diff --git a/deno.json b/deno.json
index c12bce01cd..0ba5b1fa32 100644
--- a/deno.json
+++ b/deno.json
@@ -122,6 +122,7 @@
     "./mcp": "./src/mcp/index.ts",
     "./middleware": "./src/middleware/index.ts",
     "./errors": "./src/errors/index.ts",
+    "./security": "./src/security/index.ts",
     "./observability": "./src/observability/index.ts",
     "./observability/sentry": "./src/observability/sentry.ts",
     "./observability/otlp-setup": "./src/observability/tracing/otlp-setup.ts",
diff --git a/docs/api-reference/index.md b/docs/api-reference/index.md
index ca3c9e0329..2206eca031 100644
--- a/docs/api-reference/index.md
+++ b/docs/api-reference/index.md
@@ -38,8 +38,9 @@ order: 1
 | [`veryfront/router`](./veryfront/router.md) | Client navigation and route context. |
 | [`veryfront/runs`](./veryfront/runs.md) | Canonical durable task and workflow runs. |
 | [`veryfront/sandbox`](./veryfront/sandbox.md) | Isolated execution. |
-| [`veryfront/schedule`](./veryfront/schedule.md) | Source-defined schedules for Veryfront projects. |
+| [`veryfront/schedule`](./veryfront/schedule.md) | Source-defined recurring schedules for Veryfront projects. |
 | [`veryfront/schemas`](./veryfront/schemas.md) | Validation schemas. |
+| [`veryfront/security`](./veryfront/security.md) | Security layer - input validation with size limits, CORS configuration, CSP and security headers, path traversal prevention, and secure filesystem access. |
 | [`veryfront/server`](./veryfront/server.md) | Server runtime helpers. |
 | [`veryfront/skill`](./veryfront/skill.md) | Agent skills. Public API for the agent skills system. Skills are project-level capabilities defined as SKILL.md files following the agentskills.io specification. |
 | [`veryfront/task`](./veryfront/task.md) | Source-defined tasks for Veryfront projects. |
diff --git a/docs/api-reference/veryfront/agent.md b/docs/api-reference/veryfront/agent.md
index b24d69f302..41f2d6b4d2 100644
--- a/docs/api-reference/veryfront/agent.md
+++ b/docs/api-reference/veryfront/agent.md
@@ -235,7 +235,7 @@ Clear all stored messages from memory.
 | `AGENT_DELEGATE_TOOL_PREFIX` | Prefix used for the delegate tool exposed to the coordinator agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-delegation-names.ts#L4) |
 | `AgUiDetachedStartAcceptedSchema` | Schema for AG-UI detached start accepted. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/detached-start.ts#L102) |
 | `AgUiDetachedStartRequestSchema` | Schema for AG-UI detached start request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/detached-start.ts#L98) |
-| `AgUiRequestSchema` | Schema for AG-UI request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L120) |
+| `AgUiRequestSchema` | Schema for AG-UI request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L121) |
 | `AgUiResumeSignalSchema` | Schema for AG-UI resume signal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/run-control.ts#L32) |
 | `AppendConversationRunEventsResponseSchema` | Schema for append conversation run events response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable-contracts.ts#L402) |
 | `CompleteConversationRunResponseSchema` | Schema for complete conversation run response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable-contracts.ts#L338) |
@@ -288,8 +288,8 @@ Clear all stored messages from memory.
 | `PROJECT_AGENT_KINDS` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/identity-contracts.ts#L15) |
 | `PROJECT_STEERING_FILE_MUTATION_TOOL_NAMES` | Shared project steering file mutation tool names value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/project/steering-mutation.ts#L8) |
 | `ROOT_OWNED_CHILD_RESULT_INSTRUCTION` | Shared root owned child result instruction value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L42) |
-| `RUNTIME_LOAD_SKILL_CONTINUATION_NOTE` | Legacy continuation-note fallback used when runtime tool inventory is unavailable. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L34) |
-| `RUNTIME_LOAD_SKILL_DESCRIPTION` | Shared runtime load skill description value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L38) |
+| `RUNTIME_LOAD_SKILL_CONTINUATION_NOTE` | Legacy continuation-note fallback used when runtime tool inventory is unavailable. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L48) |
+| `RUNTIME_LOAD_SKILL_DESCRIPTION` | Shared runtime load skill description value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L52) |
 | `RuntimeAgentContextItemSchema` | Schema for runtime agent context item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L125) |
 | `RuntimeAgentIdSchema` | Schema for runtime agent ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L58) |
 | `RuntimeAgentProjectContextSchema` | Schema for runtime agent project context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L217) |
@@ -303,7 +303,7 @@ Clear all stored messages from memory.
 | `RuntimeAgentToolNameSchema` | Schema for runtime agent tool name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L70) |
 | `RuntimeAgentToolSchema` | Schema for runtime agent tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L95) |
 | `RuntimeAgentValidatedClaimsSchema` | Schema for runtime agent validated claims. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L231) |
-| `RuntimeSkillFrontmatterSchema` | Schema for runtime skill frontmatter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L92) |
+| `RuntimeSkillFrontmatterSchema` | Schema for runtime skill frontmatter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L98) |
 | `SLASH_COMMAND_ARTIFACT_REMINDER` | Shared slash command artifact reminder value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L121) |
 | `SYNTHESIZE_DELEGATED_FINDINGS_IN_ROOT_VOICE` | Shared synthesize delegated findings in root voice value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L15) |
 
@@ -317,7 +317,7 @@ Clear all stored messages from memory.
 | `agent` | Agent helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/factory.ts#L133) |
 | `agentAsTool` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/composition/composition.ts#L63) |
 | `appendAgentServiceChildMirrorChunk` | Append hosted child mirror chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/child-mirror.ts#L180) |
-| `appendConversationRunEvents` | Append conversation run events. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L1058) |
+| `appendConversationRunEvents` | Append conversation run events. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L1057) |
 | `appendHostedChildMirrorChunk` | Append hosted child mirror chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/child-mirror.ts#L180) |
 | `appendMissingChildRunToolCalls` | Append missing child run tool calls. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/final-step-support.ts#L15) |
 | `appendMissingChildRunToolResults` | Append missing child run tool results. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/final-step-support.ts#L31) |
@@ -384,8 +384,8 @@ Clear all stored messages from memory.
 | `buildRootOwnedDelegatedFindingsInstruction` | Builds root owned delegated findings instruction. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L37) |
 | `buildRuntimeAgentControlPlaneStreamRequestFromInvocation` | Builds runtime agent control plane stream request from invocation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L391) |
 | `buildRuntimeAvailableSkillsPromptBlock` | Builds runtime available skills prompt block. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-prompt.ts#L112) |
-| `buildRuntimeLoadedSkillResponse` | Response payload for build runtime loaded skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L397) |
-| `buildRuntimeSkillDefinition` | Definition for build runtime skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L316) |
+| `buildRuntimeLoadedSkillResponse` | Response payload for build runtime loaded skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L425) |
+| `buildRuntimeSkillDefinition` | Definition for build runtime skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L322) |
 | `buildScheduleTraceAttributes` | Builds schedule trigger trace attributes from schedule forwarded props. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/trace-attributes.ts#L76) |
 | `buildStarterIntentRootOwnershipBlockMessage` | Message shape for build starter intent root ownership block. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L113) |
 | `buildStarterIntentRootOwnershipReminder` | Builds starter intent root ownership reminder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L108) |
@@ -429,14 +429,14 @@ Clear all stored messages from memory.
 | `createAgUiHandler` | Handler for create AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L515) |
 | `createAgUiHandler` | Handler for create AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L520) |
 | `createAgUiResumeHandler` | Handler for create AG-UI resume. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/run-control.ts#L74) |
-| `createAgUiRunErrorEvent` | Event emitted for create AG-UI run error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L428) |
+| `createAgUiRunErrorEvent` | Event emitted for create AG-UI run error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L429) |
 | `createAgUiRuntimeBrowserResponse` | Response payload for create AG-UI runtime browser. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/runtime-browser-response.ts#L29) |
 | `createAgUiRuntimeChatStreamEncoder` | Create AG-UI runtime chat stream encoder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/runtime-chat-stream-encoder.ts#L254) |
 | `createAgUiRuntimeContextMap` | Create AG-UI runtime context map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L12) |
 | `createAgUiRuntimeEventEncoder` | Create AG-UI runtime event encoder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/runtime-event-encoder.ts#L25) |
 | `createAgUiRuntimeHandler` | Handler for create AG-UI runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/runtime-handler.ts#L402) |
-| `createAgUiSseErrorResponse` | Response payload for create AG-UI sse error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L439) |
-| `createAgUiSseResponse` | Response payload for create AG-UI sse. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L452) |
+| `createAgUiSseErrorResponse` | Response payload for create AG-UI sse error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L440) |
+| `createAgUiSseResponse` | Response payload for create AG-UI sse. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L453) |
 | `createAgUiTrackedBrowserResponse` | Response payload for create AG-UI tracked browser. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/tracked-browser-response.ts#L24) |
 | `createBootstrappedHostedChatExecutionRuntime` | Create bootstrapped hosted chat execution runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-execution-runtime.ts#L439) |
 | `createChatUiMessageStreamFromDataStream` | Create chat UI message stream from data stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/chat-ui-message-stream.ts#L608) |
@@ -507,9 +507,9 @@ Clear all stored messages from memory.
 | `createRuntimeAgentDefinitionFromAgent` | Create runtime agent definition from agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/project/agent-runtime.ts#L169) |
 | `createRuntimeAgentFromMarkdownDefinition` | Definition for create runtime agent from markdown. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-markdown-adapter.ts#L8) |
 | `createRuntimeAgentSystemMessages` | Create runtime agent system messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition.ts#L244) |
-| `createRuntimeLoadSkillTool` | Create runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L574) |
-| `createRuntimeProjectFilesClient` | Create runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L104) |
-| `createRuntimeProjectSkillLoader` | Create runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L327) |
+| `createRuntimeLoadSkillTool` | Create runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L664) |
+| `createRuntimeProjectFilesClient` | Create runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L156) |
+| `createRuntimeProjectSkillLoader` | Create runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L374) |
 | `createRuntimePromptBlock` | Create runtime prompt block. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/prompt-block.ts#L9) |
 | `createStreamedStepState` | State for create streamed step. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/fork-runtime-step-state.ts#L43) |
 | `createToolExecutionDataEventBridgeStream` | Create tool execution data event bridge stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/tool-execution-data-event-bridge.ts#L41) |
@@ -584,8 +584,8 @@ Clear all stored messages from memory.
 | `getAllAgentIds` | Return all agent IDs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/composition/composition.ts#L226) |
 | `getChildRunSnapshotUsage` | Return child run snapshot usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/execution-snapshot.ts#L72) |
 | `getConfirmedProjectContextSwitchId` | Return confirmed project context switch ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/project/context.ts#L59) |
-| `getConversationRun` | Return conversation run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L982) |
-| `getConversationRunEventJsonByteLength` | Return conversation run event JSON byte length. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L25) |
+| `getConversationRun` | Return conversation run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L981) |
+| `getConversationRunEventJsonByteLength` | Return conversation run event JSON byte length. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L26) |
 | `getEmptyHostedFinalizedMessageTerminalError` | Error shape for get empty hosted finalized message terminal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/stream-terminal-error.ts#L118) |
 | `getForkRuntimeAllowedToolNames` | Return fork runtime allowed tool names. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/provider-native-tool-inventory.ts#L63) |
 | `getForwardedHostedModelId` | Return forwarded hosted model ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/runtime-request-config.ts#L86) |
@@ -601,10 +601,10 @@ Clear all stored messages from memory.
 | `getProviderNativeToolNames` | Return provider native tool names. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/provider-native-tool-inventory.ts#L44) |
 | `getProviderToolProfile` | Return provider tool profile. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/provider-tool-compat.ts#L51) |
 | `getRuntimeAgentMarkdownDefinition` | Definition for get runtime agent markdown. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-markdown-adapter.ts#L45) |
-| `getRuntimeProjectFile` | Return runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L114) |
-| `getRuntimeProjectFiles` | Return runtime project files. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L150) |
-| `getRuntimeProjectInstructions` | Return runtime project instructions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L114) |
-| `getRuntimeProjectSkillCatalog` | Return runtime project skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L134) |
+| `getRuntimeProjectFile` | Return runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L208) |
+| `getRuntimeProjectFiles` | Return runtime project files. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L328) |
+| `getRuntimeProjectInstructions` | Return runtime project instructions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L259) |
+| `getRuntimeProjectSkillCatalog` | Return runtime project skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L286) |
 | `getRuntimeUploadUrl` | Return runtime upload URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/upload-url-client.ts#L38) |
 | `getTextFromParts` | Return text from parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/types.ts#L357) |
 | `getToolArguments` | Return tool arguments. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/types.ts#L375) |
@@ -641,11 +641,11 @@ Clear all stored messages from memory.
 | `isRuntimeAgentMarkdownAgent` | Check whether a runtime agent uses markdown configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-markdown-adapter.ts#L52) |
 | `isStarterIntentRootOwnershipRequired` | Check whether starter intent root ownership is required. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/delegation-policy.ts#L237) |
 | `isSuccessfulProjectSteeringMutationResult` | Result returned from is successful project steering mutation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/project/steering-mutation.ts#L131) |
-| `listRuntimeBuiltinSkillReferenceFiles` | List runtime builtin skill reference files. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L112) |
-| `listRuntimeBuiltinSkillReferences` | List runtime builtin skill references. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L128) |
+| `listRuntimeBuiltinSkillReferenceFiles` | List runtime builtin skill reference files. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L174) |
+| `listRuntimeBuiltinSkillReferences` | List runtime builtin skill references. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L190) |
 | `loadAgentServiceEnvFiles` | Loads agent service env files. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/service/env-files.ts#L32) |
 | `loadRuntimeAgentMarkdownDefinitionFromFile` | Loads runtime agent markdown definition from file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition-files.ts#L152) |
-| `loadRuntimeBuiltinSkillCatalog` | Loads runtime builtin skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L61) |
+| `loadRuntimeBuiltinSkillCatalog` | Loads runtime builtin skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L196) |
 | `mapAgUiRuntimeEventToForkParts` | Map AG-UI runtime event to fork parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/fork-runtime-part-mapper.ts#L229) |
 | `mapFrameworkEventToForkParts` | Handles map framework event to fork parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/fork-runtime-part-mapper.ts#L408) |
 | `mapHostedStreamPartToChatUiChunks` | Map hosted stream part to chat UI chunks. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/hosted-ui-chunk-mapping.ts#L220) |
@@ -653,22 +653,22 @@ Clear all stored messages from memory.
 | `mergeToolCallInput` | Input payload for merge tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/tool-input.ts#L112) |
 | `mergeToolInputDelta` | Merge tool input delta helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/tool-input.ts#L54) |
 | `mirrorDefaultResearchRunArtifact` | Mirror default research run artifact helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/artifacts/default-research-artifact-support.ts#L299) |
-| `monitorConversationRunStatus` | Monitor conversation run status helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L999) |
+| `monitorConversationRunStatus` | Monitor conversation run status helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L998) |
 | `monitorHostedChildRunStatus` | Monitor hosted child run status helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/child-status.ts#L149) |
 | `normalizeAgUiBrowserRuntimeRequest` | Request payload for normalize AG-UI browser runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/ag-ui-contract.ts#L225) |
-| `normalizeAgUiMessages` | Normalizes AG-UI messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L384) |
+| `normalizeAgUiMessages` | Normalizes AG-UI messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L385) |
 | `normalizeAgUiRuntimeMessages` | Normalizes AG-UI runtime messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/runtime-support.ts#L44) |
 | `normalizeChatMessageMetadata` | Normalizes chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/chat-ui-message-helpers.ts#L192) |
 | `normalizeChatUiMessageChunk` | Normalizes chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/chat-ui-message-helpers.ts#L257) |
 | `normalizeChatUiMessageChunkToAgUiRuntimeEvent` | Event emitted for normalize chat UI message chunk to AG-UI runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/chat-ui-chunk-browser-encoder.ts#L217) |
 | `normalizeChatUiMessageStream` | Normalizes chat UI message stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/chat-ui-message-helpers.ts#L350) |
-| `normalizeConversationRunEvent` | Event emitted for normalize conversation run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L34) |
-| `normalizeConversationRunEvents` | Normalizes conversation run events. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L91) |
+| `normalizeConversationRunEvent` | Event emitted for normalize conversation run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L35) |
+| `normalizeConversationRunEvents` | Normalizes conversation run events. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-event-normalization.ts#L92) |
 | `normalizeEncodedConversationRunEvents` | Normalizes encoded conversation run events. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/run-events.ts#L318) |
 | `normalizeHostedChildArtifactPath` | Normalizes hosted child artifact path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/child-artifact-support.ts#L133) |
 | `normalizeParsedAgentServiceChatRequest` | Request payload for normalize parsed hosted chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-preparation.ts#L288) |
 | `normalizeParsedHostedChatRequest` | Request payload for normalize parsed hosted chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-preparation.ts#L288) |
-| `normalizeRuntimeSkillReferencePath` | Normalizes runtime skill reference path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L381) |
+| `normalizeRuntimeSkillReferencePath` | Normalizes runtime skill reference path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L409) |
 | `parseAgentServiceChatRequestFromRequest` | Request payload for parse hosted chat request from. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L427) |
 | `parseAgentServiceConfig` | Configuration used by parse agent service. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/service/config.ts#L153) |
 | `parseAgUiContextBoolean` | Parses AG-UI context boolean. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L56) |
@@ -676,8 +676,8 @@ Clear all stored messages from memory.
 | `parseAgUiContextNullableString` | Parses AG-UI context nullable string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L46) |
 | `parseAgUiContextSchema` | Zod schema for parse AG-UI context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L62) |
 | `parseAgUiContextString` | Parses AG-UI context string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L40) |
-| `parseAgUiRequest` | Request payload for parse AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L369) |
-| `parseAgUiRequestOrError` | Error shape for parse AG-UI request or. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L374) |
+| `parseAgUiRequest` | Request payload for parse AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L370) |
+| `parseAgUiRequestOrError` | Error shape for parse AG-UI request or. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L375) |
 | `parseAgUiRuntimeRequest` | Request payload for parse AG-UI runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/ag-ui-contract.ts#L249) |
 | `parseAgUiRuntimeRequestOrError` | Error shape for parse AG-UI runtime request or. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/ag-ui-contract.ts#L254) |
 | `parseAgUiSseResponse` | Parse an AG-UI SSE `Response` into normalized events, text, tool starts, and terminal error state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/sse-parser.ts#L258) |
@@ -690,8 +690,8 @@ Clear all stored messages from memory.
 | `parseRuntimeAgentRunInvocationAgentServiceChatRequestFromRequest` | Request payload for parse runtime agent run invocation hosted chat request from. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L466) |
 | `parseRuntimeAgentRunInvocationHostedChatRequestFromRequest` | Request payload for parse runtime agent run invocation hosted chat request from. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L466) |
 | `parseRuntimeAgentRunInvocationOrError` | Error shape for parse runtime agent run invocation or. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L418) |
-| `parseRuntimeSkillDocument` | Parses runtime skill document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L280) |
-| `parseRuntimeSkillMetadata` | Parses runtime skill metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L308) |
+| `parseRuntimeSkillDocument` | Parses runtime skill document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L286) |
+| `parseRuntimeSkillMetadata` | Parses runtime skill metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L314) |
 | `parseToolInputObject` | Parses tool input object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/tool-input.ts#L135) |
 | `persistConversationUserMessage` | Message shape for persist conversation user. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/bootstrap.ts#L211) |
 | `persistLatestConversationUserMessage` | Message shape for persist latest conversation user. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/bootstrap.ts#L277) |
@@ -718,11 +718,11 @@ Clear all stored messages from memory.
 | `prepareVeryfrontCloudAgentServiceChatExecution` | Prepare Veryfront Cloud hosted chat execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/cloud-chat-execution-preparation.ts#L76) |
 | `prepareVeryfrontCloudHostedChatExecution` | Prepare Veryfront Cloud hosted chat execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/cloud-chat-execution-preparation.ts#L76) |
 | `publishInvokeAgentChildRunProgress` | Publish invoke agent child run progress helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/invoke-agent-child-runs.ts#L169) |
-| `readRuntimeBuiltinDirectorySkill` | Read runtime builtin directory skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L83) |
-| `readRuntimeBuiltinFlatSkill` | Read runtime builtin flat skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L96) |
-| `readRuntimeBuiltinSkill` | Read runtime builtin skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L106) |
-| `readRuntimeBuiltinSkillEntries` | Read runtime builtin skill entries helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L30) |
-| `readRuntimeBuiltinSkillReferenceFile` | Read runtime builtin skill reference file helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L69) |
+| `readRuntimeBuiltinDirectorySkill` | Read runtime builtin directory skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L153) |
+| `readRuntimeBuiltinFlatSkill` | Read runtime builtin flat skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L162) |
+| `readRuntimeBuiltinSkill` | Read runtime builtin skill helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L168) |
+| `readRuntimeBuiltinSkillEntries` | Read runtime builtin skill entries helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L104) |
+| `readRuntimeBuiltinSkillReferenceFile` | Read runtime builtin skill reference file helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L143) |
 | `recordMirroredToolChunkState` | State for record mirrored tool chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/mirrored-tool-chunk-state.ts#L66) |
 | `recoverConversationRunAppendExecution` | Recover conversation run append execution helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L368) |
 | `recoverConversationRunAppendFailure` | Recover conversation run append failure helper. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/conversation/durable.ts#L267) |
@@ -746,8 +746,8 @@ Clear all stored messages from memory.
 | `resolveNodeHostedAgentServiceTelemetryConfig` | Configuration used by resolve node hosted agent service telemetry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/service/node-telemetry.ts#L315) |
 | `resolveRuntimeAgentDefinitionsDir` | Resolves runtime agent definitions dir. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition-files.ts#L96) |
 | `resolveRuntimeAgentMarkdownDefinitionFilePath` | Resolves runtime agent markdown definition file path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition-files.ts#L140) |
-| `resolveRuntimeBuiltinSkillReferenceFilePath` | Resolves runtime builtin skill reference file path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L47) |
-| `resolveRuntimeBuiltinSkillsDir` | Resolves runtime builtin skills dir. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L17) |
+| `resolveRuntimeBuiltinSkillReferenceFilePath` | Resolves runtime builtin skill reference file path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L121) |
+| `resolveRuntimeBuiltinSkillsDir` | Resolves runtime builtin skills dir. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L91) |
 | `resolveRuntimeClientProfile` | Resolves runtime client profile. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L103) |
 | `resolveRuntimeMessageFileUrls` | Resolves runtime message file urls. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/message-file-url-refresh.ts#L67) |
 | `resolveSingleProjectAgentRuntimeAgentId` | Resolves single project agent runtime agent ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/project/agent-runtime.ts#L239) |
@@ -841,7 +841,7 @@ Clear all stored messages from memory.
 | `RunCancelledError` | Error shape for run cancelled. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/resume-session.ts#L7) |
 | `RunNotActiveError` | Error shape for run not active. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/resume-session.ts#L23) |
 | `RunResumeSessionManager` | Implement run resume session manager. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/resume-session.ts#L92) |
-| `RuntimeProjectFilesApiAuthError` | Error shape for runtime project files API auth. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L91) |
+| `RuntimeProjectFilesApiAuthError` | Error shape for runtime project files API auth. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L143) |
 | `SummaryMemory` | Implement summary memory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/memory/memory.ts#L160) |
 | `WaitConflictError` | Error shape for wait conflict. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/resume-session.ts#L39) |
 | `WaitNotPendingError` | Error shape for wait not pending. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/resume-session.ts#L31) |
@@ -971,16 +971,16 @@ Clear all stored messages from memory.
 | `AgUiChatUiChunkBrowserEncoder` | Public API contract for AG-UI chat UI chunk browser encoder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/chat-ui-chunk-browser-encoder.ts#L16) |
 | `AgUiChunkEncoderBridge` | Public API contract for AG-UI chunk encoder bridge. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/chunk-encoder-bridge.ts#L12) |
 | `AgUiCompletion` | Payload handed to `AgUiHandlerOptions.onComplete` after an AG-UI run streams to completion successfully - the server-side counterpart to the client's `useConversationChat` persistence path. Lets an application persist the finalized conversation without reconstructing it from the SSE stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L56) |
-| `AgUiContextItem` | Public API contract for AG-UI context item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L125) |
+| `AgUiContextItem` | Public API contract for AG-UI context item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L126) |
 | `AgUiDetachedStartAccepted` | Public API contract for AG-UI detached start accepted. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/detached-start.ts#L109) |
 | `AgUiDetachedStartHandlerOptions` | Options accepted by AG-UI detached start handler. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/detached-start.ts#L225) |
 | `AgUiDetachedStartRequest` | Request payload for AG-UI detached start. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/detached-start.ts#L105) |
 | `AgUiForwardedConfigOptions` | Options accepted by AG-UI forwarded config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/forwarded-context.ts#L6) |
 | `AgUiHandlerConfigWithAgent` | Public API contract for AG-UI handler config with agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L497) |
 | `AgUiHandlerOptions` | Options accepted by AG-UI handler. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L482) |
-| `AgUiInjectedTool` | Public API contract for AG-UI injected tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L123) |
+| `AgUiInjectedTool` | Public API contract for AG-UI injected tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L124) |
 | `AgUiOnComplete` | Called once after a successful AG-UI run with the finalized conversation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/handler.ts#L83) |
-| `AgUiRequest` | Request payload for AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L127) |
+| `AgUiRequest` | Request payload for AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/host-support.ts#L128) |
 | `AgUiResumeHandlerOptions` | Options accepted by AG-UI resume handler. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/run-control.ts#L53) |
 | `AgUiResumeSignal` | Public API contract for AG-UI resume signal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/run-control.ts#L35) |
 | `AgUiResumeValue` | Public API contract for AG-UI resume value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/tool-shared.ts#L11) |
@@ -1019,15 +1019,15 @@ Clear all stored messages from memory.
 | `BuildParsedAgentServiceAgUiRequestOptions` | Options accepted by build parsed hosted AG-UI request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/ag-ui-chat-request.ts#L65) |
 | `BuildParsedHostedAgUiRequestOptions` | Options accepted by build parsed hosted AG-UI request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/ag-ui-chat-request.ts#L65) |
 | `CachedRequestAuthResult` | Result returned from cached request auth. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/service/request-auth-cache.ts#L3) |
-| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L171) |
-| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L134) |
-| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L408) |
+| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L175) |
+| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L138) |
+| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L412) |
 | `ChatUiMessageStreamFinish` | Public API contract for chat UI message stream finish. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/chat-ui-message-stream.ts#L60) |
 | `ChatUiMessageStreamFinishPart` | Public API contract for chat UI message stream finish part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/chat-ui-message-stream.ts#L25) |
 | `ChatUiMessageStreamOptions` | Options accepted by chat UI message stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/chat-ui-message-stream.ts#L69) |
-| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L159) |
-| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L144) |
-| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L151) |
+| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L163) |
+| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L148) |
+| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L155) |
 | `ChildRunExecutionBufferCleanupInput` | Input payload for child run execution buffer cleanup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/execution-cleanup.ts#L4) |
 | `ChildRunExecutionResourceFinalizeInput` | Input payload for child run execution resource finalize. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/execution-cleanup.ts#L10) |
 | `ChildRunExecutionResult` | Result returned from child run execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/child-run/execution-snapshot.ts#L39) |
@@ -1464,7 +1464,7 @@ Clear all stored messages from memory.
 | `ParsedAgUiSseRun` | Parsed AG-UI SSE response summary for evals, canaries, and host tests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/ag-ui/sse-parser.ts#L30) |
 | `ParsedHostedAgUiRequest` | Request payload for parsed hosted AG-UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/ag-ui-chat-request.ts#L60) |
 | `ParsedHostedChatRequest` | Request payload for parsed hosted chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L51) |
-| `ParsedRuntimeSkillDocument` | Public API contract for parsed runtime skill document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L252) |
+| `ParsedRuntimeSkillDocument` | Public API contract for parsed runtime skill document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L258) |
 | `ParseHostedChatRequestOptions` | Options accepted by parse hosted chat request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L78) |
 | `ParseRuntimeAgentMarkdownDefinitionInput` | Input payload for parse runtime agent markdown definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition.ts#L100) |
 | `ParseRuntimeAgentRunInvocationHostedChatRequestOptions` | Options accepted when parsing a signed control-plane runtime invocation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/hosted/chat-request-parser.ts#L92) |
@@ -1539,42 +1539,42 @@ Clear all stored messages from memory.
 | `RuntimeAgentThinkingConfig` | Configuration used by runtime agent thinking. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-definition.ts#L24) |
 | `RuntimeAgentTool` | Public API contract for runtime agent tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L344) |
 | `RuntimeAgentValidatedClaims` | Public API contract for runtime agent validated claims. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/agent-invocation-contract.ts#L362) |
-| `RuntimeBuiltinSkillEntriesResult` | Result returned from runtime builtin skill entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L6) |
+| `RuntimeBuiltinSkillEntriesResult` | Result returned from runtime builtin skill entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/builtin-skill-files.ts#L80) |
 | `RuntimeClientCapability` | Public API contract for runtime client capability. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L48) |
 | `RuntimeClientProfile` | Public API contract for runtime client profile. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L52) |
 | `RuntimeClientType` | Public API contract for runtime client type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L46) |
 | `RuntimeFileUrlResolver` | Public API contract for runtime file URL resolver. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/message-file-url-refresh.ts#L20) |
 | `RuntimeFileUrlResolverInput` | Input payload for runtime file URL resolver. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/message-file-url-refresh.ts#L13) |
-| `RuntimeGetProjectFileOptions` | Options accepted by runtime get project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L62) |
-| `RuntimeLoadedProjectSkill` | Public API contract for runtime loaded project skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L30) |
-| `RuntimeLoadedSkillResponse` | Response payload for runtime loaded skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L210) |
-| `RuntimeLoadedSkillResponseMessages` | Public API contract for runtime loaded skill response messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L201) |
-| `RuntimeLoadSkillBuiltinStore` | Public API contract for runtime load skill builtin store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L120) |
-| `RuntimeLoadSkillErrorOutput` | Output from runtime load skill error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L174) |
-| `RuntimeLoadSkillReferenceFileOutput` | Output from runtime load skill reference file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L167) |
-| `RuntimeLoadSkillToolContext` | Context for runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L109) |
-| `RuntimeLoadSkillToolInput` | Input payload for runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L162) |
-| `RuntimeLoadSkillToolMessages` | Public API contract for runtime load skill tool messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L127) |
-| `RuntimeLoadSkillToolOptions` | Options accepted by runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L130) |
-| `RuntimeLoadSkillToolOutput` | Output from runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L179) |
-| `RuntimeProjectFile` | Public API contract for runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L48) |
-| `RuntimeProjectFileListItem` | Public API contract for runtime project file list item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L50) |
-| `RuntimeProjectFilesApiOptions` | Options accepted by runtime project files API. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L55) |
-| `RuntimeProjectFilesClient` | Public API contract for runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L83) |
-| `RuntimeProjectFilesClientOptions` | Options accepted by runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L73) |
-| `RuntimeProjectFilesFetch` | Public API contract for runtime project files fetch. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L67) |
-| `RuntimeProjectFilesTrace` | Public API contract for runtime project files trace. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L70) |
-| `RuntimeProjectInstructionsOptions` | Options accepted by runtime project instructions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L43) |
-| `RuntimeProjectSkillCatalogOptions` | Options accepted by runtime project skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L32) |
-| `RuntimeProjectSkillContext` | Context for runtime project skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L14) |
-| `RuntimeProjectSkillLoader` | Public API contract for runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L52) |
-| `RuntimeProjectSkillLoaderLogger` | Public API contract for runtime project skill loader logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L36) |
-| `RuntimeProjectSkillLoaderOptions` | Options accepted by runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L41) |
-| `RuntimeProjectSteeringLookup` | Public API contract for runtime project steering lookup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L25) |
+| `RuntimeGetProjectFileOptions` | Options accepted by runtime get project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L82) |
+| `RuntimeLoadedProjectSkill` | Public API contract for runtime loaded project skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L45) |
+| `RuntimeLoadedSkillResponse` | Response payload for runtime loaded skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L216) |
+| `RuntimeLoadedSkillResponseMessages` | Public API contract for runtime loaded skill response messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L207) |
+| `RuntimeLoadSkillBuiltinStore` | Public API contract for runtime load skill builtin store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L134) |
+| `RuntimeLoadSkillErrorOutput` | Output from runtime load skill error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L201) |
+| `RuntimeLoadSkillReferenceFileOutput` | Output from runtime load skill reference file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L194) |
+| `RuntimeLoadSkillToolContext` | Context for runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L123) |
+| `RuntimeLoadSkillToolInput` | Input payload for runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L189) |
+| `RuntimeLoadSkillToolMessages` | Public API contract for runtime load skill tool messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L154) |
+| `RuntimeLoadSkillToolOptions` | Options accepted by runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L157) |
+| `RuntimeLoadSkillToolOutput` | Output from runtime load skill tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/load-skill-tool.ts#L206) |
+| `RuntimeProjectFile` | Public API contract for runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L58) |
+| `RuntimeProjectFileListItem` | Public API contract for runtime project file list item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L60) |
+| `RuntimeProjectFilesApiOptions` | Options accepted by runtime project files API. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L65) |
+| `RuntimeProjectFilesClient` | Public API contract for runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L105) |
+| `RuntimeProjectFilesClientOptions` | Options accepted by runtime project files client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L95) |
+| `RuntimeProjectFilesFetch` | Public API contract for runtime project files fetch. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L89) |
+| `RuntimeProjectFilesTrace` | Public API contract for runtime project files trace. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L92) |
+| `RuntimeProjectInstructionsOptions` | Options accepted by runtime project instructions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L141) |
+| `RuntimeProjectSkillCatalogOptions` | Options accepted by runtime project skill catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L129) |
+| `RuntimeProjectSkillContext` | Context for runtime project skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L24) |
+| `RuntimeProjectSkillLoader` | Public API contract for runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L67) |
+| `RuntimeProjectSkillLoaderLogger` | Public API contract for runtime project skill loader logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L51) |
+| `RuntimeProjectSkillLoaderOptions` | Options accepted by runtime project skill loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-loader.ts#L56) |
+| `RuntimeProjectSteeringLookup` | Public API contract for runtime project steering lookup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-skill-catalog.ts#L122) |
 | `RuntimePromptBlockOptions` | Options accepted by runtime prompt block. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/prompt-block.ts#L2) |
-| `RuntimeSkillDefinition` | Definition for runtime skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L95) |
-| `RuntimeSkillFrontmatter` | Public API contract for runtime skill frontmatter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L27) |
-| `RuntimeSkillMetadataLogger` | Public API contract for runtime skill metadata logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L228) |
+| `RuntimeSkillDefinition` | Definition for runtime skill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L101) |
+| `RuntimeSkillFrontmatter` | Public API contract for runtime skill frontmatter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L33) |
+| `RuntimeSkillMetadataLogger` | Public API contract for runtime skill metadata logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/skill-metadata.ts#L234) |
 | `RuntimeStateRequest` | Request payload for runtime state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/types.ts#L309) |
 | `RuntimeStateResolver` | Public API contract for runtime state resolver. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/types.ts#L325) |
 | `RuntimeUploadUrlClientOptions` | Options accepted by runtime upload URL client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/upload-url-client.ts#L24) |
@@ -1675,8 +1675,8 @@ Clear all stored messages from memory.
 | `runtimeClientCapabilitySchema` | Schema for runtime client capability. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L39) |
 | `runtimeClientProfileSchema` | Schema for runtime client profile. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L43) |
 | `runtimeClientTypeSchema` | Schema for runtime client type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/client-profile.ts#L35) |
-| `runtimeProjectFileListItemSchema` | Schema for runtime project file list item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L45) |
-| `runtimeProjectFileSchema` | Schema for runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L41) |
+| `runtimeProjectFileListItemSchema` | Schema for runtime project file list item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L55) |
+| `runtimeProjectFileSchema` | Schema for runtime project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/runtime/project-files-client.ts#L51) |
 
 ## Deep imports
 
diff --git a/docs/api-reference/veryfront/chat.md b/docs/api-reference/veryfront/chat.md
index 2bb282929c..7e88eab0f9 100644
--- a/docs/api-reference/veryfront/chat.md
+++ b/docs/api-reference/veryfront/chat.md
@@ -143,11 +143,11 @@ Result returned from use agent.
 | `AgentAvatar` | Render agent avatar, falling back to model identity when agent identity is absent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/agent-avatar.tsx#L24) |
 | `AgentCard` | AgentCard - render `<AgentCard {...props} />` for the default card, or compose `AgentCard.Header` / `Reasoning` / `Tools` / `Body` for a custom layout. Mirrors the `ToolCall` compound: render it, or compose it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-card.tsx#L250) |
 | `AgentPicker` | AgentPicker - render `<AgentPicker agents={...} .../>` for the default data-driven combobox, or compose `AgentPicker.Trigger`, `Content`, `Search`, `List`, `Item`, `Create`, and `Manage` for a custom menu. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-picker.tsx#L493) |
-| `AppShell` | Compound AppShell. Compose: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L529) |
-| `AttachmentPill` | AttachmentPill - render `<AttachmentPill attachment={…} />` for the default chip, or compose `AttachmentPill.Root` + `.Thumbnail` / `.Icon` / `.Label` / `.Retry` / `.Remove` for a custom layout. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L435) |
-| `AttachmentsPanel` | AttachmentsPanel - render `<AttachmentsPanel uploads={…} />` for the default panel, or compose `AttachmentsPanel.Root` + `List` / `Item` / `Empty` / `Action` for a custom layout. Mirrors the `ToolCall` / `Sources` compounds: render it, or compose it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L549) |
+| `AppShell` | Compound AppShell. Compose: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L628) |
+| `AttachmentPill` | AttachmentPill - render `<AttachmentPill attachment={…} />` for the default chip, or compose `AttachmentPill.Root` + `.Thumbnail` / `.Icon` / `.Label` / `.Retry` / `.Remove` for a custom layout. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L437) |
+| `AttachmentsPanel` | AttachmentsPanel - render `<AttachmentsPanel uploads={…} />` for the default panel, or compose `AttachmentsPanel.Root` + `List` / `Item` / `Empty` / `Action` for a custom layout. Mirrors the `ToolCall` / `Sources` compounds: render it, or compose it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L553) |
 | `BranchPicker` | Branch picker with addressable previous, count, and next leaves. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/branch-picker.tsx#L173) |
-| `Chat` | Render chat components. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/index.tsx#L321) |
+| `Chat` | Render chat components through the preset or its composable sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/chat-preset.tsx#L37) |
 | `ChatActions` | ChatActions - render `<ChatActions onAttachFiles={…} actions={…} />` for the default preset menu, or compose `ChatActions.Trigger` / `Content` / `Item` (each reads `useChatActions()`) for a custom menu. Mirrors the `ToolCall` compound: render it, or compose it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat-actions.tsx#L497) |
 | `ChatAgentPicker` | Render the connected agent switcher, or nothing when there's nothing to switch. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat-agent-picker.tsx#L63) |
 | `ChatContextProvider` | Render chat context provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/chat-context.tsx#L91) |
@@ -163,10 +163,11 @@ Result returned from use agent.
 | `CodeBlock` | Render a syntax-highlighted code block (or a mermaid diagram). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L438) |
 | `CodeSurface` | The code surface. Plain highlighted code is ALWAYS visible immediately - shiki is progressive enhancement layered on top once it lazy-loads from esm.sh (so a stalled/blocked network never leaves an empty "no code block"). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L374) |
 | `ComposerContextProvider` | Render composer context provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/composer-context.tsx#L59) |
+| `CONVERSATION_STORAGE_LIMITS` | Explicit resource limits applied on both the read and write paths. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-codec.ts#L48) |
 | `ConversationEmptyState` | State for conversation empty. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L71) |
-| `ConversationsContextProvider` | Low-level context provider (value supplied by the caller). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L32) |
+| `ConversationsContextProvider` | Low-level context provider (value supplied by the caller). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L45) |
 | `ConversationScrollButton` | Render conversation scroll button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L116) |
-| `ConversationsProvider` | ConversationsProvider - calls `useConversations` once with your `store` / `id` / `onSelect` and shares it via `ConversationsContext`. Declare persistence + router wiring here, once, at the app layout; children read it with `useConversationsContext`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L45) |
+| `ConversationsProvider` | ConversationsProvider - calls `useConversations` once with your `store` / `id` / `onSelect` and shares it via `ConversationsContext`. Declare persistence + router wiring here, once, at the app layout; children read it with `useConversationsContext`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L58) |
 | `CopyButton` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L334) |
 | `DEFAULT_CHAT_STREAM_IDLE_TIMEOUT_MS` | Default value for chat stream idle timeout ms. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L7) |
 | `DEFAULT_CHAT_STREAM_TOOL_RUNNING_TIMEOUT_MS` | Default value for chat stream tool running timeout ms. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L9) |
@@ -222,7 +223,7 @@ Result returned from use agent.
 | `isReasoningPart` | Check if a part is a reasoning part | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/utils/message-parts.ts#L82) |
 | `isSkillToolPart` | Check if a tool part is a skill-related tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/utils/message-parts.ts#L77) |
 | `isToolPart` | Check if a part is a tool part | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/utils/message-parts.ts#L32) |
-| `localConversationStore` | localStorage-backed conversation persistence. Pass a `storage` to back it with something else (tests inject an in-memory store); defaults to `localStorage`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/local-conversation-store.ts#L63) |
+| `localConversationStore` | localStorage-backed conversation persistence. Pass a `storage` to back it with another Web-Storage-like implementation. Every operation requires the Web Locks API so concurrent browser contexts cannot lose index updates. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/local-conversation-store.ts#L986) |
 | `mapHostedStreamPartToChatUiChunks` | Map hosted stream part to chat UI chunks. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/hosted-ui-chunk-mapping.ts#L220) |
 | `memoryConversationStore` | In-memory conversation persistence. Optionally seed with initial conversations. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/memory-conversation-store.ts#L22) |
 | `normalizeAgentMetadata` | Normalize a single browser-safe agent record (the `agent` object inside the `/api/agents/:id` response, or one entry of the `/api/agents` list). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent-metadata.ts#L136) |
@@ -234,23 +235,23 @@ Result returned from use agent.
 | `useAgent` | React hook for agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent.ts#L48) |
 | `useAgentMetadata` | React hook for browser-safe source-defined agent metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent-metadata.ts#L201) |
 | `useAgents` | React hook that lists the browser-safe agents a project exposes, via `GET /api/agents`. Companion to `useAgentMetadata` (single agent) - use it to drive an agent switcher, e.g. only rendering a picker when `agents.length > 1`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agents.ts#L53) |
-| `useAttachments` | `useAttachments` - the headless state hook for chat attachments: a persistent, cross-conversation registry of uploaded files with the upload / remove / list actions. This is the domain primitive; render any UI on top of it (the `AttachmentsPanel` / `AttachmentPill` components are one skin - bring your own). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L118) |
+| `useAttachments` | `useAttachments` - the headless state hook for chat attachments: a persistent, cross-conversation registry of uploaded files with the upload / remove / list actions. This is the domain primitive; render any UI on top of it (the `AttachmentsPanel` / `AttachmentPill` components are one skin - bring your own). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L352) |
 | `useChat` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-chat/use-chat.ts#L111) |
 | `useChatContextOptional` | React hook for chat context optional. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/chat-context.tsx#L86) |
 | `useChatErrorHandler` | Handler for use chat error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/error-boundary.tsx#L93) |
 | `useClipboard` | Clipboard copy hook: copies `text`, flips `copied` for ~2s. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L285) |
 | `useCompletion` | useCompletion hook for single text generation | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-completion.ts#L55) |
 | `useComposerContextOptional` | React hook for composer context optional. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/composer-context.tsx#L54) |
-| `useConversation` | Load one full conversation by id, over a swappable async store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L39) |
+| `useConversation` | Load one full conversation by id, over a swappable async store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L67) |
 | `useConversationChat` | Bind the active conversation to an isolated chat session and persistence sink. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation-chat.ts#L67) |
-| `useConversations` | List + active + persistence for conversations, over a swappable async store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L153) |
-| `useConversationsContextOptional` | Read the shared conversations state, or `null` when there is no provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L25) |
+| `useConversations` | List + active + persistence for conversations, over a swappable async store. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L302) |
+| `useConversationsContextOptional` | Read the shared conversations state, or `null` when there is no provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L38) |
 | `useMessageContextOptional` | React hook for message context optional. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/message-context.tsx#L45) |
 | `useMessageParts` | `useMessageParts` - read the current message's parts as data, so a consumer can render them however they like (the headless access point to parts; `Message.Part` is the leaf and `Message.Content` provides the default rendering). Throws outside a `Message`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/message-context.tsx#L65) |
 | `useStickToBottom` | Track and maintain "stick to bottom" for a scroll container. Attach `scrollRef` to the scrollable container and `contentRef` to the element that grows as messages / tokens arrive; the hook follows that growth while the user is pinned to the bottom. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-stick-to-bottom.ts#L51) |
 | `useStreaming` | React hook for streaming. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-streaming.ts#L41) |
-| `useUpload` | Drive file uploads and expose the resulting attachment lifecycle. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L76) |
-| `useUploadsRegistry` | `useAttachments` - the headless state hook for chat attachments: a persistent, cross-conversation registry of uploaded files with the upload / remove / list actions. This is the domain primitive; render any UI on top of it (the `AttachmentsPanel` / `AttachmentPill` components are one skin - bring your own). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L118) |
+| `useUpload` | Drive file uploads and expose the resulting attachment lifecycle. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L191) |
+| `useUploadsRegistry` | `useAttachments` - the headless state hook for chat attachments: a persistent, cross-conversation registry of uploaded files with the upload / remove / list actions. This is the domain primitive; render any UI on top of it (the `AttachmentsPanel` / `AttachmentPill` components are one skin - bring your own). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L352) |
 | `useVoiceInput` | Input payload for use voice. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-voice-input.ts#L102) |
 
 ### Classes
@@ -259,11 +260,13 @@ Result returned from use agent.
 |------|-------------|--------|
 | `ChatErrorBoundary` | Implement chat error boundary. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/error-boundary.tsx#L17) |
 | `ChatStreamIdleTimeoutError` | Error shape for chat stream idle timeout. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L49) |
+| `ConversationStoreError` | Normalized persistence failure. Store implementations should reject rather than resolve when an operation did not complete; the React hooks wrap custom adapter rejections in this error so consumers can branch on `operation` without parsing an error message. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L31) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
+| `ActiveConversationLoadFailure` | A failed provider-owned active-record load, attributed to its exact id. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L214) |
 | `AgentAvatarProps` | Props accepted by agent avatar. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/agent-avatar.tsx#L12) |
 | `AgentCardContextValue` | Per-card state shared with `AgentCard.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-card.tsx#L106) |
 | `AgentCardProps` | Props accepted by agent card. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-card.tsx#L34) |
@@ -282,22 +285,22 @@ Result returned from use agent.
 | `AgentPickerSection` | A labelled group of agents (e.g. "Connected Agents"). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-picker.tsx#L57) |
 | `AgentPickerTriggerProps` | Props for `AgentPicker.Trigger` - the pill/input combobox button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-picker.tsx#L163) |
 | `AgentTheme` | Public API contract for agent theme. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/theme.ts#L62) |
-| `AppShellHeaderProps` | Props accepted by `AppShellHeader`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L434) |
-| `AppShellOpenState` | Per-side visibility map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L94) |
-| `AppShellProps` | Props accepted by `AppShell`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L100) |
+| `AppShellHeaderProps` | Props accepted by `AppShellHeader`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L533) |
+| `AppShellOpenState` | Per-side visibility map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L155) |
+| `AppShellProps` | Props accepted by `AppShell`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L161) |
 | `AppShellSide` | Which edge a sidebar docks to. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L29) |
-| `AppShellSidebarProps` | Props accepted by `AppShellSidebar`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L230) |
-| `AppShellTriggerProps` | Props accepted by `AppShellTrigger`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L466) |
+| `AppShellSidebarProps` | Props accepted by `AppShellSidebar`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L319) |
+| `AppShellTriggerProps` | Props accepted by `AppShellTrigger`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L565) |
 | `AttachmentInfo` | Public API contract for attachment info. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L17) |
-| `AttachmentPillContextValue` | Derived per-pill view state shared with `AttachmentPill.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L143) |
-| `AttachmentPillProps` | Props accepted by attachment pill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L34) |
-| `AttachmentsPanelActionProps` | Props for `AttachmentsPanel.Action` - the upload/attach button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L496) |
-| `AttachmentsPanelContextValue` | Per-panel state shared with `AttachmentsPanel.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L42) |
-| `AttachmentsPanelEmptyProps` | Props for `AttachmentsPanel.Empty` - the no-files state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L454) |
-| `AttachmentsPanelItemProps` | Props accepted by an individual `AttachmentsPanel.Item` (attachment card). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L238) |
-| `AttachmentsPanelListProps` | Props for `AttachmentsPanel.List` - the scrollable list of file rows. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L209) |
-| `AttachmentsPanelLoadingProps` | Props for `AttachmentsPanel.Loading` - the initial-fetch placeholder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L415) |
-| `AttachmentsPanelProps` | Props accepted by `AttachmentsPanel` / `AttachmentsPanel.Root`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L64) |
+| `AttachmentPillContextValue` | Derived per-pill view state shared with `AttachmentPill.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L145) |
+| `AttachmentPillProps` | Props accepted by attachment pill. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L36) |
+| `AttachmentsPanelActionProps` | Props for `AttachmentsPanel.Action` - the upload/attach button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L500) |
+| `AttachmentsPanelContextValue` | Per-panel state shared with `AttachmentsPanel.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L43) |
+| `AttachmentsPanelEmptyProps` | Props for `AttachmentsPanel.Empty` - the no-files state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L458) |
+| `AttachmentsPanelItemProps` | Props accepted by an individual `AttachmentsPanel.Item` (attachment card). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L239) |
+| `AttachmentsPanelListProps` | Props for `AttachmentsPanel.List` - the scrollable list of file rows. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L210) |
+| `AttachmentsPanelLoadingProps` | Props for `AttachmentsPanel.Loading` - the initial-fetch placeholder. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L419) |
+| `AttachmentsPanelProps` | Props accepted by `AttachmentsPanel` / `AttachmentsPanel.Root`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L65) |
 | `BranchInfo` | Public API contract for branch info. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-chat/types.ts#L76) |
 | `BranchPickerActionProps` | Props shared by `BranchPicker.Previous` and `BranchPicker.Next`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/branch-picker.tsx#L18) |
 | `BranchPickerCountProps` | Props accepted by `BranchPicker.Count`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/branch-picker.tsx#L25) |
@@ -313,7 +316,7 @@ Result returned from use agent.
 | `ChatAgentInfo` | Agent identity + agent-driven content for `<Chat>`. Collapses the old `agent` / `models` / suggestion props into one object. In app mode (`agentId`) this is derived from agent metadata automatically; pass it yourself to drive a controlled chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/chat-props.ts#L20) |
 | `ChatAgentPickerProps` | Props accepted by `<ChatAgentPicker>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat-agent-picker.tsx#L41) |
 | `ChatContextValue` | Public API contract for chat context value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/chat-context.tsx#L20) |
-| `ChatDynamicToolPart` | Public API contract for chat dynamic tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L87) |
+| `ChatDynamicToolPart` | Public API contract for chat dynamic tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L91) |
 | `ChatEmptyProps` | Props accepted by chat empty. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-empty.tsx#L21) |
 | `ChatEmptyStateAvatarProps` | Props accepted by `<ChatEmptyState.Avatar>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-empty-state.tsx#L55) |
 | `ChatEmptyStateHeadingProps` | Props accepted by `<ChatEmptyState.Heading>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-empty-state.tsx#L89) |
@@ -321,16 +324,16 @@ Result returned from use agent.
 | `ChatEmptyStateSuggestionProps` | Props accepted by `<ChatEmptyState.Suggestion>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-empty-state.tsx#L144) |
 | `ChatEmptyStateSuggestionsProps` | Props accepted by `<ChatEmptyState.Suggestions>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-empty-state.tsx#L119) |
 | `ChatErrorBoundaryProps` | Props accepted by chat error boundary. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/error-boundary.tsx#L4) |
-| `ChatFinishReason` | Public API contract for chat finish reason. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L202) |
+| `ChatFinishReason` | Public API contract for chat finish reason. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L206) |
 | `ChatIfProps` | Props accepted by chat if. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-if.tsx#L12) |
 | `ChatInputExportProps` | Props accepted by `<ChatInput.Export>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-composer.tsx#L313) |
 | `ChatInputProps` | Props accepted by `ChatInput`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-composer.tsx#L382) |
-| `ChatMessage` | Message shape for chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L125) |
+| `ChatMessage` | Message shape for chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L129) |
 | `ChatMessageListContentProps` | Props accepted by the centered transcript column. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-message-list.tsx#L78) |
 | `ChatMessageListProps` | Props accepted by chat message list. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/chat-message-list.tsx#L25) |
-| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L171) |
-| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L134) |
-| `ChatMessagePart` | Public API contract for chat message part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L112) |
+| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L175) |
+| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L138) |
+| `ChatMessagePart` | Public API contract for chat message part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L116) |
 | `ChatMessagesSkeletonProps` | Props accepted by `<ChatMessagesSkeleton>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/chat-messages-skeleton.tsx#L36) |
 | `ChatProps` | Props accepted by chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/chat-props.ts#L34) |
 | `ChatReasoningPart` | Chat message part that carries reasoning text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L18) |
@@ -343,8 +346,8 @@ Result returned from use agent.
 | `ChatSidebarNewButtonProps` | Props accepted by `ChatSidebarNewButton`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/sidebar.tsx#L258) |
 | `ChatSidebarProps` | Props accepted by the `ChatSidebar` preset. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/sidebar.tsx#L660) |
 | `ChatSidebarRootProps` | Props accepted by `ChatSidebarRoot`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/sidebar.tsx#L205) |
-| `ChatStepPart` | Public API contract for chat step part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L100) |
-| `ChatStreamEvent` | Event emitted for chat stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L217) |
+| `ChatStepPart` | Public API contract for chat step part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L104) |
+| `ChatStreamEvent` | Event emitted for chat stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L221) |
 | `ChatStreamWatchdogOptions` | Options accepted by chat stream watchdog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L27) |
 | `ChatStreamWatchdogPhase` | Public API contract for chat stream watchdog phase. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L12) |
 | `ChatStreamWatchdogState` | State for chat stream watchdog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts#L19) |
@@ -352,23 +355,26 @@ Result returned from use agent.
 | `ChatTextPart` | Chat message part that carries text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L11) |
 | `ChatTheme` | Public API contract for chat theme. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/theme.ts#L22) |
 | `ChatThemeScopeProps` | Props accepted by `ChatThemeScope`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat-theme-scope.tsx#L23) |
-| `ChatToolPart` | Public API contract for chat tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L65) |
-| `ChatToolResultPart` | Chat message part that carries a tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L78) |
-| `ChatToolState` | State for chat tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L57) |
-| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L408) |
-| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L159) |
-| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L144) |
-| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L151) |
+| `ChatToolPart` | Public API contract for chat tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L69) |
+| `ChatToolResultPart` | Chat message part that carries a tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L82) |
+| `ChatToolState` | State for chat tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L61) |
+| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L412) |
+| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L163) |
+| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L148) |
+| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L155) |
 | `CodeBlockProps` | Props accepted by code block. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/code-block.tsx#L6) |
 | `CodeSurfaceProps` | Props accepted by `CodeSurface`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L360) |
 | `ComposerContextValue` | Public API contract for composer context value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/composer-context.tsx#L16) |
-| `Conversation` | A full conversation - metadata + its messages. Fetched via `ConversationStore.load`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L40) |
+| `Conversation` | A full conversation - metadata + its messages. Fetched via `ConversationStore.load`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L70) |
 | `ConversationEmptyStateProps` | Props accepted by conversation empty state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L62) |
-| `ConversationPatch` | Fields a conversation can be patched with. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L101) |
+| `ConversationPatch` | Fields a conversation can be patched with. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L137) |
+| `ConversationsContextValue` | Value accepted by the low-level context provider. Persistence state is optional here so existing caller-supplied structural fixtures remain compatible; `ConversationsProvider` always supplies it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L26) |
 | `ConversationScrollButtonProps` | Props accepted by conversation scroll button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L108) |
-| `ConversationsProviderProps` | Props accepted by `ConversationsProvider`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L35) |
-| `ConversationStore` | Async persistence contract for conversations. Implement all four methods; `subscribe`/`dispose` are optional capabilities (feature-detect them). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L48) |
-| `ConversationSummary` | Lightweight conversation metadata - what a list / sidebar needs (no messages). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L33) |
+| `ConversationsProviderProps` | Props accepted by `ConversationsProvider`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L48) |
+| `ConversationStorageLimits` | Named shape of the local conversation codec's public resource limits. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-codec.ts#L20) |
+| `ConversationStore` | Async persistence contract for conversations. Implement all four methods; `subscribe`/`dispose` are optional capabilities (feature-detect them). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L83) |
+| `ConversationStoreOperation` | Persistence operation associated with a `ConversationStoreError`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L23) |
+| `ConversationSummary` | Lightweight conversation metadata - what a list / sidebar needs (no messages). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/conversation-store.ts#L63) |
 | `CopyButtonProps` | Props accepted by `CopyButton`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L317) |
 | `DropZoneOverlayProps` | Props accepted by drop zone overlay. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/drop-zone.tsx#L5) |
 | `ErrorBannerProps` | Props accepted by error banner. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/composition/error-banner.tsx#L14) |
@@ -414,7 +420,7 @@ Result returned from use agent.
 | `SourcesProps` | Props accepted by `Sources` / `Sources.Root`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/sources.tsx#L44) |
 | `StepIndicatorContextValue` | Per-indicator state shared with `StepIndicator.*` sub-parts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/step-indicator.tsx#L30) |
 | `StepIndicatorProps` | Props accepted by step indicator. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/step-indicator.tsx#L7) |
-| `StorageLike` | The slice of the Web Storage API this adapter needs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/local-conversation-store.ts#L20) |
+| `StorageLike` | The slice of the Web Storage API this adapter needs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/persistence/local-conversation-store.ts#L50) |
 | `SuggestionProps` | Props accepted by suggestion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L6) |
 | `SuggestionsProps` | Props accepted by suggestions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/empty-state.tsx#L42) |
 | `TabsItemProps` | Props accepted by `<TabsItem>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/tabs.tsx#L68) |
@@ -425,14 +431,16 @@ Result returned from use agent.
 | `ToolCallProps` | Props accepted by `ToolCall` / `ToolCall.Root`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/tool-ui.tsx#L224) |
 | `ToolCallTriggerProps` | Props for `ToolCall.Trigger` - the header button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/tool-ui.tsx#L312) |
 | `ToolOutput` | Output from tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-chat/types.ts#L39) |
-| `UploadedFile` | Public API contract for uploaded file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L23) |
+| `UploadedFile` | Public API contract for uploaded file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L24) |
 | `UseAgentMetadataResult` | Result returned from useAgentMetadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent-metadata.ts#L43) |
 | `UseAgentOptions` | Options accepted by use agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent.ts#L6) |
 | `UseAgentResult` | Result returned from use agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agent.ts#L21) |
 | `UseAgentsOptions` | Options accepted by `useAgents`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agents.ts#L8) |
 | `UseAgentsResult` | Result returned from `useAgents`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-agents.ts#L17) |
-| `UseAttachmentsOptions` | Options for `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L30) |
-| `UseAttachmentsResult` | Result of `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L45) |
+| `UseAttachmentsOptions` | Options for `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L35) |
+| `UseAttachmentsRequestState` | Additive remote-request status returned by `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L82) |
+| `UseAttachmentsResult` | Result of `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L50) |
+| `UseAttachmentsStorageState` | Additive cache-status contract returned by `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L74) |
 | `UseChatOptions` | Options accepted by use chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-chat/types.ts#L58) |
 | `UseChatResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-chat/types.ts#L94) |
 | `UseClipboardResult` | Result of `useClipboard`: the copied flag + a `copy` trigger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L277) |
@@ -440,18 +448,21 @@ Result returned from use agent.
 | `UseCompletionResult` | Result returned from use completion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-completion.ts#L32) |
 | `UseConversationChatOptions` | `useConversationChat` - the library primitive that binds a `useChat` session to conversation persistence, so application code does not need to duplicate the persistence effect. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation-chat.ts#L39) |
 | `UseConversationChatResult` | Result returned by `useConversationChat`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation-chat.ts#L57) |
-| `UseConversationOptions` | Options for `useConversation`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L20) |
-| `UseConversationResult` | Result of `useConversation`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L29) |
-| `UseConversationsOptions` | Options for `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L108) |
-| `UseConversationsResult` | Result of `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L123) |
+| `UseConversationOptions` | Options for `useConversation`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L30) |
+| `UseConversationPersistenceState` | Additive persistence state returned by `useConversation`. It is kept separate from the original result interface so existing structural fixtures remain source-compatible. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L55) |
+| `UseConversationResult` | Result of `useConversation`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversation.ts#L41) |
+| `UseConversationsActiveLoadState` | Additive active-record controls returned by `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L222) |
+| `UseConversationsOptions` | Options for `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L154) |
+| `UseConversationsPersistenceState` | Additive persistence state returned by `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L204) |
+| `UseConversationsResult` | Result of `useConversations`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-conversations.ts#L171) |
 | `UseStickToBottomOptions` | Options for `useStickToBottom`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-stick-to-bottom.ts#L22) |
 | `UseStickToBottomResult` | Result of `useStickToBottom`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-stick-to-bottom.ts#L28) |
 | `UseStreamingOptions` | Options accepted by use streaming. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-streaming.ts#L5) |
 | `UseStreamingResult` | Result returned from use streaming. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-streaming.ts#L20) |
-| `UseUploadOptions` | Options for `useUpload`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L19) |
-| `UseUploadResult` | Result of `useUpload`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L30) |
-| `UseUploadsRegistryOptions` | Options for `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L30) |
-| `UseUploadsRegistryResult` | Result of `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L45) |
+| `UseUploadOptions` | Options for `useUpload`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L29) |
+| `UseUploadResult` | Result of `useUpload`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-upload.ts#L40) |
+| `UseUploadsRegistryOptions` | Options for `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L35) |
+| `UseUploadsRegistryResult` | Result of `useAttachments`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/hooks/use-uploads-registry.ts#L50) |
 | `UseVoiceInputOptions` | Options accepted by use voice input. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-voice-input.ts#L5) |
 | `UseVoiceInputResult` | Result returned from use voice input. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/agent/react/use-voice-input.ts#L29) |
 
@@ -461,13 +472,13 @@ Result returned from use agent.
 |------|-------------|--------|
 | `useAgentCard` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-card.tsx#L116) |
 | `useAgentPicker` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/agent-picker-context.tsx#L19) |
-| `useAppShell` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L47) |
-| `useAttachmentPill` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L171) |
-| `useAttachmentsPanel` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L55) |
+| `useAppShell` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L108) |
+| `useAttachmentPill` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachment-pill.tsx#L173) |
+| `useAttachmentsPanel` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/attachments-panel.tsx#L56) |
 | `useChatActions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat-actions.tsx#L304) |
 | `useChatContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/chat-context.tsx#L80) |
 | `useComposerContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/composer-context.tsx#L48) |
-| `useConversationsContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L19) |
+| `useConversationsContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/conversations-context.tsx#L30) |
 | `useMessageContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/contexts/message-context.tsx#L39) |
 | `useModelSelector` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/model-selector.tsx#L157) |
 | `useReasoning` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/chat/chat/components/reasoning.tsx#L25) |
@@ -582,28 +593,28 @@ import "veryfront/chat/protocol";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `ChatDataPart` | Public API contract for chat data part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L106) |
-| `ChatDynamicToolPart` | Public API contract for chat dynamic tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L87) |
+| `ChatDataPart` | Public API contract for chat data part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L110) |
+| `ChatDynamicToolPart` | Public API contract for chat dynamic tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L91) |
 | `ChatFilePart` | Chat message part that carries an uploaded file or image attachment. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L27) |
-| `ChatFinishReason` | Public API contract for chat finish reason. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L202) |
-| `ChatMessage` | Message shape for chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L125) |
-| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L171) |
-| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L134) |
-| `ChatMessagePart` | Public API contract for chat message part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L112) |
+| `ChatFinishReason` | Public API contract for chat finish reason. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L206) |
+| `ChatMessage` | Message shape for chat. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L129) |
+| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L175) |
+| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L138) |
+| `ChatMessagePart` | Public API contract for chat message part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L116) |
 | `ChatPartState` | Canonical chat message and stream protocol for Veryfront chat surfaces. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L8) |
 | `ChatReasoningPart` | Chat message part that carries reasoning text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L18) |
-| `ChatSourceDocumentPart` | Chat message part that carries a document citation source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L48) |
-| `ChatSourceUrlPart` | Chat message part that carries a URL citation source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L40) |
-| `ChatStepPart` | Public API contract for chat step part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L100) |
-| `ChatStreamEvent` | Event emitted for chat stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L217) |
+| `ChatSourceDocumentPart` | Chat message part that carries a document citation source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L52) |
+| `ChatSourceUrlPart` | Chat message part that carries a URL citation source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L44) |
+| `ChatStepPart` | Public API contract for chat step part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L104) |
+| `ChatStreamEvent` | Event emitted for chat stream. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L221) |
 | `ChatTextPart` | Chat message part that carries text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L11) |
-| `ChatToolPart` | Public API contract for chat tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L65) |
-| `ChatToolResultPart` | Chat message part that carries a tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L78) |
-| `ChatToolState` | State for chat tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L57) |
-| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L408) |
-| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L159) |
-| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L144) |
-| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L151) |
+| `ChatToolPart` | Public API contract for chat tool part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L69) |
+| `ChatToolResultPart` | Chat message part that carries a tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L82) |
+| `ChatToolState` | State for chat tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L61) |
+| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L412) |
+| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L163) |
+| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L148) |
+| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L155) |
 
 ### `veryfront/chat/types`
 
@@ -630,8 +641,8 @@ import { buildDataFileAnnotation, isImageFile, isTextPreviewFile } from "veryfro
 | `ChatDataUiPart` | Chat UI part that carries custom data chunks. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L161) |
 | `ChatDynamicToolUiPart` | Tool UI part for a runtime-selected tool name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L149) |
 | `ChatFileUiPart` | Public API contract for chat file UI part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L107) |
-| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L171) |
-| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L134) |
+| `ChatMessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L175) |
+| `ChatMessageMetadataUsage` | Public API contract for chat message metadata usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L138) |
 | `ChatModelFilePart` | Public API contract for chat model file part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L204) |
 | `ChatModelReasoningPart` | Provider model message part that carries reasoning text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L196) |
 | `ChatModelTextPart` | Provider model message part that carries text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L190) |
@@ -650,17 +661,17 @@ import { buildDataFileAnnotation, isImageFile, isTextPreviewFile } from "veryfro
 | `ChatToolResultOutput` | Output from chat tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L224) |
 | `ChatToolResultPart` | Provider model message part that carries a tool result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L239) |
 | `ChatUiMessage` | Message shape for chat UI. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L179) |
-| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L408) |
+| `ChatUiMessageChunk` | Public API contract for chat UI message chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L412) |
 | `ChatUiMessagePart` | Public API contract for chat UI message part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L167) |
 | `ChatUiMessageRole` | Public API contract for chat UI message role. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L68) |
 | `ChatUserContentPart` | Public API contract for chat user content part. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L248) |
 | `ChatUserMessage` | Message shape for chat user. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L265) |
-| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L159) |
-| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L144) |
-| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L151) |
+| `ChildRunAudit` | Public API contract for child run audit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L163) |
+| `ChildRunAuditToolCall` | Public API contract for child run audit tool call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L148) |
+| `ChildRunAuditToolResult` | Result returned from child run audit tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L155) |
 | `DurableRootRunDescriptor` | Public API contract for durable root run descriptor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L290) |
 | `FileUIPartWithUpload` | File UI part enriched with upload metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L115) |
-| `MessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L171) |
+| `MessageMetadata` | Public API contract for chat message metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/protocol.ts#L175) |
 | `ProjectFile` | Public API contract for project file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L309) |
 | `ProjectFileListItem` | Public API contract for project file list item. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L315) |
 | `ProviderModelMessage` | Message shape for provider model. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/types.ts#L283) |
@@ -692,7 +703,7 @@ import { createChatUploadHandler } from "veryfront/chat/uploads";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `createChatUploadHandler` | Build `{ POST, GET, DELETE }` route handlers for chat attachments. Auto-selects local disk storage in dev and Veryfront Cloud once deployed, or the `storage` you provide. `DELETE ?id=` removes the file from storage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/upload-handler.ts#L115) |
+| `createChatUploadHandler` | Build `{ POST, GET, DELETE }` route handlers for chat attachments. Auto-selects local disk storage in dev and Veryfront Cloud once deployed, or the `storage` you provide. `DELETE ?id=` removes the file from storage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/chat/upload-handler.ts#L116) |
 
 #### Types
 
diff --git a/docs/api-reference/veryfront/context.md b/docs/api-reference/veryfront/context.md
index 6a92f81ce2..a1a04a4355 100644
--- a/docs/api-reference/veryfront/context.md
+++ b/docs/api-reference/veryfront/context.md
@@ -22,18 +22,18 @@ import { PageContextProvider, usePageContext } from "veryfront/context";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `PageContextProvider` | Provides page context to route and MDX descendants. Page-authored fields (`frontmatter`, `slug`, `headings`) come from the `pageContext` prop; the location fields (`path`, `query`, `params`) are derived from the router so they stay reactive and there is a single source of truth - `usePageContext()` exposes the same `query`/`pathname` as `useRouter()`. When rendered outside a `RouterProvider` (no live router) it falls back to the seed's own location. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L420) |
+| `PageContextProvider` | Provides page context to route and MDX descendants. Page-authored fields (`frontmatter`, `slug`, `headings`) come from the `pageContext` prop; the location fields (`path`, `query`, `params`) are derived from the router so they stay reactive and there is a single source of truth - `usePageContext()` exposes the same `query`/`pathname` as `useRouter()`. When rendered outside a `RouterProvider` (no live router) it falls back to the seed's own location. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L408) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `usePageContext` | Reads the current page context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L444) |
+| `usePageContext` | Reads the current page context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L432) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `MdxHeading` | Heading metadata extracted from MDX content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L52) |
-| `PageContextProviderProps` | Props accepted by `<PageContextProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L99) |
-| `PageContextValue` | Page context exposed to route and MDX components. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L62) |
+| `MdxHeading` | Heading metadata extracted from MDX content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L60) |
+| `PageContextProviderProps` | Props accepted by `<PageContextProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L107) |
+| `PageContextValue` | Page context exposed to route and MDX components. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L70) |
diff --git a/docs/api-reference/veryfront/embedding.md b/docs/api-reference/veryfront/embedding.md
index b40a893608..b5a46e6b86 100644
--- a/docs/api-reference/veryfront/embedding.md
+++ b/docs/api-reference/veryfront/embedding.md
@@ -36,7 +36,7 @@ export const { POST, GET, DELETE } = createUploadHandler(store, {
 |------|-------------|--------|
 | `chunk` | Splits text into overlapping chunks for embedding. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/chunk.ts#L24) |
 | `clearEmbeddingProviders` | Clear all registered embedding providers (for testing). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/resolve.ts#L154) |
-| `createUploadHandler` | Creates HTTP route handlers for upload, listing, and deletion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-handler.ts#L256) |
+| `createUploadHandler` | Creates HTTP route handlers for upload, listing, and deletion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-handler.ts#L248) |
 | `embedding` | Creates an embedding facade. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/embedding.ts#L28) |
 | `loadUpload` | Extracts embedding-ready text or Markdown from upload formats. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-loader.ts#L19) |
 | `ragStore` | Creates a persistent RAG store with lazy embedding and similarity search. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/rag-store.ts#L174) |
diff --git a/docs/api-reference/veryfront/extensions.md b/docs/api-reference/veryfront/extensions.md
index ae080ac470..48cffe597e 100644
--- a/docs/api-reference/veryfront/extensions.md
+++ b/docs/api-reference/veryfront/extensions.md
@@ -52,49 +52,49 @@ await loader.teardownAll();
 | Name | Description | Source |
 |------|-------------|--------|
 | `assertImageOptimizationEngine` | Validate an implementation received through the dynamic contract registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/image/image-optimization-engine.ts#L137) |
-| `assertSystemReadCapability` | Validate the bounded scope required by a `system:read` capability. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L145) |
-| `auditCapabilities` | Log capabilities for a named extension at startup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L280) |
+| `assertSystemReadCapability` | Validate the bounded scope required by a `system:read` capability. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L781) |
+| `auditCapabilities` | Log capabilities for a named extension at startup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L842) |
 | `captureImageOptimizationEngine` | Capture dynamic properties once so one run cannot split across mutations. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/image/image-optimization-engine.ts#L144) |
 | `captureRedisRuntimeProvider` | Validate and snapshot a provider before core invokes extension-owned code. Accessors are rejected so registration cannot execute code during capture. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/distributed/redis-runtime-provider.ts#L485) |
 | `composeAbortSignals` | Compose cancellation sources without depending on a mutable host `AbortSignal.any` implementation. The first source to abort owns the exact propagated reason, and listeners on every remaining source are detached immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/abort-signal.ts#L7) |
-| `detectConflicts` | Detect contract conflicts between resolved extensions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L155) |
+| `detectConflicts` | Detect contract conflicts between resolved extensions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L515) |
 | `discoverLocalExtensions` | Find `*.extension.ts` files in the project root. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L543) |
 | `discoverPackageExtensions` | Discover auto-activated package extensions without exposing identity internals. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L396) |
 | `discoverProjectExtensions` | Discover project extension paths without exposing identity internals. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L530) |
-| `formatCapabilities` | Format capabilities as human-readable strings for logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L24) |
+| `formatCapabilities` | Format capabilities as human-readable strings for logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L36) |
 | `getRecommendation` | Return recommendation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/recommendations.ts#L34) |
-| `isSupportedDenoSystemReadApi` | Return whether a Deno system permission name is explicitly read-only. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L69) |
+| `isSupportedDenoSystemReadApi` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L110) |
 | `loadExtensionFactory` | Dynamically import an extension factory from `path` and resolve it. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/factory-loader.ts#L100) |
-| `mapToDenoPermissions` | Map capabilities to Deno CLI permission flags. Skips capabilities without a Deno permission mapping. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L236) |
+| `mapToDenoPermissions` | Map capabilities to Deno CLI permission flags. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/capabilities.ts#L795) |
 | `mergeExtensions` | Merge extensions from all four sources in priority order. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L225) |
-| `orchestrateExtensions` | Run the full extension pipeline against a resolved project config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/orchestrate.ts#L125) |
+| `orchestrateExtensions` | Run the full extension pipeline against a resolved project config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/orchestrate.ts#L138) |
 | `parsePackageMetadata` | Parse veryfront extension metadata from a package.json-like object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L185) |
-| `resolve` | Resolve path segments to an absolute path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L13) |
-| `tryResolve` | Try to resolve. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L28) |
-| `validateExtension` | Validate the shape of an extension object. Returns an array of issue descriptions (empty array = valid). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L85) |
+| `resolve` | Resolve path segments to an absolute path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L18) |
+| `tryResolve` | Try to resolve. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L34) |
+| `validateExtension` | Validate the shape of an extension object. Returns an array of issue descriptions (empty array = valid). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L354) |
 
 ### Classes
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `ExtensionLoader` | Implement extension loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/loader.ts#L31) |
+| `ExtensionLoader` | Implement extension loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/loader.ts#L214) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
 | `Capability` | Declares a system capability an extension requires. Object-based for extensibility -- scoping fields vary by type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L11) |
-| `ConflictInfo` | Information about a contract conflict between extensions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L13) |
+| `ConflictInfo` | Information about a contract conflict between extensions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/validation.ts#L30) |
 | `CreateSandboxShellToolsInput` | Input payload for create sandbox shell tools. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/sandbox/shell-tools.ts#L38) |
 | `DiscoveredPackageExtension` | A package extension whose manifest is bound to one physical import target. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L42) |
-| `Extension` | Public API contract for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L46) |
+| `Extension` | Public API contract for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L50) |
 | `ExtensionActivationMode` | Controls whether installation alone may activate an extension package. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L39) |
-| `ExtensionConfigEntry` | Entry shape for extension config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L61) |
+| `ExtensionConfigEntry` | Entry shape for extension config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L65) |
 | `ExtensionContext` | Context for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L27) |
 | `ExtensionContractMetadata` | Public API contract for extension contract metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L17) |
-| `ExtensionFactory` | Public API contract for extension factory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L58) |
-| `ExtensionLogger` | Public API contract for extension logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L38) |
-| `ExtensionSource` | Public API contract for extension source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L66) |
+| `ExtensionFactory` | Public API contract for extension factory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L62) |
+| `ExtensionLogger` | Public API contract for extension logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L42) |
+| `ExtensionSource` | Public API contract for extension source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L70) |
 | `ImageOptimizationEngine` | Image decoder, resizer, and encoder implemented by an explicit extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/image/image-optimization-engine.ts#L71) |
 | `ImageOptimizationFormat` | Formats core can request from an image optimization engine. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/image/image-optimization-engine.ts#L29) |
 | `ImageOptimizationRequest` | Immutable byte-oriented request supplied by core. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/image/image-optimization-engine.ts#L32) |
@@ -103,7 +103,7 @@ await loader.teardownAll();
 | `OrchestrateOptions` | Options for `orchestrateExtensions`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/orchestrate.ts#L30) |
 | `PackageMetadata` | Metadata extracted from a package.json that declares itself as a veryfront extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/discovery.ts#L27) |
 | `RedisRuntimeProvider` | Optional Redis runtime implementation supplied by an extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/distributed/redis-runtime-provider.ts#L150) |
-| `ResolvedExtension` | Public API contract for resolved extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L74) |
+| `ResolvedExtension` | Public API contract for resolved extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L78) |
 | `SandboxShellClient` | Public API contract for sandbox shell client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/sandbox/shell-tools.ts#L30) |
 | `SandboxShellToolDefinition` | Definition for sandbox shell tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/sandbox/shell-tools.ts#L13) |
 | `SandboxShellToolExecute` | Public API contract for sandbox shell tool execute. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/sandbox/shell-tools.ts#L8) |
@@ -253,11 +253,11 @@ import { register, reset, resolve } from "veryfront/extensions/contracts";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `register` | Register. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L33) |
-| `reset` | Reset. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L43) |
-| `resolve` | Resolve path segments to an absolute path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L13) |
-| `tryResolve` | Try to resolve. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L28) |
-| `unregister` | Unregister. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L38) |
+| `register` | Register. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L40) |
+| `reset` | Reset. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L55) |
+| `resolve` | Resolve path segments to an absolute path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L18) |
+| `tryResolve` | Try to resolve. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L34) |
+| `unregister` | Unregister. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/contracts.ts#L49) |
 
 ### `veryfront/extensions/css`
 
@@ -365,29 +365,29 @@ import { createEvalReportExporterRegistry, redactEvalReportForExport, EvalReport
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `EvalReportExporterRegistryName` | Contract name used for `resolve()` / `provide()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L14) |
-| `EvalReportRedactedValue` | Sentinel used when record payload fields are removed for external export. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L20) |
+| `EvalReportExporterRegistryName` | Contract name used for `resolve()` / `provide()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L16) |
+| `EvalReportRedactedValue` | Sentinel used when record payload fields are removed for external export. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L22) |
 
 #### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `createEvalReportExporterRegistry` | Create an eval report exporter registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L303) |
-| `redactEvalReportForExport` | Create an eval report copy with external-export redaction applied. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L223) |
+| `createEvalReportExporterRegistry` | Create an eval report exporter registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L304) |
+| `redactEvalReportForExport` | Create an eval report copy with external-export redaction applied. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L225) |
 
 #### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `EvalReportExportContext` | Context passed to eval report exporters. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L54) |
-| `EvalReportExporter` | Vendor or backend implementation that receives sanitized eval reports. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L78) |
-| `EvalReportExporterRegistry` | Registry contract. Single impl created at bootstrap. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L107) |
-| `EvalReportExportFailure` | Failed exporter result. Failures are captured so later exporters still run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L95) |
-| `EvalReportExportReceipt` | Optional receipt returned by a vendor exporter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L71) |
-| `EvalReportExportRedaction` | Redaction policy applied before reports leave the process. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L23) |
-| `EvalReportExportResult` | Result for one exporter invocation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L102) |
-| `EvalReportExportSuccess` | Successful exporter result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L88) |
-| `EvalReportExportTraceContext` | Trace correlation fields that connect eval exports to runtime spans. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L47) |
+| `EvalReportExportContext` | Context passed to eval report exporters. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L56) |
+| `EvalReportExporter` | Vendor or backend implementation that receives sanitized eval reports. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L80) |
+| `EvalReportExporterRegistry` | Registry contract. Single impl created at bootstrap. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L109) |
+| `EvalReportExportFailure` | Failed exporter result. Failures are captured so later exporters still run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L97) |
+| `EvalReportExportReceipt` | Optional receipt returned by a vendor exporter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L73) |
+| `EvalReportExportRedaction` | Redaction policy applied before reports leave the process. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L25) |
+| `EvalReportExportResult` | Result for one exporter invocation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L104) |
+| `EvalReportExportSuccess` | Successful exporter result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L90) |
+| `EvalReportExportTraceContext` | Trace correlation fields that connect eval exports to runtime spans. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/eval/eval-report-exporter.ts#L49) |
 
 ### `veryfront/extensions/first-party-import`
 
@@ -461,7 +461,7 @@ import { createLLMProviderRegistry, LLMProviderRegistryName } from "veryfront/ex
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `createLLMProviderRegistry` | Create llmprovider registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/llm/llm-provider-registry.ts#L49) |
+| `createLLMProviderRegistry` | Create llmprovider registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/llm/llm-provider-registry.ts#L66) |
 
 #### Types
 
@@ -565,12 +565,17 @@ import "veryfront/extensions/schema";
 | `InferInput` | Extracts the inferred *input* type from a `Schema<T>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L111) |
 | `InferSchema` | Extracts the inferred output type `T` from a `Schema<T>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L100) |
 | `InferShape` | Maps a raw object shape to its inferred object type, preserving optionality. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L114) |
-| `JsonSchema` | Minimal JSON Schema type used by the `SchemaValidator` contract for `toJsonSchema()`. Kept in the extensions/schema category so the contract can reference it without depending on any non-leaf module. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L9) |
+| `JsonSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L18) |
+| `JsonSchemaValidationFailure` | Failed validation of an input against a compiled JSON Schema. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L173) |
+| `JsonSchemaValidationFunction` | Compiled, reusable JSON Schema validation function. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L185) |
+| `JsonSchemaValidationIssue` | Stable validation issue copied from a JSON Schema validator result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L152) |
+| `JsonSchemaValidationResult` | Result returned by a compiled JSON Schema validator. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L180) |
+| `JsonSchemaValidationSuccess` | Successful validation of an input against a compiled JSON Schema. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L166) |
 | `RefinementCtx` | Context passed to a `superRefine` callback. Provides `addIssue` to emit one or more validation issues and `path` to locate the current value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L92) |
 | `Schema` | An opaque schema definition that validates and infers type `T`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L22) |
-| `SchemaFactory` | Factory type accepted by `defineSchema`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L257) |
-| `SchemaValidator` | SchemaValidator contract interface. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L169) |
-| `SchemaValidatorCoerce` | Namespace for `coerce.*` constructors - accepts input in any form and coerces to the target type before validation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L155) |
+| `SchemaFactory` | Factory type accepted by `defineSchema`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L305) |
+| `SchemaValidator` | SchemaValidator contract interface. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L207) |
+| `SchemaValidatorCoerce` | Namespace for `coerce.*` constructors - accepts input in any form and coerces to the target type before validation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L193) |
 | `ValidationFailure` | Failed validation outcome. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L140) |
 | `ValidationIssue` | A single validation issue with location context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L123) |
 | `ValidationResult` | Discriminated union of validation outcomes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/schema-validator.ts#L149) |
@@ -589,15 +594,15 @@ import "veryfront/extensions/types";
 | Name | Description | Source |
 |------|-------------|--------|
 | `Capability` | Declares a system capability an extension requires. Object-based for extensibility -- scoping fields vary by type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L11) |
-| `Extension` | Public API contract for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L46) |
-| `ExtensionConfigEntry` | Entry shape for extension config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L61) |
+| `Extension` | Public API contract for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L50) |
+| `ExtensionConfigEntry` | Entry shape for extension config. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L65) |
 | `ExtensionContext` | Context for extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L27) |
 | `ExtensionContractMetadata` | Public API contract for extension contract metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L17) |
-| `ExtensionFactory` | Public API contract for extension factory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L58) |
-| `ExtensionLogger` | Public API contract for extension logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L38) |
-| `ExtensionSource` | Public API contract for extension source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L66) |
+| `ExtensionFactory` | Public API contract for extension factory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L62) |
+| `ExtensionLogger` | Public API contract for extension logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L42) |
+| `ExtensionSource` | Public API contract for extension source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L70) |
 | `PackageContractMetadata` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L24) |
-| `ResolvedExtension` | Public API contract for resolved extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L74) |
+| `ResolvedExtension` | Public API contract for resolved extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/types.ts#L78) |
 
 ### `veryfront/extensions/websocket`
 
diff --git a/docs/api-reference/veryfront/fs.md b/docs/api-reference/veryfront/fs.md
index dfb49a2329..8fb0b71f97 100644
--- a/docs/api-reference/veryfront/fs.md
+++ b/docs/api-reference/veryfront/fs.md
@@ -24,9 +24,9 @@ import {
 ```ts
 import { exists, mkdir, readTextFile, writeTextFile } from "veryfront/fs";
 
-const content = await readTextFile("./data/config.json");
-await writeTextFile("./output/result.json", JSON.stringify(data));
+const data = JSON.parse(await readTextFile("./data/config.json"));
 await mkdir("./output", { recursive: true });
+await writeTextFile("./output/result.json", JSON.stringify(data));
 ```
 
 ### Path utilities
@@ -53,31 +53,31 @@ const configPath = resolve(cwd(), "veryfront.config.ts");
 | Name | Description | Source |
 |------|-------------|--------|
 | `basename` | Return the last path segment. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/path/basic-operations.ts#L36) |
-| `createFileSystem` | Create file system. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L403) |
-| `cwd` | Return the current working directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L21) |
+| `createFileSystem` | Create the runtime-native filesystem implementation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L438) |
+| `cwd` | Return the current working directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L26) |
 | `dirname` | Return the parent directory path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/path/basic-operations.ts#L29) |
-| `exists` | Check whether a path exists. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L435) |
+| `exists` | Return false for a missing path and propagate every other filesystem error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L511) |
 | `extname` | Return the file extension for a path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/path/basic-operations.ts#L44) |
-| `isFileSnapshotChangedError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/adapters/file-snapshot-error.ts#L12) |
-| `isNotFoundError` | Return whether an error or its cause chain represents a path that cannot be resolved. ENOTDIR is included because a missing candidate beneath a file is just as absent as an ENOENT candidate during filesystem lookup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/not-found-error.ts#L16) |
+| `isFileSnapshotChangedError` | Return whether a value is a framework-created file snapshot change error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/adapters/file-snapshot-error.ts#L14) |
+| `isNotFoundError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/not-found-error.ts#L210) |
 | `join` | Join and normalize path segments using their detected path flavor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/path/basic-operations.ts#L18) |
-| `lstat` | Read file metadata without following a terminal symbolic link. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L445) |
-| `mkdir` | Create a directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L469) |
-| `readDir` | Read directory entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L479) |
-| `readTextFile` | Read a file as text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L415) |
-| `realPath` | Resolve a path to its canonical absolute form, following symlinks. Throws if the path does not exist. Useful for containment checks where a symlink could otherwise escape an intended directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L515) |
-| `remove` | Remove a file or directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L474) |
+| `lstat` | Read file metadata without following a terminal symbolic link. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L521) |
+| `mkdir` | Create a directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L561) |
+| `readDir` | Read directory entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L571) |
+| `readTextFile` | Read a file as text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L491) |
+| `realPath` | Resolve a path to its canonical absolute form, following symlinks. Throws if the path does not exist. Useful for containment checks where a symlink could otherwise escape an intended directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L607) |
+| `remove` | Remove a file or directory, rejecting when the path does not exist. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L566) |
 | `resolve` | Resolve path segments to an absolute, normalized path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/path/resolution.ts#L18) |
-| `writeTextFile` | Write text to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L425) |
+| `writeTextFile` | Write text to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L501) |
 
 ### Classes
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `FileSnapshotChangedError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/adapters/file-snapshot-error.ts#L3) |
+| `FileSnapshotChangedError` | Error raised when a file changes while a stable snapshot is being read. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/adapters/file-snapshot-error.ts#L4) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `FileSystem` | Public API contract for file system. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L25) |
+| `FileSystem` | Runtime-neutral filesystem contract. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L83) |
diff --git a/docs/api-reference/veryfront/head.md b/docs/api-reference/veryfront/head.md
index 51248d5bf1..4cd9555b12 100644
--- a/docs/api-reference/veryfront/head.md
+++ b/docs/api-reference/veryfront/head.md
@@ -22,4 +22,4 @@ import { Head } from "veryfront/head";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `Head` | Applies document head elements during SSR and client rendering. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L471) |
+| `Head` | Applies document head elements during SSR and client rendering. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L459) |
diff --git a/docs/api-reference/veryfront/index.client.md b/docs/api-reference/veryfront/index.client.md
index e0223d0651..dd5f21a2b2 100644
--- a/docs/api-reference/veryfront/index.client.md
+++ b/docs/api-reference/veryfront/index.client.md
@@ -33,34 +33,34 @@ export function GET() {
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L65) |
+| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L91) |
 | `INPUT_VALIDATION_FAILED` | HTTP request input validation failures (replaces ValidationError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L86) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `apiNotFound` | Create a 404 Not Found response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L114) |
-| `apiRedirect` | Create an HTTP redirect response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L92) |
-| `badRequest` | Create a 400 Bad Request response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L119) |
-| `createValidatedHandler` | Create a validated API handler wrapper that auto-validates body/query with Zod schemas | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L20) |
-| `createValidationError` | Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L11) |
-| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L6) |
-| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L11) |
-| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L129) |
-| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L117) |
+| `apiNotFound` | Create a 404 Not Found response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L119) |
+| `apiRedirect` | Create an HTTP redirect response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L97) |
+| `badRequest` | Create a 400 Bad Request response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L124) |
+| `createValidatedHandler` | Create a validated API handler with bounded body/query validation. Bodies without a schema are preflighted through a clone, leaving the original request body available to the handler after its size is verified. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L163) |
+| `createValidationError` | Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L12) |
+| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L4) |
+| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L8) |
+| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
+| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L106) |
 | `json` | Create a JSON response with the correct content type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L67) |
-| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L19) |
-| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L20) |
-| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L21) |
+| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L17) |
+| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L18) |
+| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L19) |
 | `notFound` | Render the 404 page from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L45) |
-| `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L48) |
-| `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L12) |
-| `parseQueryParams` | Parse and validate query parameters from a request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L81) |
+| `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L133) |
+| `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L67) |
+| `parseQueryParams` | Parse and validate query parameters from a bounded request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L189) |
 | `redirect` | Redirect the request from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L34) |
-| `sanitizeData` | Sanitize data to prevent XSS and prototype pollution attacks. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L2) |
-| `serverError` | Create a 500 Internal Server Error response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
-| `unauthorized` | Create a 401 Unauthorized response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L124) |
+| `sanitizeData` | Sanitize JSON-like data by HTML-encoding string values and removing keys that can mutate an object's prototype chain. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L8) |
+| `serverError` | Create a 500 Internal Server Error response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L139) |
+| `unauthorized` | Create a 401 Unauthorized response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L129) |
 
 ### Types
 
@@ -77,8 +77,8 @@ export function GET() {
 | `PageWithData` | Page with data fetching capabilities | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/types.ts#L16) |
 | `StartServerOptions` | Server options. Defaults to development mode with HMR. Set `mode: "production"` for a production server. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L138) |
 | `StaticPathsResult` | Return type for `getStaticPaths()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/schemas/data.schema.ts#L61) |
-| `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L7) |
-| `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L14) |
-| `VeryfrontConfig` | Project configuration. The underlying zod schema stores `extensions` as `unknown[]`; this tightened alias surfaces the expected `ExtensionConfigEntry[]` shape to TypeScript consumers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/schemas/index.ts#L25) |
+| `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L11) |
+| `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L18) |
+| `VeryfrontConfig` | Project configuration. The underlying runtime schema stores `extensions` as `unknown[]`; this tightened alias surfaces the expected `ExtensionConfigEntry[]` shape to TypeScript consumers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/schemas/index.ts#L24) |
 | `VeryfrontHandler` | Web API request handler with WebSocket upgrade and HMR helpers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L153) |
 | `VeryfrontServer` | Running server instance with lifecycle controls. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L141) |
diff --git a/docs/api-reference/veryfront/index.md b/docs/api-reference/veryfront/index.md
index aae7754838..66acb4f225 100644
--- a/docs/api-reference/veryfront/index.md
+++ b/docs/api-reference/veryfront/index.md
@@ -58,37 +58,37 @@ export function getServerData(ctx: DataContext) {
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L65) |
+| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L91) |
 | `INPUT_VALIDATION_FAILED` | HTTP request input validation failures (replaces ValidationError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L86) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `apiNotFound` | Create a 404 Not Found response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L114) |
-| `apiRedirect` | Create an HTTP redirect response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L92) |
-| `badRequest` | Create a 400 Bad Request response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L119) |
+| `apiNotFound` | Create a 404 Not Found response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L119) |
+| `apiRedirect` | Create an HTTP redirect response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L97) |
+| `badRequest` | Create a 400 Bad Request response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L124) |
 | `createHandler` | Create a Veryfront request handler for development or production. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L233) |
-| `createValidatedHandler` | Create a validated API handler wrapper that auto-validates body/query with Zod schemas | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L20) |
-| `createValidationError` | Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L11) |
-| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L6) |
-| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L11) |
-| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L129) |
-| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L117) |
+| `createValidatedHandler` | Create a validated API handler with bounded body/query validation. Bodies without a schema are preflighted through a clone, leaving the original request body available to the handler after its size is verified. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L163) |
+| `createValidationError` | Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L12) |
+| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L4) |
+| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L8) |
+| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
+| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L106) |
 | `json` | Create a JSON response with the correct content type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L67) |
-| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L19) |
-| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L20) |
-| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L21) |
+| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L17) |
+| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L18) |
+| `mergeConfigs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L19) |
 | `notFound` | Render the 404 page from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L45) |
-| `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L48) |
-| `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L12) |
-| `parseQueryParams` | Parse and validate query parameters from a request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L81) |
+| `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L133) |
+| `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L67) |
+| `parseQueryParams` | Parse and validate query parameters from a bounded request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L189) |
 | `redirect` | Redirect the request from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L34) |
-| `sanitizeData` | Sanitize data to prevent XSS and prototype pollution attacks. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L2) |
-| `serverError` | Create a 500 Internal Server Error response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
+| `sanitizeData` | Sanitize JSON-like data by HTML-encoding string values and removing keys that can mutate an object's prototype chain. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L8) |
+| `serverError` | Create a 500 Internal Server Error response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L139) |
 | `startServer` | Start a Veryfront server in development or production mode. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L520) |
 | `toNodeHandler` | Convert a Web API request handler into a Node.js HTTP listener. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/node-handler.ts#L4) |
-| `unauthorized` | Create a 401 Unauthorized response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L124) |
+| `unauthorized` | Create a 401 Unauthorized response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L129) |
 
 ### Types
 
@@ -105,8 +105,8 @@ export function getServerData(ctx: DataContext) {
 | `PageWithData` | Page with data fetching capabilities | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/types.ts#L16) |
 | `StartServerOptions` | Server options. Defaults to development mode with HMR. Set `mode: "production"` for a production server. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L138) |
 | `StaticPathsResult` | Return type for `getStaticPaths()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/schemas/data.schema.ts#L61) |
-| `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L7) |
-| `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L14) |
-| `VeryfrontConfig` | Project configuration. The underlying zod schema stores `extensions` as `unknown[]`; this tightened alias surfaces the expected `ExtensionConfigEntry[]` shape to TypeScript consumers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/schemas/index.ts#L25) |
+| `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L11) |
+| `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L18) |
+| `VeryfrontConfig` | Project configuration. The underlying runtime schema stores `extensions` as `unknown[]`; this tightened alias surfaces the expected `ExtensionConfigEntry[]` shape to TypeScript consumers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/schemas/index.ts#L24) |
 | `VeryfrontHandler` | Web API request handler with WebSocket upgrade and HMR helpers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L153) |
 | `VeryfrontServer` | Running server instance with lifecycle controls. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/server/index.ts#L141) |
diff --git a/docs/api-reference/veryfront/middleware.md b/docs/api-reference/veryfront/middleware.md
index 78a8621ffd..212dc647f8 100644
--- a/docs/api-reference/veryfront/middleware.md
+++ b/docs/api-reference/veryfront/middleware.md
@@ -143,7 +143,7 @@ Options accepted by timeout.
 | Name | Description | Source |
 |------|-------------|--------|
 | `authRateLimit` | Pre-configured rate limiter for authentication endpoints (5 req/15min). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/middleware/builtin/security/rate-limit.ts#L140) |
-| `cors` | Create CORS middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L9) |
+| `cors` | Create CORS middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L10) |
 | `devLogger` | Create development request logging middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/middleware/builtin/logger.ts#L244) |
 | `getTimeoutFromEnv` | Gets timeout from environment variable REQUEST_TIMEOUT_MS | [source](https://github.com/veryfront/veryfront-code/blob/main/src/middleware/builtin/timeout.ts#L94) |
 | `logger` | Create request logging middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/middleware/builtin/logger.ts#L191) |
diff --git a/docs/api-reference/veryfront/provider.md b/docs/api-reference/veryfront/provider.md
index 19013cba03..0720464ca3 100644
--- a/docs/api-reference/veryfront/provider.md
+++ b/docs/api-reference/veryfront/provider.md
@@ -140,7 +140,7 @@ import { buildProviderError, createAnthropicRequestInit, createGoogleRequestInit
 | `createAnthropicRequestInit` | Create Anthropic request init. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-request-init.ts#L74) |
 | `createGoogleRequestInit` | Create Google request init. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-request-init.ts#L96) |
 | `createOpenAIRequestInit` | Create request init options for OpenAI-compatible providers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-request-init.ts#L55) |
-| `createWarningCollector` | Create warning collector. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L338) |
+| `createWarningCollector` | Create warning collector. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L326) |
 | `getAnthropicMessagesUrl` | Return Anthropic messages URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-endpoints.ts#L15) |
 | `getGoogleEmbeddingUrl` | Return Google embedding URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-endpoints.ts#L52) |
 | `getGoogleGenerateContentUrl` | Return Google generate content URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-endpoints.ts#L30) |
@@ -153,15 +153,15 @@ import { buildProviderError, createAnthropicRequestInit, createGoogleRequestInit
 | `parseRetryAfterMs` | Parses retry after ms. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-http.ts#L76) |
 | `parseSseChunk` | Parses sse chunk. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-sse.ts#L4) |
 | `readGatewayBillingMode` | Read a trusted gateway billing mode from provider metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-usage.ts#L7) |
-| `readProviderOptions` | Options accepted by read provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L482) |
+| `readProviderOptions` | Options accepted by read provider. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L470) |
 | `readRecord` | Record shape for read. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-records.ts#L2) |
-| `readTextParts` | Read text content parts from provider messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L360) |
+| `readTextParts` | Read text content parts from provider messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L348) |
 | `requestJson` | Request and parse a JSON response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-http.ts#L252) |
 | `requestStream` | Request a streaming response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-http.ts#L270) |
-| `stringifyJsonValue` | Serialize a JSON-compatible value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L351) |
-| `toOpenAICompatibleMessages` | Convert runtime prompt messages into OpenAI-compatible chat messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L395) |
-| `toOpenAICompatibleTools` | Convert runtime tool definitions into OpenAI-compatible function tools. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L458) |
-| `unwrapToolInputSchema` | Zod schema for unwrap tool input. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L503) |
+| `stringifyJsonValue` | Serialize a JSON-compatible value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L339) |
+| `toOpenAICompatibleMessages` | Convert runtime prompt messages into OpenAI-compatible chat messages. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L383) |
+| `toOpenAICompatibleTools` | Convert runtime tool definitions into OpenAI-compatible function tools. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L446) |
+| `unwrapToolInputSchema` | Zod schema for unwrap tool input. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L491) |
 | `withToolInputStatusTransitions` | Applies tool input status transitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/tool-input-status.ts#L62) |
 
 #### Classes
@@ -178,9 +178,9 @@ import { buildProviderError, createAnthropicRequestInit, createGoogleRequestInit
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `OpenAICompatibleChatMessage` | Message shape for OpenAI-compatible chat requests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L253) |
-| `OpenAICompatibleChatRequest` | Request payload for OpenAI-compatible chat completion providers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L287) |
-| `ProviderWarning` | Structured warning emitted when a provider runtime drops or rewrites a caller-provided option. Mirrors the AI ecosystem convention (Vercel AI SDK, LangChain) of returning `unsupported-setting` warnings on the runtime result so callers can discover silently-dropped fields without having to read the source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L320) |
+| `OpenAICompatibleChatMessage` | Message shape for OpenAI-compatible chat requests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L241) |
+| `OpenAICompatibleChatRequest` | Request payload for OpenAI-compatible chat completion providers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L275) |
+| `ProviderWarning` | Structured warning emitted when a provider runtime drops or rewrites a caller-provided option. Mirrors the AI ecosystem convention (Vercel AI SDK, LangChain) of returning `unsupported-setting` warnings on the runtime result so callers can discover silently-dropped fields without having to read the source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L308) |
 | `RuntimePromptMessage` | Message shape for runtime prompt. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader.ts#L42) |
 | `RuntimeUsage` | Public API contract for runtime usage. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/runtime-loader/provider-usage.ts#L12) |
 
diff --git a/docs/api-reference/veryfront/router.md b/docs/api-reference/veryfront/router.md
index 7cee33841d..b40c0f511f 100644
--- a/docs/api-reference/veryfront/router.md
+++ b/docs/api-reference/veryfront/router.md
@@ -27,20 +27,20 @@ import { Link, RouterProvider, useRouter } from "veryfront/router";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `Link` | Renders an anchor element annotated for Veryfront prefetch handling. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L400) |
-| `Router` | Provides the router context. `pathname`/`query` track the live URL through the shared navigation store's `useSyncExternalStore` surface; `params`/`domain` are seeded from the `router` prop. One component serves both sides: React uses `getServerSnapshot` (the seed href) during SSR and the live store on the client, so there is no environment branch - the server render and the first client render match by construction. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L284) |
-| `RouterProvider` | Provides the router context. `pathname`/`query` track the live URL through the shared navigation store's `useSyncExternalStore` surface; `params`/`domain` are seeded from the `router` prop. One component serves both sides: React uses `getServerSnapshot` (the seed href) during SSR and the live store on the client, so there is no environment branch - the server render and the first client render match by construction. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L284) |
+| `Link` | Renders an anchor element annotated for Veryfront prefetch handling. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L388) |
+| `Router` | Provides the router context. `pathname`/`query` track the live URL through the shared navigation store's `useSyncExternalStore` surface; `params`/`domain` are seeded from the `router` prop. One component serves both sides: React uses `getServerSnapshot` (the seed href) during SSR and the live store on the client, so there is no environment branch - the server render and the first client render match by construction. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L272) |
+| `RouterProvider` | Provides the router context. `pathname`/`query` track the live URL through the shared navigation store's `useSyncExternalStore` surface; `params`/`domain` are seeded from the `router` prop. One component serves both sides: React uses `getServerSnapshot` (the seed href) during SSR and the live store on the client, so there is no environment branch - the server render and the first client render match by construction. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L272) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `useRouter` | Reads the router context: `pathname`, `query`, `params`, and the navigation actions. Reactive across client-side navigation - this is the single hook for location and navigation state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L395) |
+| `useRouter` | Reads the router context: `pathname`, `query`, `params`, and the navigation actions. Reactive across client-side navigation - this is the single hook for location and navigation state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L383) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `LinkProps` | Props accepted by `<Link>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L30) |
-| `RouterProviderProps` | Props accepted by `<RouterProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L36) |
-| `RouterValue` | Router state exposed through `useRouter()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L4) |
+| `LinkProps` | Props accepted by `<Link>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L38) |
+| `RouterProviderProps` | Props accepted by `<RouterProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L44) |
+| `RouterValue` | Router state exposed through `useRouter()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L12) |
diff --git a/docs/api-reference/veryfront/schedule.md b/docs/api-reference/veryfront/schedule.md
index c8d6e65c64..30b00af7cc 100644
--- a/docs/api-reference/veryfront/schedule.md
+++ b/docs/api-reference/veryfront/schedule.md
@@ -1,6 +1,6 @@
 ---
 title: "veryfront/schedule"
-description: "Source-defined schedules for Veryfront projects."
+description: "Source-defined recurring schedules for Veryfront projects."
 order: 30
 ---
 
@@ -33,21 +33,21 @@ export default schedule({
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `discoverSchedules` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L18) |
-| `isScheduleDefinition` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L53) |
-| `schedule` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/factory.ts#L223) |
+| `discoverSchedules` | Discover and validate canonical schedule definitions from a project directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L27) |
+| `isScheduleDefinition` | Return true only when every schedule field and nested invariant is valid. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L92) |
+| `schedule` | Validate and normalize a source-defined schedule configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/factory.ts#L12) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `ScheduleConcurrencyPolicy` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L3) |
-| `ScheduleConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L47) |
-| `ScheduleDefinition` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L31) |
-| `ScheduleDiscoveryOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L9) |
-| `ScheduleDiscoveryResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L16) |
-| `ScheduleHealth` | Marks a schedule unhealthy when it has not succeeded within the given budget. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L6) |
-| `ScheduleIntegrationRequirement` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L19) |
-| `ScheduleIntegrationRequirementConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L25) |
-| `ScheduleIntegrationResource` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L15) |
-| `ScheduleIntegrationResourceIdentity` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L10) |
+| `ScheduleConcurrencyPolicy` | Behavior when a scheduled occurrence overlaps an active run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L5) |
+| `ScheduleConfig` | Author-facing recurring schedule configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L82) |
+| `ScheduleDefinition` | Validated, canonical source definition for one recurring schedule. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L48) |
+| `ScheduleDiscoveryOptions` | Inputs for deterministic source schedule discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L12) |
+| `ScheduleDiscoveryResult` | Valid schedules and bounded per-file discovery diagnostics. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/discovery.ts#L24) |
+| `ScheduleHealth` | Marks a schedule unhealthy when it has not succeeded within the given budget. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L8) |
+| `ScheduleIntegrationRequirement` | Canonical integration access required before a scheduled run can start. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L28) |
+| `ScheduleIntegrationRequirementConfig` | Author-facing integration requirement; omitted collections default to empty. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L38) |
+| `ScheduleIntegrationResource` | Integration resource optionally scoped beneath a parent resource. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L22) |
+| `ScheduleIntegrationResourceIdentity` | Stable integration resource key used for source-owned access requirements. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schedule/types.ts#L14) |
diff --git a/docs/api-reference/veryfront/schemas.md b/docs/api-reference/veryfront/schemas.md
index 7c6b06a675..5fdc9177b8 100644
--- a/docs/api-reference/veryfront/schemas.md
+++ b/docs/api-reference/veryfront/schemas.md
@@ -1,6 +1,6 @@
 ---
 title: "veryfront/schemas"
-description: "Reusable validation schemas and the `defineSchema` helper."
+description: "Reusable validation schemas and the `defineSchema` helper. Schema materialization requires a registered `SchemaValidator`. Veryfront runtime bootstrap registers the built-in validator before handlers run. `lazySchema` keeps module-scope schema constants import-safe before bootstrap."
 order: 31
 ---
 
@@ -20,9 +20,7 @@ import {
 ## Examples
 
 ```ts
-import { CommonSchemas, defineSchema } from "veryfront/schemas";
-
-const email = CommonSchemas.email.parse("user@example.com");
+import { CommonSchemas, defineSchema, lazySchema } from "veryfront/schemas";
 
 const getUserSchema = defineSchema((v) =>
   v.object({
@@ -30,6 +28,11 @@ const getUserSchema = defineSchema((v) =>
     name: v.string().min(1),
   })
 );
+export const UserSchema = lazySchema(getUserSchema);
+
+export function parseEmail(input: unknown) {
+  return CommonSchemas.email.parse(input);
+}
 ```
 
 ## Exports
@@ -38,60 +41,60 @@ const getUserSchema = defineSchema((v) =>
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L65) |
+| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L91) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `defineSchema` | Wrap a schema factory so that it is built lazily on first call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/define.ts#L37) |
-| `lazySchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/lazy.ts#L7) |
-| `schemaIsOptional` | Returns `true` when the schema permits `undefined`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/json-schema.ts#L29) |
-| `schemaToJsonSchema` | Convert an opaque `Schema<T>` to a JSON Schema document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/json-schema.ts#L19) |
+| `defineSchema` | Wrap a schema factory so that it is built lazily on first call. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/define.ts#L82) |
+| `lazySchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/lazy.ts#L39) |
+| `schemaIsOptional` | Returns `true` when the schema permits `undefined`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/json-schema.ts#L53) |
+| `schemaToJsonSchema` | Convert an opaque `Schema<T>` to a JSON Schema document. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/json-schema.ts#L35) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `AbsolutePath` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L84) |
-| `DateRange` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L98) |
-| `Email` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L92) |
-| `FilePath` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L76) |
-| `HexColor` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L63) |
-| `JsonSchema` | Minimal JSON Schema type used by the `SchemaValidator` contract for `toJsonSchema()`. Kept in the extensions/schema category so the contract can reference it without depending on any non-leaf module. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L9) |
-| `JsonValue` | Recursive JSON value type - a string, number, boolean, null, array of JsonValue, or object with string keys and JsonValue values. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L39) |
-| `NonEmptyString` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L15) |
-| `NonNegativeInt` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L25) |
-| `Pagination` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L97) |
-| `PhoneNumber` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L96) |
-| `PortNumber` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L30) |
-| `PositiveInt` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L20) |
-| `Semver` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L71) |
-| `Slug` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L94) |
-| `StrongPassword` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L99) |
-| `Timestamp` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L33) |
-| `Url` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L95) |
-| `Uuid` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L93) |
+| `AbsolutePath` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L105) |
+| `DateRange` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L124) |
+| `Email` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L118) |
+| `FilePath` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L93) |
+| `HexColor` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L76) |
+| `JsonSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L18) |
+| `JsonValue` | Recursive JSON value type: a string, number, boolean, null, array of JsonValue, or object with string keys and JsonValue values. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L50) |
+| `NonEmptyString` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L22) |
+| `NonNegativeInt` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L32) |
+| `Pagination` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L123) |
+| `PhoneNumber` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L122) |
+| `PortNumber` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L41) |
+| `PositiveInt` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L27) |
+| `Semver` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L84) |
+| `Slug` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L120) |
+| `StrongPassword` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L125) |
+| `Timestamp` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L44) |
+| `Url` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L121) |
+| `Uuid` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L119) |
 
 ### Constants
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `getAbsolutePathSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L78) |
-| `getDateRangeSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L39) |
-| `getEmailSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L20) |
-| `getFilePathSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L73) |
-| `getHexColorSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L60) |
-| `getJsonValueSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L47) |
-| `getNonEmptyStringSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L12) |
-| `getNonNegativeIntSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L22) |
-| `getPaginationSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L30) |
-| `getPhoneNumberSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L26) |
-| `getPortNumberSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L27) |
-| `getPositiveIntSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L17) |
-| `getSemverSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L65) |
-| `getSlugSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L22) |
-| `getStrongPasswordSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L50) |
-| `getTimestampSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L32) |
-| `getUrlSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L23) |
-| `getUuidSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L21) |
+| `getAbsolutePathSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L95) |
+| `getDateRangeSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L62) |
+| `getEmailSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L28) |
+| `getFilePathSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L86) |
+| `getHexColorSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L73) |
+| `getJsonValueSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L52) |
+| `getNonEmptyStringSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L19) |
+| `getNonNegativeIntSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L29) |
+| `getPaginationSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L40) |
+| `getPhoneNumberSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L36) |
+| `getPortNumberSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L34) |
+| `getPositiveIntSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L24) |
+| `getSemverSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L78) |
+| `getSlugSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L30) |
+| `getStrongPasswordSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L73) |
+| `getTimestampSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/primitives.ts#L43) |
+| `getUrlSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L33) |
+| `getUuidSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L29) |
diff --git a/docs/api-reference/veryfront/security.md b/docs/api-reference/veryfront/security.md
new file mode 100644
index 0000000000..f1ee8440f2
--- /dev/null
+++ b/docs/api-reference/veryfront/security.md
@@ -0,0 +1,138 @@
+---
+title: "veryfront/security"
+description: "Security layer - input validation with size limits, CORS configuration, CSP and security headers, path traversal prevention, and secure filesystem access."
+order: 32
+---
+
+## Import
+
+```ts
+import {
+  applyCORSHeaders,
+  applyCORSHeadersSync,
+  applyCsrfCookie,
+  applySecurityHeaders,
+  buildCacheControl,
+  cors,
+} from "veryfront/security";
+```
+
+## Examples
+
+### Apply response security headers
+
+```ts
+import { applySecurityHeaders, generateNonce } from "veryfront/security";
+
+const response = new Response("Ready");
+applySecurityHeaders(response.headers, false, generateNonce(), null);
+```
+
+## Exports
+
+### Components
+
+| Name | Description | Source |
+|------|-------------|--------|
+| `BUILD_HELPER_PERMISSIONS` | BUILD_HELPER - manifest generators, framework source prep. Only needs filesystem + env access. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L48) |
+| `CACHE_DURATIONS` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/constants.ts#L10) |
+| `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L91) |
+| `CORS_MAX_AGE` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L22) |
+| `DEFAULT_CORS_HEADERS` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L9) |
+| `DEFAULT_CORS_METHODS` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L1) |
+| `DEFAULT_LIMITS` | Framework-owned request limits. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L21) |
+| `INPUT_VALIDATION_FAILED` | HTTP request input validation failures (replaces ValidationError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L86) |
+| `PathValidationError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L39) |
+| `SECURITY_VIOLATION` | Path traversal / secure-fs violations (replaces SecurityError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L77) |
+| `SERVER_PERMISSIONS` | SERVER - CLI server (dev, production, proxy, MCP, split-mode). Also used by build and test tasks that need equivalent access. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L14) |
+| `ValidationPresets` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/presets.ts#L45) |
+| `WORKFLOW_RUN_PERMISSIONS` | WORKFLOW_RUN - `ProcessRunExecutor` (RESTRICTED). Runs user-authored code - no `--allow-run`, `--allow-ffi`, or `--allow-sys`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L37) |
+
+### Functions
+
+| Name | Description | Source |
+|------|-------------|--------|
+| `applyCORSHeaders` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L86) |
+| `applyCORSHeadersSync` | Apply CORS synchronously. Promise-returning values still fail closed at runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L112) |
+| `applyCsrfCookie` | Set CSRF cookie on GET/HEAD responses when not already present. Uses httpOnly: false so client JS can read the cookie for double-submit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L150) |
+| `applySecurityHeaders` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L173) |
+| `buildCacheControl` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/cache-handler.ts#L86) |
+| `cors` | Create CORS middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L10) |
+| `corsSimple` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L39) |
+| `createResponseBuilder` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/builder.ts#L60) |
+| `createSecureFs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L1129) |
+| `createValidatedHandler` | Create a validated API handler with bounded body/query validation. Bodies without a schema are preflighted through a clone, leaving the original request body available to the handler after its size is verified. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L163) |
+| `createValidationError` | Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L12) |
+| `createValidator` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L446) |
+| `generateCsrfToken` | Generate a CSRF token and return value + Set-Cookie header string | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L70) |
+| `generateNonce` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L44) |
+| `getSecurityHeader` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L160) |
+| `handleCORSPreflight` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/preflight.ts#L126) |
+| `isPreflightRequest` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/preflight.ts#L186) |
+| `isRequestBodyTooLargeError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L100) |
+| `isValidSecurityConfig` | Check a standalone security configuration against the canonical project configuration schema. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L214) |
+| `loadSecurityConfig` | Load the project's schema-validated security configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L234) |
+| `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L139) |
+| `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L68) |
+| `parseQueryParams` | Parse and validate query parameters from a bounded request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L195) |
+| `readBodyWithLimit` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L229) |
+| `sanitizeData` | Sanitize JSON-like data by HTML-encoding string values and removing keys that can mutate an object's prototype chain. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L8) |
+| `sanitizePathForDisplay` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L468) |
+| `setCors` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/cors-handler.ts#L4) |
+| `shouldApplyCORS` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L130) |
+| `validateCORSConfig` | Validate CORS configuration for security issues. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L418) |
+| `validateCsrf` | Validate CSRF token by comparing header and cookie | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L119) |
+| `validateLexicalPath` | Validate lexical path containment without consulting a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L403) |
+| `validateOrigin` | Validate origin against CORS configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L392) |
+| `validateOriginSync` | Synchronous origin validation. Promise-returning values still fail closed at runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L408) |
+| `validatePath` | Admit a path against the physical semantics of a runtime filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L330) |
+| `validatePathSync` | Validate lexical path containment without consulting a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L431) |
+| `validateRequestLimits` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L106) |
+| `wrapAdapterWithSecurity` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L1188) |
+
+### Classes
+
+| Name | Description | Source |
+|------|-------------|--------|
+| `AuthHandler` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/auth.ts#L155) |
+| `BaseHandler` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/base-handler.ts#L45) |
+| `CsrfHandler` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/csrf/csrf-handler.ts#L55) |
+| `ResponseBuilder` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/builder.ts#L9) |
+| `SecureFs` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L645) |
+| `SecurityConfigLoader` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L274) |
+
+### Types
+
+| Name | Description | Source |
+|------|-------------|--------|
+| `CacheStrategy` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/types.ts#L11) |
+| `CORSConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/types.ts#L1) |
+| `CORSHeaderOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L34) |
+| `CORSOptions` | CORS policy accepted by asynchronous middleware and preflight APIs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L7) |
+| `CORSPreflightOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L27) |
+| `CORSValidationResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L21) |
+| `CSPDirectives` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/types.ts#L10) |
+| `CsrfConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L20) |
+| `CsrfTokenOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L27) |
+| `HandlerHelpers` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/base-handler.ts#L19) |
+| `LexicalPathValidationOptions` | Options for lexical containment checks that never inspect a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L33) |
+| `OriginValidator` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L2) |
+| `ParseFormOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L39) |
+| `ParseJsonOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L28) |
+| `ParseQueryOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L43) |
+| `PathValidationPolicyOptions` | Filesystem-independent policy fields shared by physical path presets. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L18) |
+| `RequestLimits` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L8) |
+| `ResponseBuilderConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/types.ts#L27) |
+| `SecureFsConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L56) |
+| `SecurityConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/types/server.ts#L9) |
+| `SecurityContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L39) |
+| `SecurityEvent` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L65) |
+| `SyncCORSConfig` | CORS policy accepted by synchronous response-building APIs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L17) |
+| `SyncCORSHeaderOptions` | Header options accepted by synchronous CORS response helpers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L42) |
+| `SyncOriginValidator` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L1) |
+| `ValidatedData` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L47) |
+| `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L11) |
+| `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L18) |
+| `ValidationLevel` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L8) |
+| `ValidationOptions` | Options for physical filesystem admission. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L28) |
+| `ValidationResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L10) |
diff --git a/docs/api-reference/veryfront/server.md b/docs/api-reference/veryfront/server.md
index 1a1e3fbc67..78d13d2387 100644
--- a/docs/api-reference/veryfront/server.md
+++ b/docs/api-reference/veryfront/server.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/server"
 description: "Create and run Veryfront servers."
-order: 32
+order: 33
 ---
 
 ## Import
diff --git a/docs/api-reference/veryfront/skill.md b/docs/api-reference/veryfront/skill.md
index 3b73224b3b..16c96b9a40 100644
--- a/docs/api-reference/veryfront/skill.md
+++ b/docs/api-reference/veryfront/skill.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/skill"
 description: "Agent skills. Public API for the agent skills system. Skills are project-level capabilities defined as SKILL.md files following the agentskills.io specification."
-order: 33
+order: 34
 ---
 
 ## Import
@@ -46,32 +46,32 @@ validateSkillMetadata(parsed.frontmatter, "review");
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `createExecuteSkillScriptTool` | Create the execute_skill_script tool. Executes a script from a skill's scripts/ directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L328) |
-| `createLoadSkillReferenceTool` | Create the load_skill_reference tool. Reads a reference file from a skill's references/, resources/, or assets/ directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L291) |
-| `createLoadSkillTool` | Create the load_skill tool. Loads a skill's full instructions, available references, and scripts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L235) |
+| `createExecuteSkillScriptTool` | Create the execute_skill_script tool. Executes a script from a skill's scripts/ directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L468) |
+| `createLoadSkillReferenceTool` | Create the load_skill_reference tool. Reads a reference file from a skill's references/, resources/, or assets/ directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L424) |
+| `createLoadSkillTool` | Create the load_skill tool. Loads a skill's full instructions, available references, and scripts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/tools.ts#L353) |
 | `filterToolsForSkill` | Layer 1: Filter tool definitions before sending to model. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/allowed-tools.ts#L81) |
 | `getAllSkills` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/registry.ts#L147) |
 | `getSkill` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/registry.ts#L143) |
-| `getSkillScriptExecutor` | Get the appropriate script executor. Checks cloud auth availability on every call so request-scoped credentials and environment overrides are respected. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/executor.ts#L215) |
+| `getSkillScriptExecutor` | Get the appropriate script executor. Checks cloud auth availability on every call so request-scoped credentials and environment overrides are respected. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/executor.ts#L219) |
 | `isSkillVisibleTo` | Whether a skill is visible to the caller identified by the scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/registry.ts#L33) |
 | `isToolAllowedBySkill` | Layer 2: Check if a specific tool call is allowed at execution time. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/allowed-tools.ts#L114) |
-| `listSkillSubdir` | List files in a skill subdirectory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/path-safety.ts#L197) |
+| `listSkillSubdir` | List files with the public compatibility resource policy. Enumeration is not entry-capped and preserves the filesystem adapter's iteration order. `listStrictSkillSubdir` applies the runtime filesystem ceilings and deterministic ordering. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/path-safety.ts#L637) |
 | `parseSkillFrontmatter` | Parse SKILL.md content into frontmatter + body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/parser.ts#L32) |
 | `registerSkill` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/registry.ts#L139) |
 | `validateAllowedToolPatterns` | Validate allowed-tool patterns at parse time. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/allowed-tools.ts#L135) |
 | `validateSkillMetadata` | Validate and normalize parsed frontmatter into SkillMetadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/parser.ts#L81) |
-| `validateSkillPath` | Validate that a requested path is safe within a skill's root directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/path-safety.ts#L115) |
+| `validateSkillPath` | Validate a requested path with the public compatibility resource policy. Relative paths may contain up to 4096 characters and filesystem directory enumeration is not entry-capped. `validateStrictSkillPath` applies the runtime filesystem ceilings. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/path-safety.ts#L482) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `ActiveSkillContext` | Active skill context for runtime policy tracking | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L120) |
+| `ActiveSkillContext` | Active skill context for runtime policy tracking | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L122) |
 | `AgentCapabilityScope` | Caller scope used for owner-aware capability resolution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/registry.ts#L27) |
 | `Skill` | Registered skill instance | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L78) |
 | `SkillContent` | Full skill content returned by load_skill tool | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L64) |
 | `SkillMetadata` | Parsed frontmatter metadata from SKILL.md | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L46) |
-| `SkillScriptExecutor` | Script executor interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L115) |
+| `SkillScriptExecutor` | Script executor interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L117) |
 | `SkillScriptExecutorInput` | Input for the script executor | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L105) |
 | `SkillScriptResult` | Result from executing a skill script | [source](https://github.com/veryfront/veryfront-code/blob/main/src/skill/types.ts#L98) |
 
diff --git a/docs/api-reference/veryfront/task.md b/docs/api-reference/veryfront/task.md
index 88e1e061a9..fce318aa0e 100644
--- a/docs/api-reference/veryfront/task.md
+++ b/docs/api-reference/veryfront/task.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/task"
 description: "Source-defined tasks for Veryfront projects."
-order: 34
+order: 35
 ---
 
 ## Import
@@ -38,26 +38,27 @@ export default {
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `deriveTaskId` | Derive task ID from file path (e.g., "tasks/sync-data.ts" -&gt; "sync-data"). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L177) |
-| `discoverProjectTaskRuntime` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L32) |
-| `discoverTasks` | Discover all tasks in a project with the legacy file-based path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L193) |
-| `findProjectRuntimeTask` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L57) |
-| `findTaskById` | Find a specific task by ID through the legacy file-based path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L268) |
-| `formatProjectRuntimeDiscoveryErrors` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L26) |
-| `isTaskDefinition` | Type guard: checks if a value looks like a TaskDefinition | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/types.ts#L44) |
-| `listProjectRuntimeTasks` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L71) |
-| `runTask` | Run a task with the given options | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L70) |
+| `deriveTaskId` | Derive task ID from file path (e.g., "tasks/sync-data.ts" -&gt; "sync-data"). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L233) |
+| `discoverProjectTaskRuntime` | Discover project tasks and the colocated runtime primitives they may use. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L45) |
+| `discoverTasks` | Discover all tasks in a project with the legacy file-based path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L248) |
+| `findProjectRuntimeTask` | Find one task by its stable project-runtime ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L81) |
+| `findTaskById` | Find a specific task by ID through the legacy file-based path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L322) |
+| `formatProjectRuntimeDiscoveryErrors` | Format project-runtime discovery failures for CLI and operator diagnostics. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L38) |
+| `isTaskDefinition` | Return true only when the runnable and every declared task metadata field match the public `TaskDefinition` contract. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/types.ts#L61) |
+| `listProjectRuntimeTasks` | List project-runtime tasks in deterministic ID order. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L96) |
+| `runTask` | Run a task with the given options | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L96) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `DiscoveredTask` | Discovered task info. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L49) |
-| `ProjectTaskRuntimeOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L12) |
-| `RunnableTask` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L16) |
-| `RunTaskOptions` | Options for running a task | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L30) |
+| `DiscoveredTask` | Discovered task info. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L59) |
+| `ProjectTaskRuntimeDiscovery` | Project runtime discovery result used by task lookup and execution helpers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L13) |
+| `ProjectTaskRuntimeOptions` | Options for discovering tasks through the unified project runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/project-runtime.ts#L16) |
+| `RunnableTask` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L17) |
+| `RunTaskOptions` | Options for running a task | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L31) |
 | `TaskContext` | Context passed to task run() function | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/types.ts#L12) |
-| `TaskDefinition` | Task definition exported from a tasks/ file | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/types.ts#L26) |
-| `TaskDiscoveryOptions` | Options for file-based task discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L71) |
-| `TaskDiscoveryResult` | Result of file-based task discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L93) |
-| `TaskRunResult` | Result of running a task | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L53) |
+| `TaskDefinition` | Task definition exported from a tasks/ file | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/types.ts#L28) |
+| `TaskDiscoveryOptions` | Options for file-based task discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L81) |
+| `TaskDiscoveryResult` | Result of file-based task discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/discovery.ts#L103) |
+| `TaskRunResult` | Result of running a task | [source](https://github.com/veryfront/veryfront-code/blob/main/src/task/runner.ts#L57) |
diff --git a/docs/api-reference/veryfront/testing.md b/docs/api-reference/veryfront/testing.md
index f8606d7d5b..cdea12ffac 100644
--- a/docs/api-reference/veryfront/testing.md
+++ b/docs/api-reference/veryfront/testing.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/testing"
 description: "Cross-runtime BDD assertions and test helpers."
-order: 35
+order: 36
 ---
 
 ## Import
@@ -37,62 +37,62 @@ describe("math", () => {
 |------|-------------|--------|
 | `afterAll` | Register a hook after all BDD tests in a group. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L640) |
 | `afterEach` | Register a hook after each BDD test. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L620) |
-| `assert` | Assert that a value is truthy. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L283) |
-| `assertEquals` | Assert that two values are deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L268) |
-| `assertExists` | Assert that a value is not null or undefined. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L288) |
-| `assertGreater` | Assert that a number is greater than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L352) |
-| `assertGreaterOrEqual` | Assert that a number is greater than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L357) |
-| `assertInstanceOf` | Assert that a value is an instance of a constructor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L323) |
-| `assertLess` | Assert that a number is less than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L362) |
-| `assertLessOrEqual` | Assert that a number is less than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L367) |
-| `assertMatch` | Assert that a string matches a regular expression. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L318) |
-| `assertNotEquals` | Assert that two values are not deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L273) |
-| `assertNotStrictEquals` | Assert that two values are not strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L338) |
-| `assertObjectMatch` | Assert that an object contains matching properties. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L343) |
-| `assertRejects` | Assert that an async function rejects. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L303) |
-| `assertStrictEquals` | Assert that two values are strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L278) |
-| `assertStringIncludes` | Assert that a string contains another string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L313) |
-| `assertThrows` | Assert that a synchronous function throws. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L293) |
+| `assert` | Assert that a value is truthy. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L284) |
+| `assertEquals` | Assert that two values are deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L269) |
+| `assertExists` | Assert that a value is not null or undefined. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L289) |
+| `assertGreater` | Assert that a number is greater than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L353) |
+| `assertGreaterOrEqual` | Assert that a number is greater than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L358) |
+| `assertInstanceOf` | Assert that a value is an instance of a constructor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L324) |
+| `assertLess` | Assert that a number is less than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L363) |
+| `assertLessOrEqual` | Assert that a number is less than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L368) |
+| `assertMatch` | Assert that a string matches a regular expression. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L319) |
+| `assertNotEquals` | Assert that two values are not deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L274) |
+| `assertNotStrictEquals` | Assert that two values are not strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L339) |
+| `assertObjectMatch` | Assert that an object contains matching properties. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L344) |
+| `assertRejects` | Assert that an async function rejects. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L304) |
+| `assertStrictEquals` | Assert that two values are strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L279) |
+| `assertStringIncludes` | Assert that a string contains another string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L314) |
+| `assertThrows` | Assert that a synchronous function throws. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L294) |
 | `beforeAll` | Register a hook before all BDD tests in a group. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L630) |
 | `beforeEach` | Register a hook before each BDD test. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L611) |
-| `chmod` | Change file permissions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L496) |
-| `createFileSystem` | Create file system. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L403) |
-| `cwd` | Return the current working directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L21) |
+| `chmod` | Change file permissions, rejecting operational failures. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L588) |
+| `createFileSystem` | Create the runtime-native filesystem implementation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L438) |
+| `cwd` | Return the current working directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L26) |
 | `deepEquals` | ********************* Shared utility functions for cross-runtime testing. ********************* | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/utils.ts#L5) |
 | `delay` | Wait for a duration in milliseconds. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L123) |
-| `deleteEnv` | Delete a process environment variable. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L213) |
+| `deleteEnv` | Delete a process environment variable. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L205) |
 | `describe` | Group related BDD tests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L497) |
-| `env` | Read and write process environment variables. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L32) |
-| `exists` | Check whether a path exists. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L435) |
+| `env` | Read and write process environment variables. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L33) |
+| `exists` | Return false for a missing path and propagate every other filesystem error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L511) |
 | `exit` | Exit the current process. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L128) |
-| `fail` | Fail the current assertion immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L333) |
-| `getArgs` | Get command-line arguments (cross-runtime: Deno.args or process.argv). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L5) |
-| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L117) |
+| `fail` | Fail the current assertion immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L334) |
+| `getArgs` | Get command-line arguments (cross-runtime: Deno.args or process.argv). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/lifecycle.ts#L10) |
+| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L106) |
 | `getTestTimeScale` | Return test time scale. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/timing.ts#L4) |
-| `isAlreadyExistsError` | Error shape for is already exists. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L533) |
-| `isNotFoundError` | Return whether an error or its cause chain represents a path that cannot be resolved. ENOTDIR is included because a missing candidate beneath a file is just as absent as an ENOENT candidate during filesystem lookup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/not-found-error.ts#L16) |
+| `isAlreadyExistsError` | Error shape for is already exists. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L617) |
+| `isNotFoundError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/not-found-error.ts#L210) |
 | `it` | Define a BDD test case. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L553) |
-| `makeTempDir` | Create temp dir. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L491) |
+| `makeTempDir` | Atomically create a unique directory beneath the operating-system temp root. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L583) |
 | `makeTempDirWithOptions` | Options accepted by make temp dir with. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L73) |
 | `makeTempFile` | Create temp file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L48) |
-| `mkdir` | Create a directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L469) |
-| `readDir` | Read directory entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L479) |
-| `readFile` | Read a file as bytes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L420) |
-| `readTextFile` | Read a file as text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L415) |
+| `mkdir` | Create a directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L561) |
+| `readDir` | Read directory entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L571) |
+| `readFile` | Read a file as bytes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L496) |
+| `readTextFile` | Read a file as text. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L491) |
 | `registerTestCleanup` | Registers test cleanup. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/isolation.ts#L22) |
-| `remove` | Remove a file or directory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L474) |
+| `remove` | Remove a file or directory, rejecting when the path does not exist. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L566) |
 | `resetAllTestState` | Comprehensive reset of ALL test state across the application. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/isolation.ts#L64) |
 | `safeStringify` | Serialize unknown values safely for test output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/utils.ts#L34) |
 | `scaleMs` | Scale a duration for the current test runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/timing.ts#L9) |
-| `setEnv` | Sets env. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L193) |
-| `stat` | Read file metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L440) |
+| `setEnv` | Sets env. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L185) |
+| `stat` | Read file metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L516) |
 | `testDelay` | Wait for a test-scaled duration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/timing.ts#L15) |
 | `waitFor` | Wait until a condition succeeds. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L99) |
 | `withEnv` | Applies env. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L186) |
 | `withTempDir` | Applies temp dir. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L138) |
 | `withTempFile` | Applies temp file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/deno-compat.ts#L162) |
-| `writeFile` | Write bytes to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L430) |
-| `writeTextFile` | Write text to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L425) |
+| `writeFile` | Write bytes to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L506) |
+| `writeTextFile` | Write text to a file. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/fs.ts#L501) |
 
 ### Types
 
@@ -105,9 +105,9 @@ describe("math", () => {
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `isBun` | True if running in Bun runtime (check first since Bun has process.versions.node) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L69) |
-| `isDeno` | True if running in real Deno runtime (not dnt shim) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L75) |
-| `isNode` | True if running in Node.js runtime (has process.versions.node, not Bun, not shimmed Deno) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L72) |
+| `isBun` | True if running in Bun runtime (Bun also exposes process.versions.node). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L94) |
+| `isDeno` | True if running in the real Deno runtime rather than a dnt shim. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L103) |
+| `isNode` | True if running in Node.js rather than a more specific compatible host. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/runtime.ts#L100) |
 | `test` | Shared test value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/bdd.ts#L650) |
 
 ## Deep imports
@@ -124,23 +124,23 @@ import { assert, assertEquals, assertExists } from "veryfront/testing/assert";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `assert` | Assert that a value is truthy. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L283) |
-| `assertEquals` | Assert that two values are deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L268) |
-| `assertExists` | Assert that a value is not null or undefined. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L288) |
-| `assertGreater` | Assert that a number is greater than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L352) |
-| `assertGreaterOrEqual` | Assert that a number is greater than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L357) |
-| `assertInstanceOf` | Assert that a value is an instance of a constructor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L323) |
-| `assertLess` | Assert that a number is less than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L362) |
-| `assertLessOrEqual` | Assert that a number is less than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L367) |
-| `assertMatch` | Assert that a string matches a regular expression. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L318) |
-| `assertNotEquals` | Assert that two values are not deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L273) |
-| `assertNotStrictEquals` | Assert that two values are not strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L338) |
-| `assertObjectMatch` | Assert that an object contains matching properties. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L343) |
-| `assertRejects` | Assert that an async function rejects. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L303) |
-| `assertStrictEquals` | Assert that two values are strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L278) |
-| `assertStringIncludes` | Assert that a string contains another string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L313) |
-| `assertThrows` | Assert that a synchronous function throws. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L293) |
-| `fail` | Fail the current assertion immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L333) |
+| `assert` | Assert that a value is truthy. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L284) |
+| `assertEquals` | Assert that two values are deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L269) |
+| `assertExists` | Assert that a value is not null or undefined. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L289) |
+| `assertGreater` | Assert that a number is greater than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L353) |
+| `assertGreaterOrEqual` | Assert that a number is greater than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L358) |
+| `assertInstanceOf` | Assert that a value is an instance of a constructor. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L324) |
+| `assertLess` | Assert that a number is less than another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L363) |
+| `assertLessOrEqual` | Assert that a number is less than or equal to another number. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L368) |
+| `assertMatch` | Assert that a string matches a regular expression. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L319) |
+| `assertNotEquals` | Assert that two values are not deeply equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L274) |
+| `assertNotStrictEquals` | Assert that two values are not strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L339) |
+| `assertObjectMatch` | Assert that an object contains matching properties. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L344) |
+| `assertRejects` | Assert that an async function rejects. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L304) |
+| `assertStrictEquals` | Assert that two values are strictly equal. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L279) |
+| `assertStringIncludes` | Assert that a string contains another string. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L314) |
+| `assertThrows` | Assert that a synchronous function throws. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L294) |
+| `fail` | Fail the current assertion immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/testing/assert.ts#L334) |
 
 ### `veryfront/testing/bdd`
 
diff --git a/docs/api-reference/veryfront/tool.md b/docs/api-reference/veryfront/tool.md
index d0b23fce41..dfba89a557 100644
--- a/docs/api-reference/veryfront/tool.md
+++ b/docs/api-reference/veryfront/tool.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/tool"
 description: "Define tools with schema-backed inputs for agents and MCP."
-order: 36
+order: 37
 ---
 
 ## Import
@@ -126,26 +126,26 @@ Create a typed tool definition.
 | Name | Description | Source |
 |------|-------------|--------|
 | `createContext7ToolSource` | Create context7 tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/context7.ts#L28) |
-| `createProjectScopedRemoteToolCatalog` | Create project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L243) |
-| `createRemoteMCPToolSource` | Create remote MCP tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-mcp.ts#L505) |
-| `createSleepTool` | Create sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L53) |
-| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L100) |
-| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L105) |
-| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L110) |
+| `createProjectScopedRemoteToolCatalog` | Create project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L348) |
+| `createRemoteMCPToolSource` | Create remote MCP tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-mcp.ts#L807) |
+| `createSleepTool` | Create sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L54) |
+| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L96) |
+| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L101) |
+| `createToolsFromHostDefinitions` | Create tools from host definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L106) |
 | `createToolsFromRemoteDefinitions` | Create tools from remote definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-source-tools.ts#L29) |
-| `dynamicTool` | Create a dynamic tool definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L182) |
+| `dynamicTool` | Create a dynamic tool definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L251) |
 | `executeTool` | Execute a tool definition with validated input. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/executor.ts#L15) |
-| `filterProjectScopedRemoteToolDefinitions` | Filter project scoped remote tool definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L166) |
+| `filterProjectScopedRemoteToolDefinitions` | Filter project scoped remote tool definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L179) |
 | `hasToolExecutionErrorMarker` | Check whether tool execution error marker is present. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/result.ts#L6) |
-| `hydrateProjectScopedRemoteToolInput` | Input payload for hydrate project scoped remote tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L181) |
+| `hydrateProjectScopedRemoteToolInput` | Input payload for hydrate project scoped remote tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L194) |
 | `isErroredToolExecutionResult` | Result returned from is errored tool execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/result.ts#L79) |
-| `isProjectNavigationRemoteTool` | Check whether a remote tool is project-navigation scoped. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L146) |
-| `isRemoteToolNameAllowed` | Check whether a remote tool name is allowed. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L158) |
+| `isProjectNavigationRemoteTool` | Check whether a remote tool is project-navigation scoped. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L159) |
+| `isRemoteToolNameAllowed` | Check whether a remote tool name is allowed. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L171) |
 | `isToolVisibleTo` | Whether a registered tool is visible to the caller identified by the execution context. Unowned tools are project/global; owned tools are only visible to their owning agent. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/executor.ts#L10) |
-| `listProjectScopedRemoteToolNames` | List project scoped remote tool names. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L340) |
-| `loadRemoteToolsFromSource` | Loads remote tools from source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-source-tools.ts#L62) |
-| `resolveProjectScopedRemoteToolProjectId` | Resolves project scoped remote tool project ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L204) |
-| `tool` | Create a typed tool definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L115) |
+| `listProjectScopedRemoteToolNames` | List project scoped remote tool names. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L430) |
+| `loadRemoteToolsFromSource` | Loads remote tools from source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-source-tools.ts#L78) |
+| `resolveProjectScopedRemoteToolProjectId` | Resolves project scoped remote tool project ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L240) |
+| `tool` | Create a typed tool definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L175) |
 | `traceHostTools` | Wrap host tools with tracing metadata. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/tracing.ts#L41) |
 
 ### Types
@@ -153,29 +153,29 @@ Create a typed tool definition.
 | Name | Description | Source |
 |------|-------------|--------|
 | `Context7ToolSourceConfig` | Configuration used by context7 tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/context7.ts#L7) |
-| `CreateSleepToolOptions` | Options accepted by create sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L13) |
-| `DynamicToolConfig` | Configuration used by dynamic tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L171) |
+| `CreateSleepToolOptions` | Options accepted by create sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L14) |
+| `DynamicToolConfig` | Configuration used by dynamic tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/factory.ts#L240) |
 | `HostToolDefinition` | Definition for host tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L12) |
 | `HostToolMaterializationOptions` | Options accepted by host tool materialization. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L38) |
 | `HostToolSet` | Public API contract for host tool set. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/host-tools.ts#L30) |
 | `HostToolTraceAttributeInput` | Input payload for host tool trace attribute. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/tracing.ts#L14) |
 | `HostToolTraceAttributes` | Public API contract for host tool trace attributes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/tracing.ts#L11) |
 | `HostToolTraceRunner` | Public API contract for host tool trace runner. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/tracing.ts#L5) |
-| `JsonSchema` | Minimal JSON Schema type used by the `SchemaValidator` contract for `toJsonSchema()`. Kept in the extensions/schema category so the contract can reference it without depending on any non-leaf module. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L9) |
-| `ListProjectScopedRemoteToolNameOptions` | Options accepted by list project scoped remote tool name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L63) |
-| `ProjectScopedRemoteToolCatalog` | Public API contract for project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L51) |
-| `ProjectScopedRemoteToolCatalogOptions` | Options accepted by project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L17) |
-| `ProjectScopedRemoteToolDefaultProjectId` | Public API contract for project scoped remote tool default project ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L10) |
-| `ProjectScopedRemoteToolDefinitions` | Public API contract for project scoped remote tool definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L31) |
-| `ProjectScopedRemoteToolExecution` | Public API contract for project scoped remote tool execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L44) |
-| `ProjectScopedRemoteToolExecutionInput` | Input payload for project scoped remote tool execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L37) |
-| `ProjectScopedRemoteToolOptions` | Options accepted by project scoped remote tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L5) |
-| `RemoteMCPToolSourceConfig` | Configuration used by remote MCP tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-mcp.ts#L34) |
-| `RemoteToolMaterializationOptions` | Options accepted by remote tool materialization. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-source-tools.ts#L7) |
+| `JsonSchema` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/schema/json-schema.ts#L18) |
+| `ListProjectScopedRemoteToolNameOptions` | Options accepted by list project scoped remote tool name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L64) |
+| `ProjectScopedRemoteToolCatalog` | Public API contract for project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L52) |
+| `ProjectScopedRemoteToolCatalogOptions` | Options accepted by project scoped remote tool catalog. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L18) |
+| `ProjectScopedRemoteToolDefaultProjectId` | Public API contract for project scoped remote tool default project ID. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L11) |
+| `ProjectScopedRemoteToolDefinitions` | Public API contract for project scoped remote tool definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L32) |
+| `ProjectScopedRemoteToolExecution` | Public API contract for project scoped remote tool execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L45) |
+| `ProjectScopedRemoteToolExecutionInput` | Input payload for project scoped remote tool execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L38) |
+| `ProjectScopedRemoteToolOptions` | Options accepted by project scoped remote tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/project-scoped-remote-tools.ts#L6) |
+| `RemoteMCPToolSourceConfig` | Configuration used by remote MCP tool source. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-mcp.ts#L49) |
+| `RemoteToolMaterializationOptions` | Options accepted by remote tool materialization. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/remote-source-tools.ts#L8) |
 | `RemoteToolSource` | Remote tool source loaded dynamically at runtime. Hosts can provide these to expose tools from remote MCP-compatible systems without registering those tools globally inside the framework. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/types.ts#L226) |
-| `SleepToolInput` | Input payload for sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L44) |
-| `SleepToolOutput` | Output from sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L47) |
-| `SleepToolWait` | Public API contract for sleep tool wait. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L10) |
+| `SleepToolInput` | Input payload for sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L45) |
+| `SleepToolOutput` | Output from sleep tool. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L48) |
+| `SleepToolWait` | Public API contract for sleep tool wait. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L11) |
 | `Tool` | Tool instance (returned by tool() function) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/types.ts#L148) |
 | `ToolConfig` | Tool configuration options | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/types.ts#L13) |
 | `ToolDefinition` | Provider-facing tool definition used for model/tool registration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/types.ts#L213) |
@@ -188,5 +188,5 @@ Create a typed tool definition.
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `sleepTool` | Default sleep tool (max 60 s) exposed as a property accessor so the underlying `tool({...})` materialization is deferred until first use. Preserves the existing `sleepTool.execute(...)` call shape. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L91) |
-| `toolRegistry` | Shared tool registry value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/registry.ts#L67) |
+| `sleepTool` | Default sleep tool (max 60 s) exposed as a property accessor so the underlying `tool({...})` materialization is deferred until first use. Preserves the existing `sleepTool.execute(...)` call shape. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/sleep.ts#L103) |
+| `toolRegistry` | Shared tool registry value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/tool/registry.ts#L70) |
diff --git a/docs/api-reference/veryfront/trigger.md b/docs/api-reference/veryfront/trigger.md
index d94d96da9f..b779948225 100644
--- a/docs/api-reference/veryfront/trigger.md
+++ b/docs/api-reference/veryfront/trigger.md
@@ -1,13 +1,18 @@
 ---
 title: "veryfront/trigger"
 description: "Shared source-trigger discovery and local execution primitives."
-order: 37
+order: 38
 ---
 
 ## Import
 
 ```ts
-import { discoverSourceTriggers, runTriggerTarget } from "veryfront/trigger";
+import {
+  discoverSourceTriggers,
+  isTriggerId,
+  isTriggerTarget,
+  runTriggerTarget,
+} from "veryfront/trigger";
 ```
 
 ## Examples
@@ -37,19 +42,23 @@ if (dailyTriage) {
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `discoverSourceTriggers` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L113) |
-| `runTriggerTarget` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L179) |
+| `discoverSourceTriggers` | Discover, validate, normalize, and deterministically de-duplicate source trigger definitions. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L352) |
+| `isTriggerId` | Return true for a bounded canonical slash-separated trigger identifier. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/validation.ts#L8) |
+| `isTriggerTarget` | Return true only for canonical targets stored in own data properties. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/target.ts#L41) |
+| `runTriggerTarget` | Discover and execute one canonical task, workflow, or agent target. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L361) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `RunTriggerTargetOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L19) |
-| `SourceTriggerDiscoveryError` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L26) |
-| `SourceTriggerDiscoveryErrorCode` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L18) |
-| `SourceTriggerDiscoveryResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L36) |
-| `SourceTriggerKind` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L16) |
-| `TriggerDefinitionWithId` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L49) |
-| `TriggerDiscoveryOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L41) |
-| `TriggerTarget` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/target.ts#L3) |
-| `TriggerTargetRunResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L32) |
+| `RunTriggerTargetOptions` | Options for one local trigger target execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L25) |
+| `SourceTriggerDiscoveryError` | Structured failure produced while discovering one source definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L34) |
+| `SourceTriggerDiscoveryErrorCode` | Stable failure categories emitted while discovering source triggers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L25) |
+| `SourceTriggerDiscoveryOptions` | Validation and normalization contract for source trigger discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L93) |
+| `SourceTriggerDiscoveryResult` | Deterministic source trigger discovery result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L52) |
+| `SourceTriggerKind` | Source definition families handled by shared trigger discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L22) |
+| `TriggerDefinitionWithId` | Minimum contract required for source trigger de-duplication. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L87) |
+| `TriggerDiscoveryOptions` | Shared filesystem, directory, and source-kind options for trigger discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/discovery.ts#L71) |
+| `TriggerTarget` | Canonical reference to a runnable project definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/target.ts#L7) |
+| `TriggerTargetKind` | Supported local trigger target kinds. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/target.ts#L4) |
+| `TriggerTargetRunResult` | Successful local trigger target result. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/trigger/local-runner.ts#L51) |
diff --git a/docs/api-reference/veryfront/ui.md b/docs/api-reference/veryfront/ui.md
index a481fc62de..7e4c2b2828 100644
--- a/docs/api-reference/veryfront/ui.md
+++ b/docs/api-reference/veryfront/ui.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/ui"
 description: "`veryfront/ui` - the public UI primitive library. Dependency-light forks of Veryfront Studio's design system (cva/Slot inlined; colours remapped to veryfront's `[var(--token)]` vocabulary; zero external packages). These are the base layer the `veryfront/chat` components are built on: `chat` depends on `ui`, never the reverse."
-order: 38
+order: 39
 ---
 
 ## Import
@@ -61,7 +61,7 @@ export default function App({ children }: { children: React.ReactNode }) {
 | `AlertAction` | Trailing action slot for `<Alert>` (button or link). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/alert.tsx#L89) |
 | `AlertContent` | Message body for `<Alert>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/alert.tsx#L70) |
 | `AlertIcon` | Leading icon slot for `<Alert>` (size-4 recommended). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/alert.tsx#L51) |
-| `AppShell` | Compound AppShell. Compose: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L529) |
+| `AppShell` | Compound AppShell. Compose: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L628) |
 | `Avatar` | Render a user / agent / entity avatar. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/avatar.tsx#L37) |
 | `Badge` | Render a badge. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/badge.tsx#L38) |
 | `Button` | Render an action button. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/button.tsx#L126) |
@@ -75,9 +75,9 @@ export default function App({ children }: { children: React.ReactNode }) {
 | `Collapsible` | Collapsible root - owns open state. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/collapsible.tsx#L29) |
 | `CollapsibleContent` | Collapsible content - rendered only while open. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/collapsible.tsx#L80) |
 | `CollapsibleTrigger` | Toggles the collapsible. `asChild` merges onto the child element. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/collapsible.tsx#L54) |
-| `ColorModeProvider` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L47) |
-| `ColorModeScript` | Inline script to prevent flash of wrong color mode on SSR. Render this in &lt;head&gt; before any content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L127) |
-| `ColorModeToggle` | Simple toggle button for color mode. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L149) |
+| `ColorModeProvider` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L60) |
+| `ColorModeScript` | Inline script to prevent flash of wrong color mode on SSR. Render this in &lt;head&gt; before any content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L152) |
+| `ColorModeToggle` | Simple toggle button for color mode. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L176) |
 | `Command` | Command root - owns the filter query and the item registry. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L35) |
 | `CommandDialog` | A Command palette inside a modal Dialog overlay. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L94) |
 | `CommandEmpty` | Shown when the query matches no items. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L173) |
@@ -176,19 +176,19 @@ export default function App({ children }: { children: React.ReactNode }) {
 | `generateTokenCSS` | Generates the scoped CSS for the design tokens. Every rule matches BOTH the canonical `[data-vf-ui]` scope and the `[data-vf-chat]` compat alias, so tokens don't leak to the page and existing consumers keep working. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/design-tokens.ts#L184) |
 | `getDocumentNonce` | Reuse the server-issued CSP nonce for client-created style/script elements during hydration and SPA updates. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/csp-nonce.ts#L5) |
 | `getFileTypeLabel` | Human label for a file extension, falling back to the media type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/file-type.tsx#L233) |
-| `useColorModeOptional` | Non-throwing variant - returns `null` when there is no `ColorModeProvider`. Use for components that should render standalone (e.g. a `CodeBlock` dropped into markdown) and fall back to light mode. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L117) |
+| `useColorModeOptional` | Non-throwing variant - returns `null` when there is no `ColorModeProvider`. Use for components that should render standalone (e.g. a `CodeBlock` dropped into markdown) and fall back to light mode. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L142) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
 | `AlertProps` | Props accepted by `<Alert>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/alert.tsx#L23) |
-| `AppShellHeaderProps` | Props accepted by `AppShellHeader`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L434) |
-| `AppShellOpenState` | Per-side visibility map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L94) |
-| `AppShellProps` | Props accepted by `AppShell`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L100) |
+| `AppShellHeaderProps` | Props accepted by `AppShellHeader`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L533) |
+| `AppShellOpenState` | Per-side visibility map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L155) |
+| `AppShellProps` | Props accepted by `AppShell`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L161) |
 | `AppShellSide` | Which edge a sidebar docks to. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L29) |
-| `AppShellSidebarProps` | Props accepted by `AppShellSidebar`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L230) |
-| `AppShellTriggerProps` | Props accepted by `AppShellTrigger`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L466) |
+| `AppShellSidebarProps` | Props accepted by `AppShellSidebar`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L319) |
+| `AppShellTriggerProps` | Props accepted by `AppShellTrigger`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L565) |
 | `AvatarProps` | Props accepted by `<Avatar>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/avatar.tsx#L25) |
 | `BadgeProps` | Props accepted by `<Badge>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/badge.tsx#L32) |
 | `ButtonProps` | Props accepted by `<Button>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/button.tsx#L116) |
@@ -197,7 +197,7 @@ export default function App({ children }: { children: React.ReactNode }) {
 | `CheckboxProps` | Props accepted by `<Checkbox>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/checkbox.tsx#L16) |
 | `CodeBlockProps` | Props accepted by `<CodeBlock>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/code-block.tsx#L237) |
 | `CollapsibleProps` | Props accepted by `<Collapsible>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/collapsible.tsx#L21) |
-| `ColorModeProviderProps` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L40) |
+| `ColorModeProviderProps` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L53) |
 | `CommandDialogProps` | Props accepted by `<CommandDialog>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L86) |
 | `CommandInputProps` | Props accepted by `<CommandInput>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L111) |
 | `CommandItemProps` | Props accepted by `<CommandItem>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/command.tsx#L223) |
@@ -251,7 +251,7 @@ export default function App({ children }: { children: React.ReactNode }) {
 | `selectTriggerVariants` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/select.tsx#L21) |
 | `switchTrackVariants` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/switch.tsx#L15) |
 | `textareaVariants` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/textarea.tsx#L11) |
-| `useAppShell` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L47) |
+| `useAppShell` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/app-shell.tsx#L108) |
 | `useColorMode` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/components/ui/color-mode.tsx#L23) |
 
 ## Deep imports
diff --git a/docs/api-reference/veryfront/utils.md b/docs/api-reference/veryfront/utils.md
index 259d6533d9..ad59130695 100644
--- a/docs/api-reference/veryfront/utils.md
+++ b/docs/api-reference/veryfront/utils.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/utils"
 description: "Runtime detection, logging, constants, hashing, and feature flags."
-order: 39
+order: 40
 ---
 
 ## Import
@@ -39,9 +39,9 @@ serverLogger.info("Booting server", { project_id: "proj_123" });
 | `BREAKPOINT_XL` | Shared breakpoint xl value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/html.ts#L13) |
 | `BYTES_PER_KB` | Shared bytes per kb value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/network.ts#L8) |
 | `DEFAULT_ALLOWED_CDN_HOSTS` | Default value for allowed cdn hosts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cdn.ts#L77) |
-| `DEFAULT_BUILD_CONCURRENCY` | Default value for build concurrency. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/build.ts#L2) |
+| `DEFAULT_BUILD_CONCURRENCY` | Default value for build concurrency. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/build.ts#L4) |
 | `DEFAULT_DASHBOARD_PORT` | Default port for development dashboard (matches veryfront.config.ts default) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/server.ts#L11) |
-| `DEFAULT_LRU_MAX_ENTRIES` | Default value for lru max entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L45) |
+| `DEFAULT_LRU_MAX_ENTRIES` | Default value for lru max entries. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L107) |
 | `DEV_SERVER_ENDPOINTS` | Shared dev server endpoints value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/server.ts#L135) |
 | `FORBIDDEN_PATH_PATTERNS` | Shared forbidden path patterns value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/security.ts#L4) |
 | `HASH_SEED_DJB2` | Shared hash seed djb2 value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/hash.ts#L2) |
@@ -73,22 +73,22 @@ serverLogger.info("Booting server", { project_id: "proj_123" });
 | `HTTP_STATUS_SERVER_ERROR_MIN` | Shared HTTP status server error min value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L66) |
 | `HTTP_STATUS_SUCCESS_MIN` | Shared HTTP status success min value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L60) |
 | `HTTP_UNAVAILABLE` | Shared HTTP unavailable value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L54) |
-| `IMAGE_OPTIMIZATION` | Shared image optimization value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/build.ts#L5) |
-| `MAX_BATCH_SIZE` | ****** Batch limits ******* | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/limits.ts#L31) |
+| `IMAGE_OPTIMIZATION` | Shared image optimization value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/build.ts#L7) |
+| `MAX_BATCH_SIZE` | ****** Batch limits ******* | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/limits.ts#L33) |
 | `MAX_CSS_PIPELINE_IDENTITY_CODE_UNITS` | Maximum UTF-16 code units accepted for one complete CSS pipeline identity. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/css-artifact-identity.ts#L13) |
 | `MAX_CSS_PIPELINE_IDENTITY_UTF8_BYTES` | Maximum encoded UTF-8 bytes accepted for one complete CSS pipeline identity. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/css-artifact-identity.ts#L16) |
 | `MAX_PATH_LENGTH` | Maximum value for path length. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/security.ts#L16) |
 | `MAX_PATH_TRAVERSAL_DEPTH` | Maximum value for path traversal depth. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/security.ts#L2) |
-| `MS_PER_SECOND` | Shared ms per second value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L5) |
+| `MS_PER_SECOND` | Shared ms per second value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L7) |
 | `PREFETCH_DEFAULT_DELAY_MS` | Shared prefetch default delay ms value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L24) |
 | `PREFETCH_DEFAULT_TIMEOUT_MS` | Shared prefetch default timeout ms value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L22) |
 | `PREFETCH_MAX_SIZE_BYTES` | Shared prefetch max size bytes value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/http.ts#L20) |
 | `REACT_DEFAULT_VERSION` | Shared React default version value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cdn.ts#L12) |
 | `RESPONSIVE_IMAGE_WIDTH_LG` | Shared responsive image width lg value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/network.ts#L19) |
 | `RESPONSIVE_IMAGE_WIDTHS` | Shared responsive image widths value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/network.ts#L22) |
-| `RSC_MANIFEST_CACHE_TTL_MS` | Shared RSC manifest cache ttl ms value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L85) |
-| `TSX_LAYOUT_MAX_ENTRIES` | Shared TSX layout max entries value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L57) |
-| `TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES` | Per-project cap for the TSX layout component cache. Prevents a single noisy tenant from evicting every other project's cached layouts. Defaults to ceil(TSX_LAYOUT_MAX_ENTRIES / 10) so no one project consumes more than ~10 % of the global budget. Set via TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES env var. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L67) |
+| `RSC_MANIFEST_CACHE_TTL_MS` | Shared RSC manifest cache ttl ms value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L186) |
+| `TSX_LAYOUT_MAX_ENTRIES` | Shared TSX layout max entries value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L119) |
+| `TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES` | Per-project cap for the TSX layout component cache. Prevents a single noisy tenant from evicting every other project's cached layouts. Defaults to ceil(TSX_LAYOUT_MAX_ENTRIES / 10) so no one project consumes more than ~10 % of the global budget. Set via TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES env var. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/cache.ts#L129) |
 | `VERSION` | Shared version value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/version-constant.ts#L4) |
 | `Z_INDEX_DEV_INDICATOR` | Shared z index dev indicator value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/html.ts#L2) |
 | `Z_INDEX_ERROR_OVERLAY` | Shared z index error overlay value. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/constants/html.ts#L4) |
@@ -132,14 +132,14 @@ serverLogger.info("Booting server", { project_id: "proj_123" });
 | `memoizeAsync` | Memoize async. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/memoize.ts#L71) |
 | `memoizeHash` | FNV-1a hash algorithm for fast cache key generation. 10-15x faster than JSON.stringify() and uses 70-80% less memory. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/memoize.ts#L90) |
 | `normalizePath` | Normalizes path. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/path-utils.ts#L11) |
-| `parallelMap` | Run parallel map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/parallel.ts#L43) |
-| `redactSensitive` | Returns a redacted deep copy of `context`. Any property whose key is `isSensitiveKey` has its value replaced with `REDACTED`; nested plain objects, class instances, and arrays are traversed. The input is never mutated, and the pass fails closed (returns `REDACTED`) on cycles, depth overflow, or a throwing getter. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L187) |
+| `parallelMap` | Run parallel map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/parallel.ts#L52) |
+| `redactSensitive` | Returns a redacted copy of `context` while preserving the established source and runtime value shapes. Any property whose key is `isSensitiveKey` is replaced with `REDACTED`; nested records and arrays are traversed, while primitives and scalar-serializing objects retain their original types. The input is never mutated. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L412) |
 | `refreshLoggerConfig` | Re-read logger configuration from environment variables. Call after loading .env files so the logger picks up any overrides. The active preset (cli/server) is preserved across refreshes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L184) |
 | `registerTraceContextGetter` | Register the trace context getter. Called by trace-bridge.ts after OTLP initialization. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L649) |
 | `runWithRequestContextAsync` | Run with request context async. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L39) |
 | `safeJsonParse` | Parse `value` as JSON without throwing; failures return `{ ok: false, error }` so callers handle them without a surrounding try/catch. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/json.ts#L16) |
-| `sanitizeUrlCredentials` | Strip credentials from URL-shaped strings so they can be safely emitted in free-form text (error messages, stacks, lifted `request_url` fields). Unlike `redactSensitive`, which is key-based, this scrubs secrets embedded in the *value* itself: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L232) |
-| `sanitizeUrlForSpan` | Return the URL form safe to attach to observability span attributes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L287) |
+| `sanitizeUrlCredentials` | Strip credentials from URL-shaped strings so they can be safely emitted in free-form text (error messages, stacks, lifted `request_url` fields). Unlike `redactSensitive`, which is key-based, this scrubs secrets embedded in the *value* itself: | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L733) |
+| `sanitizeUrlForSpan` | Return the URL form safe to attach to observability span attributes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/redact.ts#L857) |
 | `shortHash` | Create short hash. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/hash-utils.ts#L51) |
 | `simpleHash` | Create simple hash. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/hash-utils.ts#L34) |
 | `sleep` | Resolve after `ms` milliseconds; rejects with `abortSignal.reason` if aborted first. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/sleep.ts#L2) |
@@ -214,27 +214,27 @@ import { __registerLogRecordEmitter, __registerRequestContextGetter, __registerT
 | `__resetLogRecordEmitterForTests` | Reset the process-level structured log emitter. Only intended for tests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L230) |
 | `__resetTraceContextGetterForTests` | Reset the trace context getter. Only intended for testing purposes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L660) |
 | `__subscribeLogRecordEmitter` | Subscribe to process-level structured log records. Returns an unregister function. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L222) |
-| `colorize` | Apply ANSI color codes to text if enabled. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L67) |
+| `colorize` | Apply ANSI color codes to text if enabled. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L136) |
 | `createRequestLogger` | Create a logger for a specific request context. Useful for binding request-specific metadata to all logs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L767) |
 | `createRunUserLogger` | Create run user logger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L779) |
-| `formatContextText` | Format context and error as indented key=value pairs. Filters out undefined values for cleaner output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L145) |
-| `formatErrorText` | Format a serialized error for text output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L124) |
-| `formatTimestamp` | Format a timestamp as HH:MM:SS. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L59) |
-| `formatValue` | Format a value for log output (handles strings, numbers, booleans, objects). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L90) |
+| `formatContextText` | Format context and error as indented key=value pairs. Filters out undefined values for cleaner output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L214) |
+| `formatErrorText` | Format a serialized error for text output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L193) |
+| `formatTimestamp` | Format a timestamp as HH:MM:SS. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L128) |
+| `formatValue` | Format a value for log output (handles strings, numbers, booleans, objects). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L159) |
 | `getBaseLogger` | Get the base logger without request context awareness. Use this when you need to create a request-scoped logger in middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L749) |
 | `getDefaultLevel` | Determine the log level based on environment variables. Exported for testing purposes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L143) |
 | `getRequestContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L26) |
 | `getRequestLogger` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L30) |
-| `isRecord` | Check if value is a non-null, non-array object (plain record). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L163) |
-| `normalizeText` | Normalize whitespace in text (collapse multiple spaces to single space). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L75) |
-| `padTag` | Pad or truncate a tag to fixed width for aligned output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L51) |
+| `isRecord` | Check if value is a non-null, non-array object (plain record). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L232) |
+| `normalizeText` | Normalize whitespace in text (collapse multiple spaces to single space). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L144) |
+| `padTag` | Pad or truncate a tag to fixed width for aligned output. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L120) |
 | `refreshLoggerConfig` | Re-read logger configuration from environment variables. Call after loading .env files so the logger picks up any overrides. The active preset (cli/server) is preserved across refreshes. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L184) |
 | `runWithRequestContext` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L34) |
 | `runWithRequestContextAsync` | Run with request context async. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L39) |
-| `serializeError` | Serialize an error object for structured logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L133) |
+| `serializeError` | Serialize an error object for structured logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L202) |
 | `setLoggerPreset` | Switch the text output format between server-style (timestamp + tag prefix) and CLI-style (2-space indent + glyph only, no timestamp or tag). JSON output is unaffected by this setting. Call before any framework code runs in CLI entry points so framework messages render in the CLI's visual language. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L198) |
 | `setLogLevel` | Override the active log level without re-reading environment variables. Use when a verbosity flag (--verbose, --quiet) has been parsed and its effect needs to propagate to all loggers immediately. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L208) |
-| `truncateText` | Truncate text to maxLength, adding ellipsis if truncated. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L82) |
+| `truncateText` | Truncate text to maxLength, adding ellipsis if truncated. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L151) |
 
 #### Types
 
@@ -248,7 +248,7 @@ import { __registerLogRecordEmitter, __registerRequestContextGetter, __registerT
 | `LogLevelName` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L16) |
 | `LogRecordEmitter` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/logger.ts#L122) |
 | `RequestContext` | Context for request. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/request-context.ts#L14) |
-| `SerializedError` | Serialized error structure for structured logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L115) |
+| `SerializedError` | Serialized error structure for structured logging. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/utils/logger/core.ts#L184) |
 
 #### Constants
 
diff --git a/docs/api-reference/veryfront/webhook.md b/docs/api-reference/veryfront/webhook.md
index 96ef09da52..710447d954 100644
--- a/docs/api-reference/veryfront/webhook.md
+++ b/docs/api-reference/veryfront/webhook.md
@@ -1,13 +1,19 @@
 ---
 title: "veryfront/webhook"
 description: "Source-defined webhooks for Veryfront projects."
-order: 40
+order: 41
 ---
 
 ## Import
 
 ```ts
-import { discoverWebhooks, isWebhookDefinition, webhook } from "veryfront/webhook";
+import {
+  discoverWebhooks,
+  isWebhookDefinition,
+  isWebhookId,
+  prepareWebhookInvocation,
+  webhook,
+} from "veryfront/webhook";
 ```
 
 ## Examples
@@ -36,20 +42,24 @@ export default webhook({
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `discoverWebhooks` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L18) |
-| `isWebhookDefinition` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L37) |
-| `webhook` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/factory.ts#L54) |
+| `discoverWebhooks` | Discover and validate source-defined webhooks across configured directories. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L27) |
+| `isWebhookDefinition` | Return true only when every webhook field and nested invariant is valid. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L69) |
+| `isWebhookId` | Return true for source webhook identifiers accepted by hosted reconciliation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/validation.ts#L247) |
+| `prepareWebhookInvocation` | Revalidate and own a definition and payload before local webhook execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/runtime.ts#L168) |
+| `webhook` | Validate and normalize a source-defined webhook configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/factory.ts#L10) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `WebhookAgentMessageMapping` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L22) |
-| `WebhookConfig` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L35) |
-| `WebhookDefinition` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L26) |
-| `WebhookDiscoveryOptions` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L9) |
-| `WebhookDiscoveryResult` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L16) |
-| `WebhookEventFilter` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L17) |
-| `WebhookEventFilterCondition` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L11) |
-| `WebhookEventFilterMode` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L3) |
-| `WebhookEventFilterOperator` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L5) |
+| `PreparedWebhookInvocation` | Owned, cloud-compatible inputs for one local webhook target run. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/runtime.ts#L16) |
+| `WebhookAgentConversationMode` | Hosted conversation behavior for an agent-target webhook. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L34) |
+| `WebhookAgentMessageMapping` | Prompt and optional hosted conversation mapping for an agent target. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L40) |
+| `WebhookConfig` | Author-facing webhook configuration accepted by `webhook`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L66) |
+| `WebhookDefinition` | Validated source definition for one webhook trigger. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L50) |
+| `WebhookDiscoveryOptions` | Inputs for deterministic source webhook discovery. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L12) |
+| `WebhookDiscoveryResult` | Valid webhooks and bounded per-file discovery diagnostics. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/discovery.ts#L24) |
+| `WebhookEventFilter` | Optional gate evaluated before a webhook target starts. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L26) |
+| `WebhookEventFilterCondition` | One dot-path comparison against the webhook JSON payload. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L16) |
+| `WebhookEventFilterMode` | Whether every filter condition or at least one condition must match. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L5) |
+| `WebhookEventFilterOperator` | Comparisons supported by hosted and local webhook filtering. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/webhook/types.ts#L8) |
diff --git a/docs/api-reference/veryfront/workflow.md b/docs/api-reference/veryfront/workflow.md
index 78db23420b..024300b430 100644
--- a/docs/api-reference/veryfront/workflow.md
+++ b/docs/api-reference/veryfront/workflow.md
@@ -1,7 +1,7 @@
 ---
 title: "veryfront/workflow"
 description: "DAG-based agentic workflows with human-in-the-loop support."
-order: 41
+order: 42
 ---
 
 ## Import
@@ -132,13 +132,13 @@ Options accepted by parallel.
 | `delay` | Create a simple delay/sleep node. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/wait.ts#L66) |
 | `dependsOn` | Declare workflow step dependencies. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/workflow.ts#L119) |
 | `doWhile` | Create a do-while workflow loop. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/loop.ts#L103) |
-| `generateId` | Generate a unique workflow ID | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L362) |
+| `generateId` | Generate a unique workflow ID | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L615) |
 | `getWorkflowTenant` | Get the current workflow tenant context. Returns undefined if not executing within a workflow step. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/executor/step-executor.ts#L51) |
 | `hasWorkerSupport` | Check whether worker support is present. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/backends/types.ts#L262) |
 | `loop` | Create a loop workflow step. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/loop.ts#L56) |
 | `map` | Create a mapped workflow step. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/map.ts#L24) |
 | `parallel` | Create a parallel node for concurrent execution of multiple steps. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/parallel.ts#L21) |
-| `parseDuration` | Parse duration string to milliseconds | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L288) |
+| `parseDuration` | Parse duration string to milliseconds | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L461) |
 | `sequence` | Create a sequential workflow definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/workflow.ts#L78) |
 | `step` | Create a workflow step definition. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/step.ts#L25) |
 | `subWorkflow` | Create a sub-workflow node for nested execution. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/sub-workflow.ts#L19) |
@@ -169,7 +169,7 @@ Options accepted by parallel.
 |------|-------------|--------|
 | `BackendConfig` | Configuration used by backend. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/backends/types.ts#L57) |
 | `BranchOptions` | Options accepted by branch. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/branch.ts#L12) |
-| `CapturedTenantContext` | Captured tenant context for multi-tenant workflow execution. Allows tools and framework utilities to access the current tenant without explicit parameter passing. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L235) |
+| `CapturedTenantContext` | Captured tenant context for multi-tenant workflow execution. Allows tools and framework utilities to access the current tenant without explicit parameter passing. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L312) |
 | `LoopOptions` | Options accepted by loop. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/loop.ts#L20) |
 | `MapOptions` | Options accepted by map. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/map.ts#L13) |
 | `ParallelOptions` | Options accepted by parallel. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/parallel.ts#L12) |
@@ -187,19 +187,19 @@ Options accepted by parallel.
 | `UseWorkflowStartResult` | Result returned from use workflow start. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/react/use-workflow-start.ts#L13) |
 | `WaitForApprovalOptions` | Options accepted by wait for approval. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/wait.ts#L6) |
 | `WaitForEventOptions` | Options accepted by wait for event. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/wait.ts#L36) |
-| `Workflow` | Workflow instance | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L224) |
+| `Workflow` | Workflow instance | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L301) |
 | `WorkflowBackend` | Public API contract for workflow backend. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/backends/types.ts#L72) |
 | `WorkflowClientConfig` | Configuration used by workflow client. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/api/workflow-client.ts#L28) |
-| `WorkflowContext` | Workflow context containing structured-cloneable input and node outputs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L50) |
-| `WorkflowDefinition` | Workflow definition | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L207) |
+| `WorkflowContext` | Workflow context containing structured-cloneable input and node outputs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L54) |
+| `WorkflowDefinition` | Workflow definition | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L283) |
 | `WorkflowExecutorConfig` | Workflow executor configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/executor/workflow-executor.ts#L59) |
 | `WorkflowHandle` | Controller for a running workflow. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/executor/workflow-executor.ts#L91) |
-| `WorkflowNode` | Workflow node | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L198) |
-| `WorkflowNodeConfig` | Union of all workflow node configurations | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L186) |
+| `WorkflowNode` | Workflow node | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L274) |
+| `WorkflowNodeConfig` | Union of all workflow node configurations | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L262) |
 | `WorkflowOptions` | Options accepted by workflow. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/dsl/workflow.ts#L22) |
-| `WorkflowRun` | Workflow run state | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L255) |
+| `WorkflowRun` | Workflow run state | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/types.ts#L332) |
 | `WorkflowRunUpdate` | Run state that may change after the immutable run snapshot is created. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/backends/types.ts#L13) |
-| `WorkflowStatus` | Public API contract for workflow status. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/schemas/workflow.schema.ts#L250) |
+| `WorkflowStatus` | Public API contract for workflow status. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/schemas/workflow.schema.ts#L251) |
 
 ### Constants
 
@@ -262,8 +262,8 @@ import { createAgent, createClaudeCodeTool, createEventPublisher } from "veryfro
 |------|-------------|--------|
 | `createAgent` | Create a reusable agent function with preset configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/agent.ts#L257) |
 | `createClaudeCodeTool` | Create a customized Claude Code tool | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/tool.ts#L113) |
-| `createEventPublisher` | Create an event publisher based on environment | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L250) |
-| `createWebSocketHandler` | Create a WebSocket handler for HTTP upgrade requests | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L255) |
+| `createEventPublisher` | Create an event publisher based on environment | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L299) |
+| `createWebSocketHandler` | Create a WebSocket handler for HTTP upgrade requests. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L671) |
 | `createWorkspaceSync` | Create a workspace sync for a Claude Code run | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L638) |
 | `executeAgent` | Execute a task using the Claude Agent SDK. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/agent.ts#L108) |
 | `withWorkspace` | Execute a function with a synchronized workspace | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L663) |
@@ -272,13 +272,14 @@ import { createAgent, createClaudeCodeTool, createEventPublisher } from "veryfro
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `AgentController` | Agent controller for handling client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L302) |
-| `CallbackEventPublisher` | Simple callback-based publisher Calls a function for each event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L197) |
-| `MemoryEventPublisher` | In-memory event publisher using EventTarget Useful for testing or single-process deployments | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L30) |
-| `MultiEventPublisher` | Publishes events to multiple publishers | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L216) |
-| `RedisEventPublisher` | Implement redis event publisher. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L84) |
-| `SSEEventPublisher` | Server-Sent Events publisher Writes events directly to a ReadableStream controller | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L153) |
-| `WebSocketPublisher` | WebSocket-based bidirectional publisher | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L55) |
+| `AgentController` | Backwards-compatible single-connection controller. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L1346) |
+| `AgentControllerRegistry` | Retains one controller generation per run independently of transient publisher connections. Replacements synchronously retire the old publisher; only an exact publisher token can detach, and only an exact run token can terminally release the controller. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L1389) |
+| `CallbackEventPublisher` | Simple callback-based publisher Calls a function for each event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L240) |
+| `MemoryEventPublisher` | In-memory event publisher using EventTarget Useful for testing or single-process deployments | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L53) |
+| `MultiEventPublisher` | Publishes events to multiple publishers | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L259) |
+| `RedisEventPublisher` | Redis-backed publisher whose implementation is supplied by the Redis extension. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L90) |
+| `SSEEventPublisher` | Server-Sent Events publisher Writes events directly to a ReadableStream controller | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/event-publisher.ts#L157) |
+| `WebSocketPublisher` | WebSocket-based bidirectional publisher | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L187) |
 | `WorkspaceSync` | Workspace manager for Claude Code execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L158) |
 
 #### Types
@@ -286,44 +287,49 @@ import { createAgent, createClaudeCodeTool, createEventPublisher } from "veryfro
 | Name | Description | Source |
 |------|-------------|--------|
 | `AgentConfig` | Agent configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/agent.ts#L20) |
-| `ApprovalRequestEvent` | Approval request event (sent to client when tool needs approval) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L359) |
-| `BidirectionalPublisher` | Bidirectional publisher interface (WebSocket) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L406) |
-| `CancelCommand` | Cancel the running agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L284) |
-| `CancelledEvent` | Cancelled event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L388) |
-| `ClaudeCodeEvent` | Union of all event types | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L220) |
-| `ClaudeCodeEventBase` | Base event interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L91) |
-| `ClaudeCodeEventHandler` | Event subscriber callback | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L248) |
-| `ClaudeCodeEventPublisher` | Event publisher interface for streaming events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L238) |
-| `ClaudeCodeEventSubscriber` | Event subscriber interface for receiving events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L253) |
-| `ClaudeCodeEventType` | Event types for streaming Claude Code execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L73) |
-| `ClaudeCodeMode` | Tool modes for Claude Code agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L10) |
-| `ClaudeCodeResult` | Final result from agent execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L28) |
-| `ClaudeCodeToolInput` | Input schema type for claude-code workflow tools | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L50) |
-| `ClientCommand` | Union of all client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L324) |
-| `ClientCommandHandler` | Handler for client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L334) |
-| `ClientCommandType` | Client command types for WebSocket communication | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L265) |
-| `CompleteEvent` | Complete event (agent finished) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L202) |
-| `ErrorEvent` | Error event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L210) |
+| `AgentControllerConfig` | Run-scoped controller policy. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L130) |
+| `AgentControllerHandle` | Run-scoped command surface without transport lifecycle authority. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L140) |
+| `AgentControllerRegistration` | Opaque ownership token for one run publisher generation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L167) |
+| `AgentControllerRunRegistration` | Opaque ownership token for one run controller generation. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L157) |
+| `ApprovalRequestEvent` | Approval request event (sent to client when tool needs approval) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L397) |
+| `BidirectionalPublisher` | Bidirectional publisher interface (WebSocket) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L472) |
+| `CancelCommand` | Cancel the running agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L303) |
+| `CancelledEvent` | Cancelled event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L430) |
+| `ClaudeCodeEvent` | Union of all event types | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L237) |
+| `ClaudeCodeEventBase` | Base event interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L108) |
+| `ClaudeCodeEventHandler` | Event subscriber callback | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L265) |
+| `ClaudeCodeEventPublisher` | Event publisher interface for streaming events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L255) |
+| `ClaudeCodeEventSubscriber` | Event subscriber interface for receiving events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L270) |
+| `ClaudeCodeEventType` | Event types for streaming Claude Code execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L90) |
+| `ClaudeCodeMode` | Tool modes for Claude Code agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L27) |
+| `ClaudeCodeResult` | Final result from agent execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L45) |
+| `ClaudeCodeToolInput` | Input schema type for claude-code workflow tools | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L67) |
+| `ClientCommand` | Union of all client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L349) |
+| `ClientCommandHandler` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L363) |
+| `ClientCommandType` | Client command types for WebSocket communication | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L282) |
+| `CompleteEvent` | Complete event (agent finished) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L219) |
+| `ErrorEvent` | Error event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L227) |
 | `FileChange` | File change tracking | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L54) |
-| `InputCommand` | Send user input to the agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L309) |
-| `InputRequestEvent` | Input request event (sent to client when agent needs user input) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L371) |
-| `IterationCompleteEvent` | Iteration complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L169) |
-| `IterationStartEvent` | Iteration start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L105) |
-| `PingCommand` | Keepalive ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L317) |
-| `PongEvent` | Pong response to ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L381) |
+| `InputCommand` | Send user input to the agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L332) |
+| `InputRequestEvent` | Input request event (sent to client when agent needs user input) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L411) |
+| `IterationCompleteEvent` | Iteration complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L186) |
+| `IterationStartEvent` | Iteration start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L122) |
+| `PingCommand` | Keepalive ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L342) |
+| `PongEvent` | Pong response to ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L423) |
 | `RedisEventPublisherConfig` | Redis Pub/Sub publisher configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/distributed/redis-runtime-provider.ts#L132) |
-| `TextCompleteEvent` | Text complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L122) |
-| `TextDeltaEvent` | Text delta event (streaming text chunk) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L114) |
-| `ThinkingCompleteEvent` | Thinking complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L194) |
-| `ThinkingDeltaEvent` | Thinking delta event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L186) |
-| `ThinkingStartEvent` | Thinking start event (extended thinking) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L179) |
-| `ToolApprovalConfig` | Tool approval configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L416) |
-| `ToolCallCompleteEvent` | Tool call complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L148) |
-| `ToolCallInputEvent` | Tool call input delta (streaming input JSON) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L139) |
-| `ToolCallStartEvent` | Tool call start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L130) |
-| `ToolResultEvent` | Tool result event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L158) |
+| `TextCompleteEvent` | Text complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L139) |
+| `TextDeltaEvent` | Text delta event (streaming text chunk) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L131) |
+| `ThinkingCompleteEvent` | Thinking complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L211) |
+| `ThinkingDeltaEvent` | Thinking delta event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L203) |
+| `ThinkingStartEvent` | Thinking start event (extended thinking) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L196) |
+| `ToolApprovalConfig` | Tool approval configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L488) |
+| `ToolCallCompleteEvent` | Tool call complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L165) |
+| `ToolCallInputEvent` | Tool call input delta (streaming input JSON) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L156) |
+| `ToolCallStartEvent` | Tool call start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L147) |
+| `ToolResultEvent` | Tool result event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L175) |
 | `UploadResult` | Upload result | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L91) |
-| `WebSocketPublisherConfig` | WebSocket publisher configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L34) |
+| `WebSocketHandlerConfig` | Configuration for a registry-owned WebSocket upgrade handler. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L648) |
+| `WebSocketPublisherConfig` | WebSocket publisher configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/websocket-publisher.ts#L112) |
 | `WorkspaceConfig` | Workspace configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L28) |
 | `WorkspaceSyncResult` | Workspace sync result | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/workspace-sync.ts#L64) |
 
@@ -370,49 +376,69 @@ import { useClaudeCodeStream, useClaudeCodeText, useClaudeCodeWebSocket } from "
 Claude Agent SDK Integration Types Type definitions for the Claude Agent SDK workflow tools.
 
 ```ts
-import "veryfront/workflow/claude-code/types";
+import { MAX_CLAUDE_CODE_WIRE_ARRAY_ITEMS, MAX_CLAUDE_CODE_WIRE_FIELD_LENGTH, MAX_CLAUDE_CODE_WIRE_IDENTIFIER_LENGTH } from "veryfront/workflow/claude-code/types";
 ```
 
+#### Components
+
+| Name | Description | Source |
+|------|-------------|--------|
+| `MAX_CLAUDE_CODE_WIRE_ARRAY_ITEMS` | Maximum array entries in structured wire data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L14) |
+| `MAX_CLAUDE_CODE_WIRE_FIELD_LENGTH` | Maximum UTF-16 length of one non-identity wire field. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L10) |
+| `MAX_CLAUDE_CODE_WIRE_IDENTIFIER_LENGTH` | Maximum UTF-16 length of a wire identity. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L12) |
+| `MAX_CLAUDE_CODE_WIRE_JSON_DEPTH` | Maximum nesting depth in structured wire data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L16) |
+| `MAX_CLAUDE_CODE_WIRE_JSON_NODES` | Maximum aggregate nodes in structured wire data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L18) |
+| `MAX_CLAUDE_CODE_WIRE_KEY_LENGTH` | Maximum UTF-16 length of a structured wire object key. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L22) |
+| `MAX_CLAUDE_CODE_WIRE_MESSAGE_BYTES` | Maximum encoded size of one Claude Code wire message. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L8) |
+| `MAX_CLAUDE_CODE_WIRE_OBJECT_FIELDS` | Maximum own fields on one structured wire object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L20) |
+
 #### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `ApprovalRequestEvent` | Approval request event (sent to client when tool needs approval) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L359) |
-| `BidirectionalPublisher` | Bidirectional publisher interface (WebSocket) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L406) |
-| `CancelCommand` | Cancel the running agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L284) |
-| `CancelledEvent` | Cancelled event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L388) |
-| `ClaudeCodeEvent` | Union of all event types | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L220) |
-| `ClaudeCodeEventBase` | Base event interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L91) |
-| `ClaudeCodeEventExtended` | Extended event union including bidirectional events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L396) |
-| `ClaudeCodeEventHandler` | Event subscriber callback | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L248) |
-| `ClaudeCodeEventPublisher` | Event publisher interface for streaming events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L238) |
-| `ClaudeCodeEventSubscriber` | Event subscriber interface for receiving events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L253) |
-| `ClaudeCodeEventType` | Event types for streaming Claude Code execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L73) |
-| `ClaudeCodeMode` | Tool modes for Claude Code agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L10) |
-| `ClaudeCodeResult` | Final result from agent execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L28) |
-| `ClaudeCodeToolInput` | Input schema type for claude-code workflow tools | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L50) |
-| `ClientCommand` | Union of all client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L324) |
-| `ClientCommandHandler` | Handler for client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L334) |
-| `ClientCommandType` | Client command types for WebSocket communication | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L265) |
-| `CompleteEvent` | Complete event (agent finished) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L202) |
-| `ErrorEvent` | Error event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L210) |
-| `FileChange` | File change from workspace operations | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L18) |
-| `InputCommand` | Send user input to the agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L309) |
-| `InputRequestEvent` | Input request event (sent to client when agent needs user input) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L371) |
-| `IterationCompleteEvent` | Iteration complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L169) |
-| `IterationStartEvent` | Iteration start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L105) |
-| `PingCommand` | Keepalive ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L317) |
-| `PongEvent` | Pong response to ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L381) |
-| `TextCompleteEvent` | Text complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L122) |
-| `TextDeltaEvent` | Text delta event (streaming text chunk) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L114) |
-| `ThinkingCompleteEvent` | Thinking complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L194) |
-| `ThinkingDeltaEvent` | Thinking delta event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L186) |
-| `ThinkingStartEvent` | Thinking start event (extended thinking) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L179) |
-| `ToolApprovalConfig` | Tool approval configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L416) |
-| `ToolCallCompleteEvent` | Tool call complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L148) |
-| `ToolCallInputEvent` | Tool call input delta (streaming input JSON) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L139) |
-| `ToolCallStartEvent` | Tool call start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L130) |
-| `ToolResultEvent` | Tool result event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L158) |
+| `ApprovalRequestEvent` | Approval request event (sent to client when tool needs approval) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L397) |
+| `ApproveCommand` | Approve a pending tool call | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L311) |
+| `BidirectionalPublisher` | Bidirectional publisher interface (WebSocket) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L472) |
+| `CancelCommand` | Cancel the running agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L303) |
+| `CancelledEvent` | Cancelled event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L430) |
+| `ClaudeCodeEvent` | Union of all event types | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L237) |
+| `ClaudeCodeEventBase` | Base event interface | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L108) |
+| `ClaudeCodeEventBaseExtended` | Base interface for extended events (bidirectional communication) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L387) |
+| `ClaudeCodeEventExtended` | Extended event union including bidirectional events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L461) |
+| `ClaudeCodeEventHandler` | Event subscriber callback | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L265) |
+| `ClaudeCodeEventPublisher` | Event publisher interface for streaming events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L255) |
+| `ClaudeCodeEventSubscriber` | Event subscriber interface for receiving events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L270) |
+| `ClaudeCodeEventType` | Event types for streaming Claude Code execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L90) |
+| `ClaudeCodeEventTypeExtended` | Extended event type including bidirectional events | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L376) |
+| `ClaudeCodeMode` | Tool modes for Claude Code agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L27) |
+| `ClaudeCodeResult` | Final result from agent execution | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L45) |
+| `ClaudeCodeToolInput` | Input schema type for claude-code workflow tools | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L67) |
+| `ClientCommand` | Union of all client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L349) |
+| `ClientCommandDisposition` | Handler for client commands | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L359) |
+| `ClientCommandHandler` |  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L363) |
+| `ClientCommandObserver` | Passive command observer. Its completion never controls command acknowledgement. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L371) |
+| `ClientCommandType` | Client command types for WebSocket communication | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L282) |
+| `CommandAckEvent` | Acknowledges the semantic disposition of a keyed client command. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L444) |
+| `CompleteEvent` | Complete event (agent finished) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L219) |
+| `ErrorEvent` | Error event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L227) |
+| `FileChange` | File change from workspace operations | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L35) |
+| `InputCommand` | Send user input to the agent | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L332) |
+| `InputRequestEvent` | Input request event (sent to client when agent needs user input) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L411) |
+| `IterationCompleteEvent` | Iteration complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L186) |
+| `IterationStartEvent` | Iteration start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L122) |
+| `PingCommand` | Keepalive ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L342) |
+| `PongEvent` | Pong response to ping | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L423) |
+| `RejectCommand` | Reject a pending tool call | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L321) |
+| `TextCompleteEvent` | Text complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L139) |
+| `TextDeltaEvent` | Text delta event (streaming text chunk) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L131) |
+| `ThinkingCompleteEvent` | Thinking complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L211) |
+| `ThinkingDeltaEvent` | Thinking delta event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L203) |
+| `ThinkingStartEvent` | Thinking start event (extended thinking) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L196) |
+| `ToolApprovalConfig` | Tool approval configuration | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L488) |
+| `ToolCallCompleteEvent` | Tool call complete event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L165) |
+| `ToolCallInputEvent` | Tool call input delta (streaming input JSON) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L156) |
+| `ToolCallStartEvent` | Tool call start event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L147) |
+| `ToolResultEvent` | Tool result event | [source](https://github.com/veryfront/veryfront-code/blob/main/src/workflow/claude-code/types.ts#L175) |
 
 ### `veryfront/workflow/discovery`
 
diff --git a/scripts/lint/check-skipped-tests-baseline.ts b/scripts/lint/check-skipped-tests-baseline.ts
index 6aa9e8fdc5..1df2c907bd 100644
--- a/scripts/lint/check-skipped-tests-baseline.ts
+++ b/scripts/lint/check-skipped-tests-baseline.ts
@@ -27,7 +27,7 @@ const SCAN_ROOTS = [
 
 // Lower this when you re-enable or delete skipped tests. Raising it means new
 // dead coverage is being added — prefer fixing or deleting the test instead.
-export const SKIPPED_TEST_BASELINE = 22;
+export const SKIPPED_TEST_BASELINE = 20;
 
 // Method form: it.skip( / describe.ignore( / test.skip( / Deno.test.ignore(
 const METHOD_FORM = /\b(?:it|describe|test|Deno\.test)\.(?:skip|ignore)\s*\(/g;
diff --git a/scripts/lint/module-boundaries-baseline.json b/scripts/lint/module-boundaries-baseline.json
index d7e62b74ff..f136801cd1 100644
--- a/scripts/lint/module-boundaries-baseline.json
+++ b/scripts/lint/module-boundaries-baseline.json
@@ -21,7 +21,6 @@
     "cycle-sensitive:src/observability/tracing/context-propagation.ts -> #veryfront/utils",
     "cycle-sensitive:src/observability/tracing/manager.ts -> #veryfront/utils",
     "cycle-sensitive:src/observability/tracing/span-operations.ts -> #veryfront/utils",
-    "cycle-sensitive:src/platform/adapters/detect.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/fallback-wrapper.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/fs/cache/file-cache.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/fs/github/adapter.ts -> #veryfront/errors",
@@ -49,17 +48,9 @@
     "cycle-sensitive:src/platform/adapters/fs/veryfront/stat-operations.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/redis/modules.ts -> #veryfront/errors",
     "cycle-sensitive:src/platform/adapters/registry.ts -> #veryfront/errors",
-    "cycle-sensitive:src/platform/adapters/registry.ts -> #veryfront/utils",
-    "cycle-sensitive:src/platform/adapters/runtime/bun/filesystem-adapter.ts -> #veryfront/errors",
     "cycle-sensitive:src/platform/adapters/runtime/bun/filesystem-adapter.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/runtime/bun/http-server.ts -> #veryfront/utils",
-    "cycle-sensitive:src/platform/adapters/runtime/bun/websocket-adapter.ts -> #veryfront/errors",
-    "cycle-sensitive:src/platform/adapters/runtime/cloudflare/filesystem.ts -> #veryfront/errors",
-    "cycle-sensitive:src/platform/adapters/runtime/cloudflare/shell.ts -> #veryfront/errors",
-    "cycle-sensitive:src/platform/adapters/runtime/deno/adapter.ts -> #veryfront/errors",
-    "cycle-sensitive:src/platform/adapters/runtime/deno/adapter.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/runtime/node/filesystem-adapter.ts -> #veryfront/utils",
-    "cycle-sensitive:src/platform/adapters/runtime/shared/node-based-shell-adapter.ts -> #veryfront/errors",
     "cycle-sensitive:src/platform/adapters/token/factory.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/token/integration.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/token/veryfront/adapter.ts -> #veryfront/errors",
@@ -69,7 +60,6 @@
     "cycle-sensitive:src/platform/adapters/token/veryfront/types.ts -> #veryfront/errors",
     "cycle-sensitive:src/platform/adapters/veryfront-api-client/client.ts -> #veryfront/utils",
     "cycle-sensitive:src/platform/adapters/veryfront-api-client/operations.ts -> #veryfront/utils",
-    "cycle-sensitive:src/platform/compat/http/websocket.ts -> #veryfront/errors",
     "cycle-sensitive:src/platform/compat/kv/factory.ts -> #veryfront/utils",
     "cycle-sensitive:src/types/entities/getEntityInfo.ts -> #veryfront/utils",
     "cycle-sensitive:src/types/global-guards.ts -> #veryfront/utils",
diff --git a/scripts/lint/test-typecheck-baseline.json b/scripts/lint/test-typecheck-baseline.json
index 4f387e9639..97734e559d 100644
--- a/scripts/lint/test-typecheck-baseline.json
+++ b/scripts/lint/test-typecheck-baseline.json
@@ -58,8 +58,6 @@
   "src/routing/api/module-loader/security-config.test.ts",
   "src/routing/api/openapi/mcp-resource.test.ts",
   "src/runs/schemas.test.ts",
-  "src/security/path-validation/canonical.test.ts",
-  "src/security/path-validation/index.test.ts",
   "src/server/build-service-worker.test.ts",
   "src/server/handlers/response/cors.test.ts",
   "src/transforms/import-rewriter/strategies/import-map-strategy.test.ts",
diff --git a/src/agent/factory.test.ts b/src/agent/factory.test.ts
index 37d005c5cc..4890d8f527 100644
--- a/src/agent/factory.test.ts
+++ b/src/agent/factory.test.ts
@@ -213,9 +213,9 @@ description: Excluded skill
       ...createSkill("selected", "Selected skill"),
       fsAdapter: {
         ...selectedAdapter,
-        async readFile(path) {
+        async readFileBytesWithinLimit(path, byteLimit) {
           selectedReads++;
-          return await selectedAdapter.readFile(path);
+          return await selectedAdapter.readFileBytesWithinLimit!(path, byteLimit);
         },
       },
     });
@@ -223,9 +223,9 @@ description: Excluded skill
       ...createSkill("excluded", "Excluded skill"),
       fsAdapter: {
         ...excludedAdapter,
-        async readFile(path) {
+        async readFileBytesWithinLimit(path, byteLimit) {
           excludedReads++;
-          return await excludedAdapter.readFile(path);
+          return await excludedAdapter.readFileBytesWithinLimit!(path, byteLimit);
         },
       },
     });
@@ -276,9 +276,9 @@ description: Excluded skill
       ...createSkill("excluded", "Excluded skill"),
       fsAdapter: {
         ...excludedAdapter,
-        async readFile(path) {
+        async readFileBytesWithinLimit(path, byteLimit) {
           excludedReads++;
-          return await excludedAdapter.readFile(path);
+          return await excludedAdapter.readFileBytesWithinLimit!(path, byteLimit);
         },
       },
     });
diff --git a/src/agent/hosted/project-steering-adapter.test.ts b/src/agent/hosted/project-steering-adapter.test.ts
index 815c4bcf1d..f08e411bdd 100644
--- a/src/agent/hosted/project-steering-adapter.test.ts
+++ b/src/agent/hosted/project-steering-adapter.test.ts
@@ -92,12 +92,18 @@ Use project instructions.`,
       "project",
     ]);
     assertEquals(fileCalls.length, 2);
-    assertEquals(fileCalls[0], {
+    const instructionCall = { ...fileCalls[0] };
+    delete instructionCall.abortSignal;
+    delete instructionCall.timeoutMs;
+    delete instructionCall.listingBudget;
+    assertEquals(instructionCall, {
       projectId: "project-1",
       authToken: "token-1",
       branchId: "branch-1",
       path: "AGENTS.md",
+      maximumContentCharacters: 1_048_576,
     });
+    assert(typeof fileCalls[0]?.timeoutMs === "number");
   });
 });
 
@@ -159,12 +165,12 @@ Deno.test("hosted project steering adapter accepts a custom builtin skill store"
         },
       ],
       builtinStore: {
-        readSkill: (storeSkillsDir, skillId) => {
+        readSkill: async (storeSkillsDir, skillId) => {
           readSkillCalls.push({ skillsDir: storeSkillsDir, skillId });
           return skillId === "custom" ? "Use custom builtin instructions." : null;
         },
-        readReferenceFile: () => null,
-        listReferences: (storeSkillsDir, skillId) => {
+        readReferenceFile: async () => null,
+        listReferences: async (storeSkillsDir, skillId) => {
           referenceCalls.push({ skillsDir: storeSkillsDir, skillId });
           return ["references/custom.md"];
         },
diff --git a/src/agent/hosted/project-steering-adapter.ts b/src/agent/hosted/project-steering-adapter.ts
index 14b3622984..08c772bced 100644
--- a/src/agent/hosted/project-steering-adapter.ts
+++ b/src/agent/hosted/project-steering-adapter.ts
@@ -1,9 +1,9 @@
 import type { Tool } from "#veryfront/tool";
 import { HostedServiceAuthError, isHostedServiceAuthError } from "../service/auth.ts";
 import {
-  listRuntimeBuiltinSkillReferences,
-  readRuntimeBuiltinSkill,
-  readRuntimeBuiltinSkillReferenceFile,
+  listRuntimeBuiltinSkillReferencesWithinLimit,
+  readRuntimeBuiltinSkillReferenceWithinLimit,
+  readRuntimeBuiltinSkillWithinLimit,
 } from "../runtime/builtin-skill-files.ts";
 import {
   createRuntimeLoadSkillTool,
@@ -134,9 +134,9 @@ function createDefaultProjectSkillLoader(
 
 function createDefaultBuiltinStore(): RuntimeLoadSkillBuiltinStore {
   return {
-    readSkill: readRuntimeBuiltinSkill,
-    readReferenceFile: readRuntimeBuiltinSkillReferenceFile,
-    listReferences: listRuntimeBuiltinSkillReferences,
+    readSkill: readRuntimeBuiltinSkillWithinLimit,
+    readReferenceFile: readRuntimeBuiltinSkillReferenceWithinLimit,
+    listReferences: listRuntimeBuiltinSkillReferencesWithinLimit,
   };
 }
 
diff --git a/src/agent/runtime/builtin-skill-files.test.ts b/src/agent/runtime/builtin-skill-files.test.ts
index 0ef5529a68..45aa03bd2f 100644
--- a/src/agent/runtime/builtin-skill-files.test.ts
+++ b/src/agent/runtime/builtin-skill-files.test.ts
@@ -1,5 +1,5 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "@std/assert";
+import { assertEquals, assertThrows } from "@std/assert";
 import { resolve } from "node:path";
 import {
   listRuntimeBuiltinSkillReferenceFiles,
@@ -11,6 +11,7 @@ import {
   resolveRuntimeBuiltinSkillReferenceFilePath,
   resolveRuntimeBuiltinSkillsDir,
 } from "./builtin-skill-files.ts";
+import { SKILL_SUBDIR_MAX_ENTRIES, SKILL_TEXT_FILE_MAX_BYTES } from "#veryfront/skill/limits.ts";
 
 function withTempDir(fn: (dir: string) => void): void {
   const dir = Deno.makeTempDirSync();
@@ -110,3 +111,28 @@ Deno.test("runtime builtin skill reference helpers reject traversal and read val
     ]);
   });
 });
+
+Deno.test("runtime builtin compatibility readers fail before unbounded materialization", () => {
+  withTempDir((rootDir) => {
+    Deno.writeTextFileSync(
+      resolve(rootDir, "oversized.md"),
+      "x".repeat(SKILL_TEXT_FILE_MAX_BYTES + 1),
+    );
+    assertThrows(
+      () => readRuntimeBuiltinFlatSkill(rootDir, "oversized"),
+      RangeError,
+      "may contain at most",
+    );
+
+    const refsDir = resolve(rootDir, "many", "references");
+    Deno.mkdirSync(refsDir, { recursive: true });
+    for (let index = 0; index <= SKILL_SUBDIR_MAX_ENTRIES; index += 1) {
+      Deno.writeTextFileSync(resolve(refsDir, `${index}.md`), "");
+    }
+    assertThrows(
+      () => listRuntimeBuiltinSkillReferenceFiles(rootDir, "many"),
+      RangeError,
+      "may contain at most",
+    );
+  });
+});
diff --git a/src/agent/runtime/builtin-skill-files.ts b/src/agent/runtime/builtin-skill-files.ts
index 81b309951e..335f146816 100644
--- a/src/agent/runtime/builtin-skill-files.ts
+++ b/src/agent/runtime/builtin-skill-files.ts
@@ -1,6 +1,80 @@
-import { type Dirent, existsSync, readdirSync, readFileSync } from "node:fs";
+import { closeSync, type Dirent, existsSync, opendirSync, openSync, readSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { normalizeRuntimeSkillReferencePath } from "./skill-metadata.ts";
+import { createFileSystem, isNotFoundError } from "#veryfront/platform/compat/fs.ts";
+import type { SkillOperationBudget } from "#veryfront/skill/operation-budget.ts";
+import { SKILL_SUBDIR_MAX_ENTRIES, SKILL_TEXT_FILE_MAX_BYTES } from "#veryfront/skill/limits.ts";
+
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+const builtinFileSystem = createFileSystem();
+
+function readDirectoryEntriesWithinLimit(path: string): Dirent[] {
+  const directory = opendirSync(path);
+  const entries: Dirent[] = [];
+  try {
+    while (true) {
+      const entry = directory.readSync();
+      if (entry === null) return entries;
+      if (entries.length >= SKILL_SUBDIR_MAX_ENTRIES) {
+        throw new RangeError(
+          `Runtime skill directory may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+        );
+      }
+      entries.push(entry);
+    }
+  } finally {
+    directory.closeSync();
+  }
+}
+
+function isMissingNodePath(error: unknown): boolean {
+  return error instanceof Error && (error as NodeJS.ErrnoException).code === "ENOENT";
+}
+
+function readBuiltinFileSyncWithinLimit(path: string): string | null {
+  let descriptor: number;
+  try {
+    descriptor = openSync(path, "r");
+  } catch (error) {
+    if (isMissingNodePath(error)) return null;
+    throw error;
+  }
+  try {
+    const bytes = new Uint8Array(SKILL_TEXT_FILE_MAX_BYTES + 1);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
+      if (count === 0) return utf8Decoder.decode(bytes.subarray(0, offset));
+      offset += count;
+    }
+    throw new RangeError(
+      `Runtime skill file may contain at most ${SKILL_TEXT_FILE_MAX_BYTES} bytes`,
+    );
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+async function readBuiltinFileWithinLimit(
+  root: string,
+  path: string,
+  budget: SkillOperationBudget,
+): Promise<string | null> {
+  try {
+    return await budget.run(async () => {
+      const reader = builtinFileSystem.readFileSnapshotWithinLimit;
+      if (!reader) {
+        throw new Error("Runtime filesystem does not support bounded snapshot reads");
+      }
+      return utf8Decoder.decode(
+        await reader.call(builtinFileSystem, path, root, SKILL_TEXT_FILE_MAX_BYTES),
+      );
+    });
+  } catch (error) {
+    if (isNotFoundError(error)) return null;
+    throw error;
+  }
+}
 
 /** Result returned from runtime builtin skill entries. */
 export type RuntimeBuiltinSkillEntriesResult = { ok: true; entries: Dirent[] } | {
@@ -33,7 +107,7 @@ export function readRuntimeBuiltinSkillEntries(
   try {
     return {
       ok: true,
-      entries: readdirSync(skillsDir, { withFileTypes: true }),
+      entries: readDirectoryEntriesWithinLimit(skillsDir),
     };
   } catch (error) {
     return {
@@ -72,11 +146,7 @@ export function readRuntimeBuiltinSkillReferenceFile(
   file: string,
 ): string | null {
   const filePath = resolveRuntimeBuiltinSkillReferenceFilePath(skillsDir, skillId, file);
-  if (!filePath || !existsSync(filePath)) {
-    return null;
-  }
-
-  return readFileSync(filePath, "utf-8");
+  return filePath ? readBuiltinFileSyncWithinLimit(filePath) : null;
 }
 
 /** Read runtime builtin directory skill helper. */
@@ -85,21 +155,13 @@ export function readRuntimeBuiltinDirectorySkill(
   skillId: string,
 ): string | null {
   const directorySkillPath = resolve(skillsDir, skillId, "SKILL.md");
-  if (!existsSync(directorySkillPath)) {
-    return null;
-  }
-
-  return readFileSync(directorySkillPath, "utf-8");
+  return readBuiltinFileSyncWithinLimit(directorySkillPath);
 }
 
 /** Read runtime builtin flat skill helper. */
 export function readRuntimeBuiltinFlatSkill(skillsDir: string, skillId: string): string | null {
   const flatSkillPath = resolve(skillsDir, `${skillId}.md`);
-  if (!existsSync(flatSkillPath)) {
-    return null;
-  }
-
-  return readFileSync(flatSkillPath, "utf-8");
+  return readBuiltinFileSyncWithinLimit(flatSkillPath);
 }
 
 /** Read runtime builtin skill helper. */
@@ -118,7 +180,7 @@ export function listRuntimeBuiltinSkillReferenceFiles(
     return [];
   }
 
-  return readdirSync(refsDir, { withFileTypes: true })
+  return readDirectoryEntriesWithinLimit(refsDir)
     .filter((entry) => entry.isFile())
     .map((entry) => entry.name)
     .sort();
@@ -130,3 +192,61 @@ export function listRuntimeBuiltinSkillReferences(skillsDir: string, skillId: st
     `references/${file}`
   );
 }
+
+/** Strict bounded runtime read of a built-in skill document. */
+export async function readRuntimeBuiltinSkillWithinLimit(
+  skillsDir: string,
+  skillId: string,
+  budget: SkillOperationBudget,
+): Promise<string | null> {
+  const directoryPath = resolve(skillsDir, skillId, "SKILL.md");
+  const directory = await readBuiltinFileWithinLimit(skillsDir, directoryPath, budget);
+  if (directory !== null) return directory;
+  return await readBuiltinFileWithinLimit(
+    skillsDir,
+    resolve(skillsDir, `${skillId}.md`),
+    budget,
+  );
+}
+
+/** Strict bounded runtime read of one advertised built-in reference. */
+export async function readRuntimeBuiltinSkillReferenceWithinLimit(
+  skillsDir: string,
+  skillId: string,
+  file: string,
+  budget: SkillOperationBudget,
+): Promise<string | null> {
+  const path = resolveRuntimeBuiltinSkillReferenceFilePath(skillsDir, skillId, file);
+  return path ? await readBuiltinFileWithinLimit(skillsDir, path, budget) : null;
+}
+
+/** Strict capped and deterministic built-in reference listing. */
+export async function listRuntimeBuiltinSkillReferencesWithinLimit(
+  skillsDir: string,
+  skillId: string,
+  budget: SkillOperationBudget,
+): Promise<string[]> {
+  const refsDir = resolve(skillsDir, skillId, "references");
+  try {
+    return await budget.run(async () => {
+      const references: string[] = [];
+      let entries = 0;
+      for await (const entry of builtinFileSystem.readDir(refsDir)) {
+        entries += 1;
+        if (entries > SKILL_SUBDIR_MAX_ENTRIES) {
+          throw new RangeError(
+            `Skill references may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+          );
+        }
+        if (entry.isSymlink) {
+          throw new Error(`Skill reference entry must not be a symlink: ${entry.name}`);
+        }
+        if (entry.isFile) references.push(`references/${entry.name}`);
+      }
+      return references.sort();
+    });
+  } catch (error) {
+    if (isNotFoundError(error)) return [];
+    throw error;
+  }
+}
diff --git a/src/agent/runtime/load-skill-tool.test.ts b/src/agent/runtime/load-skill-tool.test.ts
index 35598672d6..8643f419c2 100644
--- a/src/agent/runtime/load-skill-tool.test.ts
+++ b/src/agent/runtime/load-skill-tool.test.ts
@@ -13,6 +13,10 @@ import type {
   RuntimeProjectSkillLoader,
 } from "./project-skill-loader.ts";
 import type { RuntimeLoadedSkillResponse } from "./skill-metadata.ts";
+import {
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
 
 const PROJECT_CONTEXT: RuntimeProjectSkillContext = {
   projectId: "project-1",
@@ -66,10 +70,11 @@ function createBuiltinStore(input: {
   referenceLists?: Map<string, string[]>;
 }): RuntimeLoadSkillBuiltinStore {
   return {
-    readSkill: (_skillsDir, skillId) => input.skills?.get(skillId) ?? null,
+    readSkill: (_skillsDir, skillId) => Promise.resolve(input.skills?.get(skillId) ?? null),
     readReferenceFile: (_skillsDir, skillId, normalizedFile) =>
-      input.references?.get(`${skillId}/${normalizedFile}`) ?? null,
-    listReferences: (_skillsDir, skillId) => input.referenceLists?.get(skillId) ?? [],
+      Promise.resolve(input.references?.get(`${skillId}/${normalizedFile}`) ?? null),
+    listReferences: (_skillsDir, skillId) =>
+      Promise.resolve(input.referenceLists?.get(skillId) ?? []),
   };
 }
 
@@ -1085,15 +1090,15 @@ Deno.test("createRuntimeLoadSkillTool treats an empty availableSkillIds manifest
     },
     builtinSkillIds: ["plan"],
     builtinStore: {
-      readSkill: () => {
+      readSkill: async () => {
         builtinReads++;
         return "# Builtin plan";
       },
-      readReferenceFile: () => {
+      readReferenceFile: async () => {
         builtinReads++;
         return "Guide";
       },
-      listReferences: () => {
+      listReferences: async () => {
         builtinReads++;
         return ["references/guide.md"];
       },
@@ -1134,3 +1139,77 @@ Deno.test("createRuntimeLoadSkillTool allows host copy overrides", async () => {
   assertEquals(result.nextStep, "Custom next step.");
   assertStringIncludes(JSON.stringify(result), "Custom next step.");
 });
+
+Deno.test("runtime load_skill rejects oversized production-loader documents", async () => {
+  const tool = createRuntimeLoadSkillTool({
+    context: createProjectContext(),
+    skillsDir: "/skills",
+    projectSkillLoader: createProjectSkillLoader({
+      skills: new Map([
+        ["large", {
+          instructions: "x".repeat(SKILL_DOCUMENT_MAX_CHARACTERS + 1),
+          references: [],
+        }],
+      ]),
+    }),
+    builtinStore: createBuiltinStore({}),
+  });
+
+  await assertRejects(
+    () => tool.execute({ skillId: "large" }),
+    RangeError,
+    "Skill document may contain at most",
+  );
+});
+
+Deno.test("runtime load_skill rejects oversized available-tool inventories before storage", async () => {
+  let storageCalls = 0;
+  const tool = createRuntimeLoadSkillTool({
+    context: createProjectContext({
+      availableToolNames: Array.from(
+        { length: SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES + 1 },
+        (_, index) => `tool_${index}`,
+      ),
+    }),
+    skillsDir: "/skills",
+    projectSkillLoader: {
+      listProjectSkillReferences: () => Promise.resolve([]),
+      loadProjectSkill: () => {
+        storageCalls += 1;
+        return Promise.resolve(null);
+      },
+      loadProjectSkillReference: () => Promise.resolve(null),
+    },
+    builtinStore: createBuiltinStore({}),
+  });
+
+  await assertRejects(
+    () => tool.execute({ skillId: "large" }),
+    RangeError,
+    "Runtime tools may contain at most",
+  );
+  assertEquals(storageCalls, 0);
+});
+
+Deno.test("runtime load_skill propagates caller cancellation through the shared budget", async () => {
+  const controller = new AbortController();
+  const reason = new Error("cancel runtime skill load");
+  const tool = createRuntimeLoadSkillTool({
+    context: createProjectContext(),
+    skillsDir: "/skills",
+    projectSkillLoader: {
+      listProjectSkillReferences: () => Promise.resolve([]),
+      loadProjectSkill: (_context, _skillId, operation) =>
+        new Promise((_resolve, reject) => {
+          const signal = operation?.budget?.abortSignal;
+          signal?.addEventListener("abort", () => reject(signal.reason), { once: true });
+        }),
+      loadProjectSkillReference: () => Promise.resolve(null),
+    },
+    builtinStore: createBuiltinStore({}),
+  });
+
+  const pending = tool.execute({ skillId: "pending" }, { abortSignal: controller.signal });
+  controller.abort(reason);
+  await assertRejects(() => pending, Error, reason.message);
+});
diff --git a/src/agent/runtime/load-skill-tool.ts b/src/agent/runtime/load-skill-tool.ts
index 5f948fe8e1..d391fd8f1f 100644
--- a/src/agent/runtime/load-skill-tool.ts
+++ b/src/agent/runtime/load-skill-tool.ts
@@ -1,7 +1,7 @@
 import { defineSchema, lazySchema } from "#veryfront/schemas/index.ts";
 import { INPUT_VALIDATION_FAILED } from "#veryfront/errors";
 import type { InferSchema } from "#veryfront/extensions/schema/index.ts";
-import type { Tool } from "#veryfront/tool/types.ts";
+import type { Tool, ToolExecutionContext } from "#veryfront/tool/types.ts";
 import { zodToJsonSchema } from "#veryfront/tool/schema/zod-json-schema.ts";
 import {
   LOAD_SKILL_CONTINUE_SAME_TURN,
@@ -11,10 +11,24 @@ import {
   LOAD_SKILL_TOOL_INTERSECTION,
 } from "../conversation/delegation-policy.ts";
 import {
-  listRuntimeBuiltinSkillReferences,
-  readRuntimeBuiltinSkill,
-  readRuntimeBuiltinSkillReferenceFile,
+  listRuntimeBuiltinSkillReferencesWithinLimit,
+  readRuntimeBuiltinSkillReferenceWithinLimit,
+  readRuntimeBuiltinSkillWithinLimit,
 } from "./builtin-skill-files.ts";
+import {
+  createSkillOperationBudget,
+  type SkillOperationBudget,
+} from "#veryfront/skill/operation-budget.ts";
+import {
+  SKILL_ALLOWED_TOOL_MAX_PATTERNS,
+  SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH,
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_FILE_OPERATION_TIMEOUT_MS,
+  SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES,
+  SKILL_RUNTIME_LOADED_REFERENCE_CACHE_MAX_ENTRIES,
+  SKILL_RUNTIME_LOADED_SKILL_CACHE_MAX_ENTRIES,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
 import type {
   RuntimeLoadedProjectSkill,
   RuntimeProjectSkillContext,
@@ -118,9 +132,22 @@ export type RuntimeLoadSkillToolContext = RuntimeProjectSkillContext & {
 
 /** Public API contract for runtime load skill builtin store. */
 export type RuntimeLoadSkillBuiltinStore = {
-  readSkill: (skillsDir: string, skillId: string) => string | null;
-  readReferenceFile: (skillsDir: string, skillId: string, normalizedFile: string) => string | null;
-  listReferences: (skillsDir: string, skillId: string) => string[];
+  readSkill: (
+    skillsDir: string,
+    skillId: string,
+    budget: SkillOperationBudget,
+  ) => Promise<string | null>;
+  readReferenceFile: (
+    skillsDir: string,
+    skillId: string,
+    normalizedFile: string,
+    budget: SkillOperationBudget,
+  ) => Promise<string | null>;
+  listReferences: (
+    skillsDir: string,
+    skillId: string,
+    budget: SkillOperationBudget,
+  ) => Promise<string[]>;
 };
 
 /** Public API contract for runtime load skill tool messages. */
@@ -183,13 +210,63 @@ export type RuntimeLoadSkillToolOutput =
 
 function getBuiltinStore(options: RuntimeLoadSkillToolOptions): RuntimeLoadSkillBuiltinStore {
   return {
-    readSkill: options.builtinStore?.readSkill ?? readRuntimeBuiltinSkill,
+    readSkill: options.builtinStore?.readSkill ?? readRuntimeBuiltinSkillWithinLimit,
     readReferenceFile: options.builtinStore?.readReferenceFile ??
-      readRuntimeBuiltinSkillReferenceFile,
-    listReferences: options.builtinStore?.listReferences ?? listRuntimeBuiltinSkillReferences,
+      readRuntimeBuiltinSkillReferenceWithinLimit,
+    listReferences: options.builtinStore?.listReferences ??
+      listRuntimeBuiltinSkillReferencesWithinLimit,
   };
 }
 
+function assertRuntimeBoundaryCollections(options: RuntimeLoadSkillToolOptions): void {
+  if (
+    (options.context.availableToolNames?.length ?? 0) > SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES
+  ) {
+    throw new RangeError(
+      `Runtime tools may contain at most ${SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES} entries`,
+    );
+  }
+  if ((options.context.availableSkillIds?.length ?? 0) > SKILL_SUBDIR_MAX_ENTRIES) {
+    throw new RangeError(`Runtime skills may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`);
+  }
+}
+
+function assertLoadedSkillPayload(
+  instructions: string,
+  references: readonly string[] | undefined,
+): void {
+  if (instructions.length > SKILL_DOCUMENT_MAX_CHARACTERS) {
+    throw new RangeError(
+      `Skill document may contain at most ${SKILL_DOCUMENT_MAX_CHARACTERS} characters`,
+    );
+  }
+  if ((references?.length ?? 0) > SKILL_SUBDIR_MAX_ENTRIES) {
+    throw new RangeError(
+      `Skill references may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+    );
+  }
+}
+
+function assertRuntimeResponseMetadata(response: RuntimeLoadedSkillResponse): void {
+  const tools = response.delegationTools ?? [];
+  if (tools.length > SKILL_ALLOWED_TOOL_MAX_PATTERNS) {
+    throw new RangeError(
+      `Skill allowed-tools may contain at most ${SKILL_ALLOWED_TOOL_MAX_PATTERNS} entries`,
+    );
+  }
+  if (tools.some((entry) => entry.length > SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH)) {
+    throw new RangeError(
+      `Skill allowed-tool patterns may contain at most ${SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH} characters`,
+    );
+  }
+}
+
+function assertCacheCapacity(record: object, maximum: number, label: string): void {
+  if (Object.keys(record).length >= maximum) {
+    throw new RangeError(`${label} may contain at most ${maximum} entries`);
+  }
+}
+
 function getResponseMessages(
   options: RuntimeLoadSkillToolOptions,
 ): RuntimeLoadedSkillResponseMessages {
@@ -214,7 +291,8 @@ function buildLoadedSkillResponse(input: {
   instructions: string;
   references?: readonly string[];
 }): RuntimeLoadedSkillResponse {
-  return buildRuntimeLoadedSkillResponse({
+  assertLoadedSkillPayload(input.instructions, input.references);
+  const response = buildRuntimeLoadedSkillResponse({
     skillId: input.skillId,
     instructions: input.instructions,
     nextStep: input.options.nextStep ??
@@ -224,6 +302,8 @@ function buildLoadedSkillResponse(input: {
     availableToolNames: input.options.context.availableToolNames,
     logger: input.options.logger,
   });
+  assertRuntimeResponseMetadata(response);
+  return response;
 }
 
 function buildAlreadyLoadedSkillResponse(
@@ -502,6 +582,7 @@ async function loadRuntimeSkillReferenceFile(
   options: RuntimeLoadSkillToolOptions,
   skillId: string,
   file: string,
+  budget: SkillOperationBudget,
 ): Promise<RuntimeLoadSkillReferenceFileOutput | RuntimeLoadSkillErrorOutput> {
   const normalizedFile = normalizeRuntimeSkillReferencePath(file);
   if (!normalizedFile) {
@@ -537,22 +618,30 @@ async function loadRuntimeSkillReferenceFile(
   if (loadedSkillReferenceResponses[referenceKey]) {
     return buildAlreadyLoadedSkillReferenceResponse(skillId, normalizedFile);
   }
+  assertCacheCapacity(
+    loadedSkillReferenceResponses,
+    SKILL_RUNTIME_LOADED_REFERENCE_CACHE_MAX_ENTRIES,
+    "Loaded skill reference cache",
+  );
 
   const projectFileContent = await options.projectSkillLoader.loadProjectSkillReference(
     options.context,
     skillId,
     normalizedFile,
+    { budget },
   );
   if (projectFileContent) {
+    assertLoadedSkillPayload(projectFileContent, undefined);
     const response = { skillId, file: normalizedFile, content: projectFileContent };
     loadedSkillReferenceResponses[referenceKey] = response;
     return response;
   }
 
-  const localContent = getBuiltinStore(options).readReferenceFile(
+  const localContent = await getBuiltinStore(options).readReferenceFile(
     options.skillsDir,
     skillId,
     normalizedFile,
+    budget,
   );
   if (localContent) {
     const response = { skillId, file: normalizedFile, content: localContent };
@@ -566,8 +655,9 @@ async function loadRuntimeSkillReferenceFile(
 async function loadRuntimeSkillBody(
   options: RuntimeLoadSkillToolOptions,
   skillId: string,
+  budget: SkillOperationBudget,
 ): Promise<RuntimeLoadedProjectSkill | null> {
-  return await options.projectSkillLoader.loadProjectSkill(options.context, skillId);
+  return await options.projectSkillLoader.loadProjectSkill(options.context, skillId, { budget });
 }
 
 /** Create runtime load skill tool. */
@@ -576,7 +666,15 @@ export function createRuntimeLoadSkillTool(
 ): Tool<RuntimeLoadSkillToolInput, RuntimeLoadSkillToolOutput> {
   const builtinStore = getBuiltinStore(options);
 
-  async function execute({ skillId, file }: RuntimeLoadSkillToolInput) {
+  async function execute(
+    { skillId, file }: RuntimeLoadSkillToolInput,
+    executionContext?: ToolExecutionContext,
+  ) {
+    assertRuntimeBoundaryCollections(options);
+    const budget = createSkillOperationBudget({
+      abortSignal: executionContext?.abortSignal,
+      timeoutMs: SKILL_FILE_OPERATION_TIMEOUT_MS,
+    });
     let parsed: RuntimeLoadSkillToolInput;
     try {
       parsed = buildRuntimeLoadSkillInputSchema(options).parse(
@@ -593,7 +691,7 @@ export function createRuntimeLoadSkillTool(
     file = parsed.file;
 
     if (file) {
-      return await loadRuntimeSkillReferenceFile(options, skillId, file);
+      return await loadRuntimeSkillReferenceFile(options, skillId, file, budget);
     }
 
     const loadedSkillResponses = options.context.loadedSkillResponses ??= {};
@@ -602,8 +700,13 @@ export function createRuntimeLoadSkillTool(
     if (loadedResponse) {
       return buildAlreadyLoadedSkillResponse(skillId, loadedResponse);
     }
+    assertCacheCapacity(
+      loadedSkillResponses,
+      SKILL_RUNTIME_LOADED_SKILL_CACHE_MAX_ENTRIES,
+      "Loaded skill cache",
+    );
 
-    const projectSkill = await loadRuntimeSkillBody(options, skillId);
+    const projectSkill = await loadRuntimeSkillBody(options, skillId, budget);
     if (projectSkill) {
       const response = buildLoadedSkillResponse({
         options,
@@ -615,13 +718,14 @@ export function createRuntimeLoadSkillTool(
       return response;
     }
 
-    const localContent = builtinStore.readSkill(options.skillsDir, skillId);
+    const localContent = await builtinStore.readSkill(options.skillsDir, skillId, budget);
     if (localContent) {
+      const references = await builtinStore.listReferences(options.skillsDir, skillId, budget);
       const response = buildLoadedSkillResponse({
         options,
         skillId,
         instructions: localContent,
-        references: builtinStore.listReferences(options.skillsDir, skillId),
+        references,
       });
       loadedSkillResponses[loadedSkillKey] = response;
       return response;
diff --git a/src/agent/runtime/project-files-client.test.ts b/src/agent/runtime/project-files-client.test.ts
index aaa21dd2f4..ce9e3ad454 100644
--- a/src/agent/runtime/project-files-client.test.ts
+++ b/src/agent/runtime/project-files-client.test.ts
@@ -6,9 +6,12 @@ import {
   assertStringIncludes,
 } from "#veryfront/testing/assert.ts";
 import {
+  createRuntimeProjectFileListingBudget,
+  createRuntimeProjectFilesClient,
   getRuntimeProjectFile,
   getRuntimeProjectFiles,
   RuntimeProjectFilesApiAuthError,
+  type RuntimeProjectFilesClientOptions,
   type RuntimeProjectFilesFetch,
 } from "./project-files-client.ts";
 
@@ -34,6 +37,25 @@ function textResponse(body: string, status: number): Response {
   return new Response(body, { status });
 }
 
+function chunkedJsonResponse(body: unknown, chunkBytes: number): Response {
+  const bytes = new TextEncoder().encode(JSON.stringify(body));
+  let offset = 0;
+  return new Response(
+    new ReadableStream<Uint8Array>({
+      pull(controller) {
+        if (offset >= bytes.byteLength) {
+          controller.close();
+          return;
+        }
+        const end = Math.min(offset + chunkBytes, bytes.byteLength);
+        controller.enqueue(bytes.slice(offset, end));
+        offset = end;
+      },
+    }),
+    { headers: { "Content-Type": "application/json" } },
+  );
+}
+
 function mockFetchResponses(
   ...responses: Response[]
 ): RuntimeProjectFilesFetch & { calls: FetchCall[] } {
@@ -84,6 +106,43 @@ Deno.test("getRuntimeProjectFile returns a project file from the API file route"
   assertEquals(result, fileData);
 });
 
+Deno.test("createRuntimeProjectFilesClient keeps its configured transport immutable", async () => {
+  const trustedFetch = mockFetchResponses(
+    jsonResponse({ data: [], page_info: { next: null } }),
+  );
+  let untrustedFetchCalls = 0;
+  const untrustedFetch: RuntimeProjectFilesFetch = () => {
+    untrustedFetchCalls += 1;
+    return Promise.resolve(jsonResponse({ data: [], page_info: { next: null } }));
+  };
+  const configuredUrl = new URL("https://api.test");
+  const clientOptions: RuntimeProjectFilesClientOptions = {
+    apiUrl: configuredUrl,
+    fetch: trustedFetch,
+    pageLimit: 25,
+  };
+  const client = createRuntimeProjectFilesClient(clientOptions);
+
+  configuredUrl.hostname = "mutated.test";
+  clientOptions.fetch = untrustedFetch;
+  clientOptions.pageLimit = 1;
+
+  await client.getProjectFiles({
+    projectId: "project-1",
+    authToken: "token-1",
+    ...({
+      apiUrl: "https://untrusted.test",
+      fetch: untrustedFetch,
+      pageLimit: 1,
+    } as object),
+  });
+
+  const url = getRequestedUrl(trustedFetch);
+  assertEquals(url.origin, "https://api.test");
+  assertEquals(url.searchParams.get("limit"), "25");
+  assertEquals(untrustedFetchCalls, 0);
+});
+
 Deno.test("getRuntimeProjectFile returns null when the API file route returns 404", async () => {
   const fetchSpy = mockFetchResponses(textResponse("File not found", 404));
 
@@ -144,6 +203,84 @@ Deno.test("getRuntimeProjectFile reports upstream and network errors", async ()
   assertStringIncludes(getErrorMessage(networkError), "ECONNREFUSED");
 });
 
+Deno.test("getRuntimeProjectFile bounds the response before parsing skill content", async () => {
+  const oversized = "x".repeat(70_000);
+  const fetchSpy = mockFetchResponses(
+    jsonResponse({ path: "skills/large/SKILL.md", content: oversized }),
+  );
+
+  await assertRejects(
+    () =>
+      getRuntimeProjectFile({
+        ...baseOptions,
+        fetch: fetchSpy,
+        path: "skills/large/SKILL.md",
+        maximumContentCharacters: 1,
+      }),
+    RangeError,
+    "response may contain at most",
+  );
+});
+
+Deno.test("getRuntimeProjectFile parses heavily fragmented bounded responses", async () => {
+  const fileData = { path: "skills/example/SKILL.md", content: "x".repeat(1_024) };
+  const fetchSpy = mockFetchResponses(chunkedJsonResponse(fileData, 1));
+
+  assertEquals(
+    await getRuntimeProjectFile({
+      ...baseOptions,
+      fetch: fetchSpy,
+      path: fileData.path,
+      maximumContentCharacters: 2_048,
+    }),
+    fileData,
+  );
+});
+
+Deno.test("getRuntimeProjectFiles rejects and cancels a response stream that makes no progress", async () => {
+  let cancelled = false;
+  const response = new Response(
+    new ReadableStream<Uint8Array>({
+      pull(controller) {
+        controller.enqueue(new Uint8Array());
+      },
+      cancel() {
+        cancelled = true;
+      },
+    }),
+  );
+
+  await assertRejects(
+    () => getRuntimeProjectFiles({ ...baseOptions, fetch: mockFetchResponses(response) }),
+    RangeError,
+    "made no byte progress",
+  );
+  assertEquals(cancelled, true);
+});
+
+Deno.test("getRuntimeProjectFiles cancels a stalled response body when its timeout expires", async () => {
+  let cancelled = false;
+  const response = new Response(
+    new ReadableStream<Uint8Array>({
+      cancel() {
+        cancelled = true;
+      },
+    }),
+  );
+
+  await assertRejects(
+    () =>
+      getRuntimeProjectFiles({
+        ...baseOptions,
+        fetch: mockFetchResponses(response),
+        timeoutMs: 5,
+      }),
+    DOMException,
+    "timed out",
+  );
+  assertEquals(cancelled, true);
+});
+
 Deno.test("getRuntimeProjectFile passes project, path, branch, fields, and auth through REST", async () => {
   const fetchSpy = mockFetchResponses(jsonResponse({ path: "src/index.ts", content: "hello" }));
 
@@ -185,6 +322,21 @@ Deno.test("getRuntimeProjectFiles returns project file paths from the API list r
   assertEquals(result, files);
 });
 
+Deno.test("getRuntimeProjectFiles rejects unsafe list prefixes before network access", async () => {
+  let calls = 0;
+  const fetchSpy: RuntimeProjectFilesFetch = () => {
+    calls += 1;
+    return Promise.resolve(jsonResponse({ data: [], page_info: { next: null } }));
+  };
+  for (const pathPrefix of ["../skills", "/skills", "skills/", "skills\\nested"]) {
+    await assertRejects(
+      () => getRuntimeProjectFiles({ ...baseOptions, fetch: fetchSpy, pathPrefix }),
+      RangeError,
+    );
+  }
+  assertEquals(calls, 0);
+});
+
 Deno.test("getRuntimeProjectFiles follows API pagination until no next cursor remains", async () => {
   const fetchSpy = mockFetchResponses(
     jsonResponse({
@@ -203,6 +355,114 @@ Deno.test("getRuntimeProjectFiles follows API pagination until no next cursor re
   assertEquals(getRequestedUrl(fetchSpy, 1).searchParams.get("cursor"), "cursor-2");
 });
 
+Deno.test("getRuntimeProjectFiles rejects repeated cursors before another request", async () => {
+  const fetchSpy = mockFetchResponses(
+    jsonResponse({ data: [], page_info: { next: "same" } }),
+    jsonResponse({ data: [], page_info: { next: "same" } }),
+  );
+
+  await assertRejects(
+    () => getRuntimeProjectFiles({ ...baseOptions, fetch: fetchSpy }),
+    RangeError,
+    "repeated pagination cursor",
+  );
+  assertEquals(fetchSpy.calls.length, 2);
+});
+
+Deno.test("getRuntimeProjectFiles makes no post-timeout request when fetch ignores abort", async () => {
+  let calls = 0;
+  const fetchIgnoringAbort: RuntimeProjectFilesFetch = async () => {
+    calls += 1;
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    return jsonResponse({ data: [], page_info: { next: "another-page" } });
+  };
+
+  await assertRejects(
+    () =>
+      getRuntimeProjectFiles({
+        ...baseOptions,
+        fetch: fetchIgnoringAbort,
+        timeoutMs: 5,
+      }),
+    DOMException,
+    "timed out",
+  );
+  assertEquals(calls, 1);
+});
+
+Deno.test("getRuntimeProjectFiles enforces response bytes cumulatively across related prefixes", async () => {
+  const listingBudget = createRuntimeProjectFileListingBudget();
+  const padding = "x".repeat(2_400_000);
+  for (let index = 0; index < 6; index += 1) {
+    const fetchSpy = mockFetchResponses(
+      jsonResponse({ data: [], page_info: { next: null }, padding }),
+    );
+    assertEquals(
+      await getRuntimeProjectFiles({ ...baseOptions, fetch: fetchSpy, listingBudget }),
+      [],
+    );
+  }
+  const overBudgetFetch = mockFetchResponses(
+    jsonResponse({ data: [], page_info: { next: null }, padding }),
+  );
+  await assertRejects(
+    () =>
+      getRuntimeProjectFiles({
+        ...baseOptions,
+        fetch: overBudgetFetch,
+        listingBudget,
+      }),
+    RangeError,
+    "responses may contain at most",
+  );
+});
+
+Deno.test("getRuntimeProjectFiles stops pagination before retaining an oversized listing", async () => {
+  const fetchSpy = mockFetchResponses(
+    jsonResponse({
+      data: [{ path: "a.ts" }],
+      page_info: { next: "cursor-2" },
+    }),
+    jsonResponse({
+      data: [{ path: "b.ts" }],
+      page_info: { next: "cursor-3" },
+    }),
+  );
+
+  await assertRejects(
+    () => getRuntimeProjectFiles({ ...baseOptions, fetch: fetchSpy, maximumEntries: 1 }),
+    RangeError,
+    "may contain at most 1 entries",
+  );
+  assertEquals(fetchSpy.calls.length, 2);
+});
+
+Deno.test("getRuntimeProjectFiles bounds each page before parsing and rejects oversized paths", async () => {
+  const oversizedPageFetch = mockFetchResponses(
+    jsonResponse({
+      data: [{ path: "x".repeat(2_600_000) }],
+      page_info: { next: null },
+    }),
+  );
+  await assertRejects(
+    () => getRuntimeProjectFiles({ ...baseOptions, fetch: oversizedPageFetch }),
+    RangeError,
+    "response may contain at most",
+  );
+
+  const oversizedPathFetch = mockFetchResponses(
+    jsonResponse({
+      data: [{ path: "x".repeat(4_097) }],
+      page_info: { next: null },
+    }),
+  );
+  await assertRejects(
+    () => getRuntimeProjectFiles({ ...baseOptions, fetch: oversizedPathFetch }),
+    RangeError,
+    "paths may contain at most 4096 characters",
+  );
+});
+
 Deno.test("getRuntimeProjectFiles throws auth errors for API HTTP 401 and 403", async () => {
   const unauthorizedFetch = mockFetchResponses(textResponse("Unauthorized", 401));
   const unauthorizedError = await assertRejects(() =>
@@ -239,15 +499,21 @@ Deno.test("getRuntimeProjectFiles reports upstream and network errors", async ()
   assertStringIncludes(getErrorMessage(networkError), "ECONNREFUSED");
 });
 
-Deno.test("getRuntimeProjectFiles passes project, branch, fields, pagination limit, and auth through REST", async () => {
+Deno.test("getRuntimeProjectFiles passes project, branch, path, fields, pagination limit, and auth through REST", async () => {
   const fetchSpy = mockFetchResponses(jsonResponse({ data: [], page_info: { next: null } }));
 
-  await getRuntimeProjectFiles({ ...baseOptions, fetch: fetchSpy, branchId: "branch-1" });
+  await getRuntimeProjectFiles({
+    ...baseOptions,
+    fetch: fetchSpy,
+    branchId: "branch-1",
+    pathPrefix: "skills",
+  });
 
   const url = getRequestedUrl(fetchSpy);
   assertEquals(url.origin, "https://api.test");
   assertEquals(url.pathname, "/projects/project-1/files");
   assertEquals(url.searchParams.get("branch"), "branch-1");
+  assertEquals(url.searchParams.get("path"), "skills");
   assertEquals(url.searchParams.get("fields"), "(path)");
   assertEquals(url.searchParams.get("limit"), "100");
   assertEquals(
diff --git a/src/agent/runtime/project-files-client.ts b/src/agent/runtime/project-files-client.ts
index 208386d473..4143f299db 100644
--- a/src/agent/runtime/project-files-client.ts
+++ b/src/agent/runtime/project-files-client.ts
@@ -4,6 +4,19 @@ import { NETWORK_ERROR } from "#veryfront/errors";
 
 const DEFAULT_PROJECT_FILES_TIMEOUT_MS = 15_000;
 const DEFAULT_PROJECT_FILES_PAGE_LIMIT = 100;
+const PROJECT_FILE_JSON_OVERHEAD_BYTES = 65_536;
+const PROJECT_FILE_PATH_MAX_CHARACTERS = 4_096;
+const PROJECT_FILE_CURSOR_MAX_CHARACTERS = 4_096;
+const PROJECT_FILE_LIST_MAX_PAGES = 50;
+const PROJECT_FILE_LIST_TOTAL_MAX_BYTES = 16 * 1_048_576;
+const PROJECT_FILE_LIST_PAGE_MAX_BYTES =
+  DEFAULT_PROJECT_FILES_PAGE_LIMIT * PROJECT_FILE_PATH_MAX_CHARACTERS * 6 +
+  PROJECT_FILE_JSON_OVERHEAD_BYTES;
+const PROJECT_FILE_RESPONSE_BLOCK_BYTES = 65_536;
+const PROJECT_FILE_RESPONSE_YIELD_CHUNKS = 256;
+const PROJECT_FILE_RESPONSE_MAX_CONSECUTIVE_EMPTY_CHUNKS = 4_096;
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+const utf8Encoder = new TextEncoder();
 
 export const getRuntimeProjectFileSchema = defineSchema((v) =>
   v.object({
@@ -56,11 +69,23 @@ export type RuntimeProjectFilesApiOptions = {
   projectId: string;
   authToken: string;
   branchId?: string | null;
+  /** Stop pagination before retaining more than this many entries. */
+  maximumEntries?: number;
+  /** Restrict the API listing to this bounded server-side path prefix. */
+  pathPrefix?: string;
+  /** Shared bounded-listing budget used when one catalog spans several prefixes. */
+  listingBudget?: RuntimeProjectFileListingBudget;
+  /** Cooperatively cancel all requests and body reads in this listing. */
+  abortSignal?: AbortSignal;
+  /** Bound the complete request/pagination operation. */
+  timeoutMs?: number;
 };
 
 /** Options accepted by runtime get project file. */
 export type RuntimeGetProjectFileOptions = RuntimeProjectFilesApiOptions & {
   path: string;
+  /** Reject returned text content above this character count. */
+  maximumContentCharacters?: number;
 };
 
 /** Public API contract for runtime project files fetch. */
@@ -87,6 +112,36 @@ export type RuntimeProjectFilesClient = {
   ) => Promise<RuntimeProjectFileListItem[]>;
 };
 
+/** Opaque cumulative budget shared by related project-file listings. */
+export type RuntimeProjectFileListingBudget = {
+  consumePage(): void;
+  consumeBytes(byteCount: number): void;
+};
+
+/** Create a cumulative project-file listing budget. */
+export function createRuntimeProjectFileListingBudget(): RuntimeProjectFileListingBudget {
+  let pages = 0;
+  let bytes = 0;
+  return Object.freeze({
+    consumePage(): void {
+      pages += 1;
+      if (pages > PROJECT_FILE_LIST_MAX_PAGES) {
+        throw new RangeError(
+          `Project file listing may contain at most ${PROJECT_FILE_LIST_MAX_PAGES} pages`,
+        );
+      }
+    },
+    consumeBytes(byteCount: number): void {
+      bytes += byteCount;
+      if (bytes > PROJECT_FILE_LIST_TOTAL_MAX_BYTES) {
+        throw new RangeError(
+          `Project file listing responses may contain at most ${PROJECT_FILE_LIST_TOTAL_MAX_BYTES} bytes`,
+        );
+      }
+    },
+  });
+}
+
 /** Error shape for runtime project files API auth. */
 export class RuntimeProjectFilesApiAuthError extends Error {
   readonly statusCode: number;
@@ -104,86 +159,330 @@ export class RuntimeProjectFilesApiAuthError extends Error {
 export function createRuntimeProjectFilesClient(
   options: RuntimeProjectFilesClientOptions,
 ): RuntimeProjectFilesClient {
-  return {
-    getProjectFile: (input) => getRuntimeProjectFile({ ...options, ...input }),
-    getProjectFiles: (input) => getRuntimeProjectFiles({ ...options, ...input }),
-  };
+  // Snapshot the trusted transport configuration. Callers can pass plain
+  // JavaScript objects at runtime, so spreading request input into this scope
+  // would let excess properties replace the configured origin or transport.
+  const apiUrl = new URL(options.apiUrl).toString();
+  const configuredTimeoutMs = options.timeoutMs;
+  const configuredFetch = options.fetch;
+  const configuredPageLimit = options.pageLimit;
+  const configuredTrace = options.trace;
+  const configuredAccessDeniedErrorFactory = options.createAccessDeniedError;
+
+  return Object.freeze({
+    getProjectFile: (input) =>
+      getRuntimeProjectFile({
+        apiUrl,
+        fetch: configuredFetch,
+        pageLimit: configuredPageLimit,
+        trace: configuredTrace,
+        createAccessDeniedError: configuredAccessDeniedErrorFactory,
+        projectId: input.projectId,
+        authToken: input.authToken,
+        branchId: input.branchId,
+        maximumEntries: input.maximumEntries,
+        pathPrefix: input.pathPrefix,
+        listingBudget: input.listingBudget,
+        abortSignal: input.abortSignal,
+        timeoutMs: input.timeoutMs ?? configuredTimeoutMs,
+        path: input.path,
+        maximumContentCharacters: input.maximumContentCharacters,
+      }),
+    getProjectFiles: (input) =>
+      getRuntimeProjectFiles({
+        apiUrl,
+        fetch: configuredFetch,
+        pageLimit: configuredPageLimit,
+        trace: configuredTrace,
+        createAccessDeniedError: configuredAccessDeniedErrorFactory,
+        projectId: input.projectId,
+        authToken: input.authToken,
+        branchId: input.branchId,
+        maximumEntries: input.maximumEntries,
+        pathPrefix: input.pathPrefix,
+        listingBudget: input.listingBudget,
+        abortSignal: input.abortSignal,
+        timeoutMs: input.timeoutMs ?? configuredTimeoutMs,
+      }),
+  });
 }
 
 /** Return runtime project file. */
 export async function getRuntimeProjectFile(
   options: RuntimeProjectFilesClientOptions & RuntimeGetProjectFileOptions,
 ): Promise<RuntimeProjectFile | null> {
-  return traceProjectFilesRequest(options, "runtimeProjectFiles.getProjectFile", async () => {
-    const url = createRuntimeProjectFileUrl({
-      ...options,
-      fields: "(path,content)",
-    });
-    const response = await fetchRuntimeProjectFilesRestResponse(url, options);
-
-    if (response.status === 404) {
-      return null;
-    }
-
-    if (!response.ok) {
-      throw NETWORK_ERROR.create({
-        detail:
-          `Failed to fetch file ${options.path} for project ${options.projectId}: ${await readApiErrorMessage(
+  if (
+    options.maximumContentCharacters !== undefined &&
+    (!Number.isSafeInteger(options.maximumContentCharacters) ||
+      options.maximumContentCharacters <= 0 ||
+      options.maximumContentCharacters >
+        Math.floor((Number.MAX_SAFE_INTEGER - PROJECT_FILE_JSON_OVERHEAD_BYTES) / 6))
+  ) {
+    throw new RangeError(
+      "Project file maximumContentCharacters must be a positive bounded safe integer",
+    );
+  }
+  return withRuntimeProjectFilesRequestSignal(
+    options,
+    (signal) =>
+      traceProjectFilesRequest(options, "runtimeProjectFiles.getProjectFile", async () => {
+        const url = createRuntimeProjectFileUrl({
+          ...options,
+          fields: "(path,content)",
+        });
+        const response = await fetchRuntimeProjectFilesRestResponse(url, options, signal);
+
+        if (response.status === 404) {
+          return null;
+        }
+
+        if (!response.ok) {
+          throw NETWORK_ERROR.create({
+            detail:
+              `Failed to fetch file ${options.path} for project ${options.projectId}: ${await readApiErrorMessage(
+                response,
+              )}`,
+          });
+        }
+
+        const responseValue = options.maximumContentCharacters === undefined
+          ? await response.json()
+          : await readJsonResponseWithinLimit(
             response,
-          )}`,
-      });
+            options.maximumContentCharacters * 6 + PROJECT_FILE_JSON_OVERHEAD_BYTES,
+            signal,
+          );
+        const parsed = getRuntimeProjectFileSchema().safeParse(responseValue);
+        if (!parsed.success) {
+          throw NETWORK_ERROR.create({
+            detail:
+              `Failed to fetch file ${options.path} for project ${options.projectId}: invalid API response`,
+          });
+        }
+
+        if (
+          options.maximumContentCharacters !== undefined &&
+          parsed.data.content.length > options.maximumContentCharacters
+        ) {
+          throw new RangeError(
+            `Project file content may contain at most ${options.maximumContentCharacters} characters`,
+          );
+        }
+        return parsed.data;
+      }),
+  );
+}
+
+async function readJsonResponseWithinLimit(
+  response: Response,
+  byteLimit: number,
+  abortSignal?: AbortSignal,
+  listingBudget?: RuntimeProjectFileListingBudget,
+): Promise<unknown> {
+  throwIfAborted(abortSignal);
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null) {
+    const length = Number(declaredLength);
+    if (Number.isFinite(length) && length > byteLimit) {
+      throw new RangeError(`Project file response may contain at most ${byteLimit} bytes`);
     }
+  }
+  if (!response.body) {
+    const text = await response.text();
+    throwIfAborted(abortSignal);
+    const byteLength = utf8Encoder.encode(text).byteLength;
+    listingBudget?.consumeBytes(byteLength);
+    if (byteLength > byteLimit) {
+      throw new RangeError(`Project file response may contain at most ${byteLimit} bytes`);
+    }
+    return JSON.parse(text);
+  }
+
+  const reader = response.body.getReader();
+  const blocks: Uint8Array[] = [];
+  let total = 0;
+  let currentBlock: Uint8Array | undefined;
+  let currentBlockLength = 0;
+  let chunksSinceYield = 0;
+  let consecutiveEmptyChunks = 0;
+  const abortBodyRead = () => {
+    void reader.cancel(abortSignal?.reason).catch(() => undefined);
+  };
+  abortSignal?.addEventListener("abort", abortBodyRead, { once: true });
+  try {
+    while (true) {
+      const result = await reader.read();
+      throwIfAborted(abortSignal);
+      if (result.done) break;
+
+      const chunk = result.value;
+      if (chunk.byteLength === 0) {
+        consecutiveEmptyChunks += 1;
+        if (consecutiveEmptyChunks > PROJECT_FILE_RESPONSE_MAX_CONSECUTIVE_EMPTY_CHUNKS) {
+          throw new RangeError("Project file response stream made no byte progress");
+        }
+      } else {
+        consecutiveEmptyChunks = 0;
+      }
+
+      total += chunk.byteLength;
+      listingBudget?.consumeBytes(chunk.byteLength);
+      if (total > byteLimit) {
+        throw new RangeError(`Project file response may contain at most ${byteLimit} bytes`);
+      }
 
-    const parsed = getRuntimeProjectFileSchema().safeParse(await response.json());
-    if (!parsed.success) {
-      throw NETWORK_ERROR.create({
-        detail:
-          `Failed to fetch file ${options.path} for project ${options.projectId}: invalid API response`,
-      });
+      let chunkOffset = 0;
+      while (chunkOffset < chunk.byteLength) {
+        if (!currentBlock) {
+          currentBlock = new Uint8Array(
+            Math.min(PROJECT_FILE_RESPONSE_BLOCK_BYTES, byteLimit),
+          );
+          currentBlockLength = 0;
+        }
+        const copied = Math.min(
+          currentBlock.byteLength - currentBlockLength,
+          chunk.byteLength - chunkOffset,
+        );
+        currentBlock.set(chunk.subarray(chunkOffset, chunkOffset + copied), currentBlockLength);
+        currentBlockLength += copied;
+        chunkOffset += copied;
+        if (currentBlockLength === currentBlock.byteLength) {
+          blocks.push(currentBlock);
+          currentBlock = undefined;
+          currentBlockLength = 0;
+        }
+      }
+
+      chunksSinceYield += 1;
+      if (chunksSinceYield >= PROJECT_FILE_RESPONSE_YIELD_CHUNKS) {
+        chunksSinceYield = 0;
+        await new Promise<void>((resolve) => setTimeout(resolve, 0));
+        throwIfAborted(abortSignal);
+      }
     }
+  } catch (error) {
+    void reader.cancel(error).catch(() => undefined);
+    throw error;
+  } finally {
+    abortSignal?.removeEventListener("abort", abortBodyRead);
+    reader.releaseLock();
+  }
 
-    return parsed.data;
-  });
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const block of blocks) {
+    bytes.set(block, offset);
+    offset += block.byteLength;
+  }
+  if (currentBlock && currentBlockLength > 0) {
+    bytes.set(currentBlock.subarray(0, currentBlockLength), offset);
+  }
+  return JSON.parse(utf8Decoder.decode(bytes));
 }
 
 /** Return runtime project files. */
 export async function getRuntimeProjectFiles(
   options: RuntimeProjectFilesClientOptions & RuntimeProjectFilesApiOptions,
 ): Promise<RuntimeProjectFileListItem[]> {
-  return traceProjectFilesRequest(options, "runtimeProjectFiles.getProjectFiles", async () => {
-    const files: RuntimeProjectFileListItem[] = [];
-    let cursor: string | null = null;
-
-    do {
-      const url = createRuntimeProjectFileUrl({
-        ...options,
-        fields: "(path)",
-        cursor,
-      });
-      const response = await fetchRuntimeProjectFilesRestResponse(url, options);
-
-      if (!response.ok) {
-        throw NETWORK_ERROR.create({
-          detail:
-            `Failed to fetch files for project ${options.projectId}: ${await readApiErrorMessage(
+  if (
+    options.maximumEntries !== undefined &&
+    (!Number.isSafeInteger(options.maximumEntries) || options.maximumEntries <= 0)
+  ) {
+    throw new RangeError("Project file maximumEntries must be a positive safe integer");
+  }
+  if (
+    options.pathPrefix !== undefined &&
+    (options.pathPrefix.length === 0 ||
+      options.pathPrefix.length > PROJECT_FILE_PATH_MAX_CHARACTERS ||
+      options.pathPrefix.startsWith("/") || options.pathPrefix.endsWith("/") ||
+      options.pathPrefix.includes("\\") || options.pathPrefix.includes("\0") ||
+      options.pathPrefix.split("/").some((segment) =>
+        segment.length === 0 || segment === "." || segment === ".."
+      ))
+  ) {
+    throw new RangeError(
+      `Project file list path must contain between 1 and ${PROJECT_FILE_PATH_MAX_CHARACTERS} characters`,
+    );
+  }
+  return withRuntimeProjectFilesRequestSignal(
+    options,
+    (signal) =>
+      traceProjectFilesRequest(options, "runtimeProjectFiles.getProjectFiles", async () => {
+        const files: RuntimeProjectFileListItem[] = [];
+        const listingBudget = options.listingBudget ?? createRuntimeProjectFileListingBudget();
+        const seenCursors = new Set<string>();
+        let cursor: string | null = null;
+
+        do {
+          throwIfAborted(signal);
+          listingBudget.consumePage();
+          const url = createRuntimeProjectFileUrl({
+            ...options,
+            fields: "(path)",
+            cursor,
+          });
+          const response = await fetchRuntimeProjectFilesRestResponse(url, options, signal);
+          throwIfAborted(signal);
+
+          if (!response.ok) {
+            throw NETWORK_ERROR.create({
+              detail:
+                `Failed to fetch files for project ${options.projectId}: ${await readApiErrorMessage(
+                  response,
+                )}`,
+            });
+          }
+
+          const parsed = getRuntimeProjectFileListRestResponseSchema().safeParse(
+            await readJsonResponseWithinLimit(
               response,
-            )}`,
-        });
-      }
-
-      const parsed = getRuntimeProjectFileListRestResponseSchema().safeParse(await response.json());
-      if (!parsed.success) {
-        throw NETWORK_ERROR.create({
-          detail: `Failed to fetch files for project ${options.projectId}: invalid API response`,
-        });
-      }
-
-      files.push(...parsed.data.data);
-      cursor = parsed.data.page_info.next;
-    } while (cursor);
-
-    return files;
-  });
+              PROJECT_FILE_LIST_PAGE_MAX_BYTES,
+              signal,
+              listingBudget,
+            ),
+          );
+          if (!parsed.success) {
+            throw NETWORK_ERROR.create({
+              detail:
+                `Failed to fetch files for project ${options.projectId}: invalid API response`,
+            });
+          }
+
+          for (const file of parsed.data.data) {
+            if (file.path.length > PROJECT_FILE_PATH_MAX_CHARACTERS) {
+              throw new RangeError(
+                `Project file paths may contain at most ${PROJECT_FILE_PATH_MAX_CHARACTERS} characters`,
+              );
+            }
+          }
+          if (
+            parsed.data.page_info.next !== null &&
+            parsed.data.page_info.next.length > PROJECT_FILE_CURSOR_MAX_CHARACTERS
+          ) {
+            throw new RangeError(
+              `Project file cursors may contain at most ${PROJECT_FILE_CURSOR_MAX_CHARACTERS} characters`,
+            );
+          }
+
+          if (
+            options.maximumEntries !== undefined &&
+            files.length + parsed.data.data.length > options.maximumEntries
+          ) {
+            throw new RangeError(
+              `Project file listing may contain at most ${options.maximumEntries} entries`,
+            );
+          }
+          files.push(...parsed.data.data);
+          cursor = parsed.data.page_info.next;
+          if (cursor !== null && seenCursors.has(cursor)) {
+            throw new RangeError("Project file listing returned a repeated pagination cursor");
+          }
+          if (cursor !== null) seenCursors.add(cursor);
+        } while (cursor);
+
+        return files;
+      }),
+  );
 }
 
 function createRuntimeProjectFileUrl(input: {
@@ -194,6 +493,7 @@ function createRuntimeProjectFileUrl(input: {
   fields: string;
   cursor?: string | null;
   pageLimit?: number;
+  pathPrefix?: string;
 }): URL {
   const apiUrl = new URL(input.apiUrl);
   const encodedProjectId = encodeURIComponent(input.projectId);
@@ -209,6 +509,9 @@ function createRuntimeProjectFileUrl(input: {
   if (input.cursor) {
     url.searchParams.set("cursor", input.cursor);
   }
+  if (input.pathPrefix) {
+    url.searchParams.set("path", input.pathPrefix);
+  }
   if (!input.path) {
     url.searchParams.set("limit", String(input.pageLimit ?? DEFAULT_PROJECT_FILES_PAGE_LIMIT));
   }
@@ -219,12 +522,13 @@ function createRuntimeProjectFileUrl(input: {
 async function fetchRuntimeProjectFilesRestResponse(
   url: URL,
   options: RuntimeProjectFilesClientOptions & { authToken: string },
+  signal: AbortSignal,
 ): Promise<Response> {
   const response = await (options.fetch ?? fetch)(url.toString(), {
     headers: {
       Authorization: `Bearer ${options.authToken}`,
     },
-    signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_PROJECT_FILES_TIMEOUT_MS),
+    signal,
   });
 
   if (response.status === 401 || response.status === 403) {
@@ -234,6 +538,41 @@ async function fetchRuntimeProjectFilesRestResponse(
   return response;
 }
 
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (!signal?.aborted) return;
+  throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+
+async function withRuntimeProjectFilesRequestSignal<T>(
+  options: RuntimeProjectFilesClientOptions & { abortSignal?: AbortSignal },
+  fn: (signal: AbortSignal) => Promise<T>,
+): Promise<T> {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_PROJECT_FILES_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("Project files timeoutMs must be a positive safe integer");
+  }
+  const controller = new AbortController();
+  const externalSignal = options.abortSignal;
+  const abortFromExternal = () => controller.abort(externalSignal?.reason);
+  if (externalSignal) {
+    externalSignal.addEventListener("abort", abortFromExternal, { once: true });
+    if (externalSignal.aborted) abortFromExternal();
+  }
+  const timeoutId = setTimeout(
+    () => controller.abort(new DOMException("The operation timed out", "TimeoutError")),
+    timeoutMs,
+  );
+  try {
+    throwIfAborted(controller.signal);
+    const result = await fn(controller.signal);
+    throwIfAborted(controller.signal);
+    return result;
+  } finally {
+    clearTimeout(timeoutId);
+    externalSignal?.removeEventListener("abort", abortFromExternal);
+  }
+}
+
 function createProjectFilesAccessDeniedError(
   options: RuntimeProjectFilesClientOptions,
   statusCode: number,
diff --git a/src/agent/runtime/project-skill-catalog.test.ts b/src/agent/runtime/project-skill-catalog.test.ts
index 92826b1fb2..3ad8447dc1 100644
--- a/src/agent/runtime/project-skill-catalog.test.ts
+++ b/src/agent/runtime/project-skill-catalog.test.ts
@@ -1,5 +1,5 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals, assertExists } from "@std/assert";
+import { assertEquals, assertExists, assertRejects, assertThrows } from "@std/assert";
 import { resolve } from "node:path";
 import {
   getRuntimeProjectInstructions,
@@ -11,6 +11,12 @@ import type {
   RuntimeProjectFilesApiOptions,
 } from "./project-files-client.ts";
 import type { RuntimeSkillDefinition } from "./skill-metadata.ts";
+import {
+  SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS,
+  SKILL_CATALOG_MAX_METADATA_CHARACTERS,
+  SKILL_CATALOG_MAX_PATH_ENTRIES,
+  SKILL_CATALOG_MAX_SKILLS,
+} from "#veryfront/skill/limits.ts";
 
 const PROJECT_CONTEXT = {
   projectId: "project-1",
@@ -18,6 +24,14 @@ const PROJECT_CONTEXT = {
   branchId: "branch-1",
 };
 
+function withoutRuntimeBudgetFields<T extends RuntimeProjectFilesApiOptions>(options: T) {
+  const copy = { ...options };
+  delete copy.abortSignal;
+  delete copy.timeoutMs;
+  delete copy.listingBudget;
+  return copy;
+}
+
 function withTempDir(fn: (dir: string) => void): void {
   const dir = Deno.makeTempDirSync();
   try {
@@ -43,7 +57,11 @@ function createSkillCatalog(input: {
         builtinSkills: input.builtinSkills ?? [],
         getProjectFiles: async (options) => {
           filesCalls.push(options);
-          return input.paths === null ? null : (input.paths ?? []).map((path) => ({ path }));
+          if (input.paths === null) return null;
+          const prefix = options.pathPrefix ? `${options.pathPrefix}/` : undefined;
+          return (input.paths ?? [])
+            .filter((path) => !prefix || path.startsWith(prefix))
+            .map((path) => ({ path }));
         },
         getProjectFile: async (options) => {
           fileCalls.push(options);
@@ -77,6 +95,126 @@ Deno.test("loadRuntimeBuiltinSkillCatalog loads flat and directory skills with r
   });
 });
 
+Deno.test("built-in catalog rejects work beyond the cumulative skill limit", () => {
+  withTempDir((rootDir) => {
+    for (let index = 0; index <= SKILL_CATALOG_MAX_SKILLS; index += 1) {
+      Deno.writeTextFileSync(resolve(rootDir, `skill-${index}.md`), "# Skill");
+    }
+    assertThrows(
+      () => loadRuntimeBuiltinSkillCatalog({ skillsDir: rootDir }),
+      RangeError,
+      `at most ${SKILL_CATALOG_MAX_SKILLS} skills`,
+    );
+  });
+});
+
+Deno.test("hosted catalog accepts the exact document aggregate and rejects one character over", async () => {
+  const exact = Array.from({ length: 8 }, (_, index) => ({
+    id: `skill-${index}`,
+    name: `skill-${index}`,
+    description: "Skill",
+    instructions: "x".repeat(SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS / 8),
+    allowedTools: [],
+  }));
+  const getProjectFiles = () => Promise.resolve(null);
+  const getProjectFile = () => Promise.resolve(null);
+
+  assertEquals(
+    await getRuntimeProjectSkillCatalog({
+      ...PROJECT_CONTEXT,
+      builtinSkills: exact,
+      getProjectFiles,
+      getProjectFile,
+    }),
+    exact,
+  );
+  await assertRejects(
+    () =>
+      getRuntimeProjectSkillCatalog({
+        ...PROJECT_CONTEXT,
+        builtinSkills: [...exact, {
+          id: "over",
+          name: "over",
+          description: "Over",
+          instructions: "x",
+          allowedTools: [],
+        }],
+        getProjectFiles,
+        getProjectFile,
+      }),
+    RangeError,
+    `at most ${SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS} characters`,
+  );
+});
+
+Deno.test("hosted catalog enforces retained metadata cumulatively before discovery", async () => {
+  const exactDescription = "x".repeat(SKILL_CATALOG_MAX_METADATA_CHARACTERS - 2);
+  const exact: RuntimeSkillDefinition = {
+    id: "a",
+    name: "a",
+    description: exactDescription,
+    instructions: "",
+    allowedTools: [],
+  };
+  assertEquals(
+    await getRuntimeProjectSkillCatalog({
+      ...PROJECT_CONTEXT,
+      builtinSkills: [exact],
+      getProjectFiles: () => Promise.resolve(null),
+      getProjectFile: () => Promise.resolve(null),
+    }),
+    [exact],
+  );
+  await assertRejects(
+    () =>
+      getRuntimeProjectSkillCatalog({
+        ...PROJECT_CONTEXT,
+        builtinSkills: [{ ...exact, description: `${exactDescription}x` }],
+        getProjectFiles: () => Promise.resolve(null),
+        getProjectFile: () => Promise.resolve(null),
+      }),
+    RangeError,
+    `at most ${SKILL_CATALOG_MAX_METADATA_CHARACTERS} characters`,
+  );
+});
+
+Deno.test("hosted catalog accepts the exact aggregate reference count and rejects one over", async () => {
+  const definition = (id: string, count: number): RuntimeSkillDefinition => ({
+    id,
+    name: id,
+    description: id,
+    instructions: "",
+    allowedTools: [],
+    references: Array.from({ length: count }, (_, index) => `references/${id}-${index}.md`),
+  });
+  const exact = [
+    definition("first", SKILL_CATALOG_MAX_PATH_ENTRIES / 2),
+    definition("second", SKILL_CATALOG_MAX_PATH_ENTRIES / 2),
+  ];
+  const getProjectFiles = () => Promise.resolve(null);
+  const getProjectFile = () => Promise.resolve(null);
+  assertEquals(
+    await getRuntimeProjectSkillCatalog({
+      ...PROJECT_CONTEXT,
+      builtinSkills: exact,
+      getProjectFiles,
+      getProjectFile,
+    }),
+    exact,
+  );
+  await assertRejects(
+    () =>
+      getRuntimeProjectSkillCatalog({
+        ...PROJECT_CONTEXT,
+        builtinSkills: [...exact, definition("over", 1)],
+        getProjectFiles,
+        getProjectFile,
+      }),
+    RangeError,
+    `at most ${SKILL_CATALOG_MAX_PATH_ENTRIES} entries`,
+  );
+});
+
 Deno.test("getRuntimeProjectInstructions returns the first available instruction file", async () => {
   const fileCalls: RuntimeGetProjectFileOptions[] = [];
 
@@ -89,10 +227,11 @@ Deno.test("getRuntimeProjectInstructions returns the first available instruction
   });
 
   assertEquals(instructions, "# Agent");
-  assertEquals(fileCalls, [
+  assertEquals(fileCalls.map(withoutRuntimeBudgetFields), [
     {
       ...PROJECT_CONTEXT,
       path: "AGENTS.md",
+      maximumContentCharacters: 1_048_576,
     },
   ]);
 });
@@ -112,6 +251,28 @@ Deno.test("getRuntimeProjectSkillCatalog returns builtin skills when project fil
   assertEquals(await catalog(), builtinSkills);
 });
 
+Deno.test("project skill catalog rejects oversized discovery before scheduling file reads", async () => {
+  let fileReads = 0;
+  await assertRejects(
+    () =>
+      getRuntimeProjectSkillCatalog({
+        ...PROJECT_CONTEXT,
+        builtinSkills: [],
+        getProjectFiles: () =>
+          Promise.resolve(
+            Array.from({ length: 1_001 }, (_, index) => ({ path: `skills/${index}.md` })),
+          ),
+        getProjectFile: () => {
+          fileReads += 1;
+          return Promise.resolve(null);
+        },
+      }),
+    RangeError,
+    "may contain at most 1000 entries",
+  );
+  assertEquals(fileReads, 0);
+});
+
 Deno.test("getRuntimeProjectSkillCatalog parses project directory skills and references", async () => {
   const { catalog, filesCalls, fileCalls } = createSkillCatalog({
     paths: [
@@ -134,11 +295,16 @@ Deno.test("getRuntimeProjectSkillCatalog parses project directory skills and ref
   assertEquals(research.maxSteps, 7);
   assertEquals(research.allowedTools, ["bash"]);
   assertEquals(research.references, ["references/checklists/checklist.md"]);
-  assertEquals(filesCalls, [PROJECT_CONTEXT]);
-  assertEquals(fileCalls, [
+  assertEquals(filesCalls.map(withoutRuntimeBudgetFields), [
+    { ...PROJECT_CONTEXT, pathPrefix: "skills", maximumEntries: 1_000 },
+    { ...PROJECT_CONTEXT, pathPrefix: ".veryfront/skills", maximumEntries: 1_000 },
+    { ...PROJECT_CONTEXT, pathPrefix: "agents", maximumEntries: 1_000 },
+  ]);
+  assertEquals(fileCalls.map(withoutRuntimeBudgetFields), [
     {
       ...PROJECT_CONTEXT,
       path: "skills/research/SKILL.md",
+      maximumContentCharacters: 1_048_576,
     },
   ]);
 });
diff --git a/src/agent/runtime/project-skill-catalog.ts b/src/agent/runtime/project-skill-catalog.ts
index 66b232d049..3a96321540 100644
--- a/src/agent/runtime/project-skill-catalog.ts
+++ b/src/agent/runtime/project-skill-catalog.ts
@@ -9,6 +9,7 @@ import type {
   RuntimeProjectFileListItem,
   RuntimeProjectFilesApiOptions,
 } from "./project-files-client.ts";
+import { createRuntimeProjectFileListingBudget } from "./project-files-client.ts";
 import {
   listRuntimeBuiltinSkillReferences,
   readRuntimeBuiltinDirectorySkill,
@@ -20,6 +21,102 @@ import {
   type RuntimeSkillDefinition,
   type RuntimeSkillMetadataLogger,
 } from "./skill-metadata.ts";
+import {
+  createSkillOperationBudget,
+  type SkillOperationBudget,
+} from "#veryfront/skill/operation-budget.ts";
+import {
+  SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS,
+  SKILL_CATALOG_MAX_DOCUMENT_UTF8_BYTES,
+  SKILL_CATALOG_MAX_METADATA_CHARACTERS,
+  SKILL_CATALOG_MAX_PATH_ENTRIES,
+  SKILL_CATALOG_MAX_SKILLS,
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_FILE_OPERATION_TIMEOUT_MS,
+  SKILL_ROOT_PATH_MAX_LENGTH,
+  SKILL_STEERING_PATH_MAX_ENTRIES,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
+
+const utf8Encoder = new TextEncoder();
+
+class RuntimeSkillCatalogBudget {
+  private documentCharacters = 0;
+  private documentUtf8Bytes = 0;
+  private metadataCharacters = 0;
+  private pathEntries = 0;
+  private skills = 0;
+
+  retainDocument(content: string): void {
+    const characters = this.documentCharacters + content.length;
+    const utf8Bytes = this.documentUtf8Bytes + utf8Encoder.encode(content).byteLength;
+    if (characters > SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS) {
+      throw new RangeError(
+        `Skill catalog documents may contain at most ${SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS} characters`,
+      );
+    }
+    if (utf8Bytes > SKILL_CATALOG_MAX_DOCUMENT_UTF8_BYTES) {
+      throw new RangeError(
+        `Skill catalog documents may contain at most ${SKILL_CATALOG_MAX_DOCUMENT_UTF8_BYTES} UTF-8 bytes`,
+      );
+    }
+    this.documentCharacters = characters;
+    this.documentUtf8Bytes = utf8Bytes;
+  }
+
+  retainPath(): void {
+    if (this.pathEntries >= SKILL_CATALOG_MAX_PATH_ENTRIES) {
+      throw new RangeError(
+        `Skill catalog paths may contain at most ${SKILL_CATALOG_MAX_PATH_ENTRIES} entries`,
+      );
+    }
+    this.pathEntries += 1;
+  }
+
+  retainDefinition(definition: RuntimeSkillDefinition): void {
+    if (this.skills >= SKILL_CATALOG_MAX_SKILLS) {
+      throw new RangeError(`Skill catalog may contain at most ${SKILL_CATALOG_MAX_SKILLS} skills`);
+    }
+    const metadataCharacters = this.metadataCharacters + getRetainedMetadataCharacters(definition);
+    if (metadataCharacters > SKILL_CATALOG_MAX_METADATA_CHARACTERS) {
+      throw new RangeError(
+        `Skill catalog metadata may contain at most ${SKILL_CATALOG_MAX_METADATA_CHARACTERS} characters`,
+      );
+    }
+    this.skills += 1;
+    this.metadataCharacters = metadataCharacters;
+  }
+}
+
+function getRetainedMetadataCharacters(definition: RuntimeSkillDefinition): number {
+  let total = definition.id.length + definition.name.length + definition.description.length;
+  for (
+    const value of [
+      definition.displayName,
+      definition.model,
+      definition.ownerAgentId,
+      definition.shortName,
+      definition.sourcePath,
+    ]
+  ) {
+    total += value?.length ?? 0;
+  }
+  for (const value of definition.allowedTools) total += value.length;
+  for (const value of definition.references ?? []) total += value.length;
+  for (const [key, value] of Object.entries(definition.metadata ?? {})) {
+    total += key.length + value.length;
+  }
+  return total;
+}
+
+function retainExistingDefinition(
+  budget: RuntimeSkillCatalogBudget,
+  definition: RuntimeSkillDefinition,
+): void {
+  budget.retainDocument(definition.instructions);
+  for (const _reference of definition.references ?? []) budget.retainPath();
+  budget.retainDefinition(definition);
+}
 
 /** Public API contract for runtime project steering lookup. */
 export type RuntimeProjectSteeringLookup = {
@@ -37,12 +134,14 @@ export type RuntimeProjectSkillCatalogOptions = {
   builtinSkills: readonly RuntimeSkillDefinition[];
   steeringPaths?: Pick<ProjectSteeringPaths, "skills">;
   logger?: RuntimeSkillMetadataLogger;
+  operationBudget?: SkillOperationBudget;
 };
 
 /** Options accepted by runtime project instructions. */
 export type RuntimeProjectInstructionsOptions = {
   getProjectFile: (options: RuntimeGetProjectFileOptions) => Promise<RuntimeProjectFile | null>;
   steeringPaths?: Pick<ProjectSteeringPaths, "instructions">;
+  operationBudget?: SkillOperationBudget;
 };
 
 function sortSkillsById(skills: Iterable<RuntimeSkillDefinition>): RuntimeSkillDefinition[] {
@@ -50,11 +149,47 @@ function sortSkillsById(skills: Iterable<RuntimeSkillDefinition>): RuntimeSkillD
 }
 
 function getSkillPaths(options: Pick<RuntimeProjectSkillCatalogOptions, "steeringPaths">) {
-  return options.steeringPaths?.skills ?? DEFAULT_PROJECT_STEERING_PATHS.skills;
+  const paths = options.steeringPaths?.skills ?? DEFAULT_PROJECT_STEERING_PATHS.skills;
+  assertSteeringPathCount(paths);
+  for (const path of paths) assertCatalogPrefix(path);
+  return paths;
+}
+
+function assertCatalogPrefix(path: string): void {
+  const segments = path.split("/");
+  if (
+    path.length === 0 || path.length > SKILL_ROOT_PATH_MAX_LENGTH || path.startsWith("/") ||
+    path.endsWith("/") || path.includes("\\") || path.includes("\0") ||
+    segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")
+  ) {
+    throw new RangeError("Project skill catalog prefixes must be bounded relative paths");
+  }
 }
 
 function getInstructionPaths(options: RuntimeProjectInstructionsOptions) {
-  return options.steeringPaths?.instructions ?? DEFAULT_PROJECT_STEERING_PATHS.instructions;
+  const paths = options.steeringPaths?.instructions ?? DEFAULT_PROJECT_STEERING_PATHS.instructions;
+  assertSteeringPathCount(paths);
+  return paths;
+}
+
+function assertSteeringPathCount(paths: readonly string[]): void {
+  if (paths.length > SKILL_STEERING_PATH_MAX_ENTRIES) {
+    throw new RangeError(
+      `Project steering paths may contain at most ${SKILL_STEERING_PATH_MAX_ENTRIES} entries`,
+    );
+  }
+}
+
+function assertCatalogContent(content: string, label: string): void {
+  if (content.length > SKILL_DOCUMENT_MAX_CHARACTERS) {
+    throw new RangeError(
+      `${label} may contain at most ${SKILL_DOCUMENT_MAX_CHARACTERS} characters`,
+    );
+  }
+}
+
+function createCatalogBudget(existing?: SkillOperationBudget): SkillOperationBudget {
+  return existing ?? createSkillOperationBudget({ timeoutMs: SKILL_FILE_OPERATION_TIMEOUT_MS });
 }
 
 /** Loads runtime builtin skill catalog. */
@@ -62,6 +197,7 @@ export function loadRuntimeBuiltinSkillCatalog(input: {
   skillsDir: string;
   logger?: RuntimeSkillMetadataLogger;
 }): RuntimeSkillDefinition[] {
+  const catalogBudget = new RuntimeSkillCatalogBudget();
   const entriesResult = readRuntimeBuiltinSkillEntries(input.skillsDir);
   if (!entriesResult.ok) {
     input.logger?.error?.("Failed to load built-in skills", {
@@ -71,58 +207,74 @@ export function loadRuntimeBuiltinSkillCatalog(input: {
     return [];
   }
 
-  return sortSkillsById(
-    entriesResult.entries.flatMap((entry) => {
-      if (entry.isFile() && entry.name.endsWith(".md")) {
-        const id = basename(entry.name, ".md");
-        const content = readRuntimeBuiltinFlatSkill(input.skillsDir, id);
-        if (content === null) {
-          return [];
-        }
-
-        const definition = buildRuntimeSkillDefinition({
-          id,
-          content,
-          logger: input.logger,
-        });
-
-        return definition ? [definition] : [];
+  const definitions = entriesResult.entries.flatMap((entry) => {
+    if (entry.isFile() && entry.name.endsWith(".md")) {
+      const id = basename(entry.name, ".md");
+      const content = readRuntimeBuiltinFlatSkill(input.skillsDir, id);
+      if (content === null) {
+        return [];
       }
+      catalogBudget.retainDocument(content);
 
-      if (entry.isDirectory()) {
-        const content = readRuntimeBuiltinDirectorySkill(input.skillsDir, entry.name);
-        if (content === null) {
-          return [];
-        }
+      const definition = buildRuntimeSkillDefinition({
+        id,
+        content,
+        logger: input.logger,
+      });
 
-        const definition = buildRuntimeSkillDefinition({
-          id: entry.name,
-          content,
-          references: listRuntimeBuiltinSkillReferences(input.skillsDir, entry.name),
-          logger: input.logger,
-        });
+      if (!definition) return [];
+      catalogBudget.retainPath();
+      catalogBudget.retainDefinition(definition);
+      return [definition];
+    }
 
-        return definition ? [definition] : [];
+    if (entry.isDirectory()) {
+      const content = readRuntimeBuiltinDirectorySkill(input.skillsDir, entry.name);
+      if (content === null) {
+        return [];
       }
+      catalogBudget.retainDocument(content);
+      const references = listRuntimeBuiltinSkillReferences(input.skillsDir, entry.name);
+      for (const _reference of references) catalogBudget.retainPath();
+
+      const definition = buildRuntimeSkillDefinition({
+        id: entry.name,
+        content,
+        references,
+        logger: input.logger,
+      });
 
-      return [];
-    }),
-  );
+      if (!definition) return [];
+      catalogBudget.retainPath();
+      catalogBudget.retainDefinition(definition);
+      return [definition];
+    }
+
+    return [];
+  });
+  return sortSkillsById(definitions);
 }
 
 /** Return runtime project instructions. */
 export async function getRuntimeProjectInstructions(
   input: RuntimeProjectSteeringLookup & RuntimeProjectInstructionsOptions,
 ): Promise<string> {
+  const budget = createCatalogBudget(input.operationBudget);
   for (const filePath of getInstructionPaths(input)) {
-    const file = await input.getProjectFile({
-      projectId: input.projectId,
-      authToken: input.authToken,
-      branchId: input.branchId,
-      path: filePath,
-    });
+    const file = await budget.run((abortSignal) =>
+      input.getProjectFile({
+        projectId: input.projectId,
+        authToken: input.authToken,
+        branchId: input.branchId,
+        path: filePath,
+        maximumContentCharacters: SKILL_DOCUMENT_MAX_CHARACTERS,
+        abortSignal,
+        timeoutMs: budget.remainingMs(),
+      })
+    );
 
     if (file?.content) {
+      assertCatalogContent(file.content, "Project instructions");
       return file.content;
     }
   }
@@ -134,18 +286,56 @@ export async function getRuntimeProjectInstructions(
 export async function getRuntimeProjectSkillCatalog(
   input: RuntimeProjectSteeringLookup & RuntimeProjectSkillCatalogOptions,
 ): Promise<RuntimeSkillDefinition[]> {
-  const allFiles = await input.getProjectFiles({
-    projectId: input.projectId,
-    authToken: input.authToken,
-    branchId: input.branchId,
-  });
-  if (!allFiles || allFiles.length === 0) {
+  const budget = createCatalogBudget(input.operationBudget);
+  const catalogBudget = new RuntimeSkillCatalogBudget();
+  const skillPrefixes = getSkillPaths(input);
+  for (const definition of input.builtinSkills) retainExistingDefinition(catalogBudget, definition);
+  const filesByPath = new Map<string, RuntimeProjectFileListItem>();
+  const listingBudget = createRuntimeProjectFileListingBudget();
+  let hasAvailableListing = false;
+  for (const prefix of new Set([...skillPrefixes, "agents"])) {
+    const prefixWithSlash = `${prefix}/`;
+    const files = await budget.run((abortSignal) =>
+      input.getProjectFiles({
+        projectId: input.projectId,
+        authToken: input.authToken,
+        branchId: input.branchId,
+        pathPrefix: prefix,
+        maximumEntries: SKILL_SUBDIR_MAX_ENTRIES,
+        listingBudget,
+        abortSignal,
+        timeoutMs: budget.remainingMs(),
+      })
+    );
+    if (!files) {
+      continue;
+    }
+    hasAvailableListing = true;
+    for (const file of files) {
+      // Do not trust custom clients to honor the server-side catalog filter.
+      if (!file.path.startsWith(prefixWithSlash)) {
+        continue;
+      }
+      if (!filesByPath.has(file.path)) catalogBudget.retainPath();
+      filesByPath.set(file.path, file);
+      if (filesByPath.size > SKILL_SUBDIR_MAX_ENTRIES) {
+        throw new RangeError(
+          `Project skill file listing may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+        );
+      }
+    }
+  }
+  if (!hasAvailableListing) {
+    return [...input.builtinSkills];
+  }
+  const allFiles = [...filesByPath.values()];
+  if (allFiles.length === 0) {
     return [...input.builtinSkills];
   }
 
   const projectSkillsById = new Map<string, RuntimeSkillDefinition>();
 
-  for (const prefix of getSkillPaths(input)) {
+  for (const prefix of skillPrefixes) {
     const prefixWithSlash = `${prefix}/`;
 
     const flatPaths = allFiles
@@ -168,21 +358,23 @@ export async function getRuntimeProjectSkillCatalog(
       continue;
     }
 
-    const skillFiles = await Promise.all(
-      skillPaths.map((path) =>
+    for (const path of skillPaths) {
+      const file = await budget.run((abortSignal) =>
         input.getProjectFile({
           projectId: input.projectId,
           authToken: input.authToken,
           branchId: input.branchId,
           path,
+          maximumContentCharacters: SKILL_DOCUMENT_MAX_CHARACTERS,
+          abortSignal,
+          timeoutMs: budget.remainingMs(),
         })
-      ),
-    );
-
-    for (const file of skillFiles) {
+      );
       if (!file?.content) {
         continue;
       }
+      assertCatalogContent(file.content, "Skill document");
+      catalogBudget.retainDocument(file.content);
 
       const isFlat = file.path.endsWith(".md") && !file.path.endsWith("/SKILL.md");
       const id = getProjectSkillId(file.path, isFlat);
@@ -199,6 +391,7 @@ export async function getRuntimeProjectSkillCatalog(
       });
 
       if (definition && !projectSkillsById.has(definition.id)) {
+        catalogBudget.retainDefinition(definition);
         projectSkillsById.set(definition.id, definition);
       }
     }
@@ -214,21 +407,23 @@ export async function getRuntimeProjectSkillCatalog(
     .sort();
 
   if (colocatedPaths.length > 0) {
-    const colocatedFiles = await Promise.all(
-      colocatedPaths.map((path) =>
+    for (const path of colocatedPaths) {
+      const file = await budget.run((abortSignal) =>
         input.getProjectFile({
           projectId: input.projectId,
           authToken: input.authToken,
           branchId: input.branchId,
           path,
+          maximumContentCharacters: SKILL_DOCUMENT_MAX_CHARACTERS,
+          abortSignal,
+          timeoutMs: budget.remainingMs(),
         })
-      ),
-    );
-
-    for (const file of colocatedFiles) {
+      );
       if (!file?.content) {
         continue;
       }
+      assertCatalogContent(file.content, "Colocated skill document");
+      catalogBudget.retainDocument(file.content);
       const identity = getColocatedSkillIdentity(file.path);
       if (!identity) {
         continue;
@@ -245,6 +440,7 @@ export async function getRuntimeProjectSkillCatalog(
       });
 
       if (definition && !projectSkillsById.has(definition.id)) {
+        catalogBudget.retainDefinition(definition);
         projectSkillsById.set(definition.id, definition);
       }
     }
@@ -327,8 +523,14 @@ function getProjectSkillReferences(input: {
   const skillRootPrefix = input.file.path.replace(/SKILL\.md$/, "");
   const refsPrefix = `${skillRootPrefix}references/`;
 
-  return input.allFiles
+  const references = input.allFiles
     .filter((file) => file.path.startsWith(refsPrefix))
     .map((file) => file.path.slice(skillRootPrefix.length))
     .sort();
+  if (references.length > SKILL_SUBDIR_MAX_ENTRIES) {
+    throw new RangeError(
+      `Skill references may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+    );
+  }
+  return references;
 }
diff --git a/src/agent/runtime/project-skill-loader.test.ts b/src/agent/runtime/project-skill-loader.test.ts
index 66f3143ea2..875b0c4b6a 100644
--- a/src/agent/runtime/project-skill-loader.test.ts
+++ b/src/agent/runtime/project-skill-loader.test.ts
@@ -1,4 +1,9 @@
 import { assertEquals } from "#veryfront/testing/assert.ts";
+import {
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
+import { createSkillOperationBudget } from "#veryfront/skill/operation-budget.ts";
 import { createRuntimeProjectSkillLoader } from "./project-skill-loader.ts";
 import type {
   RuntimeGetProjectFileOptions,
@@ -65,7 +70,7 @@ Deno.test("runtime project skill loader returns empty results without project co
 });
 
 Deno.test("runtime project skill loader loads directory skills with normalized sorted references", async () => {
-  const { loader } = createLoader({
+  const { loader, filesCalls } = createLoader({
     getProjectFile: async ({ path }) =>
       path === "skills/research/SKILL.md" ? { path, content: "# Research" } : null,
     getProjectFiles: async () => [
@@ -80,6 +85,39 @@ Deno.test("runtime project skill loader loads directory skills with normalized s
     instructions: "# Research",
     references: ["references/checklists/checklist.md", "references/zeta.md"],
   });
+  assertEquals(filesCalls[0]?.pathPrefix, "skills/research/references");
+  assertEquals(filesCalls[0]?.maximumEntries, SKILL_SUBDIR_MAX_ENTRIES);
+});
+
+Deno.test("runtime project skill loader bounds every remote document read", async () => {
+  const { loader, fileCalls } = createLoader({
+    getProjectFile: async ({ path }) =>
+      path === "skills/research/SKILL.md"
+        ? { path, content: "# Research" }
+        : path === "skills/research/references/guide.md"
+        ? { path, content: "# Guide" }
+        : null,
+  });
+  const controller = new AbortController();
+  const budget = createSkillOperationBudget({
+    abortSignal: controller.signal,
+    timeoutMs: 5_000,
+  });
+
+  await loader.loadProjectSkill(PROJECT_CONTEXT, "research", { budget });
+  await loader.loadProjectSkillReference(
+    PROJECT_CONTEXT,
+    "research",
+    "references/guide.md",
+    { budget },
+  );
+
+  assertEquals(fileCalls.length, 3);
+  for (const call of fileCalls) {
+    assertEquals(call.maximumContentCharacters, SKILL_DOCUMENT_MAX_CHARACTERS);
+    assertEquals(call.abortSignal, controller.signal);
+    assertEquals(typeof call.timeoutMs, "number");
+  }
 });
 
 Deno.test("runtime project skill loader isolates references to the selected skill source path", async () => {
@@ -255,7 +293,7 @@ Deno.test("loadProjectSkillReference reads reference files from the catalog skil
 });
 
 Deno.test("listProjectSkillReferences lists references under the catalog skill dir", async () => {
-  const { loader } = createLoader({
+  const { loader, filesCalls } = createLoader({
     getProjectFiles: () =>
       Promise.resolve([
         { path: "agents/researcher/skills/cite/references/styles.md" },
@@ -270,6 +308,10 @@ Deno.test("listProjectSkillReferences lists references under the catalog skill d
   );
 
   assertEquals(references, ["references/journals.md", "references/styles.md"]);
+  assertEquals(
+    filesCalls[0]?.pathPrefix,
+    "agents/researcher/skills/cite/references",
+  );
 });
 
 Deno.test("loader falls back to steering-path probing without a catalog entry", async () => {
diff --git a/src/agent/runtime/project-skill-loader.ts b/src/agent/runtime/project-skill-loader.ts
index c5b429e4cf..fb98588303 100644
--- a/src/agent/runtime/project-skill-loader.ts
+++ b/src/agent/runtime/project-skill-loader.ts
@@ -9,6 +9,16 @@ import type {
   RuntimeProjectFilesApiOptions,
 } from "./project-files-client.ts";
 import { normalizeRuntimeSkillReferencePath } from "./skill-metadata.ts";
+import {
+  createSkillOperationBudget,
+  type SkillOperationBudget,
+} from "#veryfront/skill/operation-budget.ts";
+import {
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_FILE_OPERATION_TIMEOUT_MS,
+  SKILL_STEERING_PATH_MAX_ENTRIES,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
 
 /** Context for runtime project skill. */
 export type RuntimeProjectSkillContext = {
@@ -26,6 +36,11 @@ export type RuntimeProjectSkillContext = {
   skillSourcePaths?: Readonly<Record<string, string>>;
 };
 
+/** Shared resource budget supplied by the outer runtime tool call. */
+export type RuntimeProjectSkillOperationOptions = {
+  budget?: SkillOperationBudget;
+};
+
 /** Public API contract for runtime loaded project skill. */
 export type RuntimeLoadedProjectSkill = {
   instructions: string;
@@ -53,20 +68,37 @@ export type RuntimeProjectSkillLoader = {
   listProjectSkillReferences: (
     context: RuntimeProjectSkillContext,
     skillId: string,
+    operation?: RuntimeProjectSkillOperationOptions,
   ) => Promise<string[]>;
   loadProjectSkill: (
     context: RuntimeProjectSkillContext,
     skillId: string,
+    operation?: RuntimeProjectSkillOperationOptions,
   ) => Promise<RuntimeLoadedProjectSkill | null>;
   loadProjectSkillReference: (
     context: RuntimeProjectSkillContext,
     skillId: string,
     normalizedFile: string,
+    operation?: RuntimeProjectSkillOperationOptions,
   ) => Promise<string | null>;
 };
 
 function getSkillPaths(options: RuntimeProjectSkillLoaderOptions): readonly string[] {
-  return options.steeringPaths?.skills ?? DEFAULT_PROJECT_STEERING_PATHS.skills;
+  const paths = options.steeringPaths?.skills ?? DEFAULT_PROJECT_STEERING_PATHS.skills;
+  if (paths.length > SKILL_STEERING_PATH_MAX_ENTRIES) {
+    throw new RangeError(
+      `Skill steering paths may contain at most ${SKILL_STEERING_PATH_MAX_ENTRIES} entries`,
+    );
+  }
+  return paths;
+}
+
+function assertRuntimeSkillContent(content: string, label: string): void {
+  if (content.length > SKILL_DOCUMENT_MAX_CHARACTERS) {
+    throw new RangeError(
+      `${label} may contain at most ${SKILL_DOCUMENT_MAX_CHARACTERS} characters`,
+    );
+  }
 }
 
 function isAccessDeniedError(
@@ -104,10 +136,26 @@ function resolveCatalogSkillDir(
   return sourcePath.slice(0, -"/SKILL.md".length);
 }
 
+function getRemainingSkillOperationMs(budget: SkillOperationBudget): number | undefined {
+  budget.throwIfTerminated();
+  return budget.remainingMs();
+}
+
+function getBoundedProjectSkillReadOptions(
+  budget: SkillOperationBudget,
+): Pick<RuntimeGetProjectFileOptions, "abortSignal" | "maximumContentCharacters" | "timeoutMs"> {
+  return {
+    abortSignal: budget.abortSignal,
+    maximumContentCharacters: SKILL_DOCUMENT_MAX_CHARACTERS,
+    timeoutMs: getRemainingSkillOperationMs(budget),
+  };
+}
+
 async function findProjectSkillSource(input: {
   options: RuntimeProjectSkillLoaderOptions;
   context: RuntimeProjectSkillContext;
   skillId: string;
+  budget: SkillOperationBudget;
 }): Promise<ProjectSkillSource | null> {
   const projectId = input.context.projectId;
   if (!projectId) {
@@ -125,6 +173,7 @@ async function findProjectSkillSource(input: {
       authToken: input.context.authToken,
       branchId: input.context.branchId,
       path: `${skillsPath}/${input.skillId}/SKILL.md`,
+      ...getBoundedProjectSkillReadOptions(input.budget),
     });
     if (directorySkill?.content) {
       return { kind: "directory", skillsPath };
@@ -135,6 +184,7 @@ async function findProjectSkillSource(input: {
       authToken: input.context.authToken,
       branchId: input.context.branchId,
       path: `${skillsPath}/${input.skillId}.md`,
+      ...getBoundedProjectSkillReadOptions(input.budget),
     });
     if (flatSkill?.content) {
       return { kind: "flat", skillsPath };
@@ -148,6 +198,11 @@ function collectProjectSkillReferences(input: {
   allFiles: readonly RuntimeProjectFileListItem[];
   skillDir: string;
 }): string[] {
+  if (input.allFiles.length > SKILL_SUBDIR_MAX_ENTRIES) {
+    throw new RangeError(
+      `Project skill file listing may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+    );
+  }
   const skillPrefix = `${input.skillDir}/`;
   const refsPrefix = `${skillPrefix}references/`;
   const references = new Set<string>();
@@ -165,6 +220,11 @@ function collectProjectSkillReferences(input: {
     const normalizedReference = normalizeRuntimeSkillReferencePath(relativePath);
     if (normalizedReference) {
       references.add(normalizedReference);
+      if (references.size > SKILL_SUBDIR_MAX_ENTRIES) {
+        throw new RangeError(
+          `Skill references may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+        );
+      }
     }
   }
 
@@ -175,6 +235,7 @@ async function listProjectSkillReferences(input: {
   options: RuntimeProjectSkillLoaderOptions;
   context: RuntimeProjectSkillContext;
   skillId: string;
+  budget: SkillOperationBudget;
   skillsPath?: string;
 }): Promise<string[]> {
   const projectId = input.context.projectId;
@@ -194,6 +255,10 @@ async function listProjectSkillReferences(input: {
     projectId,
     authToken: input.context.authToken,
     branchId: input.context.branchId,
+    maximumEntries: SKILL_SUBDIR_MAX_ENTRIES,
+    pathPrefix: `${skillDir}/references`,
+    abortSignal: input.budget.abortSignal,
+    timeoutMs: getRemainingSkillOperationMs(input.budget),
   });
 
   return collectProjectSkillReferences({
@@ -206,6 +271,7 @@ async function loadProjectSkill(input: {
   options: RuntimeProjectSkillLoaderOptions;
   context: RuntimeProjectSkillContext;
   skillId: string;
+  budget: SkillOperationBudget;
 }): Promise<RuntimeLoadedProjectSkill | null> {
   const projectId = input.context.projectId;
   if (!projectId) {
@@ -220,8 +286,10 @@ async function loadProjectSkill(input: {
         authToken: input.context.authToken,
         branchId: input.context.branchId,
         path: `${catalogSkillDir}/SKILL.md`,
+        ...getBoundedProjectSkillReadOptions(input.budget),
       });
       if (catalogSkill?.content) {
+        assertRuntimeSkillContent(catalogSkill.content, "Skill document");
         return {
           instructions: catalogSkill.content,
           references: await listProjectSkillReferences(input),
@@ -235,9 +303,11 @@ async function loadProjectSkill(input: {
         authToken: input.context.authToken,
         branchId: input.context.branchId,
         path: `${skillsPath}/${input.skillId}/SKILL.md`,
+        ...getBoundedProjectSkillReadOptions(input.budget),
       });
 
       if (directorySkill?.content) {
+        assertRuntimeSkillContent(directorySkill.content, "Skill document");
         return {
           instructions: directorySkill.content,
           references: await listProjectSkillReferences({ ...input, skillsPath }),
@@ -249,9 +319,11 @@ async function loadProjectSkill(input: {
         authToken: input.context.authToken,
         branchId: input.context.branchId,
         path: `${skillsPath}/${input.skillId}.md`,
+        ...getBoundedProjectSkillReadOptions(input.budget),
       });
 
       if (flatSkill?.content) {
+        assertRuntimeSkillContent(flatSkill.content, "Skill document");
         return {
           instructions: flatSkill.content,
           references: [],
@@ -282,6 +354,7 @@ async function loadProjectSkillReference(input: {
   context: RuntimeProjectSkillContext;
   skillId: string;
   normalizedFile: string;
+  budget: SkillOperationBudget;
 }): Promise<string | null> {
   const projectId = input.context.projectId;
   if (!projectId) {
@@ -300,8 +373,10 @@ async function loadProjectSkillReference(input: {
       authToken: input.context.authToken,
       branchId: input.context.branchId,
       path: `${skillDir}/${input.normalizedFile}`,
+      ...getBoundedProjectSkillReadOptions(input.budget),
     });
     if (projectFile?.content) {
+      assertRuntimeSkillContent(projectFile.content, "Skill reference");
       return projectFile.content;
     }
   } catch (error) {
@@ -327,11 +402,31 @@ async function loadProjectSkillReference(input: {
 export function createRuntimeProjectSkillLoader(
   options: RuntimeProjectSkillLoaderOptions,
 ): RuntimeProjectSkillLoader {
+  const withBudget = <T>(
+    operation: RuntimeProjectSkillOperationOptions | undefined,
+    fn: (budget: SkillOperationBudget) => Promise<T>,
+  ): Promise<T> => {
+    const budget = operation?.budget ?? createSkillOperationBudget({
+      timeoutMs: SKILL_FILE_OPERATION_TIMEOUT_MS,
+    });
+    return budget.run(() => fn(budget));
+  };
   return {
-    listProjectSkillReferences: (context, skillId) =>
-      listProjectSkillReferences({ options, context, skillId }),
-    loadProjectSkill: (context, skillId) => loadProjectSkill({ options, context, skillId }),
-    loadProjectSkillReference: (context, skillId, normalizedFile) =>
-      loadProjectSkillReference({ options, context, skillId, normalizedFile }),
+    listProjectSkillReferences: (context, skillId, operation) =>
+      withBudget(
+        operation,
+        (budget) => listProjectSkillReferences({ options, context, skillId, budget }),
+      ),
+    loadProjectSkill: (context, skillId, operation) =>
+      withBudget(
+        operation,
+        (budget) => loadProjectSkill({ options, context, skillId, budget }),
+      ),
+    loadProjectSkillReference: (context, skillId, normalizedFile, operation) =>
+      withBudget(
+        operation,
+        (budget) =>
+          loadProjectSkillReference({ options, context, skillId, normalizedFile, budget }),
+      ),
   };
 }
diff --git a/src/agent/runtime/skill-metadata.ts b/src/agent/runtime/skill-metadata.ts
index 30caf0889e..a29e88f5fa 100644
--- a/src/agent/runtime/skill-metadata.ts
+++ b/src/agent/runtime/skill-metadata.ts
@@ -6,6 +6,12 @@ import {
   resolveSkillSelector,
 } from "#veryfront/skill/selector.ts";
 import { SKILL_NAME_REGEX, SKILL_PROVIDER_SAFE_ID_REGEX } from "#veryfront/skill/types.ts";
+import {
+  SKILL_ALLOWED_TOOL_MAX_PATTERNS,
+  SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH,
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "#veryfront/skill/limits.ts";
 
 function normalizeAllowedTools(value: string | string[] | undefined): string[] {
   if (value === undefined) {
@@ -322,6 +328,16 @@ export function buildRuntimeSkillDefinition(input: {
   sourcePath?: string;
   logger?: RuntimeSkillMetadataLogger;
 }): RuntimeSkillDefinition | null {
+  if (input.content.length > SKILL_DOCUMENT_MAX_CHARACTERS) {
+    throw new RangeError(
+      `Skill document may contain at most ${SKILL_DOCUMENT_MAX_CHARACTERS} characters`,
+    );
+  }
+  if ((input.references?.length ?? 0) > SKILL_SUBDIR_MAX_ENTRIES) {
+    throw new RangeError(
+      `Skill references may contain at most ${SKILL_SUBDIR_MAX_ENTRIES} entries`,
+    );
+  }
   if (!isRuntimeSkillIdValid(input)) {
     input.logger?.error?.("Invalid skill id; skipping skill", {
       id: input.id,
@@ -338,6 +354,18 @@ export function buildRuntimeSkillDefinition(input: {
   }
 
   const { metadata, body } = document;
+  if (metadata.allowedTools.length > SKILL_ALLOWED_TOOL_MAX_PATTERNS) {
+    throw new RangeError(
+      `Skill allowed-tools may contain at most ${SKILL_ALLOWED_TOOL_MAX_PATTERNS} entries`,
+    );
+  }
+  if (
+    metadata.allowedTools.some((pattern) => pattern.length > SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH)
+  ) {
+    throw new RangeError(
+      `Skill allowed-tool patterns may contain at most ${SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH} characters`,
+    );
+  }
   const canonicalName = input.id;
   const explicitDisplayName = metadata.metadata?.display_name?.trim() || undefined;
   const legacyDisplayName = metadata.name && metadata.name !== canonicalName
diff --git a/src/build/asset-pipeline/css-optimizer/optimizer-service.ts b/src/build/asset-pipeline/css-optimizer/optimizer-service.ts
index 7c065116b7..af806a6147 100644
--- a/src/build/asset-pipeline/css-optimizer/optimizer-service.ts
+++ b/src/build/asset-pipeline/css-optimizer/optimizer-service.ts
@@ -254,7 +254,6 @@ export class CSSOptimizerService {
       baseDir: this.baseDir,
       adapter,
       context: "build",
-      throwOnError: true,
       validationOptions: { followSymlinks: false },
     });
     this.optimizationEngine = dependencies.optimizationEngine;
diff --git a/src/build/asset-pipeline/tailwind-processor/detector.test.ts b/src/build/asset-pipeline/tailwind-processor/detector.test.ts
index 2fcc61df28..8fa83eb2fa 100644
--- a/src/build/asset-pipeline/tailwind-processor/detector.test.ts
+++ b/src/build/asset-pipeline/tailwind-processor/detector.test.ts
@@ -1,9 +1,59 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { autoDetectContentPaths } from "./detector.ts";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
+import { autoDetectContentPaths, isTailwindV4File } from "./detector.ts";
+
+function createFileAdapter(): RuntimeAdapter {
+  return {
+    name: "test",
+    fs: {
+      readFile: (path: string) => Deno.readTextFile(path),
+      readTextFile: (path: string) => Deno.readTextFile(path),
+      writeFile: (path: string, content: string) => Deno.writeTextFile(path, content),
+      writeTextFile: (path: string, content: string) => Deno.writeTextFile(path, content),
+      exists: async (path: string) => {
+        try {
+          await Deno.stat(path);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      mkdir: (path: string, options?: { recursive?: boolean }) => Deno.mkdir(path, options),
+      readDir: (path: string) => Deno.readDir(path),
+      stat: (path: string) => Deno.stat(path),
+      lstat: (path: string) => Deno.lstat(path),
+      realPath: (path: string) => Deno.realPath(path),
+      remove: (path: string, options?: { recursive?: boolean }) => Deno.remove(path, options),
+      makeTempDir: (prefix: string) => Deno.makeTempDir({ prefix }),
+      watch: (paths: string | string[], options?: { recursive?: boolean }) =>
+        options?.recursive === undefined
+          ? Deno.watchFs(paths)
+          : Deno.watchFs(paths, { recursive: options.recursive }),
+    },
+  } as unknown as RuntimeAdapter;
+}
 
 describe("build/asset-pipeline/tailwind-processor/detector", () => {
+  it("retains the detector's intentional false result for rejected paths", async () => {
+    const projectDir = await Deno.makeTempDir();
+    try {
+      const outsideFile = `${projectDir}-outside.css`;
+      await Deno.writeTextFile(outsideFile, '@import "tailwindcss";');
+      try {
+        assertEquals(
+          await isTailwindV4File(outsideFile, projectDir, createFileAdapter()),
+          false,
+        );
+      } finally {
+        await Deno.remove(outsideFile);
+      }
+    } finally {
+      await Deno.remove(projectDir, { recursive: true });
+    }
+  });
+
   describe("autoDetectContentPaths", () => {
     it("should return four content path patterns", () => {
       assertEquals(autoDetectContentPaths("/project").length, 4);
diff --git a/src/build/asset-pipeline/tailwind-processor/detector.ts b/src/build/asset-pipeline/tailwind-processor/detector.ts
index ff3871f625..a012445e43 100644
--- a/src/build/asset-pipeline/tailwind-processor/detector.ts
+++ b/src/build/asset-pipeline/tailwind-processor/detector.ts
@@ -23,7 +23,6 @@ export function isTailwindV4File(
         baseDir: projectDir,
         adapter,
         context: "build",
-        throwOnError: false,
       });
 
       try {
diff --git a/src/build/asset-pipeline/tailwind-processor/processor.test.ts b/src/build/asset-pipeline/tailwind-processor/processor.test.ts
index e85d229bcf..339c11311c 100644
--- a/src/build/asset-pipeline/tailwind-processor/processor.test.ts
+++ b/src/build/asset-pipeline/tailwind-processor/processor.test.ts
@@ -24,6 +24,8 @@ function createMockAdapter(_baseDir: string): RuntimeAdapter {
       mkdir: (path: string, opts?: { recursive?: boolean }) => Deno.mkdir(path, opts),
       readDir: (path: string) => Deno.readDir(path),
       stat: (path: string) => Deno.stat(path),
+      lstat: (path: string) => Deno.lstat(path),
+      realPath: (path: string) => Deno.realPath(path),
       remove: (path: string, opts?: { recursive?: boolean }) => Deno.remove(path, opts),
       makeTempDir: (prefix: string) => Deno.makeTempDir({ prefix }),
       watch: (paths: string | string[], options?: { recursive?: boolean }) =>
diff --git a/src/build/asset-pipeline/tailwind-processor/processor.ts b/src/build/asset-pipeline/tailwind-processor/processor.ts
index 52e4b6cf8a..f392ff6a3a 100644
--- a/src/build/asset-pipeline/tailwind-processor/processor.ts
+++ b/src/build/asset-pipeline/tailwind-processor/processor.ts
@@ -39,7 +39,6 @@ export class TailwindProcessor {
           baseDir: projectDir,
           adapter,
           context: "build",
-          throwOnError: true,
         });
 
         logger.info("Processing Tailwind CSS v4...", { inputFile, outputFile });
diff --git a/src/build/production-build/templates.ts b/src/build/production-build/templates.ts
index 5dfaf5ab68..388000c8ad 100644
--- a/src/build/production-build/templates.ts
+++ b/src/build/production-build/templates.ts
@@ -11,7 +11,7 @@ export const CLIENT_STYLES =
   ".error-container {\n  max-width: 600px;\n  margin: 2rem auto;\n  padding: 2rem;\n  background: #fee;\n  border: 1px solid #fcc;\n  border-radius: 8px;\n  color: #c00;\n}";
 
 export const CLIENT_ROUTER_BUNDLE: string | undefined =
-  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n\n// src/rendering/client/browser-stubs/logger.ts\nfunction noop() {\n}\nvar logger = {\n  debug: noop,\n  info: console.log.bind(console),\n  warn: console.warn.bind(console),\n  error: console.error.bind(console),\n  component: () => logger\n};\nvar rendererLogger = logger;\nvar PREFETCH_MAX_SIZE_BYTES = 200 * 1024;\n\n// src/rendering/client/navigation-store.ts\nvar STORE_KEY = /* @__PURE__ */ Symbol.for("veryfront.navigation.store.v1");\nfunction getNavigationStore() {\n  const holder = globalThis;\n  const existing = holder[STORE_KEY];\n  if (existing) return existing;\n  const listeners = /* @__PURE__ */ new Set();\n  let navigator = null;\n  const store = {\n    subscribe(listener) {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    getHref() {\n      const loc = globalThis.location;\n      return loc ? `${loc.pathname}${loc.search}${loc.hash}` : "/";\n    },\n    notify() {\n      for (const listener of [...listeners]) {\n        try {\n          listener();\n        } catch {\n        }\n      }\n    },\n    navigate(href, options) {\n      if (navigator) return navigator(href, options);\n      globalThis.location?.assign(href);\n      return Promise.resolve();\n    },\n    setNavigator(next) {\n      navigator = next;\n    }\n  };\n  holder[STORE_KEY] = store;\n  return store;\n}\n\n// src/rendering/client/router.ts\nimport ReactDOM from "react-dom/client";\n\n// src/html/managed-head-protocol.ts\nvar HEAD_PROVENANCE_ATTRIBUTE = "data-vf-head";\nvar HEAD_LEGACY_MANAGED_ATTRIBUTE = "data-veryfront-managed";\nvar HEAD_CONTENT_HASH_ATTRIBUTE = "data-vf-hash";\nvar HEAD_REACT_MANAGED_ATTRIBUTE = "data-vf-react-head";\nvar HEAD_REACT_OWNER_ATTRIBUTE = "data-vf-react-head-owner";\nvar HEAD_ROUTE_MANAGED_ATTRIBUTE = "data-vf-route-head";\nvar HEAD_SHELL_PROVENANCE_ATTRIBUTE = "data-vf-shell-head";\nvar HEAD_SSR_PAYLOAD_ATTRIBUTE = "data-vf-ssr-head";\nvar MAX_MANAGED_HEAD_ENTRIES = 128;\nvar MAX_MANAGED_HEAD_BYTES = 2 * 1024 * 1024;\nvar REACT_HEAD_ATTRIBUTE_NAMES = {\n  charSet: "charset",\n  className: "class",\n  crossOrigin: "crossorigin",\n  fetchPriority: "fetchpriority",\n  htmlFor: "for",\n  httpEquiv: "http-equiv",\n  imageSizes: "imagesizes",\n  imageSrcSet: "imagesrcset",\n  noModule: "nomodule",\n  referrerPolicy: "referrerpolicy"\n};\nvar SINGLETON_META_KEYS = /* @__PURE__ */ new Set([\n  "description",\n  "robots",\n  "viewport",\n  "referrer",\n  "color-scheme",\n  "application-name",\n  "generator",\n  "og:title",\n  "og:description",\n  "og:url",\n  "og:type",\n  "og:site_name",\n  "og:locale",\n  "twitter:card",\n  "twitter:site",\n  "twitter:creator",\n  "twitter:title",\n  "twitter:description",\n  "twitter:image",\n  "twitter:image:alt"\n]);\nvar SINGLETON_LINK_RELS = /* @__PURE__ */ new Set([\n  "canonical",\n  "manifest",\n  "amphtml"\n]);\nvar SUPPORTED_MANAGED_HEAD_TAGS = /* @__PURE__ */ new Set([\n  "title",\n  "meta",\n  "link",\n  "style",\n  "script"\n]);\nvar HEAD_ATTRIBUTE_NAME_PATTERN = /^[A-Za-z_:][A-Za-z0-9_.:-]*$/;\nvar MAX_HEAD_PROP_ENTRIES = 128;\nvar MAX_HEAD_ATTRIBUTE_NAME_BYTES = 256;\nvar MAX_HEAD_ATTRIBUTE_VALUE_BYTES = 64 * 1024;\nvar MAX_HEAD_ATTRIBUTE_BYTES = 1024 * 1024;\nvar MAX_HEAD_CONTENT_BYTES = 1024 * 1024;\nvar headTextEncoder = new TextEncoder();\nvar BOOLEAN_HEAD_ATTRIBUTES = /* @__PURE__ */ new Set([\n  "async",\n  "defer",\n  "disabled",\n  "itemscope",\n  "nomodule"\n]);\nfunction isHeadFrameworkAttribute(name) {\n  switch (name.toLowerCase()) {\n    case HEAD_PROVENANCE_ATTRIBUTE:\n    case HEAD_LEGACY_MANAGED_ATTRIBUTE:\n    case HEAD_CONTENT_HASH_ATTRIBUTE:\n    case HEAD_REACT_MANAGED_ATTRIBUTE:\n    case HEAD_REACT_OWNER_ATTRIBUTE:\n    case HEAD_ROUTE_MANAGED_ATTRIBUTE:\n    case HEAD_SHELL_PROVENANCE_ATTRIBUTE:\n    case HEAD_SSR_PAYLOAD_ATTRIBUTE:\n      return true;\n    default:\n      return false;\n  }\n}\nfunction normalizeHeadIdentityValue(value) {\n  const normalized = value?.trim().toLowerCase();\n  return normalized || void 0;\n}\nfunction readOwnString(record, key) {\n  try {\n    const descriptor = Reflect.getOwnPropertyDescriptor(record, key);\n    return descriptor && !descriptor.get && !descriptor.set && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : void 0;\n  } catch {\n    return void 0;\n  }\n}\nfunction headMetaSingletonKeyFromRecord(meta) {\n  if (readOwnString(meta, "charset") !== void 0) return "meta:charset";\n  const key = normalizeHeadIdentityValue(\n    readOwnString(meta, "property") ?? readOwnString(meta, "name")\n  );\n  if (!key) return void 0;\n  if (key === "theme-color") {\n    return `meta:theme-color:${readOwnString(meta, "media")?.trim() ?? ""}`;\n  }\n  return SINGLETON_META_KEYS.has(key) ? `meta:${key}` : void 0;\n}\nfunction headLinkSingletonKeyFromRecord(link) {\n  const rel = normalizeHeadIdentityValue(readOwnString(link, "rel"));\n  return rel && SINGLETON_LINK_RELS.has(rel) ? `link:${rel}` : void 0;\n}\nfunction normalizeManagedHeadString(value) {\n  return value.replace(/\\r\\n?/g, "\\n");\n}\nfunction inspectHeadProps(value) {\n  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;\n  let prototype;\n  let keys;\n  try {\n    prototype = Object.getPrototypeOf(value);\n    keys = Reflect.ownKeys(value);\n  } catch {\n    return null;\n  }\n  if (prototype !== Object.prototype && prototype !== null) return null;\n  const inspected = /* @__PURE__ */ new Map();\n  let entries = 0;\n  for (const key of keys) {\n    let descriptor;\n    try {\n      descriptor = Reflect.getOwnPropertyDescriptor(value, key);\n    } catch {\n      return null;\n    }\n    if (!descriptor) return null;\n    if (!descriptor.enumerable) continue;\n    if (typeof key !== "string" || descriptor.get || descriptor.set || !("value" in descriptor)) {\n      return null;\n    }\n    entries++;\n    if (entries > MAX_HEAD_PROP_ENTRIES) return null;\n    inspected.set(key, descriptor.value);\n  }\n  return inspected;\n}\nfunction normalizeContentPrimitive(value) {\n  if (value === null || value === void 0 || typeof value === "boolean") return void 0;\n  if (typeof value !== "string" && typeof value !== "number" && typeof value !== "bigint") {\n    return null;\n  }\n  const content = normalizeManagedHeadString(String(value));\n  return headTextEncoder.encode(content).byteLength <= MAX_HEAD_CONTENT_BYTES ? content : null;\n}\nfunction normalizeManagedHeadAttributesFromProps(tagName, props, ambientNonce, excludedKeys = /* @__PURE__ */ new Set()) {\n  const attributeMap = /* @__PURE__ */ new Map();\n  for (const [key, value] of props) {\n    if (key === "children" || key === "dangerouslySetInnerHTML" || excludedKeys.has(key)) {\n      continue;\n    }\n    if (/^on/i.test(key) || typeof value === "function" || typeof value === "symbol" || typeof value === "object") {\n      continue;\n    }\n    const name = (REACT_HEAD_ATTRIBUTE_NAMES[key] ?? key).toLowerCase();\n    if (isHeadFrameworkAttribute(name) || !HEAD_ATTRIBUTE_NAME_PATTERN.test(name) || headTextEncoder.encode(name).byteLength > MAX_HEAD_ATTRIBUTE_NAME_BYTES) {\n      continue;\n    }\n    if (BOOLEAN_HEAD_ATTRIBUTES.has(name)) {\n      if (value !== false && value !== void 0) attributeMap.set(name, "");\n      continue;\n    }\n    if (typeof value === "boolean") {\n      if (name.startsWith("data-") || name.startsWith("aria-")) {\n        attributeMap.set(name, String(value));\n      }\n      continue;\n    }\n    if (value === void 0) continue;\n    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "bigint") {\n      continue;\n    }\n    const normalizedValue = normalizeManagedHeadString(String(value));\n    if (headTextEncoder.encode(normalizedValue).byteLength > MAX_HEAD_ATTRIBUTE_VALUE_BYTES) {\n      return null;\n    }\n    attributeMap.set(name, normalizedValue);\n  }\n  if ((tagName === "script" || tagName === "style") && ambientNonce) {\n    const nonce = normalizeManagedHeadString(ambientNonce);\n    if (headTextEncoder.encode(nonce).byteLength > MAX_HEAD_ATTRIBUTE_VALUE_BYTES) return null;\n    attributeMap.set("nonce", nonce);\n  }\n  if (tagName === "link" && attributeMap.get("rel")?.trim().toLowerCase() === "preload" && attributeMap.get("as")?.trim().toLowerCase() === "font" && !attributeMap.has("crossorigin")) {\n    attributeMap.set("crossorigin", "anonymous");\n  }\n  if (attributeMap.size > MAX_HEAD_PROP_ENTRIES) return null;\n  let totalBytes = 0;\n  for (const [name, value] of attributeMap) {\n    totalBytes += headTextEncoder.encode(name).byteLength + headTextEncoder.encode(value).byteLength;\n    if (totalBytes > MAX_HEAD_ATTRIBUTE_BYTES) return null;\n  }\n  return [...attributeMap.entries()].sort(([left], [right]) => left.localeCompare(right));\n}\nfunction singletonKey(tagName, attributes) {\n  if (tagName === "title") return "title";\n  const record = Object.fromEntries(attributes);\n  if (tagName === "meta") return headMetaSingletonKeyFromRecord(record);\n  if (tagName === "link") return headLinkSingletonKeyFromRecord(record);\n  return void 0;\n}\nfunction scriptKeys(tagName, attributes) {\n  if (tagName !== "script") return [];\n  const keys = [];\n  const id = attributes.get("id");\n  const src = attributes.get("src");\n  if (id) keys.push(`script:id:${id}`);\n  if (src) keys.push(`script:src:${src}`);\n  return keys;\n}\nfunction declaresDocumentEncoding(attributes) {\n  return attributes.has("charset") || attributes.get("http-equiv")?.trim().toLowerCase() === "content-type";\n}\nfunction createManagedHeadDescriptor(tagName, attributes, content, contentMode) {\n  const attributeMap = new Map(attributes);\n  return {\n    tagName,\n    attributes,\n    ...content !== void 0 && { content },\n    contentMode,\n    signature: JSON.stringify([\n      tagName,\n      attributes,\n      contentMode,\n      content ?? null\n    ]),\n    singletonKey: singletonKey(tagName, attributeMap),\n    scriptKeys: scriptKeys(tagName, attributeMap)\n  };\n}\nfunction descriptorFromManagedHeadRecord(rawTagName, record, options = {}) {\n  const tagName = rawTagName.toLowerCase();\n  if (!SUPPORTED_MANAGED_HEAD_TAGS.has(tagName)) return null;\n  const inspected = inspectHeadProps(record);\n  if (!inspected) return null;\n  const excludedKeys = options.contentProperty ? /* @__PURE__ */ new Set([options.contentProperty]) : /* @__PURE__ */ new Set();\n  const attributes = normalizeManagedHeadAttributesFromProps(\n    tagName,\n    inspected,\n    options.ambientNonce,\n    excludedKeys\n  );\n  if (!attributes) return null;\n  const attributeMap = new Map(attributes);\n  if (tagName === "meta" && declaresDocumentEncoding(attributeMap)) return null;\n  if ((tagName === "meta" || tagName === "link") && attributes.length === 0) return null;\n  let content;\n  if (options.contentProperty) {\n    const normalized = normalizeContentPrimitive(inspected.get(options.contentProperty));\n    if (normalized === null) return null;\n    content = normalized;\n  }\n  return createManagedHeadDescriptor(tagName, attributes, content, "text");\n}\nfunction headScriptKeysIntersect(left, right) {\n  if (left.length === 0 || right.length === 0) return false;\n  const rightKeys = new Set(right);\n  return left.some((key) => rightKeys.has(key));\n}\nfunction aggregateManagedHeadDescriptors(descriptors) {\n  const aggregated = [];\n  const singletonIndexes = /* @__PURE__ */ new Map();\n  const scriptKeysSeen = /* @__PURE__ */ new Set();\n  for (const descriptor of descriptors) {\n    if (descriptor.singletonKey) {\n      const index = singletonIndexes.get(descriptor.singletonKey);\n      if (index !== void 0) {\n        aggregated[index] = descriptor;\n        continue;\n      }\n      singletonIndexes.set(descriptor.singletonKey, aggregated.length);\n    } else if (descriptor.scriptKeys.length > 0) {\n      if (descriptor.scriptKeys.some((key) => scriptKeysSeen.has(key))) continue;\n      for (const key of descriptor.scriptKeys) scriptKeysSeen.add(key);\n    }\n    aggregated.push(descriptor);\n  }\n  return aggregated;\n}\nfunction managedHeadDescriptorBytes(descriptor) {\n  let bytes = headTextEncoder.encode(descriptor.tagName).byteLength;\n  for (const [name, value] of descriptor.attributes) {\n    bytes += headTextEncoder.encode(name).byteLength;\n    bytes += headTextEncoder.encode(value).byteLength;\n  }\n  if (descriptor.content !== void 0) {\n    bytes += headTextEncoder.encode(descriptor.content).byteLength;\n  }\n  return bytes;\n}\nfunction assertManagedHeadDescriptorBudget(descriptors) {\n  if (descriptors.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError(\n      `Managed head exceeds the ${MAX_MANAGED_HEAD_ENTRIES}-entry request limit`\n    );\n  }\n  let bytes = 0;\n  for (const descriptor of descriptors) {\n    bytes += managedHeadDescriptorBytes(descriptor);\n    if (bytes > MAX_MANAGED_HEAD_BYTES) {\n      throw new TypeError(\n        `Managed head exceeds the ${MAX_MANAGED_HEAD_BYTES}-byte request limit`\n      );\n    }\n  }\n}\nfunction managedHeadDescriptorToTransportEntry(descriptor) {\n  const attributes = descriptor.attributes.filter(([name]) => name !== "nonce");\n  return {\n    tagName: descriptor.tagName,\n    attributes: attributes.map(([name, value]) => [name, value]),\n    ...descriptor.content !== void 0 && { content: descriptor.content }\n  };\n}\nfunction ownTransportValue(record, key) {\n  let descriptor;\n  try {\n    descriptor = Reflect.getOwnPropertyDescriptor(record, key);\n  } catch {\n    return void 0;\n  }\n  if (!descriptor || descriptor.get || descriptor.set || !("value" in descriptor)) {\n    return void 0;\n  }\n  return descriptor.value;\n}\nfunction descriptorFromManagedHeadTransportEntry(entry, ambientNonce) {\n  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {\n    throw new TypeError("Managed-head transport entries must be plain objects");\n  }\n  let prototype;\n  try {\n    prototype = Object.getPrototypeOf(entry);\n  } catch {\n    throw new TypeError("Managed-head transport entry cannot be inspected");\n  }\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError("Managed-head transport entries must be plain objects");\n  }\n  const tagName = ownTransportValue(entry, "tagName");\n  const rawAttributes = ownTransportValue(entry, "attributes");\n  const content = ownTransportValue(entry, "content");\n  if (typeof tagName !== "string" || tagName !== tagName.toLowerCase() || !Array.isArray(rawAttributes)) {\n    throw new TypeError("Managed-head transport entry is not canonical");\n  }\n  if (rawAttributes.length > MAX_HEAD_PROP_ENTRIES) {\n    throw new TypeError("Managed-head transport entry exceeds the attribute limit");\n  }\n  if (content !== void 0 && typeof content !== "string") {\n    throw new TypeError("Managed-head transport content must be a string");\n  }\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (!supportsText && content !== void 0) {\n    throw new TypeError("Managed-head transport content is invalid for this tag");\n  }\n  const record = /* @__PURE__ */ Object.create(null);\n  const inputAttributes = [];\n  const names = /* @__PURE__ */ new Set();\n  for (let index = 0; index < rawAttributes.length; index += 1) {\n    const pair = ownTransportValue(rawAttributes, String(index));\n    if (!Array.isArray(pair) || pair.length !== 2) {\n      throw new TypeError("Managed-head transport attributes must be string pairs");\n    }\n    const name = ownTransportValue(pair, "0");\n    const value = ownTransportValue(pair, "1");\n    if (typeof name !== "string" || typeof value !== "string") {\n      throw new TypeError("Managed-head transport attributes must be string pairs");\n    }\n    const normalizedName = name.toLowerCase();\n    if (name !== normalizedName || normalizedName === "nonce" || names.has(normalizedName)) {\n      throw new TypeError("Managed-head transport attributes are not canonical");\n    }\n    names.add(normalizedName);\n    inputAttributes.push([normalizedName, value]);\n    Object.defineProperty(record, normalizedName, {\n      enumerable: true,\n      value\n    });\n  }\n  if (content !== void 0) {\n    Object.defineProperty(record, "__veryfront_transport_content", {\n      enumerable: true,\n      value: content\n    });\n  }\n  const descriptor = descriptorFromManagedHeadRecord(tagName, record, {\n    ...supportsText && { contentProperty: "__veryfront_transport_content" },\n    ...(tagName === "script" || tagName === "style") && ambientNonce ? { ambientNonce } : {}\n  });\n  const normalizedInput = inputAttributes.sort(([left], [right]) => left.localeCompare(right));\n  const normalizedOutput = descriptor?.attributes.filter(([name]) => name !== "nonce");\n  if (!descriptor || JSON.stringify(normalizedOutput) !== JSON.stringify(normalizedInput) || supportsText && (descriptor.content ?? "") !== (content ?? "")) {\n    throw new TypeError("Managed-head transport entry failed validation");\n  }\n  return descriptor;\n}\nvar BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";\nfunction decodeBase64Url(value) {\n  if (value.length % 4 === 1 || !/^[A-Za-z0-9_-]*$/.test(value)) {\n    throw new TypeError("Managed-head payload is not valid base64url");\n  }\n  const estimatedBytes = Math.floor(value.length * 3 / 4);\n  if (estimatedBytes > MAX_MANAGED_HEAD_BYTES * 2) {\n    throw new TypeError("Managed-head payload exceeds its encoded size limit");\n  }\n  const bytes = new Uint8Array(estimatedBytes);\n  let outputIndex = 0;\n  let buffer = 0;\n  let bits = 0;\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n    if (decoded < 0) throw new TypeError("Managed-head payload is not valid base64url");\n    buffer = buffer << 6 | decoded;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes[outputIndex++] = buffer >> bits & 255;\n      buffer &= bits === 0 ? 0 : (1 << bits) - 1;\n    }\n  }\n  if (bits > 0 && buffer !== 0) {\n    throw new TypeError("Managed-head payload has non-canonical trailing bits");\n  }\n  return bytes.subarray(0, outputIndex);\n}\nfunction deserializeManagedHeadPayload(payload, ambientNonce) {\n  if (typeof payload !== "string") throw new TypeError("Managed-head payload must be a string");\n  let decoded;\n  try {\n    decoded = new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(payload));\n  } catch (error) {\n    if (error instanceof TypeError) throw error;\n    throw new TypeError("Managed-head payload is not valid UTF-8", { cause: error });\n  }\n  let entries;\n  try {\n    entries = JSON.parse(decoded);\n  } catch (error) {\n    throw new TypeError("Managed-head payload is not valid JSON", { cause: error });\n  }\n  if (!Array.isArray(entries) || entries.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError("Managed-head payload exceeds the entry limit");\n  }\n  const descriptors = aggregateManagedHeadDescriptors(\n    entries.map((entry) => descriptorFromManagedHeadTransportEntry(entry, ambientNonce))\n  );\n  assertManagedHeadDescriptorBudget(descriptors);\n  return descriptors;\n}\n\n// src/html/client-head-manager.ts\nvar HEAD_MANAGER_STATE_SYMBOL = /* @__PURE__ */ Symbol.for(\n  "veryfront.client-head-manager.v2"\n);\nvar CROSS_PAGE_PRESERVED_SINGLETON_KEYS = /* @__PURE__ */ new Set([\n  "meta:viewport",\n  "link:manifest"\n]);\nfunction getClientHeadManagerState() {\n  const globalState = globalThis;\n  return globalState[HEAD_MANAGER_STATE_SYMBOL] ?? (globalState[HEAD_MANAGER_STATE_SYMBOL] = {\n    documents: /* @__PURE__ */ new WeakMap()\n  });\n}\nfunction getManagedHeadNonce(targetDocument) {\n  if (typeof targetDocument.querySelector !== "function") return void 0;\n  const element = targetDocument.querySelector(\n    "script[nonce], style[nonce], link[nonce]"\n  );\n  if (!element) return void 0;\n  const nonce = element.nonce || element.getAttribute("nonce") || "";\n  return nonce || void 0;\n}\nfunction readElementAttributes(element) {\n  const attributes = [];\n  for (const attribute of element.attributes) {\n    const name = attribute.name.toLowerCase();\n    if (isHeadFrameworkAttribute(name)) continue;\n    const nonce = name === "nonce" && "nonce" in element ? element.nonce : "";\n    const value = BOOLEAN_HEAD_ATTRIBUTES.has(name) ? "" : nonce || attribute.value;\n    attributes.push([name, value]);\n  }\n  return attributes.sort(([left], [right]) => left.localeCompare(right));\n}\nfunction elementSingletonKey(element) {\n  const tagName = element.tagName.toLowerCase();\n  if (tagName === "title") return "title";\n  const attributes = Object.fromEntries(readElementAttributes(element));\n  if (tagName === "meta") return headMetaSingletonKeyFromRecord(attributes);\n  if (tagName === "link") return headLinkSingletonKeyFromRecord(attributes);\n  return void 0;\n}\nfunction promoteToShellHeadBaseline(element) {\n  for (const attribute of [...element.attributes]) {\n    if (isHeadFrameworkAttribute(attribute.name)) {\n      element.removeAttribute(attribute.name);\n    }\n  }\n  element.setAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE, "true");\n}\nfunction isCrossPagePreservedSingleton(element, singletonKey2 = elementSingletonKey(element)) {\n  return element.parentElement !== null && singletonKey2 !== void 0 && CROSS_PAGE_PRESERVED_SINGLETON_KEYS.has(singletonKey2);\n}\nfunction isFrameworkOwnedHeadElement(element) {\n  return element.getAttribute(HEAD_PROVENANCE_ATTRIBUTE) === "true" || element.getAttribute(HEAD_REACT_MANAGED_ATTRIBUTE) === "true" || element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1" || element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true" || element.getAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE) === "true";\n}\nfunction retireFrameworkHeadElement(element) {\n  if (isCrossPagePreservedSingleton(element)) {\n    promoteToShellHeadBaseline(element);\n    return;\n  }\n  element.remove();\n}\nfunction retireClientHeadOwnership(targetDocument) {\n  const manager = getClientHeadManagerState().documents.get(targetDocument);\n  if (manager) {\n    manager.retire();\n    return;\n  }\n  for (const element of [...targetDocument.head?.children ?? []]) {\n    if (isFrameworkOwnedHeadElement(element)) retireFrameworkHeadElement(element);\n  }\n}\n\n// src/html/client-route-head.ts\nvar ROUTE_HEAD_CONTENT_PROPERTY = "__veryfront_route_head_content";\nfunction descriptorFromHeadElement(element) {\n  const record = /* @__PURE__ */ Object.create(null);\n  for (const { name, value } of element.attributes) {\n    if (!isHeadFrameworkAttribute(name)) record[name] = value;\n  }\n  const tagName = element.tagName.toLowerCase();\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (supportsText) record[ROUTE_HEAD_CONTENT_PROPERTY] = element.textContent ?? "";\n  return descriptorFromManagedHeadRecord(\n    tagName,\n    record,\n    supportsText ? { contentProperty: ROUTE_HEAD_CONTENT_PROPERTY } : void 0\n  );\n}\nfunction writeRouteDescriptor(element, descriptor) {\n  for (const attribute of [...element.attributes]) element.removeAttribute(attribute.name);\n  for (const [name, value] of descriptor.attributes) element.setAttribute(name, value);\n  element.textContent = descriptor.content ?? "";\n  element.setAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE, "1");\n  element.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n}\nfunction prepareClientRouteHeadEntries(entries, targetDocument = document) {\n  if (entries === void 0) return [];\n  if (!Array.isArray(entries) || entries.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError("Route head payload exceeds the entry limit");\n  }\n  const descriptors = aggregateManagedHeadDescriptors(\n    entries.map(\n      (entry) => descriptorFromManagedHeadTransportEntry(entry, getManagedHeadNonce(targetDocument))\n    )\n  );\n  assertManagedHeadDescriptorBudget(descriptors);\n  return descriptors;\n}\nfunction applyPreparedClientRouteHeadDescriptors(descriptors, targetDocument = document) {\n  for (const descriptor of descriptors) {\n    const described = [...targetDocument.head.children].flatMap((element2) => {\n      const current = descriptorFromHeadElement(element2);\n      return current ? [{ element: element2, descriptor: current }] : [];\n    });\n    if (descriptor.singletonKey) {\n      const matches = described.filter(\n        ({ descriptor: current }) => current.singletonKey === descriptor.singletonKey\n      );\n      const directive = matches.find(\n        ({ element: element2 }) => element2.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1"\n      );\n      if (directive) {\n        continue;\n      }\n      const reusable = matches.find(\n        ({ element: element2 }) => element2.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true" || element2.getAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE) === "true"\n      );\n      if (reusable) {\n        writeRouteDescriptor(reusable.element, descriptor);\n        continue;\n      }\n    }\n    if (described.some(\n      ({ descriptor: current }) => current.signature === descriptor.signature || headScriptKeysIntersect(current.scriptKeys, descriptor.scriptKeys)\n    )) {\n      continue;\n    }\n    const element = targetDocument.createElement(descriptor.tagName);\n    writeRouteDescriptor(element, descriptor);\n    targetDocument.head.appendChild(element);\n  }\n}\nfunction updateRouteTitle(title, targetDocument = document) {\n  if (typeof title !== "string" || !title) return;\n  const titles = [...targetDocument.head.querySelectorAll("title")];\n  if (titles.some((element) => element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1")) {\n    return;\n  }\n  let titleElement = titles.find(\n    (element) => element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true"\n  );\n  for (const element of titles) {\n    if (element !== titleElement) element.remove();\n  }\n  if (!titleElement) {\n    titleElement = targetDocument.createElement("title");\n    titleElement.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(titleElement);\n  }\n  titleElement.textContent = title;\n}\nfunction updateRouteMetaTag(targetDocument, selector, attributeName, attributeValue, content) {\n  const matches = [...targetDocument.head.querySelectorAll(selector)];\n  if (matches.some((element) => element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1")) {\n    return;\n  }\n  let metaTag = matches.find(\n    (element) => element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true"\n  );\n  if (!metaTag) {\n    metaTag = targetDocument.createElement("meta");\n    metaTag.setAttribute(attributeName, attributeValue);\n    metaTag.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(metaTag);\n  }\n  metaTag.setAttribute("content", content);\n}\nfunction updateRouteMetaTags(metadata, targetDocument = document) {\n  if (typeof metadata.description === "string" && metadata.description) {\n    updateRouteMetaTag(\n      targetDocument,\n      \'meta[name="description"]\',\n      "name",\n      "description",\n      metadata.description\n    );\n  }\n  if (typeof metadata.ogTitle === "string" && metadata.ogTitle) {\n    updateRouteMetaTag(\n      targetDocument,\n      \'meta[property="og:title"]\',\n      "property",\n      "og:title",\n      metadata.ogTitle\n    );\n  }\n}\n\n// src/routing/client/dom-utils.ts\nvar logger2 = rendererLogger.component("veryfront");\nvar PARSED_ROUTE_HEAD_CONTENT_PROPERTY = "__veryfront_parsed_route_head_content";\nfunction isInternalLink(target) {\n  const href = target.getAttribute("href");\n  if (!href) return false;\n  if (href.startsWith("http") || href.startsWith("mailto:") || href.startsWith("#")) return false;\n  const linkTarget = target.getAttribute("target");\n  if (linkTarget === "_blank" || target.hasAttribute("download")) return false;\n  return true;\n}\nfunction findAnchorElement(element) {\n  let current = element;\n  while (current && current.tagName !== "A") {\n    current = current.parentElement;\n  }\n  return current instanceof HTMLAnchorElement ? current : null;\n}\nfunction applyHeadDirectives(container) {\n  const targetDocument = container.ownerDocument ?? document;\n  const nodes = [...container.querySelectorAll(\'[data-veryfront-head="1"], vf-head\')].filter(\n    (node) => typeof node.getAttribute !== "function" || node.getAttribute(HEAD_REACT_OWNER_ATTRIBUTE) !== "1"\n  );\n  if (!nodes.length) return;\n  retireClientHeadOwnership(targetDocument);\n  cleanManagedHeadTags(targetDocument);\n  for (const wrapper of nodes) {\n    const TemplateElement = targetDocument.defaultView?.HTMLTemplateElement ?? globalThis.HTMLTemplateElement;\n    const contentSource = TemplateElement && wrapper instanceof TemplateElement ? wrapper.content : wrapper;\n    processHeadWrapper(contentSource, targetDocument);\n    wrapper.parentElement?.removeChild(wrapper);\n  }\n}\nfunction cleanManagedHeadTags(targetDocument) {\n  for (const element of targetDocument.head.querySelectorAll(\n    `[${HEAD_LEGACY_MANAGED_ATTRIBUTE}="1"]`\n  )) {\n    element.parentElement?.removeChild(element);\n  }\n}\nfunction processHeadWrapper(wrapper, targetDocument) {\n  const ElementConstructor = targetDocument.defaultView?.Element ?? globalThis.Element;\n  const activeNonce = getManagedHeadNonce(targetDocument);\n  for (const node of wrapper.childNodes) {\n    if (!ElementConstructor || !(node instanceof ElementConstructor)) continue;\n    const tagName = node.tagName.toLowerCase();\n    if (headSingletonKey(node) === "meta:charset") continue;\n    const clone = targetDocument.createElement(tagName);\n    for (const { name, value } of node.attributes) {\n      if (name.toLowerCase() !== "nonce") clone.setAttribute(name, value);\n    }\n    if (activeNonce && (tagName === "script" || tagName === "style" || tagName === "link")) {\n      clone.setAttribute("nonce", activeNonce);\n    }\n    if (node.textContent && !clone.hasAttribute("src")) {\n      clone.textContent = node.textContent;\n    }\n    replaceExistingHeadSingleton(targetDocument, clone);\n    clone.setAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE, "1");\n    clone.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(clone);\n  }\n}\nfunction headSingletonKey(element) {\n  const tagName = element.tagName.toLowerCase();\n  if (tagName === "title") return "title";\n  if (tagName !== "meta" && tagName !== "link") return void 0;\n  const attributes = /* @__PURE__ */ Object.create(null);\n  if (!element.attributes) return void 0;\n  for (const { name, value } of element.attributes) attributes[name.toLowerCase()] = value;\n  if (tagName === "meta" && attributes["http-equiv"]?.trim().toLowerCase() === "content-type") {\n    return "meta:charset";\n  }\n  return tagName === "meta" ? headMetaSingletonKeyFromRecord(attributes) : headLinkSingletonKeyFromRecord(attributes);\n}\nfunction replaceExistingHeadSingleton(targetDocument, replacement) {\n  const singletonKey2 = headSingletonKey(replacement);\n  if (!singletonKey2 || singletonKey2 === "meta:charset") return;\n  for (const existing of [...targetDocument.head?.children ?? []]) {\n    if (headSingletonKey(existing) === singletonKey2) existing.remove();\n  }\n}\nfunction manageFocus(container) {\n  try {\n    const focusElement = container.querySelector("[data-router-focus]") || container.querySelector("main") || container.querySelector("h1");\n    focusElement?.focus?.({ preventScroll: true });\n  } catch (error) {\n    logger2.warn("focus management failed", error);\n  }\n}\nfunction extractPageDataFromScript() {\n  const pageDataScript = document.querySelector("script[data-veryfront-page]");\n  if (!pageDataScript) return null;\n  try {\n    const content = pageDataScript.textContent;\n    if (!content) {\n      logger2.warn("Page data script has no content");\n      return {};\n    }\n    return JSON.parse(content);\n  } catch (error) {\n    logger2.error("Failed to parse page data:", error);\n    return null;\n  }\n}\nfunction descriptorFromDocumentHeadElement(element) {\n  const tagName = element.tagName.toLowerCase();\n  const record = /* @__PURE__ */ Object.create(null);\n  for (const { name, value } of element.attributes) {\n    if (!isHeadFrameworkAttribute(name) && name.toLowerCase() !== "nonce") {\n      record[name.toLowerCase()] = value;\n    }\n  }\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (supportsText) record[PARSED_ROUTE_HEAD_CONTENT_PROPERTY] = element.textContent ?? "";\n  return descriptorFromManagedHeadRecord(tagName, record, {\n    ...supportsText && { contentProperty: PARSED_ROUTE_HEAD_CONTENT_PROPERTY }\n  });\n}\nfunction payloadDescriptors(root) {\n  if (!root || typeof root.querySelectorAll !== "function") return [];\n  const descriptors = [];\n  for (const element of root.querySelectorAll(`[${HEAD_SSR_PAYLOAD_ATTRIBUTE}]`)) {\n    if (element.getAttribute(HEAD_REACT_OWNER_ATTRIBUTE) !== "1") continue;\n    const payload = element.getAttribute(HEAD_SSR_PAYLOAD_ATTRIBUTE);\n    if (payload) descriptors.push(...deserializeManagedHeadPayload(payload));\n  }\n  return descriptors;\n}\nfunction snapshotClientRouteHead(targetDocument = document) {\n  const descriptors = [];\n  let hasStructuredPayload = false;\n  const hydrationDataScript = targetDocument.getElementById("veryfront-hydration-data");\n  if (hydrationDataScript?.textContent) {\n    try {\n      const hydrationData = JSON.parse(hydrationDataScript.textContent);\n      if (typeof hydrationData.managedHeadPayload === "string") {\n        descriptors.push(...deserializeManagedHeadPayload(hydrationData.managedHeadPayload));\n        hasStructuredPayload = true;\n      }\n    } catch {\n    }\n  }\n  const committedDescriptors = payloadDescriptors(targetDocument.getElementById("root"));\n  descriptors.push(...committedDescriptors);\n  const fallbackSelector = [\n    ...committedDescriptors.length === 0 ? [`[${HEAD_PROVENANCE_ATTRIBUTE}="true"]`] : [],\n    ...!hasStructuredPayload ? [`[${HEAD_SHELL_PROVENANCE_ATTRIBUTE}="true"]`] : []\n  ].join(", ");\n  if (fallbackSelector && targetDocument.head?.querySelectorAll) {\n    for (const element of targetDocument.head.querySelectorAll(fallbackSelector)) {\n      const descriptor = descriptorFromDocumentHeadElement(element);\n      if (descriptor) descriptors.push(descriptor);\n    }\n  }\n  const aggregated = aggregateManagedHeadDescriptors(descriptors);\n  assertManagedHeadDescriptorBudget(aggregated);\n  return aggregated.map(managedHeadDescriptorToTransportEntry);\n}\nfunction parsePageDataFromHTML(html) {\n  const doc = new DOMParser().parseFromString(html, "text/html");\n  const root = doc.getElementById("root");\n  if (!root) logger2.warn("[Veryfront] No root element found in HTML");\n  const content = root?.innerHTML ?? "";\n  const pageDataScript = doc.querySelector("script[data-veryfront-page]");\n  let pageData = {};\n  if (pageDataScript) {\n    try {\n      const scriptContent = pageDataScript.textContent;\n      if (!scriptContent) {\n        logger2.warn("Page data script in HTML has no content");\n      } else {\n        pageData = JSON.parse(scriptContent);\n      }\n    } catch (error) {\n      logger2.error("Failed to parse page data from HTML:", error);\n    }\n  }\n  let dependencyPinningCacheKey;\n  const hydrationDataScript = doc.getElementById("veryfront-hydration-data");\n  if (hydrationDataScript?.textContent) {\n    try {\n      const hydrationData = JSON.parse(hydrationDataScript.textContent);\n      if (typeof hydrationData.dependencyPinningCacheKey === "string") {\n        dependencyPinningCacheKey = hydrationData.dependencyPinningCacheKey;\n      }\n    } catch (error) {\n      logger2.error("Failed to parse hydration data from HTML:", error);\n    }\n  }\n  const managedHead = snapshotClientRouteHead(doc);\n  if (managedHead.some((entry) => entry.tagName === "script") || typeof root?.querySelector === "function" && root.querySelector("script")) {\n    pageData = { ...pageData, requiresFullDocumentNavigation: true };\n  }\n  return { content, pageData, managedHead, dependencyPinningCacheKey };\n}\n\n// src/rendering/client/browser-stubs/config.ts\nvar DEFAULT_PREFETCH_DELAY_MS = 100;\nvar PAGE_TRANSITION_DELAY_MS = 150;\n\n// src/routing/client/navigation-handlers.ts\nvar logger3 = rendererLogger.component("veryfront");\nvar MAX_SCROLL_POSITIONS = 100;\nvar NavigationHandlers = class {\n  constructor(prefetchDelay = DEFAULT_PREFETCH_DELAY_MS, prefetchOptions = {}) {\n    __publicField(this, "prefetchQueue", /* @__PURE__ */ new Set());\n    __publicField(this, "pendingTimeouts", /* @__PURE__ */ new Map());\n    __publicField(this, "scrollPositions", /* @__PURE__ */ new Map());\n    __publicField(this, "isPopStateNav", false);\n    __publicField(this, "prefetchDelay");\n    __publicField(this, "prefetchOptions");\n    this.prefetchDelay = prefetchDelay;\n    this.prefetchOptions = prefetchOptions;\n  }\n  createClickHandler(callbacks) {\n    return (event) => {\n      if (!(event.target instanceof HTMLElement)) return;\n      const anchor = findAnchorElement(event.target);\n      if (!anchor || !isInternalLink(anchor)) return;\n      const href = anchor.getAttribute("href");\n      if (!href) return;\n      event.preventDefault();\n      callbacks.onNavigate(href);\n    };\n  }\n  createPopStateHandler(callbacks) {\n    return (_event) => {\n      this.isPopStateNav = true;\n      const { pathname, search, hash } = globalThis.location;\n      callbacks.onNavigate(`${pathname}${search}${hash}`);\n    };\n  }\n  createMouseOverHandler(callbacks) {\n    return (event) => {\n      if (!(event.target instanceof HTMLElement)) return;\n      if (event.target.tagName !== "A") return;\n      const href = event.target.getAttribute("href");\n      if (!href || href.startsWith("http") || href.startsWith("#")) return;\n      if (!this.shouldPrefetchOnHover(event.target)) return;\n      if (this.prefetchQueue.has(href)) return;\n      this.prefetchQueue.add(href);\n      const timeoutId = setTimeout(() => {\n        callbacks.onPrefetch(href);\n        this.prefetchQueue.delete(href);\n        this.pendingTimeouts.delete(href);\n      }, this.prefetchDelay);\n      this.pendingTimeouts.set(href, timeoutId);\n    };\n  }\n  shouldPrefetchOnHover(target) {\n    const prefetchAttribute = target.getAttribute("data-prefetch");\n    if (prefetchAttribute === "false") return false;\n    if (prefetchAttribute === "true") return true;\n    return Boolean(this.prefetchOptions.hover);\n  }\n  saveScrollPosition(path) {\n    try {\n      if (this.scrollPositions.size >= MAX_SCROLL_POSITIONS) {\n        const oldest = this.scrollPositions.keys().next().value;\n        if (oldest) this.scrollPositions.delete(oldest);\n      }\n      const scrollY = globalThis.scrollY;\n      if (typeof scrollY !== "number") {\n        logger3.debug("No valid scrollY value available");\n        this.scrollPositions.set(path, 0);\n        return;\n      }\n      this.scrollPositions.set(path, scrollY);\n    } catch (error) {\n      logger3.warn("failed to record scroll position", error);\n    }\n  }\n  getScrollPosition(path) {\n    const position = this.scrollPositions.get(path);\n    if (position === void 0) {\n      logger3.debug(`No scroll position stored for ${path}`);\n      return 0;\n    }\n    return position;\n  }\n  isPopState() {\n    return this.isPopStateNav;\n  }\n  clearPopStateFlag() {\n    this.isPopStateNav = false;\n  }\n  clear() {\n    for (const timeoutId of this.pendingTimeouts.values()) clearTimeout(timeoutId);\n    this.pendingTimeouts.clear();\n    this.prefetchQueue.clear();\n    this.scrollPositions.clear();\n    this.isPopStateNav = false;\n  }\n};\n\n// src/rendering/client/browser-stubs/error-registry.ts\nfunction createBrowserError(name, fallbackMessage) {\n  return {\n    create(options = {}) {\n      const error = new Error(options.detail ?? fallbackMessage);\n      error.name = name;\n      Object.assign(error, {\n        status: options.status,\n        context: options.context\n      });\n      return error;\n    }\n  };\n}\nvar NETWORK_ERROR = createBrowserError("NetworkError", "Network request failed");\nvar SECURITY_VIOLATION = createBrowserError("SecurityViolation", "Security violation");\n\n// src/html/html-detection.ts\nfunction isFullHTMLDocument(content) {\n  const trimmed = content.trim().toLowerCase();\n  return trimmed.startsWith("<!doctype") && trimmed.includes("<html") && trimmed.includes("</html>");\n}\n\n// src/routing/client/page-loader.ts\nvar logger4 = rendererLogger.component("veryfront");\nvar MAX_CACHE_SIZE = 50;\nvar HYDRATION_DATA_ID = "veryfront-hydration-data";\nvar DEPENDENCY_PINNING_RESPONSE_HEADER = "x-veryfront-dependency-pins";\nfunction reloadBrowserDocument(url) {\n  if (typeof globalThis.location !== "undefined") {\n    globalThis.location.assign(url);\n  }\n}\nfunction readDependencyPinningCacheKey(doc) {\n  if (!doc) return "off";\n  try {\n    const hydrationDataElement = doc.getElementById(HYDRATION_DATA_ID);\n    if (!hydrationDataElement?.textContent) return "off";\n    const hydrationData = JSON.parse(hydrationDataElement.textContent);\n    return typeof hydrationData.dependencyPinningCacheKey === "string" && hydrationData.dependencyPinningCacheKey.startsWith("on:") ? hydrationData.dependencyPinningCacheKey : "off";\n  } catch (error) {\n    logger4.debug("Failed to read dependency snapshot from hydration data:", error);\n    return "off";\n  }\n}\nvar PageLoader = class {\n  constructor(doc = typeof document === "undefined" ? void 0 : document, reloadDocument = reloadBrowserDocument) {\n    __publicField(this, "cache", /* @__PURE__ */ new Map());\n    __publicField(this, "spaCache", /* @__PURE__ */ new Map());\n    __publicField(this, "pendingRequests", /* @__PURE__ */ new Map());\n    __publicField(this, "pendingSpaRequests", /* @__PURE__ */ new Map());\n    /**\n     * A loader belongs to the dependency snapshot of the document that created it.\n     * Keeping this immutable also prevents cached or in-flight route data from\n     * crossing snapshot boundaries if the hydration element is later replaced.\n     */\n    __publicField(this, "dependencyPinningCacheKey");\n    __publicField(this, "reloadDocument");\n    __publicField(this, "snapshotRecoveryStarted", false);\n    this.dependencyPinningCacheKey = readDependencyPinningCacheKey(doc);\n    this.reloadDocument = reloadDocument;\n  }\n  evictIfFull(map) {\n    if (map.size < MAX_CACHE_SIZE) return;\n    const oldest = map.keys().next().value;\n    if (oldest) map.delete(oldest);\n  }\n  getCached(path) {\n    return this.cache.get(this.snapshotScopedPath(path));\n  }\n  isCached(path) {\n    return this.cache.has(this.snapshotScopedPath(path));\n  }\n  setCache(path, data) {\n    this.evictIfFull(this.cache);\n    this.cache.set(this.snapshotScopedPath(path), data);\n  }\n  clearCache() {\n    this.cache.clear();\n    this.spaCache.clear();\n    this.pendingRequests.clear();\n    this.pendingSpaRequests.clear();\n  }\n  getSpaCached(path) {\n    return this.spaCache.get(this.snapshotScopedPath(path));\n  }\n  isSpaDataCached(path) {\n    return this.spaCache.has(this.snapshotScopedPath(path));\n  }\n  setSpaCache(path, data) {\n    this.evictIfFull(this.spaCache);\n    this.spaCache.set(this.snapshotScopedPath(path), data);\n  }\n  async fetchPageData(path, reloadOnSnapshotFailure = true) {\n    try {\n      return await this.tryFetchJSON(path) ?? await this.fetchAndParseHTML(path);\n    } catch (error) {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    }\n  }\n  async tryFetchJSON(path) {\n    let response;\n    try {\n      const navigationUrl = new URL(path, "http://veryfront.local");\n      const dataPath = navigationUrl.pathname === "/" ? "/index" : navigationUrl.pathname;\n      const endpoint = `/_veryfront/data${dataPath}.json${navigationUrl.search}`;\n      response = await fetch(endpoint, {\n        headers: this.navigationHeaders("client")\n      });\n    } catch (error) {\n      logger4.debug(`JSON fetch failed for ${path}, falling back to HTML:`, error);\n      return null;\n    }\n    if (response.status === 409) {\n      this.failDependencySnapshot(\n        path,\n        `Dependency snapshot is unavailable for ${path}`\n      );\n    }\n    if (!response.ok) return null;\n    let data;\n    try {\n      data = await response.json();\n    } catch (error) {\n      logger4.debug(`JSON response was invalid for ${path}, falling back to HTML:`, error);\n      return null;\n    }\n    this.assertDependencySnapshot(\n      data.dependencyPinningCacheKey,\n      path,\n      "route data"\n    );\n    if (typeof data.html === "string" && isFullHTMLDocument(data.html)) {\n      const parsed = parsePageDataFromHTML(data.html);\n      this.assertDependencySnapshot(\n        parsed.dependencyPinningCacheKey,\n        path,\n        "route data HTML body"\n      );\n      return {\n        ...parsed.pageData,\n        ...data,\n        html: parsed.content,\n        managedHead: parsed.managedHead\n      };\n    }\n    return data;\n  }\n  async fetchAndParseHTML(path) {\n    const response = await fetch(path, {\n      headers: this.navigationHeaders("client")\n    });\n    if (response.status === 409) {\n      this.failDependencySnapshot(\n        path,\n        `Dependency snapshot is unavailable for ${path}`\n      );\n    }\n    if (!response.ok) {\n      throw NETWORK_ERROR.create({\n        detail: `Failed to fetch ${path}`,\n        status: response.status,\n        context: { path }\n      });\n    }\n    this.assertDependencySnapshot(\n      response.headers.get(DEPENDENCY_PINNING_RESPONSE_HEADER),\n      path,\n      "HTML response"\n    );\n    const html = await response.text();\n    const {\n      content,\n      pageData,\n      managedHead,\n      dependencyPinningCacheKey\n    } = parsePageDataFromHTML(html);\n    this.assertDependencySnapshot(\n      dependencyPinningCacheKey,\n      path,\n      "HTML body"\n    );\n    return { ...pageData, html: content, managedHead };\n  }\n  loadPage(path) {\n    return this.loadPageWithSnapshotRecovery(path, true);\n  }\n  loadPageWithSnapshotRecovery(path, reloadOnSnapshotFailure) {\n    const cachedData = this.getCached(path);\n    if (cachedData) {\n      logger4.debug(`Loading ${path} from cache`);\n      return Promise.resolve(cachedData);\n    }\n    const pendingKey = this.snapshotScopedPath(path);\n    const pending = this.pendingRequests.get(pendingKey);\n    if (pending) {\n      logger4.debug(`Reusing pending request for ${path}`);\n      return this.withSnapshotRecovery(\n        pending,\n        path,\n        reloadOnSnapshotFailure\n      );\n    }\n    logger4.debug(`Creating pending request for ${path}`);\n    const request = this.createPendingRequest(pendingKey, this.pendingRequests, async () => {\n      const data = await this.fetchPageData(path, false);\n      this.setCache(path, data);\n      return data;\n    });\n    return this.withSnapshotRecovery(\n      request,\n      path,\n      reloadOnSnapshotFailure\n    );\n  }\n  async prefetch(path) {\n    if (this.isCached(path)) return;\n    logger4.debug(`Prefetching ${path}`);\n    try {\n      await this.loadPageWithSnapshotRecovery(path, false);\n    } catch (error) {\n      logger4.warn(\n        `[Veryfront] Failed to prefetch ${path}`,\n        error instanceof Error ? error : new Error(String(error))\n      );\n    }\n  }\n  async fetchSpaPageData(path, reloadOnSnapshotFailure = true) {\n    try {\n      const navigationUrl = new URL(path, "http://veryfront.local");\n      const normalizedPath = navigationUrl.pathname === "/" ? "index" : navigationUrl.pathname.replace(/^\\//, "");\n      const endpoint = `/_veryfront/page-data/${normalizedPath}.json${navigationUrl.search}`;\n      logger4.debug(`Fetching SPA page data from ${endpoint}`);\n      const response = await fetch(endpoint, {\n        headers: this.navigationHeaders("spa")\n      });\n      if (response.status === 409) {\n        this.failDependencySnapshot(\n          path,\n          `Dependency snapshot is unavailable for SPA page data ${path}`\n        );\n      }\n      if (!response.ok) {\n        throw NETWORK_ERROR.create({\n          detail: `Failed to fetch SPA page data for ${path}`,\n          status: response.status,\n          context: { path }\n        });\n      }\n      const data = await response.json();\n      this.assertDependencySnapshot(\n        data.dependencyPinningCacheKey,\n        path,\n        "SPA page data"\n      );\n      return data;\n    } catch (error) {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    }\n  }\n  loadSpaPageData(path) {\n    return this.loadSpaPageDataWithSnapshotRecovery(path, true);\n  }\n  loadSpaPageDataWithSnapshotRecovery(path, reloadOnSnapshotFailure) {\n    const cachedData = this.getSpaCached(path);\n    if (cachedData) {\n      logger4.debug(`Loading SPA data for ${path} from cache`);\n      return Promise.resolve(cachedData);\n    }\n    const pendingKey = this.snapshotScopedPath(path);\n    const pending = this.pendingSpaRequests.get(pendingKey);\n    if (pending) {\n      logger4.debug(`Reusing pending SPA request for ${path}`);\n      return this.withSnapshotRecovery(\n        pending,\n        path,\n        reloadOnSnapshotFailure\n      );\n    }\n    logger4.debug(`Creating pending SPA request for ${path}`);\n    const request = this.createPendingRequest(pendingKey, this.pendingSpaRequests, async () => {\n      const data = await this.fetchSpaPageData(path, false);\n      this.setSpaCache(path, data);\n      return data;\n    });\n    return this.withSnapshotRecovery(\n      request,\n      path,\n      reloadOnSnapshotFailure\n    );\n  }\n  async prefetchSpaPageData(path) {\n    if (this.isSpaDataCached(path)) return;\n    logger4.debug(`Prefetching SPA page data for ${path}`);\n    try {\n      await this.loadSpaPageDataWithSnapshotRecovery(path, false);\n    } catch (error) {\n      logger4.warn(\n        `[Veryfront] Failed to prefetch SPA data for ${path}`,\n        error instanceof Error ? error : new Error(String(error))\n      );\n    }\n  }\n  createPendingRequest(path, pendingMap, fetcher) {\n    const request = (async () => {\n      try {\n        return await fetcher();\n      } finally {\n        pendingMap.delete(path);\n      }\n    })();\n    pendingMap.set(path, request);\n    return request;\n  }\n  snapshotScopedPath(path) {\n    return this.dependencyPinningCacheKey.startsWith("on:") ? `${this.dependencyPinningCacheKey}\\0${path}` : path;\n  }\n  navigationHeaders(type) {\n    return {\n      "X-Veryfront-Navigation": type,\n      ...this.dependencyPinningCacheKey.startsWith("on:") ? {\n        [DEPENDENCY_PINNING_RESPONSE_HEADER]: this.dependencyPinningCacheKey\n      } : {}\n    };\n  }\n  assertDependencySnapshot(actualCacheKey, path, source) {\n    const expectedCacheKey = this.dependencyPinningCacheKey.startsWith("on:") ? this.dependencyPinningCacheKey : void 0;\n    const normalizedActualCacheKey = typeof actualCacheKey === "string" ? actualCacheKey : void 0;\n    const matches = expectedCacheKey ? normalizedActualCacheKey === expectedCacheKey : normalizedActualCacheKey === void 0 || normalizedActualCacheKey === "off";\n    if (matches) return;\n    this.failDependencySnapshot(\n      path,\n      `Dependency snapshot mismatch in ${source} for ${path}`\n    );\n  }\n  failDependencySnapshot(path, detail) {\n    throw NETWORK_ERROR.create({\n      detail,\n      status: 409,\n      context: { path }\n    });\n  }\n  withSnapshotRecovery(promise, path, reloadOnSnapshotFailure) {\n    return promise.catch((error) => {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    });\n  }\n  recoverSnapshotFailure(error, path, reloadOnSnapshotFailure) {\n    if (!reloadOnSnapshotFailure || typeof error !== "object" || error === null || error.status !== 409) {\n      return;\n    }\n    if (this.snapshotRecoveryStarted) return;\n    this.snapshotRecoveryStarted = true;\n    try {\n      this.reloadDocument(path);\n    } catch (reloadError) {\n      this.snapshotRecoveryStarted = false;\n      logger4.warn(\n        `[Veryfront] Failed to reload after dependency snapshot conflict for ${path}`,\n        reloadError instanceof Error ? reloadError : new Error(String(reloadError))\n      );\n    }\n  }\n};\n\n// src/utils/logger/core.ts\nvar ANSI = {\n  reset: "\\x1B[0m",\n  dim: "\\x1B[2m",\n  gray: "\\x1B[90m",\n  red: "\\x1B[31m",\n  green: "\\x1B[32m",\n  yellow: "\\x1B[33m",\n  blue: "\\x1B[34m",\n  magenta: "\\x1B[35m",\n  cyan: "\\x1B[36m"\n};\nvar LEVEL_COLORS = {\n  debug: ANSI.gray,\n  info: ANSI.green,\n  warn: ANSI.yellow,\n  error: ANSI.red\n};\n\n// src/utils/logger/redact.ts\nvar REDACTED = "[REDACTED]";\nvar apply = Reflect.apply;\nvar regExpExec = RegExp.prototype.exec;\nvar regExpReplace = RegExp.prototype[Symbol.replace];\nvar stringCharCodeAt = String.prototype.charCodeAt;\nvar stringSlice = String.prototype.slice;\nvar stringToLowerCase = String.prototype.toLowerCase;\nvar NON_ALPHANUMERIC_PATTERN = /[^a-z0-9]/g;\nfunction normalizeToAlphanumeric(s) {\n  const lowercase = apply(stringToLowerCase, s, []);\n  return apply(regExpReplace, NON_ALPHANUMERIC_PATTERN, [lowercase, ""]);\n}\nfunction sliceString(value, start, end) {\n  return end === void 0 ? apply(stringSlice, value, [start]) : apply(stringSlice, value, [start, end]);\n}\nvar SENSITIVE_KEY_PATTERNS = [\n  "password",\n  "passwd",\n  "pwd",\n  "passphrase",\n  "secret",\n  "clientsecret",\n  "token",\n  "apikey",\n  "accesskey",\n  "privatekey",\n  "credential",\n  "authorization",\n  "cookie",\n  "bearer",\n  "jwt",\n  "connectionstring",\n  "signature",\n  "sessionid",\n  "sid",\n  "otp",\n  "mfa",\n  "pin",\n  "salt",\n  "xsrf",\n  "csrf"\n];\nvar SENSITIVE_KEY_CACHE_MAX_SIZE = 512;\nvar SENSITIVE_KEY_CACHE_MAX_KEY_LENGTH = 128;\nvar sensitiveKeyCache = /* @__PURE__ */ new Map();\nfunction isSensitiveKey(key) {\n  const cacheable = key.length <= SENSITIVE_KEY_CACHE_MAX_KEY_LENGTH;\n  if (cacheable) {\n    const cached = sensitiveKeyCache.get(key);\n    if (cached !== void 0) return cached;\n  }\n  const normalized = normalizeToAlphanumeric(key);\n  const sensitive = SENSITIVE_KEY_PATTERNS.some((pattern) => normalized.includes(pattern));\n  if (cacheable) {\n    if (sensitiveKeyCache.size >= SENSITIVE_KEY_CACHE_MAX_SIZE) {\n      const oldestKey = sensitiveKeyCache.keys().next().value;\n      if (oldestKey !== void 0) sensitiveKeyCache.delete(oldestKey);\n    }\n    sensitiveKeyCache.set(key, sensitive);\n  }\n  return sensitive;\n}\nvar SENSITIVE_URL_PARAMS = [\n  "access_token",\n  "accesstoken",\n  "refresh_token",\n  "api_key",\n  "apikey",\n  "code",\n  "token",\n  "secret",\n  "client_secret",\n  "password",\n  "passwd",\n  "pwd",\n  "state",\n  "sig",\n  "signature",\n  "auth",\n  "x-amz-credential",\n  "x-amz-signature",\n  "x-amz-security-token",\n  "x-goog-credential",\n  "x-goog-signature"\n];\nvar NORMALIZED_SENSITIVE_URL_PARAMS = new Set(SENSITIVE_URL_PARAMS.map(normalizeToAlphanumeric));\nvar URL_USERINFO_RE = /(\\b[a-z][a-z0-9+.-]*:\\/\\/|\\/\\/)([^/?#\\s]+)@/gi;\nvar HORIZONTAL_WHITESPACE_URL_USERINFO_RE = /(\\b[a-z][a-z0-9+.-]*:\\/\\/|\\/\\/)([a-z0-9._~!$&\'()*+,;=%-]+):([^/?#@\\r\\n \\t]+[ \\t][^/?#@\\r\\n]*)@/gi;\nvar MAX_URL_PARAMETER_DECODE_PASSES = 3;\nfunction isHorizontalAssignmentBoundary(character) {\n  return character === " " || character === "\t" || character === "," || character === ";" || character === "&" || character === "?" || character === "#";\n}\nfunction isAsciiLetter(character) {\n  if (!character) return false;\n  const code = character.charCodeAt(0);\n  return code >= 65 && code <= 90 || code >= 97 && code <= 122;\n}\nfunction isAssignmentKeyStartCharacter(character) {\n  return isAsciiLetter(character) || character === "_" || character === "$";\n}\nfunction isAssignmentKeyCharacter(character) {\n  if (!character) return false;\n  const code = character.charCodeAt(0);\n  return isAssignmentKeyStartCharacter(character) || code >= 48 && code <= 57 || character === "." || character === "-";\n}\nfunction assignmentStartsAt(input, start) {\n  let index = start;\n  const keyQuote = input[index] === `"` || input[index] === "\'" ? input[index++] : "";\n  if (!isAssignmentKeyStartCharacter(input[index])) return false;\n  index++;\n  while (isAssignmentKeyCharacter(input[index])) index++;\n  if (keyQuote) {\n    if (input[index] !== keyQuote) return false;\n    index++;\n  }\n  while (input[index] === " " || input[index] === "\t") index++;\n  return input[index] === ":" || input[index] === "=";\n}\nfunction isAssignmentBoundaryCharacter(character) {\n  return character === "\\r" || character === "\\n" || character === "}" || character === "]" || isHorizontalAssignmentBoundary(character);\n}\nfunction skipAssignmentBoundaryCharacters(input, start) {\n  let index = start;\n  while (index < input.length && isAssignmentBoundaryCharacter(input[index])) {\n    index++;\n  }\n  return index;\n}\nfunction assignmentValueEndsAt(input, start) {\n  const boundaryEnd = skipAssignmentBoundaryCharacters(input, start);\n  return boundaryEnd >= input.length || assignmentStartsAt(input, boundaryEnd);\n}\nfunction redactAssignmentValue(input, start) {\n  let scanStart = start;\n  let preserveValueQuote = true;\n  if (input.startsWith(REDACTED, start)) {\n    const markerEnd = start + REDACTED.length;\n    if (assignmentValueEndsAt(input, markerEnd)) {\n      return {\n        end: markerEnd,\n        replacement: REDACTED\n      };\n    }\n    scanStart = markerEnd;\n    preserveValueQuote = false;\n  }\n  const wrapperQuote = preserveValueQuote && (input[scanStart] === `"` || input[scanStart] === "\'" || input[scanStart] === "`") ? input[scanStart] : "";\n  let wrapperQuoteClosed = false;\n  const replacement = () => wrapperQuote ? `${wrapperQuote}${REDACTED}${wrapperQuoteClosed ? wrapperQuote : ""}` : REDACTED;\n  const expectedClosings = [];\n  let quote = "";\n  let quoteStart = -1;\n  for (let index = scanStart; index < input.length; ) {\n    const character = input[index];\n    if (quote) {\n      if (character === "\\\\") {\n        index += 2;\n        continue;\n      }\n      if (character === quote) {\n        if (quoteStart === scanStart && expectedClosings.length === 0) {\n          wrapperQuoteClosed = true;\n        }\n        quote = "";\n        quoteStart = -1;\n      }\n      index++;\n      continue;\n    }\n    if (character === `"` || character === "\'" || character === "`") {\n      quote = character;\n      quoteStart = index;\n      index++;\n      continue;\n    }\n    if (character === "{" || character === "[") {\n      expectedClosings.push(character === "{" ? "}" : "]");\n      index++;\n      continue;\n    }\n    if (expectedClosings.length > 0 && (character === "}" || character === "]")) {\n      if (expectedClosings.at(-1) !== character) {\n        return { end: input.length, replacement: replacement() };\n      }\n      expectedClosings.pop();\n      index++;\n      if (expectedClosings.length === 0 && assignmentValueEndsAt(input, index)) {\n        return { end: index, replacement: replacement() };\n      }\n      continue;\n    }\n    if (expectedClosings.length > 0 || !isAssignmentBoundaryCharacter(character)) {\n      index++;\n      continue;\n    }\n    const boundaryStart = index;\n    index = skipAssignmentBoundaryCharacters(input, index);\n    if (index >= input.length || assignmentStartsAt(input, index)) {\n      return { end: boundaryStart, replacement: replacement() };\n    }\n  }\n  return { end: input.length, replacement: replacement() };\n}\nfunction redactCredentialAssignments(input, prefixPattern, keyGroup, urlParameterBoundaryGroup) {\n  let cursor = 0;\n  let result = "";\n  for (let match = apply(regExpExec, prefixPattern, [input]); match; match = apply(regExpExec, prefixPattern, [input])) {\n    const key = match[keyGroup];\n    if (!isSensitiveKey(key)) continue;\n    const valueStart = prefixPattern.lastIndex;\n    const boundary = urlParameterBoundaryGroup === void 0 ? void 0 : match[urlParameterBoundaryGroup];\n    const markerEnd = valueStart + REDACTED.length;\n    if ((boundary === "?" || boundary === "&" || boundary === ";") && input.startsWith(REDACTED, valueStart) && input[markerEnd] === "#") {\n      continue;\n    }\n    const redactedValue = redactAssignmentValue(input, valueStart);\n    result += sliceString(input, cursor, match.index);\n    result += match[0];\n    result += redactedValue.replacement;\n    cursor = redactedValue.end;\n    prefixPattern.lastIndex = redactedValue.end;\n  }\n  return cursor === 0 ? input : result + sliceString(input, cursor);\n}\nfunction isStandaloneUrlAuthorityBeforeWhitespace(scheme, user, password) {\n  const whitespaceIndex = password.search(/[ \\t]/);\n  if (whitespaceIndex < 0) return false;\n  const authority = `${user}:${sliceString(password, 0, whitespaceIndex)}`;\n  const candidate = scheme === "//" ? `https://${authority}` : `${scheme}${authority}`;\n  try {\n    const url = new URL(candidate);\n    return url.username.length === 0 && url.password.length === 0;\n  } catch {\n    return false;\n  }\n}\nfunction decodeUrlParameterName(value) {\n  let decoded = value;\n  for (let pass = 0; pass < MAX_URL_PARAMETER_DECODE_PASSES; pass++) {\n    let next;\n    try {\n      next = decodeURIComponent(decoded);\n    } catch {\n      break;\n    }\n    if (next === decoded) break;\n    decoded = next;\n  }\n  return decoded;\n}\nfunction sanitizeUrlCredentials(input) {\n  if (typeof input !== "string" || input.length === 0) return input;\n  let out = apply(regExpReplace, URL_USERINFO_RE, [\n    input,\n    (_match, scheme, userinfo) => {\n      const colon = userinfo.indexOf(":");\n      if (colon === -1) {\n        return `${scheme}${REDACTED}@`;\n      }\n      const user = sliceString(userinfo, 0, colon);\n      return `${scheme}${user}:${REDACTED}@`;\n    }\n  ]);\n  out = apply(regExpReplace, HORIZONTAL_WHITESPACE_URL_USERINFO_RE, [\n    out,\n    (match, scheme, user, password) => {\n      if (isStandaloneUrlAuthorityBeforeWhitespace(scheme, user, password)) {\n        return match;\n      }\n      return `${scheme}${user}:${REDACTED}@`;\n    }\n  ]);\n  out = apply(regExpReplace, /([?#&;])([-a-z0-9_.%\\[\\]]+)=([^&#;\\s]*)/gi, [\n    out,\n    (match, sep, key, _val) => {\n      const decodedKey = decodeUrlParameterName(key);\n      const sensitive = NORMALIZED_SENSITIVE_URL_PARAMS.has(normalizeToAlphanumeric(decodedKey)) || isSensitiveKey(decodedKey);\n      return sensitive ? `${sep}${key}=${REDACTED}` : match;\n    }\n  ]);\n  out = apply(regExpReplace, /(^|[^a-z0-9_-])((?:set-cookie|cookie)\\s*:\\s*)[^\\r\\n]*/gi, [\n    out,\n    (_match, boundary, prefix) => `${boundary}${prefix}${REDACTED}`\n  ]);\n  out = apply(regExpReplace, /\\b(authorization\\s*[:=]\\s*)[^\\r\\n]*/gi, [\n    out,\n    (_match, prefix) => `${prefix}${REDACTED}`\n  ]);\n  out = apply(\n    regExpReplace,\n    /\\b(bearer|basic)(\\s+)(?:"[^"\\r\\n]*"|\'[^\'\\r\\n]*\'|[a-z0-9._~+/=-]+)/gi,\n    [\n      out,\n      (_match, scheme, whitespace) => `${scheme}${whitespace}${REDACTED}`\n    ]\n  );\n  out = redactCredentialAssignments(\n    out,\n    /(["\'])([_$a-z][a-z0-9_.$-]*)\\1(\\s*[:=]\\s*)/gi,\n    2\n  );\n  out = redactCredentialAssignments(\n    out,\n    /(^|[^a-z0-9_.$-])([_$a-z][a-z0-9_.$-]*)(\\s*[:=]\\s*)/gi,\n    2,\n    1\n  );\n  return out;\n}\n\n// src/errors/diagnostic-policy.ts\nvar ERROR_DIAGNOSTIC_MAX_LENGTH_CHARS = 2048;\nvar ERROR_OUTPUT_MAX_LENGTH_CHARS = 64 * 1024;\nvar ERROR_DOCS_SLUG_MAX_LENGTH_CHARS = 256;\nvar ERROR_DOCS_BASE_URL = "https://veryfront.com/docs/errors/";\nvar TRUNCATION_MARKER = "...[truncated]";\nvar UNKNOWN_ERROR_SLUG = "unknown-error";\nfunction truncateDiagnosticText(value, maxLength) {\n  if (value.length <= maxLength) return value;\n  const prefixLength = Math.max(0, maxLength - TRUNCATION_MARKER.length);\n  const prefix = takeSafePrefix(value, prefixLength);\n  return `${prefix}${TRUNCATION_MARKER}`;\n}\nfunction takeSafePrefix(value, length) {\n  let prefix = value.slice(0, length);\n  const finalCodeUnit = prefix.charCodeAt(prefix.length - 1);\n  if (finalCodeUnit >= 55296 && finalCodeUnit <= 56319) {\n    prefix = prefix.slice(0, -1);\n  }\n  return prefix;\n}\nfunction replaceLoneSurrogates(value) {\n  let result = "";\n  for (let index = 0; index < value.length; index++) {\n    const codeUnit = value.charCodeAt(index);\n    if (codeUnit >= 55296 && codeUnit <= 56319) {\n      const nextCodeUnit = value.charCodeAt(index + 1);\n      if (nextCodeUnit >= 56320 && nextCodeUnit <= 57343) {\n        result += value.slice(index, index + 2);\n        index++;\n      } else {\n        result += "\\uFFFD";\n      }\n      continue;\n    }\n    result += codeUnit >= 56320 && codeUnit <= 57343 ? "\\uFFFD" : value.charAt(index);\n  }\n  return result;\n}\nfunction sanitizeBoundedDiagnosticText(value) {\n  if (typeof value !== "string") return REDACTED;\n  return truncateDiagnosticText(\n    sanitizeUrlCredentials(value),\n    ERROR_DIAGNOSTIC_MAX_LENGTH_CHARS\n  );\n}\nfunction sanitizeBoundedErrorSlug(slug) {\n  const sanitized = typeof slug === "string" ? sanitizeUrlCredentials(slug) : UNKNOWN_ERROR_SLUG;\n  const bounded = truncateDiagnosticText(\n    sanitized || UNKNOWN_ERROR_SLUG,\n    ERROR_DOCS_SLUG_MAX_LENGTH_CHARS\n  );\n  const normalized = replaceLoneSurrogates(bounded);\n  return normalized === "." || normalized === ".." ? UNKNOWN_ERROR_SLUG : normalized;\n}\nfunction buildErrorDocsUrl(slug) {\n  const segment = encodeURIComponent(sanitizeBoundedErrorSlug(slug));\n  return `${ERROR_DOCS_BASE_URL}${segment}`;\n}\n\n// src/errors/types.ts\nvar freeze = Object.freeze;\nvar getOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;\nvar numberIsFinite = Number.isFinite;\nvar VERYFRONT_ERROR_INSTANCES = /* @__PURE__ */ new WeakSet();\nvar ERROR_CATEGORIES = /* @__PURE__ */ new Set([\n  "CONFIG",\n  "BUILD",\n  "RUNTIME",\n  "ROUTE",\n  "MODULE",\n  "SERVER",\n  "BOUNDARY",\n  "DEV",\n  "DEPLOY",\n  "AGENT",\n  "GENERAL"\n]);\nfunction defineError(definition) {\n  const snapshot = { ...definition };\n  const registered = {\n    ...snapshot,\n    create(options) {\n      const message = options?.message;\n      const detail = options?.detail;\n      const cause = options?.cause;\n      const instance = options?.instance;\n      const context = options?.context;\n      const status = options?.status ?? snapshot.status;\n      return new VeryfrontError(message || detail || snapshot.title, {\n        slug: snapshot.slug,\n        category: snapshot.category,\n        status,\n        title: snapshot.title,\n        suggestion: snapshot.suggestion,\n        exitCode: snapshot.exitCode,\n        detail,\n        cause,\n        instance,\n        context\n      });\n    }\n  };\n  return freeze(registered);\n}\nvar VeryfrontError = class extends Error {\n  constructor(message, options) {\n    super(message);\n    __publicField(this, "slug");\n    __publicField(this, "category");\n    __publicField(this, "status");\n    __publicField(this, "title");\n    __publicField(this, "suggestion");\n    /** Process exit code for the CLI boundary. */\n    __publicField(this, "exitCode");\n    __publicField(this, "detail");\n    __publicField(this, "cause");\n    __publicField(this, "instance");\n    __publicField(this, "context");\n    VERYFRONT_ERROR_INSTANCES.add(this);\n    this.name = "VeryfrontError";\n    this.slug = options.slug;\n    this.category = options.category;\n    this.status = options.status;\n    this.title = options.title;\n    this.suggestion = options.suggestion;\n    this.exitCode = options.exitCode;\n    this.detail = options.detail;\n    this.cause = options.cause;\n    this.instance = options.instance;\n    this.context = options.context;\n  }\n  /**\n   * Convert to RFC 9457 Problem Details format\n   */\n  toRFC9457() {\n    const snapshot = snapshotVeryfrontError(this);\n    if (!snapshot) {\n      return {\n        type: buildErrorDocsUrl("unknown-error"),\n        title: "Unknown/unclassified error",\n        status: 500,\n        category: "GENERAL"\n      };\n    }\n    return {\n      type: buildErrorDocsUrl(snapshot.slug),\n      title: sanitizeBoundedDiagnosticText(snapshot.title),\n      status: snapshot.status,\n      detail: snapshot.detail === void 0 ? void 0 : sanitizeBoundedDiagnosticText(snapshot.detail),\n      instance: snapshot.instance === void 0 ? void 0 : sanitizeBoundedDiagnosticText(snapshot.instance),\n      category: snapshot.category,\n      suggestion: snapshot.suggestion === void 0 ? void 0 : sanitizeBoundedDiagnosticText(snapshot.suggestion),\n      cause: typeof snapshot.cause === "string" ? sanitizeBoundedDiagnosticText(snapshot.cause) : void 0\n    };\n  }\n  /**\n   * Get documentation URL for this error\n   */\n  getDocsUrl() {\n    const snapshot = snapshotVeryfrontError(this);\n    return buildErrorDocsUrl(snapshot?.slug ?? "unknown-error");\n  }\n};\nfunction isVeryfrontErrorInstance(error) {\n  return typeof error === "object" && error !== null && VERYFRONT_ERROR_INSTANCES.has(error);\n}\nfunction snapshotVeryfrontError(error) {\n  if (!isVeryfrontErrorInstance(error)) return null;\n  return snapshotKnownVeryfrontError(error);\n}\nfunction snapshotKnownVeryfrontError(error) {\n  try {\n    if (!isVeryfrontErrorInstance(error)) return null;\n    const descriptors = getOwnPropertyDescriptors(error);\n    const dataValue = (key) => {\n      const descriptor = descriptors[key];\n      return descriptor && "value" in descriptor ? descriptor.value : void 0;\n    };\n    const slug = dataValue("slug");\n    const category = dataValue("category");\n    const status = dataValue("status");\n    const title = dataValue("title");\n    const message = dataValue("message");\n    const suggestion = dataValue("suggestion");\n    const exitCode = dataValue("exitCode");\n    const detail = dataValue("detail");\n    const cause = dataValue("cause");\n    const instance = dataValue("instance");\n    const context = dataValue("context");\n    const stack = dataValue("stack");\n    if (typeof slug !== "string" || !ERROR_CATEGORIES.has(category) || typeof status !== "number" || !numberIsFinite(status) || typeof title !== "string" || typeof message !== "string" || suggestion !== void 0 && typeof suggestion !== "string" || exitCode !== void 0 && (typeof exitCode !== "number" || !numberIsFinite(exitCode)) || detail !== void 0 && typeof detail !== "string" || instance !== void 0 && typeof instance !== "string" || stack !== void 0 && typeof stack !== "string") {\n      return null;\n    }\n    return {\n      slug,\n      category,\n      status,\n      title,\n      message,\n      suggestion,\n      exitCode,\n      detail,\n      cause,\n      instance,\n      context,\n      stack\n    };\n  } catch {\n    return null;\n  }\n}\n\n// src/errors/error-registry/general.ts\nvar UNKNOWN_ERROR = defineError({\n  slug: "unknown-error",\n  category: "GENERAL",\n  status: 500,\n  title: "Unknown/unclassified error",\n  suggestion: "Check logs for more details"\n});\nvar AUTHENTICATION_REQUIRED = defineError({\n  slug: "authentication-required",\n  category: "GENERAL",\n  status: 401,\n  title: "Authentication required",\n  suggestion: "Set VERYFRONT_API_TOKEN or run \'veryfront login\'"\n});\nvar PERMISSION_DENIED = defineError({\n  slug: "permission-denied",\n  category: "GENERAL",\n  status: 403,\n  title: "File/resource permission denied",\n  suggestion: "Check file permissions and access rights"\n});\nvar FILE_NOT_FOUND = defineError({\n  slug: "file-not-found",\n  category: "GENERAL",\n  status: 404,\n  title: "File not found",\n  suggestion: "Verify the file path exists"\n});\nvar RESOURCE_NOT_FOUND = defineError({\n  slug: "resource-not-found",\n  category: "GENERAL",\n  status: 404,\n  title: "Requested resource not found",\n  suggestion: "Verify the referenced resource ID or name exists"\n});\nvar INVALID_ARGUMENT = defineError({\n  slug: "invalid-argument",\n  category: "GENERAL",\n  status: 400,\n  title: "Invalid function argument",\n  suggestion: "Check argument types and values",\n  exitCode: 2\n});\nvar TIMEOUT_ERROR = defineError({\n  slug: "timeout-error",\n  category: "GENERAL",\n  status: 408,\n  title: "Operation timed out",\n  suggestion: "Increase timeout or optimize the operation"\n});\nvar INITIALIZATION_ERROR = defineError({\n  slug: "initialization-error",\n  category: "GENERAL",\n  status: 500,\n  title: "Initialization failed",\n  suggestion: "Check initialization requirements and dependencies"\n});\nvar NOT_SUPPORTED = defineError({\n  slug: "not-supported",\n  category: "GENERAL",\n  status: 501,\n  title: "Feature not supported",\n  suggestion: "Check documentation for supported features"\n});\nvar SECURITY_VIOLATION2 = defineError({\n  slug: "security-violation",\n  category: "GENERAL",\n  status: 403,\n  title: "Security violation detected",\n  suggestion: "Check for path traversal or unauthorized access attempts"\n});\nvar INPUT_VALIDATION_FAILED = defineError({\n  slug: "input-validation-failed",\n  category: "GENERAL",\n  status: 400,\n  title: "Input validation failed",\n  suggestion: "Check request input against validation rules"\n});\nvar PROJECT_SOURCE_EMPTY = defineError({\n  slug: "project-source-empty",\n  category: "GENERAL",\n  status: 400,\n  title: "Project source is empty",\n  suggestion: "Add project files or run \'veryfront init\'"\n});\n\n// src/html/html-escape.ts\nvar MAX_ATTRIBUTE_VALUE_BYTES = 64 * 1024;\nvar MAX_TOTAL_ATTRIBUTE_BYTES = 1024 * 1024;\nvar textEncoder = new TextEncoder();\n\n// src/security/client/html-sanitizer.ts\nvar SUSPICIOUS_PATTERN_SPECS = [\n  { source: String.raw`<script[^>]*>[\\s\\S]*?<\\/script>`, flags: "gi", name: "inline script" },\n  { source: String.raw`javascript:`, flags: "gi", name: "javascript: URL" },\n  { source: String.raw`\\bon\\w+\\s*=`, flags: "gi", name: "event handler attribute" },\n  { source: String.raw`data:\\s*text\\/html`, flags: "gi", name: "data: HTML URL" }\n];\nfunction createSuspiciousPatterns() {\n  return SUSPICIOUS_PATTERN_SPECS.map(({ source, flags, name }) => ({\n    pattern: new RegExp(source, flags),\n    name\n  }));\n}\nfunction isDevMode() {\n  const g = globalThis;\n  return g.__VERYFRONT_DEV__ === true || g.Deno?.env?.get?.("VERYFRONT_ENV") === "development";\n}\nfunction validateTrustedHtml(html, options = {}) {\n  const { allowInlineScripts = false, strict = false, warn = true } = options;\n  for (const { pattern, name } of createSuspiciousPatterns()) {\n    if (allowInlineScripts && name === "inline script") continue;\n    pattern.lastIndex = 0;\n    if (!pattern.test(html)) continue;\n    if (warn) console.warn(`[Security] Suspicious ${name} detected in server HTML`);\n    if (strict || !isDevMode()) {\n      throw SECURITY_VIOLATION.create({ detail: `Potentially unsafe HTML: ${name} detected` });\n    }\n  }\n  return html;\n}\n\n// src/routing/client/page-transition.ts\nvar logger5 = rendererLogger.component("veryfront");\nvar PageTransition = class {\n  constructor(setupViewportPrefetch) {\n    __publicField(this, "setupViewportPrefetch", setupViewportPrefetch);\n    __publicField(this, "pendingTransitionTimeout");\n    __publicField(this, "pendingRoot");\n  }\n  destroy() {\n    this.cancelPendingTransition();\n  }\n  cancelPendingTransition() {\n    if (this.pendingTransitionTimeout !== void 0) {\n      clearTimeout(this.pendingTransitionTimeout);\n      this.pendingTransitionTimeout = void 0;\n    }\n    if (this.pendingRoot) {\n      this.pendingRoot.style.opacity = "1";\n      this.pendingRoot = void 0;\n    }\n  }\n  updatePage(data, isPopState, scrollY) {\n    this.cancelPendingTransition();\n    if (data.requiresFullDocumentNavigation || data.managedHead?.some((entry) => entry.tagName === "script") || typeof data.html === "string" && /<script\\b/i.test(data.html)) {\n      throw new TypeError("Scripted routes require a full document navigation");\n    }\n    const rootElement = document.getElementById("root");\n    const preparedHead = prepareClientRouteHeadEntries(data.managedHead, document);\n    const retainedTitle = document.title;\n    if (!rootElement || data.html === void 0) {\n      retireClientHeadOwnership(document);\n      applyPreparedClientRouteHeadDescriptors(preparedHead, document);\n      this.updateDocumentMetadata(document, data, retainedTitle);\n      return;\n    }\n    const trustedHtml = validateTrustedHtml(String(data.html));\n    this.performTransition(\n      rootElement,\n      data,\n      trustedHtml,\n      preparedHead,\n      retainedTitle,\n      isPopState,\n      scrollY\n    );\n  }\n  updateDocumentMetadata(targetDocument, data, retainedTitle) {\n    updateRouteTitle(data.frontmatter?.title || retainedTitle, targetDocument);\n    updateRouteMetaTags(data.frontmatter ?? {}, targetDocument);\n  }\n  performTransition(rootElement, data, trustedHtml, preparedHead, retainedTitle, isPopState, scrollY) {\n    rootElement.style.opacity = "0";\n    this.pendingRoot = rootElement;\n    this.pendingTransitionTimeout = setTimeout(() => {\n      this.pendingTransitionTimeout = void 0;\n      this.pendingRoot = void 0;\n      try {\n        retireClientHeadOwnership(rootElement.ownerDocument);\n        rootElement.innerHTML = trustedHtml;\n        applyHeadDirectives(rootElement);\n        applyPreparedClientRouteHeadDescriptors(preparedHead, rootElement.ownerDocument);\n        this.updateDocumentMetadata(rootElement.ownerDocument, data, retainedTitle);\n        this.setupViewportPrefetch(rootElement);\n        manageFocus(rootElement);\n        this.handleScroll(isPopState, scrollY);\n      } catch (error) {\n        logger5.error("Route transition commit failed; reloading the document", error);\n        globalThis.location?.reload();\n      } finally {\n        rootElement.style.opacity = "1";\n      }\n    }, PAGE_TRANSITION_DELAY_MS);\n  }\n  handleScroll(isPopState, scrollY) {\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger5.warn("scroll handling failed", error);\n    }\n  }\n  showError(error) {\n    const rootElement = document.getElementById("root");\n    if (!rootElement) return;\n    const errorDiv = document.createElement("div");\n    errorDiv.className = "veryfront-error-page";\n    const heading = document.createElement("h1");\n    heading.textContent = "Oops! Something went wrong";\n    const message = document.createElement("p");\n    message.textContent = error.message;\n    const button = document.createElement("button");\n    button.type = "button";\n    button.textContent = "Reload Page";\n    button.onclick = () => globalThis.location.reload();\n    errorDiv.append(heading, message, button);\n    retireClientHeadOwnership(rootElement.ownerDocument);\n    rootElement.innerHTML = "";\n    rootElement.appendChild(errorDiv);\n  }\n  setLoadingState(loading) {\n    const indicator = document.getElementById("veryfront-loading");\n    if (indicator) indicator.style.display = loading ? "block" : "none";\n    document.body.classList.toggle("veryfront-loading", loading);\n  }\n};\n\n// src/routing/client/viewport-prefetch.ts\nvar logger6 = rendererLogger.component("veryfront");\nvar ViewportPrefetch = class {\n  constructor(prefetchCallback, prefetchOptions = {}) {\n    __publicField(this, "observer", null);\n    __publicField(this, "prefetchCallback");\n    __publicField(this, "prefetchOptions");\n    this.prefetchCallback = prefetchCallback;\n    this.prefetchOptions = prefetchOptions;\n  }\n  setup(root) {\n    try {\n      if (!("IntersectionObserver" in globalThis)) return;\n      this.observer?.disconnect();\n      this.createObserver();\n      this.observeLinks(root);\n    } catch (error) {\n      logger6.debug("setupViewportPrefetch failed", error);\n    }\n  }\n  createObserver() {\n    this.observer = new IntersectionObserver(\n      (entries) => {\n        for (const entry of entries) {\n          if (!entry.isIntersecting) continue;\n          if (!(entry.target instanceof HTMLAnchorElement)) continue;\n          const href = entry.target.getAttribute("href");\n          if (href) this.prefetchCallback(href);\n          this.observer?.unobserve(entry.target);\n        }\n      },\n      { rootMargin: "200px" }\n    );\n  }\n  observeLinks(root) {\n    const anchors = root.querySelectorAll(\'a[href]:not([target="_blank"])\');\n    const isViewportEnabled = Boolean(this.prefetchOptions.viewport);\n    for (const anchor of anchors) {\n      if (!this.shouldObserveAnchor(anchor, isViewportEnabled)) continue;\n      this.observer?.observe(anchor);\n    }\n  }\n  shouldObserveAnchor(anchor, isViewportEnabled) {\n    const href = anchor.getAttribute("href");\n    if (!href) return false;\n    if (href.startsWith("http") || href.startsWith("#")) return false;\n    if (anchor.getAttribute("download")) return false;\n    const prefetchAttribute = anchor.getAttribute("data-prefetch");\n    if (prefetchAttribute === "false") return false;\n    return prefetchAttribute === "viewport" || isViewportEnabled;\n  }\n  disconnect() {\n    if (!this.observer) return;\n    try {\n      this.observer.disconnect();\n    } catch (error) {\n      logger6.warn("prefetchObserver.disconnect failed", error);\n    } finally {\n      this.observer = null;\n    }\n  }\n};\n\n// src/rendering/client/router.ts\nvar logger7 = rendererLogger.component("veryfront");\nfunction toHistoryMode(options) {\n  if (typeof options === "boolean") return options ? "push" : "none";\n  return options?.history ?? "push";\n}\nvar VeryfrontRouter = class {\n  constructor(options = {}) {\n    __publicField(this, "baseUrl");\n    __publicField(this, "currentPath");\n    __publicField(this, "root", null);\n    __publicField(this, "options");\n    __publicField(this, "spaMode");\n    __publicField(this, "spaNavigationHandler", null);\n    __publicField(this, "navigationSequence", 0);\n    __publicField(this, "pageLoader");\n    __publicField(this, "navigationHandlers");\n    __publicField(this, "pageTransition");\n    __publicField(this, "viewportPrefetch");\n    __publicField(this, "handleClick");\n    __publicField(this, "handlePopState");\n    __publicField(this, "handleMouseOver");\n    const globalOptions = this.loadGlobalOptions();\n    this.options = { ...globalOptions, ...options };\n    this.baseUrl = this.options.baseUrl || globalThis.location.origin;\n    this.currentPath = `${globalThis.location.pathname}${globalThis.location.search}${globalThis.location.hash}`;\n    this.spaMode = this.options.spaMode ?? globalThis.__VERYFRONT_SPA_MODE__ ?? false;\n    this.pageLoader = new PageLoader();\n    this.navigationHandlers = new NavigationHandlers(\n      this.options.prefetchDelay,\n      this.options.prefetch\n    );\n    this.pageTransition = new PageTransition((root) => this.viewportPrefetch.setup(root));\n    this.viewportPrefetch = new ViewportPrefetch(\n      (path) => this.prefetch(path),\n      this.options.prefetch\n    );\n    this.handleClick = this.navigationHandlers.createClickHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handlePopState = this.navigationHandlers.createPopStateHandler({\n      // The browser already updated the URL for a popstate, so don\'t touch history.\n      onNavigate: (url) => this.navigate(url, { history: "none" }),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handleMouseOver = this.navigationHandlers.createMouseOverHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    getNavigationStore().setNavigator((href, options2) => this.navigate(href, options2));\n  }\n  registerNavigationHandler(handler) {\n    logger7.debug("Registering SPA navigation handler");\n    this.spaNavigationHandler = handler;\n    this.spaMode = true;\n  }\n  /**\n   * Notify React (and any other) subscribers that a navigation completed —\n   * after full page loads, soft same-route changes, and popstate. Delegates to\n   * the shared navigation store, the single subscription surface both bundles\n   * share.\n   */\n  notify() {\n    getNavigationStore().notify();\n  }\n  pathnameOf(url) {\n    try {\n      return new URL(url, this.baseUrl).pathname;\n    } catch {\n      return url.split("?")[0]?.split("#")[0] || this.currentPath;\n    }\n  }\n  loadGlobalOptions() {\n    try {\n      const options = globalThis.__VERYFRONT_ROUTER_OPTS__;\n      if (!options) {\n        logger7.debug("No global options configured");\n        return {};\n      }\n      return options;\n    } catch (error) {\n      logger7.error("Failed to read global options:", error);\n      return {};\n    }\n  }\n  init() {\n    logger7.debug("Initializing client-side router");\n    const rootElement = document.getElementById("root");\n    if (!rootElement) {\n      logger7.error("Root element not found");\n      return;\n    }\n    const ReactDOMToUse = globalThis.ReactDOM ?? ReactDOM;\n    this.root = ReactDOMToUse.createRoot(rootElement);\n    document.addEventListener("click", this.handleClick);\n    globalThis.addEventListener("popstate", this.handlePopState);\n    document.addEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.setup(document);\n    this.cacheCurrentPage();\n  }\n  cacheCurrentPage() {\n    const pageData = extractPageDataFromScript();\n    if (pageData) {\n      const managedHead = snapshotClientRouteHead(document);\n      this.pageLoader.setCache(this.currentPath, {\n        ...pageData,\n        managedHead,\n        ...managedHead.some((entry) => entry.tagName === "script") || document.getElementById("root")?.querySelector("script") ? { requiresFullDocumentNavigation: true } : {}\n      });\n    }\n  }\n  /**\n   * Navigate to a URL. `options` selects the history behaviour: `{ history:\n   * "push" }` (default), `"replace"`, or `"none"` (the URL already reflects the\n   * target, as after popstate). A boolean is accepted for backward\n   * compatibility — `true` pushes, `false` maps to `"none"`.\n   */\n  async navigate(url, options) {\n    logger7.debug(`Navigating to ${url} (SPA mode: ${this.spaMode})`);\n    const navigationId = ++this.navigationSequence;\n    this.pageTransition.cancelPendingTransition();\n    this.pageTransition.setLoadingState(false);\n    const history = toHistoryMode(options);\n    const sameRoute = this.pathnameOf(url) === this.pathnameOf(this.currentPath);\n    this.navigationHandlers.saveScrollPosition(this.currentPath);\n    this.options.onStart?.(url);\n    if (history === "replace") globalThis.history.replaceState({}, "", url);\n    else if (history === "push") globalThis.history.pushState({}, "", url);\n    if (sameRoute && !this.shouldRevalidate(url, sameRoute)) {\n      if (!this.isCurrentNavigation(navigationId)) return;\n      this.currentPath = url;\n      this.notify();\n      this.options.onComplete?.(url);\n      this.options.onNavigate?.(url);\n      return;\n    }\n    if (this.spaMode && this.spaNavigationHandler) {\n      await this.loadSpaPage(url, navigationId);\n    } else {\n      if (await this.loadPage(url, true, navigationId)) return;\n    }\n    if (!this.isCurrentNavigation(navigationId)) return;\n    this.notify();\n    this.options.onNavigate?.(url);\n  }\n  isCurrentNavigation(navigationId) {\n    return navigationId === this.navigationSequence;\n  }\n  /**\n   * Whether a navigation should refetch page data. A route change always does;\n   * a same-route (query/hash-only) change consults `options.shouldRevalidate`,\n   * defaulting to `true` so server data is never shown stale.\n   */\n  shouldRevalidate(nextUrl, sameRoute) {\n    const policy = this.options.shouldRevalidate;\n    if (!policy) return true;\n    return policy({ currentHref: this.currentPath, nextHref: nextUrl, sameRoute });\n  }\n  async loadSpaPage(path, navigationId) {\n    logger7.debug(`Loading SPA page: ${path}`);\n    try {\n      const spaData = await this.pageLoader.loadSpaPageData(path);\n      if (!this.isCurrentNavigation(navigationId)) return;\n      await this.spaNavigationHandler?.(spaData);\n      if (!this.isCurrentNavigation(navigationId)) return;\n      this.currentPath = path;\n      this.handleScrollAfterNavigation();\n      this.options.onComplete?.(path);\n    } catch (error) {\n      if (!this.isCurrentNavigation(navigationId)) return;\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger7.error(`Failed to load SPA page ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    }\n  }\n  handleScrollAfterNavigation() {\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger7.warn("scroll handling failed", error);\n    }\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  /** Returns true when navigation was handed to the browser document loader. */\n  async loadPage(path, updateUI = true, navigationId) {\n    if (this.pageLoader.isCached(path)) {\n      logger7.debug(`Loading ${path} from cache`);\n      const data = this.pageLoader.getCached(path);\n      if (data) {\n        if (!this.isCurrentNavigation(navigationId)) return false;\n        if (updateUI && data.requiresFullDocumentNavigation) {\n          globalThis.location.assign(path);\n          return true;\n        }\n        if (updateUI) this.updatePage(data, path);\n        this.currentPath = path;\n        this.pageTransition.setLoadingState(false);\n        this.options.onComplete?.(path);\n        return false;\n      }\n      logger7.warn(`Cache entry for ${path} was unexpectedly null, fetching fresh data`);\n    }\n    this.pageTransition.setLoadingState(true);\n    try {\n      const data = await this.pageLoader.loadPage(path);\n      if (!this.isCurrentNavigation(navigationId)) return false;\n      if (updateUI && data.requiresFullDocumentNavigation) {\n        globalThis.location.assign(path);\n        return true;\n      }\n      if (updateUI) this.updatePage(data, path);\n      this.currentPath = path;\n      this.options.onComplete?.(path);\n      return false;\n    } catch (error) {\n      if (!this.isCurrentNavigation(navigationId)) return false;\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger7.error(`Failed to load ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n      return false;\n    } finally {\n      if (this.isCurrentNavigation(navigationId)) this.pageTransition.setLoadingState(false);\n    }\n  }\n  async prefetch(path) {\n    if (this.spaMode) {\n      await this.pageLoader.prefetchSpaPageData(path);\n      return;\n    }\n    await this.pageLoader.prefetch(path);\n  }\n  updatePage(data, targetPath) {\n    if (!this.root) return;\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(targetPath);\n    this.pageTransition.updatePage(data, isPopState, scrollY);\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  destroy() {\n    this.navigationSequence++;\n    this.pageTransition.setLoadingState(false);\n    document.removeEventListener("click", this.handleClick);\n    globalThis.removeEventListener("popstate", this.handlePopState);\n    document.removeEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.disconnect();\n    this.pageLoader.clearCache();\n    this.navigationHandlers.clear();\n    this.pageTransition.destroy();\n  }\n};\nfunction boot(options = {}) {\n  if (typeof window === "undefined" || !globalThis.document) return null;\n  const globalWithRouter = globalThis;\n  if (globalWithRouter.veryFrontRouter) return globalWithRouter.veryFrontRouter;\n  const { slug: _slug, ...routerOptions } = options;\n  const router = new VeryfrontRouter(routerOptions);\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => router.init(), { once: true });\n  } else {\n    router.init();\n  }\n  globalWithRouter.veryFrontRouter = router;\n  return router;\n}\nif (typeof window !== "undefined" && globalThis.document) {\n  boot();\n}\nexport {\n  VeryfrontRouter,\n  boot\n};\n';
+  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n\n// src/rendering/client/browser-stubs/logger.ts\nfunction noop() {\n}\nvar logger = {\n  debug: noop,\n  info: console.log.bind(console),\n  warn: console.warn.bind(console),\n  error: console.error.bind(console),\n  component: () => logger\n};\nvar rendererLogger = logger;\nvar PREFETCH_MAX_SIZE_BYTES = 200 * 1024;\n\n// src/rendering/client/navigation-store.ts\nvar STORE_KEY = /* @__PURE__ */ Symbol.for("veryfront.navigation.store.v1");\nfunction getNavigationStore() {\n  const holder = globalThis;\n  const existing = holder[STORE_KEY];\n  if (existing) return existing;\n  const listeners = /* @__PURE__ */ new Set();\n  let navigator = null;\n  const store = {\n    subscribe(listener) {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    getHref() {\n      const loc = globalThis.location;\n      return loc ? `${loc.pathname}${loc.search}${loc.hash}` : "/";\n    },\n    notify() {\n      for (const listener of [...listeners]) {\n        try {\n          listener();\n        } catch {\n        }\n      }\n    },\n    navigate(href, options) {\n      if (navigator) return navigator(href, options);\n      globalThis.location?.assign(href);\n      return Promise.resolve();\n    },\n    setNavigator(next) {\n      navigator = next;\n    }\n  };\n  holder[STORE_KEY] = store;\n  return store;\n}\n\n// src/rendering/client/router.ts\nimport ReactDOM from "react-dom/client";\n\n// src/html/managed-head-protocol.ts\nvar HEAD_PROVENANCE_ATTRIBUTE = "data-vf-head";\nvar HEAD_LEGACY_MANAGED_ATTRIBUTE = "data-veryfront-managed";\nvar HEAD_CONTENT_HASH_ATTRIBUTE = "data-vf-hash";\nvar HEAD_REACT_MANAGED_ATTRIBUTE = "data-vf-react-head";\nvar HEAD_REACT_OWNER_ATTRIBUTE = "data-vf-react-head-owner";\nvar HEAD_ROUTE_MANAGED_ATTRIBUTE = "data-vf-route-head";\nvar HEAD_SHELL_PROVENANCE_ATTRIBUTE = "data-vf-shell-head";\nvar HEAD_SSR_PAYLOAD_ATTRIBUTE = "data-vf-ssr-head";\nvar MAX_MANAGED_HEAD_ENTRIES = 128;\nvar MAX_MANAGED_HEAD_BYTES = 2 * 1024 * 1024;\nvar REACT_HEAD_ATTRIBUTE_NAMES = {\n  charSet: "charset",\n  className: "class",\n  crossOrigin: "crossorigin",\n  fetchPriority: "fetchpriority",\n  htmlFor: "for",\n  httpEquiv: "http-equiv",\n  imageSizes: "imagesizes",\n  imageSrcSet: "imagesrcset",\n  noModule: "nomodule",\n  referrerPolicy: "referrerpolicy"\n};\nvar SINGLETON_META_KEYS = /* @__PURE__ */ new Set([\n  "description",\n  "robots",\n  "viewport",\n  "referrer",\n  "color-scheme",\n  "application-name",\n  "generator",\n  "og:title",\n  "og:description",\n  "og:url",\n  "og:type",\n  "og:site_name",\n  "og:locale",\n  "twitter:card",\n  "twitter:site",\n  "twitter:creator",\n  "twitter:title",\n  "twitter:description",\n  "twitter:image",\n  "twitter:image:alt"\n]);\nvar SINGLETON_LINK_RELS = /* @__PURE__ */ new Set([\n  "canonical",\n  "manifest",\n  "amphtml"\n]);\nvar SUPPORTED_MANAGED_HEAD_TAGS = /* @__PURE__ */ new Set([\n  "title",\n  "meta",\n  "link",\n  "style",\n  "script"\n]);\nvar HEAD_ATTRIBUTE_NAME_PATTERN = /^[A-Za-z_:][A-Za-z0-9_.:-]*$/;\nvar MAX_HEAD_PROP_ENTRIES = 128;\nvar MAX_HEAD_ATTRIBUTE_NAME_BYTES = 256;\nvar MAX_HEAD_ATTRIBUTE_VALUE_BYTES = 64 * 1024;\nvar MAX_HEAD_ATTRIBUTE_BYTES = 1024 * 1024;\nvar MAX_HEAD_CONTENT_BYTES = 1024 * 1024;\nvar headTextEncoder = new TextEncoder();\nvar BOOLEAN_HEAD_ATTRIBUTES = /* @__PURE__ */ new Set([\n  "async",\n  "defer",\n  "disabled",\n  "itemscope",\n  "nomodule"\n]);\nfunction isHeadFrameworkAttribute(name) {\n  switch (name.toLowerCase()) {\n    case HEAD_PROVENANCE_ATTRIBUTE:\n    case HEAD_LEGACY_MANAGED_ATTRIBUTE:\n    case HEAD_CONTENT_HASH_ATTRIBUTE:\n    case HEAD_REACT_MANAGED_ATTRIBUTE:\n    case HEAD_REACT_OWNER_ATTRIBUTE:\n    case HEAD_ROUTE_MANAGED_ATTRIBUTE:\n    case HEAD_SHELL_PROVENANCE_ATTRIBUTE:\n    case HEAD_SSR_PAYLOAD_ATTRIBUTE:\n      return true;\n    default:\n      return false;\n  }\n}\nfunction normalizeHeadIdentityValue(value) {\n  const normalized = value?.trim().toLowerCase();\n  return normalized || void 0;\n}\nfunction readOwnString(record, key) {\n  try {\n    const descriptor = Reflect.getOwnPropertyDescriptor(record, key);\n    return descriptor && !descriptor.get && !descriptor.set && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : void 0;\n  } catch {\n    return void 0;\n  }\n}\nfunction headMetaSingletonKeyFromRecord(meta) {\n  if (readOwnString(meta, "charset") !== void 0) return "meta:charset";\n  const key = normalizeHeadIdentityValue(\n    readOwnString(meta, "property") ?? readOwnString(meta, "name")\n  );\n  if (!key) return void 0;\n  if (key === "theme-color") {\n    return `meta:theme-color:${readOwnString(meta, "media")?.trim() ?? ""}`;\n  }\n  return SINGLETON_META_KEYS.has(key) ? `meta:${key}` : void 0;\n}\nfunction headLinkSingletonKeyFromRecord(link) {\n  const rel = normalizeHeadIdentityValue(readOwnString(link, "rel"));\n  return rel && SINGLETON_LINK_RELS.has(rel) ? `link:${rel}` : void 0;\n}\nfunction normalizeManagedHeadString(value) {\n  return value.replace(/\\r\\n?/g, "\\n");\n}\nfunction inspectHeadProps(value) {\n  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;\n  let prototype;\n  let keys;\n  try {\n    prototype = Object.getPrototypeOf(value);\n    keys = Reflect.ownKeys(value);\n  } catch {\n    return null;\n  }\n  if (prototype !== Object.prototype && prototype !== null) return null;\n  const inspected = /* @__PURE__ */ new Map();\n  let entries = 0;\n  for (const key of keys) {\n    let descriptor;\n    try {\n      descriptor = Reflect.getOwnPropertyDescriptor(value, key);\n    } catch {\n      return null;\n    }\n    if (!descriptor) return null;\n    if (!descriptor.enumerable) continue;\n    if (typeof key !== "string" || descriptor.get || descriptor.set || !("value" in descriptor)) {\n      return null;\n    }\n    entries++;\n    if (entries > MAX_HEAD_PROP_ENTRIES) return null;\n    inspected.set(key, descriptor.value);\n  }\n  return inspected;\n}\nfunction normalizeContentPrimitive(value) {\n  if (value === null || value === void 0 || typeof value === "boolean") return void 0;\n  if (typeof value !== "string" && typeof value !== "number" && typeof value !== "bigint") {\n    return null;\n  }\n  const content = normalizeManagedHeadString(String(value));\n  return headTextEncoder.encode(content).byteLength <= MAX_HEAD_CONTENT_BYTES ? content : null;\n}\nfunction normalizeManagedHeadAttributesFromProps(tagName, props, ambientNonce, excludedKeys = /* @__PURE__ */ new Set()) {\n  const attributeMap = /* @__PURE__ */ new Map();\n  for (const [key, value] of props) {\n    if (key === "children" || key === "dangerouslySetInnerHTML" || excludedKeys.has(key)) {\n      continue;\n    }\n    if (/^on/i.test(key) || typeof value === "function" || typeof value === "symbol" || typeof value === "object") {\n      continue;\n    }\n    const name = (REACT_HEAD_ATTRIBUTE_NAMES[key] ?? key).toLowerCase();\n    if (isHeadFrameworkAttribute(name) || !HEAD_ATTRIBUTE_NAME_PATTERN.test(name) || headTextEncoder.encode(name).byteLength > MAX_HEAD_ATTRIBUTE_NAME_BYTES) {\n      continue;\n    }\n    if (BOOLEAN_HEAD_ATTRIBUTES.has(name)) {\n      if (value !== false && value !== void 0) attributeMap.set(name, "");\n      continue;\n    }\n    if (typeof value === "boolean") {\n      if (name.startsWith("data-") || name.startsWith("aria-")) {\n        attributeMap.set(name, String(value));\n      }\n      continue;\n    }\n    if (value === void 0) continue;\n    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "bigint") {\n      continue;\n    }\n    const normalizedValue = normalizeManagedHeadString(String(value));\n    if (headTextEncoder.encode(normalizedValue).byteLength > MAX_HEAD_ATTRIBUTE_VALUE_BYTES) {\n      return null;\n    }\n    attributeMap.set(name, normalizedValue);\n  }\n  if ((tagName === "script" || tagName === "style") && ambientNonce) {\n    const nonce = normalizeManagedHeadString(ambientNonce);\n    if (headTextEncoder.encode(nonce).byteLength > MAX_HEAD_ATTRIBUTE_VALUE_BYTES) return null;\n    attributeMap.set("nonce", nonce);\n  }\n  if (tagName === "link" && attributeMap.get("rel")?.trim().toLowerCase() === "preload" && attributeMap.get("as")?.trim().toLowerCase() === "font" && !attributeMap.has("crossorigin")) {\n    attributeMap.set("crossorigin", "anonymous");\n  }\n  if (attributeMap.size > MAX_HEAD_PROP_ENTRIES) return null;\n  let totalBytes = 0;\n  for (const [name, value] of attributeMap) {\n    totalBytes += headTextEncoder.encode(name).byteLength + headTextEncoder.encode(value).byteLength;\n    if (totalBytes > MAX_HEAD_ATTRIBUTE_BYTES) return null;\n  }\n  return [...attributeMap.entries()].sort(([left], [right]) => left.localeCompare(right));\n}\nfunction singletonKey(tagName, attributes) {\n  if (tagName === "title") return "title";\n  const record = Object.fromEntries(attributes);\n  if (tagName === "meta") return headMetaSingletonKeyFromRecord(record);\n  if (tagName === "link") return headLinkSingletonKeyFromRecord(record);\n  return void 0;\n}\nfunction scriptKeys(tagName, attributes) {\n  if (tagName !== "script") return [];\n  const keys = [];\n  const id = attributes.get("id");\n  const src = attributes.get("src");\n  if (id) keys.push(`script:id:${id}`);\n  if (src) keys.push(`script:src:${src}`);\n  return keys;\n}\nfunction declaresDocumentEncoding(attributes) {\n  return attributes.has("charset") || attributes.get("http-equiv")?.trim().toLowerCase() === "content-type";\n}\nfunction createManagedHeadDescriptor(tagName, attributes, content, contentMode) {\n  const attributeMap = new Map(attributes);\n  return {\n    tagName,\n    attributes,\n    ...content !== void 0 && { content },\n    contentMode,\n    signature: JSON.stringify([\n      tagName,\n      attributes,\n      contentMode,\n      content ?? null\n    ]),\n    singletonKey: singletonKey(tagName, attributeMap),\n    scriptKeys: scriptKeys(tagName, attributeMap)\n  };\n}\nfunction descriptorFromManagedHeadRecord(rawTagName, record, options = {}) {\n  const tagName = rawTagName.toLowerCase();\n  if (!SUPPORTED_MANAGED_HEAD_TAGS.has(tagName)) return null;\n  const inspected = inspectHeadProps(record);\n  if (!inspected) return null;\n  const excludedKeys = options.contentProperty ? /* @__PURE__ */ new Set([options.contentProperty]) : /* @__PURE__ */ new Set();\n  const attributes = normalizeManagedHeadAttributesFromProps(\n    tagName,\n    inspected,\n    options.ambientNonce,\n    excludedKeys\n  );\n  if (!attributes) return null;\n  const attributeMap = new Map(attributes);\n  if (tagName === "meta" && declaresDocumentEncoding(attributeMap)) return null;\n  if ((tagName === "meta" || tagName === "link") && attributes.length === 0) return null;\n  let content;\n  if (options.contentProperty) {\n    const normalized = normalizeContentPrimitive(inspected.get(options.contentProperty));\n    if (normalized === null) return null;\n    content = normalized;\n  }\n  return createManagedHeadDescriptor(tagName, attributes, content, "text");\n}\nfunction headScriptKeysIntersect(left, right) {\n  if (left.length === 0 || right.length === 0) return false;\n  const rightKeys = new Set(right);\n  return left.some((key) => rightKeys.has(key));\n}\nfunction aggregateManagedHeadDescriptors(descriptors) {\n  const aggregated = [];\n  const singletonIndexes = /* @__PURE__ */ new Map();\n  const scriptKeysSeen = /* @__PURE__ */ new Set();\n  for (const descriptor of descriptors) {\n    if (descriptor.singletonKey) {\n      const index = singletonIndexes.get(descriptor.singletonKey);\n      if (index !== void 0) {\n        aggregated[index] = descriptor;\n        continue;\n      }\n      singletonIndexes.set(descriptor.singletonKey, aggregated.length);\n    } else if (descriptor.scriptKeys.length > 0) {\n      if (descriptor.scriptKeys.some((key) => scriptKeysSeen.has(key))) continue;\n      for (const key of descriptor.scriptKeys) scriptKeysSeen.add(key);\n    }\n    aggregated.push(descriptor);\n  }\n  return aggregated;\n}\nfunction managedHeadDescriptorBytes(descriptor) {\n  let bytes = headTextEncoder.encode(descriptor.tagName).byteLength;\n  for (const [name, value] of descriptor.attributes) {\n    bytes += headTextEncoder.encode(name).byteLength;\n    bytes += headTextEncoder.encode(value).byteLength;\n  }\n  if (descriptor.content !== void 0) {\n    bytes += headTextEncoder.encode(descriptor.content).byteLength;\n  }\n  return bytes;\n}\nfunction assertManagedHeadDescriptorBudget(descriptors) {\n  if (descriptors.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError(\n      `Managed head exceeds the ${MAX_MANAGED_HEAD_ENTRIES}-entry request limit`\n    );\n  }\n  let bytes = 0;\n  for (const descriptor of descriptors) {\n    bytes += managedHeadDescriptorBytes(descriptor);\n    if (bytes > MAX_MANAGED_HEAD_BYTES) {\n      throw new TypeError(\n        `Managed head exceeds the ${MAX_MANAGED_HEAD_BYTES}-byte request limit`\n      );\n    }\n  }\n}\nfunction managedHeadDescriptorToTransportEntry(descriptor) {\n  const attributes = descriptor.attributes.filter(([name]) => name !== "nonce");\n  return {\n    tagName: descriptor.tagName,\n    attributes: attributes.map(([name, value]) => [name, value]),\n    ...descriptor.content !== void 0 && { content: descriptor.content }\n  };\n}\nfunction ownTransportValue(record, key) {\n  let descriptor;\n  try {\n    descriptor = Reflect.getOwnPropertyDescriptor(record, key);\n  } catch {\n    return void 0;\n  }\n  if (!descriptor || descriptor.get || descriptor.set || !("value" in descriptor)) {\n    return void 0;\n  }\n  return descriptor.value;\n}\nfunction descriptorFromManagedHeadTransportEntry(entry, ambientNonce) {\n  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {\n    throw new TypeError("Managed-head transport entries must be plain objects");\n  }\n  let prototype;\n  try {\n    prototype = Object.getPrototypeOf(entry);\n  } catch {\n    throw new TypeError("Managed-head transport entry cannot be inspected");\n  }\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError("Managed-head transport entries must be plain objects");\n  }\n  const tagName = ownTransportValue(entry, "tagName");\n  const rawAttributes = ownTransportValue(entry, "attributes");\n  const content = ownTransportValue(entry, "content");\n  if (typeof tagName !== "string" || tagName !== tagName.toLowerCase() || !Array.isArray(rawAttributes)) {\n    throw new TypeError("Managed-head transport entry is not canonical");\n  }\n  if (rawAttributes.length > MAX_HEAD_PROP_ENTRIES) {\n    throw new TypeError("Managed-head transport entry exceeds the attribute limit");\n  }\n  if (content !== void 0 && typeof content !== "string") {\n    throw new TypeError("Managed-head transport content must be a string");\n  }\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (!supportsText && content !== void 0) {\n    throw new TypeError("Managed-head transport content is invalid for this tag");\n  }\n  const record = /* @__PURE__ */ Object.create(null);\n  const inputAttributes = [];\n  const names = /* @__PURE__ */ new Set();\n  for (let index = 0; index < rawAttributes.length; index += 1) {\n    const pair = ownTransportValue(rawAttributes, String(index));\n    if (!Array.isArray(pair) || pair.length !== 2) {\n      throw new TypeError("Managed-head transport attributes must be string pairs");\n    }\n    const name = ownTransportValue(pair, "0");\n    const value = ownTransportValue(pair, "1");\n    if (typeof name !== "string" || typeof value !== "string") {\n      throw new TypeError("Managed-head transport attributes must be string pairs");\n    }\n    const normalizedName = name.toLowerCase();\n    if (name !== normalizedName || normalizedName === "nonce" || names.has(normalizedName)) {\n      throw new TypeError("Managed-head transport attributes are not canonical");\n    }\n    names.add(normalizedName);\n    inputAttributes.push([normalizedName, value]);\n    Object.defineProperty(record, normalizedName, {\n      enumerable: true,\n      value\n    });\n  }\n  if (content !== void 0) {\n    Object.defineProperty(record, "__veryfront_transport_content", {\n      enumerable: true,\n      value: content\n    });\n  }\n  const descriptor = descriptorFromManagedHeadRecord(tagName, record, {\n    ...supportsText && { contentProperty: "__veryfront_transport_content" },\n    ...(tagName === "script" || tagName === "style") && ambientNonce ? { ambientNonce } : {}\n  });\n  const normalizedInput = inputAttributes.sort(([left], [right]) => left.localeCompare(right));\n  const normalizedOutput = descriptor?.attributes.filter(([name]) => name !== "nonce");\n  if (!descriptor || JSON.stringify(normalizedOutput) !== JSON.stringify(normalizedInput) || supportsText && (descriptor.content ?? "") !== (content ?? "")) {\n    throw new TypeError("Managed-head transport entry failed validation");\n  }\n  return descriptor;\n}\nvar BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";\nfunction decodeBase64Url(value) {\n  if (value.length % 4 === 1 || !/^[A-Za-z0-9_-]*$/.test(value)) {\n    throw new TypeError("Managed-head payload is not valid base64url");\n  }\n  const estimatedBytes = Math.floor(value.length * 3 / 4);\n  if (estimatedBytes > MAX_MANAGED_HEAD_BYTES * 2) {\n    throw new TypeError("Managed-head payload exceeds its encoded size limit");\n  }\n  const bytes = new Uint8Array(estimatedBytes);\n  let outputIndex = 0;\n  let buffer = 0;\n  let bits = 0;\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n    if (decoded < 0) throw new TypeError("Managed-head payload is not valid base64url");\n    buffer = buffer << 6 | decoded;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes[outputIndex++] = buffer >> bits & 255;\n      buffer &= bits === 0 ? 0 : (1 << bits) - 1;\n    }\n  }\n  if (bits > 0 && buffer !== 0) {\n    throw new TypeError("Managed-head payload has non-canonical trailing bits");\n  }\n  return bytes.subarray(0, outputIndex);\n}\nfunction deserializeManagedHeadPayload(payload, ambientNonce) {\n  if (typeof payload !== "string") throw new TypeError("Managed-head payload must be a string");\n  let decoded;\n  try {\n    decoded = new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(payload));\n  } catch (error) {\n    if (error instanceof TypeError) throw error;\n    throw new TypeError("Managed-head payload is not valid UTF-8", { cause: error });\n  }\n  let entries;\n  try {\n    entries = JSON.parse(decoded);\n  } catch (error) {\n    throw new TypeError("Managed-head payload is not valid JSON", { cause: error });\n  }\n  if (!Array.isArray(entries) || entries.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError("Managed-head payload exceeds the entry limit");\n  }\n  const descriptors = aggregateManagedHeadDescriptors(\n    entries.map((entry) => descriptorFromManagedHeadTransportEntry(entry, ambientNonce))\n  );\n  assertManagedHeadDescriptorBudget(descriptors);\n  return descriptors;\n}\n\n// src/html/client-head-manager.ts\nvar HEAD_MANAGER_STATE_SYMBOL = /* @__PURE__ */ Symbol.for(\n  "veryfront.client-head-manager.v2"\n);\nvar CROSS_PAGE_PRESERVED_SINGLETON_KEYS = /* @__PURE__ */ new Set([\n  "meta:viewport",\n  "link:manifest"\n]);\nfunction getClientHeadManagerState() {\n  const globalState = globalThis;\n  return globalState[HEAD_MANAGER_STATE_SYMBOL] ?? (globalState[HEAD_MANAGER_STATE_SYMBOL] = {\n    documents: /* @__PURE__ */ new WeakMap()\n  });\n}\nfunction getManagedHeadNonce(targetDocument) {\n  if (typeof targetDocument.querySelector !== "function") return void 0;\n  const element = targetDocument.querySelector(\n    "script[nonce], style[nonce], link[nonce]"\n  );\n  if (!element) return void 0;\n  const nonce = element.nonce || element.getAttribute("nonce") || "";\n  return nonce || void 0;\n}\nfunction readElementAttributes(element) {\n  const attributes = [];\n  for (const attribute of element.attributes) {\n    const name = attribute.name.toLowerCase();\n    if (isHeadFrameworkAttribute(name)) continue;\n    const nonce = name === "nonce" && "nonce" in element ? element.nonce : "";\n    const value = BOOLEAN_HEAD_ATTRIBUTES.has(name) ? "" : nonce || attribute.value;\n    attributes.push([name, value]);\n  }\n  return attributes.sort(([left], [right]) => left.localeCompare(right));\n}\nfunction elementSingletonKey(element) {\n  const tagName = element.tagName.toLowerCase();\n  if (tagName === "title") return "title";\n  const attributes = Object.fromEntries(readElementAttributes(element));\n  if (tagName === "meta") return headMetaSingletonKeyFromRecord(attributes);\n  if (tagName === "link") return headLinkSingletonKeyFromRecord(attributes);\n  return void 0;\n}\nfunction promoteToShellHeadBaseline(element) {\n  for (const attribute of [...element.attributes]) {\n    if (isHeadFrameworkAttribute(attribute.name)) {\n      element.removeAttribute(attribute.name);\n    }\n  }\n  element.setAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE, "true");\n}\nfunction isCrossPagePreservedSingleton(element, singletonKey2 = elementSingletonKey(element)) {\n  return element.parentElement !== null && singletonKey2 !== void 0 && CROSS_PAGE_PRESERVED_SINGLETON_KEYS.has(singletonKey2);\n}\nfunction isFrameworkOwnedHeadElement(element) {\n  return element.getAttribute(HEAD_PROVENANCE_ATTRIBUTE) === "true" || element.getAttribute(HEAD_REACT_MANAGED_ATTRIBUTE) === "true" || element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1" || element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true" || element.getAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE) === "true";\n}\nfunction retireFrameworkHeadElement(element) {\n  if (isCrossPagePreservedSingleton(element)) {\n    promoteToShellHeadBaseline(element);\n    return;\n  }\n  element.remove();\n}\nfunction retireClientHeadOwnership(targetDocument) {\n  const manager = getClientHeadManagerState().documents.get(targetDocument);\n  if (manager) {\n    manager.retire();\n    return;\n  }\n  for (const element of [...targetDocument.head?.children ?? []]) {\n    if (isFrameworkOwnedHeadElement(element)) retireFrameworkHeadElement(element);\n  }\n}\n\n// src/html/client-route-head.ts\nvar ROUTE_HEAD_CONTENT_PROPERTY = "__veryfront_route_head_content";\nfunction descriptorFromHeadElement(element) {\n  const record = /* @__PURE__ */ Object.create(null);\n  for (const { name, value } of element.attributes) {\n    if (!isHeadFrameworkAttribute(name)) record[name] = value;\n  }\n  const tagName = element.tagName.toLowerCase();\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (supportsText) record[ROUTE_HEAD_CONTENT_PROPERTY] = element.textContent ?? "";\n  return descriptorFromManagedHeadRecord(\n    tagName,\n    record,\n    supportsText ? { contentProperty: ROUTE_HEAD_CONTENT_PROPERTY } : void 0\n  );\n}\nfunction writeRouteDescriptor(element, descriptor) {\n  for (const attribute of [...element.attributes]) element.removeAttribute(attribute.name);\n  for (const [name, value] of descriptor.attributes) element.setAttribute(name, value);\n  element.textContent = descriptor.content ?? "";\n  element.setAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE, "1");\n  element.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n}\nfunction prepareClientRouteHeadEntries(entries, targetDocument = document) {\n  if (entries === void 0) return [];\n  if (!Array.isArray(entries) || entries.length > MAX_MANAGED_HEAD_ENTRIES) {\n    throw new TypeError("Route head payload exceeds the entry limit");\n  }\n  const descriptors = aggregateManagedHeadDescriptors(\n    entries.map(\n      (entry) => descriptorFromManagedHeadTransportEntry(entry, getManagedHeadNonce(targetDocument))\n    )\n  );\n  assertManagedHeadDescriptorBudget(descriptors);\n  return descriptors;\n}\nfunction applyPreparedClientRouteHeadDescriptors(descriptors, targetDocument = document) {\n  for (const descriptor of descriptors) {\n    const described = [...targetDocument.head.children].flatMap((element2) => {\n      const current = descriptorFromHeadElement(element2);\n      return current ? [{ element: element2, descriptor: current }] : [];\n    });\n    if (descriptor.singletonKey) {\n      const matches = described.filter(\n        ({ descriptor: current }) => current.singletonKey === descriptor.singletonKey\n      );\n      const directive = matches.find(\n        ({ element: element2 }) => element2.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1"\n      );\n      if (directive) {\n        continue;\n      }\n      const reusable = matches.find(\n        ({ element: element2 }) => element2.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true" || element2.getAttribute(HEAD_SHELL_PROVENANCE_ATTRIBUTE) === "true"\n      );\n      if (reusable) {\n        writeRouteDescriptor(reusable.element, descriptor);\n        continue;\n      }\n    }\n    if (described.some(\n      ({ descriptor: current }) => current.signature === descriptor.signature || headScriptKeysIntersect(current.scriptKeys, descriptor.scriptKeys)\n    )) {\n      continue;\n    }\n    const element = targetDocument.createElement(descriptor.tagName);\n    writeRouteDescriptor(element, descriptor);\n    targetDocument.head.appendChild(element);\n  }\n}\nfunction updateRouteTitle(title, targetDocument = document) {\n  if (typeof title !== "string" || !title) return;\n  const titles = [...targetDocument.head.querySelectorAll("title")];\n  if (titles.some((element) => element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1")) {\n    return;\n  }\n  let titleElement = titles.find(\n    (element) => element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true"\n  );\n  for (const element of titles) {\n    if (element !== titleElement) element.remove();\n  }\n  if (!titleElement) {\n    titleElement = targetDocument.createElement("title");\n    titleElement.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(titleElement);\n  }\n  titleElement.textContent = title;\n}\nfunction updateRouteMetaTag(targetDocument, selector, attributeName, attributeValue, content) {\n  const matches = [...targetDocument.head.querySelectorAll(selector)];\n  if (matches.some((element) => element.getAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE) === "1")) {\n    return;\n  }\n  let metaTag = matches.find(\n    (element) => element.getAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE) === "true"\n  );\n  if (!metaTag) {\n    metaTag = targetDocument.createElement("meta");\n    metaTag.setAttribute(attributeName, attributeValue);\n    metaTag.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(metaTag);\n  }\n  metaTag.setAttribute("content", content);\n}\nfunction updateRouteMetaTags(metadata, targetDocument = document) {\n  if (typeof metadata.description === "string" && metadata.description) {\n    updateRouteMetaTag(\n      targetDocument,\n      \'meta[name="description"]\',\n      "name",\n      "description",\n      metadata.description\n    );\n  }\n  if (typeof metadata.ogTitle === "string" && metadata.ogTitle) {\n    updateRouteMetaTag(\n      targetDocument,\n      \'meta[property="og:title"]\',\n      "property",\n      "og:title",\n      metadata.ogTitle\n    );\n  }\n}\n\n// src/routing/client/dom-utils.ts\nvar logger2 = rendererLogger.component("veryfront");\nvar PARSED_ROUTE_HEAD_CONTENT_PROPERTY = "__veryfront_parsed_route_head_content";\nfunction isInternalLink(target) {\n  const href = target.getAttribute("href");\n  if (!href) return false;\n  if (href.startsWith("http") || href.startsWith("mailto:") || href.startsWith("#")) return false;\n  const linkTarget = target.getAttribute("target");\n  if (linkTarget === "_blank" || target.hasAttribute("download")) return false;\n  return true;\n}\nfunction findAnchorElement(element) {\n  let current = element;\n  while (current && current.tagName !== "A") {\n    current = current.parentElement;\n  }\n  return current instanceof HTMLAnchorElement ? current : null;\n}\nfunction applyHeadDirectives(container) {\n  const targetDocument = container.ownerDocument ?? document;\n  const nodes = [...container.querySelectorAll(\'[data-veryfront-head="1"], vf-head\')].filter(\n    (node) => typeof node.getAttribute !== "function" || node.getAttribute(HEAD_REACT_OWNER_ATTRIBUTE) !== "1"\n  );\n  if (!nodes.length) return;\n  retireClientHeadOwnership(targetDocument);\n  cleanManagedHeadTags(targetDocument);\n  for (const wrapper of nodes) {\n    const TemplateElement = targetDocument.defaultView?.HTMLTemplateElement ?? globalThis.HTMLTemplateElement;\n    const contentSource = TemplateElement && wrapper instanceof TemplateElement ? wrapper.content : wrapper;\n    processHeadWrapper(contentSource, targetDocument);\n    wrapper.parentElement?.removeChild(wrapper);\n  }\n}\nfunction cleanManagedHeadTags(targetDocument) {\n  for (const element of targetDocument.head.querySelectorAll(\n    `[${HEAD_LEGACY_MANAGED_ATTRIBUTE}="1"]`\n  )) {\n    element.parentElement?.removeChild(element);\n  }\n}\nfunction processHeadWrapper(wrapper, targetDocument) {\n  const ElementConstructor = targetDocument.defaultView?.Element ?? globalThis.Element;\n  const activeNonce = getManagedHeadNonce(targetDocument);\n  for (const node of wrapper.childNodes) {\n    if (!ElementConstructor || !(node instanceof ElementConstructor)) continue;\n    const tagName = node.tagName.toLowerCase();\n    if (headSingletonKey(node) === "meta:charset") continue;\n    const clone = targetDocument.createElement(tagName);\n    for (const { name, value } of node.attributes) {\n      if (name.toLowerCase() !== "nonce") clone.setAttribute(name, value);\n    }\n    if (activeNonce && (tagName === "script" || tagName === "style" || tagName === "link")) {\n      clone.setAttribute("nonce", activeNonce);\n    }\n    if (node.textContent && !clone.hasAttribute("src")) {\n      clone.textContent = node.textContent;\n    }\n    replaceExistingHeadSingleton(targetDocument, clone);\n    clone.setAttribute(HEAD_LEGACY_MANAGED_ATTRIBUTE, "1");\n    clone.setAttribute(HEAD_ROUTE_MANAGED_ATTRIBUTE, "true");\n    targetDocument.head.appendChild(clone);\n  }\n}\nfunction headSingletonKey(element) {\n  const tagName = element.tagName.toLowerCase();\n  if (tagName === "title") return "title";\n  if (tagName !== "meta" && tagName !== "link") return void 0;\n  const attributes = /* @__PURE__ */ Object.create(null);\n  if (!element.attributes) return void 0;\n  for (const { name, value } of element.attributes) attributes[name.toLowerCase()] = value;\n  if (tagName === "meta" && attributes["http-equiv"]?.trim().toLowerCase() === "content-type") {\n    return "meta:charset";\n  }\n  return tagName === "meta" ? headMetaSingletonKeyFromRecord(attributes) : headLinkSingletonKeyFromRecord(attributes);\n}\nfunction replaceExistingHeadSingleton(targetDocument, replacement) {\n  const singletonKey2 = headSingletonKey(replacement);\n  if (!singletonKey2 || singletonKey2 === "meta:charset") return;\n  for (const existing of [...targetDocument.head?.children ?? []]) {\n    if (headSingletonKey(existing) === singletonKey2) existing.remove();\n  }\n}\nfunction manageFocus(container) {\n  try {\n    const focusElement = container.querySelector("[data-router-focus]") || container.querySelector("main") || container.querySelector("h1");\n    focusElement?.focus?.({ preventScroll: true });\n  } catch (error) {\n    logger2.warn("focus management failed", error);\n  }\n}\nfunction extractPageDataFromScript() {\n  const pageDataScript = document.querySelector("script[data-veryfront-page]");\n  if (!pageDataScript) return null;\n  try {\n    const content = pageDataScript.textContent;\n    if (!content) {\n      logger2.warn("Page data script has no content");\n      return {};\n    }\n    return JSON.parse(content);\n  } catch (error) {\n    logger2.error("Failed to parse page data:", error);\n    return null;\n  }\n}\nfunction descriptorFromDocumentHeadElement(element) {\n  const tagName = element.tagName.toLowerCase();\n  const record = /* @__PURE__ */ Object.create(null);\n  for (const { name, value } of element.attributes) {\n    if (!isHeadFrameworkAttribute(name) && name.toLowerCase() !== "nonce") {\n      record[name.toLowerCase()] = value;\n    }\n  }\n  const supportsText = tagName === "title" || tagName === "script" || tagName === "style";\n  if (supportsText) record[PARSED_ROUTE_HEAD_CONTENT_PROPERTY] = element.textContent ?? "";\n  return descriptorFromManagedHeadRecord(tagName, record, {\n    ...supportsText && { contentProperty: PARSED_ROUTE_HEAD_CONTENT_PROPERTY }\n  });\n}\nfunction payloadDescriptors(root) {\n  if (!root || typeof root.querySelectorAll !== "function") return [];\n  const descriptors = [];\n  for (const element of root.querySelectorAll(`[${HEAD_SSR_PAYLOAD_ATTRIBUTE}]`)) {\n    if (element.getAttribute(HEAD_REACT_OWNER_ATTRIBUTE) !== "1") continue;\n    const payload = element.getAttribute(HEAD_SSR_PAYLOAD_ATTRIBUTE);\n    if (payload) descriptors.push(...deserializeManagedHeadPayload(payload));\n  }\n  return descriptors;\n}\nfunction snapshotClientRouteHead(targetDocument = document) {\n  const descriptors = [];\n  let hasStructuredPayload = false;\n  const hydrationDataScript = targetDocument.getElementById("veryfront-hydration-data");\n  if (hydrationDataScript?.textContent) {\n    try {\n      const hydrationData = JSON.parse(hydrationDataScript.textContent);\n      if (typeof hydrationData.managedHeadPayload === "string") {\n        descriptors.push(...deserializeManagedHeadPayload(hydrationData.managedHeadPayload));\n        hasStructuredPayload = true;\n      }\n    } catch {\n    }\n  }\n  const committedDescriptors = payloadDescriptors(targetDocument.getElementById("root"));\n  descriptors.push(...committedDescriptors);\n  const fallbackSelector = [\n    ...committedDescriptors.length === 0 ? [`[${HEAD_PROVENANCE_ATTRIBUTE}="true"]`] : [],\n    ...!hasStructuredPayload ? [`[${HEAD_SHELL_PROVENANCE_ATTRIBUTE}="true"]`] : []\n  ].join(", ");\n  if (fallbackSelector && targetDocument.head?.querySelectorAll) {\n    for (const element of targetDocument.head.querySelectorAll(fallbackSelector)) {\n      const descriptor = descriptorFromDocumentHeadElement(element);\n      if (descriptor) descriptors.push(descriptor);\n    }\n  }\n  const aggregated = aggregateManagedHeadDescriptors(descriptors);\n  assertManagedHeadDescriptorBudget(aggregated);\n  return aggregated.map(managedHeadDescriptorToTransportEntry);\n}\nfunction parsePageDataFromHTML(html) {\n  const doc = new DOMParser().parseFromString(html, "text/html");\n  const root = doc.getElementById("root");\n  if (!root) logger2.warn("[Veryfront] No root element found in HTML");\n  const content = root?.innerHTML ?? "";\n  const pageDataScript = doc.querySelector("script[data-veryfront-page]");\n  let pageData = {};\n  if (pageDataScript) {\n    try {\n      const scriptContent = pageDataScript.textContent;\n      if (!scriptContent) {\n        logger2.warn("Page data script in HTML has no content");\n      } else {\n        pageData = JSON.parse(scriptContent);\n      }\n    } catch (error) {\n      logger2.error("Failed to parse page data from HTML:", error);\n    }\n  }\n  let dependencyPinningCacheKey;\n  const hydrationDataScript = doc.getElementById("veryfront-hydration-data");\n  if (hydrationDataScript?.textContent) {\n    try {\n      const hydrationData = JSON.parse(hydrationDataScript.textContent);\n      if (typeof hydrationData.dependencyPinningCacheKey === "string") {\n        dependencyPinningCacheKey = hydrationData.dependencyPinningCacheKey;\n      }\n    } catch (error) {\n      logger2.error("Failed to parse hydration data from HTML:", error);\n    }\n  }\n  const managedHead = snapshotClientRouteHead(doc);\n  if (managedHead.some((entry) => entry.tagName === "script") || typeof root?.querySelector === "function" && root.querySelector("script")) {\n    pageData = { ...pageData, requiresFullDocumentNavigation: true };\n  }\n  return { content, pageData, managedHead, dependencyPinningCacheKey };\n}\n\n// src/rendering/client/browser-stubs/config.ts\nvar DEFAULT_PREFETCH_DELAY_MS = 100;\nvar PAGE_TRANSITION_DELAY_MS = 150;\n\n// src/routing/client/navigation-handlers.ts\nvar logger3 = rendererLogger.component("veryfront");\nvar MAX_SCROLL_POSITIONS = 100;\nvar NavigationHandlers = class {\n  constructor(prefetchDelay = DEFAULT_PREFETCH_DELAY_MS, prefetchOptions = {}) {\n    __publicField(this, "prefetchQueue", /* @__PURE__ */ new Set());\n    __publicField(this, "pendingTimeouts", /* @__PURE__ */ new Map());\n    __publicField(this, "scrollPositions", /* @__PURE__ */ new Map());\n    __publicField(this, "isPopStateNav", false);\n    __publicField(this, "prefetchDelay");\n    __publicField(this, "prefetchOptions");\n    this.prefetchDelay = prefetchDelay;\n    this.prefetchOptions = prefetchOptions;\n  }\n  createClickHandler(callbacks) {\n    return (event) => {\n      if (!(event.target instanceof HTMLElement)) return;\n      const anchor = findAnchorElement(event.target);\n      if (!anchor || !isInternalLink(anchor)) return;\n      const href = anchor.getAttribute("href");\n      if (!href) return;\n      event.preventDefault();\n      callbacks.onNavigate(href);\n    };\n  }\n  createPopStateHandler(callbacks) {\n    return (_event) => {\n      this.isPopStateNav = true;\n      const { pathname, search, hash } = globalThis.location;\n      callbacks.onNavigate(`${pathname}${search}${hash}`);\n    };\n  }\n  createMouseOverHandler(callbacks) {\n    return (event) => {\n      if (!(event.target instanceof HTMLElement)) return;\n      if (event.target.tagName !== "A") return;\n      const href = event.target.getAttribute("href");\n      if (!href || href.startsWith("http") || href.startsWith("#")) return;\n      if (!this.shouldPrefetchOnHover(event.target)) return;\n      if (this.prefetchQueue.has(href)) return;\n      this.prefetchQueue.add(href);\n      const timeoutId = setTimeout(() => {\n        callbacks.onPrefetch(href);\n        this.prefetchQueue.delete(href);\n        this.pendingTimeouts.delete(href);\n      }, this.prefetchDelay);\n      this.pendingTimeouts.set(href, timeoutId);\n    };\n  }\n  shouldPrefetchOnHover(target) {\n    const prefetchAttribute = target.getAttribute("data-prefetch");\n    if (prefetchAttribute === "false") return false;\n    if (prefetchAttribute === "true") return true;\n    return Boolean(this.prefetchOptions.hover);\n  }\n  saveScrollPosition(path) {\n    try {\n      if (this.scrollPositions.size >= MAX_SCROLL_POSITIONS) {\n        const oldest = this.scrollPositions.keys().next().value;\n        if (oldest) this.scrollPositions.delete(oldest);\n      }\n      const scrollY = globalThis.scrollY;\n      if (typeof scrollY !== "number") {\n        logger3.debug("No valid scrollY value available");\n        this.scrollPositions.set(path, 0);\n        return;\n      }\n      this.scrollPositions.set(path, scrollY);\n    } catch (error) {\n      logger3.warn("failed to record scroll position", error);\n    }\n  }\n  getScrollPosition(path) {\n    const position = this.scrollPositions.get(path);\n    if (position === void 0) {\n      logger3.debug(`No scroll position stored for ${path}`);\n      return 0;\n    }\n    return position;\n  }\n  isPopState() {\n    return this.isPopStateNav;\n  }\n  clearPopStateFlag() {\n    this.isPopStateNav = false;\n  }\n  clear() {\n    for (const timeoutId of this.pendingTimeouts.values()) clearTimeout(timeoutId);\n    this.pendingTimeouts.clear();\n    this.prefetchQueue.clear();\n    this.scrollPositions.clear();\n    this.isPopStateNav = false;\n  }\n};\n\n// src/rendering/client/browser-stubs/error-registry.ts\nfunction createBrowserError(name, fallbackMessage) {\n  return {\n    create(options = {}) {\n      const error = new Error(options.detail ?? fallbackMessage);\n      error.name = name;\n      Object.assign(error, {\n        status: options.status,\n        context: options.context\n      });\n      return error;\n    }\n  };\n}\nvar NETWORK_ERROR = createBrowserError("NetworkError", "Network request failed");\nvar SECURITY_VIOLATION = createBrowserError("SecurityViolation", "Security violation");\n\n// src/html/html-detection.ts\nfunction isFullHTMLDocument(content) {\n  const trimmed = content.trim().toLowerCase();\n  return trimmed.startsWith("<!doctype") && trimmed.includes("<html") && trimmed.includes("</html>");\n}\n\n// src/routing/client/page-loader.ts\nvar logger4 = rendererLogger.component("veryfront");\nvar MAX_CACHE_SIZE = 50;\nvar HYDRATION_DATA_ID = "veryfront-hydration-data";\nvar DEPENDENCY_PINNING_RESPONSE_HEADER = "x-veryfront-dependency-pins";\nfunction reloadBrowserDocument(url) {\n  if (typeof globalThis.location !== "undefined") {\n    globalThis.location.assign(url);\n  }\n}\nfunction readDependencyPinningCacheKey(doc) {\n  if (!doc) return "off";\n  try {\n    const hydrationDataElement = doc.getElementById(HYDRATION_DATA_ID);\n    if (!hydrationDataElement?.textContent) return "off";\n    const hydrationData = JSON.parse(hydrationDataElement.textContent);\n    return typeof hydrationData.dependencyPinningCacheKey === "string" && hydrationData.dependencyPinningCacheKey.startsWith("on:") ? hydrationData.dependencyPinningCacheKey : "off";\n  } catch (error) {\n    logger4.debug("Failed to read dependency snapshot from hydration data:", error);\n    return "off";\n  }\n}\nvar PageLoader = class {\n  constructor(doc = typeof document === "undefined" ? void 0 : document, reloadDocument = reloadBrowserDocument) {\n    __publicField(this, "cache", /* @__PURE__ */ new Map());\n    __publicField(this, "spaCache", /* @__PURE__ */ new Map());\n    __publicField(this, "pendingRequests", /* @__PURE__ */ new Map());\n    __publicField(this, "pendingSpaRequests", /* @__PURE__ */ new Map());\n    /**\n     * A loader belongs to the dependency snapshot of the document that created it.\n     * Keeping this immutable also prevents cached or in-flight route data from\n     * crossing snapshot boundaries if the hydration element is later replaced.\n     */\n    __publicField(this, "dependencyPinningCacheKey");\n    __publicField(this, "reloadDocument");\n    __publicField(this, "snapshotRecoveryStarted", false);\n    this.dependencyPinningCacheKey = readDependencyPinningCacheKey(doc);\n    this.reloadDocument = reloadDocument;\n  }\n  evictIfFull(map) {\n    if (map.size < MAX_CACHE_SIZE) return;\n    const oldest = map.keys().next().value;\n    if (oldest) map.delete(oldest);\n  }\n  getCached(path) {\n    return this.cache.get(this.snapshotScopedPath(path));\n  }\n  isCached(path) {\n    return this.cache.has(this.snapshotScopedPath(path));\n  }\n  setCache(path, data) {\n    this.evictIfFull(this.cache);\n    this.cache.set(this.snapshotScopedPath(path), data);\n  }\n  clearCache() {\n    this.cache.clear();\n    this.spaCache.clear();\n    this.pendingRequests.clear();\n    this.pendingSpaRequests.clear();\n  }\n  getSpaCached(path) {\n    return this.spaCache.get(this.snapshotScopedPath(path));\n  }\n  isSpaDataCached(path) {\n    return this.spaCache.has(this.snapshotScopedPath(path));\n  }\n  setSpaCache(path, data) {\n    this.evictIfFull(this.spaCache);\n    this.spaCache.set(this.snapshotScopedPath(path), data);\n  }\n  async fetchPageData(path, reloadOnSnapshotFailure = true) {\n    try {\n      return await this.tryFetchJSON(path) ?? await this.fetchAndParseHTML(path);\n    } catch (error) {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    }\n  }\n  async tryFetchJSON(path) {\n    let response;\n    try {\n      const navigationUrl = new URL(path, "http://veryfront.local");\n      const dataPath = navigationUrl.pathname === "/" ? "/index" : navigationUrl.pathname;\n      const endpoint = `/_veryfront/data${dataPath}.json${navigationUrl.search}`;\n      response = await fetch(endpoint, {\n        headers: this.navigationHeaders("client")\n      });\n    } catch (error) {\n      logger4.debug(`JSON fetch failed for ${path}, falling back to HTML:`, error);\n      return null;\n    }\n    if (response.status === 409) {\n      this.failDependencySnapshot(\n        path,\n        `Dependency snapshot is unavailable for ${path}`\n      );\n    }\n    if (!response.ok) return null;\n    let data;\n    try {\n      data = await response.json();\n    } catch (error) {\n      logger4.debug(`JSON response was invalid for ${path}, falling back to HTML:`, error);\n      return null;\n    }\n    this.assertDependencySnapshot(\n      data.dependencyPinningCacheKey,\n      path,\n      "route data"\n    );\n    if (typeof data.html === "string" && isFullHTMLDocument(data.html)) {\n      const parsed = parsePageDataFromHTML(data.html);\n      this.assertDependencySnapshot(\n        parsed.dependencyPinningCacheKey,\n        path,\n        "route data HTML body"\n      );\n      return {\n        ...parsed.pageData,\n        ...data,\n        html: parsed.content,\n        managedHead: parsed.managedHead\n      };\n    }\n    return data;\n  }\n  async fetchAndParseHTML(path) {\n    const response = await fetch(path, {\n      headers: this.navigationHeaders("client")\n    });\n    if (response.status === 409) {\n      this.failDependencySnapshot(\n        path,\n        `Dependency snapshot is unavailable for ${path}`\n      );\n    }\n    if (!response.ok) {\n      throw NETWORK_ERROR.create({\n        detail: `Failed to fetch ${path}`,\n        status: response.status,\n        context: { path }\n      });\n    }\n    this.assertDependencySnapshot(\n      response.headers.get(DEPENDENCY_PINNING_RESPONSE_HEADER),\n      path,\n      "HTML response"\n    );\n    const html = await response.text();\n    const {\n      content,\n      pageData,\n      managedHead,\n      dependencyPinningCacheKey\n    } = parsePageDataFromHTML(html);\n    this.assertDependencySnapshot(\n      dependencyPinningCacheKey,\n      path,\n      "HTML body"\n    );\n    return { ...pageData, html: content, managedHead };\n  }\n  loadPage(path) {\n    return this.loadPageWithSnapshotRecovery(path, true);\n  }\n  loadPageWithSnapshotRecovery(path, reloadOnSnapshotFailure) {\n    const cachedData = this.getCached(path);\n    if (cachedData) {\n      logger4.debug(`Loading ${path} from cache`);\n      return Promise.resolve(cachedData);\n    }\n    const pendingKey = this.snapshotScopedPath(path);\n    const pending = this.pendingRequests.get(pendingKey);\n    if (pending) {\n      logger4.debug(`Reusing pending request for ${path}`);\n      return this.withSnapshotRecovery(\n        pending,\n        path,\n        reloadOnSnapshotFailure\n      );\n    }\n    logger4.debug(`Creating pending request for ${path}`);\n    const request = this.createPendingRequest(pendingKey, this.pendingRequests, async () => {\n      const data = await this.fetchPageData(path, false);\n      this.setCache(path, data);\n      return data;\n    });\n    return this.withSnapshotRecovery(\n      request,\n      path,\n      reloadOnSnapshotFailure\n    );\n  }\n  async prefetch(path) {\n    if (this.isCached(path)) return;\n    logger4.debug(`Prefetching ${path}`);\n    try {\n      await this.loadPageWithSnapshotRecovery(path, false);\n    } catch (error) {\n      logger4.warn(\n        `[Veryfront] Failed to prefetch ${path}`,\n        error instanceof Error ? error : new Error(String(error))\n      );\n    }\n  }\n  async fetchSpaPageData(path, reloadOnSnapshotFailure = true) {\n    try {\n      const navigationUrl = new URL(path, "http://veryfront.local");\n      const normalizedPath = navigationUrl.pathname === "/" ? "index" : navigationUrl.pathname.replace(/^\\//, "");\n      const endpoint = `/_veryfront/page-data/${normalizedPath}.json${navigationUrl.search}`;\n      logger4.debug(`Fetching SPA page data from ${endpoint}`);\n      const response = await fetch(endpoint, {\n        headers: this.navigationHeaders("spa")\n      });\n      if (response.status === 409) {\n        this.failDependencySnapshot(\n          path,\n          `Dependency snapshot is unavailable for SPA page data ${path}`\n        );\n      }\n      if (!response.ok) {\n        throw NETWORK_ERROR.create({\n          detail: `Failed to fetch SPA page data for ${path}`,\n          status: response.status,\n          context: { path }\n        });\n      }\n      const data = await response.json();\n      this.assertDependencySnapshot(\n        data.dependencyPinningCacheKey,\n        path,\n        "SPA page data"\n      );\n      return data;\n    } catch (error) {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    }\n  }\n  loadSpaPageData(path) {\n    return this.loadSpaPageDataWithSnapshotRecovery(path, true);\n  }\n  loadSpaPageDataWithSnapshotRecovery(path, reloadOnSnapshotFailure) {\n    const cachedData = this.getSpaCached(path);\n    if (cachedData) {\n      logger4.debug(`Loading SPA data for ${path} from cache`);\n      return Promise.resolve(cachedData);\n    }\n    const pendingKey = this.snapshotScopedPath(path);\n    const pending = this.pendingSpaRequests.get(pendingKey);\n    if (pending) {\n      logger4.debug(`Reusing pending SPA request for ${path}`);\n      return this.withSnapshotRecovery(\n        pending,\n        path,\n        reloadOnSnapshotFailure\n      );\n    }\n    logger4.debug(`Creating pending SPA request for ${path}`);\n    const request = this.createPendingRequest(pendingKey, this.pendingSpaRequests, async () => {\n      const data = await this.fetchSpaPageData(path, false);\n      this.setSpaCache(path, data);\n      return data;\n    });\n    return this.withSnapshotRecovery(\n      request,\n      path,\n      reloadOnSnapshotFailure\n    );\n  }\n  async prefetchSpaPageData(path) {\n    if (this.isSpaDataCached(path)) return;\n    logger4.debug(`Prefetching SPA page data for ${path}`);\n    try {\n      await this.loadSpaPageDataWithSnapshotRecovery(path, false);\n    } catch (error) {\n      logger4.warn(\n        `[Veryfront] Failed to prefetch SPA data for ${path}`,\n        error instanceof Error ? error : new Error(String(error))\n      );\n    }\n  }\n  createPendingRequest(path, pendingMap, fetcher) {\n    const request = (async () => {\n      try {\n        return await fetcher();\n      } finally {\n        pendingMap.delete(path);\n      }\n    })();\n    pendingMap.set(path, request);\n    return request;\n  }\n  snapshotScopedPath(path) {\n    return this.dependencyPinningCacheKey.startsWith("on:") ? `${this.dependencyPinningCacheKey}\\0${path}` : path;\n  }\n  navigationHeaders(type) {\n    return {\n      "X-Veryfront-Navigation": type,\n      ...this.dependencyPinningCacheKey.startsWith("on:") ? {\n        [DEPENDENCY_PINNING_RESPONSE_HEADER]: this.dependencyPinningCacheKey\n      } : {}\n    };\n  }\n  assertDependencySnapshot(actualCacheKey, path, source) {\n    const expectedCacheKey = this.dependencyPinningCacheKey.startsWith("on:") ? this.dependencyPinningCacheKey : void 0;\n    const normalizedActualCacheKey = typeof actualCacheKey === "string" ? actualCacheKey : void 0;\n    const matches = expectedCacheKey ? normalizedActualCacheKey === expectedCacheKey : normalizedActualCacheKey === void 0 || normalizedActualCacheKey === "off";\n    if (matches) return;\n    this.failDependencySnapshot(\n      path,\n      `Dependency snapshot mismatch in ${source} for ${path}`\n    );\n  }\n  failDependencySnapshot(path, detail) {\n    throw NETWORK_ERROR.create({\n      detail,\n      status: 409,\n      context: { path }\n    });\n  }\n  withSnapshotRecovery(promise, path, reloadOnSnapshotFailure) {\n    return promise.catch((error) => {\n      this.recoverSnapshotFailure(error, path, reloadOnSnapshotFailure);\n      throw error;\n    });\n  }\n  recoverSnapshotFailure(error, path, reloadOnSnapshotFailure) {\n    if (!reloadOnSnapshotFailure || typeof error !== "object" || error === null || error.status !== 409) {\n      return;\n    }\n    if (this.snapshotRecoveryStarted) return;\n    this.snapshotRecoveryStarted = true;\n    try {\n      this.reloadDocument(path);\n    } catch (reloadError) {\n      this.snapshotRecoveryStarted = false;\n      logger4.warn(\n        `[Veryfront] Failed to reload after dependency snapshot conflict for ${path}`,\n        reloadError instanceof Error ? reloadError : new Error(String(reloadError))\n      );\n    }\n  }\n};\n\n// src/security/client/html-sanitizer.ts\nvar SUSPICIOUS_PATTERN_SPECS = [\n  { source: String.raw`<script[^>]*>[\\s\\S]*?<\\/script>`, flags: "gi", name: "inline script" },\n  { source: String.raw`javascript:`, flags: "gi", name: "javascript: URL" },\n  { source: String.raw`\\bon\\w+\\s*=`, flags: "gi", name: "event handler attribute" },\n  { source: String.raw`data:\\s*text\\/html`, flags: "gi", name: "data: HTML URL" }\n];\nfunction createSuspiciousPatterns() {\n  return SUSPICIOUS_PATTERN_SPECS.map(({ source, flags, name }) => ({\n    pattern: new RegExp(source, flags),\n    name\n  }));\n}\nfunction isDevMode() {\n  const g = globalThis;\n  return g.__VERYFRONT_DEV__ === true || g.Deno?.env?.get?.("VERYFRONT_ENV") === "development";\n}\nfunction validateTrustedHtml(html, options = {}) {\n  const { allowInlineScripts = false, strict = false, warn = true } = options;\n  for (const { pattern, name } of createSuspiciousPatterns()) {\n    if (allowInlineScripts && name === "inline script") continue;\n    pattern.lastIndex = 0;\n    if (!pattern.test(html)) continue;\n    if (warn) console.warn(`[Security] Suspicious ${name} detected in server HTML`);\n    if (strict || !isDevMode()) {\n      throw SECURITY_VIOLATION.create({ detail: `Potentially unsafe HTML: ${name} detected` });\n    }\n  }\n  return html;\n}\n\n// src/routing/client/page-transition.ts\nvar logger5 = rendererLogger.component("veryfront");\nvar PageTransition = class {\n  constructor(setupViewportPrefetch) {\n    __publicField(this, "setupViewportPrefetch", setupViewportPrefetch);\n    __publicField(this, "pendingTransitionTimeout");\n    __publicField(this, "pendingRoot");\n  }\n  destroy() {\n    this.cancelPendingTransition();\n  }\n  cancelPendingTransition() {\n    if (this.pendingTransitionTimeout !== void 0) {\n      clearTimeout(this.pendingTransitionTimeout);\n      this.pendingTransitionTimeout = void 0;\n    }\n    if (this.pendingRoot) {\n      this.pendingRoot.style.opacity = "1";\n      this.pendingRoot = void 0;\n    }\n  }\n  updatePage(data, isPopState, scrollY) {\n    this.cancelPendingTransition();\n    if (data.requiresFullDocumentNavigation || data.managedHead?.some((entry) => entry.tagName === "script") || typeof data.html === "string" && /<script\\b/i.test(data.html)) {\n      throw new TypeError("Scripted routes require a full document navigation");\n    }\n    const rootElement = document.getElementById("root");\n    const preparedHead = prepareClientRouteHeadEntries(data.managedHead, document);\n    const retainedTitle = document.title;\n    if (!rootElement || data.html === void 0) {\n      retireClientHeadOwnership(document);\n      applyPreparedClientRouteHeadDescriptors(preparedHead, document);\n      this.updateDocumentMetadata(document, data, retainedTitle);\n      return;\n    }\n    const trustedHtml = validateTrustedHtml(String(data.html));\n    this.performTransition(\n      rootElement,\n      data,\n      trustedHtml,\n      preparedHead,\n      retainedTitle,\n      isPopState,\n      scrollY\n    );\n  }\n  updateDocumentMetadata(targetDocument, data, retainedTitle) {\n    updateRouteTitle(data.frontmatter?.title || retainedTitle, targetDocument);\n    updateRouteMetaTags(data.frontmatter ?? {}, targetDocument);\n  }\n  performTransition(rootElement, data, trustedHtml, preparedHead, retainedTitle, isPopState, scrollY) {\n    rootElement.style.opacity = "0";\n    this.pendingRoot = rootElement;\n    this.pendingTransitionTimeout = setTimeout(() => {\n      this.pendingTransitionTimeout = void 0;\n      this.pendingRoot = void 0;\n      try {\n        retireClientHeadOwnership(rootElement.ownerDocument);\n        rootElement.innerHTML = trustedHtml;\n        applyHeadDirectives(rootElement);\n        applyPreparedClientRouteHeadDescriptors(preparedHead, rootElement.ownerDocument);\n        this.updateDocumentMetadata(rootElement.ownerDocument, data, retainedTitle);\n        this.setupViewportPrefetch(rootElement);\n        manageFocus(rootElement);\n        this.handleScroll(isPopState, scrollY);\n      } catch (error) {\n        logger5.error("Route transition commit failed; reloading the document", error);\n        globalThis.location?.reload();\n      } finally {\n        rootElement.style.opacity = "1";\n      }\n    }, PAGE_TRANSITION_DELAY_MS);\n  }\n  handleScroll(isPopState, scrollY) {\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger5.warn("scroll handling failed", error);\n    }\n  }\n  showError(error) {\n    const rootElement = document.getElementById("root");\n    if (!rootElement) return;\n    const errorDiv = document.createElement("div");\n    errorDiv.className = "veryfront-error-page";\n    const heading = document.createElement("h1");\n    heading.textContent = "Oops! Something went wrong";\n    const message = document.createElement("p");\n    message.textContent = error.message;\n    const button = document.createElement("button");\n    button.type = "button";\n    button.textContent = "Reload Page";\n    button.onclick = () => globalThis.location.reload();\n    errorDiv.append(heading, message, button);\n    retireClientHeadOwnership(rootElement.ownerDocument);\n    rootElement.innerHTML = "";\n    rootElement.appendChild(errorDiv);\n  }\n  setLoadingState(loading) {\n    const indicator = document.getElementById("veryfront-loading");\n    if (indicator) indicator.style.display = loading ? "block" : "none";\n    document.body.classList.toggle("veryfront-loading", loading);\n  }\n};\n\n// src/routing/client/viewport-prefetch.ts\nvar logger6 = rendererLogger.component("veryfront");\nvar ViewportPrefetch = class {\n  constructor(prefetchCallback, prefetchOptions = {}) {\n    __publicField(this, "observer", null);\n    __publicField(this, "prefetchCallback");\n    __publicField(this, "prefetchOptions");\n    this.prefetchCallback = prefetchCallback;\n    this.prefetchOptions = prefetchOptions;\n  }\n  setup(root) {\n    try {\n      if (!("IntersectionObserver" in globalThis)) return;\n      this.observer?.disconnect();\n      this.createObserver();\n      this.observeLinks(root);\n    } catch (error) {\n      logger6.debug("setupViewportPrefetch failed", error);\n    }\n  }\n  createObserver() {\n    this.observer = new IntersectionObserver(\n      (entries) => {\n        for (const entry of entries) {\n          if (!entry.isIntersecting) continue;\n          if (!(entry.target instanceof HTMLAnchorElement)) continue;\n          const href = entry.target.getAttribute("href");\n          if (href) this.prefetchCallback(href);\n          this.observer?.unobserve(entry.target);\n        }\n      },\n      { rootMargin: "200px" }\n    );\n  }\n  observeLinks(root) {\n    const anchors = root.querySelectorAll(\'a[href]:not([target="_blank"])\');\n    const isViewportEnabled = Boolean(this.prefetchOptions.viewport);\n    for (const anchor of anchors) {\n      if (!this.shouldObserveAnchor(anchor, isViewportEnabled)) continue;\n      this.observer?.observe(anchor);\n    }\n  }\n  shouldObserveAnchor(anchor, isViewportEnabled) {\n    const href = anchor.getAttribute("href");\n    if (!href) return false;\n    if (href.startsWith("http") || href.startsWith("#")) return false;\n    if (anchor.getAttribute("download")) return false;\n    const prefetchAttribute = anchor.getAttribute("data-prefetch");\n    if (prefetchAttribute === "false") return false;\n    return prefetchAttribute === "viewport" || isViewportEnabled;\n  }\n  disconnect() {\n    if (!this.observer) return;\n    try {\n      this.observer.disconnect();\n    } catch (error) {\n      logger6.warn("prefetchObserver.disconnect failed", error);\n    } finally {\n      this.observer = null;\n    }\n  }\n};\n\n// src/rendering/client/router.ts\nvar logger7 = rendererLogger.component("veryfront");\nfunction toHistoryMode(options) {\n  if (typeof options === "boolean") return options ? "push" : "none";\n  return options?.history ?? "push";\n}\nvar VeryfrontRouter = class {\n  constructor(options = {}) {\n    __publicField(this, "baseUrl");\n    __publicField(this, "currentPath");\n    __publicField(this, "root", null);\n    __publicField(this, "options");\n    __publicField(this, "spaMode");\n    __publicField(this, "spaNavigationHandler", null);\n    __publicField(this, "navigationSequence", 0);\n    __publicField(this, "pageLoader");\n    __publicField(this, "navigationHandlers");\n    __publicField(this, "pageTransition");\n    __publicField(this, "viewportPrefetch");\n    __publicField(this, "handleClick");\n    __publicField(this, "handlePopState");\n    __publicField(this, "handleMouseOver");\n    const globalOptions = this.loadGlobalOptions();\n    this.options = { ...globalOptions, ...options };\n    this.baseUrl = this.options.baseUrl || globalThis.location.origin;\n    this.currentPath = `${globalThis.location.pathname}${globalThis.location.search}${globalThis.location.hash}`;\n    this.spaMode = this.options.spaMode ?? globalThis.__VERYFRONT_SPA_MODE__ ?? false;\n    this.pageLoader = new PageLoader();\n    this.navigationHandlers = new NavigationHandlers(\n      this.options.prefetchDelay,\n      this.options.prefetch\n    );\n    this.pageTransition = new PageTransition((root) => this.viewportPrefetch.setup(root));\n    this.viewportPrefetch = new ViewportPrefetch(\n      (path) => this.prefetch(path),\n      this.options.prefetch\n    );\n    this.handleClick = this.navigationHandlers.createClickHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handlePopState = this.navigationHandlers.createPopStateHandler({\n      // The browser already updated the URL for a popstate, so don\'t touch history.\n      onNavigate: (url) => this.navigate(url, { history: "none" }),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handleMouseOver = this.navigationHandlers.createMouseOverHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    getNavigationStore().setNavigator((href, options2) => this.navigate(href, options2));\n  }\n  registerNavigationHandler(handler) {\n    logger7.debug("Registering SPA navigation handler");\n    this.spaNavigationHandler = handler;\n    this.spaMode = true;\n  }\n  /**\n   * Notify React (and any other) subscribers that a navigation completed —\n   * after full page loads, soft same-route changes, and popstate. Delegates to\n   * the shared navigation store, the single subscription surface both bundles\n   * share.\n   */\n  notify() {\n    getNavigationStore().notify();\n  }\n  pathnameOf(url) {\n    try {\n      return new URL(url, this.baseUrl).pathname;\n    } catch {\n      return url.split("?")[0]?.split("#")[0] || this.currentPath;\n    }\n  }\n  loadGlobalOptions() {\n    try {\n      const options = globalThis.__VERYFRONT_ROUTER_OPTS__;\n      if (!options) {\n        logger7.debug("No global options configured");\n        return {};\n      }\n      return options;\n    } catch (error) {\n      logger7.error("Failed to read global options:", error);\n      return {};\n    }\n  }\n  init() {\n    logger7.debug("Initializing client-side router");\n    const rootElement = document.getElementById("root");\n    if (!rootElement) {\n      logger7.error("Root element not found");\n      return;\n    }\n    const ReactDOMToUse = globalThis.ReactDOM ?? ReactDOM;\n    this.root = ReactDOMToUse.createRoot(rootElement);\n    document.addEventListener("click", this.handleClick);\n    globalThis.addEventListener("popstate", this.handlePopState);\n    document.addEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.setup(document);\n    this.cacheCurrentPage();\n  }\n  cacheCurrentPage() {\n    const pageData = extractPageDataFromScript();\n    if (pageData) {\n      const managedHead = snapshotClientRouteHead(document);\n      this.pageLoader.setCache(this.currentPath, {\n        ...pageData,\n        managedHead,\n        ...managedHead.some((entry) => entry.tagName === "script") || document.getElementById("root")?.querySelector("script") ? { requiresFullDocumentNavigation: true } : {}\n      });\n    }\n  }\n  /**\n   * Navigate to a URL. `options` selects the history behaviour: `{ history:\n   * "push" }` (default), `"replace"`, or `"none"` (the URL already reflects the\n   * target, as after popstate). A boolean is accepted for backward\n   * compatibility — `true` pushes, `false` maps to `"none"`.\n   */\n  async navigate(url, options) {\n    logger7.debug(`Navigating to ${url} (SPA mode: ${this.spaMode})`);\n    const navigationId = ++this.navigationSequence;\n    this.pageTransition.cancelPendingTransition();\n    this.pageTransition.setLoadingState(false);\n    const history = toHistoryMode(options);\n    const sameRoute = this.pathnameOf(url) === this.pathnameOf(this.currentPath);\n    this.navigationHandlers.saveScrollPosition(this.currentPath);\n    this.options.onStart?.(url);\n    if (history === "replace") globalThis.history.replaceState({}, "", url);\n    else if (history === "push") globalThis.history.pushState({}, "", url);\n    if (sameRoute && !this.shouldRevalidate(url, sameRoute)) {\n      if (!this.isCurrentNavigation(navigationId)) return;\n      this.currentPath = url;\n      this.notify();\n      this.options.onComplete?.(url);\n      this.options.onNavigate?.(url);\n      return;\n    }\n    if (this.spaMode && this.spaNavigationHandler) {\n      await this.loadSpaPage(url, navigationId);\n    } else {\n      if (await this.loadPage(url, true, navigationId)) return;\n    }\n    if (!this.isCurrentNavigation(navigationId)) return;\n    this.notify();\n    this.options.onNavigate?.(url);\n  }\n  isCurrentNavigation(navigationId) {\n    return navigationId === this.navigationSequence;\n  }\n  /**\n   * Whether a navigation should refetch page data. A route change always does;\n   * a same-route (query/hash-only) change consults `options.shouldRevalidate`,\n   * defaulting to `true` so server data is never shown stale.\n   */\n  shouldRevalidate(nextUrl, sameRoute) {\n    const policy = this.options.shouldRevalidate;\n    if (!policy) return true;\n    return policy({ currentHref: this.currentPath, nextHref: nextUrl, sameRoute });\n  }\n  async loadSpaPage(path, navigationId) {\n    logger7.debug(`Loading SPA page: ${path}`);\n    try {\n      const spaData = await this.pageLoader.loadSpaPageData(path);\n      if (!this.isCurrentNavigation(navigationId)) return;\n      await this.spaNavigationHandler?.(spaData);\n      if (!this.isCurrentNavigation(navigationId)) return;\n      this.currentPath = path;\n      this.handleScrollAfterNavigation();\n      this.options.onComplete?.(path);\n    } catch (error) {\n      if (!this.isCurrentNavigation(navigationId)) return;\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger7.error(`Failed to load SPA page ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    }\n  }\n  handleScrollAfterNavigation() {\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger7.warn("scroll handling failed", error);\n    }\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  /** Returns true when navigation was handed to the browser document loader. */\n  async loadPage(path, updateUI = true, navigationId) {\n    if (this.pageLoader.isCached(path)) {\n      logger7.debug(`Loading ${path} from cache`);\n      const data = this.pageLoader.getCached(path);\n      if (data) {\n        if (!this.isCurrentNavigation(navigationId)) return false;\n        if (updateUI && data.requiresFullDocumentNavigation) {\n          globalThis.location.assign(path);\n          return true;\n        }\n        if (updateUI) this.updatePage(data, path);\n        this.currentPath = path;\n        this.pageTransition.setLoadingState(false);\n        this.options.onComplete?.(path);\n        return false;\n      }\n      logger7.warn(`Cache entry for ${path} was unexpectedly null, fetching fresh data`);\n    }\n    this.pageTransition.setLoadingState(true);\n    try {\n      const data = await this.pageLoader.loadPage(path);\n      if (!this.isCurrentNavigation(navigationId)) return false;\n      if (updateUI && data.requiresFullDocumentNavigation) {\n        globalThis.location.assign(path);\n        return true;\n      }\n      if (updateUI) this.updatePage(data, path);\n      this.currentPath = path;\n      this.options.onComplete?.(path);\n      return false;\n    } catch (error) {\n      if (!this.isCurrentNavigation(navigationId)) return false;\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger7.error(`Failed to load ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n      return false;\n    } finally {\n      if (this.isCurrentNavigation(navigationId)) this.pageTransition.setLoadingState(false);\n    }\n  }\n  async prefetch(path) {\n    if (this.spaMode) {\n      await this.pageLoader.prefetchSpaPageData(path);\n      return;\n    }\n    await this.pageLoader.prefetch(path);\n  }\n  updatePage(data, targetPath) {\n    if (!this.root) return;\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(targetPath);\n    this.pageTransition.updatePage(data, isPopState, scrollY);\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  destroy() {\n    this.navigationSequence++;\n    this.pageTransition.setLoadingState(false);\n    document.removeEventListener("click", this.handleClick);\n    globalThis.removeEventListener("popstate", this.handlePopState);\n    document.removeEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.disconnect();\n    this.pageLoader.clearCache();\n    this.navigationHandlers.clear();\n    this.pageTransition.destroy();\n  }\n};\nfunction boot(options = {}) {\n  if (typeof window === "undefined" || !globalThis.document) return null;\n  const globalWithRouter = globalThis;\n  if (globalWithRouter.veryFrontRouter) return globalWithRouter.veryFrontRouter;\n  const { slug: _slug, ...routerOptions } = options;\n  const router = new VeryfrontRouter(routerOptions);\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => router.init(), { once: true });\n  } else {\n    router.init();\n  }\n  globalWithRouter.veryFrontRouter = router;\n  return router;\n}\nif (typeof window !== "undefined" && globalThis.document) {\n  boot();\n}\nexport {\n  VeryfrontRouter,\n  boot\n};\n';
 
 export const CLIENT_PREFETCH_BUNDLE: string | undefined =
   'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n\n// src/rendering/client/browser-logger.ts\nvar ConditionalBrowserLogger = class {\n  constructor(prefix, level) {\n    __publicField(this, "prefix", prefix);\n    __publicField(this, "level", level);\n  }\n  log(minLevel, fn, message, ...args) {\n    if (this.level > minLevel) return;\n    fn?.(message, ...args);\n  }\n  debug(message, ...args) {\n    this.log(\n      0 /* DEBUG */,\n      console.debug,\n      `[${this.prefix}] DEBUG: ${message}`,\n      ...args\n    );\n  }\n  info(message, ...args) {\n    this.log(1 /* INFO */, console.log, `[${this.prefix}] ${message}`, ...args);\n  }\n  warn(message, ...args) {\n    this.log(\n      2 /* WARN */,\n      console.warn,\n      `[${this.prefix}] WARN: ${message}`,\n      ...args\n    );\n  }\n  error(message, ...args) {\n    this.log(\n      3 /* ERROR */,\n      console.error,\n      `[${this.prefix}] ERROR: ${message}`,\n      ...args\n    );\n  }\n};\nfunction getBrowserLogLevel() {\n  if (typeof window === "undefined") return 2 /* WARN */;\n  const g = globalThis;\n  const isDevelopment = g.__VERYFRONT_DEV__ || g.__RSC_DEV__;\n  if (!isDevelopment) return 2 /* WARN */;\n  const isDebugEnabled2 = g.__VERYFRONT_DEBUG__ || g.__RSC_DEBUG__;\n  return isDebugEnabled2 ? 0 /* DEBUG */ : 1 /* INFO */;\n}\nvar defaultLevel = getBrowserLogLevel();\nvar rscLogger = new ConditionalBrowserLogger("RSC", defaultLevel);\nvar prefetchLogger = new ConditionalBrowserLogger("PREFETCH", defaultLevel);\nvar hydrateLogger = new ConditionalBrowserLogger("HYDRATE", defaultLevel);\nvar browserLogger = new ConditionalBrowserLogger("VERYFRONT", defaultLevel);\n\n// src/rendering/client/prefetch/link-observer.ts\nfunction isAnchorElement(element) {\n  return typeof HTMLAnchorElement !== "undefined" ? element instanceof HTMLAnchorElement : element.tagName === "A";\n}\nvar LinkObserver = class {\n  constructor(options, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "intersectionObserver", null);\n    __publicField(this, "mutationObserver", null);\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "pendingTimeouts", /* @__PURE__ */ new Map());\n    __publicField(this, "elementTimeoutMap", /* @__PURE__ */ new WeakMap());\n    __publicField(this, "timeoutCounter", 0);\n    this.options = options;\n    this.prefetchedUrls = prefetchedUrls;\n  }\n  init() {\n    this.createIntersectionObserver();\n    this.observeLinks();\n    this.setupMutationObserver();\n  }\n  createIntersectionObserver() {\n    this.intersectionObserver = new IntersectionObserver(\n      (entries) => this.handleIntersection(entries),\n      { rootMargin: this.options.rootMargin }\n    );\n  }\n  handleIntersection(entries) {\n    for (const entry of entries) {\n      if (!entry.isIntersecting) continue;\n      if (!isAnchorElement(entry.target)) continue;\n      const link = entry.target;\n      if (this.timeoutCounter > 1e6) this.timeoutCounter = 0;\n      const timeoutKey = this.timeoutCounter++;\n      const timeoutId = setTimeout(() => {\n        this.pendingTimeouts.delete(timeoutKey);\n        this.elementTimeoutMap.delete(link);\n        this.options.onLinkVisible(link);\n      }, this.options.delay);\n      this.pendingTimeouts.set(timeoutKey, timeoutId);\n      this.elementTimeoutMap.set(link, timeoutKey);\n    }\n  }\n  observeLinks() {\n    this.observeAnchors(document.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  setupMutationObserver() {\n    this.mutationObserver = new MutationObserver((mutations) => {\n      for (const mutation of mutations) {\n        if (mutation.type !== "childList") continue;\n        for (const node of mutation.addedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE) continue;\n          this.observeElement(node);\n        }\n        for (const node of mutation.removedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE) continue;\n          this.clearElementTimeouts(node);\n        }\n      }\n    });\n    this.mutationObserver.observe(document.body, { childList: true, subtree: true });\n  }\n  clearTimeoutForElement(element) {\n    const timeoutKey = this.elementTimeoutMap.get(element);\n    if (timeoutKey === void 0) return;\n    const timeoutId = this.pendingTimeouts.get(timeoutKey);\n    if (timeoutId !== void 0) {\n      clearTimeout(timeoutId);\n      this.pendingTimeouts.delete(timeoutKey);\n    }\n    this.elementTimeoutMap.delete(element);\n  }\n  clearElementTimeouts(element) {\n    if (isAnchorElement(element)) this.clearTimeoutForElement(element);\n    for (const link of element.querySelectorAll("a")) {\n      this.clearTimeoutForElement(link);\n    }\n  }\n  observeElement(element) {\n    if (isAnchorElement(element) && this.isValidLink(element)) {\n      this.intersectionObserver?.observe(element);\n    }\n    this.observeAnchors(element.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  observeAnchors(links) {\n    for (const link of links) {\n      if (!isAnchorElement(link)) continue;\n      if (!this.isValidLink(link)) continue;\n      this.intersectionObserver?.observe(link);\n    }\n  }\n  isValidLink(link) {\n    if (link.hostname !== globalThis.location.hostname) return false;\n    if (link.hasAttribute("download")) return false;\n    if (link.target === "_blank") return false;\n    const url = link.href;\n    if (this.prefetchedUrls.has(url)) return false;\n    if (url === globalThis.location.href) return false;\n    if (link.hash && link.pathname === globalThis.location.pathname) return false;\n    if (link.dataset.noPrefetch) return false;\n    return true;\n  }\n  destroy() {\n    for (const timeoutId of this.pendingTimeouts.values()) {\n      clearTimeout(timeoutId);\n    }\n    this.pendingTimeouts.clear();\n    this.timeoutCounter = 0;\n    this.intersectionObserver?.disconnect();\n    this.intersectionObserver = null;\n    this.mutationObserver?.disconnect();\n    this.mutationObserver = null;\n  }\n};\n\n// src/rendering/client/prefetch/network-utils.ts\nvar NetworkUtils = class {\n  constructor(allowedNetworks = ["4g", "wifi", "ethernet"]) {\n    __publicField(this, "networkInfo");\n    __publicField(this, "allowedNetworks");\n    this.allowedNetworks = allowedNetworks;\n    this.networkInfo = this.getNetworkConnection();\n  }\n  getNavigatorWithConnection() {\n    if (typeof globalThis.navigator === "undefined") return null;\n    return globalThis.navigator;\n  }\n  getNetworkConnection() {\n    const nav = this.getNavigatorWithConnection();\n    return nav?.connection ?? nav?.mozConnection ?? nav?.webkitConnection ?? null;\n  }\n  shouldPrefetch() {\n    if (this.networkInfo?.saveData) return false;\n    const effectiveType = this.networkInfo?.effectiveType;\n    if (effectiveType != null && !this.allowedNetworks.includes(effectiveType)) return false;\n    return true;\n  }\n  onNetworkChange(callback) {\n    this.networkInfo?.addEventListener?.("change", callback);\n  }\n  getNetworkInfo() {\n    return this.networkInfo;\n  }\n};\n\n// src/utils/constants/css.ts\nvar MAX_CSS_FILE_BYTES = 16 * 1024 * 1024;\nvar MAX_CSS_TOTAL_BYTES = 64 * 1024 * 1024;\nvar MAX_CSS_OUTPUT_FILE_BYTES = 32 * 1024 * 1024;\n\n// src/utils/constants/buffers.ts\nvar DEFAULT_MAX_BODY_SIZE_BYTES = 1024 * 1024;\nvar DEFAULT_MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024;\nvar PREFETCH_QUEUE_MAX_SIZE_BYTES = DEFAULT_MAX_BODY_SIZE_BYTES;\nvar MAX_BUNDLE_CHUNK_SIZE_BYTES = 4096 * 1024;\n\n// src/utils/constants/limits.ts\nvar MAX_TIMER_DELAY_MS = 2147483647;\n\n// src/utils/constants/cache.ts\nvar SECONDS_PER_MINUTE = 60;\nvar MINUTES_PER_HOUR = 60;\nvar HOURS_PER_DAY = 24;\nvar MS_PER_SECOND = 1e3;\nvar MS_PER_MINUTE = SECONDS_PER_MINUTE * MS_PER_SECOND;\nvar MS_PER_HOUR = MINUTES_PER_HOUR * MS_PER_MINUTE;\nvar ONE_DAY_MS = HOURS_PER_DAY * MS_PER_HOUR;\nfunction getEnvString(key) {\n  const g = globalThis;\n  try {\n    return g.Deno?.env?.get?.(key) ?? g.process?.env?.[key];\n  } catch (_) {\n    return void 0;\n  }\n}\nvar MAX_CONFIGURED_CACHE_ENTRIES = 1e6;\nvar MAX_CONFIGURED_CACHE_SIZE_MB = 64 * 1024;\nvar MAX_CONFIGURED_CONCURRENCY = 1e4;\nvar MAX_CONFIGURED_TTL_SECONDS = 365 * HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE;\nvar BYTES_PER_MB = 1024 * 1024;\nvar MAX_CACHE_TTL_SECONDS = 2147483647;\nvar MAX_CACHE_TTL_MILLISECONDS = MAX_CACHE_TTL_SECONDS * MS_PER_SECOND;\nfunction getEnvInteger(key, fallback, { min = 1, max }) {\n  const value = getEnvString(key);\n  if (value == null) return fallback;\n  const normalized = value.trim();\n  if (!/^\\d+$/.test(normalized)) return fallback;\n  const parsed = Number(normalized);\n  if (!Number.isSafeInteger(parsed) || parsed < min || parsed > max) return fallback;\n  return parsed;\n}\nfunction getStrictEnvInteger(key, fallback, { min = 1, max }) {\n  const value = getEnvString(key);\n  if (value == null) return fallback;\n  const normalized = value.trim();\n  if (!/^\\d+$/.test(normalized)) {\n    throw new RangeError(\n      `${key} must be a base-10 integer between ${min} and ${max}`\n    );\n  }\n  const parsed = Number(normalized);\n  if (!Number.isSafeInteger(parsed) || parsed < min || parsed > max) {\n    throw new RangeError(`${key} must be between ${min} and ${max}`);\n  }\n  return parsed;\n}\nfunction getEnvCacheEntries(key, fallback) {\n  return getEnvInteger(key, fallback, { max: MAX_CONFIGURED_CACHE_ENTRIES });\n}\nfunction getEnvCacheSizeMb(key, fallback) {\n  return getEnvInteger(key, fallback, { max: MAX_CONFIGURED_CACHE_SIZE_MB });\n}\nfunction getEnvTtlSeconds(key, fallback) {\n  return getEnvInteger(key, fallback, { max: MAX_CONFIGURED_TTL_SECONDS });\n}\nvar DEFAULT_LRU_MAX_ENTRIES = getEnvCacheEntries("LRU_DEFAULT_MAX_ENTRIES", 100);\nvar COMPONENT_LOADER_MAX_ENTRIES = getEnvCacheEntries("COMPONENT_LOADER_MAX_ENTRIES", 200);\nvar COMPONENT_LOADER_TTL_MS = 10 * MS_PER_MINUTE;\nvar MDX_RENDERER_MAX_ENTRIES = getEnvCacheEntries("MDX_RENDERER_MAX_ENTRIES", 500);\nvar MDX_RENDERER_TTL_MS = 10 * MS_PER_MINUTE;\nvar RENDERER_CORE_MAX_ENTRIES = getEnvCacheEntries("RENDERER_CORE_MAX_ENTRIES", 200);\nvar RENDERER_CORE_TTL_MS = 5 * MS_PER_MINUTE;\nvar TSX_LAYOUT_MAX_ENTRIES = getEnvCacheEntries("TSX_LAYOUT_MAX_ENTRIES", 100);\nvar TSX_LAYOUT_TTL_MS = 10 * MS_PER_MINUTE;\nvar TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES = getEnvCacheEntries(\n  "TSX_LAYOUT_PER_PROJECT_MAX_ENTRIES",\n  Math.ceil(TSX_LAYOUT_MAX_ENTRIES / 10)\n);\nvar DATA_FETCHING_MAX_ENTRIES = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_ENTRIES",\n  500,\n  { max: MAX_CONFIGURED_CACHE_ENTRIES }\n);\nvar DATA_FETCHING_MAX_ENTRIES_PER_PROJECT = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_ENTRIES_PER_PROJECT",\n  Math.max(1, Math.ceil(DATA_FETCHING_MAX_ENTRIES / 5)),\n  { max: DATA_FETCHING_MAX_ENTRIES }\n);\nvar dataFetchingMaxSizeMb = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_SIZE_MB",\n  50,\n  { max: MAX_CONFIGURED_CACHE_SIZE_MB }\n);\nvar DATA_FETCHING_MAX_SIZE_BYTES = dataFetchingMaxSizeMb * BYTES_PER_MB;\nvar DATA_FETCHING_MAX_SIZE_BYTES_PER_PROJECT = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_SIZE_MB_PER_PROJECT",\n  Math.max(1, Math.ceil(dataFetchingMaxSizeMb / 5)),\n  { max: dataFetchingMaxSizeMb }\n) * BYTES_PER_MB;\nvar DATA_FETCHING_TTL_MS = 10 * MS_PER_MINUTE;\nvar DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS",\n  512,\n  { max: MAX_CONFIGURED_CONCURRENCY }\n);\nvar DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS_PER_PROJECT = getStrictEnvInteger(\n  "DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS_PER_PROJECT",\n  Math.min(128, DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS),\n  { max: DATA_FETCHING_MAX_CONCURRENT_EXECUTIONS }\n);\nvar MDX_CACHE_TTL_DEVELOPMENT_MS = 5 * MS_PER_MINUTE;\nvar BUNDLE_CACHE_TTL_DEVELOPMENT_MS = 5 * MS_PER_MINUTE;\nvar BUNDLE_MANIFEST_PROD_TTL_MS = 7 * ONE_DAY_MS;\nvar SERVER_ACTION_DEFAULT_TTL_SEC = MINUTES_PER_HOUR * SECONDS_PER_MINUTE;\nvar DISTRIBUTED_SSR_MODULE_TTL_PRODUCTION_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_SSR_MODULE_TTL_SEC",\n  6 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_SSR_MODULE_TTL_PREVIEW_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_SSR_MODULE_TTL_PREVIEW_SEC",\n  10 * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_TRANSFORM_TTL_PRODUCTION_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_TRANSFORM_TTL_SEC",\n  6 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_TRANSFORM_TTL_PREVIEW_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_TRANSFORM_TTL_PREVIEW_SEC",\n  10 * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_FILE_TTL_PRODUCTION_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_FILE_TTL_SEC",\n  MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_FILE_TTL_PREVIEW_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_FILE_TTL_PREVIEW_SEC",\n  5 * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_CSS_TTL_PRODUCTION_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_CSS_TTL_SEC",\n  6 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n);\nvar DISTRIBUTED_CSS_TTL_PREVIEW_SEC = getEnvTtlSeconds(\n  "DISTRIBUTED_CSS_TTL_PREVIEW_SEC",\n  10 * SECONDS_PER_MINUTE\n);\nvar LRU_DEFAULT_MAX_ENTRIES_V2 = getEnvCacheEntries("LRU_MAX_ENTRIES", 2e3);\nvar LRU_DEFAULT_MAX_SIZE_BYTES = getEnvCacheSizeMb("LRU_MAX_SIZE_MB", 200) * BYTES_PER_MB;\nvar MEMORY_CACHE_MAX_ENTRIES = getEnvCacheEntries("MEMORY_CACHE_MAX_ENTRIES", 2e3);\nvar MEMORY_CACHE_MAX_SIZE_BYTES = getEnvCacheSizeMb("MEMORY_CACHE_MAX_SIZE_MB", 50) * BYTES_PER_MB;\nvar FILE_CACHE_MAX_ENTRIES = getEnvCacheEntries("FILE_CACHE_MAX_ENTRIES", 1e3);\nvar FILE_CACHE_MAX_SIZE_MB = getEnvCacheSizeMb("FILE_CACHE_MAX_SIZE_MB", 100);\nvar MAX_CONCURRENT_REVALIDATIONS = getEnvInteger("MAX_CONCURRENT_REVALIDATIONS", 32, {\n  max: MAX_CONFIGURED_CONCURRENCY\n});\nvar MAX_CONCURRENT_HTTP_FETCHES = getEnvInteger("MAX_CONCURRENT_HTTP_FETCHES", 50, {\n  max: MAX_CONFIGURED_CONCURRENCY\n});\nvar REVALIDATION_TIMEOUT_MS = getEnvInteger("REVALIDATION_TIMEOUT_MS", 15e3, {\n  max: MAX_TIMER_DELAY_MS\n});\nvar REVALIDATION_PER_PROJECT_LIMIT = getEnvInteger(\n  "REVALIDATION_PER_PROJECT_LIMIT",\n  Math.ceil(MAX_CONCURRENT_REVALIDATIONS / 3),\n  { min: 0, max: MAX_CONFIGURED_CONCURRENCY }\n);\nvar BUNDLE_MANIFEST_DISTRIBUTED_TTL_SEC = getEnvTtlSeconds(\n  "BUNDLE_MANIFEST_DISTRIBUTED_TTL_SEC",\n  HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n  // 24 hours (86400)\n);\nvar BUNDLE_MANIFEST_LRU_MAX_ENTRIES = getEnvCacheEntries(\n  "BUNDLE_MANIFEST_LRU_MAX_ENTRIES",\n  5e3\n);\nvar BUNDLE_MANIFEST_MEMORY_MAX_METADATA_SIZE_BYTES = getEnvCacheSizeMb(\n  "BUNDLE_MANIFEST_MEMORY_MAX_METADATA_SIZE_MB",\n  128\n) * BYTES_PER_MB;\nvar BUNDLE_MANIFEST_MEMORY_MAX_CODE_SIZE_BYTES = getEnvCacheSizeMb(\n  "BUNDLE_MANIFEST_MEMORY_MAX_CODE_SIZE_MB",\n  256\n) * BYTES_PER_MB;\nvar HTTP_MODULE_CACHE_MAX_ENTRIES = getEnvCacheEntries(\n  "HTTP_MODULE_CACHE_MAX_ENTRIES",\n  2e3\n);\nvar HTTP_MODULE_DISTRIBUTED_TTL_SEC = getEnvTtlSeconds(\n  "HTTP_MODULE_DISTRIBUTED_TTL_SEC",\n  HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n  // 24 hours (86400)\n);\nvar TRANSFORM_DISTRIBUTED_TTL_SEC = getEnvTtlSeconds(\n  "TRANSFORM_DISTRIBUTED_TTL_SEC",\n  6 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE\n  // 6 hours (21600)\n);\nvar MODULE_CACHE_MAX_ENTRIES = getEnvCacheEntries("MODULE_CACHE_MAX_ENTRIES", 1e4);\nvar MODULE_CACHE_TTL_MS = getEnvInteger(\n  "MODULE_CACHE_TTL_MS",\n  5 * MS_PER_MINUTE,\n  // 5 minutes - short enough to pick up changes, long enough to cache\n  { max: MAX_TIMER_DELAY_MS }\n);\nvar ESM_CACHE_MAX_ENTRIES = getEnvCacheEntries("ESM_CACHE_MAX_ENTRIES", 5e3);\nvar ESM_CACHE_TTL_MS = getEnvInteger(\n  "ESM_CACHE_TTL_MS",\n  10 * MS_PER_MINUTE,\n  // 10 minutes - external modules change less frequently\n  { max: MAX_TIMER_DELAY_MS }\n);\n\n// src/utils/constants/http.ts\nvar KB_IN_BYTES = 1024;\nvar PREFETCH_MAX_SIZE_BYTES = 200 * KB_IN_BYTES;\n\n// src/utils/constants/hmr.ts\nvar HMR_MAX_MESSAGE_SIZE_BYTES = 1024 * KB_IN_BYTES;\n\n// src/utils/constants/network.ts\nvar BYTES_PER_KB = 1024;\nvar BYTES_PER_MB2 = BYTES_PER_KB * BYTES_PER_KB;\n\n// src/utils/constants/security.ts\nvar MAX_CSRF_TTL_SECONDS = Number.MAX_SAFE_INTEGER;\n\n// src/platform/compat/constants.ts\nvar DEFAULT_PORT = 3e3;\nvar LOCALHOST = Object.freeze(\n  {\n    IPV4: "127.0.0.1",\n    IPV6: "::1",\n    HOSTNAME: "localhost"\n  }\n);\n\n// src/config/defaults.ts\nvar DEFAULT_TIMEOUT_MS = 5e3;\nvar SSR_TIMEOUT_MS = 1e4;\nvar SSR_MAX_BUFFERED_BYTES = 16 * 1024 * 1024;\nvar SANDBOX_TIMEOUT_MS = 5e3;\nvar DEFAULT_CACHE_MAX_SIZE = 100;\nvar DURATION_HISTOGRAM_BOUNDARIES_MS = Object.freeze(\n  [\n    5,\n    10,\n    25,\n    50,\n    75,\n    100,\n    250,\n    500,\n    750,\n    1e3,\n    2500,\n    5e3,\n    7500,\n    1e4\n  ]\n);\nvar SIZE_HISTOGRAM_BOUNDARIES_KB = Object.freeze(\n  [\n    1,\n    5,\n    10,\n    25,\n    50,\n    100,\n    250,\n    500,\n    1e3,\n    2500,\n    5e3,\n    1e4\n  ]\n);\nvar defaultConfig = Object.freeze(\n  {\n    server: Object.freeze({\n      port: DEFAULT_PORT,\n      hostname: "0.0.0.0"\n    }),\n    timeouts: Object.freeze({\n      default: DEFAULT_TIMEOUT_MS,\n      api: 3e4,\n      ssr: SSR_TIMEOUT_MS,\n      hmr: 3e4,\n      sandbox: SANDBOX_TIMEOUT_MS\n    }),\n    cache: Object.freeze({\n      jit: Object.freeze({\n        maxSize: DEFAULT_CACHE_MAX_SIZE,\n        tempDirPrefix: "vf-bundle-"\n      })\n    }),\n    metrics: Object.freeze({\n      ssrBoundaries: DURATION_HISTOGRAM_BOUNDARIES_MS\n    })\n  }\n);\n\n// src/utils/constants/server.ts\nvar INTERNAL_PREFIX = "/_veryfront";\nvar INTERNAL_PATH_PREFIXES = {\n  /** React Server Components endpoints */\n  RSC: `${INTERNAL_PREFIX}/rsc/`,\n  /** File system access endpoints (base64 encoded paths) */\n  FS: `${INTERNAL_PREFIX}/fs/`,\n  /** Virtual module system */\n  MODULES: `${INTERNAL_PREFIX}/modules/`,\n  /** Generated page modules */\n  PAGES: `${INTERNAL_PREFIX}/pages/`,\n  /** Data JSON endpoints */\n  DATA: `${INTERNAL_PREFIX}/data/`,\n  /** Library modules and large vendor surfaces */\n  LIB: `${INTERNAL_PREFIX}/lib/`,\n  /** Chunk assets */\n  CHUNKS: `${INTERNAL_PREFIX}/chunks/`,\n  /** Client component modules */\n  CLIENT: `${INTERNAL_PREFIX}/client/`\n};\nvar INTERNAL_ENDPOINTS = {\n  // Development endpoints\n  HMR_RUNTIME: `${INTERNAL_PREFIX}/hmr-runtime.js`,\n  HMR: `${INTERNAL_PREFIX}/hmr.js`,\n  ERROR_OVERLAY: `${INTERNAL_PREFIX}/error-overlay.js`,\n  // Legacy endpoint retained for backward compatibility (no active handler).\n  DEV_LOADER: `${INTERNAL_PREFIX}/dev-loader.js`,\n  CLIENT_LOG: `${INTERNAL_PREFIX}/log`,\n  // Production endpoints\n  CLIENT_JS: `${INTERNAL_PREFIX}/client.js`,\n  ROUTER_JS: `${INTERNAL_PREFIX}/router.js`,\n  PREFETCH_JS: `${INTERNAL_PREFIX}/prefetch.js`,\n  MANIFEST_JSON: `${INTERNAL_PREFIX}/manifest.json`,\n  APP_JS: `${INTERNAL_PREFIX}/app.js`,\n  // RSC endpoints\n  RSC_CLIENT: `${INTERNAL_PREFIX}/rsc/client.js`,\n  RSC_MANIFEST: `${INTERNAL_PREFIX}/rsc/manifest`,\n  RSC_STREAM: `${INTERNAL_PREFIX}/rsc/stream`,\n  RSC_PAYLOAD: `${INTERNAL_PREFIX}/rsc/payload`,\n  RSC_RENDER: `${INTERNAL_PREFIX}/rsc/render`,\n  RSC_PAGE: `${INTERNAL_PREFIX}/rsc/page`,\n  RSC_MODULE: `${INTERNAL_PREFIX}/rsc/module`,\n  RSC_DOM: `${INTERNAL_PREFIX}/rsc/dom.js`,\n  // Library module endpoints\n  LIB_CHAT_REACT: `${INTERNAL_PREFIX}/lib/chat/react.js`,\n  LIB_CHAT_COMPONENTS: `${INTERNAL_PREFIX}/lib/chat/components.js`,\n  LIB_CHAT_PRIMITIVES: `${INTERNAL_PREFIX}/lib/chat/primitives.js`\n};\nvar PROJECT_DIRS = {\n  /** Base veryfront internal directory */\n  ROOT: ".veryfront",\n  /** Cache directory for build artifacts, transforms, etc. */\n  CACHE: ".veryfront/cache",\n  /** KV store directory */\n  KV: ".veryfront/kv",\n  /** Log files directory */\n  LOGS: ".veryfront/logs",\n  /** Temporary files directory */\n  TMP: ".veryfront/tmp"\n};\nvar DEFAULT_CACHE_DIR = PROJECT_DIRS.CACHE;\nvar DEV_SERVER_ENDPOINTS = {\n  HMR_RUNTIME: INTERNAL_ENDPOINTS.HMR_RUNTIME,\n  ERROR_OVERLAY: INTERNAL_ENDPOINTS.ERROR_OVERLAY\n};\n\n// src/rendering/client/prefetch/prefetch-queue.ts\nvar DEFAULT_OPTIONS = {\n  maxConcurrent: 4,\n  maxSize: PREFETCH_QUEUE_MAX_SIZE_BYTES,\n  timeout: 5e3\n};\nfunction isAbortError(error) {\n  if (typeof error !== "object" || error === null) return false;\n  if (!("name" in error)) return false;\n  return error.name === "AbortError";\n}\nvar PrefetchQueue = class {\n  constructor(options = {}, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "controllers", /* @__PURE__ */ new Map());\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "concurrent", 0);\n    __publicField(this, "stopped", false);\n    __publicField(this, "onResourcesFetched");\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n    this.prefetchedUrls = prefetchedUrls ?? /* @__PURE__ */ new Set();\n  }\n  setResourceCallback(callback) {\n    this.onResourcesFetched = callback;\n  }\n  enqueue(url) {\n    void this.prefetch(url);\n  }\n  has(url) {\n    return this.prefetchedUrls.has(url) || this.controllers.has(url);\n  }\n  get size() {\n    return this.controllers.size;\n  }\n  clear() {\n    this.stopAll();\n    this.prefetchedUrls.clear();\n  }\n  start() {\n    this.stopped = false;\n  }\n  stop() {\n    this.stopped = true;\n    this.stopAll();\n  }\n  getQueueSize() {\n    return this.controllers.size;\n  }\n  getConcurrentCount() {\n    return this.concurrent;\n  }\n  async prefetchLink(link) {\n    if (this.stopped) return;\n    const url = link.href;\n    if (!url || this.controllers.has(url) || this.prefetchedUrls.has(url)) return;\n    if (this.concurrent >= this.options.maxConcurrent) {\n      prefetchLogger.debug?.(`Prefetch queue full, skipping ${url}`);\n      return;\n    }\n    let parsedUrl;\n    try {\n      parsedUrl = new URL(url);\n    } catch (_) {\n      prefetchLogger.debug?.(`Invalid prefetch URL ${url}`);\n      return;\n    }\n    const controller = new AbortController();\n    this.controllers.set(url, controller);\n    this.concurrent += 1;\n    const timeoutId = this.options.timeout > 0 ? setTimeout(() => controller.abort(), this.options.timeout) : void 0;\n    try {\n      const response = await fetch(parsedUrl.toString(), {\n        method: "GET",\n        signal: controller.signal,\n        headers: { "X-Veryfront-Prefetch": "1" }\n      });\n      if (!response.ok) return;\n      if (this.isResponseTooLarge(response)) {\n        prefetchLogger.debug?.(`Prefetch too large, skipping ${url}`);\n        return;\n      }\n      this.prefetchedUrls.add(url);\n      if (!this.onResourcesFetched) return;\n      try {\n        await this.onResourcesFetched(response, url);\n      } catch (callbackError) {\n        prefetchLogger.error?.(`Prefetch callback failed for ${url}`, callbackError);\n      }\n    } catch (error) {\n      if (!isAbortError(error)) {\n        prefetchLogger.error?.(`Failed to prefetch ${url}`, error);\n      }\n    } finally {\n      if (timeoutId !== void 0) clearTimeout(timeoutId);\n      this.controllers.delete(url);\n      this.concurrent = Math.max(0, this.concurrent - 1);\n    }\n  }\n  async prefetch(url) {\n    const link = typeof document !== "undefined" ? document.createElement("a") : { href: url };\n    link.href = url;\n    await this.prefetchLink(link);\n  }\n  stopAll() {\n    for (const controller of this.controllers.values()) {\n      controller.abort();\n    }\n    this.controllers.clear();\n    this.concurrent = 0;\n  }\n  isResponseTooLarge(response) {\n    const rawLength = response.headers.get("content-length");\n    if (rawLength === null) return false;\n    const size = Number.parseInt(rawLength, 10);\n    if (!Number.isFinite(size)) return false;\n    return size > this.options.maxSize;\n  }\n};\nvar prefetchQueue = new PrefetchQueue();\n\n// src/rendering/client/prefetch/resource-hints.ts\nvar ResourceHintsManager = class {\n  constructor() {\n    __publicField(this, "appliedHints", /* @__PURE__ */ new Set());\n  }\n  applyResourceHints(hints) {\n    for (const hint of hints) {\n      const key = `${hint.type}:${hint.href}`;\n      if (this.appliedHints.has(key)) continue;\n      const existing = document.querySelector(\n        `link[rel="${hint.type}"][href="${hint.href}"]`\n      );\n      if (existing) {\n        this.appliedHints.add(key);\n        continue;\n      }\n      this.createAndAppendHint(hint);\n      this.appliedHints.add(key);\n      prefetchLogger.debug(`Added resource hint: ${hint.type} ${hint.href}`);\n    }\n  }\n  createAndAppendHint(hint) {\n    if (!document.head) {\n      prefetchLogger.warn("document.head is not available, skipping resource hint");\n      return;\n    }\n    const link = document.createElement("link");\n    link.rel = hint.type;\n    link.href = hint.href;\n    if (hint.as) link.setAttribute("as", hint.as);\n    if (hint.crossOrigin) link.setAttribute("crossorigin", hint.crossOrigin);\n    if (hint.media) link.setAttribute("media", hint.media);\n    document.head.appendChild(link);\n  }\n  extractResourceHints(html, prefetchedUrls) {\n    try {\n      const doc = new DOMParser().parseFromString(html, "text/html");\n      const hints = [];\n      this.extractPreloadLinks(doc, prefetchedUrls, hints);\n      this.extractScripts(doc, prefetchedUrls, hints);\n      this.extractStylesheets(doc, prefetchedUrls, hints);\n      return hints;\n    } catch (error) {\n      prefetchLogger.error("Failed to parse prefetched page", error);\n      return [];\n    }\n  }\n  isValidResourceHintType(rel) {\n    switch (rel) {\n      case "prefetch":\n      case "preload":\n      case "preconnect":\n      case "dns-prefetch":\n        return true;\n      default:\n        return false;\n    }\n  }\n  extractPreloadLinks(doc, prefetchedUrls, hints) {\n    const links = doc.querySelectorAll(\n      \'link[rel="preload"], link[rel="prefetch"]\'\n    );\n    for (const link of links) {\n      const href = link.href;\n      if (!href) continue;\n      if (prefetchedUrls.has(href)) continue;\n      if (!this.isValidResourceHintType(link.rel)) continue;\n      hints.push({\n        type: link.rel,\n        href,\n        as: link.getAttribute("as") ?? void 0\n      });\n    }\n  }\n  extractScripts(doc, prefetchedUrls, hints) {\n    for (const script of doc.querySelectorAll("script[src]")) {\n      const src = script.src;\n      if (!src || prefetchedUrls.has(src)) continue;\n      hints.push({ type: "prefetch", href: src, as: "script" });\n    }\n  }\n  extractStylesheets(doc, prefetchedUrls, hints) {\n    for (const link of doc.querySelectorAll(\'link[rel="stylesheet"]\')) {\n      const href = link.href;\n      if (!href || prefetchedUrls.has(href)) continue;\n      hints.push({ type: "prefetch", href, as: "style" });\n    }\n  }\n  static generateResourceHints(_route, assets) {\n    const hints = [\n      \'<link rel="dns-prefetch" href="https://cdn.jsdelivr.net">\',\n      \'<link rel="dns-prefetch" href="https://esm.sh">\',\n      \'<link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>\'\n    ];\n    for (const asset of assets) {\n      if (asset.endsWith(".js")) {\n        hints.push(`<link rel="modulepreload" href="${asset}">`);\n        continue;\n      }\n      if (asset.endsWith(".css")) {\n        hints.push(`<link rel="preload" as="style" href="${asset}">`);\n        continue;\n      }\n      if (/\\.(woff2?|ttf|otf)$/.test(asset)) {\n        hints.push(`<link rel="preload" as="font" href="${asset}" crossorigin>`);\n      }\n    }\n    return hints.join("\\n");\n  }\n};\n\n// src/rendering/client/browser-stubs/logger.ts\nfunction noop() {\n}\nvar logger = {\n  debug: noop,\n  info: console.log.bind(console),\n  warn: console.warn.bind(console),\n  error: console.error.bind(console),\n  component: () => logger\n};\nvar PREFETCH_MAX_SIZE_BYTES2 = 200 * 1024;\nvar PREFETCH_DEFAULT_TIMEOUT_MS2 = 1e4;\nvar PREFETCH_DEFAULT_DELAY_MS2 = 200;\n\n// src/rendering/client/prefetch.ts\nvar PrefetchManager = class {\n  constructor(options = {}) {\n    __publicField(this, "options");\n    __publicField(this, "prefetchedUrls", /* @__PURE__ */ new Set());\n    __publicField(this, "networkUtils");\n    __publicField(this, "linkObserver", null);\n    __publicField(this, "resourceHintsManager");\n    __publicField(this, "prefetchQueue");\n    this.options = {\n      rootMargin: options.rootMargin ?? "50px",\n      delay: options.delay ?? PREFETCH_DEFAULT_DELAY_MS2,\n      maxConcurrent: options.maxConcurrent ?? 2,\n      allowedNetworks: options.allowedNetworks ?? ["4g", "wifi", "ethernet"],\n      maxSize: options.maxSize ?? PREFETCH_MAX_SIZE_BYTES2,\n      timeout: options.timeout ?? PREFETCH_DEFAULT_TIMEOUT_MS2\n    };\n    this.networkUtils = new NetworkUtils(this.options.allowedNetworks);\n    this.resourceHintsManager = new ResourceHintsManager();\n    this.prefetchQueue = new PrefetchQueue(\n      {\n        maxConcurrent: this.options.maxConcurrent,\n        maxSize: this.options.maxSize,\n        timeout: this.options.timeout\n      },\n      this.prefetchedUrls\n    );\n    this.prefetchQueue.setResourceCallback(\n      (response, url) => this.prefetchPageResources(response, url)\n    );\n  }\n  init() {\n    prefetchLogger.info("Initializing prefetch manager");\n    if (!this.networkUtils.shouldPrefetch()) {\n      prefetchLogger.info("Prefetching disabled due to network conditions");\n      return;\n    }\n    this.linkObserver = new LinkObserver(\n      {\n        rootMargin: this.options.rootMargin,\n        delay: this.options.delay,\n        onLinkVisible: (link) => this.prefetchQueue.prefetchLink(link)\n      },\n      this.prefetchedUrls\n    );\n    this.linkObserver.init();\n    this.networkUtils.onNetworkChange(() => {\n      if (!this.networkUtils.shouldPrefetch()) this.prefetchQueue.stopAll();\n    });\n  }\n  async prefetchPageResources(response, _pageUrl) {\n    const html = await response.text();\n    const hints = this.resourceHintsManager.extractResourceHints(html, this.prefetchedUrls);\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  applyResourceHints(hints) {\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  async prefetch(url) {\n    await this.prefetchQueue.prefetch(url);\n  }\n  static generateResourceHints(route, assets) {\n    return ResourceHintsManager.generateResourceHints(route, assets);\n  }\n  destroy() {\n    this.linkObserver?.destroy();\n    this.prefetchQueue.stopAll();\n    this.prefetchedUrls.clear();\n  }\n};\nfunction initPrefetch(options) {\n  const prefetchManager = new PrefetchManager(options);\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => prefetchManager.init(), { once: true });\n  } else {\n    prefetchManager.init();\n  }\n  globalThis.veryFrontPrefetch = prefetchManager;\n  return prefetchManager;\n}\nfunction resolveAutoInitOptions() {\n  const setting = globalThis.__VERYFRONT_PREFETCH__;\n  if (!setting) return null;\n  if (setting === true) return {};\n  if (typeof setting === "object") return setting;\n  return null;\n}\nfunction shouldAutoInitPrefetch(options) {\n  if (!options) return false;\n  if (typeof window === "undefined" || typeof document === "undefined") return false;\n  const win = window;\n  const doc = document;\n  if (win.__veryfrontSSRStub || doc.__veryfrontSSRStub) return false;\n  if (typeof IntersectionObserver === "undefined") return false;\n  if (typeof MutationObserver === "undefined") return false;\n  return true;\n}\nvar autoInitOptions = resolveAutoInitOptions();\nif (shouldAutoInitPrefetch(autoInitOptions)) initPrefetch(autoInitOptions);\nexport {\n  PrefetchManager,\n  initPrefetch\n};\n';
diff --git a/src/modules/server/module-batch-handler.ts b/src/modules/server/module-batch-handler.ts
index e5d505ccbe..baa37819c7 100644
--- a/src/modules/server/module-batch-handler.ts
+++ b/src/modules/server/module-batch-handler.ts
@@ -276,7 +276,6 @@ export function handleModuleBatch(req: Request, options: BatchHandlerOptions): P
         adapter,
         context: "module-loading",
         contextOptions: { allowedImportDirs },
-        throwOnError: false,
       });
 
       logger.debug("Processing batch request", {
diff --git a/src/modules/server/module-server.ts b/src/modules/server/module-server.ts
index 446a4a3e4b..eaa9d5fca4 100644
--- a/src/modules/server/module-server.ts
+++ b/src/modules/server/module-server.ts
@@ -332,7 +332,6 @@ export function serveModule(req: Request, options: ModuleServerOptions): Promise
         adapter,
         context: "module-loading",
         contextOptions: { allowedImportDirs },
-        throwOnError: false,
         onSecurityEvent: (event) => {
           if (event.type !== "validation-failed") return;
           logger.warn("Security validation failed", {
diff --git a/src/platform/adapters/base.ts b/src/platform/adapters/base.ts
index 11c9623e52..e90927b6b3 100644
--- a/src/platform/adapters/base.ts
+++ b/src/platform/adapters/base.ts
@@ -232,6 +232,8 @@ export interface FileSystemAdapter {
    * adapters must omit this marker and provide lstat and realPath instead.
    */
   readonly symlinkSemantics?: "none";
+  /** Adapter is immutably bound to one project and needs no request scope. */
+  readonly projectContextSemantics?: "fixed";
   readFile(path: string): Promise<string>;
   /** Read raw bytes when binary-safe access is required */
   readFileBytes?(path: string): Promise<Uint8Array>;
diff --git a/src/platform/adapters/fs/github/adapter.test.ts b/src/platform/adapters/fs/github/adapter.test.ts
index 12d9168249..a15a3db57d 100644
--- a/src/platform/adapters/fs/github/adapter.test.ts
+++ b/src/platform/adapters/fs/github/adapter.test.ts
@@ -2,6 +2,9 @@ import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
 import { afterEach, beforeEach, describe, it } from "#veryfront/testing/bdd.ts";
 import { isNotFoundError } from "#veryfront/platform/compat/fs.ts";
+import { FSAdapterWrapper } from "../wrapper.ts";
+import { validatePath, ValidationPresets } from "#veryfront/security/path-validation/index.ts";
+import type { RuntimeAdapter } from "../../base.ts";
 import { GitHubFSAdapter } from "./adapter.ts";
 import { createGitHubConfig } from "./types.ts";
 
@@ -27,9 +30,10 @@ const mockFileContent = {
   encoding: "base64",
 };
 
-function createAdapter(): GitHubFSAdapter {
+function createAdapter(projectDir?: string): GitHubFSAdapter {
   return new GitHubFSAdapter({
     type: "github",
+    projectDir,
     github: { token: "test", owner: "owner", repo: "repo" },
   });
 }
@@ -114,6 +118,29 @@ describe("GitHubFSAdapter", () => {
 
       assertEquals(treeRequested, true);
     });
+
+    it("admits ordinary files through the real wrapper while excluding Git symlinks", async () => {
+      globalThis.fetch = createTreeFetch({
+        sha: "abc123",
+        tree: [
+          { path: "README.md", mode: "100644", type: "blob", sha: "sha1", size: 100 },
+          { path: "outside.md", mode: "120000", type: "blob", sha: "sha2", size: 9 },
+        ],
+        truncated: false,
+      });
+
+      const adapter = createAdapter("/project");
+      const wrapped = new FSAdapterWrapper(adapter);
+      const result = await validatePath("README.md", {
+        ...ValidationPresets.internal("/project"),
+        adapter: { fs: wrapped } as unknown as RuntimeAdapter,
+      });
+
+      assertEquals(wrapped.symlinkSemantics, "none");
+      assertEquals(result.valid, true);
+      assertEquals(result.canonicalPath, "/project/README.md");
+      assertEquals(await wrapped.exists("/project/outside.md"), false);
+    });
   });
 
   describe("file operations", () => {
diff --git a/src/platform/adapters/fs/github/adapter.ts b/src/platform/adapters/fs/github/adapter.ts
index 42c5870923..e783ae550a 100644
--- a/src/platform/adapters/fs/github/adapter.ts
+++ b/src/platform/adapters/fs/github/adapter.ts
@@ -19,6 +19,8 @@ import {
 const LOG_PREFIX = "[GitHubFSAdapter]";
 
 export class GitHubFSAdapter implements FSAdapter {
+  /** Git tree symlink blobs are excluded from the adapter's readable index. */
+  readonly symlinkSemantics = "none" as const;
   private readonly config: ResolvedGitHubConfig;
   private readonly client: GitHubApiClient;
   private readonly cache: FileCache;
diff --git a/src/platform/adapters/fs/github/stat-operations.ts b/src/platform/adapters/fs/github/stat-operations.ts
index b3530cfcab..3fc2121b77 100644
--- a/src/platform/adapters/fs/github/stat-operations.ts
+++ b/src/platform/adapters/fs/github/stat-operations.ts
@@ -84,6 +84,10 @@ export class GitHubStatOperations {
     this.directoryIndex.add("");
 
     for (const entry of entries) {
+      // Git represents symbolic links as blob entries with mode 120000. This
+      // virtual adapter never follows them: omit them entirely so every path it
+      // admits has symlink-free storage semantics.
+      if (entry.mode === "120000") continue;
       if (entry.type === "blob") {
         this.fileIndex.set(entry.path, {
           path: entry.path,
diff --git a/src/platform/adapters/fs/veryfront/adapter.ts b/src/platform/adapters/fs/veryfront/adapter.ts
index b6b265d0f2..d1dd535300 100644
--- a/src/platform/adapters/fs/veryfront/adapter.ts
+++ b/src/platform/adapters/fs/veryfront/adapter.ts
@@ -116,6 +116,7 @@ function buildManifestFetcher(
 export class VeryfrontFSAdapter implements FSAdapter {
   readonly maxWholeFileReadBytes = DEFAULT_VERYFRONT_API_SUCCESS_BODY_BYTES;
   readonly symlinkSemantics = "none" as const;
+  readonly projectContextSemantics: "fixed" | undefined;
   private client: VeryfrontApiClient;
   private cache: FileCache;
   private normalizer: PathNormalizer;
@@ -250,6 +251,7 @@ export class VeryfrontFSAdapter implements FSAdapter {
     this.projectSlug = vf.projectSlug ?? "";
     this.contentSource = vf.contentSource ?? { type: "branch", branch: "main" };
     this.proxyMode = vf.proxyMode ?? false;
+    this.projectContextSemantics = this.proxyMode ? undefined : "fixed";
 
     const retryConfig = buildRetryConfig(vf.retry);
 
diff --git a/src/platform/adapters/fs/veryfront/types.ts b/src/platform/adapters/fs/veryfront/types.ts
index cb0f67b51a..d481001200 100644
--- a/src/platform/adapters/fs/veryfront/types.ts
+++ b/src/platform/adapters/fs/veryfront/types.ts
@@ -7,6 +7,7 @@ export type { DirectoryEntry };
 
 export interface FSAdapter {
   readonly symlinkSemantics?: "none";
+  readonly projectContextSemantics?: "fixed";
   readFile(path: string): Promise<Uint8Array | string>;
   readFileBytes?(path: string): Promise<Uint8Array>;
   readonly maxWholeFileReadBytes?: number;
diff --git a/src/platform/adapters/fs/wrapper.ts b/src/platform/adapters/fs/wrapper.ts
index a60301ead6..c1e3a5d4f1 100644
--- a/src/platform/adapters/fs/wrapper.ts
+++ b/src/platform/adapters/fs/wrapper.ts
@@ -57,6 +57,7 @@ export interface ExtendedFileSystemAdapter extends FileSystemAdapter {
   isVeryfrontAdapter(): boolean;
   isMultiProjectMode(): boolean;
   isContextualMode(): boolean;
+  isFixedProjectMode(): boolean;
   setRequestToken(token: string): void;
   clearRequestToken(): void;
   setRequestBranch(branch: string | null): void;
@@ -134,6 +135,7 @@ export class FSAdapterWrapper implements ExtendedFileSystemAdapter {
   private readonly _fsAdapter: FSAdapter;
   private readonly _unboundedFileReader?: (path: string) => Promise<Uint8Array>;
   private readonly _wholeFileReader?: CapturedWholeFileReader;
+  private readonly _fixedProjectMode: boolean;
   readonly symlinkSemantics: "none" | undefined;
   readonly maxWholeFileReadBytes?: number;
   readonly readFileBytesBounded?: (path: string, byteLimit: number) => Promise<Uint8Array>;
@@ -154,6 +156,11 @@ export class FSAdapterWrapper implements ExtendedFileSystemAdapter {
     this.symlinkSemantics = semantics && "value" in semantics && semantics.value === "none"
       ? "none"
       : undefined;
+    const projectContext = Object.getOwnPropertyDescriptor(fsAdapter, "projectContextSemantics");
+    this._fixedProjectMode = projectContext && "value" in projectContext &&
+        projectContext.value === "fixed"
+      ? true
+      : false;
 
     const snapshotReader = captureSnapshotReadCapability(fsAdapter, "FSAdapter", true);
     let byteReaders: CapturedByteReaders;
@@ -306,8 +313,12 @@ export class FSAdapterWrapper implements ExtendedFileSystemAdapter {
       typeof this._fsAdapter.runWithContext === "function";
   }
 
+  isFixedProjectMode(): boolean {
+    return this._fixedProjectMode;
+  }
+
   isContextualMode(): boolean {
-    return isContextualAdapter(this._fsAdapter);
+    return isContextualAdapter(this._fsAdapter) && !this.isFixedProjectMode();
   }
 
   async readFile(path: string): Promise<string> {
diff --git a/src/react/components/chat/chat/hooks/use-upload.test.tsx b/src/react/components/chat/chat/hooks/use-upload.test.tsx
index 5ada6b10e7..4a5c8c87ba 100644
--- a/src/react/components/chat/chat/hooks/use-upload.test.tsx
+++ b/src/react/components/chat/chat/hooks/use-upload.test.tsx
@@ -1,6 +1,6 @@
 import * as React from "react";
 import { flushSync } from "react-dom";
-import { createRoot } from "react-dom/client";
+import { createRoot, type Root } from "react-dom/client";
 import { JSDOM } from "npm:jsdom@28.0.0";
 import {
   assert,
@@ -177,6 +177,18 @@ function installDom(): {
   };
 }
 
+/**
+ * Unmount and drain the scheduler task React leaves behind.
+ *
+ * React's scheduler holds a `setImmediate` until it next runs. It completes on
+ * its own, but the test has to yield once more or Deno's leak sanitizer sees
+ * the timer still pending.
+ */
+async function unmount(root: Root): Promise<void> {
+  flushSync(() => root.unmount());
+  await new Promise((resolve) => setTimeout(resolve, 0));
+}
+
 describe("useUpload", () => {
   it("creates collision-resistant attachment ids with Web Crypto", () => {
     assertEquals(
@@ -226,7 +238,7 @@ describe("useUpload", () => {
     assertStrictEquals(actual, expected);
   });
 
-  it("releases previews and preserves the allocation error when a batch cannot finish", () => {
+  it("releases previews and preserves the allocation error when a batch cannot finish", async () => {
     const dom = installDom();
     let latest: UseUploadResult | null = null;
     const createObjectURL = URL.createObjectURL;
@@ -261,7 +273,7 @@ describe("useUpload", () => {
       assertStrictEquals(actual, allocationError);
       assertEquals(dom.revokedObjectURLs, ["blob:test-preview-1"]);
       assertEquals((latest as unknown as UseUploadResult).attachments, []);
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
@@ -279,7 +291,7 @@ describe("useUpload", () => {
     assertEquals(parseChatUploadResponse(oversizedUnicode), null);
   });
 
-  it("clamps transport progress to the documented percentage range", () => {
+  it("clamps transport progress to the documented percentage range", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -305,13 +317,13 @@ describe("useUpload", () => {
         (latest as unknown as UseUploadResult).attachments[0]?.progress,
         100,
       );
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
   });
 
-  it("aborts pending uploads and releases previews on unmount", () => {
+  it("aborts pending uploads and releases previews on unmount", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -331,7 +343,7 @@ describe("useUpload", () => {
       assertEquals(PendingXMLHttpRequest.instances.length, 1);
       assertEquals((latest as unknown as UseUploadResult).attachments.length, 1);
 
-      flushSync(() => root.unmount());
+      await unmount(root);
 
       assertEquals(PendingXMLHttpRequest.instances[0]?.aborted, true);
       assertEquals(dom.revokedObjectURLs, ["blob:test-preview-1"]);
@@ -340,7 +352,7 @@ describe("useUpload", () => {
     }
   });
 
-  it("finishes clear cleanup and reports transport abort errors exactly", () => {
+  it("finishes clear cleanup and reports transport abort errors exactly", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     const previousReportError = (globalThis as { reportError?: (error: unknown) => void })
@@ -374,7 +386,7 @@ describe("useUpload", () => {
       assertEquals((latest as unknown as UseUploadResult).attachments, []);
       assertEquals(reported.length, 1);
       assertStrictEquals(reported[0], abortError);
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       if (previousReportError) {
         (globalThis as { reportError?: (error: unknown) => void }).reportError =
@@ -386,7 +398,7 @@ describe("useUpload", () => {
     }
   });
 
-  it("uses the latest retry and ignores a late completion from the aborted request", () => {
+  it("uses the latest retry and ignores a late completion from the aborted request", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -419,7 +431,7 @@ describe("useUpload", () => {
         "https://cdn.example.com/current.txt",
       );
       assertEquals((latest as unknown as UseUploadResult).attachments[0]?.uploadId, "current");
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
@@ -464,13 +476,13 @@ describe("useUpload", () => {
         (latest as unknown as UseUploadResult).attachments[0]?.url,
         "https://cdn.example.com/current.txt",
       );
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
   });
 
-  it("accepts a new-scope upload from a descendant layout effect during handoff", () => {
+  it("accepts a new-scope upload from a descendant layout effect during handoff", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -501,13 +513,13 @@ describe("useUpload", () => {
         "Bearer new",
       );
       assertEquals((latest as unknown as UseUploadResult).attachments.length, 1);
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
   });
 
-  it("removal aborts ownership and a late callback cannot resurrect the attachment", () => {
+  it("removal aborts ownership and a late callback cannot resurrect the attachment", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -532,13 +544,13 @@ describe("useUpload", () => {
       request.responseText = '{"url":"https://cdn.example.com/late.txt","id":"late"}';
       flushSync(() => staleOnload?.());
       assertEquals((latest as unknown as UseUploadResult).attachments, []);
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
   });
 
-  it("inline retries are epoch-owned and keep only the latest FileReader result", () => {
+  it("inline retries are epoch-owned and keep only the latest FileReader result", async () => {
     const dom = installDom();
     PendingFileReader.instances = [];
     let latest: UseUploadResult | null = null;
@@ -566,13 +578,13 @@ describe("useUpload", () => {
         (latest as unknown as UseUploadResult).attachments[0]?.url,
         "data:text/plain;base64,Y3VycmVudA==",
       );
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
   });
 
-  it("retained callbacks are inert after unmount and allocate no previews", () => {
+  it("retained callbacks are inert after unmount and allocate no previews", async () => {
     const dom = installDom();
     PendingXMLHttpRequest.instances = [];
     let latest: UseUploadResult | null = null;
@@ -585,7 +597,7 @@ describe("useUpload", () => {
       const root = createRoot(document.getElementById("root")!);
       flushSync(() => root.render(<Capture />));
       const retained = latest as unknown as UseUploadResult;
-      flushSync(() => root.unmount());
+      await unmount(root);
 
       retained.upload([new File(["image"], "late.png", { type: "image/png" })]);
       retained.remove("missing");
@@ -660,7 +672,7 @@ describe("useUpload", () => {
           </React.Suspense>,
         )
       );
-      flushSync(() => root.unmount());
+      await unmount(root);
     } finally {
       dom.restore();
     }
diff --git a/src/release-assets/build-executor.ts b/src/release-assets/build-executor.ts
index b5c463cb07..d72d9577a1 100644
--- a/src/release-assets/build-executor.ts
+++ b/src/release-assets/build-executor.ts
@@ -53,7 +53,7 @@ import { getReactUrls } from "#veryfront/transforms/esm/react-cdn.ts";
 import { PLATFORM_UTILITIES } from "#veryfront/html/utils.ts";
 import { extractCandidatesFromFiles } from "#veryfront/html/styles-builder/candidate-extractor.ts";
 import { FRAMEWORK_CANDIDATES } from "#veryfront/server/handlers/dev/framework-candidates.generated.ts";
-import { validatePathSync } from "#veryfront/security/path-validation.ts";
+import { validateLexicalPath } from "#veryfront/security/path-validation.ts";
 import {
   CSS_IMPORTING_SOURCE_EXTENSIONS,
   resolveCssImportPath,
@@ -1371,9 +1371,11 @@ function portableReleaseFilePathKey(filePath: string): string {
 }
 
 function resolveMaterializedReleasePath(tempDir: string, filePath: string): string {
-  const result = validatePathSync(filePath, {
+  // The build owns a newly-created temporary root and materializes only regular
+  // file contents beneath it; no caller-controlled filesystem links are
+  // admitted. Lexical containment is therefore the correct boundary here.
+  const result = validateLexicalPath(filePath, {
     baseDir: tempDir,
-    level: "strict",
     allowAbsolute: false,
   });
   const resolvedPath = result.canonicalPath ? normalize(result.canonicalPath) : null;
diff --git a/src/repositories/filesystem/filesystem-repository.ts b/src/repositories/filesystem/filesystem-repository.ts
index e7a2a869d6..b52e95d0dc 100644
--- a/src/repositories/filesystem/filesystem-repository.ts
+++ b/src/repositories/filesystem/filesystem-repository.ts
@@ -18,8 +18,6 @@ export interface SecureFsRepositoryConfig {
   context: RepositoryContext;
   /** Security context for validation (default: "internal") */
   securityContext?: SecurityContext;
-  /** Whether to throw on validation errors (default: true) */
-  throwOnError?: boolean;
 }
 
 /**
@@ -51,7 +49,6 @@ export class SecureFsRepository implements FileSystemRepository {
       baseDir: config.baseDir,
       adapter: config.adapter,
       context: config.securityContext ?? "internal",
-      throwOnError: config.throwOnError ?? true,
     });
     if (this.secureFs.maxWholeFileReadBytes !== undefined) {
       Object.defineProperty(this, "maxWholeFileReadBytes", {
diff --git a/src/repositories/repositories.test.ts b/src/repositories/repositories.test.ts
index 9516563f91..f5d2d5f9b4 100644
--- a/src/repositories/repositories.test.ts
+++ b/src/repositories/repositories.test.ts
@@ -197,6 +197,16 @@ describe("MockFileSystemRepository", () => {
 });
 
 describe("SecureFsRepository", () => {
+  it("fails closed for paths outside its repository root", async () => {
+    const repository = createFileSystemRepository({
+      baseDir: "/project",
+      adapter: createMockAdapter(),
+      context: createMockRepositoryContext(),
+    });
+
+    await expect(repository.readFile("../outside.txt")).rejects.toThrow();
+  });
+
   it("publishes immutable exact and snapshot read capabilities", async () => {
     const adapter = createMockAdapter();
     adapter.fs.files.set("/project/asset.bin", "abc");
diff --git a/src/security/README.md b/src/security/README.md
index 51ec08fa09..19450d9619 100644
--- a/src/security/README.md
+++ b/src/security/README.md
@@ -1,343 +1,200 @@
-# Security Module
+# Security module reference
 
-## Purpose
+`src/security` owns Veryfront's request-security primitives and the internal
+worker boundary used to run project code. Its only published package entrypoint
+is `veryfront/security`, mapped to [`index.ts`](./index.ts).
 
-The security module provides core security primitives and policies for Veryfront applications, including CSP (Content Security Policy), CORS, authentication utilities, and input validation.
+This module does not provide password hashing, JWT verification, SQL escaping,
+or a public sandbox API. Authentication here is limited to the runtime's Basic
+and bearer-token request gate. Public rate limiting belongs to
+[`veryfront/middleware`](../middleware/README.md).
 
-## Scope
+## Published surface
 
-### What this module does:
+The root entrypoint exports the following groups:
 
-- Content Security Policy (CSP) configuration and enforcement
-- CORS (Cross-Origin Resource Sharing) policies
-- CSRF (Cross-Site Request Forgery) protection
-- Authentication helpers and session management
-- Input validation and sanitization
-- Path traversal protection
-- Security headers management
-- Rate limiting
-- Secure filesystem operations
-- Deno permission management
-- Sandbox for untrusted code execution
+| Area             | Runtime exports                                                                                                                                  |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| HTTP handlers    | `BaseHandler`, `AuthHandler`, `CsrfHandler`, `SecurityConfigLoader`, deprecated `loadSecurityConfig` and `isValidSecurityConfig`                 |
+| Input boundaries | `validateRequestLimits`, `readBodyWithLimit`, `parseJsonBody`, `parseFormData`, `parseQueryParams`, `createValidatedHandler`                     |
+| CORS             | `cors`, `corsSimple`, `validateOrigin`, `validateOriginSync`, `applyCORSHeaders`, `applyCORSHeadersSync`, `handleCORSPreflight`                  |
+| CSRF             | `generateCsrfToken`, `validateCsrf`, `applyCsrfCookie`                                                                                           |
+| Responses        | `ResponseBuilder`, `createResponseBuilder`, `applySecurityHeaders`, `buildCacheControl`, `generateNonce`                                         |
+| Paths and files  | `validatePath`, `validateLexicalPath`, deprecated `validatePathSync`, `createValidator`, `createSecureFs`, `SecureFs`, `wrapAdapterWithSecurity` |
+| Deno permissions | `BUILD_HELPER_PERMISSIONS`, `SERVER_PERMISSIONS`, `WORKFLOW_RUN_PERMISSIONS`                                                                     |
 
-### What this module does NOT do:
+Types are exported beside their owning runtime contracts. The exact runtime
+inventory is regression-pinned in [`index.test.ts`](./index.test.ts); adding or
+removing a root export is an intentional package-surface change.
 
-- Middleware execution (see `middleware/builtin/security/`)
-- Agent sandbox execution (see `src/sandbox/`)
+## Policy ownership
 
-## Architecture
+### Configuration
 
-```
-security/
-├── http/                   # HTTP security
-│   ├── auth.ts            # Authentication utilities
-│   ├── config.ts          # Security configuration
-│   ├── cors.ts            # CORS policies
-│   └── csp.ts             # Content Security Policy
-├── csrf/                   # CSRF protection
-├── input-validation/       # Input sanitization
-│   ├── validators.ts      # Validation rules
-│   └── sanitizers.ts      # Input cleaning
-├── path-validation/        # Path traversal protection
-├── rate-limit/            # Rate limiting [has README]
-├── sandbox/               # Sandboxed code execution
-├── client/                # Client-side security utilities
-├── utils/                 # Security utility functions
-├── secure-fs.ts           # Secure filesystem operations
-├── path-validation.ts     # Path validation utilities
-└── deno-permissions.ts    # Deno permission management
-```
-
-## Key Exports
+Project security configuration is validated by the canonical configuration
+schema before `SecurityConfigLoader` derives a request-owned, frozen security
+context. Production derivation enables the default CSRF policy when the project
+does not specify one. A failed configuration load fails the current request and
+remains retryable for a later request.
 
-### CSP (Content Security Policy)
-
-- `createCSPPolicy(options)` - Generate CSP header
-- `CSPBuilder` - Fluent CSP builder
-- `defaultCSP` - Secure default policy
+`SecurityConfigLoader` is the canonical runtime configuration loader. Call
+`ensureLoaded()` before reading its derived values. The deprecated
+`loadSecurityConfig()` and `isValidSecurityConfig()` exports remain for source
+compatibility. They delegate to the canonical loader/schema behavior;
+`loadSecurityConfig()` propagates load and validation failures and returns
+`null` only when no security policy is configured.
 
 ### CORS
 
-- `createCORSPolicy(options)` - CORS configuration
-- `isAllowedOrigin(origin, policy)` - Origin validation
-- `CORSPreflightHandler` - Handle OPTIONS requests
-
-### Authentication
-
-- `validateAuthToken(token)` - JWT/session validation
-- `hashPassword(password)` - Secure password hashing
-- `comparePasswords(plain, hashed)` - Password verification
-
-### Input Validation
-
-- `validateInput(value, rules)` - Multi-rule validation
-- `sanitizeHTML(html)` - XSS protection
-- `escapeSQL(query)` - SQL injection protection
+CORS policy owns every `Access-Control-*` response header. Runtime helpers
+snapshot and validate their configuration, reject wildcard origins combined
+with credentials, bound all reflected lists, and fail closed when an origin
+validator throws or returns an invalid value.
 
-## Dependencies
+Use the asynchronous helpers when an origin validator can return a promise.
+The synchronous helpers deliberately deny promise-returning validators.
 
-### Internal
-
-- `shared/` - Utilities and constants
-- `server/` - HTTP integration
-
-### External
-
-- `bcrypt` (optional) - Password hashing
-- `jsonwebtoken` (optional) - JWT handling
-
-## Usage Examples
-
-### Content Security Policy
-
-```typescript
-import { CSPBuilder } from "./security/http";
-
-const csp = new CSPBuilder()
-  .defaultSrc(["self"])
-  .scriptSrc(["self", "https://cdn.example.com"])
-  .styleSrc(["self", "unsafe-inline"])
-  .imgSrc(["self", "data:", "https:"])
-  .build();
-
-// Apply to response
-response.headers.set("Content-Security-Policy", csp);
-```
+### CSRF
 
-### CORS Configuration
-
-```typescript
-import { createCORSPolicy } from "./security/http";
-
-const cors = createCORSPolicy({
-  origin: ["https://app.example.com", "https://admin.example.com"],
-  methods: ["GET", "POST", "PUT", "DELETE"],
-  credentials: true,
-  maxAge: 86400, // 24 hours
-});
-
-// Check origin
-if (cors.isAllowed(request.headers.get("origin"))) {
-  // Add CORS headers
-}
-```
+CSRF uses a double-submit cookie and header comparison. The default cookie is
+`__Host-vf_csrf`; it is host-only, path-scoped to `/`, and always secure.
+Cookie/header names and token lifetimes are bounded both in configuration and
+at the public helper boundary. State-changing requests are checked unless an
+exact, schema-validated exclusion applies.
 
 ### Authentication
 
-```typescript
-import { hashPassword, validateAuthToken } from "./security/http";
-
-// Hash password
-const hashedPassword = await hashPassword("user-password");
-
-// Validate token
-const payload = await validateAuthToken(token, {
-  secret: process.env.JWT_SECRET,
-  algorithms: ["HS256"],
-});
-
-console.log(payload.userId);
-```
-
-### Input Validation
-
-```typescript
-import { sanitizeHTML, validateInput } from "./security/input-validation";
-
-// Validate email
-const emailResult = validateInput(userInput.email, {
-  type: "email",
-  required: true,
-  maxLength: 255,
-});
-
-if (!emailResult.valid) {
-  throw new Error(emailResult.errors.join(", "));
-}
-
-// Sanitize HTML content
-const safeHTML = sanitizeHTML(userInput.bio, {
-  allowedTags: ["p", "br", "strong", "em"],
-  allowedAttributes: {},
-});
-```
-
-## Security Best Practices
-
-### 1. CSP Configuration
-
-```typescript
-// Production CSP - Strict
-const strictCSP = new CSPBuilder()
-  .defaultSrc(["none"])
-  .scriptSrc(["self"])
-  .styleSrc(["self"])
-  .imgSrc(["self"])
-  .connectSrc(["self"])
-  .fontSrc(["self"])
-  .objectSrc(["none"])
-  .mediaSrc(["self"])
-  .frameSrc(["none"])
-  .build();
-
-// Development CSP - Relaxed for HMR
-const devCSP = new CSPBuilder()
-  .defaultSrc(["self"])
-  .scriptSrc(["self", "unsafe-eval"]) // For HMR
-  .connectSrc(["self", "ws:", "wss:"]) // For WebSocket
-  .build();
-```
-
-### 2. CORS Policies
-
-```typescript
-// Public API - Open CORS
-const publicCORS = createCORSPolicy({
-  origin: "*",
-  methods: ["GET"],
-  credentials: false,
-});
-
-// Private API - Restricted CORS
-const privateCORS = createCORSPolicy({
-  origin: (origin) => {
-    return origin?.endsWith(".example.com") ?? false;
-  },
-  methods: ["GET", "POST", "PUT", "DELETE"],
-  credentials: true,
-  exposedHeaders: ["X-Request-ID"],
-});
+`AuthHandler` accepts either one Basic credential pair or one bearer token.
+Ambiguous environment configuration fails closed. Unauthorized responses are
+non-cacheable and receive the resolved CORS and security policy. Credential
+verification uses constant-time comparison.
+
+### Input validation
+
+Each standalone body, form, and query parser applies the same snapshotted
+request limits as `createValidatedHandler`. Query parsing measures the complete
+URL in UTF-8 bytes before allocating parameter collections. JSON parsing also
+captures the decoded value through the framework's bounded, iterative JSON
+snapshot before invoking a schema, so excessive depth, node count, or string
+size cannot be delegated to a recursive validator. Composite handlers reuse
+their already-validated request boundary rather than silently skipping or
+repeating those checks.
+
+### Response headers
+
+`ResponseBuilder` centralizes CSP, HSTS, framing, cross-origin, referrer, cache,
+and CORS response headers. Server integrations remove project-provided
+policy-owned headers before applying the host policy. Project configuration can
+override supported security headers, but `Access-Control-*` values must be
+configured through CORS. The production default CSP admits only same-origin
+resources plus narrowly required nonce, data, and blob sources; CDN, font,
+media-provider, analytics, and API origins must be declared by the owning
+extension or explicit project CSP. The obsolete browser XSS auditor is disabled
+with `X-XSS-Protection: 0`.
+
+### Paths and filesystem access
+
+Path validation canonicalizes existing ancestors, rejects traversal and
+symlink escapes, and applies context-specific rules. `SecureFs` validates a
+path before delegating to the configured runtime adapter. Its trust root and
+policy are immutable after construction; it exposes no raw-adapter escape
+hatch. Policy records and directory allowlists are copied from own data
+properties, so inherited settings, accessors, and later caller mutations cannot
+change the active policy. Directory iteration and watcher installation use
+asynchronous physical canonicalization. Filesystem adapters must provide
+`lstat`/`realPath` for the requested symlink policy or explicitly guarantee that
+their API cannot traverse symbolic links; unknown semantics fail closed.
+An omitted module-import allowlist is explicitly unrestricted within the
+project root, while an empty allowlist denies every project subdirectory; the
+two states are never collapsed.
+Callers that create a watcher must await `watcher.ready` before assuming it is
+active. Binary reads require a native binary-safe adapter capability and never
+fall back to text transcoding. Temporary directories are created beneath the
+configured trust root.
+
+`validateLexicalPath` performs only string-level containment checks. It does
+not accept adapter, existence, or symlink-policy options and must not be used as
+filesystem admission for a local or otherwise symlink-capable backing store.
+The deprecated `validatePathSync` compatibility wrapper applies the same
+lexical-only behavior while accepting historical policy fields; those fields
+cannot enable filesystem checks or weaken containment.
+Conversely, `validatePath` always requires the runtime adapter whose filesystem
+will perform the admitted operation. `ValidationPresets` are immutable policy
+fragments, not standalone physical validators; combine a preset with that
+adapter or use `SecureFs`, which does so at construction.
+
+This is a path-admission boundary, not an operating-system capability sandbox.
+A hostile actor that can concurrently replace filesystem entries can still
+create time-of-check/time-of-use races on adapters without descriptor-relative
+filesystem operations. Production deployments must not grant project code
+independent write access to the host paths being served.
+
+## Internal worker isolation
+
+[`sandbox/`](./sandbox/) is an internal runtime implementation used by Routing,
+Data, and Rendering. It is not exported from `veryfront/security`.
+
+The worker pool provides:
+
+- bounded worker count and exactly one active admission per serialized worker;
+- per-request deadlines and generation retirement;
+- project-root reads plus immutable framework-source reads in compiled builds,
+  with shared caches and `DENO_DIR` excluded;
+- denied Deno environment permission, with a frozen request-owned `env` record
+  passed through App and Pages handler contexts instead;
+- denied remote module imports, including for renderer dependencies;
+- prepared-module size and retained-module limits;
+- bounded, normalized data-loader results before worker-to-host transfer;
+- a private control port protected from project-code message forgery;
+- DNS-pinned outbound networking that blocks loopback, private, link-local,
+  metadata, and other non-global destinations by default; and
+- deterministic cleanup of workers, streams, timers, and egress brokers.
+
+Worker isolation is disabled unless `WORKER_ISOLATION_ENABLED` and the relevant
+`WORKER_ISOLATION_API`, `WORKER_ISOLATION_DATA`, or `WORKER_ISOLATION_SSR` flag
+are enabled. Defined invalid flags and pool limits are startup errors; they are
+not silently replaced with defaults.
+
+`WORKER_ISOLATION_SSR=1` additionally requires explicit registration of
+`@veryfront/ext-react-ssr`. That extension supplies a local, offline renderer
+bundle through the isolated-SSR contract. Core does not import React, and there
+is no host-rendering or remote-import fallback; an SSR request fails closed with
+an installation hint when the extension is absent. API and data workers do not
+resolve or receive the renderer contract.
+
+Deno Workers share the host process. Worker retirement is lifecycle hygiene,
+not a hard per-worker memory or CPU boundary. A project can still create
+host-process memory pressure or consume a worker thread until the host
+terminates it. Strong memory, CPU, and process containment requires a
+separately limited process or container.
+
+## Internal-only files
+
+- [`client/`](./client/) validates trusted HTML and serializes values for inline
+  scripts.
+- [`http/`](./http/) contains handler, CORS, and response-policy
+  implementations.
+- [`input-validation/`](./input-validation/) contains bounded body readers and
+  request parsers.
+- [`path-validation/`](./path-validation/) contains canonicalization and
+  validation rules.
+- [`sandbox/`](./sandbox/) contains the project-worker protocol and pool.
+- [`rate-limit/client-key.ts`](./rate-limit/client-key.ts) is the shared client
+  identity helper used by public middleware rate limiting.
+
+The maintained rate limiter is in `src/middleware/builtin/security`; Security
+contains no second implementation.
+
+## Verification
+
+Run the complete module portfolio with:
+
+```sh
+DENO_TESTING=1 VF_DISABLE_LRU_INTERVAL=1 NODE_ENV=test \
+  deno test --preload=src/schemas/_test-setup.ts --no-check --allow-all \
+  --unstable-worker-options --unstable-net src/security
 ```
 
-### 3. Password Security
-
-```typescript
-import { comparePasswords, hashPassword } from "./security/http";
-
-// Registration
-const user = {
-  email: input.email,
-  passwordHash: await hashPassword(input.password, {
-    rounds: 12, // bcrypt cost factor
-  }),
-};
-
-// Login
-const valid = await comparePasswords(
-  input.password,
-  user.passwordHash,
-);
-```
-
-### 4. Input Validation
-
-```typescript
-// Define validation schema
-const userSchema = {
-  email: {
-    type: "email",
-    required: true,
-    maxLength: 255,
-  },
-  age: {
-    type: "number",
-    min: 18,
-    max: 120,
-  },
-  bio: {
-    type: "string",
-    maxLength: 1000,
-    sanitize: true,
-  },
-};
-
-// Validate and sanitize
-const result = validateInput(userInput, userSchema);
-if (!result.valid) {
-  return new Response(JSON.stringify({ errors: result.errors }), {
-    status: 400,
-  });
-}
-```
-
-## Security Headers
-
-### Recommended Headers
-
-```typescript
-const securityHeaders = {
-  "Content-Security-Policy": csp,
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "X-XSS-Protection": "1; mode=block",
-  "Referrer-Policy": "strict-origin-when-cross-origin",
-  "Permissions-Policy": "geolocation=(), microphone=(), camera=()",
-  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
-};
-```
-
-## Testing
-
-```bash
-# Run security tests
-deno task test src/security/
-
-# Test CSP generation
-deno task test src/security/http/csp.test.ts
-
-# Test input validation
-deno task test src/security/input-validation/
-```
-
-## Maintainer
-
-**Team:** Security Team
-**Primary Contact:** security@example.com
-**Code Owners:** See CODEOWNERS file
-
-## Related Modules
-
-- [`server/`](../server/README.md) - Request handlers with security enforcement
-- [`middleware/`](../middleware/README.md) - Security middleware
-
-## Common Vulnerabilities
-
-### XSS (Cross-Site Scripting)
-
-**Prevention:**
-
-- Use `sanitizeHTML()` for user content
-- Set strict CSP
-- Escape output in templates
-
-### CSRF (Cross-Site Request Forgery)
-
-**Prevention:**
-
-- Use SameSite cookies
-- Validate CORS origin
-- Implement CSRF tokens
-
-### SQL Injection
-
-**Prevention:**
-
-- Use parameterized queries
-- Never concatenate user input
-- Use `escapeSQL()` as last resort
-
-### Authentication Issues
-
-**Prevention:**
-
-- Use secure password hashing (bcrypt, cost ≥12)
-- Implement rate limiting
-- Use HTTPS only
-- Set secure session cookies
-
-## References
-
-- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
-- [CSP Reference](https://content-security-policy.com/)
-- [CORS Specification](https://fetch.spec.whatwg.org/#http-cors-protocol)
-- [Veryfront Security Guide](https://veryfront.com/docs/security)
+Use `--trace-leaks` for the closure gate. Worker, Routing, Data, Rendering, and
+Server consumer suites are also required after changes to the sandbox protocol,
+permissions, CORS, response headers, or request parsing.
diff --git a/src/security/client/html-sanitizer.test.ts b/src/security/client/html-sanitizer.test.ts
index e2abcd1f27..40f9b68ab5 100644
--- a/src/security/client/html-sanitizer.test.ts
+++ b/src/security/client/html-sanitizer.test.ts
@@ -134,4 +134,14 @@ describe("jsonForInlineScript", () => {
     assertStringIncludes(result, "\\u0026");
     assertEquals(JSON.parse(result), value);
   });
+
+  it("rejects top-level values that JSON cannot serialize", () => {
+    for (const value of [undefined, () => undefined, Symbol("value")]) {
+      assertThrows(
+        () => jsonForInlineScript(value),
+        TypeError,
+        "must be JSON-serializable",
+      );
+    }
+  });
 });
diff --git a/src/security/client/html-sanitizer.ts b/src/security/client/html-sanitizer.ts
index cee4c8278b..21e27e0539 100644
--- a/src/security/client/html-sanitizer.ts
+++ b/src/security/client/html-sanitizer.ts
@@ -7,7 +7,7 @@
  * - validateTrustedHtml() provides defense-in-depth for server HTML
  */
 
-import { escapeHtml } from "#veryfront/html/html-escape.ts";
+import { escapeHtml } from "#veryfront/utils/html-escape.ts";
 import { SECURITY_VIOLATION } from "#veryfront/errors/error-registry.ts";
 
 export { escapeHtml };
@@ -40,7 +40,11 @@ export function escapeInlineJsonText(value: string): string {
 }
 
 export function jsonForInlineScript(value: unknown, space?: string | number): string {
-  return escapeInlineJsonText(JSON.stringify(value, null, space));
+  const serialized = JSON.stringify(value, null, space);
+  if (serialized === undefined) {
+    throw new TypeError("Inline script data must be JSON-serializable");
+  }
+  return escapeInlineJsonText(serialized);
 }
 
 export function buildTrustedHtmlValidatorScript(): string {
diff --git a/src/security/csrf/helpers.test.ts b/src/security/csrf/helpers.test.ts
index 8d717e0327..0c7fbca7b9 100644
--- a/src/security/csrf/helpers.test.ts
+++ b/src/security/csrf/helpers.test.ts
@@ -1,6 +1,6 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { assertEquals, assertNotEquals } from "#veryfront/testing/assert.ts";
+import { assertEquals, assertNotEquals, assertThrows } from "#veryfront/testing/assert.ts";
 import { applyCsrfCookie, generateCsrfToken, validateCsrf } from "./helpers.ts";
 
 describe("security/csrf/helpers", () => {
@@ -33,6 +33,14 @@ describe("security/csrf/helpers", () => {
       assertEquals(result.setCookie.includes("Secure"), false);
     });
 
+    it("keeps Secure for __Secure- prefixed cookies", () => {
+      const result = generateCsrfToken({
+        cookieName: "__Secure-my_csrf",
+        secure: false,
+      });
+      assertEquals(result.setCookie.includes("Secure"), true);
+    });
+
     it("should use custom cookie name", () => {
       const result = generateCsrfToken({ cookieName: "my_csrf" });
       assertEquals(result.setCookie.startsWith("my_csrf="), true);
@@ -48,6 +56,21 @@ describe("security/csrf/helpers", () => {
       const b = generateCsrfToken();
       assertNotEquals(a.token, b.token);
     });
+
+    it("rejects invalid cookie serialization options", () => {
+      for (
+        const options of [
+          { cookieName: "bad\r\nname" },
+          { cookieName: "" },
+          { ttlSec: 0 },
+          { ttlSec: Number.POSITIVE_INFINITY },
+          { httpOnly: "yes" as unknown as boolean },
+          { secure: "no" as unknown as boolean },
+        ]
+      ) {
+        assertThrows(() => generateCsrfToken(options));
+      }
+    });
   });
 
   describe("validateCsrf", () => {
@@ -124,6 +147,25 @@ describe("security/csrf/helpers", () => {
       });
       assertEquals(validateCsrf(req), false);
     });
+
+    it("fails closed for invalid runtime names", () => {
+      const req = new Request("http://localhost/submit", {
+        method: "POST",
+        headers: {
+          cookie: "__Host-vf_csrf=token",
+          "x-csrf-token": "token",
+        },
+      });
+
+      assertEquals(
+        validateCsrf(req, { cookieName: "bad\r\nname" }),
+        false,
+      );
+      assertEquals(
+        validateCsrf(req, { headerName: "" }),
+        false,
+      );
+    });
   });
 
   describe("applyCsrfCookie", () => {
diff --git a/src/security/csrf/helpers.ts b/src/security/csrf/helpers.ts
index 1fda775b44..af4250c3ca 100644
--- a/src/security/csrf/helpers.ts
+++ b/src/security/csrf/helpers.ts
@@ -9,7 +9,9 @@
 
 import { base64urlEncodeBytes } from "#veryfront/utils/base64url.ts";
 import { parseCookiesFromHeaders } from "#veryfront/utils/cookie-utils.ts";
-import { getHostEnv } from "#veryfront/platform/compat/process.ts";
+import { isProxyTopologyTrusted } from "#veryfront/platform/compat/proxy-topology.ts";
+import { HTTP_TOKEN_PATTERN } from "#veryfront/utils/cors-policy-limits.ts";
+import { MAX_CSRF_NAME_LENGTH, MAX_CSRF_TTL_SECONDS } from "#veryfront/utils/constants/security.ts";
 
 /** Default CSRF token TTL: 24 hours (longer than session action TTL to avoid stale-form 403s). */
 const CSRF_DEFAULT_TTL_SEC = 86_400;
@@ -31,15 +33,59 @@ export interface CsrfTokenOptions {
   secure?: boolean;
 }
 
+function requireCsrfName(value: unknown, label: string): string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > MAX_CSRF_NAME_LENGTH ||
+    !HTTP_TOKEN_PATTERN.test(value)
+  ) {
+    throw new TypeError(
+      `${label} must be a valid HTTP token no longer than ${MAX_CSRF_NAME_LENGTH} characters`,
+    );
+  }
+  return value;
+}
+
+function requireCsrfTtl(value: unknown): number {
+  if (
+    typeof value !== "number" ||
+    !Number.isSafeInteger(value) ||
+    value < 1 ||
+    value > MAX_CSRF_TTL_SECONDS
+  ) {
+    throw new RangeError("CSRF token ttlSec must be a positive safe integer");
+  }
+  return value;
+}
+
+function requireBooleanOption(value: unknown, label: string): boolean {
+  if (typeof value !== "boolean") {
+    throw new TypeError(`${label} must be a boolean`);
+  }
+  return value;
+}
+
 /** Generate a CSRF token and return value + Set-Cookie header string */
 export function generateCsrfToken(options?: CsrfTokenOptions): {
   token: string;
   setCookie: string;
 } {
-  const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
-  const maxAge = options?.ttlSec ?? CSRF_DEFAULT_TTL_SEC;
-  const httpOnly = options?.httpOnly ?? true;
-  const secure = cookieName.startsWith("__Host-") ? true : options?.secure ?? true;
+  const cookieName = requireCsrfName(
+    options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME,
+    "CSRF cookieName",
+  );
+  const maxAge = requireCsrfTtl(options?.ttlSec ?? CSRF_DEFAULT_TTL_SEC);
+  const httpOnly = options?.httpOnly === undefined
+    ? true
+    : requireBooleanOption(options.httpOnly, "CSRF token httpOnly");
+  const requestedSecure = options?.secure === undefined
+    ? true
+    : requireBooleanOption(options.secure, "CSRF token secure");
+  const secure = cookieName.startsWith("__Host-") ||
+      cookieName.startsWith("__Secure-")
+    ? true
+    : requestedSecure;
 
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);
@@ -74,22 +120,27 @@ export function validateCsrf(
   req: Request,
   options?: { cookieName?: string; headerName?: string },
 ): boolean {
-  const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
-  const headerName = options?.headerName ?? "x-csrf-token";
-
-  let cookieToken: string | undefined;
   try {
-    cookieToken = parseCookiesFromHeaders(req.headers)[cookieName];
-  } catch (_) {
-    /* expected: malformed cookie (e.g. bad percent-encoding) → treat as missing */
+    const cookieName = requireCsrfName(
+      options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME,
+      "CSRF cookieName",
+    );
+    const headerName = requireCsrfName(
+      options?.headerName ?? "x-csrf-token",
+      "CSRF headerName",
+    );
+    const cookieToken = parseCookiesFromHeaders(req.headers)[cookieName];
+    if (!cookieToken) return false;
+
+    const headerToken = req.headers.get(headerName) ?? "";
+    if (!headerToken) return false;
+
+    return timingSafeEqual(cookieToken, headerToken);
+  } catch {
+    // Invalid options, malformed cookies, and unreadable request headers all
+    // fail closed through this boolean validation contract.
     return false;
   }
-  if (!cookieToken) return false;
-
-  const headerToken = req.headers.get(headerName) ?? "";
-  if (!headerToken) return false;
-
-  return timingSafeEqual(cookieToken, headerToken);
 }
 
 /**
@@ -133,7 +184,7 @@ export function applyCsrfCookie(
   // deployment trusts the upstream proxy (VERYFRONT_TRUST_FORWARDED_HEADERS=1).
   // The forwarded header is client-spoofable otherwise, so blindly trusting it
   // could suppress the Secure flag on a genuinely-HTTPS deployment.
-  const trustProxyHeaders = getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1";
+  const trustProxyHeaders = isProxyTopologyTrusted();
   const isSecure = cookieName.startsWith("__Host-") ||
     req.url.startsWith("https://") ||
     (trustProxyHeaders && req.headers.get("x-forwarded-proto") === "https");
diff --git a/src/security/deno-permissions.ts b/src/security/deno-permissions.ts
index a071469625..9d89d7a27e 100644
--- a/src/security/deno-permissions.ts
+++ b/src/security/deno-permissions.ts
@@ -28,7 +28,7 @@ export const SERVER_PERMISSIONS = [
  *
  * `--allow-env` is intentionally left unscoped here rather than pinned to a
  * static allowlist: the set of env vars a run legitimately needs (tenant
- * context, MODE/run IDs, operator-supplied vars such as REDIS_URL) is assembled
+ * context, MODE/run IDs, and operator-supplied extension variables) is assembled
  * dynamically per execution and cannot be enumerated statically. The child uses
  * `clearEnv: true`, so it does not ordinarily inherit arbitrary host variables.
  * This profile still grants broad read, write, and network access and is only
diff --git a/src/security/http/auth.test.ts b/src/security/http/auth.test.ts
index 2644188b9a..995b0a3ca7 100644
--- a/src/security/http/auth.test.ts
+++ b/src/security/http/auth.test.ts
@@ -1,6 +1,7 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { expect } from "#std/expect.ts";
+import type { HandlerContext, SecurityConfig } from "#veryfront/types";
 import { AuthHandler } from "./auth.ts";
 
 /**
@@ -12,12 +13,16 @@ describe("AuthHandler realm sanitization", () => {
     return new AuthHandler();
   }
 
-  function createCtx(realm?: unknown) {
+  function createCtx(realm?: unknown): HandlerContext {
     const basic: Record<string, unknown> = { username: "admin", password: "secret" };
     if (realm !== undefined) basic.realm = realm;
     return {
-      securityConfig: { auth: { basic } },
-      adapter: { env: { get: () => "" } },
+      projectDir: "/tmp/auth-test",
+      securityConfig: { auth: { basic } } as unknown as SecurityConfig,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: () => "" },
+      } as unknown as HandlerContext["adapter"],
       isLocalProject: false,
     };
   }
@@ -25,8 +30,8 @@ describe("AuthHandler realm sanitization", () => {
   async function getWwwAuthenticate(handler: AuthHandler, realm?: unknown): Promise<string> {
     const ctx = createCtx(realm);
     const req = new Request("http://localhost/test");
-    const result = await handler.handle(req, ctx as any);
-    const response = (result as any).response as Response;
+    const result = await handler.handle(req, ctx);
+    const response = result.response as Response;
     return response.headers.get("WWW-Authenticate") ?? "";
   }
 
@@ -74,4 +79,391 @@ describe("AuthHandler realm sanitization", () => {
     const header = await getWwwAuthenticate(handler, 12345);
     expect(header).toBe('Basic realm="12345"');
   });
+
+  it("does not invoke conversion hooks on an invalid realm value", async () => {
+    const handler = createHandler();
+    let conversions = 0;
+    const hostileRealm = {
+      [Symbol.toPrimitive]() {
+        conversions++;
+        throw new Error("realm conversion must not run");
+      },
+    };
+
+    const header = await getWwwAuthenticate(handler, hostileRealm);
+
+    expect(header).toBe('Basic realm="Secure Area"');
+    expect(conversions).toBe(0);
+  });
+
+  it("keeps the outer Basic challenge request-local during CORS re-entry", async () => {
+    const handler = createHandler();
+    const outerCtx = createCtx("Outer Realm");
+    if (!outerCtx.securityConfig) throw new Error("test security config is required");
+
+    outerCtx.securityConfig.cors = {
+      origin: () => {
+        void handler.handle(
+          new Request("http://localhost/inner"),
+          createCtx("Inner Realm"),
+        );
+        return true;
+      },
+    };
+
+    const result = await handler.handle(
+      new Request("http://localhost/outer", {
+        headers: { origin: "https://client.example" },
+      }),
+      outerCtx,
+    );
+
+    expect(result.response?.headers.get("WWW-Authenticate")).toBe(
+      'Basic realm="Outer Realm"',
+    );
+  });
+
+  it("applies the resolved CORS and security policy to unauthorized responses", async () => {
+    const handler = createHandler();
+    const ctx = createCtx();
+    if (!ctx.securityConfig) throw new Error("test security config is required");
+    ctx.securityConfig.cors = {
+      origin: "https://client.example",
+      credentials: true,
+    };
+    const req = new Request("http://localhost/test", {
+      headers: { origin: "https://client.example" },
+    });
+
+    const result = await handler.handle(req, ctx);
+    const response = result.response as Response;
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+      "https://client.example",
+    );
+    expect(response.headers.get("Access-Control-Allow-Credentials")).toBe("true");
+    expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+  });
+
+  it("returns a Bearer challenge with the same hardened unauthorized response", async () => {
+    const handler = createHandler();
+    const ctx: HandlerContext = {
+      projectDir: "/tmp/auth-test",
+      securityConfig: {
+        auth: { bearer: { token: "expected-token" } },
+        cors: { origin: "https://client.example" },
+      } as SecurityConfig,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: () => "" },
+      } as unknown as HandlerContext["adapter"],
+      isLocalProject: false,
+    };
+    const req = new Request("http://localhost/test", {
+      headers: {
+        authorization: "Bearer wrong-token",
+        origin: "https://client.example",
+      },
+    });
+
+    const result = await handler.handle(req, ctx);
+    const response = result.response as Response;
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get("WWW-Authenticate")).toBe("Bearer");
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+      "https://client.example",
+    );
+    expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+  });
+
+  it("fails closed when environment variables configure both auth modes", async () => {
+    const handler = createHandler();
+    const credentials: Record<string, string> = {
+      VERYFRONT_BASIC_USER: "admin",
+      VERYFRONT_BASIC_PASS: "secret",
+      VERYFRONT_BEARER_TOKEN: "expected-token",
+    };
+    const ctx: HandlerContext = {
+      projectDir: "/tmp/auth-test",
+      securityConfig: null,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: (name: string) => credentials[name] },
+      } as unknown as HandlerContext["adapter"],
+      isLocalProject: false,
+    };
+
+    for (
+      const authorization of [
+        `Basic ${btoa("admin:secret")}`,
+        "Bearer expected-token",
+      ]
+    ) {
+      const result = await handler.handle(
+        new Request("http://localhost/test", {
+          headers: { authorization },
+        }),
+        ctx,
+      );
+
+      expect(result.continue).not.toBe(true);
+      expect(result.response?.status).toBe(401);
+      expect(result.response?.headers.get("WWW-Authenticate")).toBe(
+        'Basic realm="Secure Area", Bearer',
+      );
+    }
+  });
+
+  it("fails closed for every partial, empty, or competing environment auth state", async () => {
+    const handler = createHandler();
+    const values = [undefined, "", "configured"] as const;
+    const basicAuthorization = `Basic ${btoa("configured:configured")}`;
+    const bearerAuthorization = "Bearer configured";
+
+    for (const username of values) {
+      for (const password of values) {
+        for (const token of values) {
+          const credentials: Readonly<Record<string, string | undefined>> = {
+            VERYFRONT_BASIC_USER: username,
+            VERYFRONT_BASIC_PASS: password,
+            VERYFRONT_BEARER_TOKEN: token,
+          };
+          const ctx: HandlerContext = {
+            projectDir: "/tmp/auth-test",
+            securityConfig: null,
+            cspUserHeader: null,
+            adapter: {
+              env: { get: (name: string) => credentials[name] },
+            } as unknown as HandlerContext["adapter"],
+            isLocalProject: false,
+          };
+          const authDisabled = username === undefined &&
+            password === undefined &&
+            token === undefined;
+          const validBasic = username === "configured" &&
+            password === "configured" &&
+            token === undefined;
+          const validBearer = username === undefined &&
+            password === undefined &&
+            token === "configured";
+
+          if (authDisabled) {
+            const result = await handler.handle(
+              new Request("http://localhost/test"),
+              ctx,
+            );
+            expect(result.continue).toBe(true);
+            continue;
+          }
+
+          if (validBasic || validBearer) {
+            const result = await handler.handle(
+              new Request("http://localhost/test", {
+                headers: {
+                  authorization: validBasic ? basicAuthorization : bearerAuthorization,
+                },
+              }),
+              ctx,
+            );
+            expect(result.continue).toBe(true);
+            continue;
+          }
+
+          for (
+            const authorization of [
+              undefined,
+              basicAuthorization,
+              bearerAuthorization,
+            ]
+          ) {
+            const headers = authorization === undefined ? undefined : { authorization };
+            const result = await handler.handle(
+              new Request("http://localhost/test", { headers }),
+              ctx,
+            );
+            const response = result.response as Response;
+
+            expect(result.continue).not.toBe(true);
+            expect(response.status).toBe(401);
+            expect(response.headers.get("WWW-Authenticate")).toBe(
+              'Basic realm="Secure Area", Bearer',
+            );
+            expect(await response.text()).toBe("Unauthorized");
+          }
+        }
+      }
+    }
+  });
+
+  it("does not expose an authentication bypass through test globals", async () => {
+    const globals = globalThis as Record<string, unknown>;
+    const hadFlag = Object.hasOwn(globals, "__vfTestEnv");
+    const previousFlag = globals.__vfTestEnv;
+    globals.__vfTestEnv = true;
+    try {
+      const ctx: HandlerContext = {
+        projectDir: "/tmp/auth-test",
+        securityConfig: null,
+        cspUserHeader: null,
+        adapter: {
+          env: {
+            get: (name: string) => name === "VERYFRONT_BEARER_TOKEN" ? "required" : undefined,
+          },
+        } as unknown as HandlerContext["adapter"],
+        isLocalProject: false,
+      };
+
+      const result = await new AuthHandler().handle(
+        new Request("http://localhost/test"),
+        ctx,
+      );
+
+      expect(result.response?.status).toBe(401);
+    } finally {
+      if (hadFlag) globals.__vfTestEnv = previousFlag;
+      else delete globals.__vfTestEnv;
+    }
+  });
+
+  it("rejects accessor-backed explicit auth without invoking accessors", async () => {
+    let getterCalls = 0;
+    const auth = Object.defineProperty({}, "bearer", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return { token: "must-not-be-trusted" };
+      },
+    });
+    const securityConfig = Object.defineProperty({}, "auth", {
+      enumerable: true,
+      value: auth,
+    }) as SecurityConfig;
+    const ctx: HandlerContext = {
+      projectDir: "/tmp/auth-test",
+      securityConfig,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: () => undefined },
+      } as unknown as HandlerContext["adapter"],
+      isLocalProject: false,
+    };
+
+    const result = await new AuthHandler().handle(
+      new Request("http://localhost/test", {
+        headers: { authorization: "Bearer must-not-be-trusted" },
+      }),
+      ctx,
+    );
+
+    expect(result.response?.status).toBe(401);
+    expect(getterCalls).toBe(0);
+  });
+
+  it("rejects an accessor-backed security auth field without invoking it", async () => {
+    let getterCalls = 0;
+    const securityConfig = Object.defineProperty({}, "auth", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return { bearer: { token: "must-not-be-trusted" } };
+      },
+    }) as SecurityConfig;
+    const ctx: HandlerContext = {
+      projectDir: "/tmp/auth-test",
+      securityConfig,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: () => undefined },
+      } as unknown as HandlerContext["adapter"],
+      isLocalProject: false,
+    };
+
+    const result = await new AuthHandler().handle(
+      new Request("http://localhost/test", {
+        headers: { authorization: "Bearer must-not-be-trusted" },
+      }),
+      ctx,
+    );
+
+    expect(result.response?.status).toBe(401);
+    expect(getterCalls).toBe(0);
+  });
+
+  it("fails closed when explicit auth proxy inspection fails", async () => {
+    const auth = new Proxy({}, {
+      ownKeys() {
+        throw new Error("hostile proxy");
+      },
+    });
+    const ctx: HandlerContext = {
+      projectDir: "/tmp/auth-test",
+      securityConfig: { auth } as unknown as SecurityConfig,
+      cspUserHeader: null,
+      adapter: {
+        env: { get: () => undefined },
+      } as unknown as HandlerContext["adapter"],
+      isLocalProject: false,
+    };
+
+    const result = await new AuthHandler().handle(
+      new Request("http://localhost/test"),
+      ctx,
+    );
+
+    expect(result.response?.status).toBe(401);
+  });
+
+  it("rejects malformed or competing explicit auth config without exposing credentials", async () => {
+    const handler = createHandler();
+    const invalidAuthConfigs: readonly unknown[] = [
+      {},
+      { basic: {} },
+      { basic: { username: "admin" } },
+      { basic: { password: "secret" } },
+      { basic: { username: "", password: "secret" } },
+      { basic: { username: "admin", password: "" } },
+      { bearer: {} },
+      { bearer: { token: "" } },
+      {
+        basic: { username: "admin", password: "secret" },
+        bearer: { token: "private-token" },
+      },
+      { basic: undefined },
+      { unknownMode: { secret: "must-not-leak" } },
+      "invalid-auth-config",
+    ];
+
+    for (const auth of invalidAuthConfigs) {
+      const ctx: HandlerContext = {
+        projectDir: "/tmp/auth-test",
+        securityConfig: { auth } as unknown as SecurityConfig,
+        cspUserHeader: null,
+        adapter: {
+          env: { get: () => undefined },
+        } as unknown as HandlerContext["adapter"],
+        isLocalProject: false,
+      };
+      const result = await handler.handle(
+        new Request("http://localhost/test", {
+          headers: { authorization: "Bearer private-token" },
+        }),
+        ctx,
+      );
+      const response = result.response as Response;
+      const body = await response.text();
+
+      expect(response.status).toBe(401);
+      expect(response.headers.get("WWW-Authenticate")).toBe(
+        'Basic realm="Secure Area", Bearer',
+      );
+      expect(body).toBe("Unauthorized");
+      expect(body).not.toContain("admin");
+      expect(body).not.toContain("secret");
+      expect(body).not.toContain("private-token");
+    }
+  });
 });
diff --git a/src/security/http/auth.ts b/src/security/http/auth.ts
index de06480dfe..fdebbc6a1c 100644
--- a/src/security/http/auth.ts
+++ b/src/security/http/auth.ts
@@ -5,14 +5,151 @@ import type {
   HandlerPriority,
   HandlerResult,
 } from "#veryfront/types";
-import type { AuthConfig } from "./middleware/types.ts";
 import { encodeBase64 } from "#veryfront/utils";
 import { constantTimeEqual } from "../utils/constant-time.ts";
-import { isProduction } from "#veryfront/platform/environment.ts";
 
 function sanitizeRealm(realm: unknown): string {
+  const type = typeof realm;
+  const value = type === "string" ||
+      type === "number" ||
+      type === "bigint" ||
+      type === "boolean" ||
+      type === "symbol"
+    ? String(realm)
+    : "Secure Area";
+
   // deno-lint-ignore no-control-regex -- intentional: strips control chars and special chars from HTTP realm header
-  return String(realm).replace(/[\x00-\x1f\x7f"\\]/g, "");
+  return value.replace(/[\x00-\x1f\x7f"\\]/g, "");
+}
+
+type ResolvedAuth =
+  | Readonly<{
+    kind: "basic";
+    username: string;
+    password: string;
+    realm: string;
+  }>
+  | Readonly<{
+    kind: "bearer";
+    token: string;
+  }>
+  | Readonly<{
+    kind: "invalid";
+  }>;
+
+const INVALID_AUTH = Object.freeze({ kind: "invalid" } as const);
+const AUTH_CONFIG_KEYS = new Set(["basic", "bearer"]);
+const BASIC_AUTH_CONFIG_KEYS = new Set(["username", "password", "realm"]);
+const BEARER_AUTH_CONFIG_KEYS = new Set(["token"]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function snapshotOwnDataRecord(
+  value: unknown,
+  allowedKeys: ReadonlySet<string>,
+): Readonly<Record<string, unknown>> | null {
+  if (!isRecord(value)) return null;
+
+  try {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) return null;
+
+    const keys = Reflect.ownKeys(value);
+    const snapshot = Object.create(null) as Record<string, unknown>;
+    for (const key of keys) {
+      if (typeof key !== "string" || !allowedKeys.has(key)) return null;
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !("value" in descriptor)) return null;
+      Object.defineProperty(snapshot, key, {
+        enumerable: true,
+        value: descriptor.value,
+      });
+    }
+    return Object.freeze(snapshot);
+  } catch {
+    return null;
+  }
+}
+
+type ExplicitAuth =
+  | Readonly<{ state: "absent" }>
+  | Readonly<{ state: "present"; value: unknown }>
+  | Readonly<{ state: "invalid" }>;
+
+const ABSENT_AUTH = Object.freeze({ state: "absent" } as const);
+const INVALID_EXPLICIT_AUTH = Object.freeze({ state: "invalid" } as const);
+
+function readExplicitAuth(securityConfig: unknown): ExplicitAuth {
+  if (securityConfig === null || securityConfig === undefined) return ABSENT_AUTH;
+  if (!isRecord(securityConfig)) return INVALID_EXPLICIT_AUTH;
+
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(securityConfig, "auth");
+    if (descriptor) {
+      return "value" in descriptor
+        ? Object.freeze({ state: "present", value: descriptor.value })
+        : INVALID_EXPLICIT_AUTH;
+    }
+
+    const visited = new Set<object>();
+    let prototype = Object.getPrototypeOf(securityConfig);
+    for (let depth = 0; prototype !== null && depth < 64; depth++) {
+      if (visited.has(prototype)) return INVALID_EXPLICIT_AUTH;
+      visited.add(prototype);
+      if (Object.getOwnPropertyDescriptor(prototype, "auth")) {
+        return INVALID_EXPLICIT_AUTH;
+      }
+      prototype = Object.getPrototypeOf(prototype);
+    }
+    return prototype === null ? ABSENT_AUTH : INVALID_EXPLICIT_AUTH;
+  } catch {
+    return INVALID_EXPLICIT_AUTH;
+  }
+}
+
+function resolveConfiguredAuth(value: unknown): ResolvedAuth {
+  const auth = snapshotOwnDataRecord(value, AUTH_CONFIG_KEYS);
+  if (!auth) return INVALID_AUTH;
+
+  const hasBasic = Object.hasOwn(auth, "basic");
+  const hasBearer = Object.hasOwn(auth, "bearer");
+  if (hasBasic === hasBearer) return INVALID_AUTH;
+
+  if (hasBasic) {
+    const basic = snapshotOwnDataRecord(auth.basic, BASIC_AUTH_CONFIG_KEYS);
+    if (
+      !basic ||
+      !Object.hasOwn(basic, "username") ||
+      !Object.hasOwn(basic, "password") ||
+      typeof basic.username !== "string" ||
+      basic.username.length === 0 ||
+      typeof basic.password !== "string" ||
+      basic.password.length === 0
+    ) {
+      return INVALID_AUTH;
+    }
+
+    return Object.freeze({
+      kind: "basic",
+      username: basic.username,
+      password: basic.password,
+      realm: sanitizeRealm(basic.realm || "Secure Area"),
+    });
+  }
+
+  const bearer = snapshotOwnDataRecord(auth.bearer, BEARER_AUTH_CONFIG_KEYS);
+  if (
+    !bearer ||
+    !Object.hasOwn(bearer, "token") ||
+    typeof bearer.token !== "string" ||
+    bearer.token.length === 0
+  ) {
+    return INVALID_AUTH;
+  }
+
+  return Object.freeze({ kind: "bearer", token: bearer.token });
 }
 
 export class AuthHandler extends BaseHandler {
@@ -22,86 +159,116 @@ export class AuthHandler extends BaseHandler {
     patterns: [], // Checks all requests
   };
 
-  private basicUser: string | null = null;
-  private basicPass: string | null = null;
-  private basicRealm = "Secure Area";
-  private bearerToken: string | null = null;
-
   handle(req: Request, ctx: HandlerContext): Promise<HandlerResult> {
-    this.loadAuthConfig(ctx);
-
     if (req.method.toUpperCase() === "OPTIONS") return Promise.resolve(this.continue());
 
-    const basicResult = this.shouldUseBasic() ? this.checkBasicAuth(req) : null;
-    if (basicResult) return Promise.resolve(basicResult);
-
-    const bearerResult = this.shouldUseBearer() ? this.checkBearerAuth(req) : null;
-    if (bearerResult) return Promise.resolve(bearerResult);
+    const auth = this.resolveAuth(ctx);
+    if (!auth) return Promise.resolve(this.continue());
 
-    return Promise.resolve(this.continue());
+    if (auth.kind === "basic") {
+      return Promise.resolve(this.checkBasicAuth(req, ctx, auth));
+    }
+    if (auth.kind === "bearer") {
+      return Promise.resolve(this.checkBearerAuth(req, ctx, auth));
+    }
+    return Promise.resolve(this.rejectInvalidAuth(req, ctx));
   }
 
-  private loadAuthConfig(ctx: HandlerContext): void {
-    // Reset per-request auth state to avoid leaking config across requests.
-    this.basicUser = null;
-    this.basicPass = null;
-    this.basicRealm = "Secure Area";
-    this.bearerToken = null;
+  private resolveAuth(ctx: HandlerContext): ResolvedAuth | null {
+    const explicitAuth = readExplicitAuth(ctx.securityConfig);
+    if (explicitAuth.state === "invalid") return INVALID_AUTH;
+    if (explicitAuth.state === "present") return resolveConfiguredAuth(explicitAuth.value);
 
-    const authConfig = ctx.securityConfig?.auth as AuthConfig | undefined;
+    const username: unknown = ctx.adapter.env.get("VERYFRONT_BASIC_USER");
+    const password: unknown = ctx.adapter.env.get("VERYFRONT_BASIC_PASS");
+    const token: unknown = ctx.adapter.env.get("VERYFRONT_BEARER_TOKEN");
+    const hasUsername = username !== undefined;
+    const hasPassword = password !== undefined;
+    const hasToken = token !== undefined;
 
-    if (authConfig?.basic) {
-      this.basicUser = authConfig.basic.username;
-      this.basicPass = authConfig.basic.password;
-      this.basicRealm = sanitizeRealm(authConfig.basic.realm || "Secure Area");
-      return;
-    }
+    if (!hasUsername && !hasPassword && !hasToken) return null;
 
-    if (authConfig?.bearer) {
-      this.bearerToken = authConfig.bearer.token;
-      return;
+    if (
+      hasUsername &&
+      hasPassword &&
+      !hasToken &&
+      typeof username === "string" &&
+      username.length > 0 &&
+      typeof password === "string" &&
+      password.length > 0
+    ) {
+      return Object.freeze({
+        kind: "basic",
+        username,
+        password,
+        realm: "Secure Area",
+      });
     }
 
-    // `__vfTestEnv` lets the test harness skip env-var credential loading so
-    // tests run without auth. It must NEVER short-circuit auth in production:
-    // guard it behind the environment check so a stray/injected global can't
-    // silently disable authentication on a live deployment.
-    if (!isProduction() && (globalThis as Record<string, unknown>).__vfTestEnv === true) return;
-
-    this.basicUser = ctx.adapter.env.get("VERYFRONT_BASIC_USER") ?? "";
-    this.basicPass = ctx.adapter.env.get("VERYFRONT_BASIC_PASS") ?? "";
-    this.bearerToken = ctx.adapter.env.get("VERYFRONT_BEARER_TOKEN") ?? "";
-  }
-
-  private shouldUseBasic(): boolean {
-    return Boolean(this.basicUser && this.basicPass);
-  }
+    if (
+      !hasUsername &&
+      !hasPassword &&
+      hasToken &&
+      typeof token === "string" &&
+      token.length > 0
+    ) {
+      return Object.freeze({ kind: "bearer", token });
+    }
 
-  private shouldUseBearer(): boolean {
-    return Boolean(this.bearerToken);
+    return INVALID_AUTH;
   }
 
-  private checkBasicAuth(req: Request): HandlerResult | null {
-    const expected = `Basic ${encodeBase64(`${this.basicUser}:${this.basicPass}`)}`;
+  private checkBasicAuth(
+    req: Request,
+    ctx: HandlerContext,
+    authConfig: Extract<ResolvedAuth, { kind: "basic" }>,
+  ): HandlerResult {
+    const expected = `Basic ${encodeBase64(`${authConfig.username}:${authConfig.password}`)}`;
     const auth = req.headers.get("authorization") ?? "";
 
-    if (constantTimeEqual(auth, expected)) return null;
+    if (constantTimeEqual(auth, expected)) return this.continue();
 
     return this.respond(
-      new Response("Unauthorized", {
-        status: 401,
-        headers: { "WWW-Authenticate": `Basic realm="${this.basicRealm}"` },
-      }),
+      this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req)
+        .withCache("no-store")
+        .withHeaders({ "WWW-Authenticate": `Basic realm="${authConfig.realm}"` })
+        .text("Unauthorized", 401),
     );
   }
 
-  private checkBearerAuth(req: Request): HandlerResult | null {
+  private checkBearerAuth(
+    req: Request,
+    ctx: HandlerContext,
+    authConfig: Extract<ResolvedAuth, { kind: "bearer" }>,
+  ): HandlerResult {
     const auth = req.headers.get("authorization") ?? "";
 
-    if (auth.startsWith("Bearer ") && constantTimeEqual(auth.slice(7), this.bearerToken ?? "")) {
-      return null;
+    if (auth.startsWith("Bearer ") && constantTimeEqual(auth.slice(7), authConfig.token)) {
+      return this.continue();
     }
 
-    return this.respond(new Response("Unauthorized", { status: 401 }));
+    return this.respond(
+      this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req)
+        .withCache("no-store")
+        .withHeaders({ "WWW-Authenticate": "Bearer" })
+        .text("Unauthorized", 401),
+    );
+  }
+
+  private rejectInvalidAuth(req: Request, ctx: HandlerContext): HandlerResult {
+    return this.respond(
+      this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req)
+        .withCache("no-store")
+        .withHeaders({
+          "WWW-Authenticate": 'Basic realm="Secure Area", Bearer',
+        })
+        .text("Unauthorized", 401),
+    );
   }
 }
diff --git a/src/security/http/base-handler.test.ts b/src/security/http/base-handler.test.ts
index 950ddc5d12..5b553407da 100644
--- a/src/security/http/base-handler.test.ts
+++ b/src/security/http/base-handler.test.ts
@@ -1,5 +1,5 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
+import { assert, assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
 import { afterEach, describe, it } from "#veryfront/testing/bdd.ts";
 import { deleteEnv, setEnv } from "#veryfront/compat/process.ts";
 import {
@@ -9,6 +9,9 @@ import {
 } from "#veryfront/observability/tracing/api-shim.ts";
 import { runWithRequestContext } from "#veryfront/platform/adapters/fs/veryfront/request-context.ts";
 import { metrics } from "#veryfront/metrics";
+import { VeryfrontError } from "#veryfront/errors";
+import { FSAdapterWrapper } from "#veryfront/platform/adapters/fs/wrapper.ts";
+import { VeryfrontFSAdapter } from "#veryfront/platform/adapters/fs/veryfront/adapter.ts";
 import { BaseHandler } from "./base-handler.ts";
 import type {
   HandlerContext,
@@ -28,6 +31,14 @@ class TestHandler extends BaseHandler {
     return this.continue();
   }
 
+  testShouldHandle(req: Request, ctx: HandlerContext): boolean {
+    return this.shouldHandle(req, ctx);
+  }
+
+  testGetErrorMessage(error: unknown): string {
+    return this.getErrorMessage(error);
+  }
+
   // Expose withProxyContext for testing
   testWithProxyContext<T>(
     ctx: HandlerContext,
@@ -52,6 +63,72 @@ function createMinimalCtx(
   } as unknown as HandlerContext;
 }
 
+describe("BaseHandler route matching", () => {
+  it("treats exact: false as the documented legacy prefix form", () => {
+    const handler = new TestHandler();
+    handler.metadata.patterns = [{ pattern: "/api", exact: false }];
+    const ctx = createMinimalCtx();
+
+    assertEquals(
+      handler.testShouldHandle(new Request("http://localhost/api/items"), ctx),
+      true,
+    );
+    assertEquals(
+      handler.testShouldHandle(new Request("http://localhost/other"), ctx),
+      false,
+    );
+  });
+
+  it("lets an explicit prefix option override the legacy exact alias", () => {
+    const handler = new TestHandler();
+    const ctx = createMinimalCtx();
+
+    handler.metadata.patterns = [{ pattern: "/api", exact: false, prefix: false }];
+    assertEquals(
+      handler.testShouldHandle(new Request("http://localhost/api/items"), ctx),
+      false,
+    );
+    assertEquals(
+      handler.testShouldHandle(new Request("http://localhost/api"), ctx),
+      true,
+    );
+
+    handler.metadata.patterns = [{ pattern: "/api", exact: true, prefix: true }];
+    assertEquals(
+      handler.testShouldHandle(new Request("http://localhost/api/items"), ctx),
+      true,
+    );
+  });
+
+  it("matches global and sticky regular expressions deterministically", () => {
+    const ctx = createMinimalCtx();
+    for (const pattern of [/^\/api/g, /^\/api/y]) {
+      const handler = new TestHandler();
+      handler.metadata.patterns = [{ pattern }];
+      const request = new Request("http://localhost/api");
+
+      assertEquals(handler.testShouldHandle(request, ctx), true);
+      assertEquals(handler.testShouldHandle(request, ctx), true);
+      assertEquals(pattern.lastIndex, 0);
+    }
+  });
+});
+
+describe("BaseHandler error boundaries", () => {
+  it("returns a stable fallback for unreadable thrown values", () => {
+    const unreadableError = new Proxy({}, {
+      get() {
+        throw new Error("error fields must not be read directly");
+      },
+      getPrototypeOf() {
+        throw new Error("error prototype must not be read directly");
+      },
+    });
+
+    assertEquals(new TestHandler().testGetErrorMessage(unreadableError), "Unknown error");
+  });
+});
+
 describe("BaseHandler.withProxyContext", () => {
   afterEach(() => {
     try {
@@ -79,26 +156,65 @@ describe("BaseHandler.withProxyContext", () => {
     assertEquals(called, true, "fn should run in local dev mode");
   });
 
-  it("runs fn() without proxy context when requireToken is true but no token", async () => {
+  it("does not misclassify a standalone cache-isolation slug as proxy context", async () => {
     const handler = new TestHandler();
     let called = false;
+    const warnings: unknown[][] = [];
+    const originalWarn = console.warn;
 
-    await handler.testWithProxyContext(
-      createMinimalCtx({ projectSlug: "my-project" }),
-      async () => {
-        called = true;
-        return { continue: true } as HandlerResult;
-      },
-      { requireToken: true },
-    );
+    console.warn = (...args: unknown[]) => warnings.push(args);
+    try {
+      await handler.testWithProxyContext(
+        createMinimalCtx({ projectSlug: "my-project" }),
+        async () => {
+          called = true;
+          return { continue: true } as HandlerResult;
+        },
+        { requireToken: true },
+      );
+    } finally {
+      console.warn = originalWarn;
+    }
 
-    // fn() should still run so embedded framework modules can be served,
-    // but without project-scoped credentials (no setRequestToken call)
     assertEquals(
       called,
       true,
-      "fn should run without proxy context so embedded modules work",
+      "fn should run directly for a standalone filesystem",
     );
+    assertEquals(warnings, []);
+  });
+
+  it("runs a fixed-project Veryfront adapter without unsafe request-global mutation", async () => {
+    const handler = new TestHandler();
+    const fixedAdapter = new VeryfrontFSAdapter({
+      type: "veryfront-api",
+      projectDir: "/project",
+      veryfront: {
+        apiBaseUrl: "https://api.test",
+        apiToken: "fixed-token",
+        projectSlug: "fixed-project",
+      },
+    });
+    const fs = new FSAdapterWrapper(fixedAdapter);
+    let called = false;
+    try {
+      await handler.testWithProxyContext(
+        createMinimalCtx({
+          projectSlug: "fixed-project",
+          adapter: { fs } as unknown as HandlerContext["adapter"],
+        }),
+        () => {
+          called = true;
+          return Promise.resolve("ok");
+        },
+        { requireToken: true },
+      );
+      assertEquals(fs.isFixedProjectMode(), true);
+      assertEquals(fs.isContextualMode(), false);
+      assertEquals(called, true);
+    } finally {
+      await fs.shutdown();
+    }
   });
 
   it("runs fn() when requireToken is true and token is present", async () => {
@@ -168,6 +284,84 @@ describe("BaseHandler.withProxyContext", () => {
     assertEquals(called, true, "fn should run with proxyToken");
   });
 
+  for (const mode of ["multi-project", "contextual"] as const) {
+    it(`rejects missing required credentials before ${mode} filesystem work`, async () => {
+      const handler = new TestHandler();
+      let callbackCalled = false;
+      const fs = mode === "multi-project"
+        ? {
+          isMultiProjectMode: () => true,
+          runWithContext: async (_slug: string, _token: string, fn: () => Promise<unknown>) =>
+            await fn(),
+        }
+        : {
+          isContextualMode: () => true,
+          setRequestBranch() {},
+          setRequestToken() {},
+        };
+      const ctx = createMinimalCtx({
+        projectSlug: "remote-project",
+        adapter: { fs } as unknown as HandlerContext["adapter"],
+      });
+
+      const error = await assertRejects(
+        () =>
+          handler.testWithProxyContext(
+            ctx,
+            () => {
+              callbackCalled = true;
+              return Promise.resolve("forbidden");
+            },
+            { requireToken: true },
+          ),
+        VeryfrontError,
+      );
+
+      assert(error instanceof VeryfrontError);
+      assertEquals(error.slug, "authentication-required");
+      assertEquals(callbackCalled, false);
+    });
+  }
+
+  it("rejects an incomplete multi-project filesystem adapter explicitly", async () => {
+    const handler = new TestHandler();
+    const ctx = createMinimalCtx({
+      projectSlug: "my-project",
+      proxyToken: "vf_proxy_token",
+      adapter: {
+        fs: {
+          isMultiProjectMode: () => true,
+        },
+      } as unknown as HandlerContext["adapter"],
+    });
+
+    await assertRejects(
+      () => handler.testWithProxyContext(ctx, () => Promise.resolve("unused")),
+      TypeError,
+      "requires a runWithContext adapter method",
+    );
+  });
+
+  it("rejects incomplete contextual filesystem capabilities without legacy inference", async () => {
+    const handler = new TestHandler();
+    const ctx = createMinimalCtx({
+      projectSlug: "my-project",
+      proxyToken: "vf_proxy_token",
+      adapter: {
+        fs: {
+          isContextualMode: () => true,
+          setRequestToken() {},
+        },
+      } as unknown as HandlerContext["adapter"],
+    });
+
+    await assertRejects(
+      () => handler.testWithProxyContext(ctx, () => Promise.resolve("unused")),
+      TypeError,
+      "requires atomic runWithContext scope",
+    );
+  });
+
   it("emits metrics with project and environment labels in multi-project request context", async () => {
     const handler = new TestHandler();
     const counterCalls: unknown[] = [];
diff --git a/src/security/http/base-handler.ts b/src/security/http/base-handler.ts
index bae900339c..7c1801ecef 100644
--- a/src/security/http/base-handler.ts
+++ b/src/security/http/base-handler.ts
@@ -10,7 +10,10 @@ import { runWithVerifiedCacheApiCredential } from "#veryfront/cache/verified-api
 import type { VerifiedControlPlaneRequestClaims } from "#veryfront/internal-agents/control-plane-auth.ts";
 import { getHostEnv } from "#veryfront/platform/compat/process.ts";
 import type { WebSocketUpgradeResponse } from "#veryfront/platform/adapters/base.ts";
+import { getErrorMessage as formatErrorMessage } from "#veryfront/errors/veryfront-error.ts";
+import { AUTHENTICATION_REQUIRED } from "#veryfront/errors";
 import { serverLogger } from "#veryfront/utils";
+import { isExplicitlyLocalProject } from "#veryfront/security/project-locality.ts";
 import { ResponseBuilder } from "./response/index.ts";
 
 export interface HandlerHelpers {
@@ -24,6 +27,21 @@ export interface HandlerHelpers {
   continue: () => HandlerResult;
 }
 
+/** Match a request pathname against one runtime route pattern. */
+export function matchesRoutePathname(pathname: string, routePattern: RoutePattern): boolean {
+  const pattern = routePattern.pattern;
+
+  if (typeof pattern === "string") {
+    const isPrefixMatch = routePattern.prefix ?? routePattern.exact === false;
+    return isPrefixMatch ? pathname.startsWith(pattern) : pathname === pattern;
+  }
+
+  if (!pattern.global && !pattern.sticky) return pattern.test(pathname);
+
+  const statelessMatcher = new RegExp(pattern.source, pattern.flags);
+  return statelessMatcher.test(pathname);
+}
+
 export abstract class BaseHandler implements Handler {
   abstract metadata: HandlerMetadata;
 
@@ -57,25 +75,16 @@ export abstract class BaseHandler implements Handler {
       if (!methods.includes(method)) return false;
     }
 
-    const routePattern = pattern.pattern;
-
-    if (typeof routePattern === "string") {
-      return pattern.prefix ? pathname.startsWith(routePattern) : pathname === routePattern;
-    }
-
-    if (routePattern instanceof RegExp) return routePattern.test(pathname);
-
-    return false;
+    return matchesRoutePathname(pathname, pattern);
   }
 
   protected createResponseBuilder(
     ctx: HandlerContext,
     nonce?: string,
-    _options?: Record<string, unknown>,
   ): ResponseBuilder {
     return new ResponseBuilder({
       securityConfig: ctx.securityConfig ?? undefined,
-      isDev: !!ctx.isLocalProject,
+      isDev: isExplicitlyLocalProject(ctx),
       cspUserHeader: ctx.cspUserHeader,
       adapter: ctx.adapter,
       nonce,
@@ -88,17 +97,16 @@ export abstract class BaseHandler implements Handler {
     serverLogger.debug(`[${this.metadata.name}] ${message}`, extra ?? undefined);
   }
 
-  protected logWarn(message: string, extra?: Record<string, unknown>, _ctx?: HandlerContext): void {
+  protected logWarn(message: string, extra?: Record<string, unknown>): void {
     serverLogger.warn(`[${this.metadata.name}] ${message}`, extra ?? undefined);
   }
 
-  protected logInfo(message: string, extra?: Record<string, unknown>, _ctx?: HandlerContext): void {
+  protected logInfo(message: string, extra?: Record<string, unknown>): void {
     serverLogger.info(`[${this.metadata.name}] ${message}`, extra ?? undefined);
   }
 
   protected getErrorMessage(error: unknown): string {
-    if (error instanceof Error) return error.message;
-    return String(error);
+    return formatErrorMessage(error);
   }
 
   protected continue(): HandlerResult {
@@ -109,6 +117,8 @@ export abstract class BaseHandler implements Handler {
     response: Response | WebSocketUpgradeResponse,
     metadata?: Record<string, unknown>,
   ): HandlerResult {
+    // HandlerResult deliberately remains HTTP-only. Runtime dispatch recognizes
+    // the explicit non-DOM WebSocket signal before using normal Response APIs.
     return { response: response as Response, continue: false, metadata };
   }
 
@@ -137,6 +147,8 @@ export abstract class BaseHandler implements Handler {
       setRequestToken?: (t: string) => void;
       setRequestBranch?: (b: string | null) => void;
       isMultiProjectMode?: () => boolean;
+      isContextualMode?: () => boolean;
+      isFixedProjectMode?: () => boolean;
       runWithContext?: <R>(
         slug: string,
         token: string,
@@ -151,33 +163,36 @@ export abstract class BaseHandler implements Handler {
       ) => Promise<R>;
     };
 
-    if (typeof fsWrapper.setRequestBranch === "function") {
-      try {
-        fsWrapper.setRequestBranch(ctx.parsedDomain?.branch ?? null);
-      } catch (_) {
-        /* expected: multi-project mode uses runWithContext for branch context */
-      }
-    }
-
     const requireToken = options.requireToken ?? false;
+    const isMultiProjectMode = fsWrapper.isMultiProjectMode?.() === true;
+    const isContextualMode = fsWrapper.isContextualMode?.() === true;
+    const isFixedProjectMode = fsWrapper.isFixedProjectMode?.() === true;
+    const requiresProjectCredential = isMultiProjectMode || isContextualMode;
 
     // No project slug → local dev mode, no proxy context needed.
     if (!ctx.projectSlug) return fn();
 
-    // Token required but missing in proxy mode → run fn() without
-    // project-scoped credentials. This allows embedded framework modules
-    // (e.g. /_vf_modules/_veryfront/...) to be served from the binary
-    // while project-specific content will fail at the filesystem level
-    // (no token = no access to remote project files).
-    if (requireToken && !effectiveToken) {
-      serverLogger.warn(
-        `[${this.metadata.name}] No API token for proxy context — project content will be unavailable`,
-        { projectSlug: ctx.projectSlug },
+    // A project slug is also used to isolate standalone caches; it does not by
+    // itself imply a credentialed proxy filesystem. Once the adapter declares
+    // contextual project access, however, a required credential is an actual
+    // admission boundary and the callback must not run without it.
+    if (requireToken && !effectiveToken && requiresProjectCredential) {
+      return Promise.reject(
+        AUTHENTICATION_REQUIRED.create({
+          detail: "Contextual project filesystem access requires an API token",
+        }),
       );
-      return fn();
     }
 
-    if (fsWrapper.isMultiProjectMode?.()) {
+    if (isMultiProjectMode) {
+      if (typeof fsWrapper.runWithContext !== "function") {
+        return Promise.reject(
+          new TypeError(
+            "Multi-project filesystem mode requires a runWithContext adapter method",
+          ),
+        );
+      }
+
       const isProduction = (ctx.resolvedEnvironment ?? ctx.requestContext?.mode) === "production";
       const branch = ctx.parsedDomain?.branch ?? null;
 
@@ -192,7 +207,7 @@ export abstract class BaseHandler implements Handler {
         ctx,
       );
 
-      return fsWrapper.runWithContext!(
+      return fsWrapper.runWithContext(
         ctx.projectSlug,
         effectiveToken,
         fn,
@@ -206,10 +221,18 @@ export abstract class BaseHandler implements Handler {
       );
     }
 
-    if (typeof fsWrapper.setRequestToken === "function" && effectiveToken) {
-      fsWrapper.setRequestToken(effectiveToken);
+    if (isContextualMode) {
+      return Promise.reject(
+        new TypeError(
+          "Contextual filesystem access requires atomic runWithContext scope; global request-context mutators are not safe",
+        ),
+      );
     }
 
+    // A fixed-project adapter is already bound to one tenant and credential at
+    // construction. It must never receive request-global token/branch mutation.
+    if (isFixedProjectMode) return runWithCacheBatching(fn);
+
     return runWithCacheBatching(fn);
   }
 }
diff --git a/src/security/http/config.test.ts b/src/security/http/config.test.ts
index 7d32c9b835..d4c11da07e 100644
--- a/src/security/http/config.test.ts
+++ b/src/security/http/config.test.ts
@@ -1,8 +1,15 @@
 import "#veryfront/schemas/_test-setup.ts";
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
-import { assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
+import { DenoAdapter } from "#veryfront/platform/adapters/runtime/deno/adapter.ts";
+import { assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
 import { afterEach, describe, it } from "#veryfront/testing/bdd.ts";
-import { SecurityConfigLoader } from "./config.ts";
+import { clearConfigCache, type VeryfrontConfig } from "#veryfront/config";
+import {
+  deriveSecurityContext,
+  isValidSecurityConfig,
+  loadSecurityConfig,
+  SecurityConfigLoader,
+} from "./config.ts";
 
 function captureConsoleLog(): { getOutput: () => string; restore: () => void } {
   const originalWarn = console.warn;
@@ -36,10 +43,82 @@ describe("security/http/config", () => {
   const originalNodeEnv = Deno.env.get("NODE_ENV");
 
   afterEach(() => {
+    clearConfigCache();
     if (originalNodeEnv === undefined) Deno.env.delete("NODE_ENV");
     else Deno.env.set("NODE_ENV", originalNodeEnv);
   });
 
+  it("validates compatibility inputs through the canonical security schema", () => {
+    assertEquals(
+      isValidSecurityConfig({
+        cors: { origin: "https://client.example", methods: ["GET"] },
+        csrf: true,
+      }),
+      true,
+    );
+    assertEquals(isValidSecurityConfig({ csrf: "enabled" }), false);
+    assertEquals(isValidSecurityConfig({ unknownPolicy: true }), false);
+
+    let getterCalls = 0;
+    const hostile = {} as Record<string, unknown>;
+    Object.defineProperty(hostile, "csrf", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return true;
+      },
+    });
+
+    assertEquals(isValidSecurityConfig(hostile), false);
+    assertEquals(getterCalls, 0);
+  });
+
+  it("loads a frozen compatibility snapshot and reserves null for absent policy", async () => {
+    const configuredProject = await Deno.makeTempDir({ prefix: "vf-security-configured-" });
+    const defaultProject = await Deno.makeTempDir({ prefix: "vf-security-default-" });
+
+    try {
+      await Deno.writeTextFile(
+        `${configuredProject}/veryfront.config.js`,
+        'export default { security: { csrf: true, cors: { methods: ["GET"] } } };',
+      );
+
+      const loaded = await loadSecurityConfig(configuredProject, new DenoAdapter());
+      const absent = await loadSecurityConfig(defaultProject, new DenoAdapter());
+
+      assertEquals(loaded?.csrf, true);
+      assertEquals(
+        (loaded?.cors as { methods?: string[] } | undefined)?.methods,
+        ["GET"],
+      );
+      assertEquals(Object.isFrozen(loaded), true);
+      assertEquals(Object.isFrozen((loaded?.cors as { methods?: string[] })?.methods), true);
+      assertEquals(absent, null);
+    } finally {
+      await Deno.remove(configuredProject, { recursive: true });
+      await Deno.remove(defaultProject, { recursive: true });
+    }
+  });
+
+  it("propagates invalid project configuration instead of failing open", async () => {
+    const projectDir = await Deno.makeTempDir({ prefix: "vf-security-invalid-" });
+
+    try {
+      await Deno.writeTextFile(
+        `${projectDir}/veryfront.config.js`,
+        'export default { security: { csrf: "enabled" } };',
+      );
+
+      await assertRejects(
+        () => loadSecurityConfig(projectDir, new DenoAdapter()),
+        Error,
+        "security.csrf",
+      );
+    } finally {
+      await Deno.remove(projectDir, { recursive: true });
+    }
+  });
+
   it("serializes object CSP config for downstream handler context", async () => {
     const loader = new SecurityConfigLoader(
       "/project",
@@ -87,7 +166,7 @@ describe("security/http/config", () => {
     assertEquals(loader.getSecurityHeader("COEP", "require-corp"), "require-corp");
   });
 
-  it("reset clears cached security state", async () => {
+  it("does not expose a reset race after publishing security state", async () => {
     const loader = new SecurityConfigLoader(
       "/project",
       createMockAdapter(),
@@ -104,11 +183,9 @@ describe("security/http/config", () => {
     assertEquals(loader.getSecurityConfig()?.cors, true);
     assertEquals(loader.getCspUserHeader(), "default-src 'self'");
 
-    loader.reset();
-
-    assertEquals(loader.getSecurityConfig(), null);
-    assertEquals(loader.getCspUserHeader(), null);
-    assertEquals(loader.getCorsConfig(), undefined);
+    assertEquals("reset" in loader, false);
+    assertEquals(loader.getSecurityConfig()?.cors, true);
+    assertEquals(loader.getCspUserHeader(), "default-src 'self'");
   });
 
   it("defaults CSRF protection on in production when not explicitly configured", async () => {
@@ -201,14 +278,127 @@ describe("security/http/config", () => {
     assertEquals(getOutput().includes("Neither CORS nor CSRF protection is configured"), true);
   });
 
+  it("derives a deep-frozen request-owned security context without mutating config", () => {
+    const originValidator = (origin: string) => origin === "https://client.example";
+    const config = {
+      security: {
+        cors: {
+          origin: originValidator,
+          methods: ["GET"],
+          allowedHeaders: ["authorization"],
+        },
+        csrf: {
+          excludePaths: ["/webhooks"],
+        },
+        csp: {
+          "default-src": ["'none'"],
+        },
+        auth: {
+          basic: {
+            username: "alice",
+            password: "secret",
+          },
+        },
+      },
+    } as VeryfrontConfig;
+
+    const first = deriveSecurityContext(config, { productionDefaults: true });
+    const second = deriveSecurityContext(config, { productionDefaults: true });
+    const sourceCors = config.security?.cors as Exclude<
+      NonNullable<NonNullable<VeryfrontConfig["security"]>["cors"]>,
+      boolean
+    >;
+    const derivedCors = first.securityConfig.cors as Exclude<
+      NonNullable<typeof first.securityConfig.cors>,
+      boolean
+    >;
+
+    assertEquals(first.securityConfig === config.security, false);
+    assertEquals(first.securityConfig === second.securityConfig, false);
+    assertEquals(derivedCors === sourceCors, false);
+    assertEquals(derivedCors.methods === sourceCors.methods, false);
+    assertEquals(Object.isFrozen(first), true);
+    assertEquals(Object.isFrozen(first.securityConfig), true);
+    assertEquals(Object.isFrozen(derivedCors), true);
+    assertEquals(Object.isFrozen(derivedCors.methods), true);
+    assertEquals(derivedCors.origin === originValidator, false);
+    assertEquals(Object.isFrozen(derivedCors.origin), true);
+    assertEquals(
+      typeof derivedCors.origin === "function" &&
+        derivedCors.origin("https://client.example"),
+      true,
+    );
+    assertEquals(
+      typeof (second.securityConfig.cors as { origin?: unknown }).origin === "function" &&
+        (second.securityConfig.cors as { origin?: unknown }).origin === derivedCors.origin,
+      false,
+    );
+    assertEquals(first.cspUserHeader, "default-src 'none'");
+
+    sourceCors.methods?.push("POST");
+    assertEquals(derivedCors.methods, ["GET"]);
+  });
+
+  it("applies production defaults without overriding explicit security choices", () => {
+    const production = deriveSecurityContext(
+      { security: { csrf: false, cors: false } },
+      { productionDefaults: true },
+    );
+    const development = deriveSecurityContext(
+      { security: {} },
+      { productionDefaults: false },
+    );
+
+    assertEquals(production.securityConfig.csrf, false);
+    assertEquals(production.securityConfig.cors, false);
+    assertEquals(development.securityConfig.csrf, undefined);
+    assertEquals(development.securityConfig.cors, false);
+  });
+
+  it("rejects hostile configuration shapes without invoking accessors", () => {
+    let configGetterCalls = 0;
+    const config = {} as Record<string, unknown>;
+    Object.defineProperty(config, "security", {
+      enumerable: true,
+      get() {
+        configGetterCalls++;
+        return { csrf: true };
+      },
+    });
+    assertThrows(() => deriveSecurityContext(config as VeryfrontConfig), TypeError);
+    assertEquals(configGetterCalls, 0);
+
+    const cyclic: Record<string, unknown> = {};
+    cyclic.self = cyclic;
+    assertThrows(
+      () => deriveSecurityContext({ security: cyclic } as VeryfrontConfig),
+      TypeError,
+    );
+
+    let optionGetterCalls = 0;
+    const options = {} as Record<string, unknown>;
+    Object.defineProperty(options, "productionDefaults", {
+      enumerable: true,
+      get() {
+        optionGetterCalls++;
+        return true;
+      },
+    });
+    assertThrows(
+      () => deriveSecurityContext(undefined, options as never),
+      TypeError,
+    );
+    assertEquals(optionGetterCalls, 0);
+  });
+
   it("rejects a failed load for the current caller and retries on the next call", async () => {
     let shouldFail = true;
     const config = new Proxy(
       { security: { csrf: true } },
       {
-        get(target, property, receiver) {
-          if (shouldFail) throw new Error("config load failed");
-          return Reflect.get(target, property, receiver);
+        getOwnPropertyDescriptor(target, property) {
+          if (property === "security" && shouldFail) throw new Error("config load failed");
+          return Reflect.getOwnPropertyDescriptor(target, property);
         },
       },
     );
@@ -216,8 +406,8 @@ describe("security/http/config", () => {
 
     await assertRejects(
       () => loader.ensureLoaded(),
-      Error,
-      "config load failed",
+      TypeError,
+      "Invalid security configuration",
     );
     assertEquals(loader.getSecurityConfig(), null);
 
diff --git a/src/security/http/config.ts b/src/security/http/config.ts
index 6b93994eb7..9c8f4a0509 100644
--- a/src/security/http/config.ts
+++ b/src/security/http/config.ts
@@ -1,13 +1,276 @@
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import type { SecurityConfig } from "#veryfront/types";
 import type { VeryfrontConfig } from "#veryfront/config";
-import { getConfig } from "#veryfront/config";
+import { getConfig, validateVeryfrontConfig } from "#veryfront/config";
 import { serverLogger } from "#veryfront/utils";
 import { buildCSP, generateNonce, serializeCSPDirectives } from "./response/security-handler.ts";
 import { isProduction } from "#veryfront/platform/environment.ts";
 
 const logger = serverLogger.component("security-config-loader");
 
+export interface DerivedSecurityContext {
+  securityConfig: SecurityConfig;
+  cspUserHeader: string | null;
+}
+
+export interface DeriveSecurityContextOptions {
+  /**
+   * Apply security defaults used by production runtimes. Defaults to the
+   * process environment; callers with an independently trusted runtime
+   * classification may override it explicitly.
+   */
+  productionDefaults?: boolean;
+}
+
+const MAX_SECURITY_CONFIG_DEPTH = 32;
+const MAX_SECURITY_CONFIG_ENTRIES = 10_000;
+const MAX_SECURITY_CONFIG_ARRAY_LENGTH = 1_024;
+
+interface SecuritySnapshotState {
+  readonly clones: WeakMap<object, unknown>;
+  readonly active: WeakSet<object>;
+  entries: number;
+}
+
+function invalidSecurityConfig(): never {
+  throw new TypeError("Invalid security configuration");
+}
+
+function consumeSecurityEntry(state: SecuritySnapshotState): void {
+  state.entries++;
+  if (state.entries > MAX_SECURITY_CONFIG_ENTRIES) invalidSecurityConfig();
+}
+
+function cloneAndFreezeSecurityValue<T>(
+  value: T,
+  state: SecuritySnapshotState = {
+    clones: new WeakMap(),
+    active: new WeakSet(),
+    entries: 0,
+  },
+  depth = 0,
+): T {
+  if (value === null) return value;
+
+  if (depth > MAX_SECURITY_CONFIG_DEPTH) return invalidSecurityConfig();
+
+  if (typeof value === "function") {
+    const source = value as (...args: unknown[]) => unknown;
+    const cached = state.clones.get(source);
+    if (cached !== undefined) return cached as T;
+
+    const wrapped = function (this: unknown, ...args: unknown[]): unknown {
+      return Reflect.apply(source, this, args);
+    };
+    state.clones.set(source, wrapped);
+    return Object.freeze(wrapped) as T;
+  }
+
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? value : invalidSecurityConfig();
+  }
+  if (
+    typeof value === "string" ||
+    typeof value === "boolean" ||
+    value === undefined
+  ) {
+    return value;
+  }
+  if (typeof value !== "object") return invalidSecurityConfig();
+
+  const source = value as object;
+  if (state.active.has(source)) return invalidSecurityConfig();
+  const cached = state.clones.get(source);
+  if (cached !== undefined) return cached as T;
+
+  let isArray: boolean;
+  let prototype: object | null;
+  try {
+    isArray = Array.isArray(value);
+    prototype = Object.getPrototypeOf(value);
+  } catch {
+    return invalidSecurityConfig();
+  }
+
+  if (!isArray && prototype !== Object.prototype && prototype !== null) {
+    return invalidSecurityConfig();
+  }
+
+  state.active.add(source);
+  try {
+    if (isArray) {
+      let keys: (string | symbol)[];
+      let length: unknown;
+      try {
+        keys = Reflect.ownKeys(source);
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(source, "length");
+        length = lengthDescriptor && "value" in lengthDescriptor
+          ? lengthDescriptor.value
+          : undefined;
+      } catch {
+        return invalidSecurityConfig();
+      }
+      if (
+        typeof length !== "number" ||
+        !Number.isSafeInteger(length) ||
+        length < 0 ||
+        length > MAX_SECURITY_CONFIG_ARRAY_LENGTH ||
+        keys.length !== length + 1
+      ) {
+        return invalidSecurityConfig();
+      }
+
+      const clone = new Array<unknown>(length);
+      state.clones.set(source, clone);
+      for (let index = 0; index < length; index++) {
+        const descriptor = Object.getOwnPropertyDescriptor(source, String(index));
+        if (!descriptor || !("value" in descriptor)) return invalidSecurityConfig();
+        consumeSecurityEntry(state);
+        clone[index] = cloneAndFreezeSecurityValue(descriptor.value, state, depth + 1);
+      }
+      return Object.freeze(clone) as T;
+    }
+
+    let keys: (string | symbol)[];
+    try {
+      keys = Reflect.ownKeys(source);
+    } catch {
+      return invalidSecurityConfig();
+    }
+    const clone: Record<string, unknown> = Object.create(null);
+    state.clones.set(source, clone);
+    for (const key of keys) {
+      if (typeof key !== "string") return invalidSecurityConfig();
+      const descriptor = Object.getOwnPropertyDescriptor(source, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) {
+        return invalidSecurityConfig();
+      }
+      consumeSecurityEntry(state);
+      Object.defineProperty(clone, key, {
+        configurable: false,
+        enumerable: true,
+        writable: false,
+        value: cloneAndFreezeSecurityValue(descriptor.value, state, depth + 1),
+      });
+    }
+    return Object.freeze(clone) as T;
+  } finally {
+    state.active.delete(source);
+  }
+}
+
+function readSecurityConfig(cfg: unknown): SecurityConfig | undefined {
+  if (cfg === undefined) return undefined;
+  if (typeof cfg !== "object" || cfg === null || Array.isArray(cfg)) {
+    return invalidSecurityConfig();
+  }
+
+  try {
+    const prototype = Object.getPrototypeOf(cfg);
+    if (prototype !== Object.prototype && prototype !== null) return invalidSecurityConfig();
+    const descriptor = Object.getOwnPropertyDescriptor(cfg, "security");
+    if (!descriptor) return undefined;
+    if (!descriptor.enumerable || !("value" in descriptor)) return invalidSecurityConfig();
+    const value = descriptor.value;
+    if (value === undefined) return undefined;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return invalidSecurityConfig();
+    }
+    return value as SecurityConfig;
+  } catch {
+    return invalidSecurityConfig();
+  }
+}
+
+function readProductionDefaults(options: unknown): boolean | undefined {
+  if (typeof options !== "object" || options === null || Array.isArray(options)) {
+    return invalidSecurityConfig();
+  }
+
+  try {
+    const prototype = Object.getPrototypeOf(options);
+    if (prototype !== Object.prototype && prototype !== null) return invalidSecurityConfig();
+    const keys = Reflect.ownKeys(options);
+    if (keys.some((key) => key !== "productionDefaults")) return invalidSecurityConfig();
+    const descriptor = Object.getOwnPropertyDescriptor(options, "productionDefaults");
+    if (!descriptor) return undefined;
+    if (!descriptor.enumerable || !("value" in descriptor)) return invalidSecurityConfig();
+    if (descriptor.value !== undefined && typeof descriptor.value !== "boolean") {
+      return invalidSecurityConfig();
+    }
+    return descriptor.value as boolean | undefined;
+  } catch {
+    return invalidSecurityConfig();
+  }
+}
+
+/**
+ * Check a standalone security configuration against the canonical project
+ * configuration schema.
+ *
+ * @deprecated Project configuration loaded through `getConfig()` is already
+ * validated. Prefer that validated configuration or `SecurityConfigLoader`.
+ */
+export function isValidSecurityConfig(config: unknown): config is SecurityConfig {
+  try {
+    const snapshot = cloneAndFreezeSecurityValue(config);
+    return validateVeryfrontConfig({ security: snapshot }).security !== undefined;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Load the project's schema-validated security configuration.
+ *
+ * Unlike the historical implementation, configuration loading and validation
+ * failures are propagated so callers cannot silently continue without the
+ * configured security policy. `null` means that the project has no security
+ * configuration.
+ *
+ * @deprecated Use `SecurityConfigLoader` to derive the runtime security
+ * context, including production defaults and the serialized CSP header.
+ */
+export async function loadSecurityConfig(
+  projectDir: string,
+  adapter: RuntimeAdapter,
+): Promise<SecurityConfig | null> {
+  const config = await getConfig(projectDir, adapter);
+  const security = readSecurityConfig(config);
+  return security === undefined ? null : cloneAndFreezeSecurityValue(security);
+}
+
+/**
+ * Derive a request-owned security context from schema-validated project config.
+ *
+ * Config objects can be cached and shared between projects or requests. Deep
+ * cloning and freezing here prevents a handler from mutating that shared
+ * source. Function-valued origin validators are wrapped in request-owned
+ * frozen callables so mutable function objects are not shared across requests.
+ */
+export function deriveSecurityContext(
+  cfg?: VeryfrontConfig,
+  options: DeriveSecurityContextOptions = {},
+): DerivedSecurityContext {
+  const source = readSecurityConfig(cfg);
+  const snapshot = source === undefined
+    ? Object.freeze(Object.create(null)) as SecurityConfig
+    : cloneAndFreezeSecurityValue(source);
+  const normalized: SecurityConfig = Object.assign(Object.create(null), snapshot);
+  normalized.cors ??= false;
+
+  const productionDefaults = readProductionDefaults(options) ?? isProduction();
+  if (normalized.csrf === undefined && productionDefaults) {
+    normalized.csrf = true;
+  }
+
+  const securityConfig = Object.freeze(normalized);
+  return Object.freeze({
+    securityConfig,
+    cspUserHeader: serializeCSPDirectives(securityConfig.csp),
+  });
+}
+
 export class SecurityConfigLoader {
   private securityConfig: SecurityConfig | null = null;
   private cspUserHeader: string | null = null;
@@ -34,7 +297,10 @@ export class SecurityConfigLoader {
       // Fail this request closed, but allow a later request to retry after a
       // transient filesystem, import, or parse failure.
       if (Object.is(this.loadPromise, loadPromise)) this.loadPromise = null;
-      logger.error("Failed to load security config; will retry on next request", { error });
+      // Configuration errors can contain project paths or source fragments.
+      // Keep process telemetry stable and non-sensitive; the error still
+      // rejects the current caller unchanged for the request error boundary.
+      logger.error("Failed to load security config; will retry on next request");
       throw error;
     }
   }
@@ -45,15 +311,9 @@ export class SecurityConfigLoader {
   }
 
   private applyConfig(cfg?: VeryfrontConfig): void {
-    const security: SecurityConfig = cfg?.security ? { ...cfg.security } as SecurityConfig : {};
     const production = this.productionRuntime || isProduction();
-
-    if (security.headers) security.headers = { ...security.headers };
-
-    security.cors ??= false;
-    if (security.csrf === undefined && production) {
-      security.csrf = true;
-    }
+    const derived = deriveSecurityContext(cfg, { productionDefaults: production });
+    const security = derived.securityConfig;
 
     if (production && !security.cors && !security.csrf) {
       logger.warn(
@@ -64,7 +324,7 @@ export class SecurityConfigLoader {
     }
 
     this.securityConfig = security;
-    this.cspUserHeader = serializeCSPDirectives(security.csp);
+    this.cspUserHeader = derived.cspUserHeader;
     this.isLoaded = true;
   }
 
@@ -92,11 +352,4 @@ export class SecurityConfigLoader {
     if (typeof configValue === "string") return configValue;
     return envValue || defaultValue;
   }
-
-  reset(): void {
-    this.securityConfig = null;
-    this.cspUserHeader = null;
-    this.isLoaded = false;
-    this.loadPromise = null;
-  }
 }
diff --git a/src/security/http/cors/constants.test.ts b/src/security/http/cors/constants.test.ts
index 94e5541743..74d0eec54c 100644
--- a/src/security/http/cors/constants.test.ts
+++ b/src/security/http/cors/constants.test.ts
@@ -5,6 +5,8 @@ import {
   DEFAULT_HEADERS,
   DEFAULT_MAX_AGE,
   DEFAULT_METHODS,
+  getDefaultCORSHeaders,
+  getDefaultCORSMethods,
   HTTP_FORBIDDEN,
   HTTP_NO_CONTENT,
 } from "./constants.ts";
@@ -20,6 +22,11 @@ describe("CORS constants", () => {
     it("should have 6 methods", () => {
       assertEquals(DEFAULT_METHODS.length, 6);
     });
+
+    it("exports the immutable runtime policy", () => {
+      assertEquals(Object.isFrozen(DEFAULT_METHODS), true);
+      assertEquals(getDefaultCORSMethods(), DEFAULT_METHODS);
+    });
   });
 
   describe("DEFAULT_HEADERS", () => {
@@ -28,6 +35,11 @@ describe("CORS constants", () => {
         assert(DEFAULT_HEADERS.includes(header));
       }
     });
+
+    it("exports the immutable runtime policy", () => {
+      assertEquals(Object.isFrozen(DEFAULT_HEADERS), true);
+      assertEquals(getDefaultCORSHeaders(), DEFAULT_HEADERS);
+    });
   });
 
   describe("DEFAULT_MAX_AGE", () => {
diff --git a/src/security/http/cors/constants.ts b/src/security/http/cors/constants.ts
index 38c303f1b9..032795f678 100644
--- a/src/security/http/cors/constants.ts
+++ b/src/security/http/cors/constants.ts
@@ -1,5 +1,24 @@
-export const DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-export const DEFAULT_HEADERS = ["Content-Type", "Authorization"];
+export const DEFAULT_METHODS: readonly string[] = Object.freeze([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+]);
+export const DEFAULT_HEADERS: readonly string[] = Object.freeze([
+  "Content-Type",
+  "Authorization",
+]);
+
+export function getDefaultCORSMethods(): readonly string[] {
+  return DEFAULT_METHODS;
+}
+
+export function getDefaultCORSHeaders(): readonly string[] {
+  return DEFAULT_HEADERS;
+}
+
 export const DEFAULT_MAX_AGE = 86400;
 
 export const HTTP_NO_CONTENT = 204;
diff --git a/src/security/http/cors/headers.test.ts b/src/security/http/cors/headers.test.ts
index aa2ec6ce1b..740862e6b0 100644
--- a/src/security/http/cors/headers.test.ts
+++ b/src/security/http/cors/headers.test.ts
@@ -1,7 +1,8 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { shouldApplyCORS } from "./headers.ts";
+import { applyCORSHeaders, applyCORSHeadersSync, shouldApplyCORS } from "./headers.ts";
+import { MAX_CORS_TOKEN_LENGTH } from "#veryfront/utils/cors-policy-limits.ts";
 
 describe("security/http/cors/headers", () => {
   describe("shouldApplyCORS", () => {
@@ -33,4 +34,252 @@ describe("security/http/cors/headers", () => {
       assertEquals(shouldApplyCORS(req, { origin: "http://example.com" }), false);
     });
   });
+
+  it("fails the entire CORS boundary closed for an oversized exposed-header policy", async () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://app.example.com" },
+    });
+    const response = await applyCORSHeaders({
+      request,
+      response: new Response("ok"),
+      config: {
+        origin: "https://app.example.com",
+        exposedHeaders: ["X".repeat(MAX_CORS_TOKEN_LENGTH + 1)],
+      },
+    });
+
+    assertEquals(response?.headers.get("Access-Control-Allow-Origin"), null);
+    assertEquals(response?.headers.get("Access-Control-Expose-Headers"), null);
+  });
+
+  it("does not partially apply malformed or unknown CORS configuration", async () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://app.example.com" },
+    });
+
+    for (
+      const config of [
+        { origin: "https://app.example.com", credentials: "yes" },
+        { origin: "https://app.example.com", maxAge: -1 },
+        { origin: "https://app.example.com", methods: ["GET, POST"] },
+        { origin: "https://app.example.com", unexpected: true },
+      ]
+    ) {
+      const response = await applyCORSHeaders({
+        request,
+        response: new Response("ok"),
+        config: config as never,
+      });
+
+      assertEquals(response?.headers.get("Access-Control-Allow-Origin"), null);
+      assertEquals(response?.headers.get("Access-Control-Allow-Credentials"), null);
+      assertEquals(response?.headers.get("Access-Control-Expose-Headers"), null);
+    }
+  });
+
+  it("rejects unsafe callback origins before writing response headers", async () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://app.example.com" },
+    });
+    const response = await applyCORSHeaders({
+      request,
+      response: new Response("ok"),
+      config: {
+        origin: () => "https://例.example",
+      },
+    });
+
+    assertEquals(response?.headers.get("Access-Control-Allow-Origin"), null);
+  });
+
+  it("scrubs every policy-owned CORS header when an origin is denied", async () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://denied.example.com" },
+    });
+    const headers = new Headers({
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Credentials": "true",
+      "Access-Control-Expose-Headers": "X-Project",
+      "Access-Control-Allow-Methods": "DELETE",
+      "Access-Control-Allow-Headers": "X-Project",
+      "Access-Control-Max-Age": "999999",
+      "Access-Control-Allow-Private-Network": "true",
+      "Access-Control-Future-Policy": "unsafe",
+    });
+    await applyCORSHeaders({
+      request,
+      headers,
+      config: { origin: "https://allowed.example.com" },
+    });
+
+    for (
+      const name of [
+        "Access-Control-Allow-Origin",
+        "Access-Control-Allow-Credentials",
+        "Access-Control-Expose-Headers",
+        "Access-Control-Allow-Methods",
+        "Access-Control-Allow-Headers",
+        "Access-Control-Max-Age",
+        "Access-Control-Allow-Private-Network",
+        "Access-Control-Future-Policy",
+      ]
+    ) {
+      assertEquals(headers.get(name), null);
+    }
+  });
+
+  it("mutates supplied headers to the exact allowed policy without stale values", () => {
+    const origin = "https://allowed.example.com";
+    const request = new Request("http://localhost/", {
+      headers: { origin },
+    });
+    const headers = new Headers({
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Credentials": "true",
+      "Access-Control-Expose-Headers": "X-Project",
+      "Access-Control-Allow-Methods": "DELETE",
+      "Access-Control-Allow-Headers": "X-Project",
+      "Access-Control-Max-Age": "999999",
+      "Access-Control-Allow-Private-Network": "true",
+      "Access-Control-Future-Policy": "unsafe",
+    });
+
+    applyCORSHeadersSync({
+      request,
+      headers,
+      config: { origin },
+    });
+
+    assertEquals(headers.get("Access-Control-Allow-Origin"), origin);
+    assertEquals(headers.get("Vary"), "Origin");
+    for (
+      const name of [
+        "Access-Control-Allow-Credentials",
+        "Access-Control-Expose-Headers",
+        "Access-Control-Allow-Methods",
+        "Access-Control-Allow-Headers",
+        "Access-Control-Max-Age",
+        "Access-Control-Allow-Private-Network",
+        "Access-Control-Future-Policy",
+      ]
+    ) {
+      assertEquals(headers.get(name), null);
+    }
+  });
+
+  it("returns async denials and malformed policies with the sanitized supplied headers", async () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://denied.example.com" },
+    });
+
+    for (
+      const config of [
+        { origin: "https://allowed.example.com" },
+        { origin: "https://denied.example.com", unexpected: true },
+      ]
+    ) {
+      const response = new Response("ok", {
+        headers: {
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Credentials": "true",
+          "Access-Control-Future-Policy": "unsafe",
+          "X-Response": "original",
+        },
+      });
+      const headers = new Headers({
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Credentials": "true",
+        "Access-Control-Future-Policy": "unsafe",
+        "X-Authoritative": "detached",
+      });
+
+      const result = await applyCORSHeaders({
+        request,
+        response,
+        headers,
+        config: config as never,
+      });
+
+      assertEquals(result?.headers.get("Access-Control-Allow-Origin"), null);
+      assertEquals(result?.headers.get("Access-Control-Allow-Credentials"), null);
+      assertEquals(result?.headers.get("Access-Control-Future-Policy"), null);
+      assertEquals(result?.headers.get("X-Authoritative"), "detached");
+      assertEquals(result?.headers.get("X-Response"), null);
+    }
+  });
+
+  it("returns sync denials and malformed policies with the sanitized supplied headers", () => {
+    const request = new Request("http://localhost/", {
+      headers: { origin: "https://denied.example.com" },
+    });
+
+    for (
+      const config of [
+        { origin: "https://allowed.example.com" },
+        { origin: "https://denied.example.com", unexpected: true },
+      ]
+    ) {
+      const response = new Response("ok", {
+        headers: {
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Credentials": "true",
+          "Access-Control-Future-Policy": "unsafe",
+          "X-Response": "original",
+        },
+      });
+      const headers = new Headers({
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Credentials": "true",
+        "Access-Control-Future-Policy": "unsafe",
+        "X-Authoritative": "detached",
+      });
+
+      const result = applyCORSHeadersSync({
+        request,
+        response,
+        headers,
+        config: config as never,
+      });
+
+      assertEquals(result?.headers.get("Access-Control-Allow-Origin"), null);
+      assertEquals(result?.headers.get("Access-Control-Allow-Credentials"), null);
+      assertEquals(result?.headers.get("Access-Control-Future-Policy"), null);
+      assertEquals(result?.headers.get("X-Authoritative"), "detached");
+      assertEquals(result?.headers.get("X-Response"), null);
+    }
+  });
+
+  it("keeps supplied headers authoritative when an origin is allowed", async () => {
+    const origin = "https://allowed.example.com";
+    const result = await applyCORSHeaders({
+      request: new Request("http://localhost/", { headers: { origin } }),
+      response: new Response("ok", { headers: { "X-Response": "original" } }),
+      headers: new Headers({ "X-Authoritative": "detached" }),
+      config: { origin },
+    });
+
+    assertEquals(result?.headers.get("Access-Control-Allow-Origin"), origin);
+    assertEquals(result?.headers.get("X-Authoritative"), "detached");
+    assertEquals(result?.headers.get("X-Response"), null);
+  });
+
+  it("merges Vary field names case-insensitively without empty tokens", async () => {
+    const request = new Request("https://example.com", {
+      headers: { Origin: "https://app.example.com" },
+    });
+
+    for (const initialVary of ["origin", "", "*"]) {
+      const headers = new Headers({ Vary: initialVary });
+      await applyCORSHeaders({
+        request,
+        headers,
+        config: { origin: "https://app.example.com" },
+      });
+
+      assertEquals(
+        headers.get("Vary"),
+        initialVary === "" ? "Origin" : initialVary,
+      );
+    }
+  });
 });
diff --git a/src/security/http/cors/headers.ts b/src/security/http/cors/headers.ts
index 7674018aed..a50e1ec36c 100644
--- a/src/security/http/cors/headers.ts
+++ b/src/security/http/cors/headers.ts
@@ -1,39 +1,75 @@
-import type { CORSConfig, CORSHeaderOptions, CORSValidationResult } from "./types.ts";
-import { validateOrigin, validateOriginSync } from "./validators.ts";
+import type {
+  CORSConfig,
+  CORSHeaderOptions,
+  CORSValidationResult,
+  SyncCORSHeaderOptions,
+} from "./types.ts";
+import {
+  corsOriginForTelemetry,
+  normalizeCORSConfig,
+  type NormalizedCORSConfig,
+  validateNormalizedOrigin,
+  validateNormalizedOriginSync,
+} from "./validators.ts";
 import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
+import { isCorsPolicyResponseHeaderName } from "#veryfront/utils/cors-policy-limits.ts";
+
+export function scrubPolicyOwnedCORSHeaders(headers: Headers): boolean {
+  let changed = false;
+  for (const name of [...headers.keys()]) {
+    if (!isCorsPolicyResponseHeaderName(name)) continue;
+    headers.delete(name);
+    changed = true;
+  }
+  return changed;
+}
 
 function applyValidatedHeaders(
   validation: CORSValidationResult,
-  options: CORSHeaderOptions,
+  options: CORSHeaderOptions | SyncCORSHeaderOptions,
+  config: NormalizedCORSConfig,
 ): Response | void {
-  const { response, headers: headersObj, config } = options;
+  const { response, headers: headersObj } = options;
+  const headers = headersObj ?? (response ? new Headers(response.headers) : new Headers());
 
   if (!validation.allowedOrigin) {
-    return response;
+    const changed = scrubPolicyOwnedCORSHeaders(headers);
+
+    if (!response) return;
+    if (!headersObj && !changed) return response;
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
   }
 
-  const headers = headersObj ?? (response ? new Headers(response.headers) : new Headers());
-
+  scrubPolicyOwnedCORSHeaders(headers);
   headers.set("Access-Control-Allow-Origin", validation.allowedOrigin);
 
   if (validation.allowedOrigin !== "*") {
     const varyValues = headers
       .get("Vary")
       ?.split(",")
-      .map((v) => v.trim()) ?? [];
+      .map((value) => value.trim())
+      .filter(Boolean) ?? [];
 
-    if (!varyValues.includes("Origin")) {
+    if (
+      !varyValues.some((value) => value === "*" || value.toLowerCase() === "origin")
+    ) {
       headers.set("Vary", [...varyValues, "Origin"].join(", "));
     }
   }
 
   if (validation.allowCredentials && validation.allowedOrigin !== "*") {
     headers.set("Access-Control-Allow-Credentials", "true");
-  }
+  } else headers.delete("Access-Control-Allow-Credentials");
 
   const corsConfig = typeof config === "object" ? config : null;
   if (corsConfig?.exposedHeaders?.length) {
     headers.set("Access-Control-Expose-Headers", corsConfig.exposedHeaders.join(", "));
+  } else {
+    headers.delete("Access-Control-Expose-Headers");
   }
 
   if (!response) {
@@ -48,33 +84,62 @@ function applyValidatedHeaders(
 }
 
 export function applyCORSHeaders(options: CORSHeaderOptions): Promise<Response | void> {
-  const origin = options.request.headers.get("origin");
+  const normalized = normalizeCORSConfig(options.config);
+  const origin = readRequestOrigin(options.request);
 
   return withSpan(
     "security.cors.applyHeaders",
     async () => {
-      const validation = await validateOrigin(origin, options.config);
-      return applyValidatedHeaders(validation, options);
+      if (!normalized.valid) {
+        return applyValidatedHeaders(
+          Object.freeze({
+            allowedOrigin: null,
+            allowCredentials: false,
+            error: normalized.error,
+          }),
+          options,
+          false,
+        );
+      }
+      const validation = await validateNormalizedOrigin(origin, normalized.config);
+      return applyValidatedHeaders(validation, options, normalized.config);
     },
-    { "cors.origin": origin ?? "unknown" },
+    { "cors.origin": corsOriginForTelemetry(origin) },
   );
 }
 
-export function applyCORSHeadersSync(options: CORSHeaderOptions): Response | void {
-  const origin = options.request.headers.get("origin");
-  const validation = validateOriginSync(origin, options.config);
-  return applyValidatedHeaders(validation, options);
+/** Apply CORS synchronously. Promise-returning values still fail closed at runtime. */
+export function applyCORSHeadersSync(options: SyncCORSHeaderOptions): Response | void {
+  const normalized = normalizeCORSConfig(options.config);
+  const origin = readRequestOrigin(options.request);
+  if (!normalized.valid) {
+    return applyValidatedHeaders(
+      Object.freeze({
+        allowedOrigin: null,
+        allowCredentials: false,
+        error: normalized.error,
+      }),
+      options,
+      false,
+    );
+  }
+  const validation = validateNormalizedOriginSync(origin, normalized.config);
+  return applyValidatedHeaders(validation, options, normalized.config);
 }
 
 export function shouldApplyCORS(request: Request, config?: boolean | CORSConfig): boolean {
-  if (!config) {
-    return false;
-  }
+  const normalized = normalizeCORSConfig(config);
+  if (!normalized.valid || normalized.config === false) return false;
+  if (normalized.config === true) return true;
 
-  if (config === true) {
-    return true;
-  }
+  const origin = readRequestOrigin(request);
+  return typeof origin === "string" ? true : normalized.config.origin === "*";
+}
 
-  const origin = request.headers.get("origin");
-  return origin ? true : config.origin === "*";
+function readRequestOrigin(request: Request): unknown {
+  try {
+    return request.headers.get("origin");
+  } catch {
+    return undefined;
+  }
 }
diff --git a/src/security/http/cors/index.ts b/src/security/http/cors/index.ts
index 293f609f22..88dee7e2bd 100644
--- a/src/security/http/cors/index.ts
+++ b/src/security/http/cors/index.ts
@@ -25,6 +25,9 @@ export type {
   CORSPreflightOptions,
   CORSValidationResult,
   OriginValidator,
+  SyncCORSConfig,
+  SyncCORSHeaderOptions,
+  SyncOriginValidator,
 } from "./types.ts";
 
 export {
diff --git a/src/security/http/cors/middleware.ts b/src/security/http/cors/middleware.ts
index 1c1fc33f26..ba6cf78019 100644
--- a/src/security/http/cors/middleware.ts
+++ b/src/security/http/cors/middleware.ts
@@ -2,20 +2,22 @@ import type { Context, MiddlewareHandler } from "#veryfront/middleware/core/inde
 import type { CORSConfig } from "./types.ts";
 import { handleCORSPreflight, isPreflightRequest } from "./preflight.ts";
 import { applyCORSHeaders } from "./headers.ts";
-import { validateCORSConfig } from "./validators.ts";
+import { normalizeCORSConfig } from "./validators.ts";
 import { createError, toError } from "#veryfront/errors";
+import { getDefaultCORSMethods } from "./constants.ts";
 
 /** Create CORS middleware. */
 export function cors(config?: boolean | CORSConfig): MiddlewareHandler {
-  const validation = validateCORSConfig(config);
-  if (!validation.valid) {
+  const normalized = normalizeCORSConfig(config);
+  if (!normalized.valid) {
     throw toError(
       createError({
         type: "config",
-        message: `[CORS] Invalid configuration: ${validation.error}`,
+        message: `[CORS] Invalid configuration: ${normalized.error}`,
       }),
     );
   }
+  const corsConfig = normalized.config;
 
   return async (
     c: Context,
@@ -24,13 +26,13 @@ export function cors(config?: boolean | CORSConfig): MiddlewareHandler {
     const request = c.req;
 
     if (isPreflightRequest(request)) {
-      return handleCORSPreflight({ request, config });
+      return handleCORSPreflight({ request, config: corsConfig });
     }
 
     const response = await next();
     if (!response) return undefined;
 
-    return (await applyCORSHeaders({ request, response, config })) ?? response;
+    return (await applyCORSHeaders({ request, response, config: corsConfig })) ?? response;
   };
 }
 
@@ -38,6 +40,6 @@ export function corsSimple(origin: string = "*"): MiddlewareHandler {
   return cors({
     origin,
     credentials: false,
-    methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+    methods: [...getDefaultCORSMethods()],
   });
 }
diff --git a/src/security/http/cors/preflight.test.ts b/src/security/http/cors/preflight.test.ts
index d0d1afcdcf..49e601f1ba 100644
--- a/src/security/http/cors/preflight.test.ts
+++ b/src/security/http/cors/preflight.test.ts
@@ -1,9 +1,243 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { isPreflightRequest } from "./preflight.ts";
+import { DEFAULT_METHODS } from "./constants.ts";
+import {
+  handleCORSPreflight,
+  isPreflightRequest,
+  normalizeCORSPreflightList,
+} from "./preflight.ts";
+import { MAX_CORS_TOKEN_LENGTH } from "#veryfront/utils/cors-policy-limits.ts";
 
 describe("security/http/cors/preflight", () => {
+  describe("configured policy", () => {
+    it("keeps configured methods and headers narrower than runtime capabilities", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "POST",
+          "access-control-request-headers": "Content-Type, X-Internal",
+        },
+      });
+
+      const response = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://app.example.com",
+          methods: ["GET"],
+          allowedHeaders: ["Content-Type"],
+        },
+        allowMethods: "GET, POST",
+        allowHeaders: "Content-Type, X-Internal",
+      });
+
+      assertEquals(response.headers.get("Access-Control-Allow-Methods"), "GET");
+      assertEquals(response.headers.get("Access-Control-Allow-Headers"), "Content-Type");
+    });
+
+    it("uses configured header policy before request-supplied headers", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "GET",
+          "access-control-request-headers": "X-Unconfigured",
+        },
+      });
+
+      const response = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://app.example.com",
+          allowedHeaders: ["Authorization"],
+        },
+      });
+
+      assertEquals(response.headers.get("Access-Control-Allow-Headers"), "Authorization");
+    });
+
+    it("treats explicitly undefined optional policies as absent", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "GET",
+          "access-control-request-headers": "X-Requested",
+        },
+      });
+
+      const response = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://app.example.com",
+          methods: undefined,
+          allowedHeaders: undefined,
+        },
+      });
+
+      assertEquals(
+        response.headers.get("Access-Control-Allow-Methods"),
+        DEFAULT_METHODS.join(", "),
+      );
+      assertEquals(response.headers.get("Access-Control-Allow-Headers"), "X-Requested");
+    });
+
+    it("omits allow headers when policy and runtime capabilities do not overlap", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "DELETE",
+          "access-control-request-headers": "X-Policy",
+        },
+      });
+
+      const response = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://app.example.com",
+          methods: ["DELETE"],
+          allowedHeaders: ["X-Policy"],
+        },
+        allowMethods: "GET, POST",
+        allowHeaders: "Content-Type",
+      });
+
+      assertEquals(response.headers.get("Access-Control-Allow-Methods"), null);
+      assertEquals(response.headers.get("Access-Control-Allow-Headers"), null);
+    });
+
+    it("fails closed instead of emitting an oversized configured header list", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "GET",
+        },
+      });
+
+      const response = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://app.example.com",
+          allowedHeaders: ["X".repeat(MAX_CORS_TOKEN_LENGTH + 1)],
+        },
+      });
+
+      assertEquals(response.status, 403);
+      assertEquals(response.headers.get("Access-Control-Allow-Origin"), null);
+      assertEquals(response.headers.get("Access-Control-Allow-Headers"), null);
+      assertEquals(response.headers.get("Access-Control-Max-Age"), null);
+    });
+
+    it("rejects malformed and unknown configuration without partial CORS headers", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "GET",
+        },
+      });
+
+      for (
+        const config of [
+          { origin: "https://app.example.com", credentials: "true" },
+          { origin: "https://app.example.com", maxAge: Number.NaN },
+          { origin: "https://app.example.com", methods: ["GET, POST"] },
+          { origin: "https://app.example.com", unknown: true },
+        ]
+      ) {
+        const response = await handleCORSPreflight({
+          request,
+          config: config as never,
+        });
+
+        assertEquals(response.status, 403);
+        assertEquals(response.headers.get("Access-Control-Allow-Origin"), null);
+        assertEquals(response.headers.get("Access-Control-Allow-Methods"), null);
+        assertEquals(response.headers.get("Access-Control-Allow-Headers"), null);
+        assertEquals(response.headers.get("Access-Control-Max-Age"), null);
+      }
+    });
+
+    it("emits max age only for allowed origins and valid safe integers", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://denied.example.com",
+          "access-control-request-method": "GET",
+        },
+      });
+
+      const denied = await handleCORSPreflight({
+        request,
+        config: {
+          origin: "https://allowed.example.com",
+          maxAge: 7,
+        },
+      });
+
+      assertEquals(denied.status, 403);
+      assertEquals(denied.headers.get("Access-Control-Max-Age"), null);
+    });
+
+    it("normalizes unknown non-string capability inputs without throwing", () => {
+      for (const value of [undefined, null, 42, {}, Symbol("methods")]) {
+        assertEquals(normalizeCORSPreflightList(value as never), null);
+      }
+    });
+
+    it("fails closed for hostile, malformed, and oversized capability values", () => {
+      const revoked = Proxy.revocable(["GET"], {});
+      revoked.revoke();
+
+      for (
+        const value of [
+          revoked.proxy,
+          "GET\r\nX-Injected",
+          "M\u{100}",
+          "G".repeat(100_000),
+        ]
+      ) {
+        assertEquals(normalizeCORSPreflightList(value as never), null);
+      }
+    });
+
+    it("returns one fixed bounded rejection for hostile option names and proxies", async () => {
+      const request = new Request("http://localhost/", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://app.example.com",
+          "access-control-request-method": "GET",
+        },
+      });
+      const revokedConfig = Proxy.revocable({}, {});
+      const revokedOrigins = Proxy.revocable(["https://app.example.com"], {});
+      revokedConfig.revoke();
+      revokedOrigins.revoke();
+
+      for (
+        const config of [
+          revokedConfig.proxy,
+          { origin: revokedOrigins.proxy },
+          { ["unknown\r\nX-Injected: yes"]: true },
+          { ["non-byte-\u{100}"]: true },
+          { ["x".repeat(100_000)]: true },
+        ]
+      ) {
+        const response = await handleCORSPreflight({
+          request,
+          config: config as never,
+        });
+
+        assertEquals(response.status, 403);
+        assertEquals(response.headers.get("X-CORS-Error"), "CORS policy rejected");
+        assertEquals(await response.text(), "CORS request rejected");
+      }
+    });
+  });
+
   describe("isPreflightRequest", () => {
     it("should return true for OPTIONS with access-control-request-method", () => {
       const req = new Request("http://localhost/", {
diff --git a/src/security/http/cors/preflight.ts b/src/security/http/cors/preflight.ts
index 17a8bd2fc4..f3682c1041 100644
--- a/src/security/http/cors/preflight.ts
+++ b/src/security/http/cors/preflight.ts
@@ -1,44 +1,154 @@
 import type { CORSPreflightOptions } from "./types.ts";
-import { validateOrigin } from "./validators.ts";
 import {
-  DEFAULT_HEADERS,
+  corsOriginForTelemetry,
+  normalizeCORSConfig,
+  type NormalizedCORSConfig,
+  snapshotCORSArray,
+  validateNormalizedOrigin,
+} from "./validators.ts";
+import {
   DEFAULT_MAX_AGE,
-  DEFAULT_METHODS,
+  getDefaultCORSHeaders,
+  getDefaultCORSMethods,
   HTTP_FORBIDDEN,
   HTTP_NO_CONTENT,
 } from "./constants.ts";
 import { serverLogger } from "#veryfront/utils";
 import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
+import {
+  isBoundedCorsTokenList,
+  MAX_CORS_SERIALIZED_LIST_LENGTH,
+  MAX_CORS_TOKEN_COUNT,
+} from "#veryfront/utils/cors-policy-limits.ts";
 
 const logger = serverLogger.component("cors");
+const REJECTED_PREFLIGHT_BODY = "CORS request rejected";
+const REJECTED_PREFLIGHT_HEADER = "CORS policy rejected";
+
+interface ResolvePreflightPolicyOptions {
+  config?: unknown;
+  allowMethods?: unknown;
+  allowHeaders?: unknown;
+  requestedHeaders?: unknown;
+}
+
+interface ResolvedPreflightPolicy {
+  methods: string;
+  headers: string;
+}
+
+export function normalizeCORSPreflightList(value: unknown): string[] | null {
+  try {
+    if (typeof value === "string") {
+      if (value.length > MAX_CORS_SERIALIZED_LIST_LENGTH) return null;
+      const normalized = [...new Set(value.split(",").map((item) => item.trim()).filter(Boolean))];
+      return isBoundedCorsTokenList(normalized) ? normalized : null;
+    }
+
+    const values = snapshotCORSArray(value, MAX_CORS_TOKEN_COUNT);
+    if (!values) return null;
+    if (!values.every((item) => typeof item === "string")) return null;
+    const normalized = [...new Set(values.map((item) => item.trim()).filter(Boolean))];
+    return isBoundedCorsTokenList(normalized) ? normalized : null;
+  } catch {
+    return null;
+  }
+}
+
+function intersectLists(
+  policy: string[],
+  capability: string[],
+  normalize: (value: string) => string,
+): string[] {
+  const supported = new Set(capability.map(normalize));
+  return policy.filter((value) => supported.has(normalize(value)));
+}
+
+/**
+ * Resolve the headers advertised by a preflight response.
+ *
+ * Explicit allow lists describe runtime capabilities. Configured lists are
+ * policy restrictions, so when both exist the response advertises only their
+ * intersection. Request-supplied header names are reflected only when no
+ * configured or explicit policy exists.
+ */
+function resolveNormalizedCORSPreflightPolicy(
+  options: ResolvePreflightPolicyOptions,
+  config: NormalizedCORSConfig,
+): ResolvedPreflightPolicy {
+  const corsConfig = typeof config === "object" ? config : undefined;
+
+  const methodCapability = options.allowMethods === undefined
+    ? undefined
+    : normalizeCORSPreflightList(options.allowMethods) ?? [];
+  const configuredMethodValues = corsConfig?.methods;
+  const hasConfiguredMethods = configuredMethodValues !== undefined;
+  const configuredMethods = hasConfiguredMethods
+    ? normalizeCORSPreflightList(configuredMethodValues) ?? []
+    : [];
+  const methods = hasConfiguredMethods
+    ? methodCapability
+      ? intersectLists(configuredMethods, methodCapability, (value) => value)
+      : configuredMethods
+    : methodCapability ?? [...getDefaultCORSMethods()];
+
+  const headerCapability = options.allowHeaders === undefined
+    ? undefined
+    : normalizeCORSPreflightList(options.allowHeaders) ?? [];
+  const configuredHeaderValues = corsConfig?.allowedHeaders;
+  const hasConfiguredHeaders = configuredHeaderValues !== undefined;
+  const configuredHeaders = hasConfiguredHeaders
+    ? normalizeCORSPreflightList(configuredHeaderValues) ?? []
+    : [];
+  const headers = hasConfiguredHeaders
+    ? headerCapability
+      ? intersectLists(configuredHeaders, headerCapability, (value) => value.toLowerCase())
+      : configuredHeaders
+    : headerCapability ??
+      (options.requestedHeaders
+        ? normalizeCORSPreflightList(options.requestedHeaders) ?? []
+        : [...getDefaultCORSHeaders()]);
+
+  return {
+    methods: methods.join(", "),
+    headers: headers.join(", "),
+  };
+}
+
+export function resolveCORSPreflightPolicy(
+  options: ResolvePreflightPolicyOptions,
+): ResolvedPreflightPolicy {
+  const normalized = normalizeCORSConfig(options.config);
+  if (!normalized.valid) return { methods: "", headers: "" };
+  return resolveNormalizedCORSPreflightPolicy(options, normalized.config);
+}
 
 export function handleCORSPreflight(options: CORSPreflightOptions): Promise<Response> {
+  const observedOrigin = readRequestHeader(options.request, "origin");
+
   return withSpan(
     "security.cors.preflight",
     async () => {
       const { request, config, allowMethods, allowHeaders } = options;
+      const normalized = normalizeCORSConfig(config);
+      if (!normalized.valid) {
+        return rejectedPreflight();
+      }
 
-      const origin = request.headers.get("origin");
-      const validation = await validateOrigin(origin, config);
+      const origin = readRequestHeader(request, "origin");
+      const validation = await validateNormalizedOrigin(origin, normalized.config);
 
       if (!validation.allowedOrigin) {
-        if (!config) {
+        if (normalized.config === false) {
           return new Response(null, { status: HTTP_NO_CONTENT });
         }
 
         logger.warn("Preflight rejected", {
-          origin,
+          origin: corsOriginForTelemetry(origin),
           error: validation.error,
         });
 
-        const errorMessage = validation.error ?? "CORS policy: Origin not allowed";
-
-        return new Response(errorMessage, {
-          status: HTTP_FORBIDDEN,
-          headers: {
-            "X-CORS-Error": validation.error ?? "Origin not allowed",
-          },
-        });
+        return rejectedPreflight();
       }
 
       const headers = new Headers();
@@ -48,20 +158,16 @@ export function handleCORSPreflight(options: CORSPreflightOptions): Promise<Resp
         headers.set("Vary", "Origin");
       }
 
-      const corsConfig = typeof config === "object" ? config : null;
-
-      const methods = allowMethods ??
-        (corsConfig?.methods?.length ? corsConfig.methods.join(", ") : DEFAULT_METHODS.join(", "));
-      headers.set("Access-Control-Allow-Methods", methods);
-
-      const requestedHeaders = request.headers.get("access-control-request-headers");
-      const resolvedAllowedHeaders = allowHeaders ??
-        requestedHeaders ??
-        (corsConfig?.allowedHeaders?.length
-          ? corsConfig.allowedHeaders.join(", ")
-          : DEFAULT_HEADERS.join(", "));
-      headers.set("Access-Control-Allow-Headers", resolvedAllowedHeaders);
+      const requestedHeaders = readRequestHeader(request, "access-control-request-headers");
+      const policy = resolveNormalizedCORSPreflightPolicy({
+        allowMethods,
+        allowHeaders,
+        requestedHeaders,
+      }, normalized.config);
+      if (policy.methods) headers.set("Access-Control-Allow-Methods", policy.methods);
+      if (policy.headers) headers.set("Access-Control-Allow-Headers", policy.headers);
 
+      const corsConfig = typeof normalized.config === "object" ? normalized.config : null;
       headers.set("Access-Control-Max-Age", String(corsConfig?.maxAge ?? DEFAULT_MAX_AGE));
 
       if (validation.allowCredentials && validation.allowedOrigin !== "*") {
@@ -73,14 +179,35 @@ export function handleCORSPreflight(options: CORSPreflightOptions): Promise<Resp
         headers,
       });
     },
-    { "cors.origin": options.request.headers.get("origin") ?? "unknown" },
+    { "cors.origin": corsOriginForTelemetry(observedOrigin) },
   );
 }
 
 export function isPreflightRequest(request: Request): boolean {
-  return (
-    request.method === "OPTIONS" &&
-    (request.headers.has("access-control-request-method") ||
-      request.headers.has("access-control-request-headers"))
-  );
+  try {
+    return (
+      request.method === "OPTIONS" &&
+      (request.headers.has("access-control-request-method") ||
+        request.headers.has("access-control-request-headers"))
+    );
+  } catch {
+    return false;
+  }
+}
+
+function rejectedPreflight(): Response {
+  return new Response(REJECTED_PREFLIGHT_BODY, {
+    status: HTTP_FORBIDDEN,
+    headers: {
+      "X-CORS-Error": REJECTED_PREFLIGHT_HEADER,
+    },
+  });
+}
+
+function readRequestHeader(request: Request, name: string): unknown {
+  try {
+    return request.headers.get(name);
+  } catch {
+    return undefined;
+  }
 }
diff --git a/src/security/http/cors/types.ts b/src/security/http/cors/types.ts
index 0935dc33b7..73c7e9d98e 100644
--- a/src/security/http/cors/types.ts
+++ b/src/security/http/cors/types.ts
@@ -1,5 +1,9 @@
-export type OriginValidator = (origin: string) => boolean | string | Promise<boolean | string>;
+export type SyncOriginValidator = (origin: string) => boolean | string;
+export type OriginValidator = (
+  origin: string,
+) => boolean | string | Promise<boolean | string>;
 
+/** CORS policy accepted by asynchronous middleware and preflight APIs. */
 export interface CORSConfig {
   origin?: string | string[] | OriginValidator;
   credentials?: boolean;
@@ -9,6 +13,11 @@ export interface CORSConfig {
   maxAge?: number;
 }
 
+/** CORS policy accepted by synchronous response-building APIs. */
+export interface SyncCORSConfig extends Omit<CORSConfig, "origin"> {
+  origin?: string | string[] | SyncOriginValidator;
+}
+
 export interface CORSValidationResult {
   allowedOrigin: string | null;
   allowCredentials: boolean;
@@ -28,3 +37,11 @@ export interface CORSHeaderOptions {
   headers?: Headers;
   config?: boolean | CORSConfig;
 }
+
+/** Header options accepted by synchronous CORS response helpers. */
+export interface SyncCORSHeaderOptions {
+  request: Request;
+  response?: Response;
+  headers?: Headers;
+  config?: boolean | SyncCORSConfig;
+}
diff --git a/src/security/http/cors/validators.test.ts b/src/security/http/cors/validators.test.ts
index a97ce25da9..66eea77a3d 100644
--- a/src/security/http/cors/validators.test.ts
+++ b/src/security/http/cors/validators.test.ts
@@ -1,7 +1,19 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
-import { validateCORSConfig, validateOrigin, validateOriginSync } from "./validators.ts";
+import { assertEquals, assertThrows } from "#veryfront/testing/assert.ts";
+import { cors } from "./middleware.ts";
+import {
+  corsOriginForTelemetry,
+  validateCORSConfig,
+  validateOrigin,
+  validateOriginSync,
+} from "./validators.ts";
+import {
+  MAX_CORS_ORIGIN_COUNT,
+  MAX_CORS_ORIGIN_LENGTH,
+  MAX_CORS_TOKEN_COUNT,
+  MAX_CORS_TOKEN_LENGTH,
+} from "#veryfront/utils/cors-policy-limits.ts";
 
 describe("validateOriginSync", () => {
   describe("no config", () => {
@@ -16,6 +28,15 @@ describe("validateOriginSync", () => {
       assertEquals(result.allowedOrigin, null);
       assertEquals(result.allowCredentials, false);
     });
+
+    it("returns fresh immutable denial results", () => {
+      const first = validateOriginSync("https://example.com", undefined);
+      const second = validateOriginSync("https://example.com", undefined);
+
+      assertEquals(first === second, false);
+      assertEquals(Object.isFrozen(first), true);
+      assertEquals(Object.isFrozen(second), true);
+    });
   });
 
   describe("config = true", () => {
@@ -129,6 +150,28 @@ describe("validateOriginSync", () => {
       assertEquals(result.allowedOrigin, null);
       assertEquals(result.error, "Origin validation error");
     });
+
+    it("does not invoke validators for unsafe request origins", () => {
+      let calls = 0;
+      const result = validateOriginSync("https://例.example", {
+        origin: () => {
+          calls++;
+          return true;
+        },
+      });
+
+      assertEquals(calls, 0);
+      assertEquals(result.allowedOrigin, null);
+      assertEquals(result.error, "Invalid or oversized request origin");
+    });
+
+    it("rejects malformed non-string request origins without throwing", () => {
+      for (const origin of [undefined, 42, {}, Symbol("origin")]) {
+        const result = validateOriginSync(origin as never, true);
+        assertEquals(result.allowedOrigin, null);
+        assertEquals(result.error, "Invalid or oversized request origin");
+      }
+    });
   });
 });
 
@@ -179,6 +222,24 @@ describe("validateOrigin (async)", () => {
     assertEquals(result.allowedOrigin, null);
     assertEquals(result.error, "Origin validation error");
   });
+
+  it("rejects unsafe callback-returned origins and wildcard credentials", async () => {
+    for (
+      const [returnedOrigin, credentials] of [
+        ["https://例.example", false],
+        [" https://example.com", false],
+        ["https://example.com\r\nX-Injected: yes", false],
+        ["*", true],
+      ] as const
+    ) {
+      const result = await validateOrigin("https://request.example", {
+        origin: () => returnedOrigin,
+        credentials,
+      });
+
+      assertEquals(result.allowedOrigin, null);
+    }
+  });
 });
 
 describe("validateCORSConfig", () => {
@@ -243,7 +304,7 @@ describe("validateCORSConfig", () => {
       maxAge: -1,
     });
     assertEquals(result.valid, false);
-    assertEquals(result.error, "maxAge must be a positive number");
+    assertEquals(result.error, "maxAge must be a non-negative safe integer");
   });
 
   it("should accept zero maxAge", () => {
@@ -261,4 +322,209 @@ describe("validateCORSConfig", () => {
     });
     assertEquals(result.valid, true);
   });
+
+  it("should reject malformed method and header tokens", () => {
+    for (
+      const config of [
+        { origin: "https://example.com\r\nX-Injected: yes" },
+        { methods: ["GET, POST"] },
+        { methods: ["GET\nInjected"] },
+        { allowedHeaders: ["X Invalid"] },
+        { exposedHeaders: ["X-Valid\r\nInjected"] },
+      ]
+    ) {
+      assertEquals(validateCORSConfig(config).valid, false);
+    }
+
+    assertEquals(
+      validateOriginSync("a".repeat(MAX_CORS_ORIGIN_LENGTH + 1), true).allowedOrigin,
+      null,
+    );
+  });
+
+  it("should reject oversized CORS origins, lists, tokens, and aggregate header values", () => {
+    const tooManyTokens = Array.from(
+      { length: MAX_CORS_TOKEN_COUNT + 1 },
+      (_, index) => `X-${index}`,
+    );
+    const aggregateTokens = Array.from(
+      { length: 17 },
+      (_, index) => `${"X".repeat(MAX_CORS_TOKEN_LENGTH - 3)}${String(index).padStart(3, "0")}`,
+    );
+    const aggregateOrigins = Array.from(
+      { length: Math.min(MAX_CORS_ORIGIN_COUNT, 5) },
+      (_, index) => `${index}${"a".repeat(MAX_CORS_ORIGIN_LENGTH - 1)}`,
+    );
+
+    for (
+      const config of [
+        { origin: "a".repeat(MAX_CORS_ORIGIN_LENGTH + 1) },
+        { origin: aggregateOrigins },
+        { methods: ["M".repeat(MAX_CORS_TOKEN_LENGTH + 1)] },
+        { allowedHeaders: tooManyTokens },
+        { exposedHeaders: aggregateTokens },
+      ]
+    ) {
+      assertEquals(validateCORSConfig(config).valid, false);
+    }
+  });
+
+  it("should reject an oversized origin returned by a validator", async () => {
+    const result = await validateOrigin("https://request.example", {
+      origin: () => "a".repeat(MAX_CORS_ORIGIN_LENGTH + 1),
+    });
+
+    assertEquals(result.allowedOrigin, null);
+    assertEquals(result.error, "Origin validator returned an invalid or oversized origin");
+  });
+
+  it("should reject non-integer, non-finite, and unsafe maxAge values", () => {
+    for (const maxAge of [1.5, Number.NaN, Number.POSITIVE_INFINITY, Number.MAX_SAFE_INTEGER + 1]) {
+      assertEquals(
+        validateCORSConfig({ origin: "https://example.com", maxAge }).valid,
+        false,
+      );
+    }
+  });
+
+  it("should reject malformed runtime option shapes without throwing", () => {
+    for (
+      const config of [
+        null,
+        1,
+        [],
+        { origin: "" },
+        { origin: [] },
+        { origin: ["https://example.com", 1] },
+        { credentials: "true" },
+        { methods: "GET" },
+        { allowedHeaders: "Authorization" },
+        { exposedHeaders: {} },
+        { origin: "https://例.example" },
+        { origin: " https://example.com" },
+        { maxAge: "3600" },
+        { unknown: true },
+      ]
+    ) {
+      assertEquals(validateCORSConfig(config as never).valid, false);
+    }
+  });
+
+  it("rejects accessor-backed and inherited runtime options without invoking them", () => {
+    let getterCalls = 0;
+    const accessorConfig = Object.defineProperty({}, "origin", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return "*";
+      },
+    });
+    const inheritedConfig = Object.create({ origin: "*" });
+
+    assertEquals(validateCORSConfig(accessorConfig as never).valid, false);
+    assertEquals(validateCORSConfig(inheritedConfig as never).valid, false);
+    assertEquals(getterCalls, 0);
+  });
+
+  it("fails closed for revoked configuration and list proxies", () => {
+    const revokedConfig = Proxy.revocable({}, {});
+    const revokedOrigins = Proxy.revocable(["https://example.com"], {});
+    const revokedMethods = Proxy.revocable(["GET"], {});
+    revokedConfig.revoke();
+    revokedOrigins.revoke();
+    revokedMethods.revoke();
+
+    for (
+      const config of [
+        revokedConfig.proxy,
+        { origin: revokedOrigins.proxy },
+        { methods: revokedMethods.proxy },
+      ]
+    ) {
+      assertEquals(validateCORSConfig(config as never).valid, false);
+    }
+  });
+
+  it("uses a fixed bounded error for every unknown option name", () => {
+    for (
+      const key of [
+        "unknown\r\nX-Injected: yes",
+        "non-byte-\u{100}",
+        "x".repeat(100_000),
+      ]
+    ) {
+      const result = validateCORSConfig({ [key]: true } as never);
+      assertEquals(result, {
+        valid: false,
+        error: "configuration contains unknown options",
+      });
+    }
+  });
+
+  it("should reject malformed values through the public cors factory", () => {
+    assertThrows(
+      () => cors({ methods: ["GET, POST"] }),
+      Error,
+      "Invalid configuration",
+    );
+    assertThrows(
+      () => cors({ allowedHeaders: ["X Invalid"] }),
+      Error,
+      "Invalid configuration",
+    );
+    assertThrows(
+      () => cors({ maxAge: Number.NaN }),
+      Error,
+      "Invalid configuration",
+    );
+  });
+});
+
+Deno.test("CORS telemetry origins are bounded before tracing", () => {
+  assertEquals(corsOriginForTelemetry("https://example.com"), "https://example.com");
+  assertEquals(corsOriginForTelemetry(null), "null");
+  assertEquals(corsOriginForTelemetry("https://例.example"), "invalid");
+  assertEquals(
+    corsOriginForTelemetry("a".repeat(MAX_CORS_ORIGIN_LENGTH + 1)),
+    "invalid",
+  );
+  assertEquals(corsOriginForTelemetry({}), "invalid");
+});
+
+Deno.test("sync validation observes rejected Promises and thenables", async () => {
+  const validatorsUrl = new URL("./validators.ts", import.meta.url).href;
+  const source = `
+    import { validateOriginSync } from ${JSON.stringify(validatorsUrl)};
+
+    const validators = [
+      async () => {
+        throw new Error("expected Promise rejection");
+      },
+      () => ({
+        then(_resolve, reject) {
+          queueMicrotask(() => reject(new Error("expected thenable rejection")));
+        },
+      }),
+    ];
+    for (const origin of validators) {
+      const result = validateOriginSync("https://example.com", {
+        origin,
+      });
+      if (result.allowedOrigin !== null) {
+        throw new Error("async validator was not denied");
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  `;
+  const output = await new Deno.Command(Deno.execPath(), {
+    args: ["eval", "--frozen", "--config=deno.json", source],
+    stdout: "piped",
+    stderr: "piped",
+  }).output();
+
+  assertEquals(
+    output.success,
+    true,
+    new TextDecoder().decode(output.stderr),
+  );
 });
diff --git a/src/security/http/cors/validators.ts b/src/security/http/cors/validators.ts
index ccc1b9e546..e21856c480 100644
--- a/src/security/http/cors/validators.ts
+++ b/src/security/http/cors/validators.ts
@@ -1,61 +1,279 @@
-import type { CORSConfig, CORSValidationResult } from "./types.ts";
+import type { CORSConfig, CORSValidationResult, SyncCORSConfig } from "./types.ts";
 import { serverLogger } from "#veryfront/utils";
 import { recordCorsRejection } from "#veryfront/observability";
 import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
+import {
+  isBoundedCorsOrigin,
+  isBoundedCorsOriginList,
+  isBoundedCorsTokenList,
+  isValidCorsMaxAge,
+  MAX_CORS_ORIGIN_COUNT,
+  MAX_CORS_TOKEN_COUNT,
+} from "#veryfront/utils/cors-policy-limits.ts";
 
 const logger = serverLogger.component("cors");
 
-const NO_CORS_RESULT: CORSValidationResult = { allowedOrigin: null, allowCredentials: false };
+const CORS_CONFIG_KEYS = new Set([
+  "origin",
+  "credentials",
+  "methods",
+  "allowedHeaders",
+  "exposedHeaders",
+  "maxAge",
+]);
+
+export type NormalizedCORSConfig = boolean | CORSConfig;
+
+export type CORSConfigNormalizationResult =
+  | { valid: true; config: NormalizedCORSConfig }
+  | { valid: false; error: string };
+
+function corsResult(
+  allowedOrigin: string | null,
+  allowCredentials: boolean,
+  error?: string,
+): CORSValidationResult {
+  const result: CORSValidationResult = { allowedOrigin, allowCredentials };
+  if (error !== undefined) result.error = error;
+  return Object.freeze(result);
+}
+
+function denyCors(error?: string): CORSValidationResult {
+  return corsResult(null, false, error);
+}
+
+function invalidConfig(error: string): CORSConfigNormalizationResult {
+  return { valid: false, error };
+}
+
+/**
+ * Snapshot a short array without invoking iterators, indexed accessors, or
+ * proxy `get` traps. Every proxy-sensitive reflection operation is guarded so
+ * revoked and otherwise hostile proxies become a deterministic invalid value.
+ */
+export function snapshotCORSArray(
+  value: unknown,
+  maxLength: number,
+): unknown[] | null {
+  let array: boolean;
+  try {
+    array = Array.isArray(value);
+  } catch {
+    return null;
+  }
+  if (!array) return null;
+
+  try {
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    const length = lengthDescriptor && "value" in lengthDescriptor
+      ? lengthDescriptor.value
+      : undefined;
+    if (
+      typeof length !== "number" ||
+      !Number.isSafeInteger(length) ||
+      length < 0 ||
+      length > maxLength
+    ) {
+      return null;
+    }
+
+    const snapshot = new Array<unknown>(length);
+    for (let index = 0; index < length; index++) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (!descriptor || !("value" in descriptor)) return null;
+      snapshot[index] = descriptor.value;
+    }
+    return snapshot;
+  } catch {
+    return null;
+  }
+}
+
+function snapshotTokenList(
+  name: "methods" | "allowedHeaders" | "exposedHeaders",
+  value: unknown,
+): { valid: true; value: string[] | undefined } | { valid: false; error: string } {
+  if (value === undefined) return { valid: true, value: undefined };
+
+  const snapshot = snapshotCORSArray(value, MAX_CORS_TOKEN_COUNT);
+  if (!snapshot) return { valid: false, error: `${name} must be an array` };
+  if (snapshot.length === 0) {
+    return { valid: false, error: `${name} array cannot be empty` };
+  }
+  if (!isBoundedCorsTokenList(snapshot)) {
+    const description = name === "methods" ? "HTTP method tokens" : "HTTP header names";
+    return {
+      valid: false,
+      error: `${name} must contain bounded valid ${description}`,
+    };
+  }
+
+  const normalized = snapshot as string[];
+  Object.freeze(normalized);
+  return { valid: true, value: normalized };
+}
+
+/**
+ * Snapshot and validate an untrusted runtime CORS policy.
+ *
+ * The schema protects configuration loaded through the normal config path, but
+ * public response helpers can be called with arbitrary JavaScript values. This
+ * is the single runtime contract used by those boundaries.
+ */
+export function normalizeCORSConfig(config: unknown): CORSConfigNormalizationResult {
+  if (config === undefined || config === false) {
+    return { valid: true, config: false };
+  }
+  if (config === true) {
+    return { valid: true, config: true };
+  }
+  if (typeof config !== "object" || config === null) {
+    return invalidConfig("configuration must be a boolean or CORS options object");
+  }
+
+  let configIsArray: boolean;
+  let keys: (string | symbol)[];
+  const values: Partial<Record<keyof CORSConfig, unknown>> = {};
+  try {
+    configIsArray = Array.isArray(config);
+    if (configIsArray) {
+      return invalidConfig("configuration must be a boolean or CORS options object");
+    }
+    const prototype = Object.getPrototypeOf(config);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return invalidConfig("configuration must be a plain options object");
+    }
+    keys = Reflect.ownKeys(config);
+
+    for (const key of keys) {
+      if (typeof key !== "string" || !CORS_CONFIG_KEYS.has(key)) {
+        return invalidConfig("configuration contains unknown options");
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(config, key);
+      if (!descriptor || !("value" in descriptor)) {
+        return invalidConfig("configuration options must be own data properties");
+      }
+      values[key as keyof CORSConfig] = descriptor.value;
+    }
+  } catch {
+    return invalidConfig("configuration could not be inspected safely");
+  }
+
+  const valueOf = (key: keyof CORSConfig): unknown => values[key];
+  const normalized: CORSConfig = {};
+
+  const origin = valueOf("origin");
+  if (origin !== undefined) {
+    if (typeof origin === "string") {
+      if (!isBoundedCorsOrigin(origin)) {
+        return invalidConfig(
+          "origin must be a bounded header-safe string, string array, or validator",
+        );
+      }
+      normalized.origin = origin;
+    } else if (typeof origin === "function") {
+      normalized.origin = origin as NonNullable<CORSConfig["origin"]>;
+    } else {
+      const snapshot = snapshotCORSArray(origin, MAX_CORS_ORIGIN_COUNT);
+      if (!snapshot || !isBoundedCorsOriginList(snapshot)) {
+        return invalidConfig(
+          "origin must be a bounded header-safe string, string array, or validator",
+        );
+      }
+      const origins = snapshot as string[];
+      Object.freeze(origins);
+      normalized.origin = origins;
+    }
+  }
+
+  const credentials = valueOf("credentials");
+  if (credentials !== undefined) {
+    if (typeof credentials !== "boolean") {
+      return invalidConfig("credentials must be a boolean");
+    }
+    normalized.credentials = credentials;
+  }
+
+  for (const name of ["methods", "allowedHeaders", "exposedHeaders"] as const) {
+    const result = snapshotTokenList(name, valueOf(name));
+    if (!result.valid) return result;
+    if (result.value !== undefined) normalized[name] = result.value;
+  }
+
+  const maxAge = valueOf("maxAge");
+  if (maxAge !== undefined) {
+    if (!isValidCorsMaxAge(maxAge)) {
+      return invalidConfig("maxAge must be a non-negative safe integer");
+    }
+    normalized.maxAge = maxAge;
+  }
+
+  if (normalized.origin === "*" && normalized.credentials === true) {
+    return invalidConfig("Cannot use credentials with wildcard origin");
+  }
+
+  Object.freeze(normalized);
+  return { valid: true, config: normalized };
+}
 
-/** Early validation checks common to sync and async paths */
 function validateEarly(
-  requestOrigin: string | null,
-  config?: boolean | CORSConfig,
+  requestOrigin: unknown,
+  config: NormalizedCORSConfig,
 ): CORSValidationResult | null {
-  if (!config) return NO_CORS_RESULT;
+  if (config === false) return denyCors();
+
+  if (requestOrigin !== null && !isBoundedCorsOrigin(requestOrigin)) {
+    return denyCors("Invalid or oversized request origin");
+  }
 
   if (config === true) {
-    return { allowedOrigin: requestOrigin ?? "*", allowCredentials: false };
+    return corsResult(requestOrigin ?? "*", false);
   }
 
-  if (!config.origin) return NO_CORS_RESULT;
+  if (config.origin === undefined) return denyCors();
 
-  if (!requestOrigin) {
-    return config.origin === "*" ? { allowedOrigin: "*", allowCredentials: false } : NO_CORS_RESULT;
+  if (requestOrigin === null) {
+    return config.origin === "*" ? corsResult("*", false) : denyCors();
   }
 
   if (config.origin !== "*") return null;
 
   if (config.credentials) {
     logger.warn("Cannot use credentials with wildcard origin - denying");
-    return {
-      allowedOrigin: null,
-      allowCredentials: false,
-      error: "Cannot use credentials with wildcard origin",
-    };
+    return denyCors("Cannot use credentials with wildcard origin");
   }
 
-  return { allowedOrigin: "*", allowCredentials: false };
+  return corsResult("*", false);
 }
 
-function validateStaticOrigin(requestOrigin: string, corsConfig: CORSConfig): CORSValidationResult {
+function validateStaticOrigin(
+  requestOrigin: string,
+  corsConfig: CORSConfig,
+): CORSValidationResult {
   const credentials = corsConfig.credentials ?? false;
   const { origin } = corsConfig;
 
-  if (Array.isArray(origin)) {
-    const allowed = origin.includes(requestOrigin);
+  let originIsArray = false;
+  try {
+    originIsArray = Array.isArray(origin);
+  } catch {
+    return denyCors("Invalid origin configuration");
+  }
+
+  if (originIsArray) {
+    const origins = origin as string[];
+    const allowed = origins.includes(requestOrigin);
 
     if (!allowed) {
       recordCorsRejection();
-      // Log at debug level - this is expected in dev when CORS config doesn't match request origin
       logger.debug("Origin not in allowlist", { requestOrigin });
     }
 
-    return {
-      allowedOrigin: allowed ? requestOrigin : null,
-      allowCredentials: allowed && credentials,
-      error: allowed ? undefined : "Origin not in allowlist",
-    };
+    return corsResult(
+      allowed ? requestOrigin : null,
+      allowed && credentials,
+      allowed ? undefined : "Origin not in allowlist",
+    );
   }
 
   if (typeof origin === "string") {
@@ -63,73 +281,79 @@ function validateStaticOrigin(requestOrigin: string, corsConfig: CORSConfig): CO
 
     if (!allowed) {
       recordCorsRejection();
-      // Log at debug level - this is expected in dev when CORS config doesn't match request origin
       logger.debug("Origin does not match", { requestOrigin, expectedOrigin: origin });
     }
 
-    return {
-      allowedOrigin: allowed ? requestOrigin : null,
-      allowCredentials: allowed && credentials,
-      error: allowed ? undefined : "Origin does not match",
-    };
+    return corsResult(
+      allowed ? requestOrigin : null,
+      allowed && credentials,
+      allowed ? undefined : "Origin does not match",
+    );
   }
 
-  return { allowedOrigin: null, allowCredentials: false, error: "Invalid origin configuration" };
+  return denyCors("Invalid origin configuration");
 }
 
 function processFunctionResult(
-  result: string | boolean,
+  result: unknown,
   requestOrigin: string,
   credentials: boolean,
 ): CORSValidationResult {
   if (typeof result === "string") {
-    return { allowedOrigin: result, allowCredentials: credentials };
+    if (!isBoundedCorsOrigin(result) || (result === "*" && credentials)) {
+      return denyCors("Origin validator returned an invalid or oversized origin");
+    }
+    return corsResult(result, credentials && result !== "*");
+  }
+
+  if (typeof result !== "boolean") {
+    return denyCors("Origin validator returned an invalid result");
   }
 
-  const allowed = result === true;
+  return corsResult(
+    result ? requestOrigin : null,
+    result && credentials,
+    result ? undefined : "Origin rejected by validation function",
+  );
+}
 
-  return {
-    allowedOrigin: allowed ? requestOrigin : null,
-    allowCredentials: allowed && credentials,
-    error: allowed ? undefined : "Origin rejected by validation function",
-  };
+function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
+  if (
+    value === null ||
+    (typeof value !== "object" && typeof value !== "function")
+  ) {
+    return false;
+  }
+  return typeof Reflect.get(value, "then") === "function";
 }
 
-/** Validate origin against CORS configuration */
-export function validateOrigin(
-  requestOrigin: string | null,
-  config?: boolean | CORSConfig,
+export async function validateNormalizedOrigin(
+  requestOrigin: unknown,
+  config: NormalizedCORSConfig,
 ): Promise<CORSValidationResult> {
-  return withSpan(
-    "security.cors.validateOrigin",
-    async (): Promise<CORSValidationResult> => {
-      const earlyResult = validateEarly(requestOrigin, config);
-      if (earlyResult) return earlyResult;
-
-      const corsConfig = config as CORSConfig;
-      const origin = requestOrigin as string;
-      const credentials = corsConfig.credentials ?? false;
-
-      if (typeof corsConfig.origin === "function") {
-        try {
-          const result = await corsConfig.origin(origin);
-          return processFunctionResult(result, origin, credentials);
-        } catch (error) {
-          logger.error("Origin validation function error", error);
-          return { allowedOrigin: null, allowCredentials: false, error: "Origin validation error" };
-        }
-      }
+  const earlyResult = validateEarly(requestOrigin, config);
+  if (earlyResult) return earlyResult;
 
-      return validateStaticOrigin(origin, corsConfig);
-    },
-    { "cors.origin": requestOrigin ?? "null" },
-  );
+  const corsConfig = config as CORSConfig;
+  const origin = requestOrigin as string;
+  const credentials = corsConfig.credentials ?? false;
+
+  if (typeof corsConfig.origin === "function") {
+    try {
+      const result = await corsConfig.origin(origin);
+      return processFunctionResult(result, origin, credentials);
+    } catch (error) {
+      logger.error("Origin validation function error", error);
+      return denyCors("Origin validation error");
+    }
+  }
+
+  return validateStaticOrigin(origin, corsConfig);
 }
 
-/** Synchronous origin validation (async validators not supported) */
-export function validateOriginSync(
-  requestOrigin: string | null,
-  config?: boolean | CORSConfig,
+export function validateNormalizedOriginSync(
+  requestOrigin: unknown,
+  config: NormalizedCORSConfig,
 ): CORSValidationResult {
   const earlyResult = validateEarly(requestOrigin, config);
   if (earlyResult) return earlyResult;
@@ -144,48 +368,62 @@ export function validateOriginSync(
 
   try {
     const result = corsConfig.origin(origin);
-
-    if (result instanceof Promise) {
+    if (isPromiseLike(result)) {
+      // Synchronous APIs cannot use the value, but they still own the
+      // validator invocation. Observe a future rejection immediately so the
+      // fail-closed return cannot be followed by an unhandled rejection.
+      void Promise.resolve(result).catch(() => undefined);
       logger.warn("Async origin validators are not supported in synchronous contexts");
-      return {
-        allowedOrigin: null,
-        allowCredentials: false,
-        error: "Async origin validators not supported",
-      };
+      return denyCors("Async origin validators not supported");
     }
-
     return processFunctionResult(result, origin, credentials);
   } catch (error) {
     logger.error("Origin validation function error", error);
-    return { allowedOrigin: null, allowCredentials: false, error: "Origin validation error" };
+    return denyCors("Origin validation error");
   }
 }
 
-/** Validate CORS configuration for security issues */
-export function validateCORSConfig(
-  config?: boolean | CORSConfig,
-): { valid: boolean; error?: string } {
-  if (!config || config === true) return { valid: true };
-
-  if (config.origin === "*" && config.credentials) {
-    return { valid: false, error: "Cannot use credentials with wildcard origin (*)" };
-  }
-
-  if (config.methods?.length === 0) {
-    return { valid: false, error: "methods array cannot be empty" };
-  }
-
-  if (config.allowedHeaders?.length === 0) {
-    return { valid: false, error: "allowedHeaders array cannot be empty" };
-  }
+export function corsOriginForTelemetry(requestOrigin: unknown): string {
+  if (requestOrigin === null) return "null";
+  return isBoundedCorsOrigin(requestOrigin) ? requestOrigin : "invalid";
+}
 
-  if (config.exposedHeaders?.length === 0) {
-    return { valid: false, error: "exposedHeaders array cannot be empty" };
-  }
+/** Validate origin against CORS configuration. */
+export function validateOrigin(
+  requestOrigin: unknown,
+  config?: boolean | CORSConfig,
+): Promise<CORSValidationResult> {
+  return withSpan(
+    "security.cors.validateOrigin",
+    async (): Promise<CORSValidationResult> => {
+      const normalized = normalizeCORSConfig(config);
+      if (!normalized.valid) return denyCors(normalized.error);
+      return await validateNormalizedOrigin(requestOrigin, normalized.config);
+    },
+    { "cors.origin": corsOriginForTelemetry(requestOrigin) },
+  );
+}
 
-  if (config.maxAge !== undefined && config.maxAge < 0) {
-    return { valid: false, error: "maxAge must be a positive number" };
-  }
+/** Synchronous origin validation. Promise-returning values still fail closed at runtime. */
+export function validateOriginSync(
+  requestOrigin: unknown,
+  config?: boolean | SyncCORSConfig,
+): CORSValidationResult {
+  const normalized = normalizeCORSConfig(config);
+  if (!normalized.valid) return denyCors(normalized.error);
+  return validateNormalizedOriginSync(requestOrigin, normalized.config);
+}
 
-  return { valid: true };
+/** Validate CORS configuration for security issues. */
+export function validateCORSConfig(
+  config?: boolean | CORSConfig,
+): { valid: boolean; error?: string } {
+  const normalized = normalizeCORSConfig(config);
+  if (normalized.valid) return { valid: true };
+  return {
+    valid: false,
+    error: normalized.error === "Cannot use credentials with wildcard origin"
+      ? "Cannot use credentials with wildcard origin (*)"
+      : normalized.error,
+  };
 }
diff --git a/src/security/http/csrf/csrf-handler.test.ts b/src/security/http/csrf/csrf-handler.test.ts
index 91cb9ce04c..cf37d1fd7c 100644
--- a/src/security/http/csrf/csrf-handler.test.ts
+++ b/src/security/http/csrf/csrf-handler.test.ts
@@ -80,11 +80,12 @@ describe("security/http/csrf/csrf-handler", () => {
       assertEquals(result.continue, true);
     });
 
-    it("should exempt /_veryfront/log", async () => {
+    it("should protect /_veryfront/log", async () => {
       const ctx = createCtx(true);
       const req = new Request("http://localhost/_veryfront/log", { method: "POST" });
       const result = await handler.handle(req, ctx);
-      assertEquals(result.continue, true);
+      assertEquals(result.continue, false);
+      assertEquals(result.response?.status, 403);
     });
 
     it("should NOT exempt /_veryfront/log/subpath", async () => {
@@ -95,11 +96,12 @@ describe("security/http/csrf/csrf-handler", () => {
       assertEquals(result.response?.status, 403);
     });
 
-    it("should exempt /_veryfront/modules/ asset paths", async () => {
+    it("should protect unsafe methods even on internal asset paths", async () => {
       const ctx = createCtx(true);
       const req = new Request("http://localhost/_veryfront/modules/client.js", { method: "POST" });
       const result = await handler.handle(req, ctx);
-      assertEquals(result.continue, true);
+      assertEquals(result.continue, false);
+      assertEquals(result.response?.status, 403);
     });
 
     it("should NOT exempt /_veryfront/rsc/action (Server Actions need CSRF)", async () => {
@@ -118,6 +120,32 @@ describe("security/http/csrf/csrf-handler", () => {
       assertEquals(result.response?.status, 403);
     });
 
+    it("should apply the resolved CORS and security policy to rejections", async () => {
+      const ctx = createCtx(true);
+      ctx.securityConfig = {
+        csrf: true,
+        cors: {
+          origin: "https://client.example",
+          credentials: true,
+        },
+      };
+      const req = new Request("http://localhost/submit", {
+        method: "POST",
+        headers: { origin: "https://client.example" },
+      });
+
+      const result = await handler.handle(req, ctx);
+
+      assertEquals(result.response?.status, 403);
+      assertEquals(
+        result.response?.headers.get("Access-Control-Allow-Origin"),
+        "https://client.example",
+      );
+      assertEquals(result.response?.headers.get("Access-Control-Allow-Credentials"), "true");
+      assertEquals(result.response?.headers.get("X-Content-Type-Options"), "nosniff");
+      assertEquals(result.response?.headers.get("Cache-Control"), "no-store");
+    });
+
     it("should reject PUT without CSRF token", async () => {
       const ctx = createCtx(true);
       const req = new Request("http://localhost/resource", { method: "PUT" });
@@ -139,6 +167,14 @@ describe("security/http/csrf/csrf-handler", () => {
       assertEquals(result.response?.status, 403);
     });
 
+    it("should reject custom methods without CSRF token", async () => {
+      const ctx = createCtx(true);
+      const req = new Request("http://localhost/cache", { method: "PURGE" });
+      const result = await handler.handle(req, ctx);
+      assertEquals(result.continue, false);
+      assertEquals(result.response?.status, 403);
+    });
+
     it("should pass POST with valid CSRF token", async () => {
       const ctx = createCtx(true);
       const { token } = generateCsrfToken({ secure: false });
diff --git a/src/security/http/csrf/csrf-handler.ts b/src/security/http/csrf/csrf-handler.ts
index b3101213e7..0719c82aa1 100644
--- a/src/security/http/csrf/csrf-handler.ts
+++ b/src/security/http/csrf/csrf-handler.ts
@@ -1,8 +1,9 @@
 /**
  * CSRF Handler — validates CSRF tokens on state-changing requests.
  *
- * Reads config from `ctx.securityConfig?.csrf`. When enabled, POST/PUT/PATCH/DELETE
- * requests must include a valid CSRF token (cookie + header match).
+ * Reads config from `ctx.securityConfig?.csrf`. When enabled, every method
+ * except GET, HEAD, and OPTIONS must include a valid CSRF token (cookie +
+ * header match).
  *
  * ## Server Actions integration
  *
@@ -49,27 +50,7 @@ import type {
   HandlerResult,
 } from "#veryfront/types";
 
-const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-
-/** Internal /_veryfront/ directory prefixes that only ever serve static assets. */
-const CSRF_EXEMPT_PREFIXES = [
-  "/_veryfront/modules/",
-  "/_veryfront/lib/",
-  "/_veryfront/chunks/",
-];
-
-/**
- * Exact internal asset paths safe to exempt from CSRF. These are GET-only
- * static JS handlers (`exact: true` patterns). They were previously exempted by
- * the bare `/_veryfront/preview-hmr` / `/_veryfront/studio-bridge` prefixes,
- * which also matched any sibling path (e.g. `.../studio-bridge/submit`) and
- * would have left a future state-changing endpoint under that prefix
- * CSRF-unprotected. Matching the exact `.js` paths keeps the exemption tight.
- */
-const CSRF_EXEMPT_EXACT_PATHS = new Set([
-  "/_veryfront/preview-hmr.js",
-  "/_veryfront/studio-bridge.js",
-]);
+const CSRF_SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
 export class CsrfHandler extends BaseHandler {
   metadata: HandlerMetadata = {
@@ -86,20 +67,12 @@ export class CsrfHandler extends BaseHandler {
 
     const method = req.method.toUpperCase();
 
-    // Safe methods never need CSRF
-    if (!STATE_CHANGING_METHODS.has(method)) return this.continue();
+    // Unknown and extension methods fail closed. Only the explicitly safe HTTP
+    // methods bypass token validation.
+    if (CSRF_SAFE_METHODS.has(method)) return this.continue();
 
     const { pathname } = new URL(req.url);
 
-    // Only exempt internal asset/dev paths, NOT action endpoints
-    if (CSRF_EXEMPT_EXACT_PATHS.has(pathname)) return this.continue();
-    if (CSRF_EXEMPT_PREFIXES.some((p) => pathname.startsWith(p))) {
-      return this.continue();
-    }
-
-    // Internal log endpoint is safe to exempt (fire-and-forget client telemetry)
-    if (pathname === "/_veryfront/log") return this.continue();
-
     // Check exclude paths
     if (typeof csrfConfig === "object" && csrfConfig.excludePaths?.length) {
       for (const excludePath of csrfConfig.excludePaths) {
@@ -115,7 +88,11 @@ export class CsrfHandler extends BaseHandler {
 
     if (!validateCsrf(req, options)) {
       return this.respond(
-        new Response("Forbidden – invalid or missing CSRF token", { status: 403 }),
+        this.createResponseBuilder(ctx)
+          .withCORS(req, ctx.securityConfig?.cors)
+          .withSecurity(ctx.securityConfig ?? undefined, req)
+          .withCache("no-store")
+          .text("Forbidden – invalid or missing CSRF token", 403),
       );
     }
 
diff --git a/src/security/http/index.ts b/src/security/http/index.ts
index c96a843b78..44923d4a08 100644
--- a/src/security/http/index.ts
+++ b/src/security/http/index.ts
@@ -19,5 +19,4 @@ export type {
   CSPDirectives,
   SecurityConfig,
 } from "./middleware/index.ts";
-export { isValidSecurityConfig, loadSecurityConfig } from "./middleware/index.ts";
 export { setCors } from "./middleware/index.ts";
diff --git a/src/security/http/middleware/config-loader.test.ts b/src/security/http/middleware/config-loader.test.ts
deleted file mode 100644
index 91f172909f..0000000000
--- a/src/security/http/middleware/config-loader.test.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import "#veryfront/schemas/_test-setup.ts";
-import { describe, it } from "#veryfront/testing/bdd.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
-import { isValidSecurityConfig } from "./config-loader.ts";
-
-describe("security/http/middleware/config-loader", () => {
-  describe("isValidSecurityConfig", () => {
-    it("should return false for null/undefined", () => {
-      assertEquals(isValidSecurityConfig(null), false);
-      assertEquals(isValidSecurityConfig(undefined), false);
-    });
-
-    it("should return false for a non-object", () => {
-      assertEquals(isValidSecurityConfig("string"), false);
-      assertEquals(isValidSecurityConfig(123), false);
-      assertEquals(isValidSecurityConfig(true), false);
-    });
-
-    it("should return true for an empty object", () => {
-      assertEquals(isValidSecurityConfig({}), true);
-    });
-
-    it("should validate csp", () => {
-      assertEquals(
-        isValidSecurityConfig({ csp: { "default-src": "'self'" } }),
-        true,
-      );
-      assertEquals(isValidSecurityConfig({ csp: "invalid" }), false);
-      assertEquals(isValidSecurityConfig({ csp: null }), false);
-    });
-
-    it("should validate cors", () => {
-      assertEquals(isValidSecurityConfig({ cors: true }), true);
-      assertEquals(isValidSecurityConfig({ cors: false }), true);
-      assertEquals(isValidSecurityConfig({ cors: { origin: "*" } }), true);
-
-      assertEquals(isValidSecurityConfig({ cors: "invalid" }), false);
-      assertEquals(isValidSecurityConfig({ cors: 123 }), false);
-      assertEquals(isValidSecurityConfig({ cors: null }), false);
-    });
-
-    it("should validate coop", () => {
-      assertEquals(isValidSecurityConfig({ coop: "same-origin" }), true);
-      assertEquals(isValidSecurityConfig({ coop: 123 }), false);
-    });
-
-    it("should validate corp", () => {
-      assertEquals(isValidSecurityConfig({ corp: "same-origin" }), true);
-      assertEquals(isValidSecurityConfig({ corp: true }), false);
-    });
-
-    it("should validate coep", () => {
-      assertEquals(isValidSecurityConfig({ coep: "require-corp" }), true);
-      assertEquals(isValidSecurityConfig({ coep: [] }), false);
-    });
-
-    it("should return true for a full valid config", () => {
-      assertEquals(
-        isValidSecurityConfig({
-          cors: true,
-          csp: { "default-src": "'self'" },
-          coop: "same-origin",
-          corp: "same-origin",
-          coep: "require-corp",
-        }),
-        true,
-      );
-    });
-  });
-});
diff --git a/src/security/http/middleware/config-loader.ts b/src/security/http/middleware/config-loader.ts
deleted file mode 100644
index a246f9a5b6..0000000000
--- a/src/security/http/middleware/config-loader.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
-import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
-import { serverLogger } from "#veryfront/utils";
-import type { SecurityConfig } from "./types.ts";
-
-export function isValidSecurityConfig(config: unknown): config is SecurityConfig {
-  if (config == null || typeof config !== "object") return false;
-
-  const cfg = config as Record<string, unknown>;
-
-  if (cfg.csp !== undefined && (cfg.csp == null || typeof cfg.csp !== "object")) return false;
-
-  const cors = cfg.cors;
-  if (
-    cors !== undefined && typeof cors !== "boolean" && (cors == null || typeof cors !== "object")
-  ) {
-    return false;
-  }
-
-  const csrf = cfg.csrf;
-  if (
-    csrf !== undefined && typeof csrf !== "boolean" && (csrf == null || typeof csrf !== "object")
-  ) {
-    return false;
-  }
-
-  if (cfg.coop !== undefined && typeof cfg.coop !== "string") return false;
-  if (cfg.corp !== undefined && typeof cfg.corp !== "string") return false;
-  if (cfg.coep !== undefined && typeof cfg.coep !== "string") return false;
-
-  return true;
-}
-
-export function loadSecurityConfig(
-  projectDir: string,
-  adapter: RuntimeAdapter,
-): Promise<SecurityConfig | null> {
-  return withSpan(
-    "security.config.load",
-    async (): Promise<SecurityConfig | null> => {
-      try {
-        const { getConfig } = await import("#veryfront/config");
-        const cfg = await getConfig(projectDir, adapter);
-        const securityConfig = (cfg as Record<string, unknown>)?.security;
-
-        if (!securityConfig) return null;
-
-        if (!isValidSecurityConfig(securityConfig)) {
-          serverLogger.warn("Invalid security configuration structure, ignoring");
-          return null;
-        }
-
-        return securityConfig;
-      } catch (error) {
-        serverLogger.debug("Failed to load security config", { error });
-        return null;
-      }
-    },
-    { "security.projectDir": projectDir },
-  );
-}
diff --git a/src/security/http/middleware/index.ts b/src/security/http/middleware/index.ts
index 02df702d1a..81062053ce 100644
--- a/src/security/http/middleware/index.ts
+++ b/src/security/http/middleware/index.ts
@@ -12,5 +12,4 @@ export type {
   CSPDirectives,
   SecurityConfig,
 } from "./types.ts";
-export { isValidSecurityConfig, loadSecurityConfig } from "./config-loader.ts";
 export { setCors } from "./cors-handler.ts";
diff --git a/src/security/http/response/cache-handler.test.ts b/src/security/http/response/cache-handler.test.ts
index e6ddc068f2..c34a453382 100644
--- a/src/security/http/response/cache-handler.test.ts
+++ b/src/security/http/response/cache-handler.test.ts
@@ -1,6 +1,6 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { assert, assertEquals } from "#veryfront/testing/assert.ts";
+import { assert, assertEquals, assertThrows } from "#veryfront/testing/assert.ts";
 import { buildCacheControl } from "./cache-handler.ts";
 import { CACHE_DURATIONS } from "./constants.ts";
 
@@ -53,9 +53,8 @@ describe("security/http/response/cache-handler", () => {
         );
       });
 
-      it("should fallback for unknown string preset", () => {
-        // TypeScript wouldn't normally allow this but testing runtime behavior
-        assertEquals(buildCacheControl("unknown" as never), "public, max-age=0");
+      it("rejects unknown string presets", () => {
+        assertThrows(() => buildCacheControl("unknown" as never), TypeError);
       });
     });
 
@@ -105,6 +104,34 @@ describe("security/http/response/cache-handler", () => {
         assert(result.includes("immutable"));
         assert(result.includes("must-revalidate"));
       });
+
+      it("rejects malformed and accessor-backed cache options", () => {
+        for (
+          const strategy of [
+            { maxAge: -1 },
+            { maxAge: 1.5 },
+            { maxAge: Number.POSITIVE_INFINITY },
+            { maxAge: 60, staleWhileRevalidate: -1 },
+            { maxAge: 60, public: "yes" },
+            { maxAge: 60, unknown: true },
+            Object.create({ maxAge: 60 }),
+          ]
+        ) {
+          assertThrows(() => buildCacheControl(strategy as never), TypeError);
+        }
+
+        let getterCalls = 0;
+        const strategy = {} as Record<string, unknown>;
+        Object.defineProperty(strategy, "maxAge", {
+          enumerable: true,
+          get() {
+            getterCalls++;
+            return 60;
+          },
+        });
+        assertThrows(() => buildCacheControl(strategy as never), TypeError);
+        assertEquals(getterCalls, 0);
+      });
     });
   });
 });
diff --git a/src/security/http/response/cache-handler.ts b/src/security/http/response/cache-handler.ts
index 0bfcdbed9a..04bbdbf55c 100644
--- a/src/security/http/response/cache-handler.ts
+++ b/src/security/http/response/cache-handler.ts
@@ -1,37 +1,111 @@
 import { CACHE_DURATIONS } from "./constants.ts";
 import type { CacheStrategy } from "./types.ts";
 
-const CACHE_PRESETS: Record<string, string> = {
-  "no-cache": "no-cache, no-store, must-revalidate",
-  "no-store": "no-store",
-  short: `public, max-age=${CACHE_DURATIONS.SHORT}`,
-  medium: `public, max-age=${CACHE_DURATIONS.MEDIUM}`,
-  long: `public, max-age=${CACHE_DURATIONS.LONG}`,
-  immutable: `public, max-age=${CACHE_DURATIONS.LONG}, immutable`,
-  // "none" prevents all caching - used in development to avoid nonce mismatches
-  none: "no-cache, no-store, must-revalidate",
-};
+const CACHE_PRESETS = Object.freeze(
+  {
+    "no-cache": "no-cache, no-store, must-revalidate",
+    "no-store": "no-store",
+    short: `public, max-age=${CACHE_DURATIONS.SHORT}`,
+    medium: `public, max-age=${CACHE_DURATIONS.MEDIUM}`,
+    long: `public, max-age=${CACHE_DURATIONS.LONG}`,
+    immutable: `public, max-age=${CACHE_DURATIONS.LONG}, immutable`,
+    // "none" prevents all caching - used in development to avoid nonce mismatches
+    none: "no-cache, no-store, must-revalidate",
+  } satisfies Record<Extract<CacheStrategy, string>, string>,
+);
+
+const CACHE_OPTION_KEYS = new Set([
+  "maxAge",
+  "public",
+  "immutable",
+  "mustRevalidate",
+  "staleWhileRevalidate",
+]);
+
+interface NormalizedCacheOptions {
+  maxAge: number;
+  public?: boolean;
+  immutable?: boolean;
+  mustRevalidate?: boolean;
+  staleWhileRevalidate?: number;
+}
+
+function invalidCacheStrategy(): never {
+  throw new TypeError("Invalid cache strategy");
+}
+
+function isDeltaSeconds(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function snapshotCacheOptions(strategy: unknown): NormalizedCacheOptions {
+  if (typeof strategy !== "object" || strategy === null) return invalidCacheStrategy();
+
+  const values: Record<string, unknown> = Object.create(null);
+  try {
+    if (Array.isArray(strategy)) return invalidCacheStrategy();
+    const prototype = Object.getPrototypeOf(strategy);
+    if (prototype !== Object.prototype && prototype !== null) return invalidCacheStrategy();
+
+    for (const key of Reflect.ownKeys(strategy)) {
+      if (typeof key !== "string" || !CACHE_OPTION_KEYS.has(key)) {
+        return invalidCacheStrategy();
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(strategy, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) {
+        return invalidCacheStrategy();
+      }
+      values[key] = descriptor.value;
+    }
+  } catch {
+    return invalidCacheStrategy();
+  }
+
+  if (!isDeltaSeconds(values.maxAge)) return invalidCacheStrategy();
+  for (const key of ["public", "immutable", "mustRevalidate"] as const) {
+    if (values[key] !== undefined && typeof values[key] !== "boolean") {
+      return invalidCacheStrategy();
+    }
+  }
+  if (
+    values.staleWhileRevalidate !== undefined &&
+    !isDeltaSeconds(values.staleWhileRevalidate)
+  ) {
+    return invalidCacheStrategy();
+  }
+
+  return Object.freeze({
+    maxAge: values.maxAge,
+    public: values.public as boolean | undefined,
+    immutable: values.immutable as boolean | undefined,
+    mustRevalidate: values.mustRevalidate as boolean | undefined,
+    staleWhileRevalidate: values.staleWhileRevalidate as number | undefined,
+  });
+}
 
 export function buildCacheControl(strategy: CacheStrategy): string {
   if (typeof strategy === "string") {
-    return CACHE_PRESETS[strategy] ?? "public, max-age=0";
+    if (!Object.hasOwn(CACHE_PRESETS, strategy)) return invalidCacheStrategy();
+    return CACHE_PRESETS[strategy as keyof typeof CACHE_PRESETS];
   }
 
+  const options = snapshotCacheOptions(strategy);
+
   const parts: string[] = [
-    strategy.public !== false ? "public" : "private",
-    `max-age=${strategy.maxAge}`,
+    options.public !== false ? "public" : "private",
+    `max-age=${options.maxAge}`,
   ];
 
-  if (strategy.immutable) {
+  if (options.immutable) {
     parts.push("immutable");
   }
 
-  if (strategy.mustRevalidate) {
+  if (options.mustRevalidate) {
     parts.push("must-revalidate");
   }
 
-  if (typeof strategy.staleWhileRevalidate === "number") {
-    parts.push(`stale-while-revalidate=${strategy.staleWhileRevalidate}`);
+  if (options.staleWhileRevalidate !== undefined) {
+    parts.push(`stale-while-revalidate=${options.staleWhileRevalidate}`);
   }
 
   return parts.join(", ");
diff --git a/src/security/http/response/fluent-methods.ts b/src/security/http/response/fluent-methods.ts
index f20761a992..dacc0b28f4 100644
--- a/src/security/http/response/fluent-methods.ts
+++ b/src/security/http/response/fluent-methods.ts
@@ -6,7 +6,7 @@ import { applyCORSHeaders, applyCORSHeadersSync } from "../cors/index.ts";
 import { buildCacheControl } from "./cache-handler.ts";
 import { applySecurityHeaders } from "./security-handler.ts";
 import { applyCsrfCookie } from "../../csrf/helpers.ts";
-import type { CacheStrategy, CORSConfig, SecurityConfig } from "./types.ts";
+import type { CacheStrategy, SecurityConfig, SyncCORSConfig } from "./types.ts";
 
 export interface FluentMethodsContext {
   headers: Headers;
@@ -23,7 +23,7 @@ export interface FluentMethodsContext {
 export function withCORS<T extends FluentMethodsContext>(
   this: T,
   req: Request,
-  corsConfig?: boolean | CORSConfig,
+  corsConfig?: boolean | SyncCORSConfig,
 ): T {
   applyCORSHeadersSync({
     request: req,
diff --git a/src/security/http/response/security-handler.test.ts b/src/security/http/response/security-handler.test.ts
index f6a53e3f6a..9688749d10 100644
--- a/src/security/http/response/security-handler.test.ts
+++ b/src/security/http/response/security-handler.test.ts
@@ -7,6 +7,7 @@ import {
   buildCSP,
   generateNonce,
   getSecurityHeader,
+  SECURITY_POLICY_RESPONSE_HEADER_NAMES,
 } from "./security-handler.ts";
 import type { SecurityConfig } from "./types.ts";
 
@@ -279,60 +280,31 @@ describe("security/http/response/security-handler", () => {
       );
     });
 
-    it("default CSP should allow WebSocket connections for HMR", () => {
-      const connectSources = parseDirectiveSources(buildCSP(false, "nonce", null), "connect-src");
-      assert(connectSources.includes("wss:"), "should allow wss for WebSocket");
-      assert(connectSources.includes("https:"), "should allow https for fetch/XHR");
-    });
-
-    it("default CSP should allow Google Fonts", () => {
+    it("default CSP admits no remote hosts or broad network schemes", () => {
       const csp = buildCSP(false, "nonce", null);
-      const styleHosts = parseDirectiveRemoteHosts(csp, "style-src");
-      const fontHosts = parseDirectiveRemoteHosts(csp, "font-src");
-      assertEquals(
-        styleHosts.filter((host) => host === "fonts.googleapis.com"),
-        ["fonts.googleapis.com"],
-        "should allow Google Fonts styles",
-      );
-      assertEquals(
-        fontHosts.filter((host) => host === "fonts.gstatic.com"),
-        ["fonts.gstatic.com"],
-        "should allow Google Fonts files",
-      );
-    });
-
-    it("default CSP should allow jsdelivr CDN scripts", () => {
-      const scriptHosts = parseDirectiveRemoteHosts(buildCSP(false, "nonce", null), "script-src");
-      assertEquals(
-        scriptHosts.filter((host) => host === "cdn.jsdelivr.net"),
-        ["cdn.jsdelivr.net"],
-        "should allow jsdelivr for Scalar API docs, html2canvas, React UMD",
-      );
-    });
-
-    it("default CSP should allow esm.sh scripts for browser ESM hydration", () => {
-      const scriptHosts = parseDirectiveRemoteHosts(buildCSP(false, "nonce", null), "script-src");
-      assertEquals(
-        scriptHosts.filter((host) => host === "esm.sh"),
-        ["esm.sh"],
-        "should allow esm.sh for the pages-router/browser ESM hydration path",
-      );
-    });
-
-    it("default CSP should allow veryfront CDN styles and fonts", () => {
-      const csp = buildCSP(false, "nonce", null);
-      const styleHosts = parseDirectiveRemoteHosts(csp, "style-src");
-      const fontHosts = parseDirectiveRemoteHosts(csp, "font-src");
-      assertEquals(
-        styleHosts.filter((host) => host === "cdn.veryfront.com"),
-        ["cdn.veryfront.com"],
-        "veryfront CDN in style-src",
-      );
-      assertEquals(
-        fontHosts.filter((host) => host === "cdn.veryfront.com"),
-        ["cdn.veryfront.com"],
-        "veryfront CDN in font-src",
-      );
+      for (
+        const directive of [
+          "default-src",
+          "script-src",
+          "style-src",
+          "style-src-elem",
+          "img-src",
+          "font-src",
+          "connect-src",
+          "media-src",
+          "worker-src",
+          "frame-src",
+        ]
+      ) {
+        assertEquals(
+          parseDirectiveRemoteHosts(csp, directive),
+          [],
+          `${directive} must not hardcode a remote host`,
+        );
+      }
+      assertEquals(parseDirectiveSources(csp, "connect-src"), ["'self'"]);
+      assertEquals(parseDirectiveSources(csp, "img-src"), ["'self'", "data:"]);
+      assertEquals(parseDirectiveSources(csp, "font-src"), ["'self'", "data:"]);
     });
 
     it("default CSP should allow same-origin frames", () => {
@@ -363,7 +335,7 @@ describe("security/http/response/security-handler", () => {
       );
     });
 
-    it("default CSP should allow Video.js stylesheet, style elements, blob workers, and blob media", () => {
+    it("default CSP should allow inline style elements, blob workers, and blob media", () => {
       const csp = buildCSP(false, "my-nonce", null);
       const styleElemSources = parseDirectiveSources(
         csp,
@@ -371,10 +343,6 @@ describe("security/http/response/security-handler", () => {
       );
       const mediaSources = parseDirectiveSources(csp, "media-src");
       const workerSources = parseDirectiveSources(csp, "worker-src");
-      const remoteStyleElemHosts = parseDirectiveRemoteHosts(
-        csp,
-        "style-src-elem",
-      );
       assert(
         styleElemSources.includes("'unsafe-inline'"),
         "style-src-elem should allow runtime-created style tags",
@@ -383,11 +351,7 @@ describe("security/http/response/security-handler", () => {
         !styleElemSources.some((source) => source.startsWith("'nonce-")),
         "style-src-elem should not mix a nonce with unsafe-inline because browsers ignore unsafe-inline when nonce/hash sources are present",
       );
-      assertEquals(
-        remoteStyleElemHosts,
-        ["cdn.veryfront.com", "fonts.googleapis.com", "vjs.zencdn.net"],
-        "style-src-elem should allow Google Fonts, Veryfront CDN, and the Video.js stylesheet CDN",
-      );
+      assertEquals(styleElemSources, ["'self'", "'unsafe-inline'"]);
       assert(
         mediaSources.includes("blob:"),
         "media-src should allow blob media URLs generated by browser media pipelines",
@@ -415,38 +379,6 @@ describe("security/http/response/security-handler", () => {
       );
     });
 
-    it("default CSP should place jsdelivr in script-src not style-src", () => {
-      const csp = buildCSP(false, "nonce", null);
-      const scriptHosts = parseDirectiveRemoteHosts(csp, "script-src");
-      const styleHosts = parseDirectiveRemoteHosts(csp, "style-src");
-      assertEquals(
-        scriptHosts.filter((host) => host === "cdn.jsdelivr.net"),
-        ["cdn.jsdelivr.net"],
-        "jsdelivr should be in script-src",
-      );
-      assertEquals(
-        styleHosts.filter((host) => host === "cdn.jsdelivr.net"),
-        [],
-        "jsdelivr should NOT be in style-src",
-      );
-    });
-
-    it("default CSP should place esm.sh in script-src not style-src", () => {
-      const csp = buildCSP(false, "nonce", null);
-      const scriptHosts = parseDirectiveRemoteHosts(csp, "script-src");
-      const styleHosts = parseDirectiveRemoteHosts(csp, "style-src");
-      assertEquals(
-        scriptHosts.filter((host) => host === "esm.sh"),
-        ["esm.sh"],
-        "esm.sh should be in script-src",
-      );
-      assertEquals(
-        styleHosts.filter((host) => host === "esm.sh"),
-        [],
-        "esm.sh should NOT be in style-src",
-      );
-    });
-
     it("default CSP should keep the nonce on script-src but not on style-src", () => {
       const csp = buildCSP(false, "unique-nonce-123", null);
       const scriptSources = parseDirectiveSources(csp, "script-src");
@@ -461,11 +393,6 @@ describe("security/http/response/security-handler", () => {
       );
     });
 
-    it("default CSP should block http: in connect-src", () => {
-      const connectSources = parseDirectiveSources(buildCSP(false, "nonce", null), "connect-src");
-      assert(!connectSources.includes("http:"), "connect-src must not allow plain http");
-    });
-
     it("default CSP should not include unsafe-eval", () => {
       const result = buildCSP(false, "n", null);
       assert(!result.includes("unsafe-eval"), "default CSP must not allow eval");
@@ -505,14 +432,25 @@ describe("security/http/response/security-handler", () => {
   });
 
   describe("applySecurityHeaders", () => {
+    it("keeps the canonical policy-owned header list aligned with production output", () => {
+      const headers = applyHeaders({
+        adapter: createMockAdapter({ VERYFRONT_COEP: "require-corp" }),
+      });
+
+      assertEquals(
+        [...headers.keys()].sort(),
+        [...SECURITY_POLICY_RESPONSE_HEADER_NAMES].sort(),
+      );
+    });
+
     it("should set X-Content-Type-Options", () => {
       const headers = applyHeaders();
       assertEquals(headers.get("X-Content-Type-Options"), "nosniff");
     });
 
-    it("should set X-XSS-Protection", () => {
+    it("should disable the obsolete XSS auditor", () => {
       const headers = applyHeaders();
-      assertEquals(headers.get("X-XSS-Protection"), "1; mode=block");
+      assertEquals(headers.get("X-XSS-Protection"), "0");
     });
 
     it("should set X-Frame-Options to DENY in production", () => {
@@ -614,6 +552,30 @@ describe("security/http/response/security-handler", () => {
       assertEquals(headers.get("X-Custom-Header"), "custom-value");
     });
 
+    it("keeps Access-Control-* headers authoritative to the CORS policy layer", () => {
+      const config: SecurityConfig = {
+        headers: {
+          "X-Custom-Header": "custom-value",
+          "Access-Control-Allow-Origin": "*",
+          "aCcEsS-CoNtRoL-AlLoW-CrEdEnTiAlS": "true",
+          "Access-Control-Future-Policy": "unsafe",
+        },
+      };
+      const headers = new Headers({
+        "Access-Control-Allow-Origin": "https://policy.example",
+      });
+
+      applySecurityHeaders(headers, false, "nonce", null, config);
+
+      assertEquals(headers.get("X-Custom-Header"), "custom-value");
+      assertEquals(
+        headers.get("Access-Control-Allow-Origin"),
+        "https://policy.example",
+      );
+      assertEquals(headers.get("Access-Control-Allow-Credentials"), null);
+      assertEquals(headers.get("Access-Control-Future-Policy"), null);
+    });
+
     it("should allow overriding security headers via config.headers", () => {
       const config: SecurityConfig = {
         headers: {
diff --git a/src/security/http/response/security-handler.ts b/src/security/http/response/security-handler.ts
index f6ccf045d4..5d1aeeff2e 100644
--- a/src/security/http/response/security-handler.ts
+++ b/src/security/http/response/security-handler.ts
@@ -1,8 +1,40 @@
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { recordSecurityHeaders } from "#veryfront/observability";
 import { HOSTED_STUDIO_ORIGINS } from "#veryfront/security/http/studio-origin-policy.ts";
+import { isCorsPolicyResponseHeaderName } from "#veryfront/utils/cors-policy-limits.ts";
+import { serverLogger } from "#veryfront/utils/logger/logger.ts";
 import type { SecurityConfig } from "./types.ts";
 
+const logger = serverLogger.component("security-headers");
+const warnedReservedCorsHeaderConfigs = new WeakSet<object>();
+
+/**
+ * Response headers whose values and omissions are owned by the centralized
+ * security policy. Server integrations must remove project-provided values
+ * before applying policy so development omissions remain authoritative.
+ */
+export const SECURITY_POLICY_RESPONSE_HEADER_NAMES = Object.freeze(
+  [
+    "content-security-policy",
+    "cross-origin-embedder-policy",
+    "cross-origin-opener-policy",
+    "cross-origin-resource-policy",
+    "referrer-policy",
+    "strict-transport-security",
+    "x-content-type-options",
+    "x-frame-options",
+    "x-xss-protection",
+  ] as const,
+);
+
+const SECURITY_POLICY_RESPONSE_HEADER_NAME_SET: ReadonlySet<string> = new Set(
+  SECURITY_POLICY_RESPONSE_HEADER_NAMES,
+);
+
+export function isSecurityPolicyResponseHeaderName(name: string): boolean {
+  return SECURITY_POLICY_RESPONSE_HEADER_NAME_SET.has(name.toLowerCase());
+}
+
 /** HSTS max-age default: 1 year in seconds */
 const HSTS_MAX_AGE_SECONDS = 31_536_000;
 
@@ -31,30 +63,24 @@ export function generateNonce(): string {
 const VERYFRONT_FRAME_ANCESTORS = ["'self'", ...HOSTED_STUDIO_ORIGINS];
 
 /**
- * Build a default CSP that works for typical veryfront apps.
+ * Build the dependency-free core production CSP.
  *
- * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
- *   html2canvas, legacy/browser ESM hydration)
- * - Styles:
- *   - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
- *     + Video.js CDN so React style="" attributes, framework inline styles,
- *     and common media-player stylesheets remain compatible. Do not include a
- *     nonce in style directives here: browsers ignore 'unsafe-inline' when a
- *     nonce/hash is present, which breaks runtime-created style attributes and
- *     style elements.
- *   - style-src-elem: 'unsafe-inline' + Google Fonts + cdn.veryfront.com +
- *     Video.js CDN for runtime-created <style> tags and stylesheet elements
+ * - Scripts: same-origin and nonce-authorized scripts only
+ * - Styles: same-origin plus inline styles required by framework components.
+ *   Do not include a nonce in style directives here: browsers ignore
+ *   'unsafe-inline' when a nonce/hash is present, which breaks runtime-created
+ *   style attributes and style elements.
  *   - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
  *     style attribute support
- * - Images/fonts: 'self' + data: + https: + cdn.veryfront.com
- * - Media: 'self' + https: + blob: where browser media pipelines require
- *   object URLs
+ * - Images/fonts: same-origin plus inline data resources
+ * - Media: same-origin plus blob URLs used by browser media pipelines
  * - Workers: 'self' + blob: for browser libraries that create blob workers
- * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
+ * - Connections: same-origin only. Development skips this default, so HMR is
+ *   not widened into the production policy.
  * - Objects: 'none' (block Flash/plugins)
  * - Frames: 'self' (allows same-origin iframes; apps embedding external
- *   content like YouTube or OAuth popups should add those origins via
- *   security.csp.frameSrc in veryfront.config.ts)
+ *   content must add those origins through an extension or explicit project
+ *   `security.csp.frameSrc` configuration)
  * - Frame-ancestors: `'none'` for customer apps, or a Studio allowlist for
  *   veryfront-managed deployments. Supersedes X-Frame-Options in modern
  *   browsers and provides clickjacking protection even when X-Frame-Options
@@ -68,14 +94,14 @@ function buildDefaultCSP(nonce: string, isVeryfrontDomain: boolean): string {
 
   return [
     `default-src 'self'`,
-    `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
-    `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com https://vjs.zencdn.net`,
-    `style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com https://vjs.zencdn.net`,
+    `script-src 'self' 'nonce-${nonce}'`,
+    `style-src 'self' 'unsafe-inline'`,
+    `style-src-elem 'self' 'unsafe-inline'`,
     `style-src-attr 'unsafe-inline'`,
-    `img-src 'self' data: https:`,
-    `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,
-    `connect-src 'self' wss: https:`,
-    `media-src 'self' https: blob:`,
+    `img-src 'self' data:`,
+    `font-src 'self' data:`,
+    `connect-src 'self'`,
+    `media-src 'self' blob:`,
     `worker-src 'self' blob:`,
     `object-src 'none'`,
     `frame-src 'self'`,
@@ -179,7 +205,9 @@ export function applySecurityHeaders(
     headers.set("X-Frame-Options", getHeaderOverride("x-frame-options") ?? "DENY");
   }
 
-  headers.set("X-XSS-Protection", getHeaderOverride("x-xss-protection") ?? "1; mode=block");
+  // Disable obsolete browser XSS auditors. Legacy filtering could mutate a
+  // safe response into an exploitable one; CSP is the active script policy.
+  headers.set("X-XSS-Protection", getHeaderOverride("x-xss-protection") ?? "0");
 
   const csp = buildCSP(isDev, nonce, cspUserHeader, config, adapter, isVeryfrontDomain);
   if (csp) headers.set("Content-Security-Policy", csp);
@@ -214,10 +242,24 @@ export function applySecurityHeaders(
 
   const extraHeaders = config?.headers;
   if (extraHeaders) {
+    let ignoredCorsPolicyHeader = false;
     for (const [key, value] of Object.entries(extraHeaders)) {
       if (value === undefined) continue;
+      if (isCorsPolicyResponseHeaderName(key)) {
+        ignoredCorsPolicyHeader = true;
+        continue;
+      }
       headers.set(key, value);
     }
+    if (
+      ignoredCorsPolicyHeader &&
+      !warnedReservedCorsHeaderConfigs.has(extraHeaders)
+    ) {
+      warnedReservedCorsHeaderConfigs.add(extraHeaders);
+      logger.warn(
+        "Ignored reserved Access-Control-* entries in security.headers; configure security.cors instead",
+      );
+    }
   }
 
   recordSecurityHeaders();
diff --git a/src/security/http/response/static-helpers.test.ts b/src/security/http/response/static-helpers.test.ts
new file mode 100644
index 0000000000..766e068c67
--- /dev/null
+++ b/src/security/http/response/static-helpers.test.ts
@@ -0,0 +1,132 @@
+import "#veryfront/schemas/_test-setup.ts";
+import { assertEquals } from "#veryfront/testing/assert.ts";
+import { describe, it } from "#veryfront/testing/bdd.ts";
+import { ResponseBuilder } from "./builder.ts";
+import { MAX_CORS_TOKEN_LENGTH } from "#veryfront/utils/cors-policy-limits.ts";
+import { DEFAULT_METHODS } from "../cors/constants.ts";
+
+describe("security/http/response/static-helpers", () => {
+  it("emits the effective configured CORS max age on an allowed preflight", () => {
+    const origin = "https://app.example.com";
+    const response = ResponseBuilder.preflight(
+      new Request("https://project.example.com/api/items", {
+        method: "OPTIONS",
+        headers: {
+          origin,
+          "access-control-request-method": "GET",
+        },
+      }),
+      {
+        corsConfig: {
+          origin,
+          maxAge: 7,
+        },
+      },
+    );
+
+    assertEquals(response.status, 204);
+    assertEquals(response.headers.get("access-control-allow-origin"), origin);
+    assertEquals(response.headers.get("access-control-max-age"), "7");
+  });
+
+  it("does not emit an oversized runtime method capability", () => {
+    const origin = "https://app.example.com";
+    const response = ResponseBuilder.preflight(
+      new Request("https://project.example.com/api/items", {
+        method: "OPTIONS",
+        headers: {
+          origin,
+          "access-control-request-method": "GET",
+        },
+      }),
+      {
+        allowMethods: ["M".repeat(MAX_CORS_TOKEN_LENGTH + 1)],
+        corsConfig: { origin },
+      },
+    );
+
+    assertEquals(response.status, 204);
+    assertEquals(response.headers.get("allow"), null);
+    assertEquals(response.headers.get("access-control-allow-methods"), null);
+  });
+
+  it("fails malformed CORS configuration closed without emitting max age", () => {
+    const origin = "https://app.example.com";
+
+    for (
+      const corsConfig of [
+        { origin, maxAge: Number.NaN },
+        { origin, maxAge: Number.POSITIVE_INFINITY },
+        { origin, maxAge: -1 },
+        { origin, maxAge: Number.MAX_SAFE_INTEGER + 1 },
+        { origin, credentials: "true" },
+        { origin, unknown: true },
+      ]
+    ) {
+      const response = ResponseBuilder.preflight(
+        new Request("https://project.example.com/api/items", {
+          method: "OPTIONS",
+          headers: {
+            origin,
+            "access-control-request-method": "GET",
+          },
+        }),
+        { corsConfig: corsConfig as never },
+      );
+
+      assertEquals(response.headers.get("access-control-allow-origin"), null);
+      assertEquals(response.headers.get("access-control-allow-methods"), null);
+      assertEquals(response.headers.get("access-control-allow-headers"), null);
+      assertEquals(response.headers.get("access-control-max-age"), null);
+    }
+  });
+
+  it("never emits max age for a denied origin", () => {
+    const response = ResponseBuilder.preflight(
+      new Request("https://project.example.com/api/items", {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://denied.example.com",
+          "access-control-request-method": "GET",
+        },
+      }),
+      {
+        corsConfig: {
+          origin: "https://allowed.example.com",
+          maxAge: 7,
+        },
+      },
+    );
+
+    assertEquals(response.headers.get("access-control-allow-origin"), null);
+    assertEquals(response.headers.get("access-control-max-age"), null);
+  });
+
+  it("scrubs all CORS policy headers on disabled, denied, and malformed preflights", () => {
+    const request = new Request("https://project.example.com/api/items", {
+      method: "OPTIONS",
+      headers: {
+        origin: "https://denied.example.com",
+        "access-control-request-method": "GET",
+        "access-control-request-headers": "Authorization",
+      },
+    });
+
+    for (
+      const corsConfig of [
+        false,
+        { origin: "https://allowed.example.com" },
+        { origin: "https://denied.example.com", unknown: true },
+      ]
+    ) {
+      const response = ResponseBuilder.preflight(request, {
+        corsConfig: corsConfig as never,
+      });
+
+      assertEquals(response.headers.get("Allow"), DEFAULT_METHODS.join(", "));
+      for (const [name] of response.headers) {
+        assertEquals(name.toLowerCase().startsWith("access-control-"), false);
+      }
+    }
+  });
+});
diff --git a/src/security/http/response/static-helpers.ts b/src/security/http/response/static-helpers.ts
index f63d4fc47f..3f39d899f2 100644
--- a/src/security/http/response/static-helpers.ts
+++ b/src/security/http/response/static-helpers.ts
@@ -1,18 +1,24 @@
 import { CONTENT_TYPES } from "./constants.ts";
-import type { CacheStrategy, CORSConfig, SecurityConfig } from "./types.ts";
+import type { CacheStrategy, SecurityConfig, SyncCORSConfig } from "./types.ts";
 import { createError, toError } from "#veryfront/errors";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
+import { DEFAULT_MAX_AGE, getDefaultCORSMethods } from "../cors/constants.ts";
+import { scrubPolicyOwnedCORSHeaders } from "../cors/headers.ts";
+import { normalizeCORSPreflightList, resolveCORSPreflightPolicy } from "../cors/preflight.ts";
+import { normalizeCORSConfig } from "../cors/validators.ts";
 
 type ResponseBuilderConstructor = new (config?: {
   securityConfig?: SecurityConfig | null;
   isDev?: boolean;
   cspUserHeader?: string | null;
   adapter?: import("#veryfront/platform/adapters/base.ts").RuntimeAdapter;
+  isVeryfrontDomain?: boolean;
 }) => ResponseBuilderInstance;
 
 interface ResponseBuilderInstance {
   headers: Headers;
   status: number;
-  withCORS(req: Request, corsConfig?: boolean | CORSConfig): ResponseBuilderInstance;
+  withCORS(req: Request, corsConfig?: boolean | SyncCORSConfig): ResponseBuilderInstance;
   withSecurity(config?: SecurityConfig, req?: Request): ResponseBuilderInstance;
   withCache(strategy: CacheStrategy): ResponseBuilderInstance;
   withETag(etag: string): ResponseBuilderInstance;
@@ -35,7 +41,11 @@ function createBuilder(
   req: Request,
   config?: {
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
+    isDev?: boolean;
+    cspUserHeader?: string | null;
+    adapter?: RuntimeAdapter;
+    isVeryfrontDomain?: boolean;
     cache?: CacheStrategy;
     etag?: string;
   },
@@ -69,7 +79,7 @@ export function error(
   req: Request,
   config?: {
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
     contentType?: string;
   },
 ): Response {
@@ -88,7 +98,7 @@ export function json(
   config?: {
     status?: number;
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
     cache?: CacheStrategy;
     etag?: string;
   },
@@ -102,7 +112,7 @@ export function html(
   config?: {
     status?: number;
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
     cache?: CacheStrategy;
     etag?: string;
   },
@@ -116,20 +126,58 @@ export function preflight(
     allowMethods?: string | string[];
     allowHeaders?: string | string[];
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
+    isDev?: boolean;
+    cspUserHeader?: string | null;
+    adapter?: RuntimeAdapter;
+    isVeryfrontDomain?: boolean;
   },
 ): Response {
+  const effectiveCorsConfig = config?.corsConfig ?? config?.securityConfig?.cors;
+  const normalizedCorsConfig = normalizeCORSConfig(effectiveCorsConfig);
   const builder = createBuilder(req, config);
 
-  builder.withAllow(config?.allowMethods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+  const runtimeMethods = config?.allowMethods ?? getDefaultCORSMethods().join(", ");
+  const normalizedRuntimeMethods = normalizeCORSPreflightList(runtimeMethods);
+  if (normalizedRuntimeMethods?.length) {
+    builder.withAllow(normalizedRuntimeMethods);
+  } else {
+    builder.headers.delete("Allow");
+    builder.headers.delete("Access-Control-Allow-Methods");
+  }
+
+  if (!normalizedCorsConfig.valid) {
+    scrubPolicyOwnedCORSHeaders(builder.headers);
+    return builder.build(null, 204);
+  }
 
-  const headers = config?.allowHeaders ??
-    req.headers.get("access-control-request-headers") ??
-    "Content-Type,Authorization";
+  const policy = resolveCORSPreflightPolicy({
+    config: normalizedCorsConfig.config,
+    allowMethods: runtimeMethods,
+    allowHeaders: config?.allowHeaders,
+    requestedHeaders: req.headers.get("access-control-request-headers"),
+  });
+  if (policy.methods) {
+    builder.headers.set("Access-Control-Allow-Methods", policy.methods);
+  } else {
+    builder.headers.delete("Access-Control-Allow-Methods");
+  }
+  if (policy.headers) {
+    builder.headers.set("Access-Control-Allow-Headers", policy.headers);
+  } else {
+    builder.headers.delete("Access-Control-Allow-Headers");
+  }
+  if (!builder.headers.has("Access-Control-Allow-Origin")) {
+    scrubPolicyOwnedCORSHeaders(builder.headers);
+    return builder.build(null, 204);
+  }
 
+  const normalizedOptions = typeof normalizedCorsConfig.config === "object"
+    ? normalizedCorsConfig.config
+    : null;
   builder.headers.set(
-    "Access-Control-Allow-Headers",
-    Array.isArray(headers) ? headers.join(", ") : headers,
+    "Access-Control-Max-Age",
+    String(normalizedOptions?.maxAge ?? DEFAULT_MAX_AGE),
   );
 
   return builder.build(null, 204);
@@ -141,7 +189,7 @@ export function stream(
   config?: {
     contentType?: string;
     securityConfig?: SecurityConfig | null;
-    corsConfig?: boolean | CORSConfig;
+    corsConfig?: boolean | SyncCORSConfig;
     cache?: CacheStrategy;
   },
 ): Response {
diff --git a/src/security/http/response/types.test.ts b/src/security/http/response/types.test.ts
new file mode 100644
index 0000000000..24cff019d0
--- /dev/null
+++ b/src/security/http/response/types.test.ts
@@ -0,0 +1,37 @@
+import { assertEquals } from "#veryfront/testing/assert.ts";
+import type { CORSConfig } from "./types.ts";
+import { applyCORSHeadersSync, validateOriginSync } from "#veryfront/security/http/cors/index.ts";
+
+function acceptsSynchronousResponseCors(config: boolean | CORSConfig): boolean {
+  return Boolean(config);
+}
+
+Deno.test("response CORSConfig preserves async origin-validator source compatibility", () => {
+  assertEquals(
+    acceptsSynchronousResponseCors({
+      origin: (origin) => origin === "https://example.com",
+    }),
+    true,
+  );
+
+  assertEquals(
+    acceptsSynchronousResponseCors({ origin: async () => true }),
+    true,
+  );
+});
+
+Deno.test("synchronous CORS helper signatures reject async origin validators", () => {
+  type SyncHeaderConfig = NonNullable<
+    Parameters<typeof applyCORSHeadersSync>[0]["config"]
+  >;
+  type SyncValidationConfig = NonNullable<Parameters<typeof validateOriginSync>[1]>;
+
+  const headerAcceptsAsync: { origin: () => Promise<boolean> } extends SyncHeaderConfig ? true
+    : false = false;
+  const validatorAcceptsAsync: { origin: () => Promise<boolean> } extends SyncValidationConfig
+    ? true
+    : false = false;
+
+  assertEquals(headerAcceptsAsync, false);
+  assertEquals(validatorAcceptsAsync, false);
+});
diff --git a/src/security/http/response/types.ts b/src/security/http/response/types.ts
index 7cf5fa19a2..747c06e19c 100644
--- a/src/security/http/response/types.ts
+++ b/src/security/http/response/types.ts
@@ -3,7 +3,7 @@
  * Type definitions for response construction
  */
 
-export type { CORSConfig } from "../cors/index.ts";
+export type { CORSConfig, SyncCORSConfig } from "../cors/index.ts";
 
 import type { SecurityConfig } from "#veryfront/types";
 export type { SecurityConfig } from "#veryfront/types";
@@ -30,5 +30,6 @@ export interface ResponseBuilderConfig {
   cspUserHeader?: string | null;
   adapter?: import("#veryfront/platform/adapters/base.ts").RuntimeAdapter;
   nonce?: string; // Optional pre-generated nonce for CSP consistency
-  isVeryfrontDomain?: boolean; // When true, skips X-Frame-Options to allow iframe embedding
+  /** Select the explicit hosted-Studio `frame-ancestors` allowlist. */
+  isVeryfrontDomain?: boolean;
 }
diff --git a/src/security/index.test.ts b/src/security/index.test.ts
index 8a376c94a4..2ca174ef8b 100644
--- a/src/security/index.test.ts
+++ b/src/security/index.test.ts
@@ -3,14 +3,95 @@ import { assertEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import * as securityModule from "./index.ts";
 import { AuthHandler } from "./http/auth.ts";
-import { SecurityConfigLoader } from "./http/config.ts";
-import { loadSecurityConfig, setCors } from "./http/middleware/index.ts";
+import { isValidSecurityConfig, loadSecurityConfig, SecurityConfigLoader } from "./http/config.ts";
+import { setCors } from "./http/middleware/index.ts";
+import { validatePathSync } from "./path-validation.ts";
 
 describe("security/index.ts exports", () => {
+  it("is available through the public package security subpath", async () => {
+    const denoConfig = JSON.parse(
+      await Deno.readTextFile(new URL("../../deno.json", import.meta.url)),
+    ) as { exports?: Record<string, string> };
+
+    assertEquals(denoConfig.exports?.["./security"], "./src/security/index.ts");
+
+    const publicSecurityModule = await import("veryfront/security");
+    assertEquals(publicSecurityModule.AuthHandler, AuthHandler);
+    assertEquals(publicSecurityModule.SecurityConfigLoader, SecurityConfigLoader);
+    assertEquals(publicSecurityModule.loadSecurityConfig, loadSecurityConfig);
+    assertEquals(publicSecurityModule.validatePathSync, validatePathSync);
+  });
+
+  it("keeps the public runtime surface explicit", () => {
+    assertEquals(
+      Object.keys(securityModule).sort(),
+      [
+        "AuthHandler",
+        "BUILD_HELPER_PERMISSIONS",
+        "BaseHandler",
+        "CACHE_DURATIONS",
+        "CORS_MAX_AGE",
+        "CommonSchemas",
+        "CsrfHandler",
+        "DEFAULT_CORS_HEADERS",
+        "DEFAULT_CORS_METHODS",
+        "DEFAULT_LIMITS",
+        "INPUT_VALIDATION_FAILED",
+        "PathValidationError",
+        "ResponseBuilder",
+        "SECURITY_VIOLATION",
+        "SERVER_PERMISSIONS",
+        "SecureFs",
+        "SecurityConfigLoader",
+        "ValidationPresets",
+        "WORKFLOW_RUN_PERMISSIONS",
+        "applyCORSHeaders",
+        "applyCORSHeadersSync",
+        "applyCsrfCookie",
+        "applySecurityHeaders",
+        "buildCacheControl",
+        "cors",
+        "corsSimple",
+        "createResponseBuilder",
+        "createSecureFs",
+        "createValidatedHandler",
+        "createValidationError",
+        "createValidator",
+        "generateCsrfToken",
+        "generateNonce",
+        "getSecurityHeader",
+        "handleCORSPreflight",
+        "isValidSecurityConfig",
+        "isPreflightRequest",
+        "isRequestBodyTooLargeError",
+        "parseFormData",
+        "parseJsonBody",
+        "parseQueryParams",
+        "readBodyWithLimit",
+        "sanitizeData",
+        "sanitizePathForDisplay",
+        "setCors",
+        "shouldApplyCORS",
+        "validateCORSConfig",
+        "validateCsrf",
+        "validateOrigin",
+        "validateOriginSync",
+        "validatePath",
+        "validateLexicalPath",
+        "validateRequestLimits",
+        "validatePathSync",
+        "wrapAdapterWithSecurity",
+        "loadSecurityConfig",
+      ].sort(),
+    );
+  });
+
   it("keeps the http security helpers wired to their source modules", () => {
     assertEquals(securityModule.AuthHandler, AuthHandler);
-    assertEquals(securityModule.SecurityConfigLoader, SecurityConfigLoader);
+    assertEquals(securityModule.isValidSecurityConfig, isValidSecurityConfig);
     assertEquals(securityModule.loadSecurityConfig, loadSecurityConfig);
+    assertEquals(securityModule.SecurityConfigLoader, SecurityConfigLoader);
     assertEquals(securityModule.setCors, setCors);
+    assertEquals(securityModule.validatePathSync, validatePathSync);
   });
 });
diff --git a/src/security/index.ts b/src/security/index.ts
index 9e1623c7ba..20f206d2f8 100644
--- a/src/security/index.ts
+++ b/src/security/index.ts
@@ -3,6 +3,14 @@
  * CSP and security headers, path traversal prevention, and secure filesystem access.
  *
  * @module security
+ *
+ * @example Apply response security headers
+ * ```ts
+ * import { applySecurityHeaders, generateNonce } from "veryfront/security";
+ *
+ * const response = new Response("Ready");
+ * applySecurityHeaders(response.headers, false, generateNonce(), null);
+ * ```
  */
 
 export { BaseHandler } from "./http/base-handler.ts";
@@ -25,6 +33,7 @@ export {
 export type {
   ParseFormOptions,
   ParseJsonOptions,
+  ParseQueryOptions,
   RequestLimits,
   ValidatedData,
   ValidatedHandlerConfig,
@@ -32,16 +41,14 @@ export type {
 } from "./input-validation/index.ts";
 
 export { AuthHandler } from "./http/auth.ts";
-export { SecurityConfigLoader } from "./http/config.ts";
-export { loadSecurityConfig, setCors } from "./http/middleware/index.ts";
+export { isValidSecurityConfig, loadSecurityConfig, SecurityConfigLoader } from "./http/config.ts";
+export { setCors } from "./http/middleware/index.ts";
 export type { CORSConfig, CSPDirectives, SecurityConfig } from "./http/middleware/index.ts";
 
 export { CsrfHandler } from "./http/csrf/index.ts";
 export { applyCsrfCookie, generateCsrfToken, validateCsrf } from "./csrf/index.ts";
 export type { CsrfConfig, CsrfTokenOptions } from "./csrf/index.ts";
 
-export { isValidSecurityConfig } from "./http/middleware/index.ts";
-
 export {
   applyCORSHeaders,
   applyCORSHeadersSync,
@@ -63,6 +70,9 @@ export type {
   CORSPreflightOptions,
   CORSValidationResult,
   OriginValidator,
+  SyncCORSConfig,
+  SyncCORSHeaderOptions,
+  SyncOriginValidator,
 } from "./http/cors/index.ts";
 
 export {
@@ -80,11 +90,18 @@ export {
   createValidator,
   PathValidationError,
   sanitizePathForDisplay,
+  validateLexicalPath,
   validatePath,
   validatePathSync,
   ValidationPresets,
 } from "./path-validation.ts";
-export type { ValidationLevel, ValidationOptions, ValidationResult } from "./path-validation.ts";
+export type {
+  LexicalPathValidationOptions,
+  PathValidationPolicyOptions,
+  ValidationLevel,
+  ValidationOptions,
+  ValidationResult,
+} from "./path-validation.ts";
 
 export {
   createSecureFs,
diff --git a/src/security/input-validation/errors.ts b/src/security/input-validation/errors.ts
index 94e3e24cae..cd9b14fb6b 100644
--- a/src/security/input-validation/errors.ts
+++ b/src/security/input-validation/errors.ts
@@ -1,4 +1,5 @@
-import { INPUT_VALIDATION_FAILED, VeryfrontError } from "#veryfront/errors";
+import { INPUT_VALIDATION_FAILED } from "#veryfront/errors/error-registry/general.ts";
+import { VeryfrontError } from "#veryfront/errors/types.ts";
 
 export { INPUT_VALIDATION_FAILED, VeryfrontError };
 
diff --git a/src/security/input-validation/handler.test.ts b/src/security/input-validation/handler.test.ts
index abae531824..e296bca6de 100644
--- a/src/security/input-validation/handler.test.ts
+++ b/src/security/input-validation/handler.test.ts
@@ -1,5 +1,10 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals, assertInstanceOf } from "#veryfront/testing/assert.ts";
+import {
+  assertEquals,
+  assertInstanceOf,
+  assertStrictEquals,
+  assertThrows,
+} from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { defineSchema } from "#veryfront/schemas/index.ts";
 import { createValidatedHandler } from "./handler.ts";
@@ -21,6 +26,19 @@ function jsonRequest(
   });
 }
 
+function streamingRequest(
+  body: ReadableStream<Uint8Array>,
+  headers?: HeadersInit,
+): Request {
+  const init: RequestInit & { duplex: "half" } = {
+    method: "POST",
+    headers,
+    body,
+    duplex: "half",
+  };
+  return new Request("http://localhost/api/test", init);
+}
+
 describe("security/input-validation/handler", () => {
   describe("createValidatedHandler", () => {
     it("should validate body and pass to handler", async () => {
@@ -153,8 +171,10 @@ describe("security/input-validation/handler", () => {
 
     it("should pass the original request to the handler", async () => {
       let receivedUrl = "";
+      let receivedRequest: Request | undefined;
 
       const handler = createValidatedHandler({}, (req) => {
+        receivedRequest = req;
         receivedUrl = req.url;
         return new Response("OK");
       });
@@ -163,6 +183,7 @@ describe("security/input-validation/handler", () => {
       await handler(req);
 
       assertEquals(receivedUrl, "http://localhost/api/test");
+      assertStrictEquals(receivedRequest, req);
     });
 
     it("should propagate non-ValidationError errors", async () => {
@@ -209,6 +230,246 @@ describe("security/input-validation/handler", () => {
       assertEquals(res.status, 400);
     });
 
+    it("should enforce URL limits without a body schema", async () => {
+      let invoked = false;
+      const handler = createValidatedHandler(
+        { limits: { maxUrlLength: 32 } },
+        () => {
+          invoked = true;
+          return new Response("OK");
+        },
+      );
+
+      const res = await handler(
+        new Request(`http://localhost/api/${"x".repeat(100)}`),
+      );
+
+      assertEquals(res.status, 400);
+      assertEquals((await res.json()).error, "URL too long");
+      assertEquals(invoked, false);
+    });
+
+    it("should enforce header limits with only a query schema", async () => {
+      const querySchema = defineSchema((v) => v.object({ page: v.string() }))();
+      let invoked = false;
+      const handler = createValidatedHandler(
+        { query: querySchema, limits: { maxHeaderSize: 32 } },
+        () => {
+          invoked = true;
+          return new Response("OK");
+        },
+      );
+
+      const res = await handler(
+        new Request("http://localhost/api/test?page=1", {
+          headers: { "x-large-header": "x".repeat(100) },
+        }),
+      );
+
+      assertEquals(res.status, 400);
+      assertEquals((await res.json()).error, "Headers too large");
+      assertEquals(invoked, false);
+    });
+
+    it("should enforce declared body limits without a body schema", async () => {
+      let invoked = false;
+      const handler = createValidatedHandler(
+        { limits: { maxBodySize: 10 } },
+        () => {
+          invoked = true;
+          return new Response("OK");
+        },
+      );
+
+      const res = await handler(
+        new Request("http://localhost/api/test", {
+          headers: { "content-length": "100" },
+        }),
+      );
+
+      assertEquals(res.status, 400);
+      assertEquals((await res.json()).error, "Request body too large");
+      assertEquals(invoked, false);
+    });
+
+    it("should enforce the actual size of a chunked body without a body schema", async () => {
+      let invoked = false;
+      const handler = createValidatedHandler(
+        { limits: { maxBodySize: 10 } },
+        () => {
+          invoked = true;
+          return new Response("OK");
+        },
+      );
+      const request = streamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode("x".repeat(6)));
+            controller.enqueue(new TextEncoder().encode("x".repeat(6)));
+            controller.close();
+          },
+        }),
+      );
+
+      assertEquals(request.headers.has("content-length"), false);
+      const response = await handler(request);
+
+      assertEquals(response.status, 400);
+      assertEquals(invoked, false);
+    });
+
+    it("should reject a body larger than its understated Content-Length", async () => {
+      let invoked = false;
+      const handler = createValidatedHandler(
+        { limits: { maxBodySize: 10 } },
+        () => {
+          invoked = true;
+          return new Response("OK");
+        },
+      );
+      const request = streamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode("x".repeat(100)));
+            controller.close();
+          },
+        }),
+        { "content-length": "1" },
+      );
+
+      const response = await handler(request);
+
+      assertEquals(response.status, 400);
+      assertEquals(invoked, false);
+    });
+
+    it("should leave an accepted unparsed body available to the handler", async () => {
+      const handler = createValidatedHandler(
+        { limits: { maxBodySize: 16 } },
+        async (request) => new Response(await request.text()),
+      );
+      const request = streamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode("bounded body"));
+            controller.close();
+          },
+        }),
+      );
+
+      const response = await handler(request);
+
+      assertEquals(response.status, 200);
+      assertEquals(await response.text(), "bounded body");
+    });
+
+    it("should snapshot config and schemas before awaiting a body", async () => {
+      const bodySchema = defineSchema((v) => v.object({ name: v.string() }))();
+      const replacementSchema = defineSchema((v) => v.object({ name: v.string().min(100) }))();
+      const config = {
+        body: bodySchema,
+        limits: { maxBodySize: 64 },
+      };
+      let originalInvoked = false;
+      const configuredHandler = (_request: Request, validated: { body?: { name: string } }) => {
+        originalInvoked = true;
+        return new Response(validated.body?.name);
+      };
+      const handler = createValidatedHandler(config, configuredHandler);
+
+      let controller: ReadableStreamDefaultController<Uint8Array> | undefined;
+      const request = streamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(value) {
+            controller = value;
+          },
+        }),
+        { "content-type": "application/json" },
+      );
+      const responsePromise = handler(request);
+
+      config.body = replacementSchema;
+      config.limits.maxBodySize = 0;
+      Object.defineProperty(bodySchema, "safeParse", {
+        configurable: true,
+        value: () => ({ success: false, issues: [] }),
+      });
+      controller?.enqueue(new TextEncoder().encode('{"name":"Alice"}'));
+      controller?.close();
+
+      const response = await responsePromise;
+
+      assertEquals(response.status, 200);
+      assertEquals(await response.text(), "Alice");
+      assertEquals(originalInvoked, true);
+    });
+
+    it("should reject unknown, inherited, accessor-backed, and malformed config", () => {
+      let configGetterCalls = 0;
+      const accessorConfig = {} as Record<string, unknown>;
+      Object.defineProperty(accessorConfig, "body", {
+        enumerable: true,
+        get() {
+          configGetterCalls++;
+          return undefined;
+        },
+      });
+
+      assertThrows(
+        () => createValidatedHandler({ unsupported: true } as never, () => new Response()),
+        TypeError,
+        "unsupported option",
+      );
+      assertThrows(
+        () =>
+          createValidatedHandler(
+            Object.create({ limits: {} }),
+            () => new Response(),
+          ),
+        TypeError,
+        "plain object",
+      );
+      assertThrows(
+        () => createValidatedHandler(accessorConfig as never, () => new Response()),
+        TypeError,
+        "own data property",
+      );
+      assertThrows(
+        () => createValidatedHandler(null as never, () => new Response()),
+        TypeError,
+        "plain object",
+      );
+      assertThrows(
+        () => createValidatedHandler({}, null as never),
+        TypeError,
+        "must be a function",
+      );
+      assertEquals(configGetterCalls, 0);
+    });
+
+    it("should reject accessor-backed schemas without invoking them", () => {
+      let schemaGetterCalls = 0;
+      const accessorSchema = {} as Record<string, unknown>;
+      Object.defineProperty(accessorSchema, "safeParse", {
+        enumerable: true,
+        get() {
+          schemaGetterCalls++;
+          return () => ({ success: true, data: undefined });
+        },
+      });
+
+      assertThrows(
+        () =>
+          createValidatedHandler(
+            { body: accessorSchema as never },
+            () => new Response(),
+          ),
+        TypeError,
+        "must be a data property",
+      );
+      assertStrictEquals(schemaGetterCalls, 0);
+    });
+
     it("should work with no schemas configured", async () => {
       const handler = createValidatedHandler({}, (_req, validated) =>
         new Response(
diff --git a/src/security/input-validation/handler.ts b/src/security/input-validation/handler.ts
index c733c09994..9af1738203 100644
--- a/src/security/input-validation/handler.ts
+++ b/src/security/input-validation/handler.ts
@@ -1,8 +1,12 @@
 import type { Schema } from "#veryfront/extensions/schema/index.ts";
-import { VeryfrontError } from "./errors.ts";
-import { parseJsonBody, parseQueryParams } from "./parsers.ts";
+import { createValidationError, VeryfrontError } from "./errors.ts";
+import { readBodyBytesWithLimit, resolveRequestLimits, validateRequestLimits } from "./limits.ts";
+import { parseJsonBodyAfterRequestLimits, parseQueryParamsAfterRequestLimits } from "./parsers.ts";
 import { type RequestLimits, type ValidatedData } from "./types.ts";
 
+const VALIDATED_HANDLER_CONFIG_KEYS = new Set(["body", "query", "limits"]);
+const MAX_SCHEMA_PROTOTYPE_DEPTH = 64;
+
 /** Configuration for `createValidatedHandler()`. */
 export interface ValidatedHandlerConfig<TBody = unknown, TQuery = unknown> {
   body?: Schema<TBody>;
@@ -16,24 +20,184 @@ export type ValidatedHandlerFunction<TBody = unknown, TQuery = unknown> = (
   validated: ValidatedData<TBody, TQuery>,
 ) => Promise<Response> | Response;
 
-/** Create a validated API handler wrapper that auto-validates body/query with Zod schemas */
+function snapshotOwnConfig(
+  value: unknown,
+): Readonly<Record<string, unknown>> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError("Validated handler config must be a plain object");
+  }
+
+  let prototype: object | null;
+  let keys: Array<string | symbol>;
+  try {
+    prototype = Object.getPrototypeOf(value);
+    keys = Reflect.ownKeys(value);
+  } catch {
+    throw new TypeError("Validated handler config could not be inspected safely");
+  }
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError("Validated handler config must be a plain object");
+  }
+
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const key of keys) {
+    if (typeof key !== "string" || !VALIDATED_HANDLER_CONFIG_KEYS.has(key)) {
+      throw new TypeError(
+        `Validated handler config contains an unsupported ${
+          typeof key === "string" ? `option: ${key}` : "symbol"
+        }`,
+      );
+    }
+
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(value, key);
+    } catch {
+      throw new TypeError(`Validated handler config.${key} could not be inspected safely`);
+    }
+    if (!descriptor || !("value" in descriptor)) {
+      throw new TypeError(`Validated handler config.${key} must be an own data property`);
+    }
+    snapshot[key] = descriptor.value;
+  }
+
+  return Object.freeze(snapshot);
+}
+
+function snapshotSchema<T>(value: unknown, label: string): Schema<T> {
+  if ((typeof value !== "object" || value === null) && typeof value !== "function") {
+    throw new TypeError(`${label} must be a schema object`);
+  }
+
+  const receiver = value as object;
+  const seen = new Set<object>();
+  let current: object | null = receiver;
+  let safeParse: Schema<T>["safeParse"] | undefined;
+
+  for (let depth = 0; current !== null; depth++) {
+    if (depth >= MAX_SCHEMA_PROTOTYPE_DEPTH || seen.has(current)) {
+      throw new TypeError(`${label} has an invalid prototype chain`);
+    }
+    seen.add(current);
+
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(current, "safeParse");
+    } catch {
+      throw new TypeError(`${label}.safeParse could not be inspected safely`);
+    }
+    if (descriptor) {
+      if (!("value" in descriptor)) {
+        throw new TypeError(`${label}.safeParse must be a data property`);
+      }
+      if (typeof descriptor.value !== "function") {
+        throw new TypeError(`${label}.safeParse must be a function`);
+      }
+      safeParse = descriptor.value as Schema<T>["safeParse"];
+      break;
+    }
+
+    try {
+      current = Object.getPrototypeOf(current);
+    } catch {
+      throw new TypeError(`${label} prototype could not be inspected safely`);
+    }
+  }
+
+  if (!safeParse) {
+    throw new TypeError(`${label}.safeParse must be a function`);
+  }
+
+  // The original object remains the method receiver for class-based schema
+  // implementations. An immutable own method prevents later property
+  // replacement from changing validation after an awaited body read.
+  const snapshot = Object.create(receiver) as Schema<T>;
+  Object.defineProperty(snapshot, "safeParse", {
+    configurable: false,
+    enumerable: true,
+    value: (data: unknown) => Reflect.apply(safeParse, receiver, [data]),
+    writable: false,
+  });
+  return Object.freeze(snapshot);
+}
+
+function cancelUnconsumedBody(request: Request, reason: unknown): void {
+  const body = request.body;
+  if (!body || body.locked) return;
+  try {
+    void body.cancel(reason).catch(() => undefined);
+  } catch {
+    // The validation failure remains authoritative if cancellation fails.
+  }
+}
+
+async function validateUnparsedBody(
+  request: Request,
+  maxBodySize: number,
+): Promise<void> {
+  if (request.body === null) return;
+  if (request.bodyUsed) {
+    throw createValidationError("Request body has already been consumed");
+  }
+
+  let probe: Request;
+  try {
+    probe = request.clone();
+  } catch {
+    throw createValidationError("Request body could not be inspected safely");
+  }
+
+  try {
+    await readBodyBytesWithLimit(probe, maxBodySize);
+  } catch (error) {
+    cancelUnconsumedBody(request, error);
+    throw error;
+  }
+}
+
+/**
+ * Create a validated API handler with bounded body/query validation.
+ * Bodies without a schema are preflighted through a clone, leaving the
+ * original request body available to the handler after its size is verified.
+ */
 export function createValidatedHandler<TBody = unknown, TQuery = unknown>(
   config: ValidatedHandlerConfig<TBody, TQuery>,
   handler: ValidatedHandlerFunction<TBody, TQuery>,
 ): (request: Request) => Promise<Response> {
+  const configSnapshot = snapshotOwnConfig(config);
+  const bodySchema = configSnapshot.body === undefined
+    ? undefined
+    : snapshotSchema<TBody>(configSnapshot.body, "Validated handler body schema");
+  const querySchema = configSnapshot.query === undefined
+    ? undefined
+    : snapshotSchema<TQuery>(configSnapshot.query, "Validated handler query schema");
+  const limits = resolveRequestLimits(configSnapshot.limits as RequestLimits | undefined);
+  if (typeof handler !== "function") {
+    throw new TypeError("Validated handler must be a function");
+  }
+  const handlerSnapshot = handler;
+
   return async function validatedHandler(request: Request): Promise<Response> {
     try {
+      validateRequestLimits(request, limits);
+
       const validated: ValidatedData<TBody, TQuery> = {};
 
-      if (config.body) {
-        validated.body = await parseJsonBody(request, config.body, { limits: config.limits });
+      if (bodySchema) {
+        validated.body = await parseJsonBodyAfterRequestLimits(
+          request,
+          bodySchema,
+          limits,
+        );
+      } else {
+        await validateUnparsedBody(request, limits.maxBodySize);
       }
 
-      if (config.query) {
-        validated.query = parseQueryParams(request, config.query);
+      if (querySchema) {
+        validated.query = parseQueryParamsAfterRequestLimits(request, querySchema);
       }
 
-      return await handler(request, validated);
+      return await handlerSnapshot(request, validated);
     } catch (error) {
       if (!(error instanceof VeryfrontError && error.slug === "input-validation-failed")) {
         throw error;
diff --git a/src/security/input-validation/index.ts b/src/security/input-validation/index.ts
index bdc822dd60..169a3e37d7 100644
--- a/src/security/input-validation/index.ts
+++ b/src/security/input-validation/index.ts
@@ -4,7 +4,13 @@
  * @module security/input-validation
  */
 
-export type { ParseFormOptions, ParseJsonOptions, RequestLimits, ValidatedData } from "./types.ts";
+export type {
+  ParseFormOptions,
+  ParseJsonOptions,
+  ParseQueryOptions,
+  RequestLimits,
+  ValidatedData,
+} from "./types.ts";
 export { DEFAULT_LIMITS } from "./types.ts";
 export { createValidationError, INPUT_VALIDATION_FAILED } from "./errors.ts";
 export {
diff --git a/src/security/input-validation/limits.test.ts b/src/security/input-validation/limits.test.ts
index 470684c6e3..8a80df991c 100644
--- a/src/security/input-validation/limits.test.ts
+++ b/src/security/input-validation/limits.test.ts
@@ -1,16 +1,53 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
+import {
+  assertEquals,
+  assertRejects,
+  assertStrictEquals,
+  assertThrows,
+} from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { VeryfrontError } from "./errors.ts";
 import {
   isRequestBodyTooLargeError,
+  readBodyBytesWithLimit,
   readBodyWithLimit,
+  resolveRequestLimits,
   validateContentType,
   validateRequestLimits,
 } from "./limits.ts";
+import { DEFAULT_LIMITS } from "./types.ts";
+
+function createStreamingRequest(
+  body: ReadableStream<Uint8Array>,
+  headers?: HeadersInit,
+  signal?: AbortSignal,
+): Request {
+  // Node requires this Fetch extension for streaming request bodies. Deno and
+  // Bun accept it as an ignored/compatible RequestInit member.
+  const init: RequestInit & { duplex: "half" } = {
+    method: "POST",
+    headers,
+    body,
+    duplex: "half",
+    signal,
+  };
+  return new Request("http://localhost/", init);
+}
 
 describe("security/input-validation/limits", () => {
   describe("validateRequestLimits", () => {
+    it("does not allow callers to weaken framework-owned defaults", () => {
+      const expectedBodyLimit = DEFAULT_LIMITS.maxBodySize;
+
+      assertThrows(
+        () => {
+          (DEFAULT_LIMITS as { maxBodySize: number }).maxBodySize = 0;
+        },
+        TypeError,
+      );
+      assertStrictEquals(resolveRequestLimits().maxBodySize, expectedBodyLimit);
+    });
+
     it("should pass for normal requests", () => {
       const req = new Request("http://localhost/api/data", {
         headers: { "Content-Length": "100" },
@@ -55,6 +92,49 @@ describe("security/input-validation/limits", () => {
       );
     });
 
+    it("should reject an empty Content-Length consistently", () => {
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        headers: { "Content-Length": "" },
+      });
+
+      assertThrows(
+        () => validateRequestLimits(req),
+        VeryfrontError,
+        "Invalid Content-Length",
+      );
+    });
+
+    it("should reject a Content-Length with a numeric prefix and trailing junk", () => {
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        headers: { "Content-Length": "10 trailing-junk" },
+      });
+
+      assertThrows(
+        () => validateRequestLimits(req),
+        VeryfrontError,
+        "Invalid Content-Length",
+      );
+    });
+
+    it("rejects Content-Length values outside the safe integer domain", () => {
+      const req = createStreamingRequest(
+        new ReadableStream({
+          start(controller) {
+            controller.close();
+          },
+        }),
+        { "content-length": "9007199254740992" },
+      );
+
+      assertThrows(
+        () => validateRequestLimits(req),
+        VeryfrontError,
+        "Invalid Content-Length",
+      );
+    });
+
     it("should reject oversized headers", () => {
       const headers: Record<string, string> = {};
 
@@ -70,6 +150,79 @@ describe("security/input-validation/limits", () => {
         "Headers too large",
       );
     });
+
+    it("rejects invalid runtime limits instead of disabling enforcement", () => {
+      const req = new Request("http://localhost/");
+      for (
+        const limits of [
+          { maxBodySize: Number.POSITIVE_INFINITY },
+          { maxUrlLength: Number.NaN },
+          { maxHeaderSize: -1 },
+          { maxFileSize: 1.5 },
+          { maxBodySize: null as unknown as number },
+        ]
+      ) {
+        assertThrows(
+          () => validateRequestLimits(req, limits),
+          RangeError,
+          "must be a non-negative safe integer",
+        );
+      }
+    });
+
+    it("rejects unknown, inherited, and accessor-backed limit options", () => {
+      let getterCalls = 0;
+      const accessorLimits = {} as Record<string, unknown>;
+      Object.defineProperty(accessorLimits, "maxBodySize", {
+        enumerable: true,
+        get() {
+          getterCalls++;
+          return 1;
+        },
+      });
+
+      assertThrows(
+        () => resolveRequestLimits({ unknown: 1 } as never),
+        TypeError,
+        "unsupported option",
+      );
+      assertThrows(
+        () => resolveRequestLimits(Object.create({ maxBodySize: 1 })),
+        TypeError,
+        "plain object",
+      );
+      assertThrows(
+        () => resolveRequestLimits(accessorLimits as never),
+        TypeError,
+        "own data property",
+      );
+      assertEquals(getterCalls, 0);
+    });
+
+    it("counts URL and header limits in UTF-8 bytes", () => {
+      const requestWithUnicodeUrl = {
+        url: "http://localhost/å",
+        headers: new Headers(),
+      } as Request;
+      assertThrows(
+        () =>
+          validateRequestLimits(requestWithUnicodeUrl, {
+            maxUrlLength: requestWithUnicodeUrl.url.length,
+          }),
+        VeryfrontError,
+        "URL too long",
+      );
+
+      const req = new Request("http://localhost/", {
+        headers: { "x-value": "å" },
+      });
+      const codeUnitSize = "x-value".length + "å".length + 4;
+      assertThrows(
+        () => validateRequestLimits(req, { maxHeaderSize: codeUnitSize }),
+        VeryfrontError,
+        "Headers too large",
+      );
+    });
   });
 
   describe("validateContentType", () => {
@@ -142,6 +295,15 @@ describe("security/input-validation/limits", () => {
       assertEquals(text, "hello world");
     });
 
+    it("should reject malformed UTF-8 instead of replacing bytes", async () => {
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        body: new Uint8Array([0xc0, 0xaf]),
+      });
+
+      await assertRejects(() => readBodyWithLimit(req, 2), TypeError);
+    });
+
     it("should reject body exceeding limit", async () => {
       const req = new Request("http://localhost/", {
         method: "POST",
@@ -171,16 +333,15 @@ describe("security/input-validation/limits", () => {
     });
 
     it("should reject an oversized Content-Length", async () => {
-      const req = new Request("http://localhost/", {
-        method: "POST",
-        headers: { "content-length": "100" },
-        body: new ReadableStream({
+      const req = createStreamingRequest(
+        new ReadableStream({
           pull(controller) {
             controller.enqueue(new TextEncoder().encode("hello"));
             controller.close();
           },
         }),
-      });
+        { "content-length": "100" },
+      );
 
       await assertRejects(
         () => readBodyWithLimit(req, 10),
@@ -191,9 +352,8 @@ describe("security/input-validation/limits", () => {
 
     it("should cancel a streaming body once the limit is exceeded", async () => {
       let cancelled = false;
-      const req = new Request("http://localhost/", {
-        method: "POST",
-        body: new ReadableStream({
+      const req = createStreamingRequest(
+        new ReadableStream({
           start(controller) {
             controller.enqueue(new TextEncoder().encode("too large"));
           },
@@ -201,7 +361,7 @@ describe("security/input-validation/limits", () => {
             cancelled = true;
           },
         }),
-      });
+      );
 
       await assertRejects(
         () => readBodyWithLimit(req, 4),
@@ -211,6 +371,223 @@ describe("security/input-validation/limits", () => {
       assertEquals(cancelled, true);
     });
 
+    it("should not wait for an uncooperative stream cancellation hook", async () => {
+      let cancelled = false;
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode("too large"));
+          },
+          cancel() {
+            cancelled = true;
+            return new Promise<void>(() => {});
+          },
+        }),
+      );
+
+      let timeoutId: number | undefined;
+      const outcome = await Promise.race([
+        readBodyBytesWithLimit(req, 4).then(
+          () => "resolved",
+          () => "rejected",
+        ),
+        new Promise<"timed-out">((resolve) => {
+          timeoutId = setTimeout(() => resolve("timed-out"), 20);
+        }),
+      ]).finally(() => clearTimeout(timeoutId));
+
+      assertEquals(cancelled, true);
+      assertEquals(outcome, "rejected");
+    });
+
+    it("should preserve binary request bytes", async () => {
+      const expected = new Uint8Array([0, 255, 1, 128, 42]);
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        body: expected,
+      });
+
+      const actual = await readBodyBytesWithLimit(req, expected.byteLength);
+
+      assertEquals(actual, expected);
+    });
+
+    it("should coalesce many tiny and empty transport chunks", async () => {
+      const expected = Uint8Array.from(
+        { length: 4_096 },
+        (_, index) => index % 251,
+      );
+      let chunkIndex = 0;
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          pull(controller) {
+            if (chunkIndex === expected.byteLength * 2) {
+              controller.close();
+              return;
+            }
+            const dataIndex = Math.floor(chunkIndex / 2);
+            controller.enqueue(
+              chunkIndex % 2 === 0 ? new Uint8Array() : expected.subarray(dataIndex, dataIndex + 1),
+            );
+            chunkIndex++;
+          },
+        }),
+      );
+
+      const actual = await readBodyBytesWithLimit(
+        req,
+        expected.byteLength,
+      );
+
+      assertEquals(actual, expected);
+    });
+
+    it("should let an abort timer preempt a synchronous empty-chunk stream", async () => {
+      const controller = new AbortController();
+      const reason = new Error("empty body stream deadline");
+      let pulls = 0;
+      let cancelReason: unknown;
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          pull(streamController) {
+            pulls++;
+            streamController.enqueue(new Uint8Array());
+          },
+          cancel(receivedReason) {
+            cancelReason = receivedReason;
+          },
+        }),
+        undefined,
+        controller.signal,
+      );
+
+      const pending = readBodyBytesWithLimit(req, 1024);
+      setTimeout(() => controller.abort(reason), 0);
+
+      const error = await assertRejects(() => pending);
+      assertStrictEquals(error, reason);
+      assertStrictEquals(cancelReason, reason);
+      assertEquals(pulls < 4_096, true);
+    });
+
+    it("should reject an endless no-progress body without an external deadline", async () => {
+      let pulls = 0;
+      let cancelled = false;
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          pull(controller) {
+            pulls++;
+            controller.enqueue(new Uint8Array());
+          },
+          cancel() {
+            cancelled = true;
+          },
+        }),
+      );
+
+      await assertRejects(
+        () => readBodyBytesWithLimit(req, 1024),
+        VeryfrontError,
+        "made no progress",
+      );
+      assertEquals(cancelled, true);
+      // Fetch implementations may issue one speculative pull beyond the
+      // consumer-visible read; the no-progress bound still stays constant.
+      assertEquals(pulls < 4_100, true);
+    });
+
+    it("should reject malformed Content-Length before reading body bytes", async () => {
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        headers: { "Content-Length": "5x" },
+        body: "hello",
+      });
+
+      await assertRejects(
+        () => readBodyBytesWithLimit(req, 10),
+        VeryfrontError,
+        "Invalid Content-Length",
+      );
+    });
+
+    it("should cancel a body read when the caller signal aborts", async () => {
+      const controller = new AbortController();
+      let cancelled = false;
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          cancel() {
+            cancelled = true;
+          },
+        }),
+      );
+      const reason = new Error("body read deadline expired");
+      const pending = readBodyBytesWithLimit(req, 10, {
+        signal: controller.signal,
+      });
+
+      controller.abort(reason);
+
+      await assertRejects(
+        () => pending,
+        Error,
+        "body read deadline expired",
+      );
+      assertEquals(cancelled, true);
+    });
+
+    it("should honor the incoming Request signal without explicit options", async () => {
+      const controller = new AbortController();
+      const reason = new Error("incoming request disconnected");
+      let cancelReason: unknown;
+      const requestWithSignal = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          cancel(receivedReason) {
+            cancelReason = receivedReason;
+          },
+        }),
+        undefined,
+        controller.signal,
+      );
+      const pending = readBodyBytesWithLimit(requestWithSignal, 10);
+
+      controller.abort(reason);
+
+      const error = await assertRejects(() => pending);
+      assertStrictEquals(error, reason);
+      assertStrictEquals(cancelReason, reason);
+    });
+
+    it("should reject an already-consumed request body", async () => {
+      const req = new Request("http://localhost/", {
+        method: "POST",
+        body: "abc",
+      });
+      assertEquals(await readBodyWithLimit(req), "abc");
+
+      await assertRejects(
+        () => readBodyBytesWithLimit(req),
+        VeryfrontError,
+        "already been consumed",
+      );
+    });
+
+    it("should reject a non-byte stream chunk instead of truncating it", async () => {
+      const req = createStreamingRequest(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue("attacker-text" as unknown as Uint8Array);
+            controller.close();
+          },
+        }),
+      );
+
+      await assertRejects(
+        () => readBodyBytesWithLimit(req, 100),
+        VeryfrontError,
+        "non-byte chunk",
+      );
+    });
+
     it("should reject request with no body", async () => {
       const req = new Request("http://localhost/");
 
@@ -220,5 +597,35 @@ describe("security/input-validation/limits", () => {
         "No request body",
       );
     });
+
+    it("rejects body-read option accessors without invoking them", async () => {
+      let getterCalls = 0;
+      const options = {} as Record<string, unknown>;
+      Object.defineProperty(options, "signal", {
+        enumerable: true,
+        get() {
+          getterCalls++;
+          return new AbortController().signal;
+        },
+      });
+
+      await assertRejects(
+        () =>
+          readBodyBytesWithLimit(
+            createStreamingRequest(
+              new ReadableStream({
+                start(controller) {
+                  controller.close();
+                },
+              }),
+            ),
+            1,
+            options as never,
+          ),
+        TypeError,
+        "own data property",
+      );
+      assertEquals(getterCalls, 0);
+    });
   });
 });
diff --git a/src/security/input-validation/limits.ts b/src/security/input-validation/limits.ts
index 21d10393c4..757db41979 100644
--- a/src/security/input-validation/limits.ts
+++ b/src/security/input-validation/limits.ts
@@ -2,6 +2,100 @@ import { createValidationError, VeryfrontError } from "./errors.ts";
 import { DEFAULT_LIMITS, type RequestLimits } from "./types.ts";
 
 const REQUEST_BODY_TOO_LARGE_DETAIL = "Request body exceeds size limit";
+const BODY_COALESCE_BLOCK_BYTES = 64 * 1024;
+const BODY_READ_YIELD_CHUNKS = 256;
+const MAX_CONSECUTIVE_EMPTY_BODY_CHUNKS = 4_096;
+const textEncoder = new TextEncoder();
+const fatalUtf8Decoder = new TextDecoder("utf-8", { fatal: true });
+const REQUEST_LIMIT_KEYS = new Set([
+  "maxBodySize",
+  "maxUrlLength",
+  "maxHeaderSize",
+  "maxFileSize",
+]);
+const READ_BODY_OPTION_KEYS = new Set(["signal"]);
+
+export interface ReadBodyLimitOptions {
+  /** Abort the read and cancel the underlying stream when the caller deadline expires. */
+  signal?: AbortSignal;
+}
+
+function requireByteLimit(name: string, value: unknown): number {
+  if (
+    typeof value !== "number" ||
+    !Number.isSafeInteger(value) ||
+    value < 0
+  ) {
+    throw new RangeError(`${name} must be a non-negative safe integer`);
+  }
+  return value;
+}
+
+function snapshotOwnOptions(
+  value: unknown,
+  label: string,
+  allowedKeys: ReadonlySet<string>,
+): Readonly<Record<string, unknown>> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+  let prototype: object | null;
+  let keys: Array<string | symbol>;
+  try {
+    prototype = Object.getPrototypeOf(value);
+    keys = Reflect.ownKeys(value);
+  } catch {
+    throw new TypeError(`${label} could not be inspected safely`);
+  }
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const key of keys) {
+    if (typeof key !== "string" || !allowedKeys.has(key)) {
+      throw new TypeError(
+        `${label} contains an unsupported ${typeof key === "string" ? `option: ${key}` : "symbol"}`,
+      );
+    }
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(value, key);
+    } catch {
+      throw new TypeError(`${label}.${key} could not be inspected safely`);
+    }
+    if (!descriptor || !("value" in descriptor)) {
+      throw new TypeError(`${label}.${key} must be an own data property`);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  return Object.freeze(snapshot);
+}
+
+/** Resolve and validate every request-boundary limit before it is used. */
+export function resolveRequestLimits(
+  limits: RequestLimits = {},
+): Required<RequestLimits> {
+  const snapshot = snapshotOwnOptions(limits, "Request limits", REQUEST_LIMIT_KEYS);
+  return {
+    maxBodySize: requireByteLimit(
+      "Request body size limit",
+      snapshot.maxBodySize === undefined ? DEFAULT_LIMITS.maxBodySize : snapshot.maxBodySize,
+    ),
+    maxUrlLength: requireByteLimit(
+      "Request URL size limit",
+      snapshot.maxUrlLength === undefined ? DEFAULT_LIMITS.maxUrlLength : snapshot.maxUrlLength,
+    ),
+    maxHeaderSize: requireByteLimit(
+      "Request header size limit",
+      snapshot.maxHeaderSize === undefined ? DEFAULT_LIMITS.maxHeaderSize : snapshot.maxHeaderSize,
+    ),
+    maxFileSize: requireByteLimit(
+      "Request file size limit",
+      snapshot.maxFileSize === undefined ? DEFAULT_LIMITS.maxFileSize : snapshot.maxFileSize,
+    ),
+  };
+}
 
 export function isRequestBodyTooLargeError(error: unknown): error is VeryfrontError {
   return error instanceof VeryfrontError &&
@@ -12,32 +106,31 @@ export function isRequestBodyTooLargeError(error: unknown): error is VeryfrontEr
 export function validateRequestLimits(
   request: Request,
   limits: RequestLimits = {},
-): void {
-  const { maxUrlLength, maxBodySize, maxHeaderSize } = {
-    ...DEFAULT_LIMITS,
-    ...limits,
-  };
+): Required<RequestLimits> {
+  const resolved = resolveRequestLimits(limits);
+  const { maxUrlLength, maxBodySize, maxHeaderSize } = resolved;
 
   validateUrlLength(request.url, maxUrlLength);
   validateContentLength(request, maxBodySize);
   validateHeaderSize(request, maxHeaderSize);
+  return resolved;
 }
 
 function validateUrlLength(url: string, maxLength: number): void {
-  if (url.length <= maxLength) return;
+  const actualLength = textEncoder.encode(url).byteLength;
+  if (actualLength <= maxLength) return;
 
   throw createValidationError("URL too long", {
     maxLength,
-    actualLength: url.length,
+    actualLength,
   });
 }
 
 function validateContentLength(request: Request, maxSize: number): void {
   const contentLength = request.headers.get("content-length");
-  if (!contentLength) return;
+  if (contentLength === null) return;
 
-  const size = Number.parseInt(contentLength, 10);
-  if (Number.isNaN(size)) throw createValidationError("Invalid Content-Length header");
+  const size = parseContentLength(contentLength);
   if (size <= maxSize) return;
 
   throw createValidationError("Request body too large", {
@@ -46,11 +139,67 @@ function validateContentLength(request: Request, maxSize: number): void {
   });
 }
 
+function parseContentLength(contentLength: string): number {
+  if (!/^\d+$/.test(contentLength)) {
+    throw createValidationError("Invalid Content-Length header");
+  }
+
+  const parsed = Number(contentLength);
+  if (!Number.isSafeInteger(parsed)) {
+    throw createValidationError("Invalid Content-Length header");
+  }
+  return parsed;
+}
+
+function createBodyTooLargeError(
+  maxSize: number,
+  actualSize: number,
+  source: "content-length" | "stream",
+): VeryfrontError {
+  return createValidationError(REQUEST_BODY_TOO_LARGE_DETAIL, {
+    maxSize,
+    actualSize,
+    source,
+    ...(source === "content-length" ? { contentLength: actualSize } : { bytesRead: actualSize }),
+  });
+}
+
+function cancelBody(
+  body: ReadableStream<Uint8Array> | null,
+  reason: unknown,
+): void {
+  if (!body || body.locked) return;
+  try {
+    void body.cancel(reason).catch(() => undefined);
+  } catch {
+    // Cancellation is best effort. A hostile or broken stream must not keep
+    // the caller waiting after the body has already been rejected.
+  }
+}
+
+function cancelReader(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  reason: unknown,
+): void {
+  try {
+    void reader.cancel(reason).catch(() => undefined);
+  } catch {
+    // The rejection reason remains authoritative if cancellation itself fails.
+  }
+}
+
+function yieldToTaskQueue(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
 function validateHeaderSize(request: Request, maxSize: number): void {
   let headerSize = 0;
 
   for (const [key, value] of request.headers) {
-    headerSize += key.length + value.length + 4; // ": " and "\r\n"
+    headerSize += textEncoder.encode(key).byteLength +
+      textEncoder.encode(value).byteLength +
+      4; // ": " and "\r\n"
+    if (headerSize > maxSize) break;
   }
 
   if (headerSize <= maxSize) return;
@@ -81,52 +230,166 @@ export async function readBodyWithLimit(
   request: Request,
   maxSize: number = DEFAULT_LIMITS.maxBodySize,
 ): Promise<string> {
+  const bytes = await readBodyBytesWithLimit(request, maxSize);
+  return fatalUtf8Decoder.decode(bytes);
+}
+
+/**
+ * Read a request body without accepting more than the configured byte limit.
+ *
+ * Content-Length is an early rejection hint only. The streamed byte count is
+ * always authoritative, which also bounds chunked and dishonest requests.
+ * Tiny transport chunks are coalesced into fixed-size blocks so chunk metadata
+ * cannot grow independently of the byte limit.
+ */
+export async function readBodyBytesWithLimit(
+  request: Request,
+  maxSize: number = DEFAULT_LIMITS.maxBodySize,
+  options: ReadBodyLimitOptions = {},
+): Promise<Uint8Array> {
+  const optionSnapshot = snapshotOwnOptions(
+    options,
+    "Request body read options",
+    READ_BODY_OPTION_KEYS,
+  );
+  if (optionSnapshot.signal !== undefined && !(optionSnapshot.signal instanceof AbortSignal)) {
+    throw new TypeError("Request body read options.signal must be an AbortSignal");
+  }
+  requireByteLimit("Request body size limit", maxSize);
+  if (request.bodyUsed) {
+    throw createValidationError("Request body has already been consumed");
+  }
+
   const contentLength = request.headers.get("content-length");
   if (contentLength !== null) {
-    if (!/^\d+$/.test(contentLength)) {
-      throw createValidationError("Invalid Content-Length header");
+    let declaredSize: number;
+    try {
+      declaredSize = parseContentLength(contentLength);
+    } catch (error) {
+      cancelBody(request.body, error);
+      throw error;
     }
-    if (Number(contentLength) > maxSize) {
-      throw createValidationError(REQUEST_BODY_TOO_LARGE_DETAIL, {
-        maxSize,
-        contentLength: Number(contentLength),
-      });
+    if (declaredSize > maxSize) {
+      const error = createBodyTooLargeError(maxSize, declaredSize, "content-length");
+      cancelBody(request.body, error);
+      throw error;
     }
   }
 
   const reader = request.body?.getReader();
   if (!reader) throw createValidationError("No request body");
 
-  const chunks: Uint8Array[] = [];
+  const blocks: Uint8Array[] = [];
+  let currentBlock: Uint8Array | null = null;
+  let currentBlockLength = 0;
+  let allocatedCapacity = 0;
   let totalSize = 0;
+  let chunksSinceYield = 0;
+  let consecutiveEmptyChunks = 0;
+  let abortReason: unknown;
+  const optionSignal = optionSnapshot.signal as AbortSignal | undefined;
+  const signal = optionSignal && optionSignal !== request.signal
+    ? AbortSignal.any([request.signal, optionSignal])
+    : request.signal;
+  const abort = (): void => {
+    abortReason = signal?.reason ?? new DOMException("The operation was aborted", "AbortError");
+    cancelReader(reader, abortReason);
+  };
+
+  if (signal?.aborted) abort();
+  else signal?.addEventListener("abort", abort, { once: true });
 
   try {
     while (true) {
+      if (abortReason !== undefined) throw abortReason;
       const { done, value } = await reader.read();
+      if (abortReason !== undefined) throw abortReason;
       if (done) break;
+      if (!(value instanceof Uint8Array)) {
+        const error = createValidationError(
+          "Request body stream produced a non-byte chunk",
+        );
+        cancelReader(reader, error);
+        throw error;
+      }
+
+      if (value.byteLength > maxSize - totalSize) {
+        const actualSize = totalSize + value.byteLength;
+        const error = createBodyTooLargeError(maxSize, actualSize, "stream");
+        cancelReader(reader, error);
+        throw error;
+      }
 
-      totalSize += value.length;
-      if (totalSize > maxSize) {
-        await reader.cancel().catch(() => undefined);
-        throw createValidationError(REQUEST_BODY_TOO_LARGE_DETAIL, {
-          maxSize,
-          bytesRead: totalSize,
-        });
+      chunksSinceYield++;
+      if (value.byteLength === 0) {
+        consecutiveEmptyChunks++;
+        if (consecutiveEmptyChunks > MAX_CONSECUTIVE_EMPTY_BODY_CHUNKS) {
+          const error = createValidationError(
+            "Request body stream made no progress",
+            { consecutiveEmptyChunks },
+          );
+          cancelReader(reader, error);
+          throw error;
+        }
+      } else {
+        consecutiveEmptyChunks = 0;
       }
 
-      chunks.push(value);
+      // A synchronously produced stream can otherwise monopolize the
+      // microtask queue and prevent its own abort/deadline timer from firing.
+      if (chunksSinceYield >= BODY_READ_YIELD_CHUNKS) {
+        chunksSinceYield = 0;
+        await yieldToTaskQueue();
+        if (abortReason !== undefined) throw abortReason;
+      }
+
+      if (value.byteLength === 0) continue;
+
+      totalSize += value.byteLength;
+      let valueOffset = 0;
+      while (valueOffset < value.byteLength) {
+        if (currentBlock === null) {
+          const nextCapacity = Math.min(
+            BODY_COALESCE_BLOCK_BYTES,
+            maxSize - allocatedCapacity,
+          );
+          currentBlock = new Uint8Array(nextCapacity);
+          allocatedCapacity += nextCapacity;
+        }
+
+        const copyLength = Math.min(
+          currentBlock.byteLength - currentBlockLength,
+          value.byteLength - valueOffset,
+        );
+        currentBlock.set(
+          value.subarray(valueOffset, valueOffset + copyLength),
+          currentBlockLength,
+        );
+        currentBlockLength += copyLength;
+        valueOffset += copyLength;
+
+        if (currentBlockLength === currentBlock.byteLength) {
+          blocks.push(currentBlock);
+          currentBlock = null;
+          currentBlockLength = 0;
+        }
+      }
     }
   } finally {
+    signal?.removeEventListener("abort", abort);
     reader.releaseLock();
   }
 
   const combined = new Uint8Array(totalSize);
   let offset = 0;
 
-  for (const chunk of chunks) {
-    combined.set(chunk, offset);
-    offset += chunk.length;
+  for (const block of blocks) {
+    combined.set(block, offset);
+    offset += block.byteLength;
+  }
+  if (currentBlock !== null && currentBlockLength > 0) {
+    combined.set(currentBlock.subarray(0, currentBlockLength), offset);
   }
 
-  return new TextDecoder().decode(combined);
+  return combined;
 }
diff --git a/src/security/input-validation/parsers.test.ts b/src/security/input-validation/parsers.test.ts
index 2be78c86f9..9603fb8a0a 100644
--- a/src/security/input-validation/parsers.test.ts
+++ b/src/security/input-validation/parsers.test.ts
@@ -2,8 +2,9 @@ import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { defineSchema } from "#veryfront/schemas/index.ts";
+import type { Schema } from "#veryfront/extensions/schema/index.ts";
 import { VeryfrontError } from "./errors.ts";
-import { parseJsonBody, parseQueryParams } from "./parsers.ts";
+import { parseFormData, parseJsonBody, parseQueryParams } from "./parsers.ts";
 
 describe("parseJsonBody", () => {
   const schema = defineSchema((v) =>
@@ -28,6 +29,30 @@ describe("parseJsonBody", () => {
     assertEquals(result, { name: "Alice", age: 30 });
   });
 
+  it("retains the sanitize option for compatibility", async () => {
+    const textSchema = defineSchema((v) => v.object({ value: v.string() }))();
+    const result = await parseJsonBody(
+      createJsonRequest(JSON.stringify({ value: "<b>&</b>" })),
+      textSchema,
+      { sanitize: true },
+    );
+
+    assertEquals(result, { value: "&lt;b&gt;&amp;&lt;&#x2F;b&gt;" });
+  });
+
+  it("rejects a non-boolean sanitize option", async () => {
+    await assertRejects(
+      () =>
+        parseJsonBody(
+          createJsonRequest(JSON.stringify({ name: "Alice", age: 30 })),
+          schema,
+          { sanitize: "yes" } as never,
+        ),
+      TypeError,
+      "sanitize must be a boolean",
+    );
+  });
+
   it("should reject request with wrong Content-Type", async () => {
     const request = new Request("http://localhost/test", {
       method: "POST",
@@ -79,6 +104,36 @@ describe("parseJsonBody", () => {
     );
   });
 
+  it("rejects malformed, overlong, and truncated UTF-8 JSON strings", async () => {
+    const encoder = new TextEncoder();
+    const prefix = encoder.encode('{"name":"');
+    const suffix = encoder.encode('","age":30}');
+
+    for (
+      const invalidBytes of [
+        new Uint8Array([0xc0, 0xaf]),
+        new Uint8Array([0x80]),
+        new Uint8Array([0xe2, 0x82]),
+      ]
+    ) {
+      const body = new Uint8Array(prefix.length + invalidBytes.length + suffix.length);
+      body.set(prefix);
+      body.set(invalidBytes, prefix.length);
+      body.set(suffix, prefix.length + invalidBytes.length);
+      const request = new Request("http://localhost/test", {
+        method: "POST",
+        body,
+        headers: { "content-type": "application/json" },
+      });
+
+      await assertRejects(
+        () => parseJsonBody(request, schema),
+        VeryfrontError,
+        "Invalid JSON",
+      );
+    }
+  });
+
   it("should throw ValidationError for schema mismatch", async () => {
     const request = createJsonRequest(
       JSON.stringify({ name: "Alice", age: "not-a-number" }),
@@ -100,6 +155,114 @@ describe("parseJsonBody", () => {
       "Validation failed",
     );
   });
+
+  it("rejects JSON trees beyond the bounded structural depth before schema traversal", async () => {
+    const anyJsonSchema = defineSchema((v) => v.unknown())();
+    const body = `${"[".repeat(130)}null${"]".repeat(130)}`;
+
+    await assertRejects(
+      () => parseJsonBody(createJsonRequest(body), anyJsonSchema),
+      VeryfrontError,
+      "JSON value exceeds structural limits",
+    );
+  });
+
+  it("rejects unknown and accessor-backed parser options", async () => {
+    let getterCalls = 0;
+    const options = {} as Record<string, unknown>;
+    Object.defineProperty(options, "limits", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return {};
+      },
+    });
+
+    await assertRejects(
+      () => parseJsonBody(createJsonRequest("{}"), schema, { unknown: true } as never),
+      TypeError,
+      "unsupported option",
+    );
+    await assertRejects(
+      () => parseJsonBody(createJsonRequest("{}"), schema, options as never),
+      TypeError,
+      "own data property",
+    );
+    assertEquals(getterCalls, 0);
+  });
+});
+
+describe("parseFormData", () => {
+  const schema = defineSchema((v) =>
+    v.object({
+      name: v.string(),
+    })
+  )();
+
+  it("parses a bounded URL-encoded form", async () => {
+    const request = new Request("http://localhost/form", {
+      method: "POST",
+      body: "name=Alice",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+    });
+
+    assertEquals(await parseFormData(request, schema), { name: "Alice" });
+  });
+
+  it("bounds a chunked form body before parsing it", async () => {
+    const request = new Request("http://localhost/form", {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode("name="));
+          controller.enqueue(new TextEncoder().encode("Alice"));
+          controller.close();
+        },
+      }),
+    });
+
+    await assertRejects(
+      () => parseFormData(request, schema, { limits: { maxBodySize: 5 } }),
+      VeryfrontError,
+      "exceeds size limit",
+    );
+  });
+
+  it("classifies malformed multipart bodies as validation failures", async () => {
+    const request = new Request("http://localhost/form", {
+      method: "POST",
+      body: "not-a-multipart-body",
+      headers: { "content-type": "multipart/form-data; boundary=missing" },
+    });
+
+    await assertRejects(
+      () => parseFormData(request, schema),
+      VeryfrontError,
+      "Invalid form data",
+    );
+  });
+
+  it("collects special form field names without changing the input prototype", async () => {
+    let captured: Record<string, unknown> | undefined;
+    const captureSchema = {
+      safeParse(data: unknown) {
+        captured = data as Record<string, unknown>;
+        return { success: true as const, data: captured };
+      },
+    } as unknown as Schema<Record<string, unknown>>;
+    const request = new Request("http://localhost/form", {
+      method: "POST",
+      body: "__proto__=safe",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+    });
+
+    await parseFormData(request, captureSchema);
+
+    assertEquals(Object.getPrototypeOf(captured!), null);
+    assertEquals(Object.hasOwn(captured!, "__proto__"), true);
+    assertEquals(captured!["__proto__"], "safe");
+  });
 });
 
 describe("parseQueryParams", () => {
@@ -147,4 +310,65 @@ describe("parseQueryParams", () => {
     const result = parseQueryParams(request, simpleSchema);
     assertEquals(result, { name: "alice" });
   });
+
+  it("treats __proto__ as data without mutating the collector prototype", () => {
+    let captured: Record<string, unknown> | undefined;
+    const captureSchema = {
+      safeParse(data: unknown) {
+        captured = data as Record<string, unknown>;
+        return { success: true as const, data: captured };
+      },
+    } as unknown as Schema<Record<string, unknown>>;
+    const request = new Request(
+      "http://localhost/search?__proto__=first&__proto__=second",
+    );
+
+    const result = parseQueryParams(request, captureSchema);
+
+    assertEquals(Object.getPrototypeOf(captured!), null);
+    assertEquals(Object.hasOwn(captured!, "__proto__"), true);
+    assertEquals(result["__proto__"], ["first", "second"]);
+  });
+
+  it("enforces UTF-8 URL limits for standalone query parsing", () => {
+    const request = new Request(`http://localhost/search?q=${"å".repeat(32)}`);
+
+    assertThrows(
+      () => parseQueryParams(request, schema, { limits: { maxUrlLength: 32 } }),
+      VeryfrontError,
+      "URL too long",
+    );
+  });
+
+  it("rejects unknown and accessor-backed query parser options", () => {
+    let getterCalls = 0;
+    const options = {} as Record<string, unknown>;
+    Object.defineProperty(options, "limits", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return {};
+      },
+    });
+
+    assertThrows(
+      () =>
+        parseQueryParams(new Request("http://localhost/search?q=test"), schema, {
+          unknown: true,
+        } as never),
+      TypeError,
+      "unsupported option",
+    );
+    assertThrows(
+      () =>
+        parseQueryParams(
+          new Request("http://localhost/search?q=test"),
+          schema,
+          options as never,
+        ),
+      TypeError,
+      "own data property",
+    );
+    assertEquals(getterCalls, 0);
+  });
 });
diff --git a/src/security/input-validation/parsers.ts b/src/security/input-validation/parsers.ts
index d3d84ca727..a3ea92457d 100644
--- a/src/security/input-validation/parsers.ts
+++ b/src/security/input-validation/parsers.ts
@@ -1,12 +1,68 @@
 import type { Schema } from "#veryfront/extensions/schema/index.ts";
+import { snapshotBoundedJsonValue } from "#veryfront/schemas/json-value.ts";
 import { createValidationError, VeryfrontError } from "./errors.ts";
-import { readBodyWithLimit, validateContentType, validateRequestLimits } from "./limits.ts";
 import { sanitizeData } from "./sanitizers.ts";
-import { DEFAULT_LIMITS, type ParseFormOptions, type ParseJsonOptions } from "./types.ts";
+import {
+  readBodyBytesWithLimit,
+  readBodyWithLimit,
+  validateContentType,
+  validateRequestLimits,
+} from "./limits.ts";
+import {
+  type ParseFormOptions,
+  type ParseJsonOptions,
+  type ParseQueryOptions,
+  type RequestLimits,
+} from "./types.ts";
 import * as nodeBuffer from "node:buffer";
 
 const FileCtor = globalThis.File ??
   (nodeBuffer as typeof nodeBuffer & { File: typeof File }).File;
+const PARSE_JSON_OPTION_KEYS = new Set(["limits", "sanitize"]);
+const PARSE_FORM_OPTION_KEYS = new Set(["limits"]);
+const PARSE_QUERY_OPTION_KEYS = new Set(["limits"]);
+
+function snapshotParserOptions(
+  value: unknown,
+  label: string,
+  allowedKeys: ReadonlySet<string>,
+): Readonly<Record<string, unknown>> {
+  if (value === undefined) return Object.freeze(Object.create(null));
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+  let prototype: object | null;
+  let keys: Array<string | symbol>;
+  try {
+    prototype = Object.getPrototypeOf(value);
+    keys = Reflect.ownKeys(value);
+  } catch {
+    throw new TypeError(`${label} could not be inspected safely`);
+  }
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const key of keys) {
+    if (typeof key !== "string" || !allowedKeys.has(key)) {
+      throw new TypeError(
+        `${label} contains an unsupported ${typeof key === "string" ? `option: ${key}` : "symbol"}`,
+      );
+    }
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(value, key);
+    } catch {
+      throw new TypeError(`${label}.${key} could not be inspected safely`);
+    }
+    if (!descriptor || !("value" in descriptor)) {
+      throw new TypeError(`${label}.${key} must be an own data property`);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  return Object.freeze(snapshot);
+}
 
 /** Parse and validate a JSON request body. */
 export async function parseJsonBody<T>(
@@ -14,12 +70,42 @@ export async function parseJsonBody<T>(
   schema: Schema<T>,
   options?: ParseJsonOptions,
 ): Promise<T> {
-  validateRequestLimits(request, options?.limits);
+  const snapshot = snapshotParserOptions(
+    options,
+    "JSON body parser options",
+    PARSE_JSON_OPTION_KEYS,
+  );
+  const limits = validateRequestLimits(request, snapshot.limits as RequestLimits | undefined);
+  const sanitize = snapshot.sanitize;
+  if (sanitize !== undefined && typeof sanitize !== "boolean") {
+    throw new TypeError("JSON body parser options.sanitize must be a boolean");
+  }
+
+  const result = await parseJsonBodyAfterRequestLimits(
+    request,
+    schema,
+    limits,
+  );
+  return sanitize === true ? sanitizeData(result) as T : result;
+}
+
+/**
+ * Parse JSON after the caller has applied `validateRequestLimits()`.
+ *
+ * @internal This keeps composite request boundaries from repeating the
+ * URL/header/content-length checks while preserving `parseJsonBody()` as a
+ * safe standalone API.
+ */
+export async function parseJsonBodyAfterRequestLimits<T>(
+  request: Request,
+  schema: Schema<T>,
+  limits: Required<RequestLimits>,
+): Promise<T> {
   validateContentType(request, "application/json");
 
   let data: unknown;
   try {
-    const text = await readBodyWithLimit(request, options?.limits?.maxBodySize);
+    const text = await readBodyWithLimit(request, limits.maxBodySize);
     data = JSON.parse(text);
   } catch (error) {
     if (error instanceof VeryfrontError && error.slug === "input-validation-failed") throw error;
@@ -29,11 +115,16 @@ export async function parseJsonBody<T>(
     });
   }
 
-  const result = schema.safeParse(data);
-  if (result.success) {
-    return options?.sanitize ? (sanitizeData(result.data) as T) : result.data;
+  const snapshot = snapshotBoundedJsonValue(data);
+  if (!snapshot.success) {
+    throw createValidationError("JSON value exceeds structural limits", {
+      path: snapshot.path,
+    });
   }
 
+  const result = schema.safeParse(snapshot.value);
+  if (result.success) return result.data;
+
   const issues = result.issues ?? [];
   throw createValidationError("Validation failed", {
     errors: issues.map((e) => ({
@@ -50,18 +141,41 @@ export async function parseFormData<T>(
   schema: Schema<T>,
   options?: ParseFormOptions,
 ): Promise<T> {
-  validateRequestLimits(request, options?.limits);
+  const snapshot = snapshotParserOptions(
+    options,
+    "Form body parser options",
+    PARSE_FORM_OPTION_KEYS,
+  );
+  const limits = validateRequestLimits(request, snapshot.limits as RequestLimits | undefined);
 
   validateContentType(request, ["multipart/form-data", "application/x-www-form-urlencoded"]);
 
-  const formData = await request.formData();
-  const data: Record<string, unknown> = {};
-  const maxFileSize = options?.limits?.maxFileSize ?? DEFAULT_LIMITS.maxFileSize;
+  let formData: FormData;
+  try {
+    const bytes = await readBodyBytesWithLimit(request, limits.maxBodySize);
+    const contentType = request.headers.get("content-type");
+    if (!contentType) {
+      throw createValidationError("Missing Content-Type header");
+    }
+    formData = await new Response(new Uint8Array(bytes), {
+      headers: { "content-type": contentType },
+    }).formData();
+  } catch (error) {
+    if (error instanceof VeryfrontError && error.slug === "input-validation-failed") throw error;
+    throw createValidationError("Invalid form data in request body", {
+      error: error instanceof Error ? error.message : "Parse error",
+    });
+  }
+
+  // Form field names are untrusted property keys. A null-prototype collector
+  // keeps special names such as "__proto__" from changing the object's
+  // prototype before the schema gets a chance to validate them.
+  const data: Record<string, unknown> = Object.create(null);
 
   for (const [key, value] of formData.entries()) {
-    if (value instanceof FileCtor && value.size > maxFileSize) {
+    if (value instanceof FileCtor && value.size > limits.maxFileSize) {
       throw createValidationError(`File ${key} too large`, {
-        maxSize: maxFileSize,
+        maxSize: limits.maxFileSize,
         actualSize: value.size,
       });
     }
@@ -77,16 +191,44 @@ export async function parseFormData<T>(
   });
 }
 
-/** Parse and validate query parameters from a request URL. */
-export function parseQueryParams<T>(request: Request, schema: Schema<T>): T {
+/** Parse and validate query parameters from a bounded request URL. */
+export function parseQueryParams<T>(
+  request: Request,
+  schema: Schema<T>,
+  options?: ParseQueryOptions,
+): T {
+  const snapshot = snapshotParserOptions(
+    options,
+    "Query parser options",
+    PARSE_QUERY_OPTION_KEYS,
+  );
+  validateRequestLimits(request, snapshot.limits as RequestLimits | undefined);
+  return parseQueryParamsAfterRequestLimits(request, schema);
+}
+
+/**
+ * Parse query parameters after the caller has applied `validateRequestLimits()`.
+ *
+ * @internal Composite request boundaries use this to avoid repeating URL and
+ * header validation.
+ */
+export function parseQueryParamsAfterRequestLimits<T>(request: Request, schema: Schema<T>): T {
   const url = new URL(request.url);
-  const params: Record<string, unknown> = {};
+  // Query names are untrusted property keys. In particular, reading then
+  // assigning "__proto__" on a normal object can mutate its prototype.
+  const params: Record<string, unknown> = Object.create(null);
 
   for (const [key, value] of url.searchParams) {
-    const existing = params[key];
-
-    if (existing === undefined) {
-      params[key] = value;
+    const descriptor = Object.getOwnPropertyDescriptor(params, key);
+    const existing = descriptor && "value" in descriptor ? descriptor.value : undefined;
+
+    if (!descriptor) {
+      Object.defineProperty(params, key, {
+        configurable: true,
+        enumerable: true,
+        writable: true,
+        value,
+      });
       continue;
     }
 
diff --git a/src/security/input-validation/sanitizers.test.ts b/src/security/input-validation/sanitizers.test.ts
index 0d21424316..0dd3a70733 100644
--- a/src/security/input-validation/sanitizers.test.ts
+++ b/src/security/input-validation/sanitizers.test.ts
@@ -1,291 +1,38 @@
 import "#veryfront/schemas/_test-setup.ts";
-/**
- * Sanitizers Tests
- *
- * Tests for XSS and prototype pollution prevention
- */
-
-import { describe, it } from "#veryfront/testing/bdd.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
+import { describe, it } from "#veryfront/testing/bdd.ts";
+import { sanitizeData as sanitizeDataFromRoot } from "../../index.ts";
+import { sanitizeData as sanitizeDataFromClient } from "../../index.client.ts";
+import { sanitizeData as sanitizeDataFromSecurity } from "../index.ts";
 import { sanitizeData } from "./sanitizers.ts";
 
-describe("sanitizeData", () => {
-  describe("string sanitization", () => {
-    it("should escape HTML entities", () => {
-      assertEquals(
-        sanitizeData("<script>alert('xss')</script>"),
-        "&lt;script&gt;alert(&#x27;xss&#x27;)&lt;&#x2F;script&gt;",
-      );
-    });
-
-    it("should escape ampersands", () => {
-      assertEquals(sanitizeData("foo & bar"), "foo &amp; bar");
-    });
-
-    it("should escape double quotes", () => {
-      assertEquals(sanitizeData('hello "world"'), "hello &quot;world&quot;");
-    });
-
-    it("should escape single quotes", () => {
-      assertEquals(sanitizeData("hello 'world'"), "hello &#x27;world&#x27;");
-    });
-
-    it("should escape forward slashes", () => {
-      assertEquals(sanitizeData("path/to/file"), "path&#x2F;to&#x2F;file");
-    });
-
-    it("should escape angle brackets", () => {
-      assertEquals(sanitizeData("1 < 2 > 0"), "1 &lt; 2 &gt; 0");
-    });
-
-    it("should handle empty strings", () => {
-      assertEquals(sanitizeData(""), "");
-    });
-
-    it("should handle strings without special characters", () => {
-      assertEquals(sanitizeData("hello world"), "hello world");
-    });
+describe("sanitizeData compatibility", () => {
+  it("is the same compatibility function through root, client, and security exports", () => {
+    assertEquals(sanitizeDataFromRoot, sanitizeData);
+    assertEquals(sanitizeDataFromClient, sanitizeData);
+    assertEquals(sanitizeDataFromSecurity, sanitizeData);
   });
 
-  describe("array sanitization", () => {
-    it("should sanitize all array elements", () => {
-      assertEquals(sanitizeData(["<b>", "<i>"]), ["&lt;b&gt;", "&lt;i&gt;"]);
-    });
-
-    it("should handle nested arrays", () => {
-      assertEquals(sanitizeData([["<a>"], ["<b>"]]), [
-        ["&lt;a&gt;"],
-        ["&lt;b&gt;"],
-      ]);
-    });
-
-    it("should handle empty arrays", () => {
-      assertEquals(sanitizeData([]), []);
-    });
-
-    it("should handle mixed type arrays", () => {
-      assertEquals(sanitizeData(["<script>", 123, true, null]), [
-        "&lt;script&gt;",
-        123,
-        true,
-        null,
-      ]);
-    });
-  });
-
-  describe("object sanitization", () => {
-    it("should sanitize object values", () => {
-      assertEquals(sanitizeData({ name: "<script>" }), {
-        name: "&lt;script&gt;",
-      });
-    });
-
-    it("should sanitize nested objects", () => {
-      assertEquals(
-        sanitizeData({
-          outer: { inner: "<b>test</b>" },
-        }),
-        {
-          outer: { inner: "&lt;b&gt;test&lt;&#x2F;b&gt;" },
-        },
-      );
-    });
-
-    it("should handle empty objects", () => {
-      assertEquals(sanitizeData({}), {});
-    });
-
-    it("should handle objects with arrays", () => {
-      assertEquals(
-        sanitizeData({
-          items: ["<a>", "<b>"],
-        }),
-        {
-          items: ["&lt;a&gt;", "&lt;b&gt;"],
-        },
-      );
-    });
-  });
-
-  describe("prototype pollution prevention", () => {
-    it("should remove __proto__ keys", () => {
-      const malicious = JSON.parse('{"__proto__": {"polluted": true}}');
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-
-      // Check __proto__ is not an own property (not that it's undefined - .__proto__ is always the prototype)
-      assertEquals(Object.hasOwn(result, "__proto__"), false);
-      assertEquals("polluted" in result, false);
-    });
-
-    it("should remove constructor keys", () => {
-      const malicious = { constructor: { value: "bad" } };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-      assertEquals(Object.hasOwn(result, "constructor"), false);
-    });
-
-    it("should remove prototype keys", () => {
-      const malicious = { prototype: { value: "bad" } };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-      assertEquals(Object.hasOwn(result, "prototype"), false);
-    });
-
-    it("should sanitize keys to alphanumeric, dots, underscores, hyphens", () => {
-      const result = sanitizeData({
-        normal_key: "value1",
-        "key.with.dots": "value2",
-        "key-with-hyphens": "value3",
-        "key$with%special": "value4",
-      }) as Record<string, unknown>;
-
-      assertEquals(result.normal_key, "value1");
-      assertEquals(result["key.with.dots"], "value2");
-      assertEquals(result["key-with-hyphens"], "value3");
-      assertEquals(result.keywithspecial, "value4");
-    });
-
-    it("should block uppercase __PROTO__ keys", () => {
-      const malicious = { __PROTO__: { polluted: true } };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-      assertEquals(Object.hasOwn(result, "__PROTO__"), false);
-    });
-
-    it("should block uppercase CONSTRUCTOR keys", () => {
-      const malicious = { CONSTRUCTOR: { value: "bad" } };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-      assertEquals(Object.hasOwn(result, "CONSTRUCTOR"), false);
-    });
-
-    it("should block keys containing __proto__ as substring", () => {
-      const malicious = {
-        __proto__polluted: "bad",
-        x__proto__: "bad",
-        foo__proto__bar: "bad",
-      };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-
-      assertEquals(Object.hasOwn(result, "__proto__polluted"), false);
-      assertEquals(Object.hasOwn(result, "x__proto__"), false);
-      assertEquals(Object.hasOwn(result, "foo__proto__bar"), false);
-    });
-
-    it("should block keys containing constructor as substring", () => {
-      const malicious = {
-        constructorPolluted: "bad",
-        myConstructor: "bad",
-      };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-
-      assertEquals(Object.hasOwn(result, "constructorPolluted"), false);
-      assertEquals(Object.hasOwn(result, "myConstructor"), false);
-    });
-
-    it("should block keys containing prototype as substring", () => {
-      const malicious = {
-        prototypeChain: "bad",
-        myPrototype: "bad",
-      };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-
-      assertEquals(Object.hasOwn(result, "prototypeChain"), false);
-      assertEquals(Object.hasOwn(result, "myPrototype"), false);
-    });
-
-    it("should block mixed case variations", () => {
-      const malicious = {
-        __PrOtO__: { polluted: true },
-        ConsTRUCtor: { value: "bad" },
-        PROTOtype: { value: "bad" },
-      };
-      const result = sanitizeData(malicious) as Record<string, unknown>;
-      assertEquals(Object.keys(result).length, 0);
-    });
-
-    it("should block Unicode homoglyph bypass attempts", () => {
-      // U+017F (long s) normalizes to 's' under NFKC, so "con\u017Ftructor"
-      // becomes "constructor" after normalize('NFKC').toLowerCase()
-      // Note: sanitizeKey strips non-word chars, but NFKC normalization
-      // converts these to ASCII equivalents before the strip.
-      const result1 = sanitizeData({
-        "con\u017Ftructor": { value: "bad" },
-      }) as Record<string, unknown>;
-      assertEquals(Object.keys(result1).length, 0);
-
-      // U+FF50 (fullwidth 'p') normalizes to 'p' under NFKC
-      const result2 = sanitizeData({
-        "\uFF50rototype": { value: "bad" },
-      }) as Record<string, unknown>;
-      assertEquals(Object.keys(result2).length, 0);
-    });
-
-    it("should produce null-prototype objects to prevent prototype chain attacks", () => {
-      const result = sanitizeData({ safe: "value" }) as Record<string, unknown>;
-      assertEquals(Object.getPrototypeOf(result), null);
-    });
-
-    it("should produce null-prototype objects in nested structures", () => {
-      const result = sanitizeData({
-        outer: { inner: "value" },
-      }) as Record<string, unknown>;
-      assertEquals(Object.getPrototypeOf(result), null);
-      assertEquals(
-        Object.getPrototypeOf(result.outer as Record<string, unknown>),
-        null,
-      );
+  it("HTML-encodes nested string values", () => {
+    assertEquals(sanitizeData({ values: ["<b>&</b>"] }), {
+      values: ["&lt;b&gt;&amp;&lt;&#x2F;b&gt;"],
     });
   });
 
-  describe("primitive passthrough", () => {
-    it("should pass through numbers unchanged", () => {
-      assertEquals(sanitizeData(42), 42);
-      assertEquals(sanitizeData(3.14), 3.14);
-      assertEquals(sanitizeData(-1), -1);
-    });
-
-    it("should pass through booleans unchanged", () => {
-      assertEquals(sanitizeData(true), true);
-      assertEquals(sanitizeData(false), false);
-    });
-
-    it("should pass through null unchanged", () => {
-      assertEquals(sanitizeData(null), null);
-    });
-
-    it("should pass through undefined unchanged", () => {
-      assertEquals(sanitizeData(undefined), undefined);
-    });
+  it("uses null-prototype objects and rejects prototype-chain keys", () => {
+    const value = sanitizeData(
+      JSON.parse('{"safe":"ok","__proto__":{"polluted":true},"constructor":"bad"}'),
+    ) as Record<string, unknown>;
+    assertEquals(Object.getPrototypeOf(value), null);
+    assertEquals(Object.keys(value), ["safe"]);
+    assertEquals(value.safe, "ok");
   });
 
-  describe("complex nested structures", () => {
-    it("should handle deeply nested structures", () => {
-      const input = {
-        level1: {
-          level2: {
-            level3: {
-              value: "<script>",
-            },
-          },
-        },
-      };
-
-      assertEquals(sanitizeData(input), {
-        level1: {
-          level2: {
-            level3: {
-              value: "&lt;script&gt;",
-            },
-          },
-        },
-      });
-    });
-
-    it("should handle mixed arrays and objects", () => {
-      const input = {
-        items: [{ name: "<a>" }, { name: "<b>" }],
-      };
-
-      assertEquals(sanitizeData(input), {
-        items: [{ name: "&lt;a&gt;" }, { name: "&lt;b&gt;" }],
-      });
-    });
+  it("normalizes Unicode before rejecting dangerous key homoglyphs", () => {
+    const value = sanitizeData({ "con\u017Ftructor": "bad", "\uFF50rototype": "bad" }) as Record<
+      string,
+      unknown
+    >;
+    assertEquals(Object.keys(value), []);
   });
 });
diff --git a/src/security/input-validation/sanitizers.ts b/src/security/input-validation/sanitizers.ts
index 76c09a384d..86516bda80 100644
--- a/src/security/input-validation/sanitizers.ts
+++ b/src/security/input-validation/sanitizers.ts
@@ -1,14 +1,19 @@
-/** Sanitize data to prevent XSS and prototype pollution attacks. */
+/**
+ * Sanitize JSON-like data by HTML-encoding string values and removing keys
+ * that can mutate an object's prototype chain.
+ *
+ * @deprecated Prefer contextual output encoding and schema validation. This
+ * compatibility API is retained because removing it requires a major release.
+ */
 export function sanitizeData(data: unknown): unknown {
   if (typeof data === "string") return sanitizeString(data);
   if (Array.isArray(data)) return data.map(sanitizeData);
   if (data == null || typeof data !== "object") return data;
-
   return sanitizeObject(data as Record<string, unknown>);
 }
 
-function sanitizeString(str: string): string {
-  return str
+function sanitizeString(value: string): string {
+  return value
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
     .replace(/>/g, "&gt;")
@@ -17,32 +22,23 @@ function sanitizeString(str: string): string {
     .replace(/\//g, "&#x2F;");
 }
 
-function sanitizeObject(obj: Record<string, unknown>): Record<string, unknown> {
+function sanitizeObject(value: Record<string, unknown>): Record<string, unknown> {
   const sanitized: Record<string, unknown> = Object.create(null);
-
-  for (const [key, value] of Object.entries(obj)) {
+  for (const [key, entry] of Object.entries(value)) {
     const safeKey = sanitizeKey(key);
     if (!isAllowedKey(safeKey)) continue;
-
-    sanitized[safeKey] = sanitizeData(value);
+    sanitized[safeKey] = sanitizeData(entry);
   }
-
   return sanitized;
 }
 
 function sanitizeKey(key: string): string {
-  // Normalize Unicode (NFKC) first so homoglyphs like U+017F (long s) or
-  // U+FF50 (fullwidth p) become their ASCII equivalents before stripping.
   return key.normalize("NFKC").replace(/[^\w.-]/g, "");
 }
 
 function isAllowedKey(key: string): boolean {
-  // Normalize Unicode (NFKC) before case-folding to prevent bypass via
-  // homoglyphs like U+017F (long s) or U+0131 (dotless i).
   const lower = key.normalize("NFKC").toLowerCase();
-  return (
-    !lower.includes("__proto__") &&
+  return !lower.includes("__proto__") &&
     !lower.includes("constructor") &&
-    !lower.includes("prototype")
-  );
+    !lower.includes("prototype");
 }
diff --git a/src/security/input-validation/types.ts b/src/security/input-validation/types.ts
index fca2b74af8..080e20be4c 100644
--- a/src/security/input-validation/types.ts
+++ b/src/security/input-validation/types.ts
@@ -12,15 +12,27 @@ export interface RequestLimits {
   maxFileSize?: number;
 }
 
-export const DEFAULT_LIMITS: Required<RequestLimits> = {
+/**
+ * Framework-owned request limits.
+ *
+ * Freeze the public value so importing code cannot silently weaken the
+ * process-wide defaults for later requests.
+ */
+export const DEFAULT_LIMITS: Readonly<Required<RequestLimits>> = Object.freeze({
   maxBodySize: DEFAULT_MAX_BODY_SIZE_BYTES,
   maxUrlLength: DEFAULT_MAX_URL_LENGTH_BYTES,
   maxHeaderSize: DEFAULT_MAX_HEADER_SIZE_BYTES,
   maxFileSize: DEFAULT_MAX_FILE_SIZE_BYTES,
-};
+});
 
 export interface ParseJsonOptions {
   limits?: RequestLimits;
+  /**
+   * HTML-encode string values in the validated result.
+   *
+   * @deprecated Prefer contextual output encoding. This option remains for
+   * compatibility with existing consumers.
+   */
   sanitize?: boolean;
 }
 
@@ -28,6 +40,10 @@ export interface ParseFormOptions {
   limits?: RequestLimits;
 }
 
+export interface ParseQueryOptions {
+  limits?: RequestLimits;
+}
+
 export interface ValidatedData<TBody = unknown, TQuery = unknown> {
   body?: TBody;
   query?: TQuery;
diff --git a/src/security/path-validation.test.ts b/src/security/path-validation.test.ts
index 9e1983c9d2..4176f061f7 100644
--- a/src/security/path-validation.test.ts
+++ b/src/security/path-validation.test.ts
@@ -8,26 +8,27 @@ import "#veryfront/schemas/_test-setup.ts";
 
 import { assertEquals, assertExists } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
+import { createMockAdapter } from "#veryfront/platform/adapters/mock.ts";
 import {
   createValidator,
   PathValidationError,
   sanitizePathForDisplay,
-  validatePathSync,
+  validateLexicalPath,
   ValidationPresets,
 } from "./path-validation.ts";
 
 describe("Path Validation - Basic Security", () => {
   const baseDir = "/project";
 
-  describe("validatePathSync()", () => {
+  describe("validateLexicalPath()", () => {
     it("should accept valid relative paths", () => {
-      const result = validatePathSync("app/page.tsx", { baseDir });
+      const result = validateLexicalPath("app/page.tsx", { baseDir });
       assertEquals(result.valid, true);
       assertExists(result.canonicalPath);
     });
 
     it("should accept valid paths in allowed directories", () => {
-      const result = validatePathSync("app/components/Button.tsx", {
+      const result = validateLexicalPath("app/components/Button.tsx", {
         baseDir,
         allowedDirs: ["app", "pages"],
       });
@@ -35,33 +36,33 @@ describe("Path Validation - Basic Security", () => {
     });
 
     it("should reject paths outside base directory", () => {
-      const result = validatePathSync("../../../etc/passwd", { baseDir });
+      const result = validateLexicalPath("../../../etc/passwd", { baseDir });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.OUTSIDE_BASE);
     });
 
     it("should reject paths with null bytes", () => {
-      const result = validatePathSync("app/page.tsx\0/../../etc/passwd", { baseDir });
+      const result = validateLexicalPath("app/page.tsx\0/../../etc/passwd", { baseDir });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.NULL_BYTE);
     });
 
     it("should reject excessively long paths", () => {
       const longPath = "a/".repeat(3000);
-      const result = validatePathSync(longPath, { baseDir });
+      const result = validateLexicalPath(longPath, { baseDir });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.PATH_TOO_LONG);
     });
 
     it("should reject excessive traversal depth", () => {
       const deepPath = "../".repeat(15) + "etc/passwd";
-      const result = validatePathSync(deepPath, { baseDir });
+      const result = validateLexicalPath(deepPath, { baseDir });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.EXCESSIVE_TRAVERSAL);
     });
 
     it("should reject paths not in allowlist", () => {
-      const result = validatePathSync("secret/data.txt", {
+      const result = validateLexicalPath("secret/data.txt", {
         baseDir,
         allowedDirs: ["app", "pages", "public"],
       });
@@ -70,41 +71,38 @@ describe("Path Validation - Basic Security", () => {
     });
 
     it("should normalize path with current directory references", () => {
-      const result = validatePathSync("./app/./page.tsx", { baseDir });
+      const result = validateLexicalPath("./app/./page.tsx", { baseDir });
       assertEquals(result.valid, true);
       assertEquals(result.canonicalPath, "/project/app/page.tsx");
     });
 
     it("should resolve parent directory references safely", () => {
-      const result = validatePathSync("app/../pages/index.tsx", { baseDir });
+      const result = validateLexicalPath("app/../pages/index.tsx", { baseDir });
       assertEquals(result.valid, true);
       assertEquals(result.canonicalPath, "/project/pages/index.tsx");
     });
   });
 
   describe("Absolute path handling", () => {
-    it("should reject absolute paths in strict mode", () => {
-      const result = validatePathSync("/etc/passwd", {
+    it("should reject absolute paths by default", () => {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir,
-        level: "strict",
       });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.ABSOLUTE_PATH_DENIED);
     });
 
-    it("should allow absolute paths in permissive mode", () => {
-      const result = validatePathSync("/project/app/page.tsx", {
+    it("should allow absolute paths when explicitly enabled", () => {
+      const result = validateLexicalPath("/project/app/page.tsx", {
         baseDir,
-        level: "permissive",
         allowAbsolute: true,
       });
       assertEquals(result.valid, true);
     });
 
     it("should validate absolute paths against base directory", () => {
-      const result = validatePathSync("/etc/passwd", {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir,
-        level: "permissive",
         allowAbsolute: true,
       });
       assertEquals(result.valid, false);
@@ -127,7 +125,7 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
     for (const { name, path } of testCases) {
       it(`should block: ${name}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
         assertEquals(result.valid, false, `Should block: ${path}`);
       });
     }
@@ -142,7 +140,7 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
     for (const { name, path } of testCases) {
       it(`should block: ${name}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
         assertEquals(result.valid, false, `Should block: ${path}`);
       });
     }
@@ -158,7 +156,7 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
     for (const { name, path } of testCases) {
       it(`should handle: ${name}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
 
         if (!result.valid) return;
         assertExists(result.canonicalPath);
@@ -176,7 +174,7 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
     for (const { name, path } of testCases) {
       it(`should block: ${name}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
         assertEquals(result.valid, false);
         assertEquals(result.code, PathValidationError.NULL_BYTE);
       });
@@ -193,7 +191,7 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
     for (const { name, path } of testCases) {
       it(`should handle: ${name}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
 
         if (result.valid) {
           assertExists(result.canonicalPath);
@@ -207,33 +205,33 @@ describe("Path Validation - OWASP Attack Vectors", () => {
 
   describe("Edge cases and special sequences", () => {
     it("should handle empty path", () => {
-      const result = validatePathSync("", { baseDir });
+      const result = validateLexicalPath("", { baseDir });
       assertEquals(result.valid, true);
       assertEquals(result.canonicalPath, baseDir);
     });
 
     it("should handle single dot", () => {
-      const result = validatePathSync(".", { baseDir });
+      const result = validateLexicalPath(".", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("should handle multiple slashes", () => {
-      const result = validatePathSync("app///page.tsx", { baseDir });
+      const result = validateLexicalPath("app///page.tsx", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("should handle trailing slash", () => {
-      const result = validatePathSync("app/", { baseDir });
+      const result = validateLexicalPath("app/", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("should handle spaces in path", () => {
-      const result = validatePathSync("app/my page.tsx", { baseDir });
+      const result = validateLexicalPath("app/my page.tsx", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("should handle unicode characters", () => {
-      const result = validatePathSync("app/ページ.tsx", { baseDir });
+      const result = validateLexicalPath("app/ページ.tsx", { baseDir });
       assertEquals(result.valid, true);
     });
   });
@@ -251,7 +249,7 @@ describe("Path Validation - Known CVE Patterns", () => {
 
     for (const path of testCases) {
       it(`should block CVE pattern: ${path}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
         assertEquals(result.valid, false);
       });
     }
@@ -266,7 +264,7 @@ describe("Path Validation - Known CVE Patterns", () => {
 
     for (const path of testCases) {
       it(`should block Zip Slip pattern: ${path}`, () => {
-        const result = validatePathSync(path, { baseDir });
+        const result = validateLexicalPath(path, { baseDir });
         assertEquals(result.valid, false);
       });
     }
@@ -283,9 +281,9 @@ describe("Path Validation - Presets", () => {
     assertEquals(options.allowAbsolute, false);
   });
 
-  it("build preset should be permissive", () => {
+  it("build preset should explicitly allow absolute paths and symlinks", () => {
     const options = ValidationPresets.build(baseDir);
-    assertEquals(options.level, "permissive");
+    assertEquals(options.level, "normal");
     assertEquals(options.allowAbsolute, true);
   });
 
@@ -301,6 +299,7 @@ describe("Path Validation - Helper Functions", () => {
       const validator = createValidator({
         baseDir: "/project",
         allowedDirs: ["app", "pages"],
+        adapter: createMockAdapter(),
       });
 
       const result = await validator("app/page.tsx");
@@ -311,6 +310,7 @@ describe("Path Validation - Helper Functions", () => {
       const validator = createValidator({
         baseDir: "/project",
         allowedDirs: ["app"],
+        adapter: createMockAdapter(),
       });
 
       const result = await validator("pages/index.tsx", {
@@ -341,22 +341,21 @@ describe("Path Validation - Helper Functions", () => {
 describe("Path Validation - Cross-platform", () => {
   describe("Windows paths", () => {
     it("should normalize backslashes to forward slashes", () => {
-      const result = validatePathSync("app\\page.tsx", { baseDir: "/project" });
+      const result = validateLexicalPath("app\\page.tsx", { baseDir: "/project" });
       assertEquals(result.valid, true);
       assertEquals(result.canonicalPath, "/project/app/page.tsx");
     });
 
     it("should handle mixed separators", () => {
-      const result = validatePathSync("app\\components/Button.tsx", {
+      const result = validateLexicalPath("app\\components/Button.tsx", {
         baseDir: "/project",
       });
       assertEquals(result.valid, true);
     });
 
     it("should detect Windows absolute paths", () => {
-      const result = validatePathSync("C:\\Windows\\System32", {
+      const result = validateLexicalPath("C:\\Windows\\System32", {
         baseDir: "/project",
-        level: "strict",
       });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.ABSOLUTE_PATH_DENIED);
@@ -365,16 +364,15 @@ describe("Path Validation - Cross-platform", () => {
 
   describe("Unix paths", () => {
     it("should handle Unix absolute paths", () => {
-      const result = validatePathSync("/etc/passwd", {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir: "/project",
-        level: "strict",
       });
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.ABSOLUTE_PATH_DENIED);
     });
 
     it("should normalize Unix paths correctly", () => {
-      const result = validatePathSync("./app/../pages/index.tsx", {
+      const result = validateLexicalPath("./app/../pages/index.tsx", {
         baseDir: "/project",
       });
       assertEquals(result.valid, true);
@@ -383,60 +381,54 @@ describe("Path Validation - Cross-platform", () => {
   });
 });
 
-describe("Path Validation - Security Levels", () => {
+describe("Path Validation - Lexical Policy", () => {
   const baseDir = "/project";
 
-  describe("Strict level", () => {
+  describe("default absolute-path policy", () => {
     it("should reject absolute paths", () => {
-      const result = validatePathSync("/etc/passwd", {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir,
-        level: "strict",
       });
       assertEquals(result.valid, false);
     });
 
-    it("should enforce allowlist strictly", () => {
-      const result = validatePathSync("lib/utils.ts", {
+    it("should enforce the configured allowlist", () => {
+      const result = validateLexicalPath("lib/utils.ts", {
         baseDir,
-        level: "strict",
         allowedDirs: ["app", "pages"],
       });
       assertEquals(result.valid, false);
     });
   });
 
-  describe("Normal level", () => {
+  describe("relative paths", () => {
     it("should allow paths in base directory", () => {
-      const result = validatePathSync("lib/utils.ts", {
+      const result = validateLexicalPath("lib/utils.ts", {
         baseDir,
-        level: "normal",
       });
       assertEquals(result.valid, true);
     });
 
     it("should still block traversal", () => {
-      const result = validatePathSync("../../../etc/passwd", {
+      const result = validateLexicalPath("../../../etc/passwd", {
         baseDir,
-        level: "normal",
       });
       assertEquals(result.valid, false);
     });
   });
 
-  describe("Permissive level", () => {
+  describe("absolute-path opt-in", () => {
     it("should allow absolute paths when enabled", () => {
-      const result = validatePathSync("/project/app/page.tsx", {
+      const result = validateLexicalPath("/project/app/page.tsx", {
         baseDir,
-        level: "permissive",
         allowAbsolute: true,
       });
       assertEquals(result.valid, true);
     });
 
     it("should still validate against base directory", () => {
-      const result = validatePathSync("/etc/passwd", {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir,
-        level: "permissive",
         allowAbsolute: true,
       });
       assertEquals(result.valid, false);
@@ -450,7 +442,7 @@ describe("Path Validation - Real-world scenarios", () => {
     const allowedDirs = ["public", "dist"];
 
     it("should allow public assets", () => {
-      const result = validatePathSync("public/images/logo.png", {
+      const result = validateLexicalPath("public/images/logo.png", {
         baseDir,
         allowedDirs,
       });
@@ -458,7 +450,7 @@ describe("Path Validation - Real-world scenarios", () => {
     });
 
     it("should allow dist assets", () => {
-      const result = validatePathSync("dist/_veryfront/chunk.js", {
+      const result = validateLexicalPath("dist/_veryfront/chunk.js", {
         baseDir,
         allowedDirs,
       });
@@ -466,7 +458,7 @@ describe("Path Validation - Real-world scenarios", () => {
     });
 
     it("should block access to source files", () => {
-      const result = validatePathSync("src/secret.ts", {
+      const result = validateLexicalPath("src/secret.ts", {
         baseDir,
         allowedDirs,
       });
@@ -474,7 +466,7 @@ describe("Path Validation - Real-world scenarios", () => {
     });
 
     it("should block traversal to parent", () => {
-      const result = validatePathSync("public/../../etc/passwd", {
+      const result = validateLexicalPath("public/../../etc/passwd", {
         baseDir,
         allowedDirs,
       });
@@ -487,7 +479,7 @@ describe("Path Validation - Real-world scenarios", () => {
     const allowedDirs = ["app", "pages"];
 
     it("should allow app routes", () => {
-      const result = validatePathSync("app/api/users/route.ts", {
+      const result = validateLexicalPath("app/api/users/route.ts", {
         baseDir,
         allowedDirs,
       });
@@ -495,7 +487,7 @@ describe("Path Validation - Real-world scenarios", () => {
     });
 
     it("should allow pages routes", () => {
-      const result = validatePathSync("pages/api/data.ts", {
+      const result = validateLexicalPath("pages/api/data.ts", {
         baseDir,
         allowedDirs,
       });
@@ -503,7 +495,7 @@ describe("Path Validation - Real-world scenarios", () => {
     });
 
     it("should block system files", () => {
-      const result = validatePathSync("../node_modules/evil/index.js", {
+      const result = validateLexicalPath("../node_modules/evil/index.js", {
         baseDir,
         allowedDirs,
       });
@@ -515,12 +507,12 @@ describe("Path Validation - Real-world scenarios", () => {
     const baseDir = "/project";
 
     it("should allow root config files", () => {
-      const result = validatePathSync("veryfront.config.ts", { baseDir });
+      const result = validateLexicalPath("veryfront.config.ts", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("should block access outside project", () => {
-      const result = validatePathSync("../other-project/config.ts", { baseDir });
+      const result = validateLexicalPath("../other-project/config.ts", { baseDir });
       assertEquals(result.valid, false);
     });
   });
@@ -531,7 +523,7 @@ describe("Path Validation - Performance", () => {
     const iterations = 10000;
 
     for (let i = 0; i < iterations; i++) {
-      const result = validatePathSync("app/page.tsx", { baseDir: "/project" });
+      const result = validateLexicalPath("app/page.tsx", { baseDir: "/project" });
       assertEquals(result.valid, true);
       assertEquals(result.canonicalPath, "/project/app/page.tsx");
     }
@@ -542,46 +534,49 @@ describe("Path Validation - Module Loading Context", () => {
   const baseDir = "/project";
 
   describe("without allowedImportDirs (default - max flexibility)", () => {
-    const allowedDirs: string[] = [];
-
     it("should allow imports from any directory in project", () => {
-      const result = validatePathSync("custom-folder/utils.ts", {
+      const result = validateLexicalPath("custom-folder/utils.ts", {
         baseDir,
-        allowedDirs,
       });
       assertEquals(result.valid, true);
     });
 
     it("should allow imports from src directory", () => {
-      const result = validatePathSync("src/components/Button.tsx", {
+      const result = validateLexicalPath("src/components/Button.tsx", {
         baseDir,
-        allowedDirs,
       });
       assertEquals(result.valid, true);
     });
 
     it("should allow imports from deeply nested paths", () => {
-      const result = validatePathSync("src/features/auth/hooks/useAuth.ts", {
+      const result = validateLexicalPath("src/features/auth/hooks/useAuth.ts", {
         baseDir,
-        allowedDirs,
       });
       assertEquals(result.valid, true);
     });
 
     it("should still block path traversal attacks", () => {
-      const result = validatePathSync("../../../etc/passwd", {
+      const result = validateLexicalPath("../../../etc/passwd", {
         baseDir,
-        allowedDirs,
       });
       assertEquals(result.valid, false);
     });
   });
 
+  it("treats an explicitly empty import allowlist as deny-all", () => {
+    const result = validateLexicalPath("src/components/Button.tsx", {
+      baseDir,
+      allowedDirs: [],
+    });
+    assertEquals(result.valid, false);
+    assertEquals(result.code, PathValidationError.NOT_IN_ALLOWLIST);
+  });
+
   describe("with allowedImportDirs (opt-in security)", () => {
     const restrictedDirs = ["app", "pages", "components", "lib", "src"];
 
     it("should allow imports from allowed directories", () => {
-      const result = validatePathSync("components/Button.tsx", {
+      const result = validateLexicalPath("components/Button.tsx", {
         baseDir,
         allowedDirs: restrictedDirs,
       });
@@ -589,7 +584,7 @@ describe("Path Validation - Module Loading Context", () => {
     });
 
     it("should allow imports from src directory when configured", () => {
-      const result = validatePathSync("src/utils/helpers.ts", {
+      const result = validateLexicalPath("src/utils/helpers.ts", {
         baseDir,
         allowedDirs: restrictedDirs,
       });
@@ -597,7 +592,7 @@ describe("Path Validation - Module Loading Context", () => {
     });
 
     it("should block imports from directories not in allowlist", () => {
-      const result = validatePathSync("secret/private-data.ts", {
+      const result = validateLexicalPath("secret/private-data.ts", {
         baseDir,
         allowedDirs: restrictedDirs,
       });
@@ -606,7 +601,7 @@ describe("Path Validation - Module Loading Context", () => {
     });
 
     it("should block imports from custom directories when restricted", () => {
-      const result = validatePathSync("custom-folder/utils.ts", {
+      const result = validateLexicalPath("custom-folder/utils.ts", {
         baseDir,
         allowedDirs: restrictedDirs,
       });
@@ -615,7 +610,7 @@ describe("Path Validation - Module Loading Context", () => {
     });
 
     it("should still block path traversal even from allowed dirs", () => {
-      const result = validatePathSync("app/../../etc/passwd", {
+      const result = validateLexicalPath("app/../../etc/passwd", {
         baseDir,
         allowedDirs: restrictedDirs,
       });
diff --git a/src/security/path-validation.ts b/src/security/path-validation.ts
index 8e8243f038..45b21f9e58 100644
--- a/src/security/path-validation.ts
+++ b/src/security/path-validation.ts
@@ -4,11 +4,14 @@ export {
   isAbsolutePath,
   isWithinDirectory,
   joinPaths,
+  type LexicalPathValidationOptions,
   normalizeSeparators,
   PathValidationError,
+  type PathValidationPolicyOptions,
   resolvePathSegments,
   sanitizePathForDisplay,
   validateAllowedDirs,
+  validateLexicalPath,
   validatePath,
   validatePathBasics,
   validatePathSync,
diff --git a/src/security/path-validation/canonical.test.ts b/src/security/path-validation/canonical.test.ts
index acc2bb2c89..bfc0e05ae1 100644
--- a/src/security/path-validation/canonical.test.ts
+++ b/src/security/path-validation/canonical.test.ts
@@ -1,83 +1,59 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
+import { createMockAdapter } from "#veryfront/platform/adapters/mock.ts";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { getCanonicalPath, validateAllowedDirs } from "./canonical.ts";
 import { PathValidationError } from "./types.ts";
 
+function createAdapterWithFs(
+  overrides: Partial<RuntimeAdapter["fs"]>,
+): RuntimeAdapter {
+  const adapter = createMockAdapter();
+  Object.assign(adapter.fs, overrides);
+  return adapter;
+}
+
 describe("security/path-validation/canonical", () => {
   describe("getCanonicalPath", () => {
-    it("should resolve path segments without adapter", async () => {
-      const { path, isSymlink } = await getCanonicalPath("/a/b/../c");
-      assertEquals(path, "/a/c");
-      assertEquals(isSymlink, false);
-    });
-
-    it("should resolve dot segments", async () => {
-      const { path, isSymlink } = await getCanonicalPath("/a/./b/./c");
-      assertEquals(path, "/a/b/c");
-      assertEquals(isSymlink, false);
-    });
-
-    it("should return isSymlink false when followSymlinks is false", async () => {
-      const { isSymlink } = await getCanonicalPath("/some/path", undefined, false);
-      assertEquals(isSymlink, false);
-    });
-
-    it("should return isSymlink false when adapter is undefined", async () => {
-      const { isSymlink } = await getCanonicalPath("/some/path", undefined, true);
-      assertEquals(isSymlink, false);
+    it("requires a runtime adapter instead of degrading to lexical resolution", async () => {
+      await assertRejects(
+        () => getCanonicalPath("/a/b/../c", undefined as never),
+        TypeError,
+        "requires a runtime adapter",
+      );
     });
 
     it("should detect symlinks via adapter.fs.lstat", async () => {
       // lstat (not stat) is the correct symlink detector: stat() follows the
       // link and always reports isSymlink:false, so detection must use lstat.
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          lstat: (_path: string) =>
-            Promise.resolve({
-              isSymlink: true,
-              isDirectory: false,
-              isFile: true,
-              size: 0,
-            }),
-        },
-      };
-
-      const { isSymlink } = await getCanonicalPath("/some/path", mockAdapter, true);
+      const mockAdapter = createAdapterWithFs({
+        lstat: (_path: string) =>
+          Promise.resolve({
+            isSymlink: true,
+            isDirectory: false,
+            isFile: true,
+            size: 0,
+            mtime: null,
+          }),
+      });
+
+      const { isSymlink } = await getCanonicalPath("/some/path", mockAdapter);
       assertEquals(isSymlink, true);
     });
 
-    it("should fall back gracefully when adapter.fs.stat throws", async () => {
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          stat: () => Promise.reject(new Error("not found")),
-        },
-      };
-
-      const { path, isSymlink } = await getCanonicalPath("/some/path", mockAdapter, true);
-      assertEquals(path, "/some/path");
-      assertEquals(isSymlink, false);
-    });
-
-    it("should handle relative paths", async () => {
-      const { path } = await getCanonicalPath("a/b/../c");
-      assertEquals(path, "a/c");
-    });
-
     it("should resolve the nearest existing ancestor for a missing target", async () => {
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          realPath: (path: string) => {
-            if (path === "/project/link/new.txt") {
-              return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
-            }
-            if (path === "/project/link") {
-              return Promise.resolve("/outside");
-            }
-            return Promise.reject(new Error(`unexpected path: ${path}`));
-          },
+      const mockAdapter = createAdapterWithFs({
+        realPath: (path: string) => {
+          if (path === "/project/link/new.txt") {
+            return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
+          }
+          if (path === "/project/link") {
+            return Promise.resolve("/outside");
+          }
+          return Promise.reject(new Error(`unexpected path: ${path}`));
         },
-      };
+      });
 
       const result = await getCanonicalPath("/project/link/new.txt", mockAdapter);
 
@@ -95,9 +71,9 @@ describe("security/path-validation/canonical", () => {
         await Deno.mkdir(`${outsideDir}/child`, { recursive: true });
         await Deno.symlink(`${outsideDir}/child`, `${baseDir}/link`);
 
-        const adapter: Parameters<typeof getCanonicalPath>[1] = {
-          fs: { realPath: (path: string) => Deno.realPath(path) },
-        };
+        const adapter = createAdapterWithFs({
+          realPath: (path: string) => Deno.realPath(path),
+        });
         const physicalParent = await Deno.realPath(`${baseDir}/link/..`);
         const result = await getCanonicalPath(`${baseDir}/link/../new.txt`, adapter);
 
@@ -109,15 +85,13 @@ describe("security/path-validation/canonical", () => {
 
     it("should preserve the root while walking a missing Windows drive path", async () => {
       const candidates: string[] = [];
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          realPath: (path: string) => {
-            candidates.push(path);
-            if (path === "C:/") return Promise.resolve("C:/");
-            return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
-          },
+      const mockAdapter = createAdapterWithFs({
+        realPath: (path: string) => {
+          candidates.push(path);
+          if (path === "C:/") return Promise.resolve("C:/");
+          return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
         },
-      };
+      });
 
       const result = await getCanonicalPath("C:/project/new.txt", mockAdapter);
 
@@ -126,12 +100,10 @@ describe("security/path-validation/canonical", () => {
     });
 
     it("should propagate realPath errors other than not found", async () => {
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          realPath: () =>
-            Promise.reject(Object.assign(new Error("permission denied"), { code: "EACCES" })),
-        },
-      };
+      const mockAdapter = createAdapterWithFs({
+        realPath: () =>
+          Promise.reject(Object.assign(new Error("permission denied"), { code: "EACCES" })),
+      });
 
       await assertRejects(
         () => getCanonicalPath("/project/file.txt", mockAdapter),
@@ -141,12 +113,10 @@ describe("security/path-validation/canonical", () => {
     });
 
     it("should propagate lstat errors other than not found", async () => {
-      const mockAdapter: Parameters<typeof getCanonicalPath>[1] = {
-        fs: {
-          lstat: () =>
-            Promise.reject(Object.assign(new Error("permission denied"), { code: "EACCES" })),
-        },
-      };
+      const mockAdapter = createAdapterWithFs({
+        lstat: () =>
+          Promise.reject(Object.assign(new Error("permission denied"), { code: "EACCES" })),
+      });
 
       await assertRejects(
         () => getCanonicalPath("/project/file.txt", mockAdapter),
@@ -158,10 +128,16 @@ describe("security/path-validation/canonical", () => {
 
   describe("validateAllowedDirs", () => {
     it("should return valid when path is within base and no allowedDirs", () => {
-      const { valid } = validateAllowedDirs("/project/src/file.ts", "/project", []);
+      const { valid } = validateAllowedDirs("/project/src/file.ts", "/project", undefined);
       assertEquals(valid, true);
     });
 
+    it("should treat an explicit empty allowlist as deny-all", () => {
+      const { valid, code } = validateAllowedDirs("/project/src/file.ts", "/project", []);
+      assertEquals(valid, false);
+      assertEquals(code, PathValidationError.NOT_IN_ALLOWLIST);
+    });
+
     it("should return invalid when path is outside base directory", () => {
       const { valid, code } = validateAllowedDirs("/other/file.ts", "/project", []);
       assertEquals(valid, false);
diff --git a/src/security/path-validation/canonical.ts b/src/security/path-validation/canonical.ts
index 50c191792c..5f33ea1cbf 100644
--- a/src/security/path-validation/canonical.ts
+++ b/src/security/path-validation/canonical.ts
@@ -5,7 +5,7 @@
 
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { isNotFoundError } from "#veryfront/platform/compat/fs.ts";
-import { basename, dirname, join } from "#veryfront/compat/path/index.ts";
+import { basename, dirname, join, relative } from "#veryfront/compat/path/index.ts";
 
 import { isWithinDirectory, normalizeSeparators, resolvePathSegments } from "./normalization.ts";
 import { PathValidationError, type ValidationResult } from "./types.ts";
@@ -66,13 +66,12 @@ async function resolveThroughExistingAncestor(
 
 export async function getCanonicalPath(
   path: string,
-  adapter?: RuntimeAdapter,
-  _followSymlinks = false,
+  adapter: RuntimeAdapter,
 ): Promise<{ path: string; isSymlink: boolean }> {
   const resolvedPath = resolvePathSegments(path);
 
-  if (!adapter) {
-    return { path: resolvedPath, isSymlink: false };
+  if (typeof adapter !== "object" || adapter === null) {
+    throw new TypeError("Physical canonicalization requires a runtime adapter");
   }
 
   const fs = adapter.fs;
@@ -96,12 +95,10 @@ export async function getCanonicalPath(
   // the unresolved suffix. Calling realPath() only on the full target would fail
   // with ENOENT and let a symlinked parent escape via the lexical fallback.
   //
-  // Residual gap: adapters that expose neither realPath nor lstat (virtual/remote
-  // filesystems — Veryfront API, GitHub — which have no OS-level symlinks) fall
-  // back to the lexical path. Those filesystems cannot express an OS symlink
-  // escape, so the lexical containment check remains sufficient there. A
-  // hypothetical local-disk adapter lacking realPath would retain the pre-fix
-  // lexical-only behavior for intermediate-symlink escapes.
+  // validatePath() admits this lexical fallback only for adapters that
+  // explicitly declare symlink-free storage, or when lstat is sufficient for
+  // a no-follow policy. Direct callers use this helper only for resolution and
+  // must apply their own capability policy.
   if (typeof fs.realPath === "function") {
     const real = await resolveThroughExistingAncestor(
       normalizeSeparators(path),
@@ -115,6 +112,41 @@ export async function getCanonicalPath(
   return { path: resolvedPath, isSymlink };
 }
 
+/**
+ * Detect a terminal or intermediate symlink below a trusted lexical root.
+ * The root itself is excluded: callers separately canonicalize it so a
+ * deployment path such as macOS `/var` may legitimately resolve elsewhere.
+ */
+export async function pathTraversesSymlink(
+  path: string,
+  baseDir: string,
+  adapter: RuntimeAdapter,
+): Promise<boolean> {
+  const fs = adapter.fs;
+  const lstat = fs.lstat;
+  if (!lstat) return false;
+
+  const normalizedBase = resolvePathSegments(normalizeSeparators(baseDir));
+  const normalizedPath = resolvePathSegments(normalizeSeparators(path));
+  if (!isWithinDirectory(normalizedBase, normalizedPath)) return false;
+
+  const relativePath = normalizeSeparators(relative(normalizedBase, normalizedPath));
+  if (!relativePath || relativePath === ".") return false;
+
+  let candidate = normalizedBase;
+  for (const segment of relativePath.split("/")) {
+    if (!segment || segment === ".") continue;
+    candidate = join(candidate, segment);
+    try {
+      if ((await lstat.call(fs, candidate)).isSymlink) return true;
+    } catch (error) {
+      if (isNotFoundError(error)) return false;
+      throw error;
+    }
+  }
+  return false;
+}
+
 /**
  * Resolve the base directory to its physical form so that a physically-resolved
  * candidate path is compared against a physically-resolved base. Without this,
@@ -125,10 +157,10 @@ export async function getCanonicalPath(
  */
 export async function getCanonicalBaseDir(
   baseDir: string,
-  adapter?: RuntimeAdapter,
+  adapter: RuntimeAdapter,
 ): Promise<string> {
-  const fs = adapter?.fs;
-  if (fs && typeof fs.realPath === "function") {
+  const fs = adapter.fs;
+  if (typeof fs.realPath === "function") {
     try {
       return normalizeSeparators(await fs.realPath(baseDir));
     } catch (error) {
@@ -142,7 +174,7 @@ export async function getCanonicalBaseDir(
 export function validateAllowedDirs(
   canonicalPath: string,
   baseDir: string,
-  allowedDirs: string[],
+  allowedDirs: string[] | undefined,
 ): ValidationResult {
   const normalizedBase = resolvePathSegments(normalizeSeparators(baseDir)).replace(/\/$/, "");
   const normalizedPath = resolvePathSegments(normalizeSeparators(canonicalPath)).replace(/\/$/, "");
@@ -150,12 +182,12 @@ export function validateAllowedDirs(
   if (!isWithinDirectory(normalizedBase, normalizedPath)) {
     return {
       valid: false,
-      error: `Path is outside base directory: ${baseDir}`,
+      error: "Path is outside base directory",
       code: PathValidationError.OUTSIDE_BASE,
     };
   }
 
-  if (!allowedDirs?.length || normalizedPath === normalizedBase) {
+  if (allowedDirs === undefined || normalizedPath === normalizedBase) {
     return { valid: true, canonicalPath };
   }
 
@@ -165,7 +197,9 @@ export function validateAllowedDirs(
   if (!topLevelDir || !allowedDirs.includes(topLevelDir)) {
     return {
       valid: false,
-      error: `Access to directory '${topLevelDir}' not allowed. Allowed: ${allowedDirs.join(", ")}`,
+      error: allowedDirs.length === 0
+        ? `Access to directory '${topLevelDir}' not allowed: directory allowlist is empty`
+        : `Access to directory '${topLevelDir}' not allowed. Allowed: ${allowedDirs.join(", ")}`,
       code: PathValidationError.NOT_IN_ALLOWLIST,
     };
   }
diff --git a/src/security/path-validation/index.test.ts b/src/security/path-validation/index.test.ts
index b79fad4f61..51f6a83c1b 100644
--- a/src/security/path-validation/index.test.ts
+++ b/src/security/path-validation/index.test.ts
@@ -1,20 +1,36 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
+import { assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
+import { createMockAdapter } from "#veryfront/platform/adapters/mock.ts";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
+import { DenoAdapter } from "#veryfront/platform/adapters/runtime/deno/adapter.ts";
 import {
   createValidator,
   sanitizePathForDisplay,
+  validateLexicalPath,
   validatePath,
   validatePathSync,
+  ValidationPresets,
 } from "./index.ts";
 import { PathValidationError } from "./types.ts";
 
+function createAdapterWithFs(
+  overrides: Partial<RuntimeAdapter["fs"]>,
+): RuntimeAdapter {
+  const adapter = createMockAdapter();
+  Object.assign(adapter.fs, overrides);
+  return adapter;
+}
+
 describe("security/path-validation/index", () => {
   describe("validatePath", () => {
+    const adapter = createMockAdapter();
+
     it("should accept a valid relative path within base", async () => {
       const result = await validatePath("src/file.ts", {
         baseDir: "/project",
         allowedDirs: ["src"],
+        adapter,
       });
 
       assertEquals(result.valid, true);
@@ -22,17 +38,21 @@ describe("security/path-validation/index", () => {
     });
 
     it("should reject paths with null bytes", async () => {
-      const result = await validatePath("src/\0evil.ts", { baseDir: "/project" });
+      const result = await validatePath("src/\0evil.ts", {
+        baseDir: "/project",
+        adapter,
+      });
 
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.NULL_BYTE);
     });
 
-    it("should reject absolute paths in strict mode when allowAbsolute is false", async () => {
+    it("should reject absolute paths whenever allowAbsolute is false", async () => {
       const result = await validatePath("/etc/passwd", {
         baseDir: "/project",
         level: "strict",
         allowAbsolute: false,
+        adapter,
       });
 
       assertEquals(result.valid, false);
@@ -45,24 +65,28 @@ describe("security/path-validation/index", () => {
         level: "strict",
         allowAbsolute: true,
         allowedDirs: ["src"],
+        adapter,
       });
 
       assertEquals(result.valid, true);
     });
 
-    it("should allow absolute paths in normal mode even without allowAbsolute", async () => {
+    it("should reject absolute paths in normal mode unless explicitly enabled", async () => {
       const result = await validatePath("/project/src/file.ts", {
         baseDir: "/project",
         level: "normal",
         allowedDirs: ["src"],
+        adapter,
       });
 
-      assertEquals(result.valid, true);
+      assertEquals(result.valid, false);
+      assertEquals(result.code, PathValidationError.ABSOLUTE_PATH_DENIED);
     });
 
     it("should reject paths outside base directory", async () => {
       const result = await validatePath("../../etc/passwd", {
         baseDir: "/project",
+        adapter,
       });
 
       assertEquals(result.valid, false);
@@ -70,18 +94,17 @@ describe("security/path-validation/index", () => {
     });
 
     it("should reject symlinks in strict mode", async () => {
-      const mockAdapter: Parameters<typeof validatePath>[1]["adapter"] = {
-        fs: {
-          // lstat detects the link itself; stat() would follow it and hide it.
-          lstat: (_path: string) =>
-            Promise.resolve({
-              isSymlink: true,
-              isDirectory: false,
-              isFile: true,
-              size: 0,
-            }),
-        },
-      };
+      const mockAdapter = createAdapterWithFs({
+        // lstat detects the link itself; stat() would follow it and hide it.
+        lstat: (_path: string) =>
+          Promise.resolve({
+            isSymlink: true,
+            isDirectory: false,
+            isFile: true,
+            size: 0,
+            mtime: null,
+          }),
+      });
 
       const result = await validatePath("src/link.ts", {
         baseDir: "/project",
@@ -95,12 +118,122 @@ describe("security/path-validation/index", () => {
       assertEquals(result.code, PathValidationError.SYMLINK_DETECTED);
     });
 
+    it("fails closed when an adapter cannot prove no-follow symlink semantics", async () => {
+      const adapter = createMockAdapter();
+      Reflect.deleteProperty(adapter.fs, "symlinkSemantics");
+
+      const result = await validatePath("src/file.ts", {
+        baseDir: "/project",
+        adapter,
+        followSymlinks: false,
+      });
+
+      assertEquals(result.valid, false);
+      assertEquals(result.code, PathValidationError.SYMLINK_CAPABILITY_REQUIRED);
+    });
+
+    it("requires lstat for strict validation even when realPath is available", async () => {
+      const adapter = createAdapterWithFs({
+        realPath: (path: string) => Promise.resolve(path),
+      });
+      Reflect.deleteProperty(adapter.fs, "symlinkSemantics");
+
+      const result = await validatePath("src/file.ts", {
+        baseDir: "/project",
+        level: "strict",
+        adapter,
+        allowAbsolute: false,
+      });
+
+      assertEquals(result.valid, false);
+      assertEquals(result.code, PathValidationError.SYMLINK_CAPABILITY_REQUIRED);
+    });
+
+    it("requires realPath before an adapter may follow symlinks", async () => {
+      const adapter = createAdapterWithFs({
+        lstat: () =>
+          Promise.resolve({
+            isSymlink: false,
+            isDirectory: false,
+            isFile: true,
+            size: 0,
+            mtime: null,
+          }),
+      });
+      Reflect.deleteProperty(adapter.fs, "symlinkSemantics");
+
+      const result = await validatePath("src/file.ts", {
+        baseDir: "/project",
+        adapter,
+        followSymlinks: true,
+      });
+
+      assertEquals(result.valid, false);
+      assertEquals(result.code, PathValidationError.SYMLINK_CAPABILITY_REQUIRED);
+    });
+
+    it("accepts lexical validation only with an explicit symlink-free marker", async () => {
+      const adapter = createMockAdapter();
+
+      const result = await validatePath("src/file.ts", {
+        baseDir: "/project",
+        adapter,
+        followSymlinks: false,
+      });
+
+      assertEquals(result.valid, true);
+      assertEquals(result.canonicalPath, "/project/src/file.ts");
+    });
+
+    it("fails closed without a filesystem adapter, including physical presets", async () => {
+      for (
+        const options of [
+          { baseDir: "/project" },
+          ValidationPresets.userInput("/project"),
+          ValidationPresets.static("/project"),
+        ]
+      ) {
+        const result = await validatePath("src/file.ts", options as never);
+        assertEquals(result.valid, false);
+        assertEquals(result.code, PathValidationError.INVALID_PATH);
+      }
+    });
+
+    it("enforces followSymlinks for intermediate links inside the trust root", async () => {
+      if (Deno.build.os === "windows") return;
+
+      const baseDir = await Deno.makeTempDir();
+      try {
+        await Deno.mkdir(`${baseDir}/target`);
+        await Deno.writeTextFile(`${baseDir}/target/file.ts`, "export {};");
+        await Deno.symlink(`${baseDir}/target`, `${baseDir}/link`);
+        const adapter = new DenoAdapter();
+
+        const denied = await validatePath("link/file.ts", {
+          baseDir,
+          level: "normal",
+          followSymlinks: false,
+          adapter,
+        });
+        const allowed = await validatePath("link/file.ts", {
+          baseDir,
+          level: "normal",
+          followSymlinks: true,
+          adapter,
+        });
+
+        assertEquals(denied.code, PathValidationError.SYMLINK_DETECTED);
+        assertEquals(allowed.valid, true);
+        assertEquals(allowed.canonicalPath, await Deno.realPath(`${baseDir}/target/file.ts`));
+      } finally {
+        await Deno.remove(baseDir, { recursive: true });
+      }
+    });
+
     it("should reject when file not found and checkExists is true", async () => {
-      const mockAdapter: Parameters<typeof validatePath>[1]["adapter"] = {
-        fs: {
-          stat: () => Promise.reject(new Error("ENOENT")),
-        },
-      };
+      const mockAdapter = createAdapterWithFs({
+        stat: () => Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" })),
+      });
 
       const result = await validatePath("src/missing.ts", {
         baseDir: "/project",
@@ -114,10 +247,31 @@ describe("security/path-validation/index", () => {
       assertEquals(result.code, PathValidationError.FILE_NOT_FOUND);
     });
 
+    it("propagates filesystem failures that are not not-found errors", async () => {
+      const mockAdapter = createAdapterWithFs({
+        stat: () =>
+          Promise.reject(Object.assign(new Error("permission denied"), { code: "EACCES" })),
+      });
+
+      await assertRejects(
+        () =>
+          validatePath("src/private.ts", {
+            baseDir: "/project",
+            level: "normal",
+            checkExists: true,
+            adapter: mockAdapter,
+            allowedDirs: ["src"],
+          }),
+        Error,
+        "permission denied",
+      );
+    });
+
     it("should enforce allowedDirs restriction", async () => {
       const result = await validatePath("secret/data.ts", {
         baseDir: "/project",
         allowedDirs: ["src", "lib"],
+        adapter,
       });
 
       assertEquals(result.valid, false);
@@ -127,6 +281,7 @@ describe("security/path-validation/index", () => {
     it("should pass when no allowedDirs restriction is set", async () => {
       const result = await validatePath("anything/file.ts", {
         baseDir: "/project",
+        adapter,
       });
 
       assertEquals(result.valid, true);
@@ -136,6 +291,7 @@ describe("security/path-validation/index", () => {
       const result = await validatePath("src/../lib/file.ts", {
         baseDir: "/project",
         allowedDirs: ["lib"],
+        adapter,
       });
 
       assertEquals(result.valid, true);
@@ -143,22 +299,20 @@ describe("security/path-validation/index", () => {
     });
 
     it("should reject a missing target beneath a symlinked parent outside the base", async () => {
-      const mockAdapter: Parameters<typeof validatePath>[1]["adapter"] = {
-        fs: {
-          realPath: (path: string) => {
-            if (path === "/project/link/new.txt") {
-              return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
-            }
-            if (path === "/project/link") {
-              return Promise.resolve("/outside");
-            }
-            if (path === "/project") {
-              return Promise.resolve("/project");
-            }
-            return Promise.reject(new Error(`unexpected path: ${path}`));
-          },
+      const mockAdapter = createAdapterWithFs({
+        realPath: (path: string) => {
+          if (path === "/project/link/new.txt") {
+            return Promise.reject(Object.assign(new Error("missing"), { code: "ENOENT" }));
+          }
+          if (path === "/project/link") {
+            return Promise.resolve("/outside");
+          }
+          if (path === "/project") {
+            return Promise.resolve("/project");
+          }
+          return Promise.reject(new Error(`unexpected path: ${path}`));
         },
-      };
+      });
 
       const result = await validatePath("link/new.txt", {
         baseDir: "/project",
@@ -168,11 +322,35 @@ describe("security/path-validation/index", () => {
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.OUTSIDE_BASE);
     });
+
+    it("rejects unknown, inherited, and accessor-backed options without invoking accessors", async () => {
+      let getterCalls = 0;
+      const accessorOptions = { baseDir: "/project" } as Record<string, unknown>;
+      Object.defineProperty(accessorOptions, "allowedDirs", {
+        enumerable: true,
+        get() {
+          getterCalls++;
+          return ["src"];
+        },
+      });
+
+      for (
+        const options of [
+          { baseDir: "/project", unknown: true },
+          Object.create({ baseDir: "/project" }),
+          accessorOptions,
+        ]
+      ) {
+        const result = await validatePath("src/file.ts", options as never);
+        assertEquals(result.code, PathValidationError.INVALID_PATH);
+      }
+      assertEquals(getterCalls, 0);
+    });
   });
 
-  describe("validatePathSync", () => {
+  describe("validateLexicalPath", () => {
     it("should accept a valid relative path within base", () => {
-      const result = validatePathSync("src/file.ts", {
+      const result = validateLexicalPath("src/file.ts", {
         baseDir: "/project",
         allowedDirs: ["src"],
       });
@@ -181,16 +359,15 @@ describe("security/path-validation/index", () => {
     });
 
     it("should reject paths with null bytes", () => {
-      const result = validatePathSync("src/\0evil.ts", { baseDir: "/project" });
+      const result = validateLexicalPath("src/\0evil.ts", { baseDir: "/project" });
 
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.NULL_BYTE);
     });
 
-    it("should reject absolute paths in strict mode", () => {
-      const result = validatePathSync("/etc/passwd", {
+    it("should reject absolute paths unless explicitly enabled", () => {
+      const result = validateLexicalPath("/etc/passwd", {
         baseDir: "/project",
-        level: "strict",
         allowAbsolute: false,
       });
 
@@ -199,7 +376,7 @@ describe("security/path-validation/index", () => {
     });
 
     it("should enforce allowedDirs", () => {
-      const result = validatePathSync("secret/data.ts", {
+      const result = validateLexicalPath("secret/data.ts", {
         baseDir: "/project",
         allowedDirs: ["src"],
       });
@@ -209,7 +386,7 @@ describe("security/path-validation/index", () => {
     });
 
     it("should reject paths outside base directory", () => {
-      const result = validatePathSync("../../etc/passwd", {
+      const result = validateLexicalPath("../../etc/passwd", {
         baseDir: "/project",
       });
 
@@ -218,12 +395,69 @@ describe("security/path-validation/index", () => {
     });
 
     it("should accept paths with no allowedDirs", () => {
-      const result = validatePathSync("anything/file.ts", {
+      const result = validateLexicalPath("anything/file.ts", {
         baseDir: "/project",
       });
 
       assertEquals(result.valid, true);
     });
+
+    it("rejects malformed lexical policy objects and directory lists", () => {
+      const unknownOption = validateLexicalPath("src/file.ts", {
+        baseDir: "/project",
+        unknown: true,
+      } as never);
+      const nestedAllowedDir = validateLexicalPath("src/file.ts", {
+        baseDir: "/project",
+        allowedDirs: ["src/nested"],
+      });
+
+      assertEquals(unknownOption.code, PathValidationError.INVALID_PATH);
+      assertEquals(nestedAllowedDir.code, PathValidationError.INVALID_PATH);
+    });
+  });
+
+  describe("validatePathSync compatibility", () => {
+    it("delegates legacy policy fields to hardened lexical validation", () => {
+      const options = {
+        baseDir: "/project",
+        allowedDirs: ["src"],
+        level: "strict" as const,
+        followSymlinks: true,
+        checkExists: true,
+        adapter: createMockAdapter(),
+      };
+
+      assertEquals(
+        validatePathSync("src/file.ts", options),
+        validateLexicalPath("src/file.ts", {
+          baseDir: "/project",
+          allowedDirs: ["src"],
+        }),
+      );
+      assertEquals(
+        validatePathSync("../outside.ts", options).code,
+        PathValidationError.OUTSIDE_BASE,
+      );
+    });
+
+    it("rejects hostile compatibility policy objects without invoking accessors", () => {
+      let getterCalls = 0;
+      const options = { baseDir: "/project" } as Record<string, unknown>;
+      Object.defineProperty(options, "level", {
+        enumerable: true,
+        get() {
+          getterCalls++;
+          return "normal";
+        },
+      });
+
+      assertEquals(
+        validatePathSync("src/file.ts", options as never).code,
+        PathValidationError.INVALID_PATH,
+      );
+      assertEquals(getterCalls, 0);
+    });
   });
 
   describe("createValidator", () => {
@@ -231,6 +465,7 @@ describe("security/path-validation/index", () => {
       const validate = createValidator({
         baseDir: "/project",
         allowedDirs: ["src"],
+        adapter: createMockAdapter(),
       });
 
       const result = await validate("src/file.ts");
@@ -241,6 +476,7 @@ describe("security/path-validation/index", () => {
       const validate = createValidator({
         baseDir: "/project",
         allowedDirs: ["src"],
+        adapter: createMockAdapter(),
       });
 
       const result = await validate("lib/file.ts", { allowedDirs: ["lib"] });
@@ -251,12 +487,41 @@ describe("security/path-validation/index", () => {
       const validate = createValidator({
         baseDir: "/project",
         level: "strict",
+        adapter: createMockAdapter(),
       });
 
       const result = await validate("/etc/passwd");
       assertEquals(result.valid, false);
       assertEquals(result.code, PathValidationError.ABSOLUTE_PATH_DENIED);
     });
+
+    it("snapshots defaults and rejects hostile overrides", async () => {
+      const allowedDirs = ["src"];
+      const defaults = {
+        baseDir: "/project",
+        allowedDirs,
+        adapter: createMockAdapter(),
+      };
+      const validate = createValidator(defaults);
+      allowedDirs.push("secret");
+      defaults.baseDir = "/outside";
+
+      const denied = await validate("secret/file.ts");
+      assertEquals(denied.code, PathValidationError.NOT_IN_ALLOWLIST);
+
+      let getterCalls = 0;
+      const overrides = {} as Record<string, unknown>;
+      Object.defineProperty(overrides, "allowedDirs", {
+        enumerable: true,
+        get() {
+          getterCalls++;
+          return ["secret"];
+        },
+      });
+      const hostile = await validate("secret/file.ts", overrides as never);
+      assertEquals(hostile.code, PathValidationError.INVALID_PATH);
+      assertEquals(getterCalls, 0);
+    });
   });
 
   describe("sanitizePathForDisplay", () => {
@@ -275,6 +540,16 @@ describe("security/path-validation/index", () => {
       assertEquals(result, "file.ts");
     });
 
+    it("should not treat a sibling with a shared prefix as inside the base", () => {
+      const result = sanitizePathForDisplay("/project-secret/nested/file.ts", "/project");
+      assertEquals(result, "file.ts");
+    });
+
+    it("should normalize traversal before stripping the base", () => {
+      const result = sanitizePathForDisplay("/project/src/../../secret/file.ts", "/project");
+      assertEquals(result, "file.ts");
+    });
+
     it("should handle Windows-style backslashes", () => {
       const result = sanitizePathForDisplay("C:\\project\\src\\file.ts", "C:\\project");
       assertEquals(result, "src/file.ts");
diff --git a/src/security/path-validation/index.ts b/src/security/path-validation/index.ts
index f86cbec848..769acf49d9 100644
--- a/src/security/path-validation/index.ts
+++ b/src/security/path-validation/index.ts
@@ -15,7 +15,9 @@
  */
 
 export {
+  type LexicalPathValidationOptions,
   PathValidationError,
+  type PathValidationPolicyOptions,
   type ValidationLevel,
   type ValidationOptions,
   type ValidationResult,
@@ -31,24 +33,273 @@ export {
 
 export { validatePathBasics } from "./rules.ts";
 
-export { getCanonicalBaseDir, getCanonicalPath, validateAllowedDirs } from "./canonical.ts";
+export {
+  getCanonicalBaseDir,
+  getCanonicalPath,
+  pathTraversesSymlink,
+  validateAllowedDirs,
+} from "./canonical.ts";
 
 export { ValidationPresets } from "./presets.ts";
 
-import { getCanonicalBaseDir, getCanonicalPath, validateAllowedDirs } from "./canonical.ts";
+import {
+  getCanonicalBaseDir,
+  getCanonicalPath,
+  pathTraversesSymlink,
+  validateAllowedDirs,
+} from "./canonical.ts";
 import {
   isAbsolutePath,
+  isWithinDirectory,
   joinPaths,
   normalizeSeparators,
   resolvePathSegments,
 } from "./normalization.ts";
 import { validatePathBasics } from "./rules.ts";
-import { PathValidationError, type ValidationOptions, type ValidationResult } from "./types.ts";
+import {
+  type LexicalPathValidationOptions,
+  PathValidationError,
+  type PathValidationPolicyOptions,
+  type ValidationOptions,
+  type ValidationResult,
+} from "./types.ts";
+import { isNotFoundError } from "#veryfront/platform/compat/fs.ts";
+
+const VALIDATION_OPTION_KEYS = new Set([
+  "level",
+  "baseDir",
+  "allowedDirs",
+  "followSymlinks",
+  "checkExists",
+  "adapter",
+  "allowAbsolute",
+]);
+const LEXICAL_OPTION_KEYS = new Set([
+  "baseDir",
+  "allowedDirs",
+  "allowAbsolute",
+]);
+const MAX_ALLOWED_DIRECTORY_ENTRIES = 1_024;
+
+interface NormalizedValidationOptions {
+  level: "strict" | "normal";
+  baseDir: string;
+  allowedDirs: string[] | undefined;
+  followSymlinks: boolean;
+  checkExists: boolean;
+  adapter?: ValidationOptions["adapter"];
+  allowAbsolute: boolean;
+}
+
+type NormalizedPhysicalValidationOptions =
+  & Omit<NormalizedValidationOptions, "adapter">
+  & { readonly adapter: NonNullable<ValidationOptions["adapter"]> };
+
+interface NormalizedLexicalOptions {
+  baseDir: string;
+  allowedDirs: string[] | undefined;
+  allowAbsolute: boolean;
+}
+
+function invalidOptionsResult(): ValidationResult {
+  return {
+    valid: false,
+    error: "Invalid path validation options",
+    code: PathValidationError.INVALID_PATH,
+  };
+}
+
+function snapshotOptionValues(
+  input: unknown,
+  allowedKeys: ReadonlySet<string>,
+): Record<string, unknown> | null {
+  if (typeof input !== "object" || input === null) return null;
+
+  try {
+    if (Array.isArray(input)) return null;
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== Object.prototype && prototype !== null) return null;
+
+    const values: Record<string, unknown> = Object.create(null);
+    for (const key of Reflect.ownKeys(input)) {
+      if (typeof key !== "string" || !allowedKeys.has(key)) return null;
+      const descriptor = Object.getOwnPropertyDescriptor(input, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) return null;
+      values[key] = descriptor.value;
+    }
+    return values;
+  } catch {
+    return null;
+  }
+}
+
+function snapshotAllowedDirs(value: unknown): string[] | undefined | null {
+  if (value === undefined) return undefined;
+
+  try {
+    if (!Array.isArray(value)) return null;
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    const length = lengthDescriptor && "value" in lengthDescriptor
+      ? lengthDescriptor.value
+      : undefined;
+    if (
+      typeof length !== "number" ||
+      !Number.isSafeInteger(length) ||
+      length < 0 ||
+      length > MAX_ALLOWED_DIRECTORY_ENTRIES
+    ) {
+      return null;
+    }
+
+    const snapshot = new Array<string>(length);
+    for (let index = 0; index < length; index++) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (!descriptor || !("value" in descriptor)) return null;
+      const directory = descriptor.value;
+      if (
+        typeof directory !== "string" ||
+        directory.length === 0 ||
+        directory === "." ||
+        directory === ".." ||
+        directory.includes("/") ||
+        directory.includes("\\") ||
+        !validatePathBasics(directory).valid
+      ) {
+        return null;
+      }
+      snapshot[index] = directory;
+    }
+    return Object.freeze(snapshot) as string[];
+  } catch {
+    return null;
+  }
+}
+
+function isBooleanOrUndefined(value: unknown): value is boolean | undefined {
+  return value === undefined || typeof value === "boolean";
+}
+
+function hasValidationAdapter(
+  options: NormalizedValidationOptions,
+): options is NormalizedPhysicalValidationOptions {
+  return typeof options.adapter === "object" && options.adapter !== null;
+}
+
+function snapshotValidationOptions(
+  input: unknown,
+  requireBaseDir: boolean,
+  requireAdapter: boolean,
+): NormalizedValidationOptions | null {
+  const values = snapshotOptionValues(input, VALIDATION_OPTION_KEYS);
+  if (!values) return null;
+
+  const baseDir = values.baseDir;
+  if (
+    (requireBaseDir && typeof baseDir !== "string") ||
+    (baseDir !== undefined && (typeof baseDir !== "string" || baseDir.length === 0))
+  ) {
+    return null;
+  }
+
+  const level = values.level;
+  if (level !== undefined && level !== "normal" && level !== "strict") return null;
+
+  const allowedDirs = snapshotAllowedDirs(values.allowedDirs);
+  if (allowedDirs === null) return null;
+  if (
+    !isBooleanOrUndefined(values.followSymlinks) ||
+    !isBooleanOrUndefined(values.checkExists) ||
+    !isBooleanOrUndefined(values.allowAbsolute)
+  ) {
+    return null;
+  }
+  if (
+    (requireAdapter && (typeof values.adapter !== "object" || values.adapter === null)) ||
+    (values.adapter !== undefined &&
+      (typeof values.adapter !== "object" || values.adapter === null))
+  ) {
+    return null;
+  }
+
+  return Object.freeze({
+    level: level ?? "normal",
+    baseDir: typeof baseDir === "string" ? baseDir : "",
+    allowedDirs,
+    followSymlinks: values.followSymlinks ?? false,
+    checkExists: values.checkExists ?? false,
+    adapter: values.adapter as ValidationOptions["adapter"],
+    allowAbsolute: values.allowAbsolute ?? false,
+  });
+}
+
+function snapshotLexicalOptions(input: unknown): NormalizedLexicalOptions | null {
+  const values = snapshotOptionValues(input, LEXICAL_OPTION_KEYS);
+  if (!values || typeof values.baseDir !== "string" || values.baseDir.length === 0) return null;
+  const allowedDirs = snapshotAllowedDirs(values.allowedDirs);
+  if (allowedDirs === null || !isBooleanOrUndefined(values.allowAbsolute)) return null;
+
+  return Object.freeze({
+    baseDir: values.baseDir,
+    allowedDirs,
+    allowAbsolute: values.allowAbsolute ?? false,
+  });
+}
+
+function mergeValidationOptions(
+  defaults: NormalizedValidationOptions,
+  overrides: NormalizedValidationOptions,
+  rawOverrides: unknown,
+): NormalizedValidationOptions {
+  const values = rawOverrides as Record<string, unknown>;
+  const has = (key: string): boolean => Object.hasOwn(values, key) && values[key] !== undefined;
+  return Object.freeze({
+    level: has("level") ? overrides.level : defaults.level,
+    baseDir: has("baseDir") ? overrides.baseDir : defaults.baseDir,
+    allowedDirs: has("allowedDirs") ? overrides.allowedDirs : defaults.allowedDirs,
+    followSymlinks: has("followSymlinks") ? overrides.followSymlinks : defaults.followSymlinks,
+    checkExists: has("checkExists") ? overrides.checkExists : defaults.checkExists,
+    adapter: has("adapter") ? overrides.adapter : defaults.adapter,
+    allowAbsolute: has("allowAbsolute") ? overrides.allowAbsolute : defaults.allowAbsolute,
+  });
+}
+
+function invalidSymlinkCapability(error: string): ValidationResult {
+  return {
+    valid: false,
+    error,
+    code: PathValidationError.SYMLINK_CAPABILITY_REQUIRED,
+  };
+}
+
+function validateSymlinkCapabilities(
+  adapter: ValidationOptions["adapter"],
+  level: ValidationOptions["level"],
+  followSymlinks: boolean,
+): ValidationResult | null {
+  try {
+    const fs = adapter.fs;
+    const semantics = Object.getOwnPropertyDescriptor(fs, "symlinkSemantics");
+    if (semantics && "value" in semantics && semantics.value === "none") return null;
+
+    if (level === "strict" || !followSymlinks) {
+      return typeof fs.lstat === "function" ? null : invalidSymlinkCapability(
+        "Filesystem adapter must provide lstat for a no-symlink path policy",
+      );
+    }
+
+    return typeof fs.realPath === "function" ? null : invalidSymlinkCapability(
+      "Filesystem adapter must provide realPath before symlinks can be followed safely",
+    );
+  } catch {
+    return invalidSymlinkCapability(
+      "Filesystem adapter symlink capabilities could not be inspected safely",
+    );
+  }
+}
 
 function getTargetPath(
   inputPath: string,
   baseDir: string,
-  level: ValidationOptions["level"] | undefined,
   allowAbsolute: boolean,
 ): ValidationResult | { targetPath: string } {
   const normalized = normalizeSeparators(inputPath);
@@ -57,10 +308,10 @@ function getTargetPath(
     return { targetPath: joinPaths(baseDir, normalized) };
   }
 
-  if (level === "strict" && !allowAbsolute) {
+  if (!allowAbsolute) {
     return {
       valid: false,
-      error: "Absolute paths not allowed in strict mode",
+      error: "Absolute paths are not allowed by this path policy",
       code: PathValidationError.ABSOLUTE_PATH_DENIED,
     };
   }
@@ -68,40 +319,47 @@ function getTargetPath(
   return { targetPath: normalized };
 }
 
+/**
+ * Admit a path against the physical semantics of a runtime filesystem.
+ *
+ * A runtime adapter is mandatory: callers that only need normalized lexical
+ * containment must use `validateLexicalPath` instead. `ValidationPresets`
+ * provide policy fields and must be combined with the target adapter before
+ * being passed here.
+ */
 export async function validatePath(
   path: string,
   options: ValidationOptions,
 ): Promise<ValidationResult> {
+  if (typeof path !== "string") return invalidOptionsResult();
+  const normalizedOptions = snapshotValidationOptions(options, true, true);
+  if (!normalizedOptions || !hasValidationAdapter(normalizedOptions)) {
+    return invalidOptionsResult();
+  }
   const {
-    level = "normal",
+    level,
     baseDir,
-    allowedDirs = [],
-    followSymlinks = false,
-    checkExists = false,
+    allowedDirs,
+    followSymlinks,
+    checkExists,
     adapter,
-    allowAbsolute = false,
-  } = options;
+    allowAbsolute,
+  } = normalizedOptions;
 
   const basicResult = validatePathBasics(path);
   if (!basicResult.valid) return basicResult;
 
-  const targetResult = getTargetPath(path, baseDir, level, allowAbsolute);
+  const targetResult = getTargetPath(path, baseDir, allowAbsolute);
   if ("valid" in targetResult) return targetResult;
 
+  const capabilityResult = validateSymlinkCapabilities(adapter, level, followSymlinks);
+  if (capabilityResult) return capabilityResult;
+
   const { path: canonicalPath, isSymlink } = await getCanonicalPath(
     targetResult.targetPath,
     adapter,
-    followSymlinks,
   );
 
-  if (level === "strict" && isSymlink) {
-    return {
-      valid: false,
-      error: "Symlinks not allowed in strict mode",
-      code: PathValidationError.SYMLINK_DETECTED,
-    };
-  }
-
   // Compare the physically-resolved candidate against a physically-resolved base
   // so a symlink escape is caught while a symlinked base prefix does not cause a
   // false OUTSIDE_BASE rejection.
@@ -109,14 +367,24 @@ export async function validatePath(
   const allowResult = validateAllowedDirs(canonicalPath, canonicalBaseDir, allowedDirs);
   if (!allowResult.valid) return allowResult;
 
-  if (checkExists && adapter) {
+  const traversesSymlink = isSymlink ||
+    await pathTraversesSymlink(targetResult.targetPath, baseDir, adapter);
+  if (traversesSymlink && (level === "strict" || !followSymlinks)) {
+    return {
+      valid: false,
+      error: "Symlinks are not allowed by this path policy",
+      code: PathValidationError.SYMLINK_DETECTED,
+    };
+  }
+
+  if (checkExists) {
     try {
       await adapter.fs.stat(canonicalPath);
-    } catch (_) {
-      /* expected: file does not exist at canonicalPath */
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
       return {
         valid: false,
-        error: `File not found: ${canonicalPath}`,
+        error: "Path does not exist",
         code: PathValidationError.FILE_NOT_FOUND,
       };
     }
@@ -125,35 +393,85 @@ export async function validatePath(
   return { valid: true, canonicalPath };
 }
 
-export function validatePathSync(
+/**
+ * Validate lexical path containment without consulting a filesystem.
+ *
+ * This is suitable only when the backing store cannot resolve symbolic links,
+ * or when the caller performs its own descriptor-relative filesystem checks.
+ * Use `validatePath()` for filesystem admission.
+ */
+export function validateLexicalPath(
   path: string,
-  options: ValidationOptions,
+  options: LexicalPathValidationOptions,
 ): ValidationResult {
-  const { level = "normal", baseDir, allowedDirs = [], allowAbsolute = false } = options;
+  if (typeof path !== "string") return invalidOptionsResult();
+  const normalizedOptions = snapshotLexicalOptions(options);
+  if (!normalizedOptions) return invalidOptionsResult();
+  const { baseDir, allowedDirs, allowAbsolute } = normalizedOptions;
 
   const basicResult = validatePathBasics(path);
   if (!basicResult.valid) return basicResult;
 
-  const targetResult = getTargetPath(path, baseDir, level, allowAbsolute);
+  const targetResult = getTargetPath(path, baseDir, allowAbsolute);
   if ("valid" in targetResult) return targetResult;
 
   const canonicalPath = resolvePathSegments(targetResult.targetPath);
   return validateAllowedDirs(canonicalPath, baseDir, allowedDirs);
 }
 
+/**
+ * Validate lexical path containment without consulting a filesystem.
+ *
+ * The legacy physical-policy fields are accepted for source compatibility but
+ * do not weaken lexical containment. Filesystem admission must use
+ * `validatePath()` with the target runtime adapter.
+ *
+ * @deprecated Use `validateLexicalPath()` and pass only lexical policy fields.
+ */
+export function validatePathSync(
+  path: string,
+  options: PathValidationPolicyOptions & { adapter?: ValidationOptions["adapter"] },
+): ValidationResult {
+  if (typeof path !== "string") return invalidOptionsResult();
+  const normalizedOptions = snapshotValidationOptions(options, true, false);
+  if (!normalizedOptions) return invalidOptionsResult();
+
+  return validateLexicalPath(path, {
+    baseDir: normalizedOptions.baseDir,
+    allowedDirs: normalizedOptions.allowedDirs,
+    allowAbsolute: normalizedOptions.allowAbsolute,
+  });
+}
+
 export function createValidator(
   defaultOptions: ValidationOptions,
 ): (path: string, overrides?: Partial<ValidationOptions>) => Promise<ValidationResult> {
-  return (path: string, overrides?: Partial<ValidationOptions>): Promise<ValidationResult> =>
-    validatePath(path, { ...defaultOptions, ...overrides });
+  const defaults = snapshotValidationOptions(defaultOptions, true, true);
+  return (path: string, overrides?: Partial<ValidationOptions>): Promise<ValidationResult> => {
+    if (!defaults || !hasValidationAdapter(defaults)) {
+      return Promise.resolve(invalidOptionsResult());
+    }
+    if (overrides === undefined) return validatePath(path, defaults);
+
+    const overrideValues = snapshotOptionValues(overrides, VALIDATION_OPTION_KEYS);
+    const normalizedOverrides = overrideValues
+      ? snapshotValidationOptions(overrideValues, false, false)
+      : null;
+    if (!normalizedOverrides) return Promise.resolve(invalidOptionsResult());
+    const merged = mergeValidationOptions(defaults, normalizedOverrides, overrideValues);
+    return hasValidationAdapter(merged)
+      ? validatePath(path, merged)
+      : Promise.resolve(invalidOptionsResult());
+  };
 }
 
 export function sanitizePathForDisplay(path: string, baseDir: string): string {
-  const normalized = normalizeSeparators(path);
-  const normalizedBase = normalizeSeparators(baseDir);
+  const normalized = resolvePathSegments(normalizeSeparators(path));
+  const normalizedBase = resolvePathSegments(normalizeSeparators(baseDir));
 
-  if (normalized.startsWith(normalizedBase)) {
-    return normalized.slice(normalizedBase.length).replace(/^\//, "");
+  if (isWithinDirectory(normalizedBase, normalized)) {
+    if (normalized === normalizedBase) return "";
+    return normalized.slice(normalizedBase === "/" ? 1 : normalizedBase.length + 1);
   }
 
   return normalized.split("/").at(-1) ?? normalized;
diff --git a/src/security/path-validation/normalization.test.ts b/src/security/path-validation/normalization.test.ts
index cdb59d363b..68a20d0632 100644
--- a/src/security/path-validation/normalization.test.ts
+++ b/src/security/path-validation/normalization.test.ts
@@ -104,5 +104,18 @@ describe("security/path-validation/normalization", () => {
     it("should handle trailing slashes", () => {
       assertEquals(isWithinDirectory("/project/", "/project/src"), true);
     });
+
+    it("should reject an empty trust root", () => {
+      assertEquals(isWithinDirectory("", "/etc/passwd"), false);
+    });
+
+    it("should normalize unresolved traversal before comparing", () => {
+      assertEquals(isWithinDirectory("/project", "/project/../../etc/passwd"), false);
+    });
+
+    it("should treat the filesystem root as an absolute-path boundary", () => {
+      assertEquals(isWithinDirectory("/", "/etc/passwd"), true);
+      assertEquals(isWithinDirectory("/", "relative/path"), false);
+    });
   });
 });
diff --git a/src/security/path-validation/normalization.ts b/src/security/path-validation/normalization.ts
index 00328ed423..d32e231f66 100644
--- a/src/security/path-validation/normalization.ts
+++ b/src/security/path-validation/normalization.ts
@@ -55,8 +55,20 @@ export function joinPaths(base: string, relative: string): string {
  * Compares normalized paths (string comparison)
  */
 export function isWithinDirectory(baseDir: string, targetPath: string): boolean {
-  const normalizedBase = normalizeSeparators(baseDir).replace(/\/$/, "");
-  const normalizedTarget = normalizeSeparators(targetPath).replace(/\/$/, "");
+  if (!baseDir) return false;
 
+  const normalizedBase = stripTrailingSlashes(
+    resolvePathSegments(normalizeSeparators(baseDir)),
+  );
+  const normalizedTarget = stripTrailingSlashes(
+    resolvePathSegments(normalizeSeparators(targetPath)),
+  );
+
+  if (!normalizedBase) return false;
+  if (normalizedBase === "/") return normalizedTarget.startsWith("/");
   return normalizedTarget === normalizedBase || normalizedTarget.startsWith(`${normalizedBase}/`);
 }
+
+function stripTrailingSlashes(path: string): string {
+  return path === "/" ? path : path.replace(/\/+$/, "");
+}
diff --git a/src/security/path-validation/presets.test.ts b/src/security/path-validation/presets.test.ts
index 41a8ab60de..7d0b8719b0 100644
--- a/src/security/path-validation/presets.test.ts
+++ b/src/security/path-validation/presets.test.ts
@@ -60,7 +60,7 @@ describe("ValidationPresets", () => {
 
   describe("build", () => {
     it("should use permissive level", () => {
-      assertEquals(ValidationPresets.build("/base").level, "permissive");
+      assertEquals(ValidationPresets.build("/base").level, "normal");
     });
 
     it("should follow symlinks", () => {
diff --git a/src/security/path-validation/presets.ts b/src/security/path-validation/presets.ts
index a3c6b261e2..fcd2d63c4c 100644
--- a/src/security/path-validation/presets.ts
+++ b/src/security/path-validation/presets.ts
@@ -1,4 +1,4 @@
-import type { ValidationOptions } from "./types.ts";
+import type { PathValidationPolicyOptions } from "./types.ts";
 
 const USER_INPUT_ALLOWED_DIRS = [
   "app",
@@ -20,30 +20,30 @@ const USER_INPUT_ALLOWED_DIRS = [
 
 function createPreset(
   baseDir: string,
-  options: Omit<ValidationOptions, "baseDir">,
-): ValidationOptions {
+  options: Omit<PathValidationPolicyOptions, "baseDir">,
+): PathValidationPolicyOptions {
   return {
     baseDir,
     ...options,
   };
 }
 
-const INTERNAL_PRESET: Omit<ValidationOptions, "baseDir"> = {
+const INTERNAL_PRESET: Omit<PathValidationPolicyOptions, "baseDir"> = {
   level: "normal",
   followSymlinks: false,
   checkExists: false,
   allowAbsolute: false,
 };
 
-const BUILD_PRESET: Omit<ValidationOptions, "baseDir"> = {
-  level: "permissive",
+const BUILD_PRESET: Omit<PathValidationPolicyOptions, "baseDir"> = {
+  level: "normal",
   followSymlinks: true,
   checkExists: false,
   allowAbsolute: true,
 };
 
 export const ValidationPresets = {
-  userInput(baseDir: string): ValidationOptions {
+  userInput(baseDir: string): PathValidationPolicyOptions {
     return createPreset(baseDir, {
       level: "strict",
       allowedDirs: [...USER_INPUT_ALLOWED_DIRS],
@@ -53,15 +53,15 @@ export const ValidationPresets = {
     });
   },
 
-  internal(baseDir: string): ValidationOptions {
+  internal(baseDir: string): PathValidationPolicyOptions {
     return createPreset(baseDir, INTERNAL_PRESET);
   },
 
-  build(baseDir: string): ValidationOptions {
+  build(baseDir: string): PathValidationPolicyOptions {
     return createPreset(baseDir, BUILD_PRESET);
   },
 
-  static(baseDir: string): ValidationOptions {
+  static(baseDir: string): PathValidationPolicyOptions {
     return createPreset(baseDir, {
       level: "normal",
       allowedDirs: ["dist", "public"],
diff --git a/src/security/path-validation/rules.ts b/src/security/path-validation/rules.ts
index 3158a0834a..4309a7f642 100644
--- a/src/security/path-validation/rules.ts
+++ b/src/security/path-validation/rules.ts
@@ -3,11 +3,7 @@
  * @module security/path-validation/rules
  */
 
-import {
-  FORBIDDEN_PATH_PATTERNS,
-  MAX_PATH_LENGTH,
-  MAX_PATH_TRAVERSAL_DEPTH,
-} from "#veryfront/utils";
+import { MAX_PATH_LENGTH, MAX_PATH_TRAVERSAL_DEPTH } from "#veryfront/utils";
 
 import { normalizeSeparators } from "./normalization.ts";
 import { PathValidationError, type ValidationResult } from "./types.ts";
@@ -32,15 +28,6 @@ export function validatePathBasics(path: string): ValidationResult {
     };
   }
 
-  const forbiddenPattern = FORBIDDEN_PATH_PATTERNS.find((pattern) => pattern.test(path));
-  if (forbiddenPattern) {
-    return {
-      valid: false,
-      error: `Path contains forbidden pattern: ${forbiddenPattern}`,
-      code: PathValidationError.FORBIDDEN_PATTERN,
-    };
-  }
-
   const parts = normalizeSeparators(path).split("/");
   let depth = 0;
   let maxDepth = 0;
diff --git a/src/security/path-validation/types.ts b/src/security/path-validation/types.ts
index 27711073f7..5c340d60f5 100644
--- a/src/security/path-validation/types.ts
+++ b/src/security/path-validation/types.ts
@@ -5,7 +5,7 @@
 
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 
-export type ValidationLevel = "strict" | "normal" | "permissive";
+export type ValidationLevel = "strict" | "normal";
 
 export interface ValidationResult {
   valid: boolean;
@@ -14,13 +14,25 @@ export interface ValidationResult {
   code?: string;
 }
 
-export interface ValidationOptions {
+/** Filesystem-independent policy fields shared by physical path presets. */
+export interface PathValidationPolicyOptions {
   level?: ValidationLevel;
   baseDir: string;
   allowedDirs?: string[];
   followSymlinks?: boolean;
   checkExists?: boolean;
-  adapter?: RuntimeAdapter;
+  allowAbsolute?: boolean;
+}
+
+/** Options for physical filesystem admission. */
+export interface ValidationOptions extends PathValidationPolicyOptions {
+  adapter: RuntimeAdapter;
+}
+
+/** Options for lexical containment checks that never inspect a filesystem. */
+export interface LexicalPathValidationOptions {
+  baseDir: string;
+  allowedDirs?: string[];
   allowAbsolute?: boolean;
 }
 
@@ -33,6 +45,7 @@ export const PathValidationError = {
   NOT_IN_ALLOWLIST: "NOT_IN_ALLOWLIST",
   FILE_NOT_FOUND: "FILE_NOT_FOUND",
   SYMLINK_DETECTED: "SYMLINK_DETECTED",
+  SYMLINK_CAPABILITY_REQUIRED: "SYMLINK_CAPABILITY_REQUIRED",
   INVALID_PATH: "INVALID_PATH",
   ABSOLUTE_PATH_DENIED: "ABSOLUTE_PATH_DENIED",
 } as const;
diff --git a/src/security/project-locality.ts b/src/security/project-locality.ts
new file mode 100644
index 0000000000..f8040658f9
--- /dev/null
+++ b/src/security/project-locality.ts
@@ -0,0 +1,63 @@
+const apply = Reflect.apply;
+const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+const objectPrototypeHasOwnProperty = Object.prototype.hasOwnProperty;
+
+/**
+ * Read an own data property without invoking project-owned accessors. Missing,
+ * inherited, accessor-backed, revoked, and throwing-descriptor values are
+ * treated as absent. JavaScript cannot distinguish a transparent Proxy from
+ * its target, so a non-throwing Proxy is governed by the descriptor it reports.
+ */
+export function readOwnDataProperty(value: unknown, key: PropertyKey): unknown {
+  if (typeof value !== "object" || value === null) {
+    return undefined;
+  }
+
+  try {
+    const descriptor = apply(getOwnPropertyDescriptor, undefined, [
+      value,
+      key,
+    ]) as PropertyDescriptor | undefined;
+    if (
+      !descriptor ||
+      !apply(objectPrototypeHasOwnProperty, descriptor, ["value"])
+    ) {
+      return undefined;
+    }
+    return descriptor.value;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Local-project privileges require an explicit own boolean data property.
+ * Every ambiguous runtime value fails closed.
+ */
+export function isExplicitlyLocalProject(value: unknown): boolean {
+  return readOwnDataProperty(value, "isLocalProject") === true;
+}
+
+/**
+ * Host-realm project-code execution requires an explicit runtime capability.
+ *
+ * An explicitly local development project retains the historical capability.
+ * Standalone production runtimes can grant the narrower capability without
+ * enabling development-only rendering, caching, diagnostics, or HTTP policy.
+ * Every ambiguous value fails closed.
+ */
+export function isHostProjectCodeExecutionAllowed(value: unknown): boolean {
+  return isExplicitlyLocalProject(value) ||
+    isExplicitHostProjectCodeExecutionAllowed(value);
+}
+
+/**
+ * Read only the narrow host-execution capability. Callers that already
+ * snapshotted local-development status can use this without inspecting the
+ * same boundary property twice.
+ */
+export function isExplicitHostProjectCodeExecutionAllowed(
+  value: unknown,
+): boolean {
+  return readOwnDataProperty(value, "allowHostProjectCodeExecution") === true;
+}
diff --git a/src/security/rate-limit/README.md b/src/security/rate-limit/README.md
index b056bb34ed..21fca1fcd7 100644
--- a/src/security/rate-limit/README.md
+++ b/src/security/rate-limit/README.md
@@ -1,325 +1,15 @@
-# Rate Limiting Middleware
+# Rate-limit client identity helper
 
-Protection against abuse and DoS attacks through configurable rate limiting.
-
-## Features
-
-- ✅ **Multiple Strategies**: Fixed window, sliding window, token bucket
-- ✅ **Flexible Storage**: Memory store (default), or custom implementations
-- ✅ **Custom Key Generation**: Rate limit by IP, API key, user ID, etc.
-- ✅ **Skip Logic**: Bypass rate limiting for specific requests
-- ✅ **Rate Limit Headers**: Standard `X-RateLimit-*` headers
-- ✅ **Preset Configurations**: Ready-to-use configs for common use cases
-
-## Quick Start
-
-```typescript
-import { RateLimitPresets } from "veryfront/security/rate-limit";
-
-// Use a preset
-const rateLimiter = RateLimitPresets.moderate(); // 100 req/min
-
-// Apply in your handler
-export async function handler(request: Request) {
-  return await rateLimiter(request, async (req) => {
-    // Your handler logic
-    return new Response("OK");
-  });
-}
-```
-
-## Strategies
-
-### Fixed Window
-
-Simple counter that resets at fixed intervals. Fast but allows bursts at boundaries.
-
-```typescript
-import { createRateLimiter } from "veryfront/security/rate-limit";
-
-const limiter = createRateLimiter({
-  maxRequests: 100,
-  windowMs: 60000, // 1 minute
-  strategy: "fixed-window",
-});
-```
-
-### Sliding Window
-
-More accurate, prevents burst attacks by tracking individual timestamps.
-
-```typescript
-const limiter = createRateLimiter({
-  maxRequests: 100,
-  windowMs: 60000,
-  strategy: "sliding-window",
-});
-```
-
-### Token Bucket
-
-Allows controlled bursts. Tokens refill at constant rate.
-
-```typescript
-const limiter = createRateLimiter({
-  maxRequests: 100,
-  windowMs: 60000,
-  strategy: "token-bucket",
-});
-```
-
-## Custom Configuration
-
-### Rate Limit by API Key
-
-```typescript
-const limiter = createRateLimiter({
-  maxRequests: 1000,
-  windowMs: 3600000, // 1 hour
-  keyGenerator: (request) => {
-    return request.headers.get("x-api-key") || "anonymous";
-  },
-});
-```
-
-### Skip Admin Users
-
-```typescript
-const limiter = createRateLimiter({
-  maxRequests: 100,
-  windowMs: 60000,
-  skip: async (request) => {
-    const apiKey = request.headers.get("x-api-key");
-    return apiKey === process.env.ADMIN_API_KEY;
-  },
-});
-```
-
-### Custom Error Response
-
-```typescript
-const limiter = createRateLimiter({
-  maxRequests: 10,
-  windowMs: 60000,
-  onRateLimitExceeded: (request, key) => {
-    return new Response(
-      JSON.stringify({
-        error: "Rate limit exceeded",
-        key,
-        message: "Please upgrade to premium for higher limits",
-      }),
-      {
-        status: 429,
-        headers: { "Content-Type": "application/json" },
-      },
-    );
-  },
-});
-```
-
-## Presets
-
-### Strict (10 req/min)
-
-For sensitive operations.
-
-```typescript
-RateLimitPresets.strict();
-```
-
-### Moderate (100 req/min)
-
-For general web pages.
-
-```typescript
-RateLimitPresets.moderate();
-```
-
-### Lenient (1000 req/hour)
-
-For public APIs.
-
-```typescript
-RateLimitPresets.lenient();
-```
-
-### Auth (5 req/15min)
-
-For authentication endpoints.
-
-```typescript
-RateLimitPresets.auth();
-```
-
-Preset proxy headers remain untrusted by default, so rotating
-`X-Forwarded-For` values cannot bypass the limit. If a trusted reverse proxy
-sets the client address, enable proxy trust explicitly:
-
-```typescript
-const limiter = RateLimitPresets.auth({ trustProxy: true });
-```
-
-You can also provide a custom key generator, for example to limit by API key or
-authenticated user ID:
-
-```typescript
-const limiter = RateLimitPresets.auth({
-  keyGenerator: (request) => request.headers.get("x-api-key") ?? "anonymous",
-});
-```
-
-Existing store-only calls remain supported. Use
-`RateLimitPresets.auth(store)` or include the store in the options object as
-`RateLimitPresets.auth({ store })`.
-
-## Custom Store
-
-For distributed systems, implement the `RateLimitStore` interface:
+This directory is not a published `veryfront/security/rate-limit` entrypoint.
+The supported public rate limiter is owned by
+[`veryfront/middleware`](../../middleware/README.md):
 
 ```typescript
-import type { RateLimitStore } from "veryfront/security/rate-limit";
-
-class RedisRateLimitStore implements RateLimitStore {
-  async increment(key: string): Promise<number> {
-    // Implement with Redis
-  }
-
-  async get(key: string): Promise<number> {
-    // Implement with Redis
-  }
-
-  async reset(key: string): Promise<void> {
-    // Implement with Redis
-  }
-
-  async resetAll(): Promise<void> {
-    // Implement with Redis
-  }
-}
-
-const limiter = createRateLimiter({
-  maxRequests: 100,
-  windowMs: 60000,
-  store: new RedisRateLimitStore(),
-});
+import { authRateLimit, MemoryRateLimitStore, rateLimit } from "veryfront/middleware";
 ```
 
-## Response Headers
-
-All responses include rate limit headers:
-
-- `X-RateLimit-Limit`: Maximum requests allowed
-- `X-RateLimit-Remaining`: Requests remaining in window
-- `X-RateLimit-Reset`: Unix timestamp when limit resets
-
-When rate limit is exceeded:
-
-- HTTP status: `429 Too Many Requests`
-- `Retry-After`: Seconds to wait before retrying
-
-## Best Practices
-
-1. **Use appropriate limits**: Don't over-limit legitimate users
-2. **Choose right strategy**:
-   - Fixed window: Fast, good for most cases
-   - Sliding window: More accurate, prevents burst attacks
-   - Token bucket: Allow controlled bursts
-3. **Monitor limits**: Track `429` responses to tune limits
-4. **Fail open**: If rate limiting errors, allow request through
-5. **Distributed systems**: Use Redis or similar for shared state
-
-## Examples
-
-### Protect API Endpoint
-
-```typescript
-// app/api/users/route.ts
-import { RateLimitPresets } from "veryfront/security/rate-limit";
-
-const limiter = RateLimitPresets.moderate();
-
-export async function GET(request: Request) {
-  return await limiter(request, async () => {
-    const users = await db.users.findMany();
-    return Response.json(users);
-  });
-}
-```
-
-### Protect Authentication
-
-```typescript
-// app/api/auth/login/route.ts
-import { RateLimitPresets } from "veryfront/security/rate-limit";
-
-const limiter = RateLimitPresets.auth();
-
-export async function POST(request: Request) {
-  return await limiter(request, async () => {
-    const { email, password } = await request.json();
-    // ... authentication logic
-  });
-}
-```
-
-### Different Limits per Tier
-
-```typescript
-import { createRateLimiter } from "veryfront/security/rate-limit";
-
-const limiter = createRateLimiter({
-  maxRequests: 100, // Default
-  windowMs: 60000,
-  keyGenerator: (request) => {
-    const tier = request.headers.get("x-user-tier");
-    return `${tier}:${request.headers.get("x-api-key")}`;
-  },
-  onRateLimitExceeded: async (request, key) => {
-    const tier = key.split(":")[0];
-    const limits = {
-      free: 100,
-      pro: 1000,
-      enterprise: 10000,
-    };
-
-    return new Response(
-      JSON.stringify({
-        error: "Rate limit exceeded",
-        limit: limits[tier] || 100,
-        message: "Upgrade for higher limits",
-      }),
-      { status: 429 },
-    );
-  },
-});
-```
-
-## Testing
-
-```typescript
-import { createRateLimiter } from "veryfront/security/rate-limit";
-
-Deno.test("rate limiter blocks after limit", async () => {
-  const limiter = createRateLimiter({
-    maxRequests: 2,
-    windowMs: 60000,
-  });
-
-  const request = new Request("http://localhost/test");
-  const handler = async () => new Response("OK");
-
-  // First 2 should succeed
-  await limiter(request, handler);
-  await limiter(request, handler);
-
-  // 3rd should be blocked
-  const response = await limiter(request, handler);
-  assertEquals(response.status, 429);
-});
-```
-
-## See Also
-
-- [Security Overview](../README.md)
-- [Input Validation](../input-validation/)
-- [Path Validation](../path-validation.ts)
+`client-key.ts` is the single source-local file. It resolves a client identity
+for the maintained middleware implementation while keeping proxy headers
+untrusted unless the caller explicitly enables trusted-proxy handling. No
+second limiter, store, strategy, or deep-import compatibility facade lives in
+Security.
diff --git a/src/security/rate-limit/index.ts b/src/security/rate-limit/index.ts
deleted file mode 100644
index b6485bfb5d..0000000000
--- a/src/security/rate-limit/index.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Security Rate Limit
- *
- * @module security/rate-limit
- */
-
-export { createRateLimiter, RateLimitPresets } from "./middleware.ts";
-export { MemoryRateLimitStore } from "./memory-store.ts";
-export { fixedWindowStrategy, slidingWindowStrategy, tokenBucketStrategy } from "./strategies.ts";
-export type {
-  RateLimitConfig,
-  RateLimitPresetOptions,
-  RateLimitState,
-  RateLimitStore,
-  RateLimitStrategy,
-} from "./types.ts";
diff --git a/src/security/rate-limit/memory-store.test.ts b/src/security/rate-limit/memory-store.test.ts
deleted file mode 100644
index 256672ffa1..0000000000
--- a/src/security/rate-limit/memory-store.test.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
-import { describe, it } from "#veryfront/testing/bdd.ts";
-import { MemoryRateLimitStore } from "./memory-store.ts";
-
-function withStore(
-  fn: (store: MemoryRateLimitStore) => Promise<void> | void,
-): Promise<void> | void {
-  const store = new MemoryRateLimitStore(999999);
-  try {
-    return fn(store);
-  } finally {
-    store.destroy();
-  }
-}
-
-describe("security/rate-limit/memory-store", () => {
-  describe("MemoryRateLimitStore", () => {
-    it("should increment and return count", () =>
-      withStore(async (store) => {
-        assertEquals(await store.increment("key1"), 1);
-        assertEquals(await store.increment("key1"), 2);
-        assertEquals(await store.increment("key1"), 3);
-      }));
-
-    it("should get current count", () =>
-      withStore(async (store) => {
-        assertEquals(await store.get("key1"), 0);
-        await store.increment("key1");
-        assertEquals(await store.get("key1"), 1);
-      }));
-
-    it("should reset a key", () =>
-      withStore(async (store) => {
-        await store.increment("key1");
-        await store.increment("key1");
-        await store.reset("key1");
-        assertEquals(await store.get("key1"), 0);
-      }));
-
-    it("should reset all keys", () =>
-      withStore(async (store) => {
-        await store.increment("key1");
-        await store.increment("key2");
-        await store.resetAll();
-        assertEquals(await store.get("key1"), 0);
-        assertEquals(await store.get("key2"), 0);
-      }));
-
-    it("should track store size", () =>
-      withStore(async (store) => {
-        assertEquals(store.size(), 0);
-        await store.increment("key1");
-        assertEquals(store.size(), 1);
-        await store.increment("key2");
-        assertEquals(store.size(), 2);
-      }));
-
-    it("should track independent keys", () =>
-      withStore(async (store) => {
-        await store.increment("a");
-        await store.increment("b");
-        await store.increment("a");
-        assertEquals(await store.get("a"), 2);
-        assertEquals(await store.get("b"), 1);
-      }));
-
-    it("should support getState and setState", () =>
-      withStore((store) => {
-        assertEquals(store.getState("key1"), undefined);
-        store.setState("key1", {
-          count: 5,
-          resetTime: Date.now() + 60000,
-        });
-        assertEquals(store.getState("key1")?.count, 5);
-      }));
-
-    it("should clean up interval on destroy", () => {
-      const store = new MemoryRateLimitStore(999999);
-      store.destroy();
-      store.destroy();
-    });
-  });
-});
diff --git a/src/security/rate-limit/memory-store.ts b/src/security/rate-limit/memory-store.ts
deleted file mode 100644
index b8f6dc9d1d..0000000000
--- a/src/security/rate-limit/memory-store.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import type { RateLimitState, RateLimitStore } from "./types.ts";
-import { unrefTimer } from "#veryfront/platform/compat/process.ts";
-
-const MAX_TIMESTAMPS_PER_KEY = 1_000;
-const WINDOW_MS = 60_000;
-
-export class MemoryRateLimitStore implements RateLimitStore {
-  private store = new Map<string, RateLimitState>();
-  private cleanupInterval: ReturnType<typeof setInterval> | null = null;
-
-  constructor(private cleanupIntervalMs = WINDOW_MS) {
-    if (typeof setInterval === "undefined") return;
-    this.cleanupInterval = setInterval(() => this.cleanup(), cleanupIntervalMs);
-    unrefTimer(this.cleanupInterval);
-  }
-
-  increment(key: string, windowMs: number = WINDOW_MS): Promise<number> {
-    const now = Date.now();
-    const state = this.store.get(key);
-
-    if (!state || now > state.resetTime) {
-      this.store.set(key, {
-        count: 1,
-        resetTime: now + windowMs,
-        requestTimestamps: [now],
-      });
-      return Promise.resolve(1);
-    }
-
-    state.count++;
-    state.requestTimestamps?.push(now);
-
-    const timestamps = state.requestTimestamps;
-    if (timestamps?.length && timestamps.length > MAX_TIMESTAMPS_PER_KEY) {
-      const windowStart = state.resetTime - windowMs;
-      const filtered = timestamps.filter((t) => t >= windowStart);
-      state.requestTimestamps = filtered.length > MAX_TIMESTAMPS_PER_KEY
-        ? filtered.slice(-MAX_TIMESTAMPS_PER_KEY)
-        : filtered;
-    }
-
-    return Promise.resolve(state.count);
-  }
-
-  get(key: string): Promise<number> {
-    const state = this.store.get(key);
-    if (!state || Date.now() > state.resetTime) return Promise.resolve(0);
-    return Promise.resolve(state.count);
-  }
-
-  reset(key: string): Promise<void> {
-    this.store.delete(key);
-    return Promise.resolve();
-  }
-
-  resetAll(): Promise<void> {
-    this.store.clear();
-    return Promise.resolve();
-  }
-
-  getState(key: string): RateLimitState | undefined {
-    return this.store.get(key);
-  }
-
-  setState(key: string, state: RateLimitState): void {
-    this.store.set(key, state);
-  }
-
-  private cleanup(): void {
-    const now = Date.now();
-    for (const [key, state] of this.store) {
-      if (now > state.resetTime) this.store.delete(key);
-    }
-  }
-
-  destroy(): void {
-    if (this.cleanupInterval === null) return;
-    clearInterval(this.cleanupInterval);
-    this.cleanupInterval = null;
-  }
-
-  size(): number {
-    return this.store.size;
-  }
-}
diff --git a/src/security/rate-limit/middleware.test.ts b/src/security/rate-limit/middleware.test.ts
deleted file mode 100644
index a67445e082..0000000000
--- a/src/security/rate-limit/middleware.test.ts
+++ /dev/null
@@ -1,370 +0,0 @@
-import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals, assertExists, assertRejects } from "#veryfront/testing/assert.ts";
-import { describe, it } from "#veryfront/testing/bdd.ts";
-import { createRateLimiter, RateLimitPresets } from "./middleware.ts";
-import { MemoryRateLimitStore } from "./memory-store.ts";
-import type { RateLimitStore } from "./types.ts";
-
-function createNext(): () => Promise<Response> {
-  return () => Promise.resolve(new Response("OK"));
-}
-
-function createRequest(headers?: HeadersInit): Request {
-  return new Request("http://localhost/test", headers ? { headers } : undefined);
-}
-
-async function withStore(test: (store: MemoryRateLimitStore) => Promise<void>): Promise<void> {
-  const store = new MemoryRateLimitStore();
-  try {
-    await test(store);
-  } finally {
-    store.destroy();
-  }
-}
-
-describe("Rate Limiting Middleware", () => {
-  it("should allow requests within limit", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 5,
-        windowMs: 60000,
-        strategy: "fixed-window",
-        store,
-      });
-
-      const request = createRequest();
-      const next = createNext();
-
-      for (let i = 0; i < 5; i++) {
-        const response = await limiter(request, next);
-        assertEquals(response.status, 200);
-        assertExists(response.headers.get("X-RateLimit-Limit"));
-      }
-    });
-  });
-
-  it("should block requests exceeding limit", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 3,
-        windowMs: 60000,
-        strategy: "fixed-window",
-        store,
-      });
-
-      const request = createRequest();
-      const next = createNext();
-
-      for (let i = 0; i < 3; i++) {
-        const response = await limiter(request, next);
-        assertEquals(response.status, 200);
-      }
-
-      const blockedResponse = await limiter(request, next);
-      assertEquals(blockedResponse.status, 429);
-      assertExists(blockedResponse.headers.get("X-RateLimit-Limit"));
-      assertExists(blockedResponse.headers.get("Retry-After"));
-    });
-  });
-
-  it("should add rate limit headers", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 10,
-        windowMs: 60000,
-        store,
-      });
-
-      const response = await limiter(createRequest(), createNext());
-
-      assertEquals(response.headers.get("X-RateLimit-Limit"), "10");
-      assertExists(response.headers.get("X-RateLimit-Remaining"));
-      assertExists(response.headers.get("X-RateLimit-Reset"));
-    });
-  });
-
-  it("should skip rate limiting when skip function returns true", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        skip: (request) => request.headers.get("x-skip") === "true",
-        store,
-      });
-
-      const request = createRequest({ "x-skip": "true" });
-      const next = createNext();
-
-      for (let i = 0; i < 10; i++) {
-        const response = await limiter(request, next);
-        assertEquals(response.status, 200);
-      }
-    });
-  });
-
-  it("should use custom key generator", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 2,
-        windowMs: 60000,
-        keyGenerator: (request) => request.headers.get("x-api-key") ?? "default",
-        store,
-      });
-
-      const next = createNext();
-
-      const req1 = createRequest({ "x-api-key": "user1" });
-      await limiter(req1, next);
-      await limiter(req1, next);
-
-      const blocked1 = await limiter(req1, next);
-      assertEquals(blocked1.status, 429);
-
-      const req2 = createRequest({ "x-api-key": "user2" });
-      const response2 = await limiter(req2, next);
-      assertEquals(response2.status, 200);
-    });
-  });
-
-  it("should ignore X-Forwarded-For when trustProxy is false", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        store,
-      });
-
-      const next = createNext();
-
-      const req1 = createRequest({ "x-forwarded-for": "198.51.100.1" });
-      const req2 = createRequest({ "x-forwarded-for": "203.0.113.8" });
-
-      const res1 = await limiter(req1, next);
-      assertEquals(res1.status, 200);
-
-      const res2 = await limiter(req2, next);
-      assertEquals(res2.status, 429);
-    });
-  });
-
-  it("should ignore X-Real-IP when trustProxy is false", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        store,
-      });
-
-      const next = createNext();
-
-      const req1 = createRequest({ "x-real-ip": "198.51.100.1" });
-      const req2 = createRequest({ "x-real-ip": "203.0.113.8" });
-
-      const res1 = await limiter(req1, next);
-      assertEquals(res1.status, 200);
-
-      const res2 = await limiter(req2, next);
-      assertEquals(res2.status, 429);
-    });
-  });
-
-  it("should use X-Forwarded-For when trustProxy is true", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        trustProxy: true,
-        store,
-      });
-
-      const next = createNext();
-
-      const req1 = createRequest({ "x-forwarded-for": "1.2.3.4" });
-      const req2 = createRequest({ "x-forwarded-for": "5.6.7.8" });
-
-      const res1 = await limiter(req1, next);
-      assertEquals(res1.status, 200);
-
-      // Different forwarded IP = different key, so should be allowed
-      const res2 = await limiter(req2, next);
-      assertEquals(res2.status, 200);
-    });
-  });
-
-  it("should use the rightmost IP from X-Forwarded-For when trustProxy is true", async () => {
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        trustProxy: true,
-        store,
-      });
-
-      const next = createNext();
-
-      const req = createRequest({ "x-forwarded-for": "198.51.100.1, 203.0.113.8" });
-      const res = await limiter(req, next);
-      assertEquals(res.status, 200);
-
-      const req2 = createRequest({ "x-forwarded-for": "192.0.2.5, 203.0.113.8" });
-      const res2 = await limiter(req2, next);
-      assertEquals(res2.status, 429);
-    });
-  });
-
-  it("should work with preset configurations", async () => {
-    await withStore(async (store) => {
-      const limiter = RateLimitPresets.strict(store);
-      const response = await limiter(createRequest(), createNext());
-
-      assertEquals(response.status, 200);
-      assertEquals(response.headers.get("X-RateLimit-Limit"), "10");
-    });
-  });
-
-  it("should separate trusted proxy clients when using a preset", async () => {
-    await withStore(async (store) => {
-      const limiter = RateLimitPresets.auth({ store, trustProxy: true });
-      const next = createNext();
-      const firstClient = createRequest({ "x-forwarded-for": "198.51.100.1" });
-
-      for (let i = 0; i < 5; i++) {
-        assertEquals((await limiter(firstClient, next)).status, 200);
-      }
-      assertEquals((await limiter(firstClient, next)).status, 429);
-
-      const secondClient = createRequest({ "x-forwarded-for": "203.0.113.8" });
-      assertEquals((await limiter(secondClient, next)).status, 200);
-    });
-  });
-
-  it("should keep preset proxy headers untrusted by default", async () => {
-    await withStore(async (store) => {
-      const limiter = RateLimitPresets.auth(store);
-      const next = createNext();
-
-      for (let i = 0; i < 5; i++) {
-        const request = createRequest({ "x-forwarded-for": `198.51.100.${i + 1}` });
-        assertEquals((await limiter(request, next)).status, 200);
-      }
-
-      const rotatedHeader = createRequest({ "x-forwarded-for": "203.0.113.8" });
-      assertEquals((await limiter(rotatedHeader, next)).status, 429);
-    });
-  });
-
-  it("should let presets use a custom client key generator", async () => {
-    await withStore(async (store) => {
-      const limiter = RateLimitPresets.auth({
-        store,
-        keyGenerator: (request) => request.headers.get("x-api-key") ?? "anonymous",
-      });
-      const next = createNext();
-      const firstClient = createRequest({ "x-api-key": "client-a" });
-
-      for (let i = 0; i < 5; i++) {
-        assertEquals((await limiter(firstClient, next)).status, 200);
-      }
-      assertEquals((await limiter(firstClient, next)).status, 429);
-
-      const secondClient = createRequest({ "x-api-key": "client-b" });
-      assertEquals((await limiter(secondClient, next)).status, 200);
-    });
-  });
-
-  it("should fail closed with 503 when store throws (SEC-001)", async () => {
-    // Simulate a store outage (e.g. Redis down). The middleware must NOT
-    // call next() in the catch branch — that would silently bypass rate
-    // limiting and reopen brute-force / scraping / credential-stuffing
-    // surfaces. Expect a 503 with Retry-After: 60 instead.
-    const failingStore: RateLimitStore = {
-      increment: () => Promise.reject(new Error("store unavailable")),
-      get: () => Promise.reject(new Error("store unavailable")),
-      reset: () => Promise.reject(new Error("store unavailable")),
-      resetAll: () => Promise.reject(new Error("store unavailable")),
-    };
-
-    const limiter = createRateLimiter({
-      maxRequests: 5,
-      windowMs: 60000,
-      strategy: "fixed-window",
-      store: failingStore,
-    });
-
-    let nextCalled = false;
-    const next = () => {
-      nextCalled = true;
-      return Promise.resolve(new Response("OK"));
-    };
-
-    const response = await limiter(createRequest(), next);
-
-    assertEquals(response.status, 503);
-    assertEquals(response.headers.get("Retry-After"), "60");
-    assertEquals(nextCalled, false, "next() must not be invoked when the store fails");
-  });
-
-  it("should NOT swallow downstream handler errors", async () => {
-    // Downstream handler exceptions must propagate to the normal error handler
-    // rather than being reclassified as a rate-limit outage (503 + Retry-After).
-    // Masking application faults as rate-limit signals hides real problems and
-    // causes clients to back off incorrectly.
-    await withStore(async (store) => {
-      const limiter = createRateLimiter({
-        maxRequests: 5,
-        windowMs: 60000,
-        strategy: "fixed-window",
-        store,
-      });
-
-      let nextCalled = false;
-      const downstreamError = new Error("handler boom");
-      const next = () => {
-        nextCalled = true;
-        return Promise.reject(downstreamError);
-      };
-
-      const err = await assertRejects(
-        () => limiter(createRequest(), next),
-        Error,
-        "handler boom",
-      );
-      assertEquals(err, downstreamError, "the original error must propagate unchanged");
-      assertEquals(nextCalled, true, "next() must have been invoked");
-    });
-  });
-
-  it("should NOT swallow onRateLimitExceeded callback errors", async () => {
-    // User-supplied callback errors must propagate to the normal error handler
-    // rather than being masked as a 503 rate-limit outage.
-    await withStore(async (store) => {
-      const callbackError = new Error("callback boom");
-
-      const limiter = createRateLimiter({
-        maxRequests: 1,
-        windowMs: 60000,
-        strategy: "fixed-window",
-        store,
-        onRateLimitExceeded: () => {
-          throw callbackError;
-        },
-      });
-
-      const request = createRequest();
-      const next = createNext();
-
-      // First request consumes the only token allowed by the limit.
-      const ok = await limiter(request, next);
-      assertEquals(ok.status, 200);
-
-      // Second request triggers the callback, which throws — the error must
-      // propagate (NOT become a 503).
-      const err = await assertRejects(
-        () => limiter(request, next),
-        Error,
-        "callback boom",
-      );
-      assertEquals(err, callbackError, "the original callback error must propagate unchanged");
-    });
-  });
-});
diff --git a/src/security/rate-limit/middleware.ts b/src/security/rate-limit/middleware.ts
deleted file mode 100644
index 880ab655d2..0000000000
--- a/src/security/rate-limit/middleware.ts
+++ /dev/null
@@ -1,195 +0,0 @@
-import { logger } from "#veryfront/utils";
-import type { RateLimitConfig, RateLimitPresetOptions, RateLimitStore } from "./types.ts";
-import { MemoryRateLimitStore } from "./memory-store.ts";
-import { fixedWindowStrategy, slidingWindowStrategy, tokenBucketStrategy } from "./strategies.ts";
-import { resolveRateLimitClientKey } from "./client-key.ts";
-
-/** Rate limit preset: window durations */
-const STRICT_WINDOW_MS = 60_000; // 1 minute
-const MODERATE_WINDOW_MS = 60_000; // 1 minute
-const LENIENT_WINDOW_MS = 3_600_000; // 1 hour
-const AUTH_WINDOW_MS = 900_000; // 15 minutes
-
-/** Rate limit preset: max requests per window */
-const STRICT_MAX_REQUESTS = 10;
-const MODERATE_MAX_REQUESTS = 100;
-const LENIENT_MAX_REQUESTS = 1_000;
-const AUTH_MAX_REQUESTS = 5;
-
-/** Default Retry-After header value in seconds */
-const DEFAULT_RETRY_AFTER_SECONDS = "60";
-
-function defaultKeyGenerator(request: Request, trustProxy: boolean): string {
-  return resolveRateLimitClientKey(request, trustProxy, "unknown");
-}
-
-function isRateLimitStore(
-  value: RateLimitStore | RateLimitPresetOptions,
-): value is RateLimitStore {
-  return "increment" in value && typeof value.increment === "function";
-}
-
-function resolvePresetOptions(
-  storeOrOptions?: RateLimitStore | RateLimitPresetOptions,
-): RateLimitPresetOptions {
-  if (!storeOrOptions) return {};
-  return isRateLimitStore(storeOrOptions) ? { store: storeOrOptions } : storeOrOptions;
-}
-
-function defaultRateLimitExceeded(_request: Request, _key: string, message: string): Response {
-  return new Response(
-    JSON.stringify({
-      error: "Too Many Requests",
-      message,
-    }),
-    {
-      status: 429,
-      headers: {
-        "Content-Type": "application/json",
-        "Retry-After": DEFAULT_RETRY_AFTER_SECONDS,
-      },
-    },
-  );
-}
-
-function getStrategy(strategy: RateLimitConfig["strategy"]) {
-  switch (strategy) {
-    case "sliding-window":
-      return slidingWindowStrategy;
-    case "token-bucket":
-      return tokenBucketStrategy;
-    case "fixed-window":
-    default:
-      return fixedWindowStrategy;
-  }
-}
-
-function applyRateLimitHeaders(response: Response, headers: Headers): void {
-  for (const [name, value] of headers) {
-    response.headers.set(name, value);
-  }
-}
-
-export function createRateLimiter(
-  config: RateLimitConfig,
-): (request: Request, next: (req: Request) => Promise<Response>) => Promise<Response> {
-  const {
-    maxRequests,
-    windowMs,
-    strategy = "fixed-window",
-    keyGenerator,
-    onRateLimitExceeded,
-    skip,
-    message = "Too many requests. Please try again later.",
-    store = new MemoryRateLimitStore(),
-    trustProxy = false,
-  } = config;
-
-  const resolvedKeyGenerator = keyGenerator ??
-    ((req: Request) => defaultKeyGenerator(req, trustProxy));
-
-  const strategyFn = getStrategy(strategy);
-
-  return async function rateLimitMiddleware(
-    request: Request,
-    next: (req: Request) => Promise<Response>,
-  ): Promise<Response> {
-    if (skip && (await skip(request))) {
-      return next(request);
-    }
-
-    const key = resolvedKeyGenerator(request);
-
-    let result: Awaited<ReturnType<typeof strategyFn>>;
-    try {
-      result = await strategyFn(key, { ...config, maxRequests, windowMs }, store);
-    } catch (error) {
-      // Fail closed: only the rate-limit store/strategy path triggers this.
-      // If the store throws (e.g. Redis outage), reject the request with 503
-      // instead of letting it through. Failing open would silently disable
-      // rate limiting and expose brute-force, scraping, and credential-stuffing
-      // surfaces during transient store failures.
-      //
-      // Downstream handler errors (from next(request)) and user-callback errors
-      // (skip, keyGenerator, onRateLimitExceeded) are intentionally NOT caught
-      // here so they remain observable as 5xx via the normal error handler and
-      // are not masked as rate-limit outages with Retry-After: 60.
-      logger.error("Rate limiting error — failing closed", {
-        error: error instanceof Error ? error.message : String(error),
-      });
-
-      return new Response("Service temporarily unavailable", {
-        status: 503,
-        headers: { "Retry-After": "60" },
-      });
-    }
-
-    const headers = new Headers({
-      "X-RateLimit-Limit": maxRequests.toString(),
-      "X-RateLimit-Remaining": result.remaining.toString(),
-      "X-RateLimit-Reset": result.resetTime.toString(),
-    });
-
-    if (!result.allowed) {
-      logger.warn(`Rate limit exceeded for key: ${key}`, {
-        key,
-        limit: maxRequests,
-        window: windowMs,
-      });
-
-      const response = onRateLimitExceeded
-        ? await onRateLimitExceeded(request, key)
-        : defaultRateLimitExceeded(request, key, message);
-
-      applyRateLimitHeaders(response, headers);
-      return response;
-    }
-
-    const response = await next(request);
-    applyRateLimitHeaders(response, headers);
-    return response;
-  };
-}
-
-export const RateLimitPresets = {
-  strict: (storeOrOptions?: RateLimitStore | RateLimitPresetOptions) => {
-    const options = resolvePresetOptions(storeOrOptions);
-    return createRateLimiter({
-      maxRequests: STRICT_MAX_REQUESTS,
-      windowMs: STRICT_WINDOW_MS,
-      strategy: "sliding-window",
-      ...options,
-    });
-  },
-
-  moderate: (storeOrOptions?: RateLimitStore | RateLimitPresetOptions) => {
-    const options = resolvePresetOptions(storeOrOptions);
-    return createRateLimiter({
-      maxRequests: MODERATE_MAX_REQUESTS,
-      windowMs: MODERATE_WINDOW_MS,
-      strategy: "fixed-window",
-      ...options,
-    });
-  },
-
-  lenient: (storeOrOptions?: RateLimitStore | RateLimitPresetOptions) => {
-    const options = resolvePresetOptions(storeOrOptions);
-    return createRateLimiter({
-      maxRequests: LENIENT_MAX_REQUESTS,
-      windowMs: LENIENT_WINDOW_MS,
-      strategy: "fixed-window",
-      ...options,
-    });
-  },
-
-  auth: (storeOrOptions?: RateLimitStore | RateLimitPresetOptions) => {
-    const options = resolvePresetOptions(storeOrOptions);
-    return createRateLimiter({
-      maxRequests: AUTH_MAX_REQUESTS,
-      windowMs: AUTH_WINDOW_MS,
-      strategy: "sliding-window",
-      message: "Too many authentication attempts. Please try again later.",
-      ...options,
-    });
-  },
-};
diff --git a/src/security/rate-limit/strategies.test.ts b/src/security/rate-limit/strategies.test.ts
deleted file mode 100644
index 9758987b58..0000000000
--- a/src/security/rate-limit/strategies.test.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
-import { describe, it } from "#veryfront/testing/bdd.ts";
-import { fixedWindowStrategy, slidingWindowStrategy, tokenBucketStrategy } from "./strategies.ts";
-import { MemoryRateLimitStore } from "./memory-store.ts";
-import type { RateLimitConfig } from "./types.ts";
-
-function createConfig(overrides: Partial<RateLimitConfig> = {}): RateLimitConfig {
-  return {
-    maxRequests: 5,
-    windowMs: 60000,
-    ...overrides,
-  };
-}
-
-async function withStore(fn: (store: MemoryRateLimitStore) => Promise<void>): Promise<void> {
-  const store = new MemoryRateLimitStore();
-  try {
-    await fn(store);
-  } finally {
-    store.destroy();
-  }
-}
-
-describe("fixedWindowStrategy", () => {
-  it("should allow requests under the limit", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 3 });
-
-      const result = await fixedWindowStrategy("test-key", config, store);
-      assertEquals(result.allowed, true);
-      assertEquals(result.remaining, 2);
-    });
-  });
-
-  it("should track remaining requests correctly", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 3 });
-
-      await fixedWindowStrategy("key", config, store);
-      await fixedWindowStrategy("key", config, store);
-      const result = await fixedWindowStrategy("key", config, store);
-
-      assertEquals(result.allowed, true);
-      assertEquals(result.remaining, 0);
-    });
-  });
-
-  it("should deny requests over the limit", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 2 });
-
-      await fixedWindowStrategy("key", config, store);
-      await fixedWindowStrategy("key", config, store);
-      const result = await fixedWindowStrategy("key", config, store);
-
-      assertEquals(result.allowed, false);
-      assertEquals(result.remaining, 0);
-    });
-  });
-
-  it("should provide a reset time in the future", async () => {
-    await withStore(async (store) => {
-      const config = createConfig();
-      const before = Date.now();
-
-      const result = await fixedWindowStrategy("key", config, store);
-
-      assertEquals(result.resetTime >= before, true);
-    });
-  });
-
-  it("should track separate keys independently", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 1 });
-
-      await fixedWindowStrategy("key-a", config, store);
-      const resultA = await fixedWindowStrategy("key-a", config, store);
-      const resultB = await fixedWindowStrategy("key-b", config, store);
-
-      assertEquals(resultA.allowed, false);
-      assertEquals(resultB.allowed, true);
-    });
-  });
-
-  it("should honor configured windowMs in the store state (not hardcoded 60s)", async () => {
-    await withStore(async (store) => {
-      const windowMs = 600_000; // 10 minutes
-      const config = createConfig({ maxRequests: 2, windowMs });
-      const before = Date.now();
-
-      await fixedWindowStrategy("window-key", config, store);
-
-      const state = store.getState("window-key");
-      // resetTime must reflect the configured 10-minute window, not the
-      // hardcoded 60s constant the store previously used.
-      assertEquals(
-        state !== undefined && state.resetTime >= before + windowMs,
-        true,
-      );
-    });
-  });
-});
-
-describe("slidingWindowStrategy", () => {
-  it("should allow requests under the limit", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 3 });
-
-      const result = await slidingWindowStrategy("test-key", config, store);
-      assertEquals(result.allowed, true);
-      assertEquals(result.remaining, 2);
-    });
-  });
-
-  it("should deny requests over the limit", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 2 });
-
-      await slidingWindowStrategy("key", config, store);
-      await slidingWindowStrategy("key", config, store);
-      const result = await slidingWindowStrategy("key", config, store);
-
-      assertEquals(result.allowed, false);
-      assertEquals(result.remaining, 0);
-    });
-  });
-
-  it("should track timestamps within the window", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 5 });
-
-      await slidingWindowStrategy("key", config, store);
-      await slidingWindowStrategy("key", config, store);
-
-      const state = store.getState("key");
-      assertEquals(state?.requestTimestamps?.length, 2);
-    });
-  });
-});
-
-describe("tokenBucketStrategy", () => {
-  it("should allow first request (full bucket)", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 5 });
-
-      const result = await tokenBucketStrategy("key", config, store);
-      assertEquals(result.allowed, true);
-    });
-  });
-
-  it("should track remaining tokens after requests", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 5 });
-
-      const first = await tokenBucketStrategy("key", config, store);
-      assertEquals(first.allowed, true);
-
-      const second = await tokenBucketStrategy("key", config, store);
-      assertEquals(second.allowed, true);
-      assertEquals(second.remaining < first.remaining, true);
-    });
-  });
-
-  it("should deny when bucket is empty", async () => {
-    await withStore(async (store) => {
-      const config = createConfig({ maxRequests: 2 });
-
-      await tokenBucketStrategy("key", config, store);
-      await tokenBucketStrategy("key", config, store);
-      const result = await tokenBucketStrategy("key", config, store);
-
-      assertEquals(result.allowed, false);
-      assertEquals(result.remaining, 0);
-    });
-  });
-});
diff --git a/src/security/rate-limit/strategies.ts b/src/security/rate-limit/strategies.ts
deleted file mode 100644
index 047fb08b3a..0000000000
--- a/src/security/rate-limit/strategies.ts
+++ /dev/null
@@ -1,128 +0,0 @@
-import type { RateLimitConfig, RateLimitStore } from "./types.ts";
-import { MemoryRateLimitStore } from "./memory-store.ts";
-import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
-
-interface RateLimitResult {
-  allowed: boolean;
-  remaining: number;
-  resetTime: number;
-}
-
-/** Fixed window strategy - simple counter that resets at fixed intervals */
-export function fixedWindowStrategy(
-  key: string,
-  config: RateLimitConfig,
-  store: RateLimitStore,
-): Promise<RateLimitResult> {
-  return withSpan(
-    "security.rateLimit.fixedWindow",
-    async () => {
-      const count = await store.increment(key, config.windowMs);
-      const allowed = count <= config.maxRequests;
-      const remaining = Math.max(0, config.maxRequests - count);
-      const resetTime = Date.now() + config.windowMs;
-
-      return { allowed, remaining, resetTime };
-    },
-    { "rateLimit.key": key, "rateLimit.maxRequests": config.maxRequests },
-  );
-}
-
-/** Sliding window strategy - tracks individual timestamps to prevent bursts */
-export function slidingWindowStrategy(
-  key: string,
-  config: RateLimitConfig,
-  store: RateLimitStore,
-): Promise<RateLimitResult> {
-  return withSpan(
-    "security.rateLimit.slidingWindow",
-    async () => {
-      // Fallback to fixed window for non-memory stores
-      if (!(store instanceof MemoryRateLimitStore)) {
-        return fixedWindowStrategy(key, config, store);
-      }
-
-      const now = Date.now();
-      const windowStart = now - config.windowMs;
-
-      const state = store.getState(key) ?? {
-        count: 0,
-        resetTime: now + config.windowMs,
-        requestTimestamps: [],
-      };
-
-      const timestamps = (state.requestTimestamps ?? []).filter(
-        (timestamp) => timestamp > windowStart,
-      );
-      timestamps.push(now);
-
-      state.requestTimestamps = timestamps;
-      state.count = timestamps.length;
-      state.resetTime = now + config.windowMs;
-      store.setState(key, state);
-
-      const allowed = state.count <= config.maxRequests;
-      const remaining = Math.max(0, config.maxRequests - state.count);
-
-      return { allowed, remaining, resetTime: state.resetTime };
-    },
-    { "rateLimit.key": key, "rateLimit.maxRequests": config.maxRequests },
-  );
-}
-
-/** Token bucket strategy - allows bursts up to capacity with constant refill rate */
-export function tokenBucketStrategy(
-  key: string,
-  config: RateLimitConfig,
-  store: RateLimitStore,
-): Promise<RateLimitResult> {
-  return withSpan(
-    "security.rateLimit.tokenBucket",
-    async () => {
-      // Fallback to fixed window for non-memory stores
-      if (!(store instanceof MemoryRateLimitStore)) {
-        return fixedWindowStrategy(key, config, store);
-      }
-
-      const now = Date.now();
-      const refillRate = config.maxRequests / config.windowMs; // tokens per ms
-
-      const existingState = store.getState(key);
-      const state = existingState ?? {
-        // Start with full bucket, consume one token
-        count: config.maxRequests - 1,
-        resetTime: now,
-        requestTimestamps: [now],
-      };
-
-      if (!existingState) {
-        store.setState(key, state);
-        const remaining = Math.floor(state.count);
-        const resetTime = now + (config.maxRequests - remaining) / refillRate;
-        return { allowed: true, remaining, resetTime: Math.floor(resetTime) };
-      }
-
-      // Refill tokens based on time elapsed
-      const timeElapsed = now - state.resetTime;
-      const tokensToAdd = timeElapsed * refillRate;
-      state.count = Math.min(config.maxRequests, state.count + tokensToAdd);
-      state.resetTime = now;
-
-      const resetTime = now + (config.maxRequests - state.count) / refillRate;
-
-      // Check if we have tokens available
-      if (state.count < 1) {
-        store.setState(key, state);
-        return { allowed: false, remaining: 0, resetTime: Math.floor(resetTime) };
-      }
-
-      // Consume one token
-      state.count -= 1;
-      store.setState(key, state);
-
-      const remaining = Math.floor(state.count);
-      return { allowed: true, remaining, resetTime: Math.floor(resetTime) };
-    },
-    { "rateLimit.key": key, "rateLimit.maxRequests": config.maxRequests },
-  );
-}
diff --git a/src/security/rate-limit/types.ts b/src/security/rate-limit/types.ts
deleted file mode 100644
index bda064fb14..0000000000
--- a/src/security/rate-limit/types.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-export type RateLimitStrategy = "token-bucket" | "sliding-window" | "fixed-window";
-
-export interface RateLimitConfig {
-  maxRequests: number;
-  windowMs: number;
-  strategy?: RateLimitStrategy;
-  keyGenerator?: (request: Request) => string;
-  onRateLimitExceeded?: (request: Request, key: string) => Response | Promise<Response>;
-  skip?: (request: Request) => boolean | Promise<boolean>;
-  message?: string;
-  store?: RateLimitStore;
-  /** When true, trust X-Forwarded-For / X-Real-IP headers for client identification.
-   *  Only enable when the server is behind a trusted reverse proxy. Defaults to false. */
-  trustProxy?: boolean;
-}
-
-/** Options accepted by preconfigured rate limiters. */
-export interface RateLimitPresetOptions {
-  /** Storage backend. Existing callers can also pass the store directly. */
-  store?: RateLimitStore;
-  /** Function to derive a stable client key from the request. */
-  keyGenerator?: (request: Request) => string;
-  /**
-   * Trust X-Forwarded-For and X-Real-IP for client identification.
-   * Enable this only behind a trusted reverse proxy.
-   */
-  trustProxy?: boolean;
-}
-
-export interface RateLimitStore {
-  increment(key: string, windowMs?: number): Promise<number>;
-  get(key: string): Promise<number>;
-  reset(key: string): Promise<void>;
-  resetAll(): Promise<void>;
-}
-
-export interface RateLimitState {
-  count: number;
-  resetTime: number;
-  requestTimestamps?: number[];
-}
diff --git a/src/security/secure-fs.test.ts b/src/security/secure-fs.test.ts
index f14d305607..5c7a4667a9 100644
--- a/src/security/secure-fs.test.ts
+++ b/src/security/secure-fs.test.ts
@@ -1,14 +1,309 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
+import {
+  assertEquals,
+  assertRejects,
+  assertStrictEquals,
+  assertThrows,
+} from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { createSecureFs, wrapAdapterWithSecurity } from "./secure-fs.ts";
+import { createSecureFs, SecureFs, wrapAdapterWithSecurity } from "./secure-fs.ts";
 import { VeryfrontError } from "#veryfront/errors/types.ts";
 import { DenoAdapter } from "#veryfront/platform/adapters/runtime/deno/adapter.ts";
-import { createMockAdapter } from "#veryfront/platform/adapters/mock.ts";
+import type { RuntimeAdapter, ServeOptions, Server } from "#veryfront/platform/adapters/base.ts";
+import { captureBoundedTextReader } from "#veryfront/platform/adapters/bounded-text-reader.ts";
 import { FileSnapshotChangedError } from "#veryfront/platform/adapters/file-snapshot-error.ts";
-import { resolve } from "#veryfront/platform/compat/path/index.ts";
+
+function createMockFileSystem(
+  overrides: Partial<RuntimeAdapter["fs"]> = {},
+): RuntimeAdapter["fs"] {
+  const ready = Promise.resolve();
+  const fileSystem: RuntimeAdapter["fs"] = {
+    symlinkSemantics: "none",
+    readFile: () => Promise.resolve(""),
+    writeFile: () => Promise.resolve(),
+    stat: () =>
+      Promise.resolve({
+        isSymlink: false,
+        isDirectory: false,
+        isFile: true,
+        size: 0,
+        mtime: null,
+      }),
+    mkdir: () => Promise.resolve(),
+    remove: () => Promise.resolve(),
+    exists: () => Promise.resolve(true),
+    async *readDir() {},
+    makeTempDir: (prefix) => Promise.resolve(`/tmp/${prefix}`),
+    watch: () => ({
+      ready,
+      done: ready,
+      close() {},
+      async *[Symbol.asyncIterator]() {},
+    }),
+  };
+  return Object.assign(fileSystem, overrides);
+}
+
+// Complete adapter stub for constructor and adapter-lifecycle tests.
+function createMockAdapter() {
+  return { fs: createMockFileSystem() } as RuntimeAdapter;
+}
 
 describe("SecureFs", () => {
+  it("rejects inherited policy fields instead of treating them as configuration", () => {
+    const inheritedConfig = Object.assign(
+      Object.create({ baseDir: "/tmp" }),
+      { adapter: createMockAdapter() },
+    ) as Parameters<typeof createSecureFs>[0];
+    assertThrows(
+      () => createSecureFs(inheritedConfig),
+      VeryfrontError,
+      "own data property",
+    );
+
+    const inheritedValidationOptions = Object.create({ followSymlinks: true });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          validationOptions: inheritedValidationOptions,
+        }),
+      VeryfrontError,
+      "own data property",
+    );
+
+    const inheritedContextOptions = Object.create({ allowedImportDirs: ["outside"] });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          contextOptions: inheritedContextOptions,
+        }),
+      VeryfrontError,
+      "own data property",
+    );
+  });
+
+  it("rejects policy accessors without invoking them", () => {
+    let getterCalls = 0;
+    const accessorConfig = { adapter: createMockAdapter() } as Record<string, unknown>;
+    Object.defineProperty(accessorConfig, "baseDir", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return "/tmp";
+      },
+    });
+    assertThrows(
+      () => createSecureFs(accessorConfig as unknown as Parameters<typeof createSecureFs>[0]),
+      VeryfrontError,
+      "own data property",
+    );
+
+    const validationOptions = {} as Record<string, unknown>;
+    Object.defineProperty(validationOptions, "followSymlinks", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return true;
+      },
+    });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          validationOptions,
+        }),
+      VeryfrontError,
+      "own data property",
+    );
+
+    const contextOptions = {} as Record<string, unknown>;
+    Object.defineProperty(contextOptions, "allowedImportDirs", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return ["outside"];
+      },
+    });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          contextOptions,
+        }),
+      VeryfrontError,
+      "own data property",
+    );
+
+    const allowedDirs = ["public"];
+    Object.defineProperty(allowedDirs, "0", {
+      enumerable: true,
+      configurable: true,
+      get() {
+        getterCalls++;
+        return "outside";
+      },
+    });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          validationOptions: { allowedDirs },
+        }),
+      VeryfrontError,
+      "dense, non-empty strings",
+    );
+
+    const accessorAdapter = {} as Record<string, unknown>;
+    Object.defineProperty(accessorAdapter, "fs", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return {};
+      },
+    });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: accessorAdapter as unknown as RuntimeAdapter,
+        }),
+      VeryfrontError,
+      "own, data-property",
+    );
+
+    assertEquals(getterCalls, 0);
+  });
+
+  it("rejects wrapper option accessors without invoking them", () => {
+    let getterCalls = 0;
+    const options = {} as Record<string, unknown>;
+    Object.defineProperty(options, "baseDir", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return "/tmp";
+      },
+    });
+
+    assertThrows(
+      () =>
+        wrapAdapterWithSecurity(
+          createMockAdapter(),
+          options as unknown as Parameters<typeof wrapAdapterWithSecurity>[1],
+        ),
+      VeryfrontError,
+      "own data property",
+    );
+    assertEquals(getterCalls, 0);
+  });
+
+  it("rejects operation option and watch-path accessors without invoking them", async () => {
+    let getterCalls = 0;
+    const secureFs = createSecureFs({
+      baseDir: "/tmp",
+      adapter: createMockAdapter(),
+    });
+    const recursiveOptions = {} as { recursive?: boolean };
+    Object.defineProperty(recursiveOptions, "recursive", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return true;
+      },
+    });
+    const watchPaths = ["file.txt"];
+    Object.defineProperty(watchPaths, "0", {
+      enumerable: true,
+      configurable: true,
+      get() {
+        getterCalls++;
+        return "outside";
+      },
+    });
+    const watchOptions = {} as { recursive?: boolean };
+    Object.defineProperty(watchOptions, "recursive", {
+      enumerable: true,
+      get() {
+        getterCalls++;
+        return true;
+      },
+    });
+
+    await assertRejects(
+      () => secureFs.mkdir("directory", recursiveOptions),
+      VeryfrontError,
+      "own data property",
+    );
+    assertThrows(
+      () => secureFs.watch(watchPaths),
+      VeryfrontError,
+      "dense, non-empty strings",
+    );
+    assertThrows(
+      () => secureFs.watch("file.txt", watchOptions),
+      VeryfrontError,
+      "own data property",
+    );
+    assertEquals(getterCalls, 0);
+  });
+
+  it("rejects unknown contexts instead of falling through to internal policy", () => {
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/tmp",
+          adapter: createMockAdapter(),
+          context: "unknown" as never,
+        }),
+      VeryfrontError,
+      "valid security context",
+    );
+  });
+
+  it("rejects invalid runtime options instead of weakening validation", () => {
+    for (
+      const config of [
+        { baseDir: "" },
+        { context: null as unknown as "internal" },
+        { contextOptions: null as never },
+        {
+          contextOptions: {
+            allowedImportDirs: [""],
+          },
+        },
+        { onSecurityEvent: "noop" as unknown as () => void },
+        {
+          validationOptions: {
+            level: "unknown" as never,
+          },
+        },
+        {
+          validationOptions: {
+            allowAbsolute: "yes" as unknown as boolean,
+          },
+        },
+      ]
+    ) {
+      assertThrows(
+        () =>
+          createSecureFs({
+            baseDir: "/tmp",
+            adapter: createMockAdapter(),
+            ...config,
+          }),
+        VeryfrontError,
+        "SecureFs",
+      );
+    }
+  });
+
   it("rejects a missing write target beneath a symlinked parent", async () => {
     if (Deno.build.os === "windows") return;
 
@@ -73,20 +368,441 @@ describe("SecureFs", () => {
       assertEquals(outsideFileExists, false);
     } finally {
       await Deno.remove(baseDir, { recursive: true });
-      await Deno.remove(outsideDir, { recursive: true });
+      await Deno.remove(outsideDir, { recursive: true });
+    }
+  });
+
+  it("physically validates directory reads before iteration", async () => {
+    if (Deno.build.os === "windows") return;
+
+    const baseDir = await Deno.makeTempDir();
+    const outsideDir = await Deno.makeTempDir();
+    try {
+      await Deno.writeTextFile(`${outsideDir}/secret.txt`, "secret");
+      await Deno.symlink(outsideDir, `${baseDir}/link`);
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+      });
+
+      await assertRejects(
+        async () => {
+          for await (const _entry of secureFs.readDir("link")) {
+            // Validation must reject before the adapter yields any entry.
+          }
+        },
+        VeryfrontError,
+        "outside base directory",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+      await Deno.remove(outsideDir, { recursive: true });
+    }
+  });
+
+  it("physically validates watched paths before installing the watcher", async () => {
+    if (Deno.build.os === "windows") return;
+
+    const baseDir = await Deno.makeTempDir();
+    const outsideDir = await Deno.makeTempDir();
+    try {
+      await Deno.symlink(outsideDir, `${baseDir}/link`);
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+      });
+      const watcher = secureFs.watch("link");
+
+      await assertRejects(
+        () => watcher.ready!,
+        VeryfrontError,
+        "outside base directory",
+      );
+      watcher.close();
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+      await Deno.remove(outsideDir, { recursive: true });
+    }
+  });
+
+  it("installs and closes a watcher through the validated canonical path", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+      });
+      const watcher = secureFs.watch(".");
+
+      await watcher.ready;
+      watcher.close();
+      await watcher.done;
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("snapshots allowedDirs supplied during construction", async () => {
+    const baseDir = await Deno.makeTempDir();
+    const allowedDirs = ["public"];
+    try {
+      await Deno.mkdir(`${baseDir}/private`);
+      await Deno.writeTextFile(`${baseDir}/private/secret.txt`, "secret");
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+        validationOptions: { allowedDirs },
+      });
+
+      allowedDirs.push("private");
+
+      await assertRejects(
+        () => secureFs.readFile("private/secret.txt"),
+        VeryfrontError,
+        "not allowed",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("snapshots module-loading import directories supplied during construction", async () => {
+    const baseDir = await Deno.makeTempDir();
+    const allowedImportDirs = ["public"];
+    try {
+      await Deno.mkdir(`${baseDir}/private`);
+      await Deno.writeTextFile(`${baseDir}/private/secret.txt`, "secret");
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "module-loading",
+        contextOptions: { allowedImportDirs },
+      });
+
+      allowedImportDirs.push("private");
+
+      await assertRejects(
+        () => secureFs.readFile("private/secret.txt"),
+        VeryfrontError,
+        "not allowed",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("distinguishes an omitted module allowlist from an explicit deny-all list", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      await Deno.mkdir(`${baseDir}/src`);
+      await Deno.writeTextFile(`${baseDir}/src/module.ts`, "export {};");
+      const unrestricted = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "module-loading",
+      });
+      const denyAll = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "module-loading",
+        contextOptions: { allowedImportDirs: [] },
+      });
+
+      assertEquals(await unrestricted.readFile("src/module.ts"), "export {};");
+      await assertRejects(
+        () => denyAll.readFile("src/module.ts"),
+        VeryfrontError,
+        "not allowed",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("returns false for missing admitted paths in existence-checking contexts", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      await Deno.mkdir(`${baseDir}/public`);
+      await Deno.writeTextFile(`${baseDir}/public/present.txt`, "present");
+
+      for (const context of ["user-input", "static-serving"] as const) {
+        const secureFs = createSecureFs({
+          baseDir,
+          adapter: new DenoAdapter(),
+          context,
+        });
+
+        assertEquals(await secureFs.exists("public/present.txt"), true);
+        assertEquals(await secureFs.exists("public/missing.txt"), false);
+      }
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("keeps the filesystem reference supplied during construction", async () => {
+    const originalFs = createMockFileSystem({
+      readFile: () => Promise.resolve("original"),
+    });
+    const replacementFs = createMockFileSystem({
+      readFile: () => Promise.resolve("replacement"),
+    });
+    const adapter = { fs: originalFs } as RuntimeAdapter;
+    const secureFs = createSecureFs({ baseDir: "/tmp", adapter });
+
+    adapter.fs = replacementFs;
+
+    assertEquals(await secureFs.readFile("file.txt"), "original");
+  });
+
+  it("snapshots filesystem methods supplied during construction", async () => {
+    const fileSystem = createMockFileSystem({
+      readFile: () => Promise.resolve("original"),
+    });
+    const secureFs = createSecureFs({
+      baseDir: "/tmp",
+      adapter: { fs: fileSystem } as RuntimeAdapter,
+    });
+
+    Object.defineProperty(fileSystem, "readFile", {
+      configurable: true,
+      value: () => Promise.resolve("replacement"),
+    });
+
+    assertEquals(await secureFs.readFile("file.txt"), "original");
+  });
+
+  it("snapshots filesystem symlink capabilities during construction", async () => {
+    const fileSystem = createMockFileSystem({
+      readFile: () => Promise.resolve("unsafe"),
+    }) as RuntimeAdapter["fs"] & { symlinkSemantics?: "none" };
+    Reflect.deleteProperty(fileSystem, "symlinkSemantics");
+    const secureFs = createSecureFs({
+      baseDir: "/tmp",
+      adapter: { fs: fileSystem } as RuntimeAdapter,
+    });
+
+    fileSystem.symlinkSemantics = "none";
+
+    await assertRejects(
+      () => secureFs.readFile("file.txt"),
+      VeryfrontError,
+      "provide lstat",
+    );
+  });
+
+  it("does not expose APIs that can mutate or bypass its policy", () => {
+    const secureFs = createSecureFs({
+      baseDir: "/tmp",
+      adapter: createMockAdapter(),
+    }) as unknown as Record<string, unknown>;
+
+    assertEquals("getUnsafeAdapter" in secureFs, false);
+    assertEquals("updateValidationOptions" in secureFs, false);
+    assertEquals("setContext" in secureFs, false);
+  });
+
+  it("does not allow published metadata to forge a whole-file read ceiling", async () => {
+    let unboundedReads = 0;
+    const adapter = createMockAdapter();
+    adapter.fs = createMockFileSystem({
+      readFileBytes: () => {
+        unboundedReads++;
+        return Promise.resolve(new Uint8Array([1, 2]));
+      },
+    });
+    const secureFs = createSecureFs({ baseDir: "/tmp", adapter, context: "build" });
+
+    assertEquals(Reflect.set(secureFs, "maxWholeFileReadBytes", 1), false);
+    assertEquals(Reflect.deleteProperty(secureFs, "maxWholeFileReadBytes"), false);
+    await assertRejects(
+      () => captureBoundedTextReader(secureFs).readUtf8("file.txt", 1, "Asset"),
+      TypeError,
+      "genuine exact bounded byte reader",
+    );
+    assertEquals(unboundedReads, 0);
+  });
+
+  it("publishes bounded filesystem capabilities as immutable own data", async () => {
+    let boundedReads = 0;
+    let exactReads = 0;
+    const adapter = createMockAdapter();
+    adapter.fs = createMockFileSystem({
+      readFileBytes: () => Promise.resolve(new Uint8Array([3])),
+      maxWholeFileReadBytes: 3,
+      readFileBytesBounded: () => {
+        boundedReads++;
+        return Promise.resolve(new Uint8Array([1]));
+      },
+      readFileBytesWithinLimit: () => {
+        exactReads++;
+        return Promise.resolve(new Uint8Array([2]));
+      },
+    });
+    const secureFs = createSecureFs({ baseDir: "/tmp", adapter, context: "build" });
+
+    for (
+      const key of [
+        "maxWholeFileReadBytes",
+        "readFileBytesBounded",
+        "readFileBytesWithinLimit",
+      ] as const
+    ) {
+      const descriptor = Object.getOwnPropertyDescriptor(secureFs, key);
+      assertStrictEquals(descriptor?.enumerable, true, key);
+      assertStrictEquals(descriptor?.configurable, false, key);
+      assertStrictEquals(descriptor?.writable, false, key);
+      assertEquals(Reflect.deleteProperty(secureFs, key), false, key);
+    }
+    assertEquals(
+      Reflect.set(secureFs, "readFileBytesBounded", async () => new Uint8Array()),
+      false,
+    );
+    assertEquals(
+      Reflect.set(secureFs, "readFileBytesWithinLimit", async () => new Uint8Array()),
+      false,
+    );
+    assertThrows(
+      () => Object.defineProperty(secureFs, "maxWholeFileReadBytes", { value: 1 }),
+      TypeError,
+    );
+
+    assertEquals([...(await secureFs.readFileBytesBounded!("file.txt", 1))], [1]);
+    assertEquals([...(await secureFs.readFileBytesWithinLimit!("file.txt", 1))], [2]);
+    assertEquals({ boundedReads, exactReads }, { boundedReads: 1, exactReads: 1 });
+  });
+
+  it("keeps policy authority private while allowing unrelated subclass state", async () => {
+    class DerivedSecureFs extends SecureFs {
+      readonly marker = "derived";
+    }
+
+    const adapter = createMockAdapter();
+    adapter.fs = createMockFileSystem({
+      readFile: () => Promise.resolve("original"),
+    });
+    const secureFs = new DerivedSecureFs({ baseDir: "/tmp", adapter, context: "build" });
+    const forged = secureFs as unknown as Record<string, unknown>;
+    Reflect.set(forged, "fileSystem", {
+      readFile: () => Promise.resolve("forged"),
+    });
+    Reflect.set(forged, "config", Object.freeze({}));
+    Reflect.deleteProperty(forged, "validationOptions");
+
+    assertEquals(secureFs.marker, "derived");
+    assertEquals(await secureFs.readFile("file.txt"), "original");
+  });
+
+  it("keeps validation authoritative when an observer throws", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      await Deno.writeTextFile(`${baseDir}/file.txt`, "ok");
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+        onSecurityEvent() {
+          throw new Error("observer failure");
+        },
+      });
+
+      assertEquals(await secureFs.readFile("file.txt"), "ok");
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("creates temporary directories inside the configured trust root", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: new DenoAdapter(),
+        context: "internal",
+      });
+
+      const tempDir = await secureFs.makeTempDir("vf-test-");
+      assertEquals(tempDir.startsWith(`${await Deno.realPath(baseDir)}/vf-test-`), true);
+      assertEquals((await Deno.stat(tempDir)).isDirectory, true);
+
+      await assertRejects(
+        () => secureFs.makeTempDir("../escape-"),
+        VeryfrontError,
+        "safe filename characters",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
+    }
+  });
+
+  it("does not emulate binary reads through lossy text encoding", async () => {
+    const baseDir = await Deno.makeTempDir();
+    try {
+      await Deno.writeFile(`${baseDir}/binary.dat`, new Uint8Array([0xff, 0x00, 0x61]));
+      const denoFileSystem = new DenoAdapter().fs;
+      const fsWithoutBinary = createMockFileSystem({
+        readFile: denoFileSystem.readFile.bind(denoFileSystem),
+        writeFile: denoFileSystem.writeFile.bind(denoFileSystem),
+        stat: denoFileSystem.stat.bind(denoFileSystem),
+        lstat: denoFileSystem.lstat?.bind(denoFileSystem),
+        realPath: denoFileSystem.realPath?.bind(denoFileSystem),
+        mkdir: denoFileSystem.mkdir.bind(denoFileSystem),
+        remove: denoFileSystem.remove.bind(denoFileSystem),
+        exists: denoFileSystem.exists.bind(denoFileSystem),
+        readDir: denoFileSystem.readDir.bind(denoFileSystem),
+        makeTempDir: denoFileSystem.makeTempDir.bind(denoFileSystem),
+        watch: denoFileSystem.watch.bind(denoFileSystem),
+      });
+      Reflect.deleteProperty(fsWithoutBinary, "symlinkSemantics");
+      const secureFs = createSecureFs({
+        baseDir,
+        adapter: { fs: fsWithoutBinary } as RuntimeAdapter,
+        context: "internal",
+      });
+
+      await assertRejects(
+        () => secureFs.readFileBytes("binary.dat"),
+        VeryfrontError,
+        "binary-safe",
+      );
+    } finally {
+      await Deno.remove(baseDir, { recursive: true });
     }
   });
 
-  it("binds snapshot reads to captured authority, canonical paths, and the construction root", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/assets/app.bin", "present");
+  it("preserves bounded reads through canonical path validation", async () => {
+    let receivedPath: string | undefined;
+    let receivedLimit: number | undefined;
+    const fileSystem = createMockFileSystem({
+      readFileBytesBounded(path, byteLimit) {
+        receivedPath = path;
+        receivedLimit = byteLimit;
+        return Promise.resolve(new Uint8Array([1, 2, 3]));
+      },
+    });
+    const secureFs = createSecureFs({
+      baseDir: "/project",
+      adapter: { fs: fileSystem } as RuntimeAdapter,
+      context: "internal",
+    });
+
+    assertEquals(typeof secureFs.readFileBytesBounded, "function");
+    assertEquals([...await secureFs.readFileBytesBounded!("assets/app.bin", 3)], [1, 2, 3]);
+    assertEquals(receivedPath, "/project/assets/app.bin");
+    assertEquals(receivedLimit, 3);
+  });
+
+  it("binds snapshot reads to the validated path and construction-time root", async () => {
     let originalCalls = 0;
     let replacementCalls = 0;
     let received: [string, string, number] | undefined;
     const source = new Uint8Array([1, 2, 3]);
-    Object.defineProperty(adapter.fs, "readFileSnapshotWithinLimit", {
-      configurable: true,
-      value(path: string, root: string, byteLimit: number) {
+    const fileSystem = createMockFileSystem({
+      readFileSnapshotWithinLimit(path, root, byteLimit) {
         originalCalls++;
         received = [path, root, byteLimit];
         return Promise.resolve(source);
@@ -94,42 +810,36 @@ describe("SecureFs", () => {
     });
     const config = {
       baseDir: "/project/./",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal" as const,
     };
     const secureFs = createSecureFs(config);
     config.baseDir = "/attacker";
-    Object.defineProperty(adapter.fs, "readFileSnapshotWithinLimit", {
-      configurable: true,
-      value() {
-        replacementCalls++;
-        return Promise.resolve(new Uint8Array([9]));
-      },
-    });
+    fileSystem.readFileSnapshotWithinLimit = () => {
+      replacementCalls++;
+      return Promise.resolve(new Uint8Array([9]));
+    };
 
     const result = await secureFs.readFileSnapshotWithinLimit!("assets/app.bin", 3);
     source[0] = 9;
 
     assertEquals([...result], [1, 2, 3]);
-    assertEquals(received?.[0], "/project/assets/app.bin");
-    assertEquals(resolve(received?.[1] ?? ""), "/project");
-    assertEquals(received?.[2], 3);
+    assertEquals(received, ["/project/assets/app.bin", "/project", 3]);
     assertEquals({ originalCalls, replacementCalls }, { originalCalls: 1, replacementCalls: 0 });
   });
 
   it("rejects traversal before invoking raw snapshot authority", async () => {
-    const adapter = createMockAdapter();
     let reads = 0;
-    Object.defineProperty(adapter.fs, "readFileSnapshotWithinLimit", {
-      configurable: true,
-      value() {
-        reads++;
-        return Promise.resolve(new Uint8Array());
-      },
-    });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: {
+        fs: createMockFileSystem({
+          readFileSnapshotWithinLimit() {
+            reads++;
+            return Promise.resolve(new Uint8Array());
+          },
+        }),
+      } as RuntimeAdapter,
       context: "internal",
     });
 
@@ -141,243 +851,496 @@ describe("SecureFs", () => {
     assertEquals(reads, 0);
   });
 
-  it("quarantines malformed ordinary readers without vetoing snapshot authority", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "present");
-    let getterCalls = 0;
-    Object.defineProperty(adapter.fs, "readFileSnapshotWithinLimit", {
-      configurable: true,
-      value: () => Promise.resolve(new Uint8Array([4])),
+  it("rejects malformed snapshot results before returning them", async () => {
+    const secureFs = createSecureFs({
+      baseDir: "/project",
+      adapter: {
+        fs: createMockFileSystem({
+          readFileSnapshotWithinLimit: () => Promise.resolve({} as Uint8Array),
+        }),
+      } as RuntimeAdapter,
+      context: "internal",
     });
-    Object.defineProperty(adapter.fs, "readFileBytesWithinLimit", {
-      configurable: true,
-      get() {
-        getterCalls++;
-        throw new Error("must not run");
-      },
+
+    await assertRejects(
+      () => secureFs.readFileSnapshotWithinLimit!("asset.bin", 3),
+      TypeError,
+    );
+  });
+
+  it("omits rooted snapshot authority when the adapter lacks it", () => {
+    const secureFs = createSecureFs({
+      baseDir: "/project",
+      adapter: createMockAdapter(),
+      context: "internal",
     });
 
+    assertEquals(secureFs.readFileSnapshotWithinLimit, undefined);
+    assertEquals("readFileSnapshotWithinLimit" in secureFs, false);
+  });
+
+  it("rejects a virtual snapshot when its source generation changes in flight", async () => {
+    let generation = 1;
+    const readStarted = Promise.withResolvers<void>();
+    const releaseRead = Promise.withResolvers<void>();
+    const fileSystem = createMockFileSystem({
+      getSourceSnapshotVersion: () => generation,
+      async readFileBytesWithinLimit() {
+        readStarted.resolve();
+        await releaseRead.promise;
+        return new Uint8Array([1, 2, 3]);
+      },
+    });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal",
     });
-    assertEquals(
-      [...await secureFs.readFileSnapshotWithinLimit!("asset.bin", 1)],
-      [4],
+
+    const pendingRead = secureFs.readFileSnapshotWithinLimit!("asset.bin", 3);
+    await readStarted.promise;
+    generation = 2;
+    releaseRead.resolve();
+
+    await assertRejects(
+      () => pendingRead,
+      FileSnapshotChangedError,
+      "generation changed",
     );
-    assertEquals(secureFs.readFileBytesWithinLimit, undefined);
-    assertEquals(getterCalls, 0);
   });
 
-  it("fails closed instead of reconstructing binary data from a text read", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "text fallback must not run");
-    let textReads = 0;
-    const readFile = adapter.fs.readFile;
-    adapter.fs.readFile = (path: string) => {
-      textReads++;
-      return readFile(path);
-    };
-    for (
-      const key of [
-        "readFileBytes",
-        "readFileBytesBounded",
-        "readFileBytesWithinLimit",
-        "readFileSnapshotWithinLimit",
-      ] as const
-    ) {
-      Reflect.deleteProperty(adapter.fs, key);
+  it("quarantines malformed legacy capabilities without vetoing genuine snapshots", async () => {
+    const cases = [
+      { key: "readFileBytes", kind: "accessor" },
+      { key: "readFileBytesBounded", kind: "invalid" },
+      { key: "readFileBytesWithinLimit", kind: "callable-proxy" },
+      { key: "writeFileBytes", kind: "accessor" },
+      { key: "maxWholeFileReadBytes", kind: "invalid" },
+    ] as const;
+
+    for (const testCase of cases) {
+      let getterCalls = 0;
+      let applyTrapCalls = 0;
+      let writeCalls = 0;
+      const fileSystem = createMockFileSystem({
+        readFileBytes: () => Promise.resolve(new Uint8Array([1])),
+        readFileBytesBounded: () => Promise.resolve(new Uint8Array([2])),
+        readFileBytesWithinLimit: () => Promise.resolve(new Uint8Array([3])),
+        writeFileBytes: () => {
+          writeCalls++;
+          return Promise.resolve();
+        },
+        maxWholeFileReadBytes: 8,
+        readFileSnapshotWithinLimit: () => Promise.resolve(new Uint8Array([4])),
+      });
+      if (testCase.kind === "accessor") {
+        Object.defineProperty(fileSystem, testCase.key, {
+          configurable: true,
+          get() {
+            getterCalls++;
+            throw new Error("malformed legacy accessor must not run");
+          },
+        });
+      } else if (testCase.kind === "callable-proxy") {
+        Object.defineProperty(fileSystem, testCase.key, {
+          configurable: true,
+          value: new Proxy(function () {}, {
+            apply() {
+              applyTrapCalls++;
+              throw new Error("malformed legacy callable Proxy must not run");
+            },
+          }),
+        });
+      } else {
+        Object.defineProperty(fileSystem, testCase.key, {
+          configurable: true,
+          value: testCase.key === "maxWholeFileReadBytes" ? -1 : 1,
+        });
+      }
+
+      const secureFs = createSecureFs({
+        baseDir: "/project",
+        adapter: { fs: fileSystem } as RuntimeAdapter,
+        context: "internal",
+      });
+      const capturedFileSystem = (secureFs as unknown as {
+        fileSystem: RuntimeAdapter["fs"];
+      }).fileSystem;
+
+      assertEquals(
+        [...await secureFs.readFileSnapshotWithinLimit!("asset.bin", 1)],
+        [4],
+        testCase.key,
+      );
+      assertEquals({ getterCalls, applyTrapCalls }, { getterCalls: 0, applyTrapCalls: 0 });
+      assertEquals(
+        capturedFileSystem.readFileBytes === undefined,
+        testCase.key === "readFileBytes",
+        testCase.key,
+      );
+      if (capturedFileSystem.readFileBytes !== undefined) {
+        assertEquals([...await secureFs.readFileBytes("asset.bin")], [1]);
+      }
+      if (testCase.key === "readFileBytesBounded") {
+        assertEquals(secureFs.readFileBytesBounded, undefined);
+      } else {
+        assertEquals([...await secureFs.readFileBytesBounded!("asset.bin", 1)], [2]);
+      }
+      if (testCase.key === "readFileBytesWithinLimit") {
+        assertEquals(secureFs.readFileBytesWithinLimit, undefined);
+      } else {
+        assertEquals([...await secureFs.readFileBytesWithinLimit!("asset.bin", 1)], [3]);
+      }
+      if (testCase.key === "writeFileBytes") {
+        assertEquals(capturedFileSystem.writeFileBytes, undefined);
+      } else {
+        await capturedFileSystem.writeFileBytes!("/project/asset.bin", new Uint8Array([5]));
+        assertEquals(writeCalls, 1);
+      }
+      assertEquals(
+        secureFs.maxWholeFileReadBytes,
+        testCase.key === "readFileBytes" || testCase.key === "maxWholeFileReadBytes"
+          ? undefined
+          : 8,
+        testCase.key,
+      );
+      assertEquals({ getterCalls, applyTrapCalls }, { getterCalls: 0, applyTrapCalls: 0 });
     }
+  });
 
+  it("rejects traversal before invoking a bounded reader", async () => {
+    let reads = 0;
+    const fileSystem = createMockFileSystem({
+      readFileBytesBounded() {
+        reads++;
+        return Promise.resolve(new Uint8Array());
+      },
+    });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal",
     });
 
     await assertRejects(
-      () => secureFs.readFileBytes("asset.bin"),
-      TypeError,
-      "binary-safe file reads",
+      () => secureFs.readFileBytesBounded!("../secret.bin", 1),
+      VeryfrontError,
+      "Path validation failed",
     );
-    assertEquals(textReads, 0);
+    assertEquals(reads, 0);
   });
 
-  it("captures binary-read authority and isolates returned bytes", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "present");
-    const source = new Uint8Array([0xff, 0x00]);
-    Object.defineProperty(adapter.fs, "readFileBytes", {
-      configurable: true,
-      value: () => Promise.resolve(source),
-    });
-
+  it("does not advertise bounded reads when the adapter lacks the capability", () => {
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: createMockAdapter(),
       context: "internal",
     });
-    adapter.fs.readFileBytes = () => Promise.resolve(new Uint8Array([9]));
 
-    const result = await secureFs.readFileBytes("asset.bin");
-    source[0] = 1;
-    assertEquals([...result], [0xff, 0x00]);
+    assertEquals(secureFs.readFileBytesBounded, undefined);
   });
 
-  it("rejects generation changes around virtual snapshots", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "old");
-    Reflect.deleteProperty(adapter.fs, "readFileSnapshotWithinLimit");
-    const exact = adapter.fs.readFileBytesWithinLimit;
-    if (!exact) {
-      throw new Error("Mock adapter must provide bounded byte reads");
-    }
-    let mutateDuringRead = false;
-    let sourceGeneration = 1;
-    Object.defineProperty(adapter.fs, "getSourceSnapshotVersion", {
-      configurable: true,
-      value: () => sourceGeneration,
-    });
-    Object.defineProperty(adapter.fs, "readFileBytesWithinLimit", {
-      configurable: true,
-      value: async (path: string, byteLimit: number) => {
-        const bytes = await exact(path, byteLimit);
-        if (mutateDuringRead) {
-          adapter.fs.files.set(path, "new");
-          sourceGeneration++;
-        }
-        return bytes;
+  it("captures exact bounded reads and validates their canonical path", async () => {
+    let originalCalls = 0;
+    let replacementCalls = 0;
+    let received: { path: string; byteLimit: number } | undefined;
+    const fileSystem = createMockFileSystem({
+      readFileBytesWithinLimit(path, byteLimit) {
+        originalCalls++;
+        received = { path, byteLimit };
+        return Promise.resolve(new Uint8Array([1, 2, 3]));
       },
     });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal",
     });
+    fileSystem.readFileBytesWithinLimit = () => {
+      replacementCalls++;
+      return Promise.resolve(new Uint8Array([9]));
+    };
 
     assertEquals(
-      new TextDecoder().decode(
-        await secureFs.readFileSnapshotWithinLimit!("asset.bin", 3),
-      ),
-      "old",
-    );
-    mutateDuringRead = true;
-    await assertRejects(
-      () => secureFs.readFileSnapshotWithinLimit!("asset.bin", 3),
-      FileSnapshotChangedError,
+      [...await secureFs.readFileBytesWithinLimit!("assets/app.bin", 3)],
+      [1, 2, 3],
     );
+    assertEquals(received, { path: "/project/assets/app.bin", byteLimit: 3 });
+    assertEquals(originalCalls, 1);
+    assertEquals(replacementCalls, 0);
   });
 
-  it("accepts an initial zero generation for virtual snapshots", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "old");
-    Reflect.deleteProperty(adapter.fs, "readFileSnapshotWithinLimit");
-    Object.defineProperty(adapter.fs, "getSourceSnapshotVersion", {
-      configurable: true,
-      value: () => 0,
+  it("post-verifies an exact reader before re-advertising its result", async () => {
+    const fileSystem = createMockFileSystem({
+      readFileBytesWithinLimit() {
+        return Promise.resolve(new Uint8Array([1, 2, 3]));
+      },
     });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal",
     });
 
-    assertEquals(
-      new TextDecoder().decode(
-        await secureFs.readFileSnapshotWithinLimit!("asset.bin", 3),
-      ),
-      "old",
+    await assertRejects(
+      () => secureFs.readFileBytesWithinLimit!("assets/app.bin", 2),
+      RangeError,
+      "exceeds 2 bytes",
     );
   });
 
-  it("captures module-loading allowlists and preserves them across context changes", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/allowed/module.ts", "allowed");
-    adapter.fs.files.set("/project/secret/module.ts", "secret");
-    const allowedImportDirs = ["allowed"];
+  it("does not let Object.prototype provide a missing filesystem method", () => {
+    const fileSystem = createMockFileSystem();
+    delete (fileSystem as Partial<RuntimeAdapter["fs"]>).writeFile;
+    Object.defineProperty(Object.prototype, "writeFile", {
+      configurable: true,
+      value: () => Promise.resolve(),
+    });
+    try {
+      assertThrows(
+        () =>
+          createSecureFs({
+            baseDir: "/project",
+            adapter: { fs: fileSystem } as RuntimeAdapter,
+            context: "internal",
+          }),
+        VeryfrontError,
+        "must provide writeFile",
+      );
+    } finally {
+      delete (Object.prototype as Record<string, unknown>).writeFile;
+    }
+  });
+
+  it("rejects traversal and invalid limits before invoking an exact bounded reader", async () => {
+    let reads = 0;
+    const fileSystem = createMockFileSystem({
+      readFileBytesWithinLimit() {
+        reads++;
+        return Promise.resolve(new Uint8Array());
+      },
+    });
     const secureFs = createSecureFs({
       baseDir: "/project",
-      adapter,
+      adapter: { fs: fileSystem } as RuntimeAdapter,
       context: "internal",
-      contextOptions: { allowedImportDirs },
     });
-    allowedImportDirs[0] = "secret";
 
-    secureFs.setContext("module-loading");
-    assertEquals(await secureFs.readFile("allowed/module.ts"), "allowed");
     await assertRejects(
-      () => secureFs.readFile("secret/module.ts"),
+      () => secureFs.readFileBytesWithinLimit!("../secret.bin", 1),
       VeryfrontError,
-      "not allowed",
+      "Path validation failed",
     );
+    await assertRejects(
+      () => secureFs.readFileBytesWithinLimit!("assets/app.bin", 0),
+      RangeError,
+      "positive safe integer",
+    );
+    assertEquals(reads, 0);
   });
 
-  it("does not let validation updates replace the construction root or adapter", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/outside/secret.txt", "secret");
-    const replacement = createMockAdapter();
-    replacement.fs.files.set("/outside/secret.txt", "replacement");
-    const secureFs = createSecureFs({
-      baseDir: "/project",
-      adapter,
-      context: "internal",
+  it("rejects accessor and Proxy filesystem capabilities without invoking hooks", () => {
+    let getterCalls = 0;
+    const accessor = createMockFileSystem();
+    Object.defineProperty(accessor, "readFileBytesWithinLimit", {
+      get() {
+        getterCalls++;
+        return () => Promise.resolve(new Uint8Array());
+      },
+    });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/project",
+          adapter: { fs: accessor } as RuntimeAdapter,
+          context: "internal",
+        }),
+      VeryfrontError,
+      "binary capabilities are invalid",
+    );
+    assertEquals(getterCalls, 0);
+
+    let applyTraps = 0;
+    const callableProxy = createMockFileSystem({
+      readFileBytesWithinLimit: new Proxy(
+        () => Promise.resolve(new Uint8Array()),
+        {
+          apply() {
+            applyTraps++;
+            throw new Error("must not run");
+          },
+        },
+      ),
     });
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/project",
+          adapter: { fs: callableProxy } as RuntimeAdapter,
+          context: "internal",
+        }),
+      VeryfrontError,
+      "binary capabilities are invalid",
+    );
+    assertEquals(applyTraps, 0);
 
-    secureFs.updateValidationOptions({
-      baseDir: "/outside",
-      adapter: replacement,
-      allowAbsolute: true,
+    let proxyTraps = 0;
+    const proxied = new Proxy(createMockFileSystem(), {
+      getOwnPropertyDescriptor() {
+        proxyTraps++;
+        throw new Error("must not run");
+      },
     });
-    await assertRejects(
-      () => secureFs.readFile("/outside/secret.txt"),
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/project",
+          adapter: { fs: proxied } as RuntimeAdapter,
+          context: "internal",
+        }),
+      VeryfrontError,
+      "Proxy",
+    );
+    assertEquals(proxyTraps, 0);
+  });
+
+  it("rejects an accessor-backed binary writer as sanitized configuration", () => {
+    let getterCalls = 0;
+    const fileSystem = createMockFileSystem();
+    Object.defineProperty(fileSystem, "writeFileBytes", {
+      configurable: true,
+      get() {
+        getterCalls++;
+        return () => Promise.resolve();
+      },
+    });
+
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/project",
+          adapter: { fs: fileSystem } as RuntimeAdapter,
+          context: "internal",
+        }),
       VeryfrontError,
-      "outside base directory",
+      "binary capabilities are invalid",
     );
+    assertEquals(getterCalls, 0);
   });
 
-  it("publishes captured capabilities as immutable own data", () => {
+  it("does not advertise exact bounded reads when the adapter lacks the capability", () => {
     const secureFs = createSecureFs({
       baseDir: "/project",
       adapter: createMockAdapter(),
       context: "internal",
     });
-    for (
-      const key of [
-        "maxWholeFileReadBytes",
-        "readFileBytesBounded",
-        "readFileBytesWithinLimit",
-        "readFileSnapshotWithinLimit",
-        "createFileBytesExclusive",
-      ] as const
-    ) {
-      const descriptor = Object.getOwnPropertyDescriptor(secureFs, key);
-      assertEquals(descriptor?.enumerable, true, key);
-      assertEquals(descriptor?.configurable, false, key);
-      assertEquals(descriptor?.writable, false, key);
-      assertEquals(Reflect.deleteProperty(secureFs, key), false, key);
-    }
-    assertEquals(
-      Reflect.set(secureFs, "readFileBytesWithinLimit", () => Promise.resolve(new Uint8Array())),
-      false,
+
+    assertEquals(secureFs.readFileBytesWithinLimit, undefined);
+  });
+
+  it("preserves a validated fixed whole-file read ceiling", () => {
+    const fileSystem = createMockFileSystem({
+      readFileBytes: () => Promise.resolve(new Uint8Array()),
+      maxWholeFileReadBytes: 4096,
+    });
+    const secureFs = createSecureFs({
+      baseDir: "/project",
+      adapter: { fs: fileSystem } as RuntimeAdapter,
+      context: "internal",
+    });
+
+    assertEquals(secureFs.maxWholeFileReadBytes, 4096);
+  });
+
+  it("rejects accessor-backed whole-file ceiling metadata without invoking it", () => {
+    let getterCalls = 0;
+    const fileSystem = createMockFileSystem({
+      readFileBytes: () => Promise.resolve(new Uint8Array()),
+    });
+    Object.defineProperty(fileSystem, "maxWholeFileReadBytes", {
+      get() {
+        getterCalls++;
+        return 4096;
+      },
+    });
+
+    assertThrows(
+      () =>
+        createSecureFs({
+          baseDir: "/project",
+          adapter: { fs: fileSystem } as RuntimeAdapter,
+          context: "internal",
+        }),
+      VeryfrontError,
+      "binary capabilities are invalid",
     );
+    assertEquals(getterCalls, 0);
+  });
+
+  it("preserves adapter lifecycle methods with their original receiver", async () => {
+    let initialized = false;
+    let shutDown = false;
+    const adapter = {
+      id: "memory",
+      name: "lifecycle-test",
+      capabilities: {
+        typescript: false,
+        jsx: false,
+        http2: false,
+        websocket: false,
+        workers: false,
+        fileWatching: false,
+        shell: false,
+        kvStore: false,
+        writableFs: false,
+      },
+      fs: createMockAdapter().fs,
+      env: { get: () => undefined, set: () => {}, toObject: () => ({}) },
+      server: {},
+      serve(
+        this: RuntimeAdapter,
+        _handler: (request: Request) => Promise<Response> | Response,
+        _options: ServeOptions,
+      ): Promise<Server> {
+        assertStrictEquals(this, adapter);
+        return Promise.resolve({
+          addr: { hostname: "localhost", port: 0 },
+          stop: () => Promise.resolve(),
+        });
+      },
+      initialize(this: RuntimeAdapter): Promise<void> {
+        assertStrictEquals(this, adapter);
+        initialized = true;
+        return Promise.resolve();
+      },
+      shutdown(this: RuntimeAdapter): Promise<void> {
+        assertStrictEquals(this, adapter);
+        shutDown = true;
+        return Promise.resolve();
+      },
+    } as unknown as RuntimeAdapter;
+
+    const wrapped = wrapAdapterWithSecurity(adapter, { baseDir: "/tmp" });
+    await wrapped.initialize?.();
+    await wrapped.serve(() => new Response(), {});
+    await wrapped.shutdown?.();
+
+    assertEquals(initialized, true);
+    assertEquals(shutDown, true);
+    assertStrictEquals(wrapped.env, adapter.env);
+    assertStrictEquals(wrapped.server, adapter.server);
   });
 
   it("keeps raw and rooted snapshot signatures distinct on secured adapters", async () => {
-    const adapter = createMockAdapter();
-    adapter.fs.files.set("/project/asset.bin", "present");
     let received: [string, string, number] | undefined;
-    Object.defineProperty(adapter.fs, "readFileSnapshotWithinLimit", {
-      configurable: true,
-      value(path: string, root: string, byteLimit: number) {
+    const adapter = createMockAdapter();
+    adapter.fs = createMockFileSystem({
+      readFileSnapshotWithinLimit(path, root, byteLimit) {
         received = [path, root, byteLimit];
         return Promise.resolve(new Uint8Array([1, 2, 3]));
       },
     });
-    const wrapped = wrapAdapterWithSecurity(adapter, {
-      baseDir: "/project",
-      context: "internal",
-    });
+    const wrapped = wrapAdapterWithSecurity(adapter, { baseDir: "/project" });
 
     assertEquals(
       [
@@ -390,7 +1353,7 @@ describe("SecureFs", () => {
       [1, 2, 3],
     );
     assertEquals(received, ["/project/asset.bin", "/project", 3]);
-    assertThrows(
+    await assertRejects(
       () =>
         wrapped.fs.readFileSnapshotWithinLimit!(
           "/project/asset.bin",
@@ -401,50 +1364,4 @@ describe("SecureFs", () => {
       "construction-time root",
     );
   });
-
-  describe("getUnsafeAdapter", () => {
-    it("throws in production", () => {
-      const originalEnv = Deno.env.get("NODE_ENV");
-      try {
-        Deno.env.set("NODE_ENV", "production");
-        const secureFs = createSecureFs({
-          baseDir: "/tmp",
-          adapter: createMockAdapter(),
-        });
-
-        assertThrows(
-          () => secureFs.getUnsafeAdapter(),
-          VeryfrontError,
-          "not allowed in production",
-        );
-      } finally {
-        if (originalEnv !== undefined) {
-          Deno.env.set("NODE_ENV", originalEnv);
-        } else {
-          Deno.env.delete("NODE_ENV");
-        }
-      }
-    });
-
-    it("returns adapter in development", () => {
-      const originalEnv = Deno.env.get("NODE_ENV");
-      try {
-        Deno.env.set("NODE_ENV", "development");
-        const adapter = createMockAdapter();
-        const secureFs = createSecureFs({
-          baseDir: "/tmp",
-          adapter,
-        });
-
-        const result = secureFs.getUnsafeAdapter();
-        assertEquals(result, adapter);
-      } finally {
-        if (originalEnv !== undefined) {
-          Deno.env.set("NODE_ENV", originalEnv);
-        } else {
-          Deno.env.delete("NODE_ENV");
-        }
-      }
-    });
-  });
 });
diff --git a/src/security/secure-fs.ts b/src/security/secure-fs.ts
index c7b30e5d5e..6a1a834fa1 100644
--- a/src/security/secure-fs.ts
+++ b/src/security/secure-fs.ts
@@ -1,48 +1,64 @@
 import type {
   DirEntry,
+  FileChangeEvent,
   FileInfo,
   FileWatcher,
   RuntimeAdapter,
 } from "#veryfront/platform/adapters/base.ts";
-import { logger as baseLogger } from "#veryfront/utils";
 import {
+  type PathValidationPolicyOptions,
   sanitizePathForDisplay,
   validatePath,
-  validatePathSync,
   type ValidationOptions,
   ValidationPresets,
   type ValidationResult,
 } from "./path-validation.ts";
 import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
-import { SECURITY_VIOLATION } from "#veryfront/errors";
-import { getHostEnv } from "#veryfront/platform/compat/process.ts";
+import { INVALID_ARGUMENT, NOT_SUPPORTED, SECURITY_VIOLATION } from "#veryfront/errors";
+import { isProxyWithoutHooks } from "#veryfront/platform/compat/error-introspection.ts";
 import {
-  captureByteReadCapabilities,
-  type CapturedByteReaders,
-  type CapturedWholeFileReader,
-  captureExclusiveCreateCapability,
+  type CapturedFileSystemCapabilities,
+  captureFileSystemCapabilities,
+  captureLegacyFileSystemCapabilitiesForSnapshot,
+  captureSnapshotReadCapability,
   captureStaticReadCapabilities,
 } from "#veryfront/platform/adapters/file-system-capabilities.ts";
+import { copyFixedUint8ArrayWithinLimit } from "#veryfront/platform/adapters/bounded-text-reader.ts";
 import { FileSnapshotChangedError } from "#veryfront/platform/adapters/file-snapshot-error.ts";
-import { resolve } from "#veryfront/platform/compat/path/index.ts";
+import { isAbsolute, relative, resolve, sep } from "#veryfront/platform/compat/path/index.ts";
 
-const logger = baseLogger.component("secure-fs");
+export const SECURITY_CONTEXTS = [
+  "user-input",
+  "static-serving",
+  "build",
+  "internal",
+  "route-discovery",
+  "module-loading",
+] as const;
 
-export type SecurityContext =
-  | "user-input"
-  | "static-serving"
-  | "build"
-  | "internal"
-  | "route-discovery"
-  | "module-loading";
+export type SecurityContext = (typeof SECURITY_CONTEXTS)[number];
+
+const SECURITY_CONTEXT_SET = new Set<string>(SECURITY_CONTEXTS);
+
+export function isSecurityContext(value: unknown): value is SecurityContext {
+  return typeof value === "string" && SECURITY_CONTEXT_SET.has(value);
+}
+
+function requireSecurityContext(value: unknown): SecurityContext {
+  if (!isSecurityContext(value)) {
+    throw INVALID_ARGUMENT.create({
+      detail: "SecureFs requires a valid security context",
+    });
+  }
+  return value;
+}
 
 export interface SecureFsConfig {
   baseDir: string;
   adapter: RuntimeAdapter;
   context?: SecurityContext;
   contextOptions?: ContextOptions;
-  validationOptions?: Partial<ValidationOptions>;
-  throwOnError?: boolean;
+  validationOptions?: Partial<Omit<PathValidationPolicyOptions, "baseDir">>;
   onSecurityEvent?: (event: SecurityEvent) => void;
 }
 
@@ -56,136 +72,548 @@ export interface SecurityEvent {
 }
 
 interface ContextOptions {
-  allowedImportDirs?: string[];
+  readonly allowedImportDirs?: string[];
 }
 
-function snapshotContextOptions(options?: ContextOptions): ContextOptions {
-  return {
-    allowedImportDirs: options?.allowedImportDirs === undefined
-      ? undefined
-      : [...options.allowedImportDirs],
-  };
+const VALIDATION_LEVELS = new Set<NonNullable<ValidationOptions["level"]>>([
+  "strict",
+  "normal",
+]);
+
+const SECURE_FS_CONFIG_KEYS = new Set([
+  "baseDir",
+  "adapter",
+  "context",
+  "contextOptions",
+  "validationOptions",
+  "onSecurityEvent",
+]);
+const SECURE_FS_WRAPPER_OPTION_KEYS = new Set([
+  "baseDir",
+  "context",
+  "contextOptions",
+  "validationOptions",
+  "onSecurityEvent",
+]);
+const VALIDATION_OPTION_KEYS = new Set([
+  "level",
+  "allowedDirs",
+  "followSymlinks",
+  "checkExists",
+  "allowAbsolute",
+]);
+const CONTEXT_OPTION_KEYS = new Set(["allowedImportDirs"]);
+const RECURSIVE_OPERATION_OPTION_KEYS = new Set(["recursive"]);
+const WATCH_OPTION_KEYS = new Set(["recursive", "signal"]);
+const MAX_POLICY_DIRECTORY_ENTRIES = 1_024;
+const MAX_POLICY_DIRECTORY_LENGTH = 4_096;
+const universalObjectPrototype = Object.prototype;
+const objectDefineProperty = Object.defineProperty;
+const objectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+
+const SECURE_FS_IMMUTABLE_AUTHORITY_KEYS = [
+  "config",
+  "fileSystem",
+  "validationOptions",
+  "readFileBytesBounded",
+  "readFileBytesWithinLimit",
+  "maxWholeFileReadBytes",
+] as const;
+
+function hardenSecureFsAuthority(target: object): void {
+  for (const key of SECURE_FS_IMMUTABLE_AUTHORITY_KEYS) {
+    const descriptor = objectGetOwnPropertyDescriptor(target, key);
+    if (descriptor === undefined || !("value" in descriptor)) {
+      invalidSecureFsOption(`SecureFs ${key} publication is invalid`);
+    }
+    objectDefineProperty(target, key, {
+      configurable: false,
+      enumerable: descriptor.enumerable === true,
+      value: descriptor.value,
+      writable: false,
+    });
+  }
 }
 
-function snapshotValidationOptions(
-  options?: Partial<ValidationOptions>,
-): Partial<ValidationOptions> {
-  if (options === undefined) return {};
-  return {
-    ...options,
-    allowedDirs: options.allowedDirs === undefined ? undefined : [...options.allowedDirs],
-  };
+type OwnOptionSnapshot = Readonly<Record<string, unknown>>;
+
+interface NormalizedSecureFsConfig {
+  readonly baseDir: string;
+  readonly context: SecurityContext;
+  readonly contextOptions: ContextOptions;
+  readonly validationOptions: Partial<Omit<PathValidationPolicyOptions, "baseDir">>;
+  readonly onSecurityEvent: (event: SecurityEvent) => void;
+}
+
+function invalidSecureFsOption(detail: string): never {
+  throw INVALID_ARGUMENT.create({ detail });
 }
 
-type FileSystemMethod = (...args: never[]) => unknown;
+function hasInheritedOption(value: object, key: string): boolean {
+  let prototype: object | null;
+  try {
+    prototype = Object.getPrototypeOf(value);
+  } catch {
+    invalidSecureFsOption("SecureFs options could not be inspected safely");
+  }
 
-function captureFileSystemMethod(
-  fileSystem: object,
-  key: string,
-  required = false,
-): FileSystemMethod | undefined {
   const seen = new Set<object>();
+  for (let depth = 0; prototype !== null && depth < 64; depth++) {
+    if (seen.has(prototype)) {
+      invalidSecureFsOption("SecureFs options contain an invalid prototype chain");
+    }
+    seen.add(prototype);
+    try {
+      if (Object.getOwnPropertyDescriptor(prototype, key) !== undefined) return true;
+      prototype = Object.getPrototypeOf(prototype);
+    } catch {
+      invalidSecureFsOption("SecureFs options could not be inspected safely");
+    }
+  }
+
+  if (prototype !== null) {
+    invalidSecureFsOption("SecureFs options prototype chain is too deep");
+  }
+  return false;
+}
+
+function snapshotOwnOptions(
+  value: unknown,
+  label: string,
+  allowedKeys: ReadonlySet<string>,
+): OwnOptionSnapshot {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    invalidSecureFsOption(`${label} must be an object`);
+  }
+
+  let ownKeys: Array<string | symbol>;
+  try {
+    ownKeys = Reflect.ownKeys(value);
+  } catch {
+    invalidSecureFsOption(`${label} could not be inspected safely`);
+  }
+
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const key of ownKeys) {
+    if (typeof key !== "string" || !allowedKeys.has(key)) {
+      invalidSecureFsOption(
+        `${label} contains an unsupported ${typeof key === "string" ? `option: ${key}` : "symbol"}`,
+      );
+    }
+
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(value, key);
+    } catch {
+      invalidSecureFsOption(`${label}.${key} could not be inspected safely`);
+    }
+    if (descriptor === undefined || !("value" in descriptor)) {
+      invalidSecureFsOption(`${label}.${key} must be an own data property`);
+    }
+    snapshot[key] = descriptor.value;
+  }
+
+  for (const key of allowedKeys) {
+    if (
+      Object.getOwnPropertyDescriptor(snapshot, key) === undefined &&
+      hasInheritedOption(value, key)
+    ) {
+      invalidSecureFsOption(`${label}.${key} must be an own data property`);
+    }
+  }
+
+  Object.freeze(snapshot);
+  return snapshot;
+}
+
+function snapshotDirectoryList(
+  value: unknown,
+  label: string,
+): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value)) {
+    invalidSecureFsOption(`${label} must contain non-empty strings`);
+  }
+
+  let lengthDescriptor: PropertyDescriptor | undefined;
+  let ownKeys: Array<string | symbol>;
+  try {
+    lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    ownKeys = Reflect.ownKeys(value);
+  } catch {
+    invalidSecureFsOption(`${label} could not be inspected safely`);
+  }
+  const length = lengthDescriptor && "value" in lengthDescriptor
+    ? lengthDescriptor.value
+    : undefined;
+  if (
+    !Number.isSafeInteger(length) ||
+    length < 0 ||
+    length > MAX_POLICY_DIRECTORY_ENTRIES
+  ) {
+    invalidSecureFsOption(
+      `${label} must contain at most ${MAX_POLICY_DIRECTORY_ENTRIES} entries`,
+    );
+  }
+
+  for (const key of ownKeys) {
+    if (key === "length") continue;
+    if (typeof key !== "string") {
+      invalidSecureFsOption(`${label} must not contain symbol properties`);
+    }
+    const index = Number(key);
+    if (!Number.isSafeInteger(index) || index < 0 || index >= length || String(index) !== key) {
+      invalidSecureFsOption(`${label} must be a dense array without custom properties`);
+    }
+  }
+
+  const snapshot = new Array<string>(length);
+  for (let index = 0; index < length; index++) {
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    } catch {
+      invalidSecureFsOption(`${label}[${index}] could not be inspected safely`);
+    }
+    if (
+      descriptor === undefined ||
+      !("value" in descriptor) ||
+      typeof descriptor.value !== "string" ||
+      descriptor.value.length === 0 ||
+      descriptor.value.length > MAX_POLICY_DIRECTORY_LENGTH
+    ) {
+      invalidSecureFsOption(
+        `${label} must contain dense, non-empty strings no longer than ${MAX_POLICY_DIRECTORY_LENGTH} characters`,
+      );
+    }
+    snapshot[index] = descriptor.value;
+  }
+  Object.freeze(snapshot);
+  return snapshot;
+}
+
+type FilesystemMethod = (...args: unknown[]) => unknown;
+type FilesystemMethodKey =
+  | "readFile"
+  | "readFileBytes"
+  | "readFileBytesBounded"
+  | "readFileBytesWithinLimit"
+  | "writeFile"
+  | "stat"
+  | "lstat"
+  | "realPath"
+  | "mkdir"
+  | "remove"
+  | "exists"
+  | "readDir"
+  | "makeTempDir"
+  | "watch";
+
+function snapshotFilesystemMethod(
+  fileSystem: object,
+  key: FilesystemMethodKey,
+): FilesystemMethod | undefined {
   let owner: object | null = fileSystem;
+  const seen = new Set<object>();
   for (let depth = 0; owner !== null && depth < 64; depth++) {
-    if (owner === Object.prototype) break;
-    if (seen.has(owner)) throw new TypeError(`SecureFs ${key} has an invalid prototype chain`);
+    if (owner === universalObjectPrototype) return undefined;
+    if (isProxyWithoutHooks(owner)) {
+      invalidSecureFsOption(`SecureFs filesystem ${key} capability cannot be a Proxy`);
+    }
+    if (seen.has(owner)) {
+      invalidSecureFsOption("SecureFs filesystem contains an invalid prototype chain");
+    }
     seen.add(owner);
-    const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+
+    let parent: object | null;
+    try {
+      parent = Object.getPrototypeOf(owner);
+    } catch {
+      invalidSecureFsOption(`SecureFs filesystem ${key} capability could not be inspected safely`);
+    }
+    if (owner !== fileSystem && parent === null) return undefined;
+
+    let descriptor: PropertyDescriptor | undefined;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(owner, key);
+    } catch {
+      invalidSecureFsOption(`SecureFs filesystem ${key} capability could not be inspected safely`);
+    }
     if (descriptor !== undefined) {
       if (!("value" in descriptor)) {
-        if (!required) return undefined;
-        throw new TypeError(`SecureFs filesystem ${key} must be a data-property method`);
+        invalidSecureFsOption(`SecureFs filesystem ${key} must be a data-property method`);
       }
-      if (descriptor.value === undefined && !required) return undefined;
-      if (typeof descriptor.value !== "function") {
-        if (!required) return undefined;
-        throw new TypeError(`SecureFs filesystem ${key} must be a function`);
+      if (descriptor.value === undefined) return undefined;
+      if (
+        typeof descriptor.value !== "function" ||
+        isProxyWithoutHooks(descriptor.value)
+      ) {
+        invalidSecureFsOption(`SecureFs filesystem ${key} must be a non-Proxy function`);
       }
-      return descriptor.value as FileSystemMethod;
+      return descriptor.value as FilesystemMethod;
     }
-    owner = Object.getPrototypeOf(owner);
+
+    owner = parent;
   }
-  if (owner !== null && owner !== Object.prototype) {
-    throw new TypeError("SecureFs filesystem prototype chain is too deep");
+
+  if (owner !== null) {
+    invalidSecureFsOption("SecureFs filesystem prototype chain is too deep");
   }
-  if (required) throw new TypeError(`SecureFs filesystem must provide ${key}`);
   return undefined;
 }
 
-function snapshotFileSystemAuthority(fileSystem: RuntimeAdapter["fs"]): RuntimeAdapter["fs"] {
-  const required = (key: string) => captureFileSystemMethod(fileSystem, key, true)!;
-  const optional = (key: string) => captureFileSystemMethod(fileSystem, key);
-  const readFile = required("readFile");
-  const writeFile = required("writeFile");
-  const exists = required("exists");
-  const readDir = required("readDir");
-  const stat = required("stat");
-  const mkdir = required("mkdir");
-  const remove = required("remove");
-  const makeTempDir = required("makeTempDir");
-  const watch = required("watch");
-
-  const snapshot: RuntimeAdapter["fs"] = {
-    readFile: (path) => Reflect.apply(readFile, fileSystem, [path]) as Promise<string>,
-    writeFile: (path, content) =>
-      Reflect.apply(writeFile, fileSystem, [path, content]) as Promise<void>,
-    exists: (path) => Reflect.apply(exists, fileSystem, [path]) as Promise<boolean>,
-    readDir: (path) => Reflect.apply(readDir, fileSystem, [path]) as AsyncIterable<DirEntry>,
-    stat: (path) => Reflect.apply(stat, fileSystem, [path]) as Promise<FileInfo>,
-    mkdir: (path, options) => Reflect.apply(mkdir, fileSystem, [path, options]) as Promise<void>,
-    remove: (path, options) => Reflect.apply(remove, fileSystem, [path, options]) as Promise<void>,
-    makeTempDir: (prefix) => Reflect.apply(makeTempDir, fileSystem, [prefix]) as Promise<string>,
-    watch: (paths, options) => Reflect.apply(watch, fileSystem, [paths, options]) as FileWatcher,
-  };
+function requireFilesystemMethod(
+  fileSystem: RuntimeAdapter["fs"],
+  key: Exclude<
+    FilesystemMethodKey,
+    | "readFileBytes"
+    | "readFileBytesBounded"
+    | "readFileBytesWithinLimit"
+    | "lstat"
+    | "realPath"
+  >,
+): FilesystemMethod {
+  const method = snapshotFilesystemMethod(fileSystem, key);
+  if (method === undefined) {
+    invalidSecureFsOption(`SecureFs filesystem must provide ${key}`);
+  }
+  return method;
+}
 
-  const semantics = Object.getOwnPropertyDescriptor(fileSystem, "symlinkSemantics");
-  if (semantics && "value" in semantics && semantics.value === "none") {
-    Object.defineProperty(snapshot, "symlinkSemantics", { enumerable: true, value: "none" });
+function snapshotFilesystem(
+  fileSystem: RuntimeAdapter["fs"],
+  hasSnapshotAuthority: boolean,
+): RuntimeAdapter["fs"] {
+  if (isProxyWithoutHooks(fileSystem)) {
+    invalidSecureFsOption("SecureFs filesystem cannot be a Proxy");
+  }
+  let fileCapabilities: CapturedFileSystemCapabilities;
+  try {
+    fileCapabilities = hasSnapshotAuthority
+      ? captureLegacyFileSystemCapabilitiesForSnapshot(fileSystem, "SecureFs filesystem")
+      : captureFileSystemCapabilities(fileSystem, "SecureFs filesystem");
+  } catch (_) {
+    invalidSecureFsOption("SecureFs filesystem binary capabilities are invalid");
+  }
+  const readFile = requireFilesystemMethod(fileSystem, "readFile");
+  const writeFile = requireFilesystemMethod(fileSystem, "writeFile");
+  const stat = requireFilesystemMethod(fileSystem, "stat");
+  const lstat = snapshotFilesystemMethod(fileSystem, "lstat");
+  const realPath = snapshotFilesystemMethod(fileSystem, "realPath");
+  const mkdir = requireFilesystemMethod(fileSystem, "mkdir");
+  const remove = requireFilesystemMethod(fileSystem, "remove");
+  const exists = requireFilesystemMethod(fileSystem, "exists");
+  const readDir = requireFilesystemMethod(fileSystem, "readDir");
+  const makeTempDir = requireFilesystemMethod(fileSystem, "makeTempDir");
+  const watch = requireFilesystemMethod(fileSystem, "watch");
+
+  let semantics: PropertyDescriptor | undefined;
+  try {
+    semantics = Object.getOwnPropertyDescriptor(fileSystem, "symlinkSemantics");
+  } catch {
+    invalidSecureFsOption("SecureFs filesystem symlink semantics could not be inspected safely");
+  }
+
+  const snapshot = Object.create(null) as RuntimeAdapter["fs"];
+  if (semantics !== undefined && "value" in semantics && semantics.value === "none") {
+    Object.defineProperty(snapshot, "symlinkSemantics", {
+      value: "none",
+      enumerable: true,
+    });
+  }
+  snapshot.readFile = (path) => Reflect.apply(readFile, fileSystem, [path]) as Promise<string>;
+  snapshot.writeFile = (path, content) =>
+    Reflect.apply(writeFile, fileSystem, [path, content]) as Promise<void>;
+  snapshot.stat = (path) => Reflect.apply(stat, fileSystem, [path]) as Promise<FileInfo>;
+  snapshot.mkdir = (path, options) =>
+    Reflect.apply(mkdir, fileSystem, [path, options]) as Promise<void>;
+  snapshot.remove = (path, options) =>
+    Reflect.apply(remove, fileSystem, [path, options]) as Promise<void>;
+  snapshot.exists = (path) => Reflect.apply(exists, fileSystem, [path]) as Promise<boolean>;
+  snapshot.readDir = (path) =>
+    Reflect.apply(readDir, fileSystem, [path]) as AsyncIterable<DirEntry>;
+  snapshot.makeTempDir = (prefix) =>
+    Reflect.apply(makeTempDir, fileSystem, [prefix]) as Promise<string>;
+  snapshot.watch = (paths, options) =>
+    Reflect.apply(watch, fileSystem, [paths, options]) as FileWatcher;
+  const wholeFileReader = fileCapabilities.wholeFileReader;
+  if (wholeFileReader !== undefined) {
+    Object.defineProperty(snapshot, "maxWholeFileReadBytes", {
+      value: wholeFileReader.maximumBytes,
+      enumerable: true,
+      configurable: false,
+      writable: false,
+    });
+  }
+  const readFileBytes = fileCapabilities.readFileBytes;
+  if (readFileBytes !== undefined) {
+    snapshot.readFileBytes = readFileBytes;
+  }
+  const readFileBytesBounded = fileCapabilities.readFileBytesBounded;
+  if (readFileBytesBounded !== undefined) {
+    snapshot.readFileBytesBounded = readFileBytesBounded;
+  }
+  const readFileBytesWithinLimit = fileCapabilities.readFileBytesWithinLimit;
+  if (readFileBytesWithinLimit !== undefined) {
+    snapshot.readFileBytesWithinLimit = readFileBytesWithinLimit;
   }
+  const writeFileBytes = fileCapabilities.writeFileBytes;
+  if (writeFileBytes !== undefined) {
+    snapshot.writeFileBytes = writeFileBytes;
+  }
+  if (lstat !== undefined) {
+    snapshot.lstat = (path) => Reflect.apply(lstat, fileSystem, [path]) as Promise<FileInfo>;
+  }
+  if (realPath !== undefined) {
+    snapshot.realPath = (path) => Reflect.apply(realPath, fileSystem, [path]) as Promise<string>;
+  }
+
+  return Object.freeze(snapshot);
+}
+
+function snapshotValidationAdapter(fileSystem: RuntimeAdapter["fs"]): RuntimeAdapter {
+  const validationFs: {
+    symlinkSemantics?: "none";
+    stat?: RuntimeAdapter["fs"]["stat"];
+    lstat?: RuntimeAdapter["fs"]["lstat"];
+    realPath?: RuntimeAdapter["fs"]["realPath"];
+  } = {};
+
+  let semantics: PropertyDescriptor | undefined;
+  try {
+    semantics = Object.getOwnPropertyDescriptor(fileSystem, "symlinkSemantics");
+  } catch {
+    invalidSecureFsOption("SecureFs filesystem symlink semantics could not be inspected safely");
+  }
+  if (semantics !== undefined && "value" in semantics && semantics.value === "none") {
+    validationFs.symlinkSemantics = "none";
+  }
+
+  const stat = snapshotFilesystemMethod(fileSystem, "stat");
+  if (stat !== undefined) {
+    validationFs.stat = (path: string) =>
+      Reflect.apply(stat, fileSystem, [path]) as Promise<FileInfo>;
+  }
+  const lstat = snapshotFilesystemMethod(fileSystem, "lstat");
+  if (lstat !== undefined) {
+    validationFs.lstat = (path: string) =>
+      Reflect.apply(lstat, fileSystem, [path]) as Promise<FileInfo>;
+  }
+  const realPath = snapshotFilesystemMethod(fileSystem, "realPath");
+  if (realPath !== undefined) {
+    validationFs.realPath = (path: string) =>
+      Reflect.apply(realPath, fileSystem, [path]) as Promise<string>;
+  }
+
+  Object.freeze(validationFs);
+  return Object.freeze({ fs: validationFs }) as RuntimeAdapter;
+}
+
+function cloneAndFreezeAllowedDirs(
+  allowedDirs: string[] | undefined,
+): string[] | undefined {
+  if (allowedDirs === undefined) return undefined;
+  return snapshotDirectoryList(allowedDirs, "SecureFs allowedDirs");
+}
+
+function normalizeValidationOptions(
+  options: Partial<Omit<PathValidationPolicyOptions, "baseDir">> | undefined,
+): Partial<Omit<PathValidationPolicyOptions, "baseDir">> {
+  if (options === undefined) return Object.freeze({});
+  const snapshot = snapshotOwnOptions(
+    options,
+    "SecureFs validationOptions",
+    VALIDATION_OPTION_KEYS,
+  );
+  const normalized: Partial<Omit<PathValidationPolicyOptions, "baseDir">> = {};
+  const level = snapshot.level;
+  if (
+    level !== undefined &&
+    !VALIDATION_LEVELS.has(level as NonNullable<ValidationOptions["level"]>)
+  ) {
+    invalidSecureFsOption(
+      "SecureFs validation level must be strict or normal",
+    );
+  }
+  if (level !== undefined) normalized.level = level as ValidationOptions["level"];
+  const allowedDirs = snapshotDirectoryList(snapshot.allowedDirs, "SecureFs allowedDirs");
+  if (allowedDirs !== undefined) normalized.allowedDirs = allowedDirs;
   for (
     const key of [
-      "readFileBytes",
-      "readFileBytesBounded",
-      "readFileBytesWithinLimit",
-      "readFileSnapshotWithinLimit",
-      "writeFileBytes",
-      "createFileBytesExclusive",
-      "rename",
-      "lstat",
-      "realPath",
-      "resolveFile",
-      "refreshSourceSnapshot",
-      "ensureSourceSnapshotFresh",
-      "getSourceSnapshotVersion",
+      "followSymlinks",
+      "checkExists",
+      "allowAbsolute",
     ] as const
   ) {
-    const method = optional(key);
-    if (method !== undefined) {
-      Object.defineProperty(snapshot, key, {
-        enumerable: true,
-        value: (...args: unknown[]) => Reflect.apply(method, fileSystem, args),
-      });
+    const value = snapshot[key];
+    if (
+      value !== undefined &&
+      typeof value !== "boolean"
+    ) {
+      invalidSecureFsOption(`SecureFs ${key} must be a boolean`);
     }
+    if (value !== undefined) normalized[key] = value;
   }
-  const ceiling = Object.getOwnPropertyDescriptor(fileSystem, "maxWholeFileReadBytes");
-  if (
-    ceiling && "value" in ceiling &&
-    Number.isSafeInteger(ceiling.value) && ceiling.value > 0 &&
-    snapshot.readFileBytes !== undefined
-  ) {
-    Object.defineProperty(snapshot, "maxWholeFileReadBytes", {
-      enumerable: true,
-      value: ceiling.value,
-    });
+  return Object.freeze(normalized);
+}
+
+function normalizeContextOptions(
+  options: ContextOptions | undefined,
+): ContextOptions {
+  if (options === undefined) return Object.freeze({});
+  const snapshot = snapshotOwnOptions(
+    options,
+    "SecureFs contextOptions",
+    CONTEXT_OPTION_KEYS,
+  );
+  return Object.freeze({
+    allowedImportDirs: snapshotDirectoryList(
+      snapshot.allowedImportDirs,
+      "SecureFs allowedImportDirs",
+    ),
+  });
+}
+
+function normalizeRecursiveOperationOptions(
+  options: { recursive?: boolean } | undefined,
+  label: string,
+): Readonly<{ recursive?: boolean }> | undefined {
+  if (options === undefined) return undefined;
+  const snapshot = snapshotOwnOptions(
+    options,
+    label,
+    RECURSIVE_OPERATION_OPTION_KEYS,
+  );
+  if (snapshot.recursive !== undefined && typeof snapshot.recursive !== "boolean") {
+    invalidSecureFsOption(`${label}.recursive must be a boolean`);
   }
-  return Object.freeze(snapshot);
+  return Object.freeze(
+    snapshot.recursive === undefined ? {} : { recursive: snapshot.recursive },
+  );
+}
+
+function normalizeWatchOptions(
+  options: { recursive?: boolean; signal?: AbortSignal } | undefined,
+): Readonly<{ recursive?: boolean; signal?: AbortSignal }> | undefined {
+  if (options === undefined) return undefined;
+  const snapshot = snapshotOwnOptions(options, "SecureFs watch options", WATCH_OPTION_KEYS);
+  if (snapshot.recursive !== undefined && typeof snapshot.recursive !== "boolean") {
+    invalidSecureFsOption("SecureFs watch options.recursive must be a boolean");
+  }
+  if (snapshot.signal !== undefined && !(snapshot.signal instanceof AbortSignal)) {
+    invalidSecureFsOption("SecureFs watch options.signal must be an AbortSignal");
+  }
+  const normalized: { recursive?: boolean; signal?: AbortSignal } = {};
+  if (snapshot.recursive !== undefined) normalized.recursive = snapshot.recursive;
+  if (snapshot.signal !== undefined) normalized.signal = snapshot.signal;
+  return Object.freeze(normalized);
 }
 
 function getContextValidationOptions(
   context: SecurityContext,
   baseDir: string,
   options?: ContextOptions,
-): ValidationOptions {
+): PathValidationPolicyOptions {
   switch (context) {
     case "user-input":
       return ValidationPresets.userInput(baseDir);
@@ -205,168 +633,269 @@ function getContextValidationOptions(
       return {
         baseDir,
         level: "normal",
-        allowedDirs: options?.allowedImportDirs ?? [],
+        allowedDirs: options?.allowedImportDirs,
         followSymlinks: false,
         allowAbsolute: true,
       };
     case "internal":
-    default:
       return ValidationPresets.internal(baseDir);
   }
 }
 
 export class SecureFs {
-  private config: Required<SecureFsConfig>;
-  private validationOptions: ValidationOptions;
+  private readonly config: NormalizedSecureFsConfig;
   private readonly fileSystem: RuntimeAdapter["fs"];
-  private readonly validationAdapter: RuntimeAdapter;
-  private readonly unboundedFileReader?: (path: string) => Promise<Uint8Array>;
-  private readonly wholeFileReader?: CapturedWholeFileReader;
-  readonly maxWholeFileReadBytes?: number;
-  readonly readFileBytesBounded?: (path: string, byteLimit: number) => Promise<Uint8Array>;
-  readonly readFileBytesWithinLimit?: (path: string, byteLimit: number) => Promise<Uint8Array>;
-  readonly readFileSnapshotWithinLimit?: (
+  private readonly validationOptions: ValidationOptions;
+  readonly readFileBytesBounded?: (
     path: string,
     byteLimit: number,
   ) => Promise<Uint8Array>;
-  readonly createFileBytesExclusive?: (path: string, content: Uint8Array) => Promise<void>;
+  readonly readFileBytesWithinLimit?: (
+    path: string,
+    byteLimit: number,
+  ) => Promise<Uint8Array>;
+  declare readonly readFileSnapshotWithinLimit?: (
+    path: string,
+    byteLimit: number,
+  ) => Promise<Uint8Array>;
+  readonly maxWholeFileReadBytes?: number;
 
   constructor(config: SecureFsConfig) {
-    this.config = {
-      context: "internal",
-      throwOnError: true,
-      onSecurityEvent: () => {},
-      ...config,
-      contextOptions: snapshotContextOptions(config.contextOptions),
-      validationOptions: snapshotValidationOptions(config.validationOptions),
-    };
-    this.fileSystem = snapshotFileSystemAuthority(this.config.adapter.fs);
-    this.validationAdapter = Object.freeze({ ...this.config.adapter, fs: this.fileSystem });
-
-    this.validationOptions = this.buildValidationOptions(
-      this.config.context,
-      this.config.contextOptions,
-      this.validationAdapter,
+    const snapshot = snapshotOwnOptions(
+      config,
+      "SecureFs config",
+      SECURE_FS_CONFIG_KEYS,
     );
+    const configuredBaseDir = snapshot.baseDir;
+    if (typeof configuredBaseDir !== "string" || configuredBaseDir.length === 0) {
+      invalidSecureFsOption("SecureFs baseDir must be a non-empty string");
+    }
+    const baseDir = resolve(configuredBaseDir);
 
-    const staticReaders = captureStaticReadCapabilities(this.fileSystem, "SecureFs filesystem");
-    let byteReaders: CapturedByteReaders;
+    const adapter = snapshot.adapter;
+    if (
+      typeof adapter !== "object" ||
+      adapter === null
+    ) {
+      invalidSecureFsOption("SecureFs requires a runtime adapter with a filesystem");
+    }
+    if (isProxyWithoutHooks(adapter)) {
+      invalidSecureFsOption("SecureFs runtime adapter cannot be a Proxy");
+    }
+    let fsDescriptor: PropertyDescriptor | undefined;
     try {
-      byteReaders = captureByteReadCapabilities(this.fileSystem, "SecureFs filesystem");
-    } catch (error) {
-      if (staticReaders.snapshot === undefined) throw error;
-      byteReaders = Object.freeze({}) as CapturedByteReaders;
-    }
-    this.unboundedFileReader = byteReaders.unbounded;
-    if (byteReaders.whole !== undefined) {
-      this.wholeFileReader = byteReaders.whole;
-      this.maxWholeFileReadBytes = byteReaders.whole.maximumBytes;
-    }
-    if (byteReaders.prefix !== undefined) {
-      this.readFileBytesBounded = async (path, byteLimit) => {
-        const canonicalPath = await this.validateReadPath(path, "readFileBytesBounded");
-        return byteReaders.prefix!(canonicalPath, byteLimit);
-      };
+      fsDescriptor = Object.getOwnPropertyDescriptor(adapter, "fs");
+    } catch {
+      invalidSecureFsOption("SecureFs adapter filesystem could not be inspected safely");
     }
-    if (byteReaders.exact !== undefined) {
-      this.readFileBytesWithinLimit = async (path, byteLimit) => {
-        const canonicalPath = await this.validateReadPath(path, "readFileBytesWithinLimit");
-        return byteReaders.exact!(canonicalPath, byteLimit);
-      };
+    if (
+      fsDescriptor === undefined ||
+      !("value" in fsDescriptor) ||
+      typeof fsDescriptor.value !== "object" ||
+      fsDescriptor.value === null
+    ) {
+      invalidSecureFsOption(
+        "SecureFs requires an own, data-property runtime adapter filesystem",
+      );
     }
-    if (staticReaders.snapshot !== undefined) {
-      const reader = staticReaders.snapshot;
-      const containmentRoot = this.config.baseDir;
-      this.readFileSnapshotWithinLimit = async (path, byteLimit) => {
-        const canonicalPath = await this.validateReadPath(path, "readFileSnapshotWithinLimit");
-        return reader.read(canonicalPath, containmentRoot, byteLimit);
-      };
-    } else if (staticReaders.virtual !== undefined) {
-      const reader = staticReaders.virtual;
-      this.readFileSnapshotWithinLimit = async (path, byteLimit) => {
-        const canonicalPath = await this.validateReadPath(path, "readFileSnapshotWithinLimit");
-        const before = await reader.generation();
-        const bytes = reader.exact !== undefined
-          ? await reader.exact(canonicalPath, byteLimit)
-          : reader.whole !== undefined && reader.whole.maximumBytes <= byteLimit
-          ? await reader.whole.read(canonicalPath)
-          : (() => {
-            throw new TypeError("Virtual snapshot requires an admissible bounded reader");
-          })();
-        const after = await reader.generation();
-        if (before !== after) {
-          throw new FileSnapshotChangedError(
-            "Virtual file generation changed during snapshot read",
-          );
-        }
-        return bytes;
-      };
+    const suppliedFileSystem = fsDescriptor.value as RuntimeAdapter["fs"];
+    if (isProxyWithoutHooks(suppliedFileSystem)) {
+      invalidSecureFsOption("SecureFs filesystem cannot be a Proxy");
     }
-
-    let exclusiveCreator;
+    let snapshotReader: ReturnType<typeof captureSnapshotReadCapability>;
     try {
-      exclusiveCreator = captureExclusiveCreateCapability(
-        this.fileSystem,
+      snapshotReader = captureSnapshotReadCapability(
+        suppliedFileSystem,
         "SecureFs filesystem",
       );
-    } catch {
-      // Exclusive-create authority is independent from read authority. A bad
-      // optional publisher is quarantined rather than weakening valid reads.
-      exclusiveCreator = undefined;
-    }
-    if (exclusiveCreator !== undefined) {
-      this.createFileBytesExclusive = async (path, content) => {
-        const validation = await this.validatePathForOperation(path, "createFileBytesExclusive");
-        return exclusiveCreator!.create(this.getCanonicalPathOrThrow(validation, path), content);
+    } catch (_) {
+      invalidSecureFsOption("SecureFs filesystem snapshot capability is invalid");
+    }
+    let virtualSnapshotReader: ReturnType<typeof captureStaticReadCapabilities>["virtual"];
+    if (snapshotReader === undefined) {
+      try {
+        virtualSnapshotReader = captureStaticReadCapabilities(
+          suppliedFileSystem,
+          "SecureFs filesystem",
+        ).virtual;
+      } catch {
+        // A malformed optional virtual publisher must not weaken otherwise
+        // valid filesystem operations or be treated as snapshot authority.
+        virtualSnapshotReader = undefined;
+      }
+    }
+    this.fileSystem = snapshotFilesystem(
+      suppliedFileSystem,
+      snapshotReader !== undefined,
+    );
+    if (this.fileSystem.maxWholeFileReadBytes !== undefined) {
+      this.maxWholeFileReadBytes = this.fileSystem.maxWholeFileReadBytes;
+    }
+
+    const context = requireSecurityContext(
+      snapshot.context === undefined ? "internal" : snapshot.context,
+    );
+    if (
+      snapshot.onSecurityEvent !== undefined &&
+      typeof snapshot.onSecurityEvent !== "function"
+    ) {
+      invalidSecureFsOption("SecureFs onSecurityEvent must be a function");
+    }
+
+    this.config = Object.freeze({
+      baseDir,
+      context,
+      contextOptions: normalizeContextOptions(
+        snapshot.contextOptions as ContextOptions | undefined,
+      ),
+      onSecurityEvent: (snapshot.onSecurityEvent as ((event: SecurityEvent) => void) | undefined) ??
+        (() => {}),
+      validationOptions: normalizeValidationOptions(
+        snapshot.validationOptions as
+          | Partial<Omit<PathValidationPolicyOptions, "baseDir">>
+          | undefined,
+      ),
+    });
+
+    const validationAdapter = snapshotValidationAdapter(this.fileSystem);
+
+    this.validationOptions = this.buildValidationOptions(
+      this.config.context,
+      this.config.contextOptions,
+      validationAdapter,
+    );
+
+    const boundedReader = this.fileSystem.readFileBytesBounded;
+    if (boundedReader) {
+      this.readFileBytesBounded = async (path: string, byteLimit: number) => {
+        if (!Number.isSafeInteger(byteLimit) || byteLimit <= 0) {
+          throw new RangeError("SecureFs bounded read limit must be a positive safe integer");
+        }
+        const validation = await this.validatePathForOperation(
+          path,
+          "readFileBytesBounded",
+        );
+        const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
+        return copyFixedUint8ArrayWithinLimit(
+          await boundedReader.call(this.fileSystem, canonicalPath, byteLimit),
+          byteLimit,
+          "SecureFs bounded read",
+        );
       };
     }
 
-    for (
-      const key of [
-        "maxWholeFileReadBytes",
-        "readFileBytesBounded",
-        "readFileBytesWithinLimit",
-        "readFileSnapshotWithinLimit",
-        "createFileBytesExclusive",
-      ] as const
+    const exactReader = this.fileSystem.readFileBytesWithinLimit;
+    if (exactReader) {
+      this.readFileBytesWithinLimit = async (path: string, byteLimit: number) => {
+        if (!Number.isSafeInteger(byteLimit) || byteLimit <= 0) {
+          throw new RangeError(
+            "SecureFs exact bounded read limit must be a positive safe integer",
+          );
+        }
+        const validation = await this.validatePathForOperation(
+          path,
+          "readFileBytesWithinLimit",
+        );
+        const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
+        return copyFixedUint8ArrayWithinLimit(
+          await exactReader.call(this.fileSystem, canonicalPath, byteLimit),
+          byteLimit,
+          "SecureFs exact bounded read",
+        );
+      };
+    }
+    if (snapshotReader !== undefined) {
+      const containmentRoot = this.config.baseDir;
+      objectDefineProperty(this, "readFileSnapshotWithinLimit", {
+        configurable: false,
+        enumerable: true,
+        value: async (path: string, byteLimit: number) => {
+          if (!Number.isSafeInteger(byteLimit) || byteLimit <= 0) {
+            throw new RangeError(
+              "SecureFs snapshot read limit must be a positive safe integer",
+            );
+          }
+          const validation = await this.validatePathForOperation(
+            path,
+            "readFileSnapshotWithinLimit",
+          );
+          const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
+          return copyFixedUint8ArrayWithinLimit(
+            await snapshotReader.read(canonicalPath, containmentRoot, byteLimit),
+            byteLimit,
+            "SecureFs snapshot read",
+          );
+        },
+        writable: false,
+      });
+    } else if (
+      virtualSnapshotReader !== undefined &&
+      (virtualSnapshotReader.exact !== undefined || virtualSnapshotReader.whole !== undefined)
     ) {
-      Object.defineProperty(this, key, {
+      const reader = virtualSnapshotReader;
+      objectDefineProperty(this, "readFileSnapshotWithinLimit", {
         configurable: false,
         enumerable: true,
-        value: this[key],
+        value: async (path: string, byteLimit: number) => {
+          if (!Number.isSafeInteger(byteLimit) || byteLimit <= 0) {
+            throw new RangeError(
+              "SecureFs snapshot read limit must be a positive safe integer",
+            );
+          }
+          const validation = await this.validatePathForOperation(
+            path,
+            "readFileSnapshotWithinLimit",
+          );
+          const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
+          const before = await reader.generation();
+          const bytes = reader.exact !== undefined
+            ? await reader.exact(canonicalPath, byteLimit)
+            : reader.whole !== undefined && reader.whole.maximumBytes <= byteLimit
+            ? await reader.whole.read(canonicalPath)
+            : (() => {
+              throw new TypeError("Virtual snapshot requires an admissible bounded reader");
+            })();
+          const after = await reader.generation();
+          if (before !== after) {
+            throw new FileSnapshotChangedError(
+              "Virtual file generation changed during snapshot read",
+            );
+          }
+          return copyFixedUint8ArrayWithinLimit(
+            bytes,
+            byteLimit,
+            "SecureFs virtual snapshot read",
+          );
+        },
         writable: false,
       });
     }
-  }
-
-  private async validateReadPath(path: string, operation: string): Promise<string> {
-    const validation = await this.validatePathForOperation(path, operation);
-    return this.getCanonicalPathOrThrow(validation, path);
+    hardenSecureFsAuthority(this);
   }
 
   private buildValidationOptions(
     context: SecurityContext,
-    contextOptions?: ContextOptions,
-    adapter: RuntimeAdapter = this.validationAdapter,
+    contextOptions: ContextOptions | undefined,
+    adapter: RuntimeAdapter,
   ): ValidationOptions {
     const contextValidationOptions = getContextValidationOptions(
       context,
       this.config.baseDir,
       contextOptions,
     );
-
-    const validationOptions = {
-      ...contextValidationOptions,
-      ...this.config.validationOptions,
+    const overrides = this.config.validationOptions;
+    const validationOptions: ValidationOptions = {
       baseDir: this.config.baseDir,
+      level: overrides.level ?? contextValidationOptions.level,
+      allowedDirs: cloneAndFreezeAllowedDirs(
+        overrides.allowedDirs ?? contextValidationOptions.allowedDirs,
+      ),
+      followSymlinks: overrides.followSymlinks ?? contextValidationOptions.followSymlinks,
+      checkExists: overrides.checkExists ?? contextValidationOptions.checkExists,
+      allowAbsolute: overrides.allowAbsolute ?? contextValidationOptions.allowAbsolute,
       adapter,
     };
-    return {
-      ...validationOptions,
-      allowedDirs: validationOptions.allowedDirs === undefined
-        ? undefined
-        : [...validationOptions.allowedDirs],
-    };
+    return Object.freeze(validationOptions);
   }
 
   private emitValidationEvent(
@@ -374,14 +903,18 @@ export class SecureFs {
     operation: string,
     path: string,
   ): void {
-    this.config.onSecurityEvent({
-      type: result.valid ? "validation-passed" : "validation-failed",
-      operation,
-      path: sanitizePathForDisplay(path, this.config.baseDir),
-      error: result.error,
-      code: result.code,
-      timestamp: new Date(),
-    });
+    try {
+      this.config.onSecurityEvent({
+        type: result.valid ? "validation-passed" : "validation-failed",
+        operation,
+        path: sanitizePathForDisplay(path, this.config.baseDir),
+        error: result.error,
+        code: result.code,
+        timestamp: new Date(),
+      });
+    } catch {
+      // Observability callbacks must not replace the filesystem policy result.
+    }
   }
 
   private throwIfInvalid(
@@ -389,29 +922,23 @@ export class SecureFs {
     operation: string,
     path: string,
   ): void {
-    if (result.valid || !this.config.throwOnError) return;
+    if (result.valid) return;
 
     throw SECURITY_VIOLATION.create({
       detail: `Path validation failed for ${operation}: ${result.error}`,
-      context: { code: result.code, path },
+      context: {
+        code: result.code,
+        path: sanitizePathForDisplay(path, this.config.baseDir),
+      },
     });
   }
 
   private async validatePathForOperation(
     path: string,
     operation: string,
+    options: ValidationOptions = this.validationOptions,
   ): Promise<ValidationResult> {
-    const result = await validatePath(path, this.validationOptions);
-    this.emitValidationEvent(result, operation, path);
-    this.throwIfInvalid(result, operation, path);
-    return result;
-  }
-
-  private validatePathForOperationSync(
-    path: string,
-    operation: string,
-  ): ValidationResult {
-    const result = validatePathSync(path, this.validationOptions);
+    const result = await validatePath(path, options);
     this.emitValidationEvent(result, operation, path);
     this.throwIfInvalid(result, operation, path);
     return result;
@@ -424,7 +951,10 @@ export class SecureFs {
     if (validation.valid && validation.canonicalPath) return validation.canonicalPath;
     throw SECURITY_VIOLATION.create({
       detail: "Invalid path",
-      context: { code: validation.code, path },
+      context: {
+        code: validation.code,
+        path: sanitizePathForDisplay(path, this.config.baseDir),
+      },
     });
   }
 
@@ -444,9 +974,12 @@ export class SecureFs {
     const validation = await this.validatePathForOperation(path, "readFileBytes");
     const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
 
-    if (this.wholeFileReader) return await this.wholeFileReader.read(canonicalPath);
-    if (this.unboundedFileReader) return await this.unboundedFileReader(canonicalPath);
-    throw new TypeError("SecureFs filesystem does not provide binary-safe file reads");
+    const reader = this.fileSystem.readFileBytes;
+    if (reader) return await reader.call(this.fileSystem, canonicalPath);
+
+    throw NOT_SUPPORTED.create({
+      detail: "SecureFs binary reads require a binary-safe filesystem adapter",
+    });
   }
 
   async writeFile(path: string, content: string): Promise<void> {
@@ -468,96 +1001,126 @@ export class SecureFs {
   }
 
   async mkdir(path: string, options?: { recursive?: boolean }): Promise<void> {
+    const normalizedOptions = normalizeRecursiveOperationOptions(
+      options,
+      "SecureFs mkdir options",
+    );
     const validation = await this.validatePathForOperation(path, "mkdir");
     const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
-    await this.fileSystem.mkdir(canonicalPath, options);
+    await this.fileSystem.mkdir(canonicalPath, normalizedOptions);
   }
 
   async remove(path: string, options?: { recursive?: boolean }): Promise<void> {
+    const normalizedOptions = normalizeRecursiveOperationOptions(
+      options,
+      "SecureFs remove options",
+    );
     const validation = await this.validatePathForOperation(path, "remove");
     const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
-    await this.fileSystem.remove(canonicalPath, options);
+    await this.fileSystem.remove(canonicalPath, normalizedOptions);
   }
 
   async exists(path: string): Promise<boolean> {
-    const validation = await this.validatePathForOperation(path, "exists");
-    if (!validation.valid || !validation.canonicalPath) return false;
-    return await this.fileSystem.exists(validation.canonicalPath);
+    const validation = await this.validatePathForOperation(
+      path,
+      "exists",
+      Object.freeze({ ...this.validationOptions, checkExists: false }),
+    );
+    const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
+    return await this.fileSystem.exists(canonicalPath);
   }
 
-  readDir(path: string): AsyncIterable<DirEntry> {
-    const validation = this.validatePathForOperationSync(path, "readDir");
+  async *readDir(path: string): AsyncIterable<DirEntry> {
+    const validation = await this.validatePathForOperation(path, "readDir");
     const canonicalPath = this.getCanonicalPathOrThrow(validation, path);
-    return this.fileSystem.readDir(canonicalPath);
+    for await (const entry of this.fileSystem.readDir(canonicalPath)) {
+      yield entry;
+    }
   }
 
   async makeTempDir(prefix: string): Promise<string> {
-    return await this.fileSystem.makeTempDir(prefix);
+    if (
+      typeof prefix !== "string" ||
+      prefix.length === 0 ||
+      prefix.length > 128 ||
+      !/^[A-Za-z0-9._-]+$/.test(prefix)
+    ) {
+      throw INVALID_ARGUMENT.create({
+        detail: "SecureFs temporary-directory prefix must be 1-128 safe filename characters",
+      });
+    }
+
+    const relativePath = `${prefix}${crypto.randomUUID()}`;
+    const validation = await this.validatePathForOperation(relativePath, "makeTempDir");
+    const canonicalPath = this.getCanonicalPathOrThrow(validation, relativePath);
+    await this.fileSystem.mkdir(canonicalPath);
+    return canonicalPath;
   }
 
   watch(
     paths: string | string[],
     options?: { recursive?: boolean; signal?: AbortSignal },
   ): FileWatcher {
-    const pathArray = Array.isArray(paths) ? paths : [paths];
-    const validatedPaths: string[] = [];
-
-    for (const path of pathArray) {
-      const validation = this.validatePathForOperationSync(path, "watch");
-      if (validation.valid && validation.canonicalPath) {
-        validatedPaths.push(validation.canonicalPath);
-      }
+    const pathArray = Array.isArray(paths)
+      ? snapshotDirectoryList(paths, "SecureFs watch paths")!
+      : [paths];
+    if (
+      pathArray.length === 0 ||
+      !pathArray.every((path) => typeof path === "string" && path.length > 0)
+    ) {
+      throw INVALID_ARGUMENT.create({
+        detail: "SecureFs watch requires at least one non-empty path",
+      });
     }
 
-    if (validatedPaths.length === 0) {
-      if (this.config.throwOnError) {
-        throw SECURITY_VIOLATION.create({
-          detail: "No valid paths to watch",
-          context: { code: "NO_VALID_PATHS", path: paths.toString() },
-        });
-      }
+    const watchOptions = normalizeWatchOptions(options);
+    let watcher: FileWatcher | undefined;
+    let closed = false;
 
-      return this.fileSystem.watch([], options);
-    }
-
-    const pathArg: string | string[] = validatedPaths.length === 1
-      ? validatedPaths[0] ?? ""
-      : validatedPaths;
+    const ready = (async (): Promise<void> => {
+      const validatedPaths: string[] = [];
+      for (const path of pathArray) {
+        const validation = await this.validatePathForOperation(path, "watch");
+        validatedPaths.push(this.getCanonicalPathOrThrow(validation, path));
+      }
 
-    return this.fileSystem.watch(pathArg, options);
-  }
+      if (closed || watchOptions?.signal?.aborted) return;
 
-  getUnsafeAdapter(): RuntimeAdapter {
-    // Fail closed: an unset NODE_ENV must be treated as production so a missing
-    // env var can never silently open this path-validation-bypassing escape
-    // hatch. Only an explicit non-production NODE_ENV unlocks it.
-    const nodeEnv = getHostEnv("NODE_ENV");
-    if (!nodeEnv || nodeEnv === "production") {
-      throw SECURITY_VIOLATION.create({
-        detail: "getUnsafeAdapter() is not allowed in production",
-      });
-    }
-    logger.warn("Using unsafe adapter - security checks bypassed!");
-    return this.config.adapter;
-  }
+      const pathArg: string | string[] = validatedPaths.length === 1
+        ? validatedPaths[0]!
+        : validatedPaths;
+      watcher = this.fileSystem.watch(pathArg, watchOptions);
+      try {
+        await watcher.ready;
+      } catch (error) {
+        watcher.close();
+        throw error;
+      }
+      if (closed || watchOptions?.signal?.aborted) watcher.close();
+    })();
 
-  updateValidationOptions(options: Partial<ValidationOptions>): void {
-    const update = snapshotValidationOptions(options);
-    this.validationOptions = {
-      ...this.validationOptions,
-      ...update,
-      baseDir: this.config.baseDir,
-      adapter: this.validationAdapter,
+    const iterate = async function* (): AsyncIterableIterator<FileChangeEvent> {
+      await ready;
+      if (!watcher || closed) return;
+      for await (const event of watcher) yield event;
     };
-  }
 
-  setContext(context: SecurityContext): void {
-    this.validationOptions = this.buildValidationOptions(
-      context,
-      this.config.contextOptions,
-      this.validationAdapter,
-    );
-    this.config.context = context;
+    return {
+      ready,
+      get done(): Promise<void> {
+        return ready.then(async () => {
+          await watcher?.done;
+        });
+      },
+      close(): void {
+        if (closed) return;
+        closed = true;
+        watcher?.close();
+      },
+      [Symbol.asyncIterator]() {
+        return iterate();
+      },
+    };
   }
 }
 
@@ -585,8 +1148,8 @@ function createSecuredAdapterFileSystem(
   };
   if (secureFs.maxWholeFileReadBytes !== undefined) {
     Object.defineProperty(fileSystem, "maxWholeFileReadBytes", {
-      enumerable: true,
       value: secureFs.maxWholeFileReadBytes,
+      enumerable: true,
     });
   }
   if (secureFs.readFileBytesBounded !== undefined) {
@@ -598,17 +1161,27 @@ function createSecuredAdapterFileSystem(
       secureFs.readFileBytesWithinLimit!(path, byteLimit);
   }
   if (secureFs.readFileSnapshotWithinLimit !== undefined) {
-    fileSystem.readFileSnapshotWithinLimit = (path, containmentRoot, byteLimit) => {
-      if (resolve(containmentRoot) !== constructionRoot) {
+    fileSystem.readFileSnapshotWithinLimit = async (
+      path,
+      containmentRoot,
+      byteLimit,
+    ) => {
+      if (containmentRoot !== constructionRoot) {
         throw new TypeError("Secured snapshot reads require the construction-time root");
       }
-      return secureFs.readFileSnapshotWithinLimit!(path, byteLimit);
+      const rootedPath = relative(constructionRoot, path);
+      if (
+        rootedPath === ".." ||
+        rootedPath.startsWith(`..${sep}`) ||
+        isAbsolute(rootedPath)
+      ) {
+        throw new TypeError(
+          "Secured snapshot path must be contained by the construction-time root",
+        );
+      }
+      return await secureFs.readFileSnapshotWithinLimit!(rootedPath, byteLimit);
     };
   }
-  if (secureFs.createFileBytesExclusive !== undefined) {
-    fileSystem.createFileBytesExclusive = (path, content) =>
-      secureFs.createFileBytesExclusive!(path, content);
-  }
   return Object.freeze(fileSystem);
 }
 
@@ -616,12 +1189,42 @@ export function wrapAdapterWithSecurity(
   adapter: RuntimeAdapter,
   options: Omit<SecureFsConfig, "adapter">,
 ): RuntimeAdapter & { secureFs: SecureFs } {
-  const secureFs = createSecureFs({ ...options, adapter });
-  const constructionRoot = resolve(options.baseDir);
+  const snapshot = snapshotOwnOptions(
+    options,
+    "SecureFs wrapper options",
+    SECURE_FS_WRAPPER_OPTION_KEYS,
+  );
+  const secureFs = createSecureFs({
+    baseDir: snapshot.baseDir as string,
+    adapter,
+    context: snapshot.context as SecurityContext | undefined,
+    contextOptions: snapshot.contextOptions as ContextOptions | undefined,
+    validationOptions: snapshot.validationOptions as
+      | Partial<Omit<PathValidationPolicyOptions, "baseDir">>
+      | undefined,
+    onSecurityEvent: snapshot.onSecurityEvent as ((event: SecurityEvent) => void) | undefined,
+  });
 
-  return {
-    ...adapter,
-    fs: createSecuredAdapterFileSystem(secureFs, constructionRoot),
+  const wrapped: RuntimeAdapter & { secureFs: SecureFs } = {
+    id: adapter.id,
+    name: adapter.name,
+    capabilities: adapter.capabilities,
+    fs: createSecuredAdapterFileSystem(secureFs, resolve(snapshot.baseDir as string)),
+    env: adapter.env,
+    server: adapter.server,
+    serve: (handler, serveOptions) => adapter.serve(handler, serveOptions),
     secureFs,
   };
+
+  if (adapter.shell !== undefined) wrapped.shell = adapter.shell;
+  if (adapter.kv !== undefined) wrapped.kv = adapter.kv;
+  if (adapter.watcher !== undefined) wrapped.watcher = adapter.watcher;
+  if (adapter.initialize !== undefined) {
+    wrapped.initialize = () => adapter.initialize!.call(adapter);
+  }
+  if (adapter.shutdown !== undefined) {
+    wrapped.shutdown = () => adapter.shutdown!.call(adapter);
+  }
+
+  return wrapped;
 }
diff --git a/src/server/handlers/dev/dashboard/api.test.ts b/src/server/handlers/dev/dashboard/api.test.ts
index cb8ba9d7c3..1e59cda7d1 100644
--- a/src/server/handlers/dev/dashboard/api.test.ts
+++ b/src/server/handlers/dev/dashboard/api.test.ts
@@ -10,6 +10,7 @@ function createMockCtx(): HandlerContext {
     projectDir: "/project",
     adapter: {
       fs: {
+        symlinkSemantics: "none",
         readDir: async function* () {},
         readFile: async () => new Uint8Array(),
       },
@@ -25,6 +26,7 @@ function createMockCtxWithFs(fsOverrides: Record<string, unknown> = {}): Handler
     ...createMockCtx(),
     adapter: {
       fs: {
+        symlinkSemantics: "none",
         readDir: async function* () {},
         readFile: async () => "file content",
         ...fsOverrides,
diff --git a/src/server/handlers/dev/dashboard/api.ts b/src/server/handlers/dev/dashboard/api.ts
index cad0a541e2..a7cb7a5022 100644
--- a/src/server/handlers/dev/dashboard/api.ts
+++ b/src/server/handlers/dev/dashboard/api.ts
@@ -26,7 +26,8 @@ import {
 import { TransformStage } from "#veryfront/transforms/pipeline/types.ts";
 import { isRSCEnabled } from "#veryfront/utils/feature-flags.ts";
 import { getEnvironmentConfig } from "#veryfront/config/environment-config.ts";
-import { validatePathSync } from "#veryfront/security";
+import { validatePath } from "#veryfront/security";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { ReloadNotifier } from "../../../reload-notifier.ts";
 import type { HandlerContext } from "../../types.ts";
 import { errorResponse, jsonResponse } from "../http-helpers.ts";
@@ -36,7 +37,7 @@ const WORKFLOW_EXECUTION_TIMEOUT_MS = 30_000;
 /**
  * Validate a relative path against the project directory.
  *
- * Uses `validatePathSync` in strict mode (rejects absolute paths, null bytes,
+ * Uses physical strict path validation (rejects absolute paths, null bytes,
  * `..` traversal, and any resolved path that escapes `baseDir`).
  *
  * Note: `searchParams.get()` already percent-decodes; no extra decoding needed
@@ -44,11 +45,16 @@ const WORKFLOW_EXECUTION_TIMEOUT_MS = 30_000;
  *
  * Returns the canonicalized absolute path on success, or `null` when invalid.
  */
-function validateRelativePath(path: string, projectDir: string): string | null {
-  const result = validatePathSync(path, {
+async function validateRelativePath(
+  path: string,
+  projectDir: string,
+  adapter: RuntimeAdapter,
+): Promise<string | null> {
+  const result = await validatePath(path, {
     baseDir: projectDir,
     allowAbsolute: false,
     level: "strict",
+    adapter,
   });
   if (!result.valid || !result.canonicalPath) return null;
   return result.canonicalPath;
@@ -403,7 +409,7 @@ async function handleListFiles(req: Request, ctx: HandlerContext): Promise<Respo
   if (relativePath === "") {
     fullPath = projectDir;
   } else {
-    const canonical = validateRelativePath(relativePath, projectDir);
+    const canonical = await validateRelativePath(relativePath, projectDir, adapter);
     if (canonical === null) return errorResponse("Invalid path", 400);
     fullPath = canonical;
   }
@@ -441,7 +447,7 @@ async function handleReadFileContent(req: Request, ctx: HandlerContext): Promise
   const relativePath = new URL(req.url).searchParams.get("path") ?? "";
   if (!relativePath) return errorResponse("path parameter is required", 400);
 
-  const canonical = validateRelativePath(relativePath, projectDir);
+  const canonical = await validateRelativePath(relativePath, projectDir, adapter);
   if (canonical === null) return errorResponse("Invalid path", 400);
 
   try {
diff --git a/src/server/handlers/monitoring/metrics.handler.ts b/src/server/handlers/monitoring/metrics.handler.ts
index be3520860a..09e88af0eb 100644
--- a/src/server/handlers/monitoring/metrics.handler.ts
+++ b/src/server/handlers/monitoring/metrics.handler.ts
@@ -40,7 +40,7 @@ export class MetricsHandler extends BaseHandler {
 
       return Promise.resolve(this.respond(response));
     } catch (e) {
-      this.logWarn("metrics failed", { error: this.getErrorMessage(e) }, ctx);
+      this.logWarn("metrics failed", { error: this.getErrorMessage(e) });
 
       const response = ResponseBuilder.error(
         HTTP_INTERNAL_SERVER_ERROR,
diff --git a/src/server/handlers/preview/markdown-preview.handler.test.ts b/src/server/handlers/preview/markdown-preview.handler.test.ts
index 1ac40acb11..4b91f1fa8c 100644
--- a/src/server/handlers/preview/markdown-preview.handler.test.ts
+++ b/src/server/handlers/preview/markdown-preview.handler.test.ts
@@ -1,8 +1,10 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
+import type { HandlerContext } from "../types.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { MarkdownPreviewHandler } from "./markdown-preview.handler.ts";
-import type { HandlerContext } from "../types.ts";
+import { GitHubFSAdapter } from "#veryfront/platform/adapters/fs/github/adapter.ts";
+import { FSAdapterWrapper } from "#veryfront/platform/adapters/fs/wrapper.ts";
 
 function makeCtx(overrides: Partial<HandlerContext> = {}): HandlerContext {
   return {
@@ -45,3 +47,82 @@ describe("MarkdownPreviewHandler.metadata.enabled", () => {
     assertEquals(handler.metadata.enabled?.(ctx), false);
   });
 });
+
+Deno.test("MarkdownPreviewHandler admits the resolver result before reading", async () => {
+  let reads = 0;
+  const handler = new MarkdownPreviewHandler();
+  const ctx = {
+    projectDir: "/project",
+    isLocalProject: true,
+    adapter: {
+      fs: {
+        resolveFile: () => Promise.resolve("../outside/secret.md"),
+        readFile: () => {
+          reads += 1;
+          return Promise.resolve("secret");
+        },
+      },
+    },
+  } as unknown as HandlerContext;
+
+  const result = await handler.handle(new Request("http://localhost/README.md"), ctx);
+  assertEquals(result.continue, true);
+  assertEquals(reads, 0);
+});
+
+Deno.test("MarkdownPreviewHandler admits and reads through a real wrapped GitHub adapter", async () => {
+  const originalFetch = globalThis.fetch;
+  let contentReads = 0;
+  globalThis.fetch = (input) => {
+    const url = String(input);
+    if (url.includes("/git/trees/")) {
+      return Promise.resolve(Response.json({
+        sha: "tree",
+        tree: [{
+          path: "README.md",
+          mode: "100644",
+          type: "blob",
+          sha: "readme",
+          size: 7,
+        }],
+        truncated: false,
+      }));
+    }
+    if (url.includes("/contents/README.md")) {
+      contentReads += 1;
+      const content = "---\nprose: false\n---\n# Hello";
+      return Promise.resolve(Response.json({
+        type: "file",
+        name: "README.md",
+        path: "README.md",
+        sha: "readme",
+        size: content.length,
+        content: btoa(content),
+        encoding: "base64",
+        download_url: null,
+      }));
+    }
+    return Promise.resolve(new Response("Not found", { status: 404 }));
+  };
+
+  const github = new GitHubFSAdapter({
+    type: "github",
+    projectDir: "/project",
+    github: { token: "token", owner: "owner", repo: "repo" },
+  });
+  const fs = new FSAdapterWrapper(github);
+  try {
+    const result = await new MarkdownPreviewHandler().handle(
+      new Request("http://localhost/README.md"),
+      makeCtx({
+        isLocalProject: true,
+        adapter: { fs } as unknown as HandlerContext["adapter"],
+      }),
+    );
+    assertEquals(result.continue, true);
+    assertEquals(contentReads, 1);
+  } finally {
+    await fs.shutdown();
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/src/server/handlers/preview/markdown-preview.handler.ts b/src/server/handlers/preview/markdown-preview.handler.ts
index d5db511cf9..2e8af387fc 100644
--- a/src/server/handlers/preview/markdown-preview.handler.ts
+++ b/src/server/handlers/preview/markdown-preview.handler.ts
@@ -13,11 +13,9 @@ import { serverLogger } from "#veryfront/utils";
 import { HTTP_OK } from "#veryfront/utils/constants/index.ts";
 import { compileMarkdownRuntime } from "#veryfront/transforms/md/compiler/md-compiler.ts";
 import { extract } from "#std/front-matter/yaml.ts";
-import { isExtendedFSAdapter } from "#veryfront/platform/adapters/fs/wrapper.ts";
-import { getHostEnv } from "#veryfront/platform/compat/process.ts";
 import { tryNotFoundFallback } from "../request/ssr/not-found-fallback.ts";
 import { generateMarkdownHtml } from "./markdown-html-generator.ts";
-import { validatePathSync } from "#veryfront/security";
+import { validateLexicalPath, validatePath, ValidationPresets } from "#veryfront/security";
 
 const logger = serverLogger.component("markdown-preview-handler");
 
@@ -47,7 +45,7 @@ export class MarkdownPreviewHandler extends BaseHandler {
 
     const filePath = pathname.replace(/^\//, "");
 
-    const pathResult = validatePathSync(filePath, {
+    const pathResult = validateLexicalPath(filePath, {
       baseDir: ctx.projectDir,
     });
 
@@ -56,8 +54,6 @@ export class MarkdownPreviewHandler extends BaseHandler {
       return this.continue();
     }
 
-    const fsAdapter = ctx.adapter.fs;
-
     logger.debug("Attempting to serve", {
       pathname,
       filePath,
@@ -65,38 +61,11 @@ export class MarkdownPreviewHandler extends BaseHandler {
       projectSlug: ctx.projectSlug,
     });
 
-    const hasMultiProjectSupport = isExtendedFSAdapter(fsAdapter) && fsAdapter.isMultiProjectMode();
-
-    if (ctx.projectSlug && hasMultiProjectSupport) {
-      // Framework-owned token: bypass project env overlay so proxy mode works
-      // when a remote project overlay is active.
-      const effectiveToken = ctx.proxyToken || getHostEnv("VERYFRONT_API_TOKEN") || "";
-      const branch = ctx.parsedDomain?.branch ?? null;
-
-      return await fsAdapter.runWithContext(
-        ctx.projectSlug,
-        effectiveToken,
-        () => this.renderMarkdown(req, ctx, filePath, url),
-        ctx.projectId,
-        {
-          productionMode: false,
-          branch,
-          environmentName: ctx.environmentName,
-        },
-      );
-    }
-
-    if (isExtendedFSAdapter(fsAdapter) && fsAdapter.isContextualMode()) {
-      try {
-        if (ctx.proxyToken) fsAdapter.setRequestToken(ctx.proxyToken);
-        fsAdapter.setRequestBranch(ctx.parsedDomain?.branch ?? null);
-        fsAdapter.setProductionMode(false);
-      } catch (_) {
-        /* expected: some FS adapter operations may not be supported */
-      }
-    }
-
-    return await this.renderMarkdown(req, ctx, filePath, url);
+    return await this.withProxyContext(
+      ctx,
+      () => this.renderMarkdown(req, ctx, filePath, url),
+      { requireToken: true },
+    );
   }
 
   private async renderMarkdown(
@@ -106,16 +75,31 @@ export class MarkdownPreviewHandler extends BaseHandler {
     url: URL,
   ): Promise<HandlerResult> {
     try {
-      const resolveFile = ctx.adapter.fs.resolveFile;
-      const resolvedPath = resolveFile ? await resolveFile.call(ctx.adapter.fs, filePath) : null;
+      const fs = ctx.adapter.fs;
+      const stableAdapter = { fs } as typeof ctx.adapter;
+      const resolveFile = fs.resolveFile;
+      const resolvedPath = resolveFile ? await resolveFile.call(fs, filePath) : null;
 
       if (resolveFile) {
         logger.debug("resolveFile result", { filePath, resolvedPath });
       }
 
+      const admittedPath = resolvedPath ?? filePath;
+      const pathResult = await validatePath(admittedPath, {
+        ...ValidationPresets.internal(ctx.projectDir),
+        adapter: stableAdapter,
+      });
+      if (!pathResult.valid || !pathResult.canonicalPath) {
+        logger.warn("Physical path validation blocked markdown preview", {
+          filePath,
+          resolvedPath,
+        });
+        return this.continue();
+      }
+
       let content: string;
       try {
-        content = await ctx.adapter.fs.readFile(resolvedPath ?? filePath);
+        content = await fs.readFile(pathResult.canonicalPath);
       } catch (_) {
         /* expected: markdown file may not exist */
         logger.debug("File not found", { filePath, resolvedPath });
diff --git a/src/server/handlers/request/css.handler.ts b/src/server/handlers/request/css.handler.ts
index 8ad83c3f50..3eaa4d0b0d 100644
--- a/src/server/handlers/request/css.handler.ts
+++ b/src/server/handlers/request/css.handler.ts
@@ -103,7 +103,6 @@ export class CSSHandler extends BaseHandler {
         `CSS not found and JIT regeneration failed: ${cssHash}. ` +
           `Server restart or cache expiry. Reload page to regenerate.`,
         {},
-        ctx,
       );
 
       // Return 404 instead of 200 with comment - this is more honest
diff --git a/src/server/handlers/request/snippet.handler.test.ts b/src/server/handlers/request/snippet.handler.test.ts
index e3d421f53f..9a251f9a66 100644
--- a/src/server/handlers/request/snippet.handler.test.ts
+++ b/src/server/handlers/request/snippet.handler.test.ts
@@ -1,16 +1,18 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
-import { validatePathSync } from "#veryfront/security";
+import { validateLexicalPath } from "#veryfront/security";
+import { SnippetHandler } from "./snippet.handler.ts";
+import type { HandlerContext } from "../types.ts";
 
 /**
- * Tests that validatePathSync correctly blocks path traversal for paths
+ * Tests that lexical containment correctly blocks path traversal for paths
  * produced by SnippetHandler.resolveFilePath(). The handler validates
  * resolved paths before passing them to fs.readFile().
  *
  * Note: The URL constructor normalizes basic `..` traversals (e.g.,
  * `/@/../../etc/passwd` → `/etc/passwd`) before the handler sees them.
- * These tests verify the validatePathSync safety net catches traversals
+ * These tests verify the lexical safety net catches traversals
  * that survive URL normalization or arrive via non-browser HTTP clients.
  */
 describe("snippet handler path validation", () => {
@@ -19,42 +21,92 @@ describe("snippet handler path validation", () => {
   describe("blocks traversal in resolved paths", () => {
     it("rejects ../../etc/passwd (from /@/ prefix)", () => {
       // resolveFilePath("/@/../../etc/passwd") → "../../etc/passwd"
-      const result = validatePathSync("../../etc/passwd", { baseDir });
+      const result = validateLexicalPath("../../etc/passwd", { baseDir });
       assertEquals(result.valid, false);
     });
 
     it("rejects components/../../../etc/passwd (from /@components/ prefix)", () => {
       // resolveFilePath("/@components/../../../etc/passwd") → "components/../../../etc/passwd"
-      const result = validatePathSync("components/../../../etc/passwd", { baseDir });
+      const result = validateLexicalPath("components/../../../etc/passwd", { baseDir });
       assertEquals(result.valid, false);
     });
 
     it("rejects paths with null bytes", () => {
-      const result = validatePathSync("components/foo\0bar", { baseDir });
+      const result = validateLexicalPath("components/foo\0bar", { baseDir });
       assertEquals(result.valid, false);
     });
 
     it("rejects deeply nested traversal", () => {
-      const result = validatePathSync("a/b/c/../../../../etc/passwd", { baseDir });
+      const result = validateLexicalPath("a/b/c/../../../../etc/passwd", { baseDir });
       assertEquals(result.valid, false);
     });
   });
 
   describe("allows valid paths", () => {
     it("allows components/button.snippet.mdx", () => {
-      const result = validatePathSync("components/button.snippet.mdx", { baseDir });
+      const result = validateLexicalPath("components/button.snippet.mdx", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("allows nested component paths", () => {
-      const result = validatePathSync("components/ui/card.snippet.mdx", { baseDir });
+      const result = validateLexicalPath("components/ui/card.snippet.mdx", { baseDir });
       assertEquals(result.valid, true);
     });
 
     it("allows paths from /@/ prefix", () => {
       // resolveFilePath("/@/components/button.mdx") → "components/button.mdx"
-      const result = validatePathSync("components/button.mdx", { baseDir });
+      const result = validateLexicalPath("components/button.mdx", { baseDir });
       assertEquals(result.valid, true);
     });
   });
 });
+
+Deno.test("SnippetHandler validates and reads inside the same proxy context", async () => {
+  let inContext = false;
+  let readPath: string | undefined;
+  const fs = {
+    symlinkSemantics: "none" as const,
+    isMultiProjectMode: () => true,
+    isContextualMode: () => true,
+    runWithContext: async (
+      _slug: string,
+      _token: string,
+      fn: () => Promise<unknown>,
+    ) => {
+      inContext = true;
+      try {
+        return await fn();
+      } finally {
+        inContext = false;
+      }
+    },
+    exists: () => Promise.resolve(true),
+    stat: () =>
+      Promise.resolve({
+        isFile: true,
+        isDirectory: false,
+        isSymlink: false,
+        size: 0,
+        mtime: new Date(),
+      }),
+    readFile: (path: string) => {
+      assertEquals(inContext, true);
+      readPath = path;
+      return Promise.resolve("");
+    },
+  };
+  const ctx = {
+    projectDir: "/project",
+    projectSlug: "project",
+    proxyToken: "token",
+    isLocalProject: true,
+    adapter: { fs },
+  } as unknown as HandlerContext;
+
+  const result = await new SnippetHandler().handle(
+    new Request("http://localhost/@components/button"),
+    ctx,
+  );
+  assertEquals(result.response?.status, 404);
+  assertEquals(readPath, "/project/components/button.snippet.mdx");
+});
diff --git a/src/server/handlers/request/snippet.handler.ts b/src/server/handlers/request/snippet.handler.ts
index 6163302c90..05b924c145 100644
--- a/src/server/handlers/request/snippet.handler.ts
+++ b/src/server/handlers/request/snippet.handler.ts
@@ -9,7 +9,7 @@ import {
   SECURITY_VIOLATION,
   VeryfrontError,
 } from "#veryfront/errors";
-import { validatePathSync } from "#veryfront/security";
+import { validatePath, ValidationPresets } from "#veryfront/security";
 import {
   createHandlerDependencyPinningSource,
   getHandlerDependencyPinningIdentity,
@@ -26,12 +26,12 @@ export class SnippetHandler extends BaseHandler {
     patterns: [{ pattern: /^\/(@\/|@components\/)/, method: "GET" }],
   };
 
-  handle(req: Request, ctx: HandlerContext): Promise<HandlerResult> {
+  async handle(req: Request, ctx: HandlerContext): Promise<HandlerResult> {
     const url = new URL(req.url);
     const { pathname } = url;
 
     if (!pathname.startsWith("/@/") && !pathname.startsWith("/@components/")) {
-      return Promise.resolve(this.continue());
+      return this.continue();
     }
 
     logger.debug("Handling snippet request", {
@@ -41,27 +41,31 @@ export class SnippetHandler extends BaseHandler {
 
     const filePath = this.resolveFilePath(pathname);
 
-    const pathResult = validatePathSync(filePath, {
-      baseDir: ctx.projectDir,
-    });
-
-    if (!pathResult.valid) {
-      logger.warn("Path traversal blocked in snippet request", { pathname, filePath });
-      const error = SECURITY_VIOLATION.create({
-        detail: "Invalid snippet path",
-      });
-      return Promise.resolve({ response: createErrorResponse(error) });
-    }
-
     logger.debug("Resolved file path", { filePath });
 
     return this.withProxyContext(ctx, async () => {
       try {
-        const content = await ctx.adapter.fs.readFile(filePath);
+        const fs = ctx.adapter.fs;
+        const stableAdapter = { fs } as typeof ctx.adapter;
+        const pathResult = await validatePath(filePath, {
+          ...ValidationPresets.internal(ctx.projectDir),
+          adapter: stableAdapter,
+        });
+
+        if (!pathResult.valid || !pathResult.canonicalPath) {
+          logger.warn("Path traversal blocked in snippet request", { pathname, filePath });
+          const error = SECURITY_VIOLATION.create({
+            detail: "Invalid snippet path",
+          });
+          return { response: createErrorResponse(error) };
+        }
+
+        const admittedPath = pathResult.canonicalPath;
+        const content = await fs.readFile(admittedPath);
 
         if (!content) {
           logger.debug("File not found or empty", { filePath });
-          return this.respondNotFound(ctx, filePath);
+          return this.respondNotFound(ctx, admittedPath);
         }
 
         const moduleServerUrl = this.getModuleServerUrl(ctx.moduleServerUrl, url);
@@ -72,12 +76,12 @@ export class SnippetHandler extends BaseHandler {
         const result = await renderSnippet(content, {
           mode: isDev ? "development" : "production",
           projectDir: ctx.projectDir,
-          adapter: ctx.adapter,
+          adapter: stableAdapter,
           isLocalProject: ctx.isLocalProject,
           projectId: dependencyIdentity.projectId,
           contentSourceId: dependencyIdentity.contentSourceId,
           dependencyPinningSource: createHandlerDependencyPinningSource(ctx),
-          filePath,
+          filePath: admittedPath,
           moduleServerUrl,
           projectSlug: dependencyIdentity.projectSlug,
           config: ctx.config,
diff --git a/src/server/handlers/response/cors.test.ts b/src/server/handlers/response/cors.test.ts
index 5c1e49e474..c766fefafe 100644
--- a/src/server/handlers/response/cors.test.ts
+++ b/src/server/handlers/response/cors.test.ts
@@ -98,7 +98,11 @@ describe("server/handlers/response/cors", () => {
           "access-control-request-headers": "Authorization,Content-Type",
         },
       });
-      const ctx = makeCtx();
+      // Preflight is policy-driven: allow-* headers are only emitted for an
+      // origin the CORS policy admits.
+      const ctx = makeCtx({
+        securityConfig: { cors: { origin: ["http://localhost:3000"] } } as never,
+      });
       const result = await handler.handle(req, ctx);
       assertEquals(result.response instanceof Response, true);
       // Should have allow-methods header
diff --git a/src/server/handlers/response/cors.ts b/src/server/handlers/response/cors.ts
index 4f97438eed..0a54b7417d 100644
--- a/src/server/handlers/response/cors.ts
+++ b/src/server/handlers/response/cors.ts
@@ -38,7 +38,6 @@ export class CorsHandler extends BaseHandler {
       this.logWarn(
         "Failed to load CORS config — falling back to security-context defaults",
         { error },
-        ctx,
       );
     }
 
@@ -67,7 +66,7 @@ export class CorsHandler extends BaseHandler {
 
       return [...new Set(methods)].join(", ");
     } catch (error) {
-      this.logWarn("Failed to resolve route for CORS", { error, pathname }, ctx);
+      this.logWarn("Failed to resolve route for CORS", { error, pathname });
       return CorsHandler.DEFAULT_METHODS;
     }
   }
diff --git a/src/server/services/static/static-file.service.test.ts b/src/server/services/static/static-file.service.test.ts
index 5fa2abb4ec..81d1bf7d63 100644
--- a/src/server/services/static/static-file.service.test.ts
+++ b/src/server/services/static/static-file.service.test.ts
@@ -225,6 +225,65 @@ describe("server/services/static/static-file.service", () => {
   });
 
   describe("resolveFile", () => {
+    it("serves project files through the scoped SecureFs boundary", async () => {
+      __injectDepsForTests({
+        manifestCache: new Map(),
+        manifestLoading: new Map(),
+      });
+
+      const fileData = new TextEncoder().encode("hello world");
+      const files = new Map<string, Uint8Array>([
+        ["/project/public/hello.txt", fileData],
+      ]);
+      const ready = Promise.resolve();
+      const adapter = {
+        fs: {
+          symlinkSemantics: "none" as const,
+          readFile: async (path: string) => {
+            const data = files.get(path);
+            if (!data) throw createFsError("not found", "ENOENT");
+            return new TextDecoder().decode(data);
+          },
+          readFileBytes: async (path: string) => {
+            const data = files.get(path);
+            if (!data) throw createFsError("not found", "ENOENT");
+            return data;
+          },
+          writeFile: async () => {},
+          exists: async (path: string) => files.has(path),
+          stat: async (path: string) => {
+            const data = files.get(path);
+            if (!data) throw createFsError("not found", "ENOENT");
+            return {
+              isFile: true,
+              isDirectory: false,
+              isSymlink: false,
+              size: data.byteLength,
+              mtime: new Date(0),
+            };
+          },
+          async *readDir() {},
+          mkdir: async () => {},
+          remove: async () => {},
+          makeTempDir: async (prefix: string) => `/tmp/${prefix}`,
+          watch: () => ({
+            ready,
+            done: ready,
+            close() {},
+            async *[Symbol.asyncIterator]() {},
+          }),
+        },
+      } as unknown as StaticFileOptions["adapter"];
+      const service = new StaticFileService();
+      const options = makeOptions({ adapter, isLocalProject: true });
+
+      const result = await service.resolveFile("/hello.txt", options);
+
+      assertExists(result);
+      assertEquals(result.path, "/project/public/hello.txt");
+      assertEquals(result.data, fileData);
+    });
+
     it("should return null when file does not exist", async () => {
       __injectDepsForTests({
         manifestCache: new Map(),
diff --git a/src/server/services/static/static-file.service.ts b/src/server/services/static/static-file.service.ts
index 7e505339cb..4e582917d9 100644
--- a/src/server/services/static/static-file.service.ts
+++ b/src/server/services/static/static-file.service.ts
@@ -15,6 +15,7 @@ import type { CacheStrategy } from "#veryfront/security";
 import { createSecureFs } from "#veryfront/security";
 import { serverLogger } from "#veryfront/utils";
 import { isNotFoundError } from "#veryfront/platform/compat/fs.ts";
+import { relative, resolve } from "#veryfront/platform/compat/path/index.ts";
 import type { FileSystemRepository } from "#veryfront/repositories/types.ts";
 import {
   getExtension,
@@ -126,12 +127,22 @@ export class StaticFileService {
   private getFileSystem(options: StaticFileOptions): FileSystemLike {
     if (this.fsRepo) return this.fsRepo;
 
-    return createSecureFs({
-      baseDir: options.projectDir,
+    const projectRoot = resolve(options.projectDir);
+    const secureFs = createSecureFs({
+      baseDir: projectRoot,
       adapter: options.adapter,
       context: "static-serving",
-      throwOnError: false,
     });
+
+    // StaticFileService keeps absolute paths in candidates and results, while
+    // SecureFs exposes a base-directory-scoped namespace. Adapt that boundary
+    // explicitly so the static policy can continue rejecting absolute input.
+    const toProjectPath = (path: string): string => relative(projectRoot, resolve(path));
+    return {
+      readFile: (path) => secureFs.readFile(toProjectPath(path)),
+      readFileBytes: (path) => secureFs.readFileBytes(toProjectPath(path)),
+      stat: (path) => secureFs.stat(toProjectPath(path)),
+    };
   }
 
   async resolveFile(
diff --git a/src/skill/executor.ts b/src/skill/executor.ts
index b17eda8b04..3a5e2ee6a8 100644
--- a/src/skill/executor.ts
+++ b/src/skill/executor.ts
@@ -14,6 +14,7 @@ import { readTextFile } from "#veryfront/platform/compat/fs.ts";
 import { createError, toError } from "#veryfront/errors";
 import { logger } from "#veryfront/utils";
 import type { SkillScriptExecutor, SkillScriptExecutorInput, SkillScriptResult } from "./types.ts";
+import { SKILL_SCRIPT_MAX_OUTPUT_BYTES } from "./limits.ts";
 
 const DEFAULT_SCRIPT_TIMEOUT_MS = 60_000;
 const MAX_SCRIPT_TIMEOUT_MS = 300_000;
@@ -133,6 +134,9 @@ export class LocalScriptExecutor implements SkillScriptExecutor {
       env: input.env,
       capture: true,
       timeoutMs,
+      signal: input.abortSignal,
+      maxOutputBytes: SKILL_SCRIPT_MAX_OUTPUT_BYTES,
+      terminateProcessTreeOnExit: true,
     });
 
     return {
diff --git a/src/skill/limits.ts b/src/skill/limits.ts
new file mode 100644
index 0000000000..52b5a01af8
--- /dev/null
+++ b/src/skill/limits.ts
@@ -0,0 +1,74 @@
+/**
+ * Internal resource and boundary limits for the skill subsystem.
+ *
+ * Keep shared limits here so schemas, direct APIs, discovery, and execution
+ * cannot drift into enforcing different budgets.
+ */
+
+const apply = Reflect.apply;
+const NativeRegExp = RegExp;
+const regExpExec = RegExp.prototype.exec;
+
+export const SKILL_ID_MAX_LENGTH = 256;
+export const SKILL_ROOT_PATH_MAX_LENGTH = 4_096;
+export const SKILL_RELATIVE_PATH_MAX_LENGTH = 1_024;
+export const SKILL_DOCUMENT_MAX_CHARACTERS = 1_048_576;
+export const SKILL_TEXT_FILE_MAX_BYTES = 1_048_576;
+
+export const SKILL_ALLOWED_TOOL_MAX_PATTERNS = 100;
+export const SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH = 256;
+
+export const SKILL_SUBDIR_MAX_ENTRIES = 1_000;
+// load_skill merges references/, resources/, and assets/ into one read-only
+// capability list, so its aggregate budget is three bounded subdirectories.
+export const SKILL_LOADABLE_REFERENCE_MAX_ENTRIES = SKILL_SUBDIR_MAX_ENTRIES * 3;
+export const SKILL_RUNTIME_LOADED_SKILL_CACHE_MAX_ENTRIES = SKILL_SUBDIR_MAX_ENTRIES;
+export const SKILL_RUNTIME_LOADED_REFERENCE_CACHE_MAX_ENTRIES =
+  SKILL_LOADABLE_REFERENCE_MAX_ENTRIES;
+export const SKILL_ALLOWED_SUBDIR_MAX_ENTRIES = 16;
+export const SKILL_STEERING_PATH_MAX_ENTRIES = 16;
+export const SKILL_PATH_SEGMENT_MAX_LENGTH = 255;
+export const SKILL_VISIBLE_ERROR_MAX_IDS = 30;
+export const SKILL_RUNTIME_AVAILABLE_TOOL_MAX_ENTRIES = 1_000;
+/** Aggregate limits for one retained runtime skill catalog. */
+export const SKILL_CATALOG_MAX_SKILLS = 128;
+export const SKILL_CATALOG_MAX_DOCUMENT_CHARACTERS = 8 * 1_048_576;
+export const SKILL_CATALOG_MAX_DOCUMENT_UTF8_BYTES = 16 * 1_048_576;
+export const SKILL_CATALOG_MAX_PATH_ENTRIES = 1_000;
+export const SKILL_CATALOG_MAX_METADATA_CHARACTERS = 1_048_576;
+/** One outer deadline for skill discovery/read operations. */
+export const SKILL_FILE_OPERATION_TIMEOUT_MS = 30_000;
+
+export const SKILL_SCRIPT_DEFAULT_TIMEOUT_MS = 60_000;
+export const SKILL_SCRIPT_MAX_TIMEOUT_MS = 300_000;
+/** Maximum cleanup wait after a lifecycle provider receives termination. */
+export const SKILL_SCRIPT_PROVIDER_TERMINATION_GRACE_MS = 1_000;
+/** Combined UTF-8 byte ceiling for stdout and stderr returned by a skill tool. */
+export const SKILL_SCRIPT_MAX_OUTPUT_BYTES = 1_048_576;
+export const SKILL_SCRIPT_MAX_CONTENT_BYTES = 1_048_576;
+export const SKILL_SCRIPT_MAX_ARGS = 64;
+export const SKILL_SCRIPT_MAX_ARG_LENGTH = 4_096;
+export const SKILL_SCRIPT_MAX_ARG_BYTES_TOTAL = 65_536;
+export const SKILL_SCRIPT_MAX_ENV_ENTRIES = 64;
+export const SKILL_SCRIPT_MAX_ENV_KEY_LENGTH = 128;
+export const SKILL_SCRIPT_MAX_ENV_VALUE_LENGTH = 8_192;
+export const SKILL_SCRIPT_MAX_ENV_BYTES_TOTAL = 65_536;
+
+const SKILL_SCRIPT_ENV_KEY_PATTERN_SOURCE = "^[A-Za-z_][A-Za-z0-9_]*$";
+const INTERNAL_SKILL_SCRIPT_ENV_KEY_REGEX = new NativeRegExp(
+  SKILL_SCRIPT_ENV_KEY_PATTERN_SOURCE,
+);
+
+/**
+ * Public inspection matcher for skill-script environment names.
+ * Mutating this compatibility value does not alter admission decisions.
+ */
+export const SKILL_SCRIPT_ENV_KEY_REGEX = new NativeRegExp(
+  SKILL_SCRIPT_ENV_KEY_PATTERN_SOURCE,
+);
+
+/** Framework-owned skill-script environment-name admission check. */
+export function isValidSkillScriptEnvironmentKey(value: unknown): value is string {
+  return typeof value === "string" &&
+    apply(regExpExec, INTERNAL_SKILL_SCRIPT_ENV_KEY_REGEX, [value]) !== null;
+}
diff --git a/src/skill/operation-budget.ts b/src/skill/operation-budget.ts
new file mode 100644
index 0000000000..4583ea2b03
--- /dev/null
+++ b/src/skill/operation-budget.ts
@@ -0,0 +1,189 @@
+/** Shared cancellation/deadline budget for one skill file operation. */
+
+import {
+  addAbortSignalListenerOnce,
+  getAbortSignalReason,
+  isAbortSignalAborted,
+  isAbortSignalWithoutHooks,
+  removeAbortSignalListener,
+} from "#veryfront/platform/compat/abort-signal.ts";
+
+const NativeDOMException = DOMException;
+const NativePromise = Promise;
+const apply = Reflect.apply;
+const clearScheduledTimeout = clearTimeout;
+const defineOwnProperty = Object.defineProperty;
+const freeze = Object.freeze;
+const mathCeil = Math.ceil;
+const mathMax = Math.max;
+const monotonicClock = performance;
+const monotonicNow = Performance.prototype.now;
+const scheduleTimeout = setTimeout;
+
+function now(): number {
+  return apply(monotonicNow, monotonicClock, []) as number;
+}
+
+export interface SkillOperationBudget {
+  readonly abortSignal?: AbortSignal;
+  readonly timeoutMs?: number;
+  /** One immutable timeout reason shared by every deadline observation. */
+  readonly timeoutError?: SkillOperationTimeoutError;
+  remainingMs(): number | undefined;
+  throwIfTerminated(): void;
+  run<T>(operation: (abortSignal: AbortSignal | undefined) => Promise<T>): Promise<T>;
+}
+
+export class SkillOperationTimeoutError extends Error {
+  readonly timeoutMs!: number;
+
+  constructor(timeoutMs: number) {
+    super(`Skill operation timed out after ${timeoutMs}ms`);
+    defineOwnProperty(this, "name", {
+      configurable: false,
+      enumerable: false,
+      value: "SkillOperationTimeoutError",
+      writable: false,
+    });
+    defineOwnProperty(this, "timeoutMs", {
+      configurable: false,
+      enumerable: true,
+      value: timeoutMs,
+      writable: false,
+    });
+    freeze(this);
+  }
+}
+
+async function observeRejection(promise: Promise<unknown>): Promise<void> {
+  try {
+    await promise;
+  } catch (_) {
+    // The caller intentionally abandoned this settlement after cancellation.
+  }
+}
+
+function racePromises<T>(left: Promise<T>, right: Promise<never>): Promise<T> {
+  return new NativePromise<T>((resolve, reject) => {
+    void (async () => {
+      try {
+        resolve(await left);
+      } catch (error) {
+        reject(error);
+      }
+    })();
+    void (async () => {
+      try {
+        resolve(await right);
+      } catch (error) {
+        reject(error);
+      }
+    })();
+  });
+}
+
+function abortReason(signal: AbortSignal): unknown {
+  const reason = getAbortSignalReason(signal);
+  return reason === undefined
+    ? new NativeDOMException("The operation was aborted", "AbortError")
+    : reason;
+}
+
+/** Create one monotonic budget at the outermost skill-tool boundary. */
+export function createSkillOperationBudget(options: {
+  abortSignal?: AbortSignal;
+  timeoutMs?: number;
+} = {}): SkillOperationBudget {
+  const abortSignal = options.abortSignal;
+  if (abortSignal !== undefined && !isAbortSignalWithoutHooks(abortSignal)) {
+    throw new TypeError("Skill operation abortSignal must be an AbortSignal");
+  }
+  const timeoutMs = options.timeoutMs;
+  if (
+    timeoutMs !== undefined &&
+    (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)
+  ) {
+    throw new RangeError("Skill operation timeout must be a positive safe integer");
+  }
+  const timeoutError = timeoutMs === undefined
+    ? undefined
+    : new SkillOperationTimeoutError(timeoutMs);
+  const deadline = timeoutMs === undefined ? undefined : now() + timeoutMs;
+
+  const remainingMs = (): number | undefined =>
+    deadline === undefined ? undefined : mathMax(0, mathCeil(deadline - now()));
+
+  const throwIfTerminated = (): void => {
+    if (abortSignal && isAbortSignalAborted(abortSignal)) {
+      throw abortReason(abortSignal);
+    }
+    if (remainingMs() === 0) {
+      throw timeoutError!;
+    }
+  };
+
+  return freeze({
+    ...(abortSignal === undefined ? {} : { abortSignal }),
+    ...(timeoutMs === undefined ? {} : { timeoutMs }),
+    ...(timeoutError === undefined ? {} : { timeoutError }),
+    remainingMs,
+    throwIfTerminated,
+    async run<T>(
+      operation: (abortSignal: AbortSignal | undefined) => Promise<T>,
+    ): Promise<T> {
+      throwIfTerminated();
+      let promise: Promise<T>;
+      try {
+        promise = operation(abortSignal);
+      } catch (error) {
+        throwIfTerminated();
+        throw error;
+      }
+      try {
+        throwIfTerminated();
+      } catch (error) {
+        void observeRejection(promise);
+        throw error;
+      }
+      if (deadline === undefined && abortSignal === undefined) {
+        return await promise;
+      }
+
+      let timeoutId: ReturnType<typeof setTimeout> | undefined;
+      let abortListener: (() => void) | undefined;
+      const termination = new NativePromise<never>((_resolve, reject) => {
+        const remaining = remainingMs();
+        if (remaining !== undefined) {
+          timeoutId = scheduleTimeout(
+            () => reject(timeoutError!),
+            remaining,
+          );
+        }
+        if (abortSignal) {
+          abortListener = () => reject(abortReason(abortSignal));
+          addAbortSignalListenerOnce(abortSignal, abortListener);
+          if (isAbortSignalAborted(abortSignal)) {
+            abortListener();
+          }
+        }
+      });
+
+      try {
+        let result: T;
+        try {
+          result = await racePromises(promise, termination);
+        } catch (error) {
+          throwIfTerminated();
+          throw error;
+        }
+        throwIfTerminated();
+        return result;
+      } finally {
+        if (timeoutId !== undefined) clearScheduledTimeout(timeoutId);
+        if (abortSignal && abortListener) {
+          removeAbortSignalListener(abortSignal, abortListener);
+        }
+      }
+    },
+  });
+}
diff --git a/src/skill/path-safety.test.ts b/src/skill/path-safety.test.ts
index 00f2c5b0bb..0951c3de0c 100644
--- a/src/skill/path-safety.test.ts
+++ b/src/skill/path-safety.test.ts
@@ -10,8 +10,36 @@ import {
   symlink,
   writeTextFile,
 } from "#veryfront/platform/compat/fs.ts";
-import { listSkillSubdir, validateSkillPath } from "./path-safety.ts";
+import {
+  listSkillSubdir,
+  listStrictSkillSubdir,
+  validateSkillPath,
+  validateStrictSkillPath,
+} from "./path-safety.ts";
 import { createSkillTestAdapter } from "./testing.ts";
+import {
+  SKILL_ALLOWED_SUBDIR_MAX_ENTRIES,
+  SKILL_RELATIVE_PATH_MAX_LENGTH,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "./limits.ts";
+import { createSkillOperationBudget } from "./operation-budget.ts";
+
+async function settlesWithin(promise: Promise<unknown>, timeoutMs = 50): Promise<boolean> {
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise.then(
+        () => true,
+        () => true,
+      ),
+      new Promise<boolean>((resolve) => {
+        timeoutId = setTimeout(() => resolve(false), timeoutMs);
+      }),
+    ]);
+  } finally {
+    if (timeoutId !== undefined) clearTimeout(timeoutId);
+  }
+}
 
 describe("src/skill/path-safety", () => {
   describe("validateSkillPath", () => {
@@ -42,6 +70,220 @@ describe("src/skill/path-safety", () => {
       }
     });
 
+    it("allows root files while an empty allowlist still rejects subdirectories", async () => {
+      const root = "/project/skills/test";
+      const adapter = createSkillTestAdapter({
+        [`${root}/SKILL.md`]: "# Test skill",
+        [`${root}/references/guide.md`]: "Guide",
+      });
+
+      assertEquals(
+        await validateSkillPath(root, "SKILL.md", [], adapter),
+        `${root}/SKILL.md`,
+      );
+      assertEquals(
+        await validateStrictSkillPath(root, "SKILL.md", [], adapter),
+        `${root}/SKILL.md`,
+      );
+      await assertRejects(
+        () => validateSkillPath(root, "references/guide.md", [], adapter),
+        Error,
+        "allowlist is empty",
+      );
+      await assertRejects(
+        () => validateStrictSkillPath(root, "references/guide.md", [], adapter),
+        Error,
+        "allowlist is empty",
+      );
+    });
+
+    it("requires an absolute root while preserving the public allowed-directory contract", async () => {
+      await assertRejects(
+        () => validateSkillPath("relative/skill", "references/guide.md", ["references"]),
+        TypeError,
+        "absolute",
+      );
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/guide.md": "Guide",
+      });
+      const allowedSubdirs = [
+        "references",
+        ...Array.from(
+          { length: SKILL_ALLOWED_SUBDIR_MAX_ENTRIES },
+          (_unused, index) => `dir-${index}`,
+        ),
+      ];
+      assertEquals(
+        await validateSkillPath(
+          "/project/skills/test",
+          "references/guide.md",
+          allowedSubdirs,
+          adapter,
+        ),
+        "/project/skills/test/references/guide.md",
+      );
+      await assertRejects(
+        () =>
+          validateStrictSkillPath(
+            "/project/skills/test",
+            "references/guide.md",
+            allowedSubdirs,
+            adapter,
+          ),
+        RangeError,
+        `${SKILL_ALLOWED_SUBDIR_MAX_ENTRIES}`,
+      );
+
+      assertEquals(
+        await validateStrictSkillPath(
+          "/project/skills/test",
+          "references/guide.md",
+          allowedSubdirs.slice(0, SKILL_ALLOWED_SUBDIR_MAX_ENTRIES),
+          adapter,
+        ),
+        "/project/skills/test/references/guide.md",
+      );
+    });
+
+    it("rejects Proxy allowlists before invoking traps or consulting the filesystem", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/guide.md": "Guide",
+      });
+      let proxyTrapCalls = 0;
+      const allowedSubdirs = new Proxy(["references"], {
+        get(target, property, receiver) {
+          proxyTrapCalls += 1;
+          return Reflect.get(target, property, receiver);
+        },
+        getOwnPropertyDescriptor(target, property) {
+          proxyTrapCalls += 1;
+          return Reflect.getOwnPropertyDescriptor(target, property);
+        },
+      });
+
+      let failure: unknown;
+      try {
+        await validateStrictSkillPath(
+          "/project/skills/test",
+          "references/guide.md",
+          allowedSubdirs,
+          adapter,
+        );
+      } catch (error) {
+        failure = error;
+      }
+
+      assertEquals(failure instanceof TypeError, true);
+      assertEquals(
+        failure instanceof Error ? failure.message.includes("must not be a proxy") : false,
+        true,
+      );
+      assertEquals(proxyTrapCalls, 0);
+    });
+
+    it("does not echo rejected allowlist values into diagnostics", async () => {
+      const rejectedValue = "bad\nALLOWLIST_SECRET";
+      let failure: unknown;
+      try {
+        await validateStrictSkillPath(
+          "/project/skills/test",
+          "SKILL.md",
+          [rejectedValue],
+          createSkillTestAdapter({
+            "/project/skills/test/SKILL.md": "# Demo",
+          }),
+        );
+      } catch (error) {
+        failure = error;
+      }
+
+      assertEquals(failure instanceof Error, true);
+      const message = failure instanceof Error ? failure.message : "";
+      assertEquals(message.includes("ALLOWLIST_SECRET"), false);
+      assertEquals(message.includes("\n"), false);
+    });
+
+    it("keeps directory allowlist decisions independent of Array.prototype mutation", async () => {
+      const root = "/project/skills/test";
+      const adapter = createSkillTestAdapter({
+        [`${root}/scripts/run.sh`]: "echo no",
+      });
+      const original = Object.getOwnPropertyDescriptor(Array.prototype, "includes");
+      let hookCalls = 0;
+      Object.defineProperty(Array.prototype, "includes", {
+        configurable: true,
+        value() {
+          hookCalls += 1;
+          return true;
+        },
+        writable: true,
+      });
+
+      let failure: unknown;
+      try {
+        await validateStrictSkillPath(
+          root,
+          "scripts/run.sh",
+          ["references"],
+          adapter,
+        );
+      } catch (error) {
+        failure = error;
+      } finally {
+        if (original) Object.defineProperty(Array.prototype, "includes", original);
+      }
+
+      assertEquals(failure instanceof Error, true);
+      assertEquals(hookCalls, 0);
+    });
+
+    it("does not let inherited index setters rewrite the allowed-directory snapshot", async () => {
+      const root = "/project/skills/test";
+      const adapter = createSkillTestAdapter({
+        [`${root}/scripts/run.sh`]: "echo no",
+      });
+      const original = Object.getOwnPropertyDescriptor(Array.prototype, "0");
+      let authorizationSetterCalls = 0;
+      let authorized = false;
+      let failure: unknown;
+      Object.defineProperty(Array.prototype, "0", {
+        configurable: true,
+        set(value: unknown) {
+          if (value === "references") authorizationSetterCalls += 1;
+          Object.defineProperty(this, "0", {
+            configurable: true,
+            enumerable: true,
+            value: value === "references" ? "scripts" : value,
+            writable: true,
+          });
+        },
+      });
+
+      try {
+        try {
+          await validateStrictSkillPath(
+            root,
+            "scripts/run.sh",
+            ["references"],
+            adapter,
+          );
+          authorized = true;
+        } catch (error) {
+          failure = error;
+        }
+      } finally {
+        if (original) {
+          Object.defineProperty(Array.prototype, "0", original);
+        } else {
+          Reflect.deleteProperty(Array.prototype, "0");
+        }
+      }
+
+      assertEquals(authorized, false);
+      assertEquals(failure instanceof Error, true);
+      assertEquals(authorizationSetterCalls, 0);
+    });
+
     it("should validate existing files with fsAdapter", async () => {
       const adapter = createSkillTestAdapter({
         "/project/skills/test/references/guide.md": "Guide",
@@ -55,6 +297,138 @@ describe("src/skill/path-safety", () => {
       assertEquals(validated, "/project/skills/test/references/guide.md");
     });
 
+    it("uses adapter lstat and realPath capabilities to reject escapes", async () => {
+      const root = "/project/skills/test";
+      const file = `${root}/references/guide.md`;
+      const adapter = createSkillTestAdapter({ [file]: "Guide" });
+
+      await assertRejects(
+        () =>
+          validateStrictSkillPath(root, "references/guide.md", ["references"], {
+            ...adapter,
+            async lstat(path) {
+              const info = await adapter.stat(path);
+              return {
+                ...info,
+                isSymlink: path === `${root}/references`,
+              };
+            },
+          }),
+        Error,
+        "symlink",
+      );
+
+      await assertRejects(
+        () =>
+          validateSkillPath(root, "references/guide.md", ["references"], {
+            ...adapter,
+            async lstat(path) {
+              return await adapter.stat(path);
+            },
+            async realPath(path) {
+              return path === root ? root : `/outside/${path.split("/").at(-1)}`;
+            },
+          }),
+        Error,
+        "escapes root",
+      );
+    });
+
+    it("keeps the tighter relative-path ceiling on strict validation only", async () => {
+      const root = "/project/skills/test";
+      const requestedPath = `references/${
+        Array.from(
+          { length: 6 },
+          (_unused, index) => `${index}${"x".repeat(199)}`,
+        ).join("/")
+      }/guide.md`;
+      assertEquals(requestedPath.length > SKILL_RELATIVE_PATH_MAX_LENGTH, true);
+      const adapter = createSkillTestAdapter({
+        [`${root}/${requestedPath}`]: "Guide",
+      });
+
+      assertEquals(
+        await validateSkillPath(root, requestedPath, ["references"], adapter),
+        `${root}/${requestedPath}`,
+      );
+      await assertRejects(
+        () => validateStrictSkillPath(root, requestedPath, ["references"], adapter),
+        TypeError,
+        "bounded path",
+      );
+    });
+
+    it("fails closed when an adapter cannot prove symlink semantics", async () => {
+      const safeAdapter = createSkillTestAdapter({
+        "/project/skills/test/references/guide.md": "Guide",
+      });
+      const { symlinkSemantics: _authority, ...unprovenAdapter } = safeAdapter;
+
+      await assertRejects(
+        () =>
+          validateStrictSkillPath(
+            "/project/skills/test",
+            "references/guide.md",
+            ["references"],
+            unprovenAdapter,
+          ),
+        TypeError,
+        "requires own symlinkSemantics:'none' authority or lstat and realPath",
+      );
+    });
+
+    it("caps fallback adapter enumeration used for symlink detection", async () => {
+      const root = "/project/skills/test";
+      const file = `${root}/references/guide.md`;
+      const adapter = createSkillTestAdapter({ [file]: "Guide" });
+
+      await assertRejects(
+        () =>
+          validateStrictSkillPath(root, "references/guide.md", ["references"], {
+            ...adapter,
+            async *readDir() {
+              for (let index = 0; index <= SKILL_SUBDIR_MAX_ENTRIES; index += 1) {
+                yield {
+                  name: `entry-${index}`,
+                  isFile: true,
+                  isDirectory: false,
+                  isSymlink: false,
+                };
+              }
+            },
+          }),
+        RangeError,
+        `${SKILL_SUBDIR_MAX_ENTRIES}`,
+      );
+    });
+
+    it("honors a shared cancellation budget during strict validation", async () => {
+      const adapter = {
+        ...createSkillTestAdapter({}),
+        exists: () => new Promise<boolean>(() => {}),
+      };
+      const controller = new AbortController();
+      const budget = createSkillOperationBudget({ abortSignal: controller.signal });
+      const validateWithBudget = validateStrictSkillPath as unknown as (
+        root: string,
+        requestedPath: string,
+        allowedSubdirs: readonly string[],
+        fsAdapter: typeof adapter,
+        options: { budget: typeof budget },
+      ) => Promise<string>;
+
+      const validation = validateWithBudget(
+        "/project/skills/test",
+        "references/guide.md",
+        ["references"],
+        adapter,
+        { budget },
+      );
+      controller.abort(new Error("cancel strict validation"));
+
+      assertEquals(await settlesWithin(validation), true);
+    });
+
     it("should reject symlinked files in local skills", async () => {
       const tempDir = await makeTempDir({ prefix: "vf-skill-path-" });
       const skillRoot = join(tempDir, "skill");
@@ -120,13 +494,277 @@ describe("src/skill/path-safety", () => {
       );
     });
 
+    it("propagates adapter error proxies without invoking prototype traps", async () => {
+      const adapter = createSkillTestAdapter({});
+      let prototypeReads = 0;
+      const hostile = new Proxy(
+        FILE_NOT_FOUND.create({ detail: "File not found: optional directory" }),
+        {
+          getPrototypeOf(): never {
+            prototypeReads += 1;
+            throw new Error("getPrototypeOf trap must not run");
+          },
+        },
+      );
+
+      let failure: unknown;
+      try {
+        await listSkillSubdir("/project/skills/test", "assets", {
+          ...adapter,
+          async exists() {
+            throw hostile;
+          },
+        });
+      } catch (error) {
+        failure = error;
+      }
+
+      assertEquals(prototypeReads, 0);
+      assertEquals(failure === hostile, true);
+    });
+
     it("should list files via fsAdapter", async () => {
       const adapter = createSkillTestAdapter({
         "/project/skills/test/references/a.md": "A",
         "/project/skills/test/references/b.md": "B",
+        "/project/skills/test/references/release notes.md": "Notes",
+        "/project/skills/test/references/översikt.md": "Overview",
       });
       const result = await listSkillSubdir("/project/skills/test", "references", adapter);
-      assertEquals(result.sort(), ["references/a.md", "references/b.md"]);
+      assertEquals(result, [
+        "references/a.md",
+        "references/b.md",
+        "references/översikt.md",
+        "references/release notes.md",
+      ]);
+    });
+
+    it("rejects traversal in the requested subdirectory before enumeration", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/outside/secret.md": "secret",
+      });
+
+      await assertRejects(
+        () => listSkillSubdir("/project/skills/test", "../outside", adapter),
+        Error,
+        "subdirectory",
+      );
+    });
+
+    it("rejects unsafe adapter entry names", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/ok.md": "ok",
+      });
+
+      await assertRejects(
+        () =>
+          listSkillSubdir("/project/skills/test", "references", {
+            ...adapter,
+            async *readDir() {
+              yield {
+                name: "../secret.md",
+                isFile: true,
+                isDirectory: false,
+                isSymlink: false,
+              };
+            },
+          }),
+        Error,
+        "entry name",
+      );
+    });
+
+    it("does not echo rejected adapter entry names into diagnostics", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/ok.md": "ok",
+      });
+      let failure: unknown;
+      try {
+        await listStrictSkillSubdir(
+          "/project/skills/test",
+          "references",
+          {
+            ...adapter,
+            async *readDir() {
+              yield {
+                name: "bad\nENTRY_SECRET",
+                isFile: true,
+                isDirectory: false,
+                isSymlink: false,
+              };
+            },
+          },
+        );
+      } catch (error) {
+        failure = error;
+      }
+
+      assertEquals(failure instanceof Error, true);
+      const message = failure instanceof Error ? failure.message : "";
+      assertEquals(message.includes("ENTRY_SECRET"), false);
+      assertEquals(message.includes("\n"), false);
+    });
+
+    it("rejects accessor-backed adapter entries without reading them twice", async () => {
+      const root = "/project/skills/test";
+      const adapter = createSkillTestAdapter({
+        [`${root}/references/ok.md`]: "ok",
+      });
+      let nameReads = 0;
+      const entry = Object.defineProperties({}, {
+        name: {
+          enumerable: true,
+          get() {
+            nameReads += 1;
+            return nameReads === 1 ? "ok.md" : "../secret.md";
+          },
+        },
+        isFile: { enumerable: true, value: true },
+        isDirectory: { enumerable: true, value: false },
+        isSymlink: { enumerable: true, value: false },
+      });
+
+      let failure: unknown;
+      try {
+        await listStrictSkillSubdir(root, "references", {
+          ...adapter,
+          async *readDir(path) {
+            if (path === `${root}/references`) {
+              yield entry as never;
+              return;
+            }
+            yield* adapter.readDir(path);
+          },
+        });
+      } catch (error) {
+        failure = error;
+      }
+
+      assertEquals(failure instanceof TypeError, true);
+      assertEquals(nameReads, 0);
+    });
+
+    it("preserves public adapter order while strict listings sort deterministically", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/a.md": "A",
+      });
+      const unorderedAdapter = {
+        ...adapter,
+        async *readDir() {
+          yield { name: "z.md", isFile: true, isDirectory: false, isSymlink: false };
+          yield { name: "a.md", isFile: true, isDirectory: false, isSymlink: false };
+        },
+      };
+
+      assertEquals(
+        await listSkillSubdir(
+          "/project/skills/test",
+          "references",
+          unorderedAdapter,
+        ),
+        ["references/z.md", "references/a.md"],
+      );
+      assertEquals(
+        await listStrictSkillSubdir(
+          "/project/skills/test",
+          "references",
+          unorderedAdapter,
+        ),
+        ["references/a.md", "references/z.md"],
+      );
+    });
+
+    it("keeps the entry cap on strict listings only", async () => {
+      const adapter = createSkillTestAdapter({
+        "/project/skills/test/references/a.md": "A",
+      });
+      const largeAdapter = {
+        ...adapter,
+        async *readDir() {
+          for (let index = 0; index < 1_001; index++) {
+            yield {
+              name: `file-${index}.md`,
+              isFile: true,
+              isDirectory: false,
+              isSymlink: false,
+            };
+          }
+        },
+      };
+
+      assertEquals(
+        (
+          await listSkillSubdir(
+            "/project/skills/test",
+            "references",
+            largeAdapter,
+          )
+        ).length,
+        1_001,
+      );
+      await assertRejects(
+        () =>
+          listStrictSkillSubdir(
+            "/project/skills/test",
+            "references",
+            largeAdapter,
+          ),
+        RangeError,
+        "at most 1000",
+      );
+    });
+
+    it("honors a shared cancellation budget during strict listing", async () => {
+      const adapter = {
+        ...createSkillTestAdapter({}),
+        exists: () => new Promise<boolean>(() => {}),
+      };
+      const controller = new AbortController();
+      const budget = createSkillOperationBudget({ abortSignal: controller.signal });
+      const listWithBudget = listStrictSkillSubdir as unknown as (
+        root: string,
+        subdir: string,
+        fsAdapter: typeof adapter,
+        options: { budget: typeof budget },
+      ) => Promise<string[]>;
+
+      const listing = listWithBudget(
+        "/project/skills/test",
+        "references",
+        adapter,
+        { budget },
+      );
+      controller.abort(new Error("cancel strict listing"));
+
+      assertEquals(await settlesWithin(listing), true);
+    });
+
+    it("rejects symlinked local subdirectories instead of listing their targets", async () => {
+      const tempDir = await makeTempDir({ prefix: "vf-skill-list-" });
+      const skillRoot = join(tempDir, "skill");
+      const outsideDir = join(tempDir, "outside");
+      const linkedDir = join(skillRoot, "references");
+
+      try {
+        await mkdir(skillRoot, { recursive: true });
+        await mkdir(outsideDir, { recursive: true });
+        await writeTextFile(join(outsideDir, "secret.md"), "secret");
+
+        try {
+          await symlink(outsideDir, linkedDir);
+        } catch {
+          console.warn("[SKIP] symlink directory test: OS denied symlink creation — skipping");
+          return;
+        }
+
+        await assertRejects(
+          () => listSkillSubdir(skillRoot, "references"),
+          Error,
+          "symlink",
+        );
+      } finally {
+        await remove(tempDir, { recursive: true });
+      }
     });
   });
 });
diff --git a/src/skill/path-safety.ts b/src/skill/path-safety.ts
index 313386be7c..4c5208b5c6 100644
--- a/src/skill/path-safety.ts
+++ b/src/skill/path-safety.ts
@@ -2,29 +2,151 @@
  * Skill path safety
  *
  * Validates file paths within skill directories to prevent traversal attacks.
- * Uses centralized validatePath() from #veryfront/security.
+ * Uses centralized lexical admission from #veryfront/security before applying
+ * descriptor-aware filesystem checks.
  *
  * @module
  */
 
-import { validatePath, type ValidationResult } from "#veryfront/security";
+import {
+  PathValidationError,
+  validateLexicalPath,
+  type ValidationResult,
+} from "#veryfront/security";
 import { isAbsolute, join, relative, resolve } from "#veryfront/compat/path";
 import { exists, readDir, stat } from "#veryfront/platform/compat/fs.ts";
-import { createError, fromError, toError, VeryfrontError } from "#veryfront/errors";
+import { createError, fromError, toError } from "#veryfront/errors";
+import { snapshotVeryfrontError } from "#veryfront/errors/types.ts";
 import type { FileSystemAdapter } from "#veryfront/platform/adapters/base.ts";
+import { isProxyWithoutHooks } from "#veryfront/platform/compat/error-introspection.ts";
+import {
+  SKILL_ALLOWED_SUBDIR_MAX_ENTRIES,
+  SKILL_PATH_SEGMENT_MAX_LENGTH,
+  SKILL_RELATIVE_PATH_MAX_LENGTH,
+  SKILL_ROOT_PATH_MAX_LENGTH,
+  SKILL_SUBDIR_MAX_ENTRIES,
+} from "./limits.ts";
+import { hasControlCharacters, isWellFormedUtf16 } from "./string-safety.ts";
+import type { SkillOperationBudget } from "./operation-budget.ts";
+const SAFE_SKILL_PATH_SEGMENT_REGEX = /^[A-Za-z0-9._-]+$/;
+const apply = Reflect.apply;
+const arrayIsArray = Array.isArray;
+const arrayJoin = Array.prototype.join;
+const arraySort = Array.prototype.sort;
+const defineProperty = Object.defineProperty;
+const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+const numberIsSafeInteger = Number.isSafeInteger;
+const objectHasOwnProperty = Object.prototype.hasOwnProperty;
+const regExpExec = RegExp.prototype.exec;
+const setAdd = Set.prototype.add;
+const setHas = Set.prototype.has;
+const stringIncludes = String.prototype.includes;
+const stringReplaceAll = String.prototype.replaceAll;
+const stringSplit = String.prototype.split;
+const stringStartsWith = String.prototype.startsWith;
+
+function hasOwn(value: object, key: PropertyKey): boolean {
+  return apply(objectHasOwnProperty, value, [key]) as boolean;
+}
+
+function appendOwnArrayElement<T>(values: T[], value: T): void {
+  defineProperty(values, values.length, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true,
+  });
+}
+
+export interface SkillPathOperationOptions {
+  budget?: SkillOperationBudget;
+}
+
+function assertStrictSymlinkCapabilities(fsAdapter: FileSystemAdapter | undefined): void {
+  if (!fsAdapter) return;
+  const semantics = getOwnPropertyDescriptor(fsAdapter, "symlinkSemantics");
+  if (semantics && hasOwn(semantics, "value") && semantics.value === "none") return;
+  if (typeof fsAdapter.lstat === "function" && typeof fsAdapter.realPath === "function") return;
+  throw new TypeError(
+    "Strict skill filesystem requires own symlinkSemantics:'none' authority or lstat and realPath capabilities",
+  );
+}
 
 function isInsideDir(baseDir: string, targetPath: string): boolean {
   const rel = relative(baseDir, targetPath);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+  return rel === "" ||
+    (
+      !isAbsolute(rel) &&
+      rel !== ".." &&
+      !(apply(stringStartsWith, rel, ["../"]) as boolean) &&
+      !(apply(stringStartsWith, rel, ["..\\"]) as boolean)
+    );
 }
 
 function isFileNotFoundError(error: unknown): boolean {
-  if (error instanceof VeryfrontError && error.slug === "file-not-found") {
+  if (snapshotVeryfrontError(error)?.slug === "file-not-found") {
     return true;
   }
 
   const veryfrontError = fromError(error);
-  return veryfrontError?.type === "file" && veryfrontError.message.startsWith("File not found:");
+  return veryfrontError?.type === "file" &&
+    (apply(stringStartsWith, veryfrontError.message, ["File not found:"]) as boolean);
+}
+
+interface CapturedDirectoryEntry {
+  readonly name: string;
+  readonly isFile: boolean;
+  readonly isDirectory: boolean;
+  readonly isSymlink: boolean;
+}
+
+function captureDirectoryEntry(value: unknown): CapturedDirectoryEntry {
+  if ((typeof value !== "object" && typeof value !== "function") || value === null) {
+    throw new TypeError("Skill directory entry must be an object");
+  }
+  if (isProxyWithoutHooks(value)) {
+    throw new TypeError("Skill directory entry must not be a proxy");
+  }
+
+  const readData = (property: keyof CapturedDirectoryEntry): unknown => {
+    const descriptor = getOwnPropertyDescriptor(value, property);
+    if (!descriptor || !hasOwn(descriptor, "value")) {
+      throw new TypeError(`Skill directory entry ${property} must be a data property`);
+    }
+    return descriptor.value;
+  };
+  const name = readData("name");
+  const isFile = readData("isFile");
+  const isDirectory = readData("isDirectory");
+  const isSymlink = readData("isSymlink");
+  if (typeof name !== "string") {
+    throw new TypeError("Skill directory entry name must be a data string");
+  }
+  if (
+    typeof isFile !== "boolean" ||
+    typeof isDirectory !== "boolean" ||
+    typeof isSymlink !== "boolean"
+  ) {
+    throw new TypeError("Skill directory entry type flags must be data booleans");
+  }
+  return { name, isFile, isDirectory, isSymlink };
+}
+
+function splitNonEmpty(value: string, separator: string): string[] {
+  const raw = apply(stringSplit, value, [separator]) as string[];
+  const result: string[] = [];
+  for (let index = 0; index < raw.length; index += 1) {
+    const segment = raw[index];
+    if (segment) appendOwnArrayElement(result, segment);
+  }
+  return result;
+}
+
+function containsExactString(values: readonly string[], candidate: string): boolean {
+  for (let index = 0; index < values.length; index += 1) {
+    if (values[index] === candidate) return true;
+  }
+  return false;
 }
 
 async function pathExists(path: string, fsAdapter?: FileSystemAdapter): Promise<boolean> {
@@ -43,6 +165,18 @@ async function assertIsFile(path: string, fsAdapter?: FileSystemAdapter): Promis
   }
 }
 
+async function assertIsDirectory(path: string, fsAdapter?: FileSystemAdapter): Promise<void> {
+  const info = fsAdapter ? await fsAdapter.stat(path) : await stat(path);
+  if (!info.isDirectory) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: `Skill path must point to a directory: "${path}"`,
+      }),
+    );
+  }
+}
+
 async function resolveLocalRealPath(path: string): Promise<string> {
   if (typeof Deno !== "undefined") {
     return await Deno.realPath(path);
@@ -52,28 +186,31 @@ async function resolveLocalRealPath(path: string): Promise<string> {
 }
 
 async function isLocalSymlink(path: string): Promise<boolean> {
-  try {
-    if (typeof Deno !== "undefined") {
-      const info = await Deno.lstat(path);
-      return info.isSymlink;
-    }
-    const fs = await import("node:fs/promises");
-    const info = await fs.lstat(path);
-    return info.isSymbolicLink();
-  } catch {
-    // expected: path may not exist or not be accessible
-    return false;
+  if (typeof Deno !== "undefined") {
+    const info = await Deno.lstat(path);
+    return info.isSymlink;
   }
+  const fs = await import("node:fs/promises");
+  const info = await fs.lstat(path);
+  return info.isSymbolicLink();
 }
 
 async function isAdapterSymlink(
   fsAdapter: FileSystemAdapter,
   parentDir: string,
   segment: string,
+  maxEntries = SKILL_SUBDIR_MAX_ENTRIES,
 ): Promise<boolean> {
-  for await (const entry of fsAdapter.readDir(parentDir)) {
-    if (entry.name !== segment) continue;
-    return entry.isSymlink;
+  let entryCount = 0;
+  for await (const rawEntry of fsAdapter.readDir(parentDir)) {
+    entryCount += 1;
+    if (entryCount > maxEntries) {
+      throw new RangeError(
+        `Skill directory may contain at most ${maxEntries} entries`,
+      );
+    }
+    const entry = captureDirectoryEntry(rawEntry);
+    if (entry.name === segment && entry.isSymlink) return true;
   }
   return false;
 }
@@ -82,18 +219,35 @@ async function hasSymlinkInPath(
   skillRoot: string,
   canonicalPath: string,
   fsAdapter?: FileSystemAdapter,
+  maxDirectoryEntries = SKILL_SUBDIR_MAX_ENTRIES,
 ): Promise<boolean> {
   const resolvedRoot = resolve(skillRoot);
   const resolvedTarget = resolve(canonicalPath);
-  const rel = relative(resolvedRoot, resolvedTarget).replaceAll("\\", "/");
+  const rel = apply(
+    stringReplaceAll,
+    relative(resolvedRoot, resolvedTarget),
+    ["\\", "/"],
+  ) as string;
 
+  if (!isInsideDir(resolvedRoot, resolvedTarget)) return true;
+
+  if (fsAdapter?.lstat) {
+    if ((await fsAdapter.lstat(resolvedRoot)).isSymlink) return true;
+  } else if (!fsAdapter && await isLocalSymlink(resolvedRoot)) {
+    return true;
+  }
   if (!rel) return false;
-  if (rel.startsWith("..") || isAbsolute(rel)) return true;
 
   let current = resolvedRoot;
-  for (const segment of rel.split("/").filter(Boolean)) {
+  for (const segment of splitNonEmpty(rel, "/")) {
     if (fsAdapter) {
-      if (await isAdapterSymlink(fsAdapter, current, segment)) return true;
+      if (fsAdapter.lstat) {
+        if ((await fsAdapter.lstat(join(current, segment))).isSymlink) return true;
+      } else if (
+        await isAdapterSymlink(fsAdapter, current, segment, maxDirectoryEntries)
+      ) {
+        return true;
+      }
     } else if (await isLocalSymlink(join(current, segment))) {
       return true;
     }
@@ -102,8 +256,221 @@ async function hasSymlinkInPath(
   return false;
 }
 
+function assertSafePathSegment(value: string, label: string): void {
+  if (
+    value.length === 0 ||
+    value.length > SKILL_PATH_SEGMENT_MAX_LENGTH ||
+    value === "." ||
+    value === ".." ||
+    apply(regExpExec, SAFE_SKILL_PATH_SEGMENT_REGEX, [value]) === null
+  ) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: `Invalid skill ${label}`,
+      }),
+    );
+  }
+}
+
+function assertSafeDirectoryEntryName(value: string): void {
+  if (
+    value.length === 0 ||
+    value.length > SKILL_PATH_SEGMENT_MAX_LENGTH ||
+    value === "." ||
+    value === ".." ||
+    (apply(stringIncludes, value, ["/"]) as boolean) ||
+    (apply(stringIncludes, value, ["\\"]) as boolean) ||
+    !isWellFormedUtf16(value) ||
+    hasControlCharacters(value)
+  ) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: "Invalid skill directory entry name",
+      }),
+    );
+  }
+}
+
+function requireBoundedPath(
+  value: unknown,
+  label: string,
+  maxLength: number,
+  requireAbsolute: boolean,
+): string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > maxLength ||
+    !isWellFormedUtf16(value) ||
+    hasControlCharacters(value)
+  ) {
+    throw new TypeError(
+      `Skill ${label} must be a non-empty bounded path without control characters`,
+    );
+  }
+  if (requireAbsolute && !isAbsolute(value)) {
+    throw new TypeError(`Skill ${label} must be an absolute path`);
+  }
+  return value;
+}
+
+function normalizeAllowedSubdirs(
+  value: unknown,
+  maxEntries = SKILL_ALLOWED_SUBDIR_MAX_ENTRIES,
+): string[] {
+  if ((typeof value !== "object" && typeof value !== "function") || value === null) {
+    throw new TypeError("Skill allowed subdirectories must be an array");
+  }
+  if (isProxyWithoutHooks(value)) {
+    throw new TypeError("Skill allowed subdirectories must not be a proxy");
+  }
+  if (!arrayIsArray(value)) {
+    throw new TypeError("Skill allowed subdirectories must be an array");
+  }
+  const lengthDescriptor = getOwnPropertyDescriptor(value, "length");
+  const length = lengthDescriptor && hasOwn(lengthDescriptor, "value")
+    ? lengthDescriptor.value
+    : undefined;
+  if (!numberIsSafeInteger(length) || length < 0) {
+    throw new TypeError("Skill allowed subdirectories length must be a data property");
+  }
+  if (length > maxEntries) {
+    throw new RangeError(
+      `Skill path validation accepts at most ${maxEntries} allowed subdirectories`,
+    );
+  }
+
+  const subdirs: string[] = [];
+  const seen = new Set<string>();
+  for (let index = 0; index < length; index += 1) {
+    const descriptor = getOwnPropertyDescriptor(value, index);
+    if (!descriptor || !hasOwn(descriptor, "value") || typeof descriptor.value !== "string") {
+      throw new TypeError(`Skill allowed subdirectory ${index} must be a data string`);
+    }
+    assertSafePathSegment(descriptor.value, "allowed subdirectory");
+    if (!(apply(setHas, seen, [descriptor.value]) as boolean)) {
+      apply(setAdd, seen, [descriptor.value]);
+      appendOwnArrayElement(subdirs, descriptor.value);
+    }
+  }
+  return subdirs;
+}
+
+/**
+ * Apply the skill-specific allowlist contract after generic containment.
+ *
+ * Root files such as SKILL.md are always eligible. Only paths that descend
+ * into a top-level directory are governed by `allowedSubdirs`. Passing an
+ * empty array therefore means "root files only", not "deny the skill root"
+ * and not the generic path validator's unrestricted `undefined` policy.
+ */
+function validateSkillLexicalPath(
+  requestedPath: string,
+  skillRoot: string,
+  allowedSubdirs: readonly string[],
+): ValidationResult {
+  const result = validateLexicalPath(requestedPath, {
+    baseDir: skillRoot,
+    allowAbsolute: false,
+  });
+  if (!result.valid || !result.canonicalPath) return result;
+
+  const relativePath = apply(
+    stringReplaceAll,
+    relative(resolve(skillRoot), resolve(result.canonicalPath)),
+    ["\\", "/"],
+  ) as string;
+  const segments = splitNonEmpty(relativePath, "/");
+  if (segments.length <= 1 || containsExactString(allowedSubdirs, segments[0]!)) {
+    return result;
+  }
+
+  return {
+    valid: false,
+    error: allowedSubdirs.length === 0
+      ? `Access to directory '${segments[0]}' not allowed: directory allowlist is empty`
+      : `Access to directory '${segments[0]}' not allowed. Allowed: ${apply(
+        arrayJoin,
+        allowedSubdirs,
+        [", "],
+      ) as string}`,
+    code: PathValidationError.NOT_IN_ALLOWLIST,
+  };
+}
+
+async function assertRealPathContained(
+  skillRoot: string,
+  targetPath: string,
+  displayPath: string,
+  kind: "directory" | "path",
+  fsAdapter?: FileSystemAdapter,
+): Promise<void> {
+  let realRoot: string;
+  let realTarget: string;
+  if (fsAdapter?.realPath) {
+    [realRoot, realTarget] = await Promise.all([
+      fsAdapter.realPath(skillRoot),
+      fsAdapter.realPath(targetPath),
+    ]);
+  } else if (!fsAdapter) {
+    [realRoot, realTarget] = await Promise.all([
+      resolveLocalRealPath(skillRoot),
+      resolveLocalRealPath(targetPath),
+    ]);
+  } else {
+    return;
+  }
+
+  if (!isInsideDir(realRoot, realTarget)) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: `Skill ${kind} escapes root via symlink: "${displayPath}"`,
+      }),
+    );
+  }
+}
+
+async function assertSafeSkillDirectory(
+  skillRoot: string,
+  dirPath: string,
+  displayPath: string,
+  fsAdapter?: FileSystemAdapter,
+  maxDirectoryEntries = SKILL_SUBDIR_MAX_ENTRIES,
+): Promise<void> {
+  await assertIsDirectory(dirPath, fsAdapter);
+  if (
+    await hasSymlinkInPath(
+      skillRoot,
+      dirPath,
+      fsAdapter,
+      maxDirectoryEntries,
+    )
+  ) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: `Skill directory contains a symlink and is not allowed: "${displayPath}"`,
+      }),
+    );
+  }
+
+  await assertRealPathContained(
+    skillRoot,
+    dirPath,
+    displayPath,
+    "directory",
+    fsAdapter,
+  );
+}
+
 /**
- * Validate that a requested path is safe within a skill's root directory.
+ * Validate a requested path with the public compatibility resource policy.
+ * Relative paths may contain up to 4096 characters and filesystem directory
+ * enumeration is not entry-capped. {@link validateStrictSkillPath} applies
+ * the runtime filesystem ceilings.
  *
  * @param skillRoot - Absolute path to the skill directory
  * @param requestedPath - Relative path requested (e.g. "references/CLAUSES.md")
@@ -118,18 +485,88 @@ export async function validateSkillPath(
   allowedSubdirs: string[],
   fsAdapter?: FileSystemAdapter,
 ): Promise<string> {
-  const result: ValidationResult = await validatePath(requestedPath, {
-    baseDir: skillRoot,
-    allowedDirs: allowedSubdirs,
-    level: "strict",
-    allowAbsolute: false,
-  });
+  return await validateSkillPathWithLimits(
+    skillRoot,
+    requestedPath,
+    allowedSubdirs,
+    fsAdapter,
+    SKILL_ROOT_PATH_MAX_LENGTH,
+    Infinity,
+    Infinity,
+  );
+}
+
+/**
+ * Validate a skill path with runtime filesystem resource ceilings.
+ * Relative paths are limited to 1024 characters and each inspected directory
+ * is limited to 1000 entries.
+ */
+export async function validateStrictSkillPath(
+  skillRoot: string,
+  requestedPath: string,
+  allowedSubdirs: readonly string[],
+  fsAdapter?: FileSystemAdapter,
+  options: SkillPathOperationOptions = {},
+): Promise<string> {
+  assertStrictSymlinkCapabilities(fsAdapter);
+  if (options.budget) {
+    return await options.budget.run(() =>
+      validateStrictSkillPath(
+        skillRoot,
+        requestedPath,
+        allowedSubdirs,
+        fsAdapter,
+      )
+    );
+  }
+  return await validateSkillPathWithLimits(
+    skillRoot,
+    requestedPath,
+    allowedSubdirs,
+    fsAdapter,
+    SKILL_RELATIVE_PATH_MAX_LENGTH,
+    SKILL_ALLOWED_SUBDIR_MAX_ENTRIES,
+    SKILL_SUBDIR_MAX_ENTRIES,
+  );
+}
+
+async function validateSkillPathWithLimits(
+  skillRoot: string,
+  requestedPath: string,
+  allowedSubdirs: readonly string[],
+  fsAdapter: FileSystemAdapter | undefined,
+  relativePathMaxLength: number,
+  allowedSubdirMaxEntries: number,
+  directoryMaxEntries: number,
+): Promise<string> {
+  const boundedRoot = requireBoundedPath(
+    skillRoot,
+    "root",
+    SKILL_ROOT_PATH_MAX_LENGTH,
+    true,
+  );
+  const boundedRequestedPath = requireBoundedPath(
+    requestedPath,
+    "relative path",
+    relativePathMaxLength,
+    false,
+  );
+  const normalizedAllowedSubdirs = normalizeAllowedSubdirs(
+    allowedSubdirs,
+    allowedSubdirMaxEntries,
+  );
+
+  const result = validateSkillLexicalPath(
+    boundedRequestedPath,
+    boundedRoot,
+    normalizedAllowedSubdirs,
+  );
 
   if (!result.valid) {
     throw toError(
       createError({
         type: "agent",
-        message: `Skill path validation failed for "${requestedPath}": ${
+        message: `Skill path validation failed for "${boundedRequestedPath}": ${
           result.error ?? "access denied"
         }`,
       }),
@@ -140,7 +577,8 @@ export async function validateSkillPath(
     throw toError(
       createError({
         type: "agent",
-        message: `Path validation succeeded but canonical path is undefined for: ${requestedPath}`,
+        message:
+          `Path validation succeeded but canonical path is undefined for: ${boundedRequestedPath}`,
       }),
     );
   }
@@ -151,43 +589,45 @@ export async function validateSkillPath(
     throw toError(
       createError({
         type: "agent",
-        message: `File not found: "${requestedPath}" in skill directory`,
+        message: `File not found: "${boundedRequestedPath}" in skill directory`,
       }),
     );
   }
   await assertIsFile(canonicalPath, fsAdapter);
 
   // Enforce strict no-symlink policy for skill files.
-  if (await hasSymlinkInPath(skillRoot, canonicalPath, fsAdapter)) {
+  if (
+    await hasSymlinkInPath(
+      boundedRoot,
+      canonicalPath,
+      fsAdapter,
+      directoryMaxEntries,
+    )
+  ) {
     throw toError(
       createError({
         type: "agent",
-        message: `Skill path contains a symlink and is not allowed: "${requestedPath}"`,
+        message: `Skill path contains a symlink and is not allowed: "${boundedRequestedPath}"`,
       }),
     );
   }
 
-  // Defense-in-depth: local realpath check to block symlink escapes.
-  if (!fsAdapter) {
-    const [realRoot, realTarget] = await Promise.all([
-      resolveLocalRealPath(skillRoot),
-      resolveLocalRealPath(canonicalPath),
-    ]);
-    if (!isInsideDir(realRoot, realTarget)) {
-      throw toError(
-        createError({
-          type: "agent",
-          message: `Skill path escapes root directory via symlink: "${requestedPath}"`,
-        }),
-      );
-    }
-  }
+  await assertRealPathContained(
+    boundedRoot,
+    canonicalPath,
+    boundedRequestedPath,
+    "path",
+    fsAdapter,
+  );
 
   return canonicalPath;
 }
 
 /**
- * List files in a skill subdirectory.
+ * List files with the public compatibility resource policy.
+ * Enumeration is not entry-capped and preserves the filesystem adapter's
+ * iteration order. {@link listStrictSkillSubdir} applies the runtime
+ * filesystem ceilings and deterministic ordering.
  *
  * @param skillRoot - Absolute path to the skill directory
  * @param subdir - Subdirectory name (e.g. "references", "scripts")
@@ -199,7 +639,52 @@ export async function listSkillSubdir(
   subdir: string,
   fsAdapter?: FileSystemAdapter,
 ): Promise<string[]> {
-  const dirPath = join(skillRoot, subdir);
+  return await listSkillSubdirWithLimits(
+    skillRoot,
+    subdir,
+    fsAdapter,
+    Infinity,
+    false,
+  );
+}
+
+/**
+ * List at most 1000 skill directory entries in deterministic filename order.
+ */
+export async function listStrictSkillSubdir(
+  skillRoot: string,
+  subdir: string,
+  fsAdapter?: FileSystemAdapter,
+  options: SkillPathOperationOptions = {},
+): Promise<string[]> {
+  assertStrictSymlinkCapabilities(fsAdapter);
+  if (options.budget) {
+    return await options.budget.run(() => listStrictSkillSubdir(skillRoot, subdir, fsAdapter));
+  }
+  return await listSkillSubdirWithLimits(
+    skillRoot,
+    subdir,
+    fsAdapter,
+    SKILL_SUBDIR_MAX_ENTRIES,
+    true,
+  );
+}
+
+async function listSkillSubdirWithLimits(
+  skillRoot: string,
+  subdir: string,
+  fsAdapter: FileSystemAdapter | undefined,
+  maxDirectoryEntries: number,
+  sortDeterministically: boolean,
+): Promise<string[]> {
+  const boundedRoot = requireBoundedPath(
+    skillRoot,
+    "root",
+    SKILL_ROOT_PATH_MAX_LENGTH,
+    true,
+  );
+  assertSafePathSegment(subdir, "subdirectory");
+  const dirPath = join(boundedRoot, subdir);
 
   let dirExists: boolean;
   try {
@@ -215,14 +700,43 @@ export async function listSkillSubdir(
     return [];
   }
 
+  await assertSafeSkillDirectory(
+    boundedRoot,
+    dirPath,
+    subdir,
+    fsAdapter,
+    maxDirectoryEntries,
+  );
+
   const files: string[] = [];
   const entries = fsAdapter ? fsAdapter.readDir(dirPath) : readDir(dirPath);
+  let entryCount = 0;
 
-  for await (const entry of entries) {
+  for await (const rawEntry of entries) {
+    entryCount += 1;
+    if (entryCount > maxDirectoryEntries) {
+      throw new RangeError(
+        `Skill subdirectory may contain at most ${maxDirectoryEntries} entries`,
+      );
+    }
+    const entry = captureDirectoryEntry(rawEntry);
+    assertSafeDirectoryEntryName(entry.name);
+    if (entry.isSymlink) {
+      throw toError(
+        createError({
+          type: "agent",
+          message:
+            `Skill directory entry is a symlink and is not allowed: "${subdir}/${entry.name}"`,
+        }),
+      );
+    }
     if (entry.isFile) {
-      files.push(`${subdir}/${entry.name}`);
+      appendOwnArrayElement(files, `${subdir}/${entry.name}`);
     }
   }
 
-  return files;
+  if (!sortDeterministically) return files;
+  return apply(arraySort, files, [
+    (left: string, right: string) => left < right ? -1 : left > right ? 1 : 0,
+  ]) as string[];
 }
diff --git a/src/skill/string-safety.ts b/src/skill/string-safety.ts
new file mode 100644
index 0000000000..b14869c194
--- /dev/null
+++ b/src/skill/string-safety.ts
@@ -0,0 +1,61 @@
+const apply = Reflect.apply;
+const numberIsSafeInteger = Number.isSafeInteger;
+const stringCharCodeAt = String.prototype.charCodeAt;
+
+function charCodeAt(value: string, index: number): number {
+  return apply(stringCharCodeAt, value, [index]) as number;
+}
+
+/** Whether a string contains C0, DEL, or C1 control characters. */
+export function hasControlCharacters(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = charCodeAt(value, index);
+    if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) return true;
+  }
+  return false;
+}
+
+/** Whether every UTF-16 surrogate is part of a valid pair. */
+export function isWellFormedUtf16(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = charCodeAt(value, index);
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next = charCodeAt(value, index + 1);
+      if (index + 1 >= value.length || next < 0xdc00 || next > 0xdfff) {
+        return false;
+      }
+      index += 1;
+    } else if (code >= 0xdc00 && code <= 0xdfff) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/** Whether a well-formed string fits within a UTF-8 byte budget. */
+export function isUtf8WithinByteLimit(value: string, maxBytes: number): boolean {
+  if (!numberIsSafeInteger(maxBytes) || maxBytes < 0) return false;
+
+  let byteLength = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = charCodeAt(value, index);
+    if (code <= 0x7f) {
+      byteLength += 1;
+    } else if (code <= 0x7ff) {
+      byteLength += 2;
+    } else if (code >= 0xd800 && code <= 0xdbff) {
+      const next = charCodeAt(value, index + 1);
+      if (index + 1 >= value.length || next < 0xdc00 || next > 0xdfff) {
+        return false;
+      }
+      byteLength += 4;
+      index += 1;
+    } else if (code >= 0xdc00 && code <= 0xdfff) {
+      return false;
+    } else {
+      byteLength += 3;
+    }
+    if (byteLength > maxBytes) return false;
+  }
+  return true;
+}
diff --git a/src/skill/testing.ts b/src/skill/testing.ts
index afaaa55c13..5bd93600bd 100644
--- a/src/skill/testing.ts
+++ b/src/skill/testing.ts
@@ -16,6 +16,7 @@ import { FILE_NOT_FOUND } from "#veryfront/errors";
  */
 export function createSkillTestAdapter(files: Record<string, string>): FileSystemAdapter {
   const allPaths = Object.keys(files);
+  const encoder = new TextEncoder();
 
   function getEntries(
     path: string,
@@ -51,11 +52,19 @@ export function createSkillTestAdapter(files: Record<string, string>): FileSyste
   }
 
   return {
+    symlinkSemantics: "none",
     async readFile(path: string): Promise<string> {
       const content = files[path];
       if (content === undefined) throw FILE_NOT_FOUND.create({ detail: `File not found: ${path}` });
       return content;
     },
+    async readFileBytesWithinLimit(path: string, byteLimit: number): Promise<Uint8Array> {
+      const content = files[path];
+      if (content === undefined) throw FILE_NOT_FOUND.create({ detail: `File not found: ${path}` });
+      const bytes = encoder.encode(content);
+      if (bytes.byteLength > byteLimit) throw new RangeError("File exceeds byte limit");
+      return bytes;
+    },
     async exists(path: string): Promise<boolean> {
       if (path in files) return true;
       return allPaths.some((filePath) => filePath.startsWith(`${path}/`));
diff --git a/src/skill/tools.ts b/src/skill/tools.ts
index 5e9800c772..d62c44e71a 100644
--- a/src/skill/tools.ts
+++ b/src/skill/tools.ts
@@ -12,12 +12,31 @@
 import { defineSchema } from "#veryfront/schemas/index.ts";
 import { tool } from "#veryfront/tool/factory.ts";
 import type { Tool, ToolExecutionContext } from "#veryfront/tool";
-import { readTextFile } from "#veryfront/platform/compat/fs.ts";
-import { join } from "#veryfront/compat/path";
+import { createFileSystem } from "#veryfront/platform/compat/fs.ts";
+import {
+  captureByteReadCapabilities,
+  captureSnapshotReadCapability,
+} from "#veryfront/platform/adapters/file-system-capabilities.ts";
 import { createError, toError } from "#veryfront/errors";
 import { skillRegistry } from "./registry.ts";
 import { parseSkillFrontmatter } from "./parser.ts";
-import { listSkillSubdir, validateSkillPath } from "./path-safety.ts";
+import { listStrictSkillSubdir, validateStrictSkillPath } from "./path-safety.ts";
+import { createSkillOperationBudget, type SkillOperationBudget } from "./operation-budget.ts";
+import {
+  isValidSkillScriptEnvironmentKey,
+  SKILL_DOCUMENT_MAX_CHARACTERS,
+  SKILL_FILE_OPERATION_TIMEOUT_MS,
+  SKILL_SCRIPT_MAX_ARG_BYTES_TOTAL,
+  SKILL_SCRIPT_MAX_ARG_LENGTH,
+  SKILL_SCRIPT_MAX_ARGS,
+  SKILL_SCRIPT_MAX_ENV_BYTES_TOTAL,
+  SKILL_SCRIPT_MAX_ENV_ENTRIES,
+  SKILL_SCRIPT_MAX_ENV_KEY_LENGTH,
+  SKILL_SCRIPT_MAX_ENV_VALUE_LENGTH,
+  SKILL_SCRIPT_MAX_OUTPUT_BYTES,
+  SKILL_SCRIPT_MAX_TIMEOUT_MS,
+  SKILL_TEXT_FILE_MAX_BYTES,
+} from "./limits.ts";
 import { getSkillScriptExecutor } from "./executor.ts";
 import type { Skill, SkillContent, SkillScriptExecutor } from "./types.ts";
 import {
@@ -31,7 +50,9 @@ import {
 } from "./types.ts";
 
 /** Maximum allowed script execution timeout in milliseconds (5 minutes) */
-const MAX_SCRIPT_TIMEOUT_MS = 300_000;
+const MAX_SCRIPT_TIMEOUT_MS = SKILL_SCRIPT_MAX_TIMEOUT_MS;
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+const utf8Encoder = new TextEncoder();
 
 type SkillFileKind = "reference" | "script";
 type SkillSelectorToolOptions = {
@@ -75,11 +96,108 @@ const getExecuteSkillScriptInputSchema = defineSchema((v) =>
  * Read a file from a skill directory.
  * Uses skill.fsAdapter if available (VFS/cloud), otherwise falls back to compat readTextFile.
  */
-async function readSkillFile(skill: Skill, path: string): Promise<string> {
-  if (skill.fsAdapter) {
-    return await skill.fsAdapter.readFile(path);
+async function readSkillFile(
+  skill: Skill,
+  path: string,
+  byteLimit: number,
+  budget: SkillOperationBudget,
+): Promise<string> {
+  return await budget.run(async () => {
+    const fileSystem = skill.fsAdapter ?? createFileSystem();
+    const snapshot = captureSnapshotReadCapability(
+      fileSystem,
+      "Skill filesystem",
+      true,
+    );
+    const bytes = snapshot
+      ? await snapshot.read(path, skill.rootPath, byteLimit)
+      : await requireExactSkillReader(fileSystem)(path, byteLimit);
+    return utf8Decoder.decode(bytes);
+  });
+}
+
+function requireExactSkillReader(
+  fileSystem: object,
+): (path: string, byteLimit: number) => Promise<Uint8Array> {
+  const reader = captureByteReadCapabilities(fileSystem, "Skill filesystem").exact;
+  if (!reader) {
+    throw new TypeError(
+      "Skill filesystem must provide an exact bounded read capability",
+    );
+  }
+  return reader;
+}
+
+function createFileBudget(context: ToolExecutionContext | undefined, timeoutMs?: number) {
+  return createSkillOperationBudget({
+    abortSignal: context?.abortSignal,
+    timeoutMs: timeoutMs ?? SKILL_FILE_OPERATION_TIMEOUT_MS,
+  });
+}
+
+function assertDocumentCharacterLimit(content: string): void {
+  if (content.length > SKILL_DOCUMENT_MAX_CHARACTERS) {
+    throw new RangeError(
+      `Skill document may contain at most ${SKILL_DOCUMENT_MAX_CHARACTERS} characters`,
+    );
+  }
+}
+
+function assertScriptInputs(
+  args: readonly string[] | undefined,
+  env: Readonly<Record<string, string>> | undefined,
+): void {
+  if ((args?.length ?? 0) > SKILL_SCRIPT_MAX_ARGS) {
+    throw new RangeError(`Skill scripts accept at most ${SKILL_SCRIPT_MAX_ARGS} arguments`);
+  }
+  let argumentBytes = 0;
+  for (const argument of args ?? []) {
+    if (argument.length > SKILL_SCRIPT_MAX_ARG_LENGTH) {
+      throw new RangeError(
+        `Skill script arguments may contain at most ${SKILL_SCRIPT_MAX_ARG_LENGTH} characters`,
+      );
+    }
+    argumentBytes += utf8Encoder.encode(argument).byteLength;
+    if (argumentBytes > SKILL_SCRIPT_MAX_ARG_BYTES_TOTAL) {
+      throw new RangeError(
+        `Skill script arguments may contain at most ${SKILL_SCRIPT_MAX_ARG_BYTES_TOTAL} bytes`,
+      );
+    }
+  }
+
+  const entries = Object.entries(env ?? {});
+  if (entries.length > SKILL_SCRIPT_MAX_ENV_ENTRIES) {
+    throw new RangeError(
+      `Skill script environments may contain at most ${SKILL_SCRIPT_MAX_ENV_ENTRIES} entries`,
+    );
+  }
+  let environmentBytes = 0;
+  for (const [key, value] of entries) {
+    if (!isValidSkillScriptEnvironmentKey(key) || key.length > SKILL_SCRIPT_MAX_ENV_KEY_LENGTH) {
+      throw new TypeError(`Invalid skill script environment key: ${key}`);
+    }
+    if (value.length > SKILL_SCRIPT_MAX_ENV_VALUE_LENGTH) {
+      throw new RangeError(
+        `Skill script environment values may contain at most ${SKILL_SCRIPT_MAX_ENV_VALUE_LENGTH} characters`,
+      );
+    }
+    environmentBytes += utf8Encoder.encode(key).byteLength + utf8Encoder.encode(value).byteLength;
+    if (environmentBytes > SKILL_SCRIPT_MAX_ENV_BYTES_TOTAL) {
+      throw new RangeError(
+        `Skill script environments may contain at most ${SKILL_SCRIPT_MAX_ENV_BYTES_TOTAL} bytes`,
+      );
+    }
+  }
+}
+
+function assertScriptOutput(result: { stdout: string; stderr: string }): void {
+  const bytes = utf8Encoder.encode(result.stdout).byteLength +
+    utf8Encoder.encode(result.stderr).byteLength;
+  if (bytes > SKILL_SCRIPT_MAX_OUTPUT_BYTES) {
+    throw new RangeError(
+      `Skill script output may contain at most ${SKILL_SCRIPT_MAX_OUTPUT_BYTES} bytes`,
+    );
   }
-  return await readTextFile(path);
 }
 
 /**
@@ -239,38 +357,53 @@ export function createLoadSkillTool(options: SkillSelectorToolOptions = {}): Too
       "allowed tools policy, and lists of available reference files and scripts.",
     inputSchema: getLoadSkillInputSchema(),
     execute: async (input, context): Promise<SkillContent> => {
+      const budget = createFileBudget(context);
       const skill = resolveVisibleSkillOrThrow(input.skillId, context, options);
 
       // Read SKILL.md
-      const skillMdPath = join(skill.rootPath, SKILL_MD_FILENAME);
-      const content = await readSkillFile(skill, skillMdPath);
+      const validatedSkillMdPath = await validateStrictSkillPath(
+        skill.rootPath,
+        SKILL_MD_FILENAME,
+        [],
+        skill.fsAdapter,
+        { budget },
+      );
+      const content = await readSkillFile(
+        skill,
+        validatedSkillMdPath,
+        SKILL_TEXT_FILE_MAX_BYTES,
+        budget,
+      );
+      assertDocumentCharacterLimit(content);
 
       // Parse frontmatter to get instructions
       const parsed = await parseSkillFrontmatter(content);
 
       // List available files the agent can load through load_skill_reference.
-      const [references, resources, assets, scripts] = await Promise.all([
-        listSkillSubdir(
-          skill.rootPath,
-          SKILL_REFERENCES_DIR,
-          skill.fsAdapter,
-        ),
-        listSkillSubdir(
-          skill.rootPath,
-          SKILL_RESOURCES_DIR,
-          skill.fsAdapter,
-        ),
-        listSkillSubdir(
-          skill.rootPath,
-          SKILL_ASSETS_DIR,
-          skill.fsAdapter,
-        ),
-        listSkillSubdir(
-          skill.rootPath,
-          SKILL_SCRIPTS_DIR,
-          skill.fsAdapter,
-        ),
-      ]);
+      const references = await listStrictSkillSubdir(
+        skill.rootPath,
+        SKILL_REFERENCES_DIR,
+        skill.fsAdapter,
+        { budget },
+      );
+      const resources = await listStrictSkillSubdir(
+        skill.rootPath,
+        SKILL_RESOURCES_DIR,
+        skill.fsAdapter,
+        { budget },
+      );
+      const assets = await listStrictSkillSubdir(
+        skill.rootPath,
+        SKILL_ASSETS_DIR,
+        skill.fsAdapter,
+        { budget },
+      );
+      const scripts = await listStrictSkillSubdir(
+        skill.rootPath,
+        SKILL_SCRIPTS_DIR,
+        skill.fsAdapter,
+        { budget },
+      );
       const loadableReferences = [...references, ...resources, ...assets];
 
       return {
@@ -295,6 +428,7 @@ export function createLoadSkillReferenceTool(options: SkillSelectorToolOptions =
       "references/, resources/, and assets/ directories are accessible.",
     inputSchema: getLoadSkillReferenceInputSchema(),
     execute: async (input, context): Promise<{ content: string; path: string }> => {
+      const budget = createFileBudget(context);
       const skill = resolveVisibleSkillOrThrow(input.skillId, context, options);
       assertActiveSkillFileAvailable(
         {
@@ -308,14 +442,20 @@ export function createLoadSkillReferenceTool(options: SkillSelectorToolOptions =
       );
 
       // Validate path safety before reading skill-provided context.
-      const validatedPath = await validateSkillPath(
+      const validatedPath = await validateStrictSkillPath(
         skill.rootPath,
         input.reference,
         [SKILL_REFERENCES_DIR, SKILL_RESOURCES_DIR, SKILL_ASSETS_DIR],
         skill.fsAdapter,
+        { budget },
       );
 
-      const content = await readSkillFile(skill, validatedPath);
+      const content = await readSkillFile(
+        skill,
+        validatedPath,
+        SKILL_TEXT_FILE_MAX_BYTES,
+        budget,
+      );
       return { content, path: input.reference };
     },
   });
@@ -334,6 +474,8 @@ export function createExecuteSkillScriptTool(
       "Execute a script from a skill's scripts/ directory. Returns stdout, stderr, and exit code.",
     inputSchema: getExecuteSkillScriptInputSchema(),
     execute: async (input, context) => {
+      const budget = createFileBudget(context, input.timeoutMs);
+      assertScriptInputs(input.args, input.env);
       const skill = resolveVisibleSkillOrThrow(input.skillId, context, options);
       assertActiveSkillFileAvailable(
         {
@@ -347,23 +489,34 @@ export function createExecuteSkillScriptTool(
       );
 
       // Validate path safety (only scripts/ allowed)
-      const validatedPath = await validateSkillPath(
+      const validatedPath = await validateStrictSkillPath(
         skill.rootPath,
         input.script,
         [SKILL_SCRIPTS_DIR],
         skill.fsAdapter,
+        { budget },
       );
 
-      const scriptContent = await readSkillFile(skill, validatedPath);
+      const scriptContent = await readSkillFile(
+        skill,
+        validatedPath,
+        SKILL_TEXT_FILE_MAX_BYTES,
+        budget,
+      );
       const executor = options.executor ?? getSkillScriptExecutor();
-      return await executor.execute({
-        scriptPath: validatedPath,
-        scriptContent,
-        args: input.args,
-        env: input.env,
-        cwd: skill.rootPath,
-        timeoutMs: input.timeoutMs,
-      });
+      const result = await budget.run(async (abortSignal) =>
+        await executor.execute({
+          scriptPath: validatedPath,
+          scriptContent,
+          args: input.args,
+          env: input.env,
+          cwd: skill.rootPath,
+          timeoutMs: budget.remainingMs(),
+          abortSignal,
+        })
+      );
+      assertScriptOutput(result);
+      return result;
     },
   });
 }
diff --git a/src/skill/types.ts b/src/skill/types.ts
index 498abb75b0..154031c6d2 100644
--- a/src/skill/types.ts
+++ b/src/skill/types.ts
@@ -109,6 +109,8 @@ export interface SkillScriptExecutorInput {
   env?: Record<string, string>;
   cwd?: string;
   timeoutMs?: number;
+  /** Cancellation shared with the outer skill operation budget. */
+  abortSignal?: AbortSignal;
 }
 
 /** Script executor interface */
diff --git a/tests/integration/compiled-binary-e2e.test.ts b/tests/integration/compiled-binary-e2e.test.ts
index f9c1f360c5..49cc083f8c 100644
--- a/tests/integration/compiled-binary-e2e.test.ts
+++ b/tests/integration/compiled-binary-e2e.test.ts
@@ -63,6 +63,44 @@ const COMPILED_BINARY_E2E_OPTIONS = {
 // rejected by the proxy guard before this deterministic loopback URL is used.
 const UNREACHABLE_LOCAL_PROXY_API_BASE_URL = "http://127.0.0.1:1";
 
+const BROWSER_ESM_CSP = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'", "'nonce-{NONCE}'", "https://esm.sh"],
+  "style-src": ["'self'", "'unsafe-inline'"],
+  "style-src-elem": ["'self'", "'unsafe-inline'"],
+  "style-src-attr": ["'unsafe-inline'"],
+  "img-src": ["'self'", "data:"],
+  "font-src": ["'self'", "data:"],
+  "connect-src": ["'self'"],
+  "media-src": ["'self'", "blob:"],
+  "worker-src": ["'self'", "blob:"],
+  "object-src": ["'none'"],
+  "frame-src": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"],
+  "form-action": ["'self'"],
+} as const;
+
+async function configureBrowserEsmProject(
+  projectDir: string,
+  additionalConfig: Record<string, unknown> = {},
+): Promise<void> {
+  await Deno.writeTextFile(
+    join(projectDir, "veryfront.config.ts"),
+    `export default ${
+      JSON.stringify(
+        {
+          fs: { type: "local" },
+          ...additionalConfig,
+          security: { csp: BROWSER_ESM_CSP },
+        },
+        null,
+        2,
+      )
+    };`,
+  );
+}
+
 describe("Compiled Binary E2E", COMPILED_BINARY_E2E_OPTIONS, () => {
   beforeAll(async () => {
     await ensureBinaryCompiled();
@@ -1714,13 +1752,9 @@ export default function ClientPage() {
       ),
     );
 
-    await Deno.writeTextFile(
-      join(projectDir, "veryfront.config.ts"),
-      `export default {
-  fs: { type: "local" },
-  experimental: { rsc: true }
-};`,
-    );
+    await configureBrowserEsmProject(projectDir, {
+      experimental: { rsc: true },
+    });
 
     await Deno.mkdir(join(projectDir, "app"), { recursive: true });
     await Deno.writeTextFile(
@@ -1888,7 +1922,7 @@ export default function HomePage() {
     });
   });
 
-  it("should hydrate pages-router client pages under strict CSP in the compiled binary", async () => {
+  it("should hydrate pages-router client pages under an explicit dependency CSP", async () => {
     const projectDir = await createTestProject(
       "pages-browser-csp-hydration",
       `
@@ -1923,6 +1957,7 @@ export default function HomePage() {
 }
 `,
     );
+    await configureBrowserEsmProject(projectDir);
 
     await withServer(projectDir, async (server) => {
       await withBrowserPageAgainstServer(server, async ({ page, response, diagnostics }) => {
@@ -1981,7 +2016,7 @@ export default function HomePage() {
     });
   });
 
-  it("should allow hydrated client inline styles under the default CSP in the compiled binary", async () => {
+  it("should allow hydrated client inline styles under an explicit dependency CSP", async () => {
     const projectDir = await createTestProject(
       "pages-browser-csp-inline-style",
       `
@@ -2008,6 +2043,7 @@ export default function HomePage() {
 }
 `,
     );
+    await configureBrowserEsmProject(projectDir);
 
     await withServer(projectDir, async (server) => {
       await withBrowserPageAgainstServer(server, async ({ page, response, diagnostics }) => {
diff --git a/tests/integration/server/dev-server.test.ts b/tests/integration/server/dev-server.test.ts
index 1849ace5ec..df75645add 100644
--- a/tests/integration/server/dev-server.test.ts
+++ b/tests/integration/server/dev-server.test.ts
@@ -318,7 +318,11 @@ describe("Dev Server Integration", { sanitizeOps: false, sanitizeResources: fals
         assertEquals(pre.status, 204);
         const allow = pre.headers.get("allow") ?? pre.headers.get("Allow");
         assert(allow?.includes("POST"));
-        assert((pre.headers.get("access-control-allow-methods") ?? "").includes("POST"));
+        assertEquals(
+          pre.headers.get("access-control-allow-methods"),
+          null,
+          "Plain OPTIONS must not advertise CORS policy without an Origin",
+        );
         await pre.body?.cancel();
 
         controller.abort();