fix(security): harden trust boundaries

deno.json

@@ -122,6 +122,7 @@
     "./mcp": "./src/mcp/index.ts",
     "./middleware": "./src/middleware/index.ts",
     "./errors": "./src/errors/index.ts",
+    "./security": "./src/security/index.ts",
     "./observability": "./src/observability/index.ts",
     "./observability/sentry": "./src/observability/sentry.ts",
     "./observability/otlp-setup": "./src/observability/tracing/otlp-setup.ts",

docs/api-reference/index.md

@@ -38,8 +38,9 @@ order: 1
 | [`veryfront/router`](./veryfront/router.md) | Client navigation and route context. |
 | [`veryfront/runs`](./veryfront/runs.md) | Canonical durable task and workflow runs. |
 | [`veryfront/sandbox`](./veryfront/sandbox.md) | Isolated execution. |
-| [`veryfront/schedule`](./veryfront/schedule.md) | Source-defined schedules for Veryfront projects. |
+| [`veryfront/schedule`](./veryfront/schedule.md) | Source-defined recurring schedules for Veryfront projects. |
 | [`veryfront/schemas`](./veryfront/schemas.md) | Validation schemas. |
+| [`veryfront/security`](./veryfront/security.md) | Security layer - input validation with size limits, CORS configuration, CSP and security headers, path traversal prevention, and secure filesystem access. |
 | [`veryfront/server`](./veryfront/server.md) | Server runtime helpers. |
 | [`veryfront/skill`](./veryfront/skill.md) | Agent skills. Public API for the agent skills system. Skills are project-level capabilities defined as SKILL.md files following the agentskills.io specification. |
 | [`veryfront/task`](./veryfront/task.md) | Source-defined tasks for Veryfront projects. |

docs/api-reference/veryfront/context.md

@@ -22,18 +22,18 @@ import { PageContextProvider, usePageContext } from "veryfront/context";
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `PageContextProvider` | Provides page context to route and MDX descendants. Page-authored fields (`frontmatter`, `slug`, `headings`) come from the `pageContext` prop; the location fields (`path`, `query`, `params`) are derived from the router so they stay reactive and there is a single source of truth - `usePageContext()` exposes the same `query`/`pathname` as `useRouter()`. When rendered outside a `RouterProvider` (no live router) it falls back to the seed's own location. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L420) |
+| `PageContextProvider` | Provides page context to route and MDX descendants. Page-authored fields (`frontmatter`, `slug`, `headings`) come from the `pageContext` prop; the location fields (`path`, `query`, `params`) are derived from the router so they stay reactive and there is a single source of truth - `usePageContext()` exposes the same `query`/`pathname` as `useRouter()`. When rendered outside a `RouterProvider` (no live router) it falls back to the seed's own location. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L408) |
 
 ### Functions
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `usePageContext` | Reads the current page context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L444) |
+| `usePageContext` | Reads the current page context. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L432) |
 
 ### Types
 
 | Name | Description | Source |
 |------|-------------|--------|
-| `MdxHeading` | Heading metadata extracted from MDX content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L52) |
-| `PageContextProviderProps` | Props accepted by `<PageContextProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L99) |
-| `PageContextValue` | Page context exposed to route and MDX components. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L62) |
+| `MdxHeading` | Heading metadata extracted from MDX content. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L60) |
+| `PageContextProviderProps` | Props accepted by `<PageContextProvider>`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L107) |
+| `PageContextValue` | Page context exposed to route and MDX components. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/react/runtime/core.ts#L70) |

docs/api-reference/veryfront/embedding.md

@@ -36,7 +36,7 @@ export const { POST, GET, DELETE } = createUploadHandler(store, {
 |------|-------------|--------|
 | `chunk` | Splits text into overlapping chunks for embedding. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/chunk.ts#L24) |
 | `clearEmbeddingProviders` | Clear all registered embedding providers (for testing). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/resolve.ts#L154) |
-| `createUploadHandler` | Creates HTTP route handlers for upload, listing, and deletion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-handler.ts#L256) |
+| `createUploadHandler` | Creates HTTP route handlers for upload, listing, and deletion. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-handler.ts#L248) |
 | `embedding` | Creates an embedding facade. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/embedding.ts#L28) |
 | `loadUpload` | Extracts embedding-ready text or Markdown from upload formats. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/upload-loader.ts#L19) |
 | `ragStore` | Creates a persistent RAG store with lazy embedding and similarity search. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/embedding/rag-store.ts#L174) |