nvent 1.0.0-alpha.2 → 1.0.0-alpha.4

package/dist/module.d.mts

@@ -38,9 +38,13 @@ interface NventIiiOptions {
                 type: 'kv';
                 storeMethod?: 'file_based' | 'in_memory';
                 filePath?: string;
+                saveIntervalMs?: number;
             } | {
                 type: 'redis';
                 redisUrl?: string;
+            } | {
+                type: 'bridge';
+                bridgeUrl: string;
             };
         };
         /**
@@ -52,12 +56,26 @@ interface NventIiiOptions {
                 type: 'builtin';
                 storeMethod?: 'file_based' | 'in_memory';
                 filePath?: string;
+                saveIntervalMs?: number;
+                maxAttempts?: number;
+                backoffMs?: number;
+                concurrency?: number;
+                pollIntervalMs?: number;
+                /** Processing order. 'concurrent' (parallel) or 'fifo' (sequential). Default: 'concurrent' */
+                mode?: 'concurrent' | 'fifo';
             } | {
                 type: 'redis';
                 redisUrl?: string;
             } | {
                 type: 'rabbitmq';
                 amqpUrl?: string;
+                maxAttempts?: number;
+                prefetchCount?: number;
+                /** 'standard' or 'quorum' (HA replicated). Default: 'standard' */
+                queueMode?: 'standard' | 'quorum';
+            } | {
+                type: 'bridge';
+                bridgeUrl: string;
             };
             queueConfigs?: Record<string, {
                 type?: 'standard' | 'fifo';
@@ -72,6 +90,11 @@ interface NventIiiOptions {
         cron?: {
             adapter?: {
                 type: 'kv';
+                lockTtlMs?: number;
+                lockIndex?: string;
+                storeMethod?: 'file_based' | 'in_memory';
+                filePath?: string;
+                saveIntervalMs?: number;
             } | {
                 type: 'redis';
                 redisUrl?: string;
@@ -85,9 +108,13 @@ interface NventIiiOptions {
                 type: 'kv';
                 storeMethod?: 'file_based' | 'in_memory';
                 filePath?: string;
+                saveIntervalMs?: number;
             } | {
                 type: 'redis';
                 redisUrl?: string;
+            } | {
+                type: 'bridge';
+                bridgeUrl: string;
             };
         };
         /** REST API module extra settings */
@@ -95,6 +122,13 @@ interface NventIiiOptions {
             host?: string;
             defaultTimeout?: number;
             concurrencyRequestLimit?: number;
+            /** CORS configuration for browser clients */
+            cors?: {
+                /** Origins allowed to make requests. Use '*' for any, or list specific domains. */
+                allowedOrigins?: string[];
+                /** HTTP methods permitted for cross-origin requests. */
+                allowedMethods?: string[];
+            };
         };
         /** OtelModule (observability) configuration */
         observability?: {
@@ -124,6 +158,36 @@ interface NventIiiOptions {
             logsFlushIntervalMs?: number;
             logsSamplingRatio?: number;
             logsConsoleOutput?: boolean;
+            /** Advanced sampling rules — override samplingRatio for matched operations. */
+            sampling?: {
+                default?: number;
+                parentBased?: boolean;
+                rules?: Array<{
+                    operation?: string;
+                    service?: string;
+                    rate: number;
+                }>;
+                rateLimit?: {
+                    maxTracesPerSecond?: number;
+                };
+            };
+            /** Alert rules — trigger a webhook or function when a metric crosses a threshold. */
+            alerts?: Array<{
+                name: string;
+                metric: string;
+                threshold: number;
+                operator: '>' | '>=' | '<' | '<=' | '==' | '!=';
+                windowSeconds: number;
+                enabled?: boolean;
+                cooldownSeconds?: number;
+                action: {
+                    type: 'webhook';
+                    url: string;
+                } | {
+                    type: 'function';
+                    path: string;
+                };
+            }>;
             level?: 'trace' | 'debug' | 'info' | 'warn' | 'error';
             format?: 'default' | 'json';
         };
@@ -147,10 +211,104 @@ interface NventIiiOptions {
             /** Enable the Flow visualization page */
             flow?: boolean;
         };
+        /** PubSub worker — topic-based event fanout across functions. */
+        pubsub?: {
+            adapter?: {
+                type: 'local';
+            } | {
+                type: 'redis';
+                redisUrl?: string;
+            };
+        };
+        /**
+         * HTTP Functions worker — enables outbound HTTP calls from the engine.
+         * Required for functions registered with HttpInvocationConfig.
+         */
+        httpFunctions?: {
+            security?: {
+                /** URL patterns allowed for outbound requests. Use '*' to allow all. */
+                urlAllowlist?: string[];
+                /** Block requests to private/internal IP ranges (SSRF prevention). Default: true */
+                blockPrivateIps?: boolean;
+                /** Require HTTPS for all outbound requests. Default: true */
+                requireHttps?: boolean;
+            };
+        };
+        /**
+         * Additional iii-worker-manager instance with RBAC.
+         * nvent uses this automatically when browser SDK is enabled.
+         * Can also be configured manually for custom auth scenarios.
+         */
+        workerManager?: {
+            rbac?: {
+                /** Port for the RBAC worker manager. Default: 49135 */
+                port?: number;
+                /** Function ID called on every WebSocket upgrade for auth. */
+                authFunctionId?: string;
+                /** Functions the connecting worker is allowed to invoke (patterns supported). */
+                exposeFunctions?: string[];
+                /** Function invoked before each handler — enrich or audit requests. */
+                middlewareFunctionId?: string;
+                /** Allow workers to register their own function handlers. Default: true */
+                allowFunctionRegistration?: boolean;
+                /** Allow workers to register new trigger types. Default: false */
+                allowTriggerTypeRegistration?: boolean;
+                /** Prefix prepended to every function the worker registers. */
+                functionRegistrationPrefix?: string;
+                /** TTL for signed browser auth tokens generated by the Nuxt proxy. Default: 120 */
+                tokenTtlSeconds?: number;
+                /** Allow browser connections without a custom resolver returning user context. Default: true */
+                allowAnonymous?: boolean;
+                /** Optional path (relative to project root) to a custom browser auth resolver module. */
+                authResolverPath?: string;
+            };
+        };
+        /**
+         * Bridge client workers — connects this engine to remote iii instances.
+         * Each entry creates an `iii-bridge` worker in the config.
+         */
+        bridge?: Array<{
+            url: string;
+            serviceId: string;
+            serviceName?: string;
+            expose?: Array<{
+                localFunction: string;
+                remoteFunction?: string;
+            }>;
+            forward?: Array<{
+                localFunction: string;
+                remoteFunction: string;
+                timeoutMs?: number;
+            }>;
+        }>;
+        /**
+         * Exec workers — spawns external processes alongside the engine.
+         * Each entry creates an `iii-exec` worker in the config.
+         */
+        exec?: Array<{
+            watch?: string[];
+            exec: string[];
+        }>;
+        /** Anonymous usage telemetry. Set enabled: false to opt out. */
+        telemetry?: {
+            enabled?: boolean;
+            apiKey?: string;
+            sdkApiKey?: string;
+            heartbeatIntervalSecs?: number;
+        };
     };
     functions?: {
         /** Directory under server/ where functions are, relative to serverDir (default: 'functions') */
         dir?: string;
+        /**
+         * Function ID prefix for this layer's functions.
+         * Set in a layer's `nuxt.config.ts` to namespace its functions.
+         * Priority: this value → `$meta.name` → package.json name → directory name.
+         * Set to `''` (empty string) to explicitly opt out of any prefix.
+         * Has no effect in the root project (always un-prefixed).
+         * Example: 'myorg::auth'
+         */
+        prefix?: string;
         python?: {
             /**
              * Path to the Python executable used **in development only** (e.g. a virtualenv).

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "nvent",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.4",
   "configKey": "nvent",
   "builder": {
     "@nuxt/module-builder": "1.0.2",

package/dist/module.mjs

@@ -1,6 +1,7 @@
-import { join, dirname, relative, basename } from 'node:path';
-import { defineNuxtModule, createResolver, hasNuxtModule, addTemplate, addServerPlugin, addServerHandler, addServerImports, addImports, updateTemplates } from '@nuxt/kit';
+import { join, dirname, basename, relative, parse } from 'node:path';
+import { defineNuxtModule, createResolver, extendViteConfig, hasNuxtModule, addTemplate, addServerPlugin, addServerHandler, addServerImports, addImports, addPlugin, updateTemplates } from '@nuxt/kit';
 import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, readFileSync, copyFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { exec, execFileSync, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { pipeline } from 'node:stream/promises';
@@ -844,34 +845,36 @@ function defaultIiiEngineConfig() {
 }
 function defaultStateAdapter(stateDir) {
   return {
-    class: "modules::state::adapters::KvStore",
+    name: "kv",
     config: { store_method: "file_based", file_path: "./data/state_store" }
   };
 }
 function defaultQueueAdapter(queueDir) {
   return {
-    class: "modules::queue::BuiltinQueueAdapter",
+    name: "builtin",
     config: { store_method: "file_based", file_path: "./data/queue_store" }
   };
 }
 function defaultCronAdapter() {
-  return { class: "modules::cron::KvCronAdapter" };
+  return { name: "kv" };
 }
 function defaultStreamAdapter() {
-  return { class: "modules::stream::adapters::KvStore" };
+  return { name: "kv" };
 }
 function generateIiiConfigYaml(cfg) {
-  const modules = [];
+  const workers = [];
+  workers.push({ name: "iii-worker-manager", config: { port: cfg.wsPort } });
   const restApiConfig = {
     port: cfg.restApi?.port ?? cfg.httpPort
   };
   if (cfg.restApi?.host) restApiConfig.host = cfg.restApi.host;
   if (cfg.restApi?.default_timeout != null) restApiConfig.default_timeout = cfg.restApi.default_timeout;
   if (cfg.restApi?.concurrency_request_limit != null) restApiConfig.concurrency_request_limit = cfg.restApi.concurrency_request_limit;
-  modules.push({ class: "modules::api::RestApiModule", config: restApiConfig });
+  if (cfg.restApi?.cors) restApiConfig.cors = cfg.restApi.cors;
+  workers.push({ name: "iii-http", config: restApiConfig });
   if (cfg.modules.state !== false) {
     const adapter = cfg.state?.adapter ?? defaultStateAdapter();
-    modules.push({ class: "modules::state::StateModule", config: { adapter } });
+    workers.push({ name: "iii-state", config: { adapter } });
   }
   if (cfg.modules.queue !== false) {
     const adapter = cfg.queue?.adapter ?? defaultQueueAdapter();
@@ -880,11 +883,11 @@ function generateIiiConfigYaml(cfg) {
     if (queueConfigs && Object.keys(queueConfigs).length > 0) {
       queueModCfg.queue_configs = queueConfigs;
     }
-    modules.push({ class: "modules::queue::QueueModule", config: queueModCfg });
+    workers.push({ name: "iii-queue", config: queueModCfg });
   }
   if (cfg.modules.cron !== false) {
     const adapter = cfg.cron?.adapter ?? defaultCronAdapter();
-    modules.push({ class: "modules::cron::CronModule", config: { adapter } });
+    workers.push({ name: "iii-cron", config: { adapter } });
   }
   if (cfg.modules.stream !== false) {
     const streamCfg = {
@@ -894,7 +897,7 @@ function generateIiiConfigYaml(cfg) {
     if (cfg.stream?.auth_function !== void 0) streamCfg.auth_function = cfg.stream.auth_function;
     const streamAdapter = cfg.stream?.adapter ?? defaultStreamAdapter();
     streamCfg.adapter = streamAdapter;
-    modules.push({ class: "modules::stream::StreamModule", config: streamCfg });
+    workers.push({ name: "iii-stream", config: streamCfg });
   }
   if (cfg.modules.observability !== false) {
     const oCfg = cfg.observability ?? {};
@@ -922,10 +925,34 @@ function generateIiiConfigYaml(cfg) {
     if (oCfg.logs_console_output != null) otelConfig.logs_console_output = oCfg.logs_console_output;
     if (oCfg.level) otelConfig.level = oCfg.level;
     if (oCfg.format) otelConfig.format = oCfg.format;
-    modules.push({ class: "modules::observability::OtelModule", config: otelConfig });
+    if (oCfg.sampling) otelConfig.sampling = oCfg.sampling;
+    if (oCfg.alerts?.length) otelConfig.alerts = oCfg.alerts;
+    workers.push({ name: "iii-observability", config: otelConfig });
+  }
+  if (cfg.modules.pubsub) {
+    const pubsubCfg = {};
+    if (cfg.pubsub?.adapter) pubsubCfg.adapter = cfg.pubsub.adapter;
+    workers.push({ name: "iii-pubsub", config: Object.keys(pubsubCfg).length ? pubsubCfg : void 0 });
+  }
+  if (cfg.modules.httpFunctions) {
+    const hfCfg = {};
+    if (cfg.httpFunctions?.security) hfCfg.security = cfg.httpFunctions.security;
+    workers.push({ name: "iii-http-functions", config: Object.keys(hfCfg).length ? hfCfg : void 0 });
+  }
+  for (const bridgeCfg of cfg.bridge ?? []) {
+    workers.push({ name: "iii-bridge", config: bridgeCfg });
+  }
+  for (const execCfg of cfg.exec ?? []) {
+    workers.push({ name: "iii-exec", config: execCfg });
+  }
+  if (cfg.workerManagerRbac) {
+    workers.push({ name: "iii-worker-manager", config: cfg.workerManagerRbac });
+  }
+  if (cfg.telemetry) {
+    workers.push({ name: "iii-telemetry", config: cfg.telemetry });
   }
   return `# Auto-generated by nvent \u2014 do not edit manually
-` + stringifyYAML({ port: cfg.wsPort, modules });
+` + stringifyYAML({ workers });
 }
 function writeIiiConfig(outputPath, cfg) {
   mkdirSync(dirname(outputPath), { recursive: true });
@@ -939,7 +966,7 @@ function buildEngineConfig(iiiOpts) {
     wsPort: iiiOpts.wsPort ?? 49134,
     httpPort: iiiOpts.httpPort ?? 3111,
     streamPort: iiiOpts.streamPort ?? 3112,
-    modules: { state: true, queue: true, cron: true, observability: true, stream: true, ...iiiOpts.modules },
+    modules: { state: true, queue: true, cron: true, observability: true, stream: true, pubsub: false, httpFunctions: false, exec: false, telemetry: false, ...iiiOpts.modules },
     state: iiiOpts.state ? { adapter: mapStateAdapter(iiiOpts.state) } : void 0,
     queue: iiiOpts.queue ? {
       adapter: mapQueueAdapter(iiiOpts.queue?.adapter),
@@ -959,7 +986,44 @@ function buildEngineConfig(iiiOpts) {
     restApi: iiiOpts.restApi ? {
       host: iiiOpts.restApi.host,
       default_timeout: iiiOpts.restApi.defaultTimeout,
-      concurrency_request_limit: iiiOpts.restApi.concurrencyRequestLimit
+      concurrency_request_limit: iiiOpts.restApi.concurrencyRequestLimit,
+      cors: iiiOpts.restApi.cors ? {
+        allowed_origins: iiiOpts.restApi.cors.allowedOrigins,
+        allowed_methods: iiiOpts.restApi.cors.allowedMethods
+      } : void 0
+    } : void 0,
+    pubsub: iiiOpts.pubsub ? { adapter: mapPubSubAdapter(iiiOpts.pubsub) } : void 0,
+    httpFunctions: iiiOpts.httpFunctions ? {
+      security: iiiOpts.httpFunctions.security ? {
+        url_allowlist: iiiOpts.httpFunctions.security.urlAllowlist,
+        block_private_ips: iiiOpts.httpFunctions.security.blockPrivateIps,
+        require_https: iiiOpts.httpFunctions.security.requireHttps
+      } : void 0
+    } : void 0,
+    workerManagerRbac: iiiOpts.workerManager?.rbac ? {
+      port: iiiOpts.workerManager.rbac.port ?? 49135,
+      rbac: {
+        auth_function_id: iiiOpts.workerManager.rbac.authFunctionId ?? "nvent::browser::auth",
+        expose_functions: iiiOpts.workerManager.rbac.exposeFunctions,
+        middleware_function_id: iiiOpts.workerManager.rbac.middlewareFunctionId,
+        allow_function_registration: iiiOpts.workerManager.rbac.allowFunctionRegistration,
+        allow_trigger_type_registration: iiiOpts.workerManager.rbac.allowTriggerTypeRegistration,
+        function_registration_prefix: iiiOpts.workerManager.rbac.functionRegistrationPrefix
+      }
+    } : void 0,
+    bridge: iiiOpts.bridge?.map((b) => ({
+      url: b.url,
+      service_id: b.serviceId,
+      service_name: b.serviceName,
+      expose: b.expose?.map((e) => ({ local_function: e.localFunction, remote_function: e.remoteFunction })),
+      forward: b.forward?.map((f) => ({ local_function: f.localFunction, remote_function: f.remoteFunction, timeout_ms: f.timeoutMs }))
+    })),
+    exec: iiiOpts.exec?.map((e) => ({ watch: e.watch, exec: e.exec })),
+    telemetry: iiiOpts.telemetry ? {
+      enabled: iiiOpts.telemetry.enabled,
+      api_key: iiiOpts.telemetry.apiKey,
+      sdk_api_key: iiiOpts.telemetry.sdkApiKey,
+      heartbeat_interval_secs: iiiOpts.telemetry.heartbeatIntervalSecs
     } : void 0,
     observability: iiiOpts.observability ? {
       enabled: iiiOpts.observability.enabled,
@@ -982,6 +1046,24 @@ function buildEngineConfig(iiiOpts) {
       logs_flush_interval_ms: iiiOpts.observability.logsFlushIntervalMs,
       logs_sampling_ratio: iiiOpts.observability.logsSamplingRatio,
       logs_console_output: iiiOpts.observability.logsConsoleOutput,
+      sampling: iiiOpts.observability.sampling ? {
+        default: iiiOpts.observability.sampling.default,
+        parent_based: iiiOpts.observability.sampling.parentBased,
+        rules: iiiOpts.observability.sampling.rules,
+        rate_limit: iiiOpts.observability.sampling.rateLimit ? {
+          max_traces_per_second: iiiOpts.observability.sampling.rateLimit.maxTracesPerSecond
+        } : void 0
+      } : void 0,
+      alerts: iiiOpts.observability.alerts?.map((a) => ({
+        name: a.name,
+        metric: a.metric,
+        threshold: a.threshold,
+        operator: a.operator,
+        window_seconds: a.windowSeconds,
+        enabled: a.enabled,
+        cooldown_seconds: a.cooldownSeconds,
+        action: a.action
+      })),
       level: iiiOpts.observability.level,
       format: iiiOpts.observability.format
     } : void 0
@@ -989,39 +1071,60 @@ function buildEngineConfig(iiiOpts) {
 }
 function mapStateAdapter(a) {
   if (!a?.adapter) return void 0;
-  if (a.adapter.type === "redis")
-    return { class: "modules::state::adapters::RedisAdapter", config: { redis_url: a.adapter.redisUrl } };
+  if (a.adapter.type === "redis") return { name: "redis", config: { redis_url: a.adapter.redisUrl } };
+  if (a.adapter.type === "bridge") return { name: "bridge", config: { bridge_url: a.adapter.bridgeUrl } };
   return {
-    class: "modules::state::adapters::KvStore",
-    config: { store_method: a.adapter.storeMethod, file_path: a.adapter.filePath }
+    name: "kv",
+    config: { store_method: a.adapter.storeMethod, file_path: a.adapter.filePath, save_interval_ms: a.adapter.saveIntervalMs }
   };
 }
 function mapQueueAdapter(a) {
   if (!a) return void 0;
-  if (a.type === "redis")
-    return { class: "modules::queue::RedisAdapter", config: { redis_url: a.redisUrl } };
-  if (a.type === "rabbitmq")
-    return { class: "modules::queue::RabbitMQAdapter", config: { amqp_url: a.amqpUrl } };
+  if (a.type === "redis") return { name: "redis", config: { redis_url: a.redisUrl } };
+  if (a.type === "rabbitmq") return { name: "rabbitmq", config: { amqp_url: a.amqpUrl, max_attempts: a.maxAttempts, prefetch_count: a.prefetchCount, queue_mode: a.queueMode } };
+  if (a.type === "bridge") return { name: "bridge", config: { bridge_url: a.bridgeUrl } };
   return {
-    class: "modules::queue::BuiltinQueueAdapter",
-    config: { store_method: a.storeMethod, file_path: a.filePath }
+    name: "builtin",
+    config: {
+      store_method: a.storeMethod,
+      file_path: a.filePath,
+      save_interval_ms: a.saveIntervalMs,
+      max_attempts: a.maxAttempts,
+      backoff_ms: a.backoffMs,
+      concurrency: a.concurrency,
+      poll_interval_ms: a.pollIntervalMs,
+      mode: a.mode
+    }
   };
 }
 function mapCronAdapter(a) {
   if (!a?.adapter) return void 0;
-  if (a.adapter.type === "redis")
-    return { class: "modules::cron::RedisCronAdapter", config: { redis_url: a.adapter.redisUrl } };
-  return { class: "modules::cron::KvCronAdapter" };
+  if (a.adapter.type === "redis") return { name: "redis", config: { redis_url: a.adapter.redisUrl } };
+  return {
+    name: "kv",
+    config: {
+      lock_ttl_ms: a.adapter.lockTtlMs,
+      lock_index: a.adapter.lockIndex,
+      store_method: a.adapter.storeMethod,
+      file_path: a.adapter.filePath,
+      save_interval_ms: a.adapter.saveIntervalMs
+    }
+  };
 }
 function mapStreamAdapter(a) {
   if (!a?.adapter) return void 0;
-  if (a.adapter.type === "redis")
-    return { class: "modules::stream::adapters::RedisAdapter", config: { redis_url: a.adapter.redisUrl } };
+  if (a.adapter.type === "redis") return { name: "redis", config: { redis_url: a.adapter.redisUrl } };
+  if (a.adapter.type === "bridge") return { name: "bridge", config: { bridge_url: a.adapter.bridgeUrl } };
   return {
-    class: "modules::stream::adapters::KvStore",
-    config: { store_method: a.adapter.storeMethod, file_path: a.adapter.filePath }
+    name: "kv",
+    config: { store_method: a.adapter.storeMethod, file_path: a.adapter.filePath, save_interval_ms: a.adapter.saveIntervalMs }
   };
 }
+function mapPubSubAdapter(a) {
+  if (!a?.adapter) return void 0;
+  if (a.adapter.type === "redis") return { name: "redis", config: { redis_url: a.adapter.redisUrl } };
+  return { name: "local" };
+}
 
 function filePathToFunctionId(relPath) {
   const noExt = relPath.replace(/\.[a-zA-Z]+$/, "");
@@ -1042,6 +1145,7 @@ async function scanFunctions(opts) {
   for (const layer of layerInfos) {
     const serverDir = layer.serverDir || join(layer.rootDir, "server");
     const fnDir = join(serverDir, functionsDir);
+    const prefix = layer.prefix ? `${layer.prefix}::` : "";
     if (!existsSync(fnDir)) continue;
     const [jsFiles, pyFiles] = await Promise.all([
       globby(["**/*.{ts,js,mts,mjs}"], {
@@ -1056,34 +1160,27 @@ async function scanFunctions(opts) {
       })
     ]);
     for (const file of jsFiles) {
-      functions.push({ id: filePathToFunctionId(file), absPath: join(fnDir, file), relativePath: file });
+      functions.push({ id: `${prefix}${filePathToFunctionId(file)}`, absPath: join(fnDir, file), relativePath: file });
     }
     for (const file of pyFiles) {
       const absPath = join(fnDir, file);
       const standalone = detectPythonStandalone(absPath);
-      pythonFunctions.push({ id: filePathToFunctionId(file), absPath, relativePath: file, standalone });
+      pythonFunctions.push({ id: `${prefix}${filePathToFunctionId(file)}`, absPath, relativePath: file, standalone });
     }
   }
   return { functions, pythonFunctions };
 }
 function generateIiiRegistryTemplate(scanned, pythonPathRewrite) {
   const lines = ["// auto-generated by nvent \u2014 do not edit", ""];
-  lines.push(`function _stepEntry(ns, fallbackName, absPath) {`);
-  lines.push(`  const def = ns.default`);
-  lines.push(`  const meta = ns.meta`);
-  lines.push(`  const triggers = ns.triggers`);
-  lines.push(`  if (def?.__nventStep) {`);
-  lines.push(`    const name = def.name ?? fallbackName`);
-  lines.push(`    return { name, description: def.description, handler: def.handler, triggers: (def.triggers ?? []).map(t => ({ ...t, function_id: name })), enqueues: def.enqueues ?? [], flows: def.flows ?? [], stream: def.stream, filePath: absPath }`);
-  lines.push(`  }`);
-  lines.push(`  const name = meta?.name ?? fallbackName`);
-  lines.push(`  return { name, description: meta?.description, handler: def, triggers: (triggers ?? []).map(t => ({ ...t, function_id: name })), enqueues: [], flows: [], stream: undefined, filePath: absPath }`);
+  lines.push(`function _entry(ns, id, absPath) {`);
+  lines.push(`  const fn = ns.default`);
+  lines.push(`  return { id, description: fn.description, handler: fn.handler, triggers: (fn.triggers ?? []).map(t => ({ ...t, function_id: id })), request_format: fn.request_format, response_format: fn.response_format, filePath: absPath }`);
   lines.push(`}`);
   lines.push("");
   const entries = scanned.functions.map((fn, i) => {
     const ns = `fn${i}`;
     lines.push(`import * as ${ns} from ${genString(fn.absPath)}`);
-    return `_stepEntry(${ns}, ${genString(fn.id)}, ${genString(fn.absPath)})`;
+    return `_entry(${ns}, ${genString(fn.id)}, ${genString(fn.absPath)})`;
   });
   lines.push("");
   lines.push(`export const registry = {`);
@@ -1102,11 +1199,29 @@ function generateIiiRegistryTemplate(scanned, pythonPathRewrite) {
   return lines.join("\n");
 }
 
+function writePyrightConfig(options) {
+  try {
+    const { rootDir, devPath, includePaths } = options;
+    const binDir = dirname(devPath);
+    const venvDir = dirname(binDir);
+    const venv = basename(venvDir);
+    const venvPath = dirname(venvDir) || ".";
+    const include = includePaths.map((p) => relative(rootDir, p)).filter((p) => !p.startsWith(".."));
+    const config = { venvPath, venv };
+    if (include.length > 0) config.include = include;
+    writeFileSync(
+      join(rootDir, "pyrightconfig.json"),
+      JSON.stringify(config, null, 2) + "\n",
+      "utf-8"
+    );
+  } catch {
+  }
+}
 async function installPythonRequirements(requirementsPath, pythonBin, logLevel) {
   if (!existsSync(requirementsPath)) return;
   if (logLevel !== "none") console.log(`[nvent] Installing Python requirements from ${requirementsPath}`);
   return new Promise((resolve) => {
-    const proc = spawn(pythonBin, ["-m", "pip", "install", "-r", requirementsPath, "--quiet"], {
+    const proc = spawn(pythonBin, ["-m", "pip", "install", "-r", requirementsPath, "--upgrade", "--quiet"], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stderr = "";
@@ -1156,6 +1271,11 @@ const module$1 = defineNuxtModule({
     const { resolve } = createResolver(import.meta.url);
     const PYTHON_RUNTIME_SRC = resolve("./runtime/python/worker_runtime.py");
     const PYTHON_NVENT_HELPER_SRC = resolve("./runtime/python/nvent.py");
+    extendViteConfig((config) => {
+      config.optimizeDeps ||= {};
+      config.optimizeDeps.include ||= [];
+      config.optimizeDeps.include.push("iii-browser-sdk");
+    });
     const userConfig = nuxt.options[meta.configKey] ?? {};
     const opts = { ...userConfig, ...options };
     const iiiOpts = opts.iii ?? {};
@@ -1188,11 +1308,20 @@ const module$1 = defineNuxtModule({
         httpHost: iiiOpts.httpHost ?? "localhost",
         wsPort: engineCfg.wsPort,
         streamPort: engineCfg.streamPort,
+        browserPort: engineCfg.workerManagerRbac?.port ?? iiiOpts.workerManager?.rbac?.port ?? 49135,
         managed,
         mode,
         version,
         modules: engineCfg.modules,
         logLevel,
+        browserAuthFunctionId: iiiOpts.workerManager?.rbac?.authFunctionId ?? "nvent::browser::auth",
+        browserAuth: {
+          // Signed, short-lived token is minted by /_iii/browser and validated by nvent::browser::auth.
+          secret: process.env.NVENT_BROWSER_AUTH_SECRET ?? randomUUID(),
+          tokenTtlSeconds: iiiOpts.workerManager?.rbac?.tokenTtlSeconds ?? 120,
+          allowAnonymous: iiiOpts.workerManager?.rbac?.allowAnonymous ?? true,
+          authResolverPath: iiiOpts.workerManager?.rbac?.authResolverPath
+        },
         // YAML config embedded at build time so the production lifecycle plugin can
         // write iii-config.yaml without needing confbox or rebuilding from options.
         engineConfigYaml
@@ -1210,9 +1339,27 @@ const module$1 = defineNuxtModule({
         flow: consoleCfg.flow ?? true
       }
     };
-    const layerInfos = nuxt.options._layers.map((l) => ({
+    function resolveLayerPrefix(layer, isRoot) {
+      if (isRoot) return void 0;
+      const layerCfg = layer.config;
+      const explicit = layerCfg?.nvent?.functions?.prefix;
+      if (typeof explicit === "string") return explicit || void 0;
+      const metaName = layerCfg?.$meta?.name;
+      if (metaName) return metaName;
+      const pkgPath = join(layer.config.rootDir, "package.json");
+      if (existsSync(pkgPath)) {
+        try {
+          const pkgName = JSON.parse(readFileSync(pkgPath, "utf-8")).name ?? "";
+          if (pkgName) return pkgName.split("/").pop().replace(/^nuxt-/, "");
+        } catch {
+        }
+      }
+      return parse(layer.config.rootDir).name;
+    }
+    const layerInfos = nuxt.options._layers.map((l, i) => ({
       rootDir: l.config.rootDir,
-      serverDir: l.config?.serverDir ?? join(l.config.rootDir, "server")
+      serverDir: l.config?.serverDir ?? join(l.config.rootDir, "server"),
+      prefix: resolveLayerPrefix(l, i === 0)
     }));
     let lastScanned = await scanFunctions({ layerInfos, functionsDir });
     let pythonPathRewrite;
@@ -1245,19 +1392,27 @@ const module$1 = defineNuxtModule({
     };
     nitroOpts.experimental ??= {};
     nitroOpts.experimental.websocket = true;
-    addServerHandler({ route: "/stream/**", handler: resolve("./runtime/nitro/routes/stream-proxy") });
+    addServerHandler({ route: "/_iii/stream/**", handler: resolve("./runtime/nitro/routes/stream-proxy") });
+    addServerHandler({ route: "/_iii/browser", handler: resolve("./runtime/nitro/routes/browser-proxy") });
     addServerImports([
       { from: resolve("./runtime/nitro/utils/useIii"), name: "useIii" },
       { from: resolve("./runtime/nitro/utils/useIii"), name: "useIiiHealth" },
-      { from: resolve("./runtime/nitro/utils/useIii"), name: "getContext" },
-      { from: resolve("./runtime/nitro/utils/defineFunction"), name: "defineFunction" },
-      { from: resolve("./runtime/nitro/utils/defineFunction"), name: "FunctionContext" }
+      { from: resolve("./runtime/nitro/utils/defineFunction"), name: "defineFunction" }
     ]);
+    nuxt.options.alias["#nvent/server"] = resolve("./runtime/nitro/server");
     addImports([
-      { from: resolve("./runtime/app/composables/useFunctionCall"), name: "useFunctionCall" },
-      { from: resolve("./runtime/app/composables/useNventStream"), name: "useNventStream" }
+      { from: resolve("./runtime/app/composables/useIiiStream"), name: "useIiiStream" },
+      { from: resolve("./runtime/app/composables/useIii"), name: "useIii" }
     ]);
+    addPlugin({ src: resolve("./runtime/app/plugins/iii.client"), mode: "client" });
     if (nuxt.options.dev) {
+      if (!skipPython && opts.functions?.python?.devPath) {
+        writePyrightConfig({
+          rootDir: nuxt.options.rootDir,
+          devPath: opts.functions.python.devPath,
+          includePaths: layerInfos.map((l) => join(l.serverDir, functionsDir))
+        });
+      }
       const nventDir = join(nuxt.options.rootDir, "node_modules", ".nvent");
       const binDir = join(nventDir, "bin");
       if (managed && mode === "local") {