veryfront 0.1.1004 → 0.1.1006

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1004",
+    "version": "0.1.1006",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/internal-agents/run-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAmB,KAAK,IAAI,EAAgB,MAAM,kBAAkB,CAAC;AAU5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AA2KD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAkUnB"}
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAmB,KAAK,IAAI,EAAgB,MAAM,kBAAkB,CAAC;AAU5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAyOD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAoVnB"}

package/esm/src/internal-agents/run-stream.js

@@ -7,6 +7,7 @@ import { createAgentServiceSandboxTools } from "../sandbox/index.js";
 import { tryResolve } from "../extensions/contracts.js";
 import { importFirstPartyExtensionModule } from "../extensions/first-party-import.js";
 import { SandboxShellToolsProviderName, } from "../extensions/sandbox/index.js";
+import { resolveHostedRuntimeAllowedToolNames } from "../agent/hosted/runtime-essential-tools.js";
 import { SKILL_TOOL_IDS } from "../skill/types.js";
 import { isToolVisibleTo, toolRegistry } from "../tool/index.js";
 import { defineSchema, lazySchema } from "../schemas/index.js";
@@ -209,6 +210,54 @@ function getAllowedRemoteToolNames(forwardedProps) {
     }
     return allowedTools.every((toolName) => typeof toolName === "string") ? allowedTools : [];
 }
+/**
+ * Reads the restrictive `runtimeOverrides.toolAllowlist` override.
+ *
+ * Unlike `runtimeOverrides.allowedTools` — which this path treats as an
+ * additive grant list (Studio forwards integration/studio tool names it wants
+ * attached on top of the agent's own surface) — `toolAllowlist` is a hard
+ * restriction: the model-visible tool set of the run is intersected with it.
+ * Scheduled automations declare it via schedule `input.runtimeOverrides` for
+ * defense in depth. Returns null when absent (no restriction); a present but
+ * malformed value fails closed to an empty allowlist.
+ */
+function getRuntimeToolAllowlist(forwardedProps) {
+    const runtimeOverrides = isRecord(forwardedProps?.runtimeOverrides)
+        ? forwardedProps.runtimeOverrides
+        : null;
+    if (!runtimeOverrides || !Object.hasOwn(runtimeOverrides, "toolAllowlist")) {
+        return null;
+    }
+    const toolAllowlist = runtimeOverrides.toolAllowlist;
+    if (!Array.isArray(toolAllowlist)) {
+        return new Set();
+    }
+    return new Set(toolAllowlist.filter((toolName) => typeof toolName === "string" && toolName.length > 0));
+}
+/**
+ * Intersects the merged run tool set with the restrictive tool allowlist.
+ * Skill runtime/delegation tools are preserved for skill-enabled agents,
+ * mirroring the hosted chat runtime's allowlist semantics.
+ */
+function applyRuntimeToolAllowlist(mergedTools, toolAllowlist, agent) {
+    if (!toolAllowlist || !mergedTools || mergedTools === true) {
+        return mergedTools;
+    }
+    const availableSkillIds = agent.config.skills === true
+        ? ["*"]
+        : Array.isArray(agent.config.skills)
+            ? agent.config.skills
+            : undefined;
+    const allowedToolNames = resolveHostedRuntimeAllowedToolNames({
+        allowedToolNames: toolAllowlist,
+        localToolNames: Object.keys(mergedTools),
+        ...(availableSkillIds ? { availableSkillIds } : {}),
+    });
+    if (!allowedToolNames) {
+        return mergedTools;
+    }
+    return Object.fromEntries(Object.entries(mergedTools).filter(([toolName]) => allowedToolNames.has(toolName)));
+}
 function getServerResolvedProjectToolNames(forwardedProps) {
     const runtimeOverrides = isRecord(forwardedProps?.runtimeOverrides)
         ? forwardedProps.runtimeOverrides
@@ -257,9 +306,21 @@ export async function createRuntimeAgentStreamResponse(input, agent, deps) {
     });
     const forwardedAllowedRemoteToolNames = getAllowedRemoteToolNames(input.forwardedProps);
     const sourceAllowedRemoteToolNames = getAgentAllowedRemoteToolNames(agent);
-    const allowedRemoteToolNames = forwardedAllowedRemoteToolNames === undefined
+    const grantedRemoteToolNames = forwardedAllowedRemoteToolNames === undefined
         ? undefined
         : mergeRemoteToolNames(sourceAllowedRemoteToolNames, forwardedAllowedRemoteToolNames);
+    // A restrictive toolAllowlist caps remote exposure too: it intersects the
+    // tightest existing remote filter (forwarded grants, else the agent source's
+    // own __vfAllowedRemoteTools), and with neither present it becomes the
+    // remote filter directly. It can only narrow what the agent's sources
+    // already expose, never add.
+    const runtimeToolAllowlist = getRuntimeToolAllowlist(input.forwardedProps);
+    const sourceRemoteFilterBase = Object.hasOwn(agent.config, "__vfAllowedRemoteTools")
+        ? sourceAllowedRemoteToolNames
+        : undefined;
+    const allowedRemoteToolNames = runtimeToolAllowlist === null
+        ? grantedRemoteToolNames
+        : (grantedRemoteToolNames ?? sourceRemoteFilterBase ?? [...runtimeToolAllowlist]).filter((toolName) => runtimeToolAllowlist.has(toolName));
     const forwardedIntegrationToolDefs = getForwardedIntegrationToolDefinitions(input.forwardedProps);
     const availableForwardedToolNames = forwardedIntegrationToolDefs?.map((tool) => tool.name);
     const sandboxTools = await buildProjectAgentSandboxTools({ agent, deps });
@@ -267,7 +328,7 @@ export async function createRuntimeAgentStreamResponse(input, agent, deps) {
         ...(deps.localTools ?? {}),
         ...(sandboxTools.tools ?? {}),
     };
-    const mergedTools = buildMergedTools(agent, input, deps.sessionManager, availableForwardedToolNames, Object.keys(availableLocalTools).length > 0 ? availableLocalTools : undefined);
+    const mergedTools = applyRuntimeToolAllowlist(buildMergedTools(agent, input, deps.sessionManager, availableForwardedToolNames, Object.keys(availableLocalTools).length > 0 ? availableLocalTools : undefined), runtimeToolAllowlist, agent);
     const runtimeAgent = {
         ...agent,
         config: {

package/esm/src/platform/compat/http/types.d.ts

@@ -19,5 +19,6 @@ export interface WebSocketUpgradeResult {
 export interface WebSocketUpgradeOptions {
     protocol?: string;
     headers?: Headers | Record<string, string>;
+    idleTimeout?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/esm/src/platform/compat/http/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjE;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjE;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/esm/src/platform/compat/http/websocket.d.ts

@@ -1,4 +1,6 @@
+import * as dntShim from "../../../../_dnt.shims.js";
 import type { WebSocketUpgradeOptions, WebSocketUpgradeResult } from "./types.js";
 export declare function upgradeWebSocket(request: Request, options?: WebSocketUpgradeOptions): WebSocketUpgradeResult;
 export declare function isWebSocketUpgrade(request: Request): boolean;
+export declare function resolveDenoUpgradeWebSocketOptions(options?: WebSocketUpgradeOptions): dntShim.Deno.UpgradeWebSocketOptions | undefined;
 //# sourceMappingURL=websocket.d.ts.map

package/esm/src/platform/compat/http/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/websocket.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIlF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAChC,sBAAsB,CASxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5D"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAErD,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIlF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAChC,sBAAsB,CASxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5D;AAsBD,wBAAgB,kCAAkC,CAChD,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAOlD"}

package/esm/src/platform/compat/http/websocket.js

@@ -22,9 +22,14 @@ function upgradeWebSocketDeno(request, options) {
             detail: "Deno.upgradeWebSocket() is not available in this runtime.",
         });
     }
-    const denoOptions = options?.protocol
-        ? { protocol: options.protocol }
-        : undefined;
-    const { socket, response } = nativeDeno.upgradeWebSocket(request, denoOptions);
+    const { socket, response } = nativeDeno.upgradeWebSocket(request, resolveDenoUpgradeWebSocketOptions(options));
     return { socket, response };
 }
+export function resolveDenoUpgradeWebSocketOptions(options) {
+    if (!options?.protocol && options?.idleTimeout === undefined)
+        return undefined;
+    return {
+        ...(options.protocol ? { protocol: options.protocol } : {}),
+        ...(options.idleTimeout !== undefined ? { idleTimeout: options.idleTimeout } : {}),
+    };
+}

package/esm/src/proxy/main.js

@@ -23,7 +23,7 @@ import * as dntShim from "../../_dnt.shims.js";
 import { createProxyHandler, INTERNAL_PROXY_HEADERS } from "./handler.js";
 import { createCacheFromEnv } from "./cache/index.js";
 import { isRetryableConnectionError } from "./retry.js";
-import { closeBridgePeer, getServerWebSocketErrorLogLevel } from "./websocket-bridge.js";
+import { closeBridgePeer, createProxyClientWebSocketUpgradeOptions, getServerWebSocketErrorLogLevel, } from "./websocket-bridge.js";
 import { register } from "../extensions/contracts.js";
 import { importFirstPartyExtensionModule } from "../extensions/first-party-import.js";
 import { endSpan, extractContext, initializeOTLPWithApis, injectContext, ProxySpanNames, shutdownOTLP, startServerSpan, withContext, withSpan, } from "./tracing.js";
@@ -138,7 +138,7 @@ function handleWebSocketUpgrade(req, url) {
         parsedEnvironment: parsed.environment,
         targetUrl: targetUrl.toString(),
     });
-    const { socket: clientSocket, response } = upgradeWebSocket(req);
+    const { socket: clientSocket, response } = upgradeWebSocket(req, createProxyClientWebSocketUpgradeOptions());
     let serverSocket = null;
     let connectTimeoutId = null;
     let timedOut = false;

package/esm/src/proxy/websocket-bridge.d.ts

@@ -1,6 +1,8 @@
+import type { WebSocketUpgradeOptions } from "../platform/compat/http/index.js";
 type BridgePeer = Pick<WebSocket, "close" | "readyState">;
 export type ServerWebSocketErrorLogLevel = "warn" | "error";
 export declare function getServerWebSocketErrorLogLevel(message: string): ServerWebSocketErrorLogLevel;
 export declare function closeBridgePeer(peer: BridgePeer | null, code: number, reason: string): void;
+export declare function createProxyClientWebSocketUpgradeOptions(): WebSocketUpgradeOptions;
 export {};
 //# sourceMappingURL=websocket-bridge.d.ts.map

package/esm/src/proxy/websocket-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-bridge.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/websocket-bridge.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,OAAO,CAAC;AAS5D,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,4BAA4B,CAI7F;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAI3F"}
+{"version":3,"file":"websocket-bridge.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/websocket-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,KAAK,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,OAAO,CAAC;AAS5D,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,4BAA4B,CAI7F;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAI3F;AAED,wBAAgB,wCAAwC,IAAI,uBAAuB,CAIlF"}

package/esm/src/proxy/websocket-bridge.js

@@ -16,3 +16,8 @@ export function closeBridgePeer(peer, code, reason) {
         return;
     peer.close(code, reason);
 }
+export function createProxyClientWebSocketUpgradeOptions() {
+    // Proxied project sockets use app-level heartbeats; Deno's transport idle timeout
+    // can close otherwise healthy bridges before the browser sends a data frame.
+    return { idleTimeout: 0 };
+}

package/esm/src/routing/api/module-loader/esbuild-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAI5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CA2K9E"}
+{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAO5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAkP9E"}

package/esm/src/routing/api/module-loader/esbuild-plugin.js

@@ -1,11 +1,84 @@
 import * as dntShim from "../../../../_dnt.shims.js";
-import { computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
+import { computeHash, computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
+import { createFileSystem } from "../../../platform/compat/fs.js";
+import * as pathHelper from "../../../platform/compat/path/index.js";
 const logger = serverLogger.component("api");
+const HTTP_MODULE_CACHE_DIR = ".veryfront/cache/api-http-imports";
+const HTTP_MODULE_FETCH_MAX_ATTEMPTS = 3;
+const HTTP_MODULE_FETCH_RETRY_DELAY_MS = 100;
+function createHTTPModuleCache(projectDir) {
+    if (!projectDir)
+        return null;
+    const fs = createFileSystem();
+    const cacheDir = pathHelper.join(projectDir, HTTP_MODULE_CACHE_DIR);
+    async function cachePaths(url, integrity) {
+        const key = await computeHash(`${url}\n${integrity}`);
+        return {
+            sourcePath: pathHelper.join(cacheDir, `${key}.mjs`),
+            metadataPath: pathHelper.join(cacheDir, `${key}.json`),
+        };
+    }
+    async function readMetadata(metadataPath, fs) {
+        if (!await fs.exists(metadataPath))
+            return null;
+        try {
+            return JSON.parse(await fs.readTextFile(metadataPath));
+        }
+        catch (error) {
+            logger.debug(`[http] ignoring unreadable module cache metadata: ${error}`);
+            return null;
+        }
+    }
+    return {
+        async read(url, expectedIntegrity) {
+            if (!expectedIntegrity)
+                return null;
+            try {
+                const { sourcePath, metadataPath } = await cachePaths(url, expectedIntegrity);
+                if (!await fs.exists(sourcePath))
+                    return null;
+                const contents = await fs.readTextFile(sourcePath);
+                const integrity = await computeIntegrity(contents);
+                if (expectedIntegrity && integrity !== expectedIntegrity) {
+                    logger.warn(`[http] cached module integrity mismatch: ${url}`);
+                    return null;
+                }
+                const metadata = await readMetadata(metadataPath, fs);
+                if (metadata?.integrity && metadata.integrity !== integrity) {
+                    logger.warn(`[http] cached module metadata integrity mismatch: ${url}`);
+                    return null;
+                }
+                return contents;
+            }
+            catch (error) {
+                logger.debug(`[http] module cache read miss for ${url}: ${error}`);
+                return null;
+            }
+        },
+        async write(url, contents, resolvedUrl, integrity) {
+            try {
+                await fs.mkdir(cacheDir, { recursive: true });
+                const { sourcePath, metadataPath } = await cachePaths(url, integrity);
+                await fs.writeTextFile(sourcePath, contents);
+                await fs.writeTextFile(metadataPath, `${JSON.stringify({
+                    url,
+                    resolvedUrl,
+                    integrity,
+                    fetchedAt: new Date().toISOString(),
+                }, null, 2)}\n`);
+            }
+            catch (error) {
+                logger.debug(`[http] could not update module cache for ${url}: ${error}`);
+            }
+        },
+    };
+}
 export function createHTTPPlugin(options) {
     const opts = Array.isArray(options) ? { allowedHosts: options } : options;
     const { allowedHosts, strict = false } = opts;
     const lockfile = opts.lockfile ??
         (opts.projectDir ? createLockfileManager(opts.projectDir) : null);
+    const moduleCache = createHTTPModuleCache(opts.projectDir);
     return {
         name: "vf-api-http-fetch",
         setup(build) {
@@ -25,6 +98,27 @@ export function createHTTPPlugin(options) {
                     clearTimeout(timeout);
                 }
             }
+            function shouldRetryFetch(status) {
+                return status === 429 || status >= 500 || status === HTTP_NETWORK_CONNECT_TIMEOUT;
+            }
+            function delay(ms) {
+                return new Promise((resolve) => dntShim.setTimeout(resolve, ms));
+            }
+            async function fetchRemoteModule(url) {
+                for (let attempt = 1; attempt <= HTTP_MODULE_FETCH_MAX_ATTEMPTS; attempt += 1) {
+                    const response = await fetchWithTimeout(url).catch((error) => new Response(String(error?.message ?? error), {
+                        status: HTTP_NETWORK_CONNECT_TIMEOUT,
+                    }));
+                    if (!shouldRetryFetch(response.status) || attempt === HTTP_MODULE_FETCH_MAX_ATTEMPTS) {
+                        return response;
+                    }
+                    logger.warn(`[http] fetch attempt ${attempt} failed ${url} ${response.status}; retrying`);
+                    await delay(HTTP_MODULE_FETCH_RETRY_DELAY_MS * attempt);
+                }
+                return new Response("Remote module fetch failed", {
+                    status: HTTP_NETWORK_CONNECT_TIMEOUT,
+                });
+            }
             build.onResolve({ filter: /^(http|https):\/\// }, (args) => ({
                 path: args.path,
                 namespace: "http-url",
@@ -90,39 +184,62 @@ export function createHTTPPlugin(options) {
                 catch (e) {
                     logger.warn("API URL parse failed", e);
                 }
-                if (lockfile) {
-                    const cached = await lockfile.get(args.path);
-                    if (cached) {
-                        logger.debug(`[http] lockfile hit: ${args.path}`);
-                        try {
-                            const res = await fetchWithTimeout(cached.resolved);
-                            if (res.ok) {
-                                const text = await res.text();
-                                const integrity = await computeIntegrity(text);
-                                if (integrity === cached.integrity) {
-                                    return { contents: text, loader: "js" };
-                                }
-                                if (strict) {
-                                    return {
-                                        errors: [
-                                            {
-                                                text: `Integrity mismatch for ${args.path}: expected ${cached.integrity}, got ${integrity}`,
-                                            },
-                                        ],
-                                    };
-                                }
-                                logger.warn(`[http] integrity mismatch, refetching: ${args.path}`);
+                const readCachedModule = async (url, expectedIntegrity) => {
+                    if (!url || !moduleCache)
+                        return null;
+                    return await moduleCache.read(url, expectedIntegrity);
+                };
+                const lockfileEntry = lockfile ? await lockfile.get(args.path) : null;
+                if (lockfileEntry) {
+                    let canUseLockfileCacheFallback = true;
+                    logger.debug(`[http] lockfile hit: ${args.path}`);
+                    try {
+                        const res = await fetchRemoteModule(lockfileEntry.resolved);
+                        if (res.ok) {
+                            const text = await res.text();
+                            const integrity = await computeIntegrity(text);
+                            if (integrity === lockfileEntry.integrity) {
+                                await moduleCache?.write(args.path, text, lockfileEntry.resolved, integrity);
+                                await moduleCache?.write(lockfileEntry.resolved, text, lockfileEntry.resolved, integrity);
+                                return { contents: text, loader: "js" };
                             }
+                            if (strict) {
+                                return {
+                                    errors: [
+                                        {
+                                            text: `Integrity mismatch for ${args.path}: expected ${lockfileEntry.integrity}, got ${integrity}`,
+                                        },
+                                    ],
+                                };
+                            }
+                            canUseLockfileCacheFallback = false;
+                            logger.warn(`[http] integrity mismatch, refetching: ${args.path}`);
+                        }
+                        else {
+                            logger.warn(`[http] cached URL returned ${res.status}, trying module cache: ${args.path}`);
                         }
-                        catch (_error) {
-                            logger.warn(`[http] cached URL failed, refetching: ${args.path}`);
+                    }
+                    catch (_error) {
+                        logger.warn(`[http] cached URL failed, trying module cache: ${args.path}`);
+                    }
+                    if (canUseLockfileCacheFallback) {
+                        const cachedText = await readCachedModule(lockfileEntry.resolved, lockfileEntry.integrity) ??
+                            await readCachedModule(args.path, lockfileEntry.integrity);
+                        if (cachedText) {
+                            logger.warn(`[http] serving cached remote import for ${args.path}`);
+                            return { contents: cachedText, loader: "js" };
                         }
                     }
                 }
-                const res = await fetchWithTimeout(requestUrl).catch((e) => {
-                    return new Response(String(e?.message ?? e), { status: HTTP_NETWORK_CONNECT_TIMEOUT });
-                });
+                const res = await fetchRemoteModule(requestUrl);
                 if (!res.ok) {
+                    const cachedText = await readCachedModule(lockfileEntry?.resolved, lockfileEntry?.integrity) ??
+                        await readCachedModule(requestUrl, lockfileEntry?.integrity) ??
+                        await readCachedModule(args.path, lockfileEntry?.integrity);
+                    if (cachedText) {
+                        logger.warn(`[http] serving cached remote import for ${args.path}`);
+                        return { contents: cachedText, loader: "js" };
+                    }
                     logger.error(`[http] fetch failed ${requestUrl} ${res.status}`);
                     return {
                         errors: [
@@ -134,8 +251,8 @@ export function createHTTPPlugin(options) {
                 }
                 const text = await res.text();
                 const resolvedUrl = res.url || requestUrl;
+                const integrity = await computeIntegrity(text);
                 if (lockfile) {
-                    const integrity = await computeIntegrity(text);
                     await lockfile.set(args.path, {
                         resolved: resolvedUrl,
                         integrity,
@@ -144,6 +261,9 @@ export function createHTTPPlugin(options) {
                     await lockfile.flush();
                     logger.debug(`[http] lockfile updated: ${args.path} -> ${resolvedUrl}`);
                 }
+                await moduleCache?.write(args.path, text, resolvedUrl, integrity);
+                await moduleCache?.write(requestUrl, text, resolvedUrl, integrity);
+                await moduleCache?.write(resolvedUrl, text, resolvedUrl, integrity);
                 return { contents: text, loader: "js" };
             });
             logger.debug(`[API][http] resolvedUrls: ${resolvedUrls.length}, nodeMapped: ${nodeMapped.length}`);

package/esm/src/routing/api/module-loader/loader.js

@@ -253,7 +253,7 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
             plugins: [
                 createImportMapPlugin(projectDir, adapter, config),
                 createAdapterResolvePlugin(adapter, projectDir),
-                createHTTPPlugin(allowedHosts),
+                createHTTPPlugin({ allowedHosts, projectDir }),
             ],
         });
         if (result.errors?.length) {

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1004";
+export declare const VERSION = "0.1.1006";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1004";
+export const VERSION = "0.1.1006";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1004",
+  "version": "0.1.1006",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",