veryfront 0.1.1005 → 0.1.1007

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1005",
+    "version": "0.1.1007",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/internal-agents/run-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAmB,KAAK,IAAI,EAAgB,MAAM,kBAAkB,CAAC;AAU5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAyOD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAoVnB"}
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAW3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAEL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAwSD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAyWnB"}

package/esm/src/internal-agents/run-stream.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../_dnt.shims.js";
 import { AgentRuntime, } from "../agent/index.js";
 import { normalizeAgUiRuntimeMessages } from "../agent/ag-ui/runtime-support.js";
 import { compactForStep, estimateOverhead } from "../chat/message-prep.js";
+import { getRuntimeRemoteToolSources, } from "../agent/runtime/mcp-server-tool-sources.js";
 import { convertAgentRuntimeMessagesToProviderMessages, convertProviderMessagesToAgentRuntimeMessages, } from "../agent/runtime/message-adapter.js";
 import { createAgentServiceSandboxTools } from "../sandbox/index.js";
 import { tryResolve } from "../extensions/contracts.js";
@@ -9,7 +10,7 @@ import { importFirstPartyExtensionModule } from "../extensions/first-party-impor
 import { SandboxShellToolsProviderName, } from "../extensions/sandbox/index.js";
 import { resolveHostedRuntimeAllowedToolNames } from "../agent/hosted/runtime-essential-tools.js";
 import { SKILL_TOOL_IDS } from "../skill/types.js";
-import { isToolVisibleTo, toolRegistry } from "../tool/index.js";
+import { isToolVisibleTo, toolRegistry, } from "../tool/index.js";
 import { defineSchema, lazySchema } from "../schemas/index.js";
 import { createStreamTransformState, finalizeRunEvents, formatAgUiEvent, mapRuntimeEventToAgUi, parseSseJsonEvents, } from "./ag-ui-sse.js";
 import { AgentRunCancelledError } from "./session-manager.js";
@@ -238,11 +239,22 @@ function getRuntimeToolAllowlist(forwardedProps) {
  * Intersects the merged run tool set with the restrictive tool allowlist.
  * Skill runtime/delegation tools are preserved for skill-enabled agents,
  * mirroring the hosted chat runtime's allowlist semantics.
+ *
+ * The allowlist bounds this run's direct tool surface only: preserved skill
+ * delegation tools (`invoke_agent`) can spawn child runs whose tool assembly
+ * derives from the child agent's own config and is not capped by this run's
+ * allowlist. Strict schedules must exclude delegation via agent config.
  */
 function applyRuntimeToolAllowlist(mergedTools, toolAllowlist, agent) {
-    if (!toolAllowlist || !mergedTools || mergedTools === true) {
+    if (!toolAllowlist || !mergedTools) {
         return mergedTools;
     }
+    if (mergedTools === true) {
+        // buildMergedTools always expands `tools: true` into a concrete record,
+        // so this is unreachable; if that invariant ever breaks, fail closed
+        // rather than silently skipping enforcement.
+        return {};
+    }
     const availableSkillIds = agent.config.skills === true
         ? ["*"]
         : Array.isArray(agent.config.skills)
@@ -287,6 +299,48 @@ function getForwardedIntegrationToolDefinitions(forwardedProps) {
         parameters: def.inputSchema ?? def.parameters ?? { type: "object", properties: {} },
     }));
 }
+function getRemoteToolDiscoveryContext(input) {
+    return {
+        agentId: input.agent.id,
+        runId: input.runInput.runId,
+        ...(input.deps.projectAgentSandbox?.authToken
+            ? { authToken: input.deps.projectAgentSandbox.authToken }
+            : {}),
+        ...(input.deps.projectAgentSandbox?.projectId
+            ? { projectId: input.deps.projectAgentSandbox.projectId }
+            : {}),
+        ...(input.runInput.parentRunId ? { parentRunId: input.runInput.parentRunId } : {}),
+        ...(input.runInput.state !== undefined ? { state: input.runInput.state } : {}),
+        context: input.runInput.context,
+        forwardedProps: input.runInput.forwardedProps,
+    };
+}
+async function getDeclaredRemoteSourceToolNames(input) {
+    const sources = getRuntimeRemoteToolSources(input.agent.config);
+    if (!sources?.length) {
+        return [];
+    }
+    const context = getRemoteToolDiscoveryContext(input);
+    const toolNames = new Set();
+    for (const source of sources) {
+        try {
+            for (const definition of await source.listTools(context)) {
+                if (typeof definition.name === "string" && definition.name.length > 0) {
+                    toolNames.add(definition.name);
+                }
+            }
+        }
+        catch (error) {
+            logger.warn("Failed to inspect remote tool source for restrictive allowlist fallback", {
+                runId: input.runInput.runId,
+                agentId: input.agent.id,
+                sourceId: source.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return [...toolNames];
+}
 function compactRuntimeMessagesForStream(messages, mergedTools) {
     const toolCount = mergedTools && mergedTools !== true ? Object.keys(mergedTools).length : 0;
     return convertProviderMessagesToAgentRuntimeMessages(compactForStep(convertAgentRuntimeMessagesToProviderMessages(messages), estimateOverhead("", toolCount)));
@@ -309,31 +363,46 @@ export async function createRuntimeAgentStreamResponse(input, agent, deps) {
     const grantedRemoteToolNames = forwardedAllowedRemoteToolNames === undefined
         ? undefined
         : mergeRemoteToolNames(sourceAllowedRemoteToolNames, forwardedAllowedRemoteToolNames);
+    const runtimeToolAllowlist = getRuntimeToolAllowlist(input.forwardedProps);
+    if (runtimeToolAllowlist === null && forwardedAllowedRemoteToolNames !== undefined) {
+        logger.debug("runtimeOverrides.allowedTools is additive on internal runs; use runtimeOverrides.toolAllowlist to restrict the run tool surface", { runId: input.runId, agentId: agent.id });
+    }
+    const forwardedIntegrationToolDefs = getForwardedIntegrationToolDefinitions(input.forwardedProps);
+    const availableForwardedToolNames = forwardedIntegrationToolDefs?.map((tool) => tool.name);
     // A restrictive toolAllowlist caps remote exposure too: it intersects the
     // tightest existing remote filter (forwarded grants, else the agent source's
-    // own __vfAllowedRemoteTools), and with neither present it becomes the
-    // remote filter directly. It can only narrow what the agent's sources
-    // already expose, never add.
-    const runtimeToolAllowlist = getRuntimeToolAllowlist(input.forwardedProps);
+    // own __vfAllowedRemoteTools). With neither present, discover the agent's
+    // declared remote-source surface and intersect with that. A bare allowlist
+    // entry can narrow actual remote sources, but never becomes an implicit
+    // project-scoped integration grant (#2768).
     const sourceRemoteFilterBase = Object.hasOwn(agent.config, "__vfAllowedRemoteTools")
         ? sourceAllowedRemoteToolNames
         : undefined;
+    const remoteFallbackBase = runtimeToolAllowlist !== null &&
+        grantedRemoteToolNames === undefined &&
+        sourceRemoteFilterBase === undefined
+        ? await getDeclaredRemoteSourceToolNames({ agent, runInput: input, deps })
+        : undefined;
     const allowedRemoteToolNames = runtimeToolAllowlist === null
         ? grantedRemoteToolNames
-        : (grantedRemoteToolNames ?? sourceRemoteFilterBase ?? [...runtimeToolAllowlist]).filter((toolName) => runtimeToolAllowlist.has(toolName));
-    const forwardedIntegrationToolDefs = getForwardedIntegrationToolDefinitions(input.forwardedProps);
-    const availableForwardedToolNames = forwardedIntegrationToolDefs?.map((tool) => tool.name);
+        : (grantedRemoteToolNames ?? sourceRemoteFilterBase ?? remoteFallbackBase ?? []).filter((toolName) => runtimeToolAllowlist.has(toolName));
     const sandboxTools = await buildProjectAgentSandboxTools({ agent, deps });
     const availableLocalTools = {
         ...(deps.localTools ?? {}),
         ...(sandboxTools.tools ?? {}),
     };
     const mergedTools = applyRuntimeToolAllowlist(buildMergedTools(agent, input, deps.sessionManager, availableForwardedToolNames, Object.keys(availableLocalTools).length > 0 ? availableLocalTools : undefined), runtimeToolAllowlist, agent);
+    // Provider-native tools (e.g. web_search) are provider-side and bypass the
+    // merged tool record, so cap them against the allowlist explicitly.
+    const cappedProviderTools = runtimeToolAllowlist !== null && Array.isArray(agent.config.providerTools)
+        ? agent.config.providerTools.filter((toolName) => typeof toolName === "string" && runtimeToolAllowlist.has(toolName))
+        : undefined;
     const runtimeAgent = {
         ...agent,
         config: {
             ...agent.config,
             tools: mergedTools,
+            ...(cappedProviderTools !== undefined ? { providerTools: cappedProviderTools } : {}),
             ...(allowedRemoteToolNames !== undefined
                 ? { __vfAllowedRemoteTools: allowedRemoteToolNames }
                 : {}),

package/esm/src/platform/compat/http/types.d.ts

@@ -19,5 +19,6 @@ export interface WebSocketUpgradeResult {
 export interface WebSocketUpgradeOptions {
     protocol?: string;
     headers?: Headers | Record<string, string>;
+    idleTimeout?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/esm/src/platform/compat/http/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjE;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACjE;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/esm/src/platform/compat/http/websocket.d.ts

@@ -1,4 +1,6 @@
+import * as dntShim from "../../../../_dnt.shims.js";
 import type { WebSocketUpgradeOptions, WebSocketUpgradeResult } from "./types.js";
 export declare function upgradeWebSocket(request: Request, options?: WebSocketUpgradeOptions): WebSocketUpgradeResult;
 export declare function isWebSocketUpgrade(request: Request): boolean;
+export declare function resolveDenoUpgradeWebSocketOptions(options?: WebSocketUpgradeOptions): dntShim.Deno.UpgradeWebSocketOptions | undefined;
 //# sourceMappingURL=websocket.d.ts.map

package/esm/src/platform/compat/http/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/websocket.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIlF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAChC,sBAAsB,CASxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5D"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/http/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAErD,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIlF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAChC,sBAAsB,CASxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5D;AAsBD,wBAAgB,kCAAkC,CAChD,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAOlD"}

package/esm/src/platform/compat/http/websocket.js

@@ -22,9 +22,14 @@ function upgradeWebSocketDeno(request, options) {
             detail: "Deno.upgradeWebSocket() is not available in this runtime.",
         });
     }
-    const denoOptions = options?.protocol
-        ? { protocol: options.protocol }
-        : undefined;
-    const { socket, response } = nativeDeno.upgradeWebSocket(request, denoOptions);
+    const { socket, response } = nativeDeno.upgradeWebSocket(request, resolveDenoUpgradeWebSocketOptions(options));
     return { socket, response };
 }
+export function resolveDenoUpgradeWebSocketOptions(options) {
+    if (!options?.protocol && options?.idleTimeout === undefined)
+        return undefined;
+    return {
+        ...(options.protocol ? { protocol: options.protocol } : {}),
+        ...(options.idleTimeout !== undefined ? { idleTimeout: options.idleTimeout } : {}),
+    };
+}

package/esm/src/proxy/main.js

@@ -23,7 +23,7 @@ import * as dntShim from "../../_dnt.shims.js";
 import { createProxyHandler, INTERNAL_PROXY_HEADERS } from "./handler.js";
 import { createCacheFromEnv } from "./cache/index.js";
 import { isRetryableConnectionError } from "./retry.js";
-import { closeBridgePeer, getServerWebSocketErrorLogLevel } from "./websocket-bridge.js";
+import { closeBridgePeer, createProxyClientWebSocketUpgradeOptions, getServerWebSocketErrorLogLevel, } from "./websocket-bridge.js";
 import { register } from "../extensions/contracts.js";
 import { importFirstPartyExtensionModule } from "../extensions/first-party-import.js";
 import { endSpan, extractContext, initializeOTLPWithApis, injectContext, ProxySpanNames, shutdownOTLP, startServerSpan, withContext, withSpan, } from "./tracing.js";
@@ -138,7 +138,7 @@ function handleWebSocketUpgrade(req, url) {
         parsedEnvironment: parsed.environment,
         targetUrl: targetUrl.toString(),
     });
-    const { socket: clientSocket, response } = upgradeWebSocket(req);
+    const { socket: clientSocket, response } = upgradeWebSocket(req, createProxyClientWebSocketUpgradeOptions());
     let serverSocket = null;
     let connectTimeoutId = null;
     let timedOut = false;

package/esm/src/proxy/websocket-bridge.d.ts

@@ -1,6 +1,8 @@
+import type { WebSocketUpgradeOptions } from "../platform/compat/http/index.js";
 type BridgePeer = Pick<WebSocket, "close" | "readyState">;
 export type ServerWebSocketErrorLogLevel = "warn" | "error";
 export declare function getServerWebSocketErrorLogLevel(message: string): ServerWebSocketErrorLogLevel;
 export declare function closeBridgePeer(peer: BridgePeer | null, code: number, reason: string): void;
+export declare function createProxyClientWebSocketUpgradeOptions(): WebSocketUpgradeOptions;
 export {};
 //# sourceMappingURL=websocket-bridge.d.ts.map

package/esm/src/proxy/websocket-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-bridge.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/websocket-bridge.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,OAAO,CAAC;AAS5D,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,4BAA4B,CAI7F;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAI3F"}
+{"version":3,"file":"websocket-bridge.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/websocket-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,KAAK,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,OAAO,CAAC;AAS5D,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,4BAA4B,CAI7F;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAI3F;AAED,wBAAgB,wCAAwC,IAAI,uBAAuB,CAIlF"}

package/esm/src/proxy/websocket-bridge.js

@@ -16,3 +16,8 @@ export function closeBridgePeer(peer, code, reason) {
         return;
     peer.close(code, reason);
 }
+export function createProxyClientWebSocketUpgradeOptions() {
+    // Proxied project sockets use app-level heartbeats; Deno's transport idle timeout
+    // can close otherwise healthy bridges before the browser sends a data frame.
+    return { idleTimeout: 0 };
+}

package/esm/src/routing/api/module-loader/esbuild-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAI5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CA2K9E"}
+{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAO5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAkP9E"}

package/esm/src/routing/api/module-loader/esbuild-plugin.js

@@ -1,11 +1,84 @@
 import * as dntShim from "../../../../_dnt.shims.js";
-import { computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
+import { computeHash, computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
+import { createFileSystem } from "../../../platform/compat/fs.js";
+import * as pathHelper from "../../../platform/compat/path/index.js";
 const logger = serverLogger.component("api");
+const HTTP_MODULE_CACHE_DIR = ".veryfront/cache/api-http-imports";
+const HTTP_MODULE_FETCH_MAX_ATTEMPTS = 3;
+const HTTP_MODULE_FETCH_RETRY_DELAY_MS = 100;
+function createHTTPModuleCache(projectDir) {
+    if (!projectDir)
+        return null;
+    const fs = createFileSystem();
+    const cacheDir = pathHelper.join(projectDir, HTTP_MODULE_CACHE_DIR);
+    async function cachePaths(url, integrity) {
+        const key = await computeHash(`${url}\n${integrity}`);
+        return {
+            sourcePath: pathHelper.join(cacheDir, `${key}.mjs`),
+            metadataPath: pathHelper.join(cacheDir, `${key}.json`),
+        };
+    }
+    async function readMetadata(metadataPath, fs) {
+        if (!await fs.exists(metadataPath))
+            return null;
+        try {
+            return JSON.parse(await fs.readTextFile(metadataPath));
+        }
+        catch (error) {
+            logger.debug(`[http] ignoring unreadable module cache metadata: ${error}`);
+            return null;
+        }
+    }
+    return {
+        async read(url, expectedIntegrity) {
+            if (!expectedIntegrity)
+                return null;
+            try {
+                const { sourcePath, metadataPath } = await cachePaths(url, expectedIntegrity);
+                if (!await fs.exists(sourcePath))
+                    return null;
+                const contents = await fs.readTextFile(sourcePath);
+                const integrity = await computeIntegrity(contents);
+                if (expectedIntegrity && integrity !== expectedIntegrity) {
+                    logger.warn(`[http] cached module integrity mismatch: ${url}`);
+                    return null;
+                }
+                const metadata = await readMetadata(metadataPath, fs);
+                if (metadata?.integrity && metadata.integrity !== integrity) {
+                    logger.warn(`[http] cached module metadata integrity mismatch: ${url}`);
+                    return null;
+                }
+                return contents;
+            }
+            catch (error) {
+                logger.debug(`[http] module cache read miss for ${url}: ${error}`);
+                return null;
+            }
+        },
+        async write(url, contents, resolvedUrl, integrity) {
+            try {
+                await fs.mkdir(cacheDir, { recursive: true });
+                const { sourcePath, metadataPath } = await cachePaths(url, integrity);
+                await fs.writeTextFile(sourcePath, contents);
+                await fs.writeTextFile(metadataPath, `${JSON.stringify({
+                    url,
+                    resolvedUrl,
+                    integrity,
+                    fetchedAt: new Date().toISOString(),
+                }, null, 2)}\n`);
+            }
+            catch (error) {
+                logger.debug(`[http] could not update module cache for ${url}: ${error}`);
+            }
+        },
+    };
+}
 export function createHTTPPlugin(options) {
     const opts = Array.isArray(options) ? { allowedHosts: options } : options;
     const { allowedHosts, strict = false } = opts;
     const lockfile = opts.lockfile ??
         (opts.projectDir ? createLockfileManager(opts.projectDir) : null);
+    const moduleCache = createHTTPModuleCache(opts.projectDir);
     return {
         name: "vf-api-http-fetch",
         setup(build) {
@@ -25,6 +98,27 @@ export function createHTTPPlugin(options) {
                     clearTimeout(timeout);
                 }
             }
+            function shouldRetryFetch(status) {
+                return status === 429 || status >= 500 || status === HTTP_NETWORK_CONNECT_TIMEOUT;
+            }
+            function delay(ms) {
+                return new Promise((resolve) => dntShim.setTimeout(resolve, ms));
+            }
+            async function fetchRemoteModule(url) {
+                for (let attempt = 1; attempt <= HTTP_MODULE_FETCH_MAX_ATTEMPTS; attempt += 1) {
+                    const response = await fetchWithTimeout(url).catch((error) => new Response(String(error?.message ?? error), {
+                        status: HTTP_NETWORK_CONNECT_TIMEOUT,
+                    }));
+                    if (!shouldRetryFetch(response.status) || attempt === HTTP_MODULE_FETCH_MAX_ATTEMPTS) {
+                        return response;
+                    }
+                    logger.warn(`[http] fetch attempt ${attempt} failed ${url} ${response.status}; retrying`);
+                    await delay(HTTP_MODULE_FETCH_RETRY_DELAY_MS * attempt);
+                }
+                return new Response("Remote module fetch failed", {
+                    status: HTTP_NETWORK_CONNECT_TIMEOUT,
+                });
+            }
             build.onResolve({ filter: /^(http|https):\/\// }, (args) => ({
                 path: args.path,
                 namespace: "http-url",
@@ -90,39 +184,62 @@ export function createHTTPPlugin(options) {
                 catch (e) {
                     logger.warn("API URL parse failed", e);
                 }
-                if (lockfile) {
-                    const cached = await lockfile.get(args.path);
-                    if (cached) {
-                        logger.debug(`[http] lockfile hit: ${args.path}`);
-                        try {
-                            const res = await fetchWithTimeout(cached.resolved);
-                            if (res.ok) {
-                                const text = await res.text();
-                                const integrity = await computeIntegrity(text);
-                                if (integrity === cached.integrity) {
-                                    return { contents: text, loader: "js" };
-                                }
-                                if (strict) {
-                                    return {
-                                        errors: [
-                                            {
-                                                text: `Integrity mismatch for ${args.path}: expected ${cached.integrity}, got ${integrity}`,
-                                            },
-                                        ],
-                                    };
-                                }
-                                logger.warn(`[http] integrity mismatch, refetching: ${args.path}`);
+                const readCachedModule = async (url, expectedIntegrity) => {
+                    if (!url || !moduleCache)
+                        return null;
+                    return await moduleCache.read(url, expectedIntegrity);
+                };
+                const lockfileEntry = lockfile ? await lockfile.get(args.path) : null;
+                if (lockfileEntry) {
+                    let canUseLockfileCacheFallback = true;
+                    logger.debug(`[http] lockfile hit: ${args.path}`);
+                    try {
+                        const res = await fetchRemoteModule(lockfileEntry.resolved);
+                        if (res.ok) {
+                            const text = await res.text();
+                            const integrity = await computeIntegrity(text);
+                            if (integrity === lockfileEntry.integrity) {
+                                await moduleCache?.write(args.path, text, lockfileEntry.resolved, integrity);
+                                await moduleCache?.write(lockfileEntry.resolved, text, lockfileEntry.resolved, integrity);
+                                return { contents: text, loader: "js" };
                             }
+                            if (strict) {
+                                return {
+                                    errors: [
+                                        {
+                                            text: `Integrity mismatch for ${args.path}: expected ${lockfileEntry.integrity}, got ${integrity}`,
+                                        },
+                                    ],
+                                };
+                            }
+                            canUseLockfileCacheFallback = false;
+                            logger.warn(`[http] integrity mismatch, refetching: ${args.path}`);
+                        }
+                        else {
+                            logger.warn(`[http] cached URL returned ${res.status}, trying module cache: ${args.path}`);
                         }
-                        catch (_error) {
-                            logger.warn(`[http] cached URL failed, refetching: ${args.path}`);
+                    }
+                    catch (_error) {
+                        logger.warn(`[http] cached URL failed, trying module cache: ${args.path}`);
+                    }
+                    if (canUseLockfileCacheFallback) {
+                        const cachedText = await readCachedModule(lockfileEntry.resolved, lockfileEntry.integrity) ??
+                            await readCachedModule(args.path, lockfileEntry.integrity);
+                        if (cachedText) {
+                            logger.warn(`[http] serving cached remote import for ${args.path}`);
+                            return { contents: cachedText, loader: "js" };
                         }
                     }
                 }
-                const res = await fetchWithTimeout(requestUrl).catch((e) => {
-                    return new Response(String(e?.message ?? e), { status: HTTP_NETWORK_CONNECT_TIMEOUT });
-                });
+                const res = await fetchRemoteModule(requestUrl);
                 if (!res.ok) {
+                    const cachedText = await readCachedModule(lockfileEntry?.resolved, lockfileEntry?.integrity) ??
+                        await readCachedModule(requestUrl, lockfileEntry?.integrity) ??
+                        await readCachedModule(args.path, lockfileEntry?.integrity);
+                    if (cachedText) {
+                        logger.warn(`[http] serving cached remote import for ${args.path}`);
+                        return { contents: cachedText, loader: "js" };
+                    }
                     logger.error(`[http] fetch failed ${requestUrl} ${res.status}`);
                     return {
                         errors: [
@@ -134,8 +251,8 @@ export function createHTTPPlugin(options) {
                 }
                 const text = await res.text();
                 const resolvedUrl = res.url || requestUrl;
+                const integrity = await computeIntegrity(text);
                 if (lockfile) {
-                    const integrity = await computeIntegrity(text);
                     await lockfile.set(args.path, {
                         resolved: resolvedUrl,
                         integrity,
@@ -144,6 +261,9 @@ export function createHTTPPlugin(options) {
                     await lockfile.flush();
                     logger.debug(`[http] lockfile updated: ${args.path} -> ${resolvedUrl}`);
                 }
+                await moduleCache?.write(args.path, text, resolvedUrl, integrity);
+                await moduleCache?.write(requestUrl, text, resolvedUrl, integrity);
+                await moduleCache?.write(resolvedUrl, text, resolvedUrl, integrity);
                 return { contents: text, loader: "js" };
             });
             logger.debug(`[API][http] resolvedUrls: ${resolvedUrls.length}, nodeMapped: ${nodeMapped.length}`);

package/esm/src/routing/api/module-loader/loader.js

@@ -253,7 +253,7 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
             plugins: [
                 createImportMapPlugin(projectDir, adapter, config),
                 createAdapterResolvePlugin(adapter, projectDir),
-                createHTTPPlugin(allowedHosts),
+                createHTTPPlugin({ allowedHosts, projectDir }),
             ],
         });
         if (result.errors?.length) {

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1005";
+export declare const VERSION = "0.1.1007";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1005";
+export const VERSION = "0.1.1007";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1005",
+  "version": "0.1.1007",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",