veryfront 0.1.1009 → 0.1.1010

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1009",
+    "version": "0.1.1010",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/routing/api/module-loader/esbuild-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAO5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CA6Q9E"}
+{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAsR9E"}

package/esm/src/routing/api/module-loader/esbuild-plugin.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../../../_dnt.shims.js";
 import { computeHash, computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
 import { createFileSystem } from "../../../platform/compat/fs.js";
 import * as pathHelper from "../../../platform/compat/path/index.js";
+import { isAllowedRemoteHost } from "./http-validator.js";
 const logger = serverLogger.component("api");
 const HTTP_MODULE_CACHE_DIR = ".veryfront/cache/api-http-imports";
 const HTTP_MODULE_FETCH_MAX_ATTEMPTS = 3;
@@ -111,15 +112,25 @@ export function createHTTPPlugin(options) {
                 const name = error.name || "Error";
                 return typeof code === "string" && code ? `${name}(${code})` : name;
             }
+            function isReadOnlyFileSystemError(error) {
+                if (error == null)
+                    return false;
+                const message = error instanceof Error ? error.message : String(error);
+                if (/read-only file ?system|os error 30|erofs/i.test(message))
+                    return true;
+                return error instanceof Error && isReadOnlyFileSystemError(error.cause);
+            }
             async function persistLockfileEntry(url, entry) {
                 if (!lockfile)
                     return;
+                await lockfile.set(url, entry);
                 try {
-                    await lockfile.set(url, entry);
                     await lockfile.flush();
                     logger.debug(`[http] lockfile updated: ${url} -> ${entry.resolved}`);
                 }
                 catch (error) {
+                    if (!isReadOnlyFileSystemError(error))
+                        throw error;
                     logger.warn(`[http] could not persist lockfile entry for ${url}: ${describePersistenceError(error)}`);
                 }
             }
@@ -177,14 +188,12 @@ export function createHTTPPlugin(options) {
                 try {
                     const u = new URL(args.path);
                     if (allowedHosts?.length) {
-                        const hostUrl = `${u.protocol}//${u.host}`;
-                        const isAllowed = allowedHosts.some((h) => hostUrl.startsWith(h));
-                        if (!isAllowed) {
-                            const remediation = `Add "${hostUrl}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
+                        if (!isAllowedRemoteHost(u, allowedHosts)) {
+                            const remediation = `Add "${u.origin}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
                             return {
                                 errors: [
                                     {
-                                        text: `Remote import blocked by allow-list: ${hostUrl}. ${remediation}`,
+                                        text: `Remote import blocked by allow-list: ${u.origin}. ${remediation}`,
                                     },
                                 ],
                             };

package/esm/src/routing/api/module-loader/http-validator.d.ts

@@ -1,2 +1,3 @@
+export declare function isAllowedRemoteHost(url: URL, allowedHosts: string[]): boolean;
 export declare function validateHTTPImports(source: string, allowedHosts: string[]): void;
 //# sourceMappingURL=http-validator.d.ts.map

package/esm/src/routing/api/module-loader/http-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-validator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/http-validator.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAmChF"}
+{"version":3,"file":"http-validator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/http-validator.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAQ7E;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAiChF"}

package/esm/src/routing/api/module-loader/http-validator.js

@@ -1,4 +1,14 @@
 import { createError, toError } from "../../../errors/veryfront-error.js";
+export function isAllowedRemoteHost(url, allowedHosts) {
+    return allowedHosts.some((host) => {
+        try {
+            return new URL(host).origin === url.origin;
+        }
+        catch (_) {
+            return false;
+        }
+    });
+}
 export function validateHTTPImports(source, allowedHosts) {
     if (!allowedHosts?.length)
         return;
@@ -9,22 +19,20 @@ export function validateHTTPImports(source, allowedHosts) {
         const url = match[0].match(/https?:\/\/[^'"]+/)?.[0];
         if (!url)
             continue;
-        let hostUrl;
+        let u;
         try {
-            const u = new URL(url);
-            hostUrl = `${u.protocol}//${u.host}`;
+            u = new URL(url);
         }
         catch (_) {
             /* expected: URL may be malformed */
             continue;
         }
-        const isAllowed = allowedHosts.some((h) => hostUrl.startsWith(h));
-        if (isAllowed)
+        if (isAllowedRemoteHost(u, allowedHosts))
             continue;
-        const remediation = `Add "${hostUrl}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
+        const remediation = `Add "${u.origin}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
         throw toError(createError({
             type: "api",
-            message: `[API] handler build failed: Remote import blocked by allow-list: ${hostUrl}. ${remediation}`,
+            message: `[API] handler build failed: Remote import blocked by allow-list: ${u.origin}. ${remediation}`,
         }));
     }
 }

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1009";
+export declare const VERSION = "0.1.1010";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1009";
+export const VERSION = "0.1.1010";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1009",
+  "version": "0.1.1010",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",