veryfront 0.1.1009 → 0.1.1011

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1009",
+    "version": "0.1.1011",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/agent/conversation/run-event-normalization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-event-normalization.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/conversation/run-event-normalization.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wCAAwC,QAAa,CAAC;AAQnE,KAAK,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,sDAAsD;AACtD,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM5E;AAED,oDAAoD;AACpD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,0BAA0B,GAChC,0BAA0B,EAAE,CAQ9B;AAgDD,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,0BAA0B,EAAE,GACnC,0BAA0B,EAAE,CAE9B"}
+{"version":3,"file":"run-event-normalization.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/conversation/run-event-normalization.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wCAAwC,QAAa,CAAC;AASnE,KAAK,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,sDAAsD;AACtD,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM5E;AAED,oDAAoD;AACpD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,0BAA0B,GAChC,0BAA0B,EAAE,CAQ9B;AA0CD,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,0BAA0B,EAAE,GACnC,0BAA0B,EAAE,CAE9B"}

package/esm/src/agent/conversation/run-event-normalization.js

@@ -1,4 +1,5 @@
 export const MAX_CONVERSATION_RUN_EVENT_PAYLOAD_BYTES = 240 * 1024;
+const OMITTED_CONVERSATION_RUN_EVENT_TYPE = "CUSTOM";
 const MAX_SUMMARY_DEPTH = 4;
 const MAX_SUMMARY_ARRAY_ITEMS = 8;
 const MAX_SUMMARY_OBJECT_KEYS = 24;
@@ -55,13 +56,7 @@ function enforceEventSizeLimit(event) {
             }
         }
     }
-    return {
-        type: event.type,
-        ...(typeof event.messageId === "string" ? { messageId: event.messageId } : {}),
-        ...(typeof event.toolCallId === "string" ? { toolCallId: event.toolCallId } : {}),
-        truncated: true,
-        note: "Conversation-run event payload exceeded the size limit and was omitted.",
-    };
+    return buildOmittedEvent(event);
 }
 /** Normalizes conversation run events. */
 export function normalizeConversationRunEvents(events) {
@@ -139,6 +134,36 @@ function truncateEventStringFieldToLimit(event, field, suffix) {
     }
     return buildCandidate(best);
 }
+function addStringFieldWithinLimit(event, field, value) {
+    const candidate = { ...event, [field]: value };
+    if (getConversationRunEventJsonByteLength(candidate) <= MAX_CONVERSATION_RUN_EVENT_PAYLOAD_BYTES) {
+        return candidate;
+    }
+    return truncateEventStringFieldToLimit(candidate, field, " [truncated]") ?? event;
+}
+function buildOmittedEvent(event) {
+    let omitted = {
+        type: OMITTED_CONVERSATION_RUN_EVENT_TYPE,
+        name: "conversation-run-event-omitted",
+        truncated: true,
+        note: "Conversation-run event payload exceeded the size limit and was omitted.",
+    };
+    omitted = addStringFieldWithinLimit(omitted, "originalType", event.type);
+    if (typeof event.messageId === "string") {
+        omitted = addStringFieldWithinLimit(omitted, "originalMessageId", event.messageId);
+    }
+    if (typeof event.toolCallId === "string") {
+        omitted = addStringFieldWithinLimit(omitted, "originalToolCallId", event.toolCallId);
+    }
+    if (getConversationRunEventJsonByteLength(omitted) <= MAX_CONVERSATION_RUN_EVENT_PAYLOAD_BYTES) {
+        return omitted;
+    }
+    return {
+        type: OMITTED_CONVERSATION_RUN_EVENT_TYPE,
+        name: "conversation-run-event-omitted",
+        truncated: true,
+    };
+}
 function summarizeGenericEvent(event) {
     const { type, ...rest } = event;
     return {
@@ -149,17 +174,38 @@ function summarizeGenericEvent(event) {
     };
 }
 function splitStringFieldEvent(event, field) {
-    const maxBytes = getStringFieldBudget(event, field);
-    const parts = splitUtf8String(event[field], maxBytes);
-    return parts.map((part) => ({ ...event, [field]: part }));
-}
-function getStringFieldBudget(event, field) {
-    const eventWithEmptyField = {
-        ...event,
-        [field]: "",
-    };
-    return Math.max(1, MAX_CONVERSATION_RUN_EVENT_PAYLOAD_BYTES -
-        getConversationRunEventJsonByteLength(eventWithEmptyField));
+    const value = event[field];
+    const buildPart = (slice) => ({ ...event, [field]: slice });
+    const parts = [];
+    let startIndex = 0;
+    while (startIndex < value.length) {
+        // Largest prefix whose WHOLE serialized event fits the byte limit. Measuring the
+        // event (not the raw slice) keeps the split correct for escape-heavy content that
+        // expands under JSON.stringify — the same unit the API enforces — so every part
+        // fits without the size-limit backstop having to truncate (drop) any data.
+        let low = startIndex + 1;
+        let high = value.length;
+        let bestEndIndex = -1;
+        while (low <= high) {
+            const mid = Math.floor((low + high) / 2);
+            if (getConversationRunEventJsonByteLength(buildPart(value.slice(startIndex, mid))) <=
+                MAX_CONVERSATION_RUN_EVENT_PAYLOAD_BYTES) {
+                bestEndIndex = mid;
+                low = mid + 1;
+            }
+            else {
+                high = mid - 1;
+            }
+        }
+        if (bestEndIndex <= startIndex) {
+            // Even a single character overflows the envelope; hand off to the size-limit
+            // backstop rather than loop forever emitting zero-progress parts.
+            return [event];
+        }
+        parts.push(buildPart(value.slice(startIndex, bestEndIndex)));
+        startIndex = bestEndIndex;
+    }
+    return parts.length > 0 ? parts : [event];
 }
 function splitUtf8String(value, maxBytes) {
     if (encoder.encode(value).byteLength <= maxBytes) {

package/esm/src/routing/api/module-loader/esbuild-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAO5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CA6Q9E"}
+{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAsR9E"}

package/esm/src/routing/api/module-loader/esbuild-plugin.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../../../_dnt.shims.js";
 import { computeHash, computeIntegrity, createLockfileManager, HTTP_MODULE_FETCH_TIMEOUT_MS, HTTP_NETWORK_CONNECT_TIMEOUT, serverLogger, } from "../../../utils/index.js";
 import { createFileSystem } from "../../../platform/compat/fs.js";
 import * as pathHelper from "../../../platform/compat/path/index.js";
+import { isAllowedRemoteHost } from "./http-validator.js";
 const logger = serverLogger.component("api");
 const HTTP_MODULE_CACHE_DIR = ".veryfront/cache/api-http-imports";
 const HTTP_MODULE_FETCH_MAX_ATTEMPTS = 3;
@@ -111,15 +112,25 @@ export function createHTTPPlugin(options) {
                 const name = error.name || "Error";
                 return typeof code === "string" && code ? `${name}(${code})` : name;
             }
+            function isReadOnlyFileSystemError(error) {
+                if (error == null)
+                    return false;
+                const message = error instanceof Error ? error.message : String(error);
+                if (/read-only file ?system|os error 30|erofs/i.test(message))
+                    return true;
+                return error instanceof Error && isReadOnlyFileSystemError(error.cause);
+            }
             async function persistLockfileEntry(url, entry) {
                 if (!lockfile)
                     return;
+                await lockfile.set(url, entry);
                 try {
-                    await lockfile.set(url, entry);
                     await lockfile.flush();
                     logger.debug(`[http] lockfile updated: ${url} -> ${entry.resolved}`);
                 }
                 catch (error) {
+                    if (!isReadOnlyFileSystemError(error))
+                        throw error;
                     logger.warn(`[http] could not persist lockfile entry for ${url}: ${describePersistenceError(error)}`);
                 }
             }
@@ -177,14 +188,12 @@ export function createHTTPPlugin(options) {
                 try {
                     const u = new URL(args.path);
                     if (allowedHosts?.length) {
-                        const hostUrl = `${u.protocol}//${u.host}`;
-                        const isAllowed = allowedHosts.some((h) => hostUrl.startsWith(h));
-                        if (!isAllowed) {
-                            const remediation = `Add "${hostUrl}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
+                        if (!isAllowedRemoteHost(u, allowedHosts)) {
+                            const remediation = `Add "${u.origin}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
                             return {
                                 errors: [
                                     {
-                                        text: `Remote import blocked by allow-list: ${hostUrl}. ${remediation}`,
+                                        text: `Remote import blocked by allow-list: ${u.origin}. ${remediation}`,
                                     },
                                 ],
                             };

package/esm/src/routing/api/module-loader/http-validator.d.ts

@@ -1,2 +1,3 @@
+export declare function isAllowedRemoteHost(url: URL, allowedHosts: string[]): boolean;
 export declare function validateHTTPImports(source: string, allowedHosts: string[]): void;
 //# sourceMappingURL=http-validator.d.ts.map

package/esm/src/routing/api/module-loader/http-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-validator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/http-validator.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAmChF"}
+{"version":3,"file":"http-validator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/http-validator.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAQ7E;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAiChF"}

package/esm/src/routing/api/module-loader/http-validator.js

@@ -1,4 +1,14 @@
 import { createError, toError } from "../../../errors/veryfront-error.js";
+export function isAllowedRemoteHost(url, allowedHosts) {
+    return allowedHosts.some((host) => {
+        try {
+            return new URL(host).origin === url.origin;
+        }
+        catch (_) {
+            return false;
+        }
+    });
+}
 export function validateHTTPImports(source, allowedHosts) {
     if (!allowedHosts?.length)
         return;
@@ -9,22 +19,20 @@ export function validateHTTPImports(source, allowedHosts) {
         const url = match[0].match(/https?:\/\/[^'"]+/)?.[0];
         if (!url)
             continue;
-        let hostUrl;
+        let u;
         try {
-            const u = new URL(url);
-            hostUrl = `${u.protocol}//${u.host}`;
+            u = new URL(url);
         }
         catch (_) {
             /* expected: URL may be malformed */
             continue;
         }
-        const isAllowed = allowedHosts.some((h) => hostUrl.startsWith(h));
-        if (isAllowed)
+        if (isAllowedRemoteHost(u, allowedHosts))
             continue;
-        const remediation = `Add "${hostUrl}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
+        const remediation = `Add "${u.origin}" to security.remoteHosts in veryfront.config.(ts|js) or replace with an approved CDN (e.g., https://esm.sh).`;
         throw toError(createError({
             type: "api",
-            message: `[API] handler build failed: Remote import blocked by allow-list: ${hostUrl}. ${remediation}`,
+            message: `[API] handler build failed: Remote import blocked by allow-list: ${u.origin}. ${remediation}`,
         }));
     }
 }

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1009";
+export declare const VERSION = "0.1.1011";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1009";
+export const VERSION = "0.1.1011";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1009",
+  "version": "0.1.1011",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",