veryfront 0.1.1047 → 0.1.1049

package/esm/src/rendering/ssr-renderer.js

@@ -5,8 +5,9 @@ import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../observability/tracing/span-names.js";
 import { streamToString } from "./utils/index.js";
 import { setupSSRGlobals } from "./ssr-globals.js";
-function supportsStreamingSSR(versionInfo) {
-    return versionInfo.isReact18 || versionInfo.isReact19;
+import { normalizeReactVersion, resolveProjectReactVersion, stripSemverRange, } from "../transforms/esm/package-registry.js";
+function supportsStreamingReactVersion(version) {
+    return Number(version.split(".")[0]) >= 18;
 }
 async function pipeToString(pipeFn) {
     const { PassThrough } = await import("node:stream");
@@ -71,61 +72,66 @@ function pipeToReadableStream(pipeFn, abortFn) {
 }
 export class SSRRenderer {
     mode;
-    adapter;
     projectDir;
-    projectId;
-    versionInfo = null;
-    constructor(mode, adapter, projectDir, projectId) {
+    config;
+    reactVersionPromise = null;
+    resolvedReactVersion = null;
+    constructor(mode, _adapter, projectDir, _projectId, config) {
         this.mode = mode;
-        this.adapter = adapter;
         this.projectDir = projectDir;
-        this.projectId = projectId;
-    }
-    async getVersionInfo() {
-        if (this.versionInfo)
-            return this.versionInfo;
-        if (!this.projectDir) {
-            this.versionInfo = getReactVersionInfo();
-            return this.versionInfo;
+        this.config = config;
+        const legacyVersions = config?.client?.cdn?.versions;
+        const configuredVersion = config?.react?.version ??
+            (legacyVersions && legacyVersions !== "auto" ? legacyVersions.react : undefined);
+        if (configuredVersion) {
+            this.resolvedReactVersion = normalizeReactVersion(stripSemverRange(configuredVersion));
         }
-        const { getReactVersionInfoForProject } = await import("../react/index.js");
-        this.versionInfo = await getReactVersionInfoForProject(this.projectDir, this.projectId);
-        return this.versionInfo;
+    }
+    async getReactVersion() {
+        if (this.resolvedReactVersion)
+            return this.resolvedReactVersion;
+        this.reactVersionPromise ??= resolveProjectReactVersion({
+            projectDir: this.projectDir,
+            config: this.config,
+        });
+        this.resolvedReactVersion = await this.reactVersionPromise;
+        return this.resolvedReactVersion;
     }
     async renderToHTML(pageElement, options) {
         setupSSRGlobals();
-        const versionInfo = await this.getVersionInfo();
+        const reactVersion = await this.getReactVersion();
         const wantsStreamingMode = this.mode === "production" || options.wantsStream;
         const compiledBinary = isCompiledBinary();
         if (compiledBinary && wantsStreamingMode) {
             logger.debug("Streaming SSR disabled in compiled binary (using string rendering)", {
-                reactVersion: versionInfo.version,
+                reactVersion,
                 reason: "Workers with blob URLs not supported in deno compile binaries",
             });
         }
         const useStreaming = !compiledBinary &&
             wantsStreamingMode &&
-            supportsStreamingSSR(versionInfo);
+            supportsStreamingReactVersion(reactVersion);
         if (!useStreaming) {
             logger.debug("Using string SSR", {
                 mode: this.mode,
-                reactVersion: versionInfo.version,
+                reactVersion,
             });
-            const html = await withSpan(SpanNames.SSR_REACT_RENDER, () => renderToStringAdapter(pageElement), {
+            const html = await withSpan(SpanNames.SSR_REACT_RENDER, () => renderToStringAdapter(pageElement, { reactVersion }), {
                 "ssr.method": "string",
-                "ssr.react_version": versionInfo.version,
+                "ssr.react_version": reactVersion,
             });
             return { html, stream: null };
         }
         logger.debug("Rendering via streaming adapter", {
-            reactVersion: versionInfo.version,
+            reactVersion,
             delivery: options.wantsStream ? "stream" : "string",
         });
         const renderResult = await withSpan(SpanNames.SSR_REACT_RENDER, () => renderToStreamAdapter(pageElement, {
             identifierPrefix: "vf",
+            reactVersion,
         }), {
             "ssr.method": "streaming",
-            "ssr.react_version": versionInfo.version,
+            "ssr.react_version": reactVersion,
             "ssr.wants_stream": options.wantsStream,
         });
         if (renderResult.stream) {
@@ -158,12 +164,12 @@ export class SSRRenderer {
         });
     }
     getRenderingStrategy() {
-        const versionInfo = getReactVersionInfo();
-        const hasStreamingSupport = supportsStreamingSSR(versionInfo);
+        const reactVersion = this.resolvedReactVersion ?? getReactVersionInfo().version;
+        const hasStreamingSupport = supportsStreamingReactVersion(reactVersion);
         const useStreaming = this.mode === "production" && hasStreamingSupport;
         return {
             method: useStreaming ? "streaming" : "string",
-            reactVersion: versionInfo.version,
+            reactVersion,
             features: {
                 streaming: hasStreamingSupport,
                 suspense: hasStreamingSupport,
@@ -172,6 +178,7 @@ export class SSRRenderer {
         };
     }
     supportsStreaming() {
-        return supportsStreamingSSR(getReactVersionInfo());
+        const reactVersion = this.resolvedReactVersion ?? getReactVersionInfo().version;
+        return supportsStreamingReactVersion(reactVersion);
     }
 }

package/esm/src/rendering/utils/react-helpers.d.ts

@@ -1,4 +1,4 @@
-import * as React from "../../../react/react.js";
+import * as React from "react";
 import type { MDXComponents } from "../../types/index.js";
 export declare const normalizeChild: (child: React.ReactNode) => React.ReactNode;
 export declare function createDefaultMDXComponents(): MDXComponents;

package/esm/src/rendering/utils/react-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react-helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/utils/react-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,yBAAyB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAO,MAAM,cAAc,UAGV,KAAK,CAAC,SAAS,KAAG,KAAK,CAAC,SAoBrC,CAAC;AAEL,wBAAgB,0BAA0B,IAAI,aAAa,CAE1D"}
+{"version":3,"file":"react-helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/utils/react-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAO,MAAM,cAAc,UAGV,KAAK,CAAC,SAAS,KAAG,KAAK,CAAC,SAoBrC,CAAC;AAEL,wBAAgB,0BAA0B,IAAI,aAAa,CAE1D"}

package/esm/src/rendering/utils/react-helpers.js

@@ -1,4 +1,4 @@
-import * as React from "../../../react/react.js";
+import * as React from "react";
 export const normalizeChild = (() => {
     const cache = new WeakMap();
     return (child) => {

package/esm/src/routing/api/api-route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/api-route-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAW9D,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAsC;;IAUxD,wCAAwC;IACxC,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEpC;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAuD7C,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAgB5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAoBtC,OAAO,CAAC,aAAa;IAiCrB,UAAU,IAAI,KAAK,EAAE;IAIrB,KAAK,IAAI,IAAI;IAKb,UAAU,IAAI,IAAI;IAIlB,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"api-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/api-route-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAY9D,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAsC;;IAUxD,wCAAwC;IACxC,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEpC;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAqB7C,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAgB5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAoBtC,OAAO,CAAC,aAAa;IAiCrB,UAAU,IAAI,KAAK,EAAE;IAIrB,KAAK,IAAI,IAAI;IAKb,UAAU,IAAI,IAAI;IAIlB,OAAO,IAAI,IAAI;CAGhB"}

package/esm/src/routing/api/api-route-matcher.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../../_dnt.shims.js";
 import { getDisableLruIntervalEnv } from "../../config/env.js";
 import { LRUCache } from "../../utils/lru-wrapper.js";
 import { safeDecodeParam } from "../matchers/decode-param.js";
+import { parseRoute } from "../matchers/route-parser.js";
 /** Max entries in the route-match LRU cache */
 const ROUTE_CACHE_MAX_ENTRIES = 500;
 /** Time-to-live for cached route matches (5 minutes) */
@@ -26,45 +27,17 @@ export class ApiRouteMatcher {
         return this._routes;
     }
     addRoute(pattern, page) {
-        const originalPattern = pattern;
-        let regex = pattern;
-        let isOptionalCatchAll = false;
-        let isCatchAll = false;
-        const paramNames = [];
-        for (const match of originalPattern.matchAll(/\[\[\.\.\.(\w+)\]\]|\[\.\.\.(\w+)\]|\[(\w+)\]/g)) {
-            const optionalCatchAll = match[1];
-            const catchAll = match[2];
-            const param = match[3];
-            if (optionalCatchAll) {
-                paramNames.push(optionalCatchAll);
-                isOptionalCatchAll = true;
-                isCatchAll = true;
-                continue;
-            }
-            if (catchAll) {
-                paramNames.push(catchAll);
-                isCatchAll = true;
-                continue;
-            }
-            if (param)
-                paramNames.push(param);
-        }
-        regex = regex
-            .replace(/\/?\[\[\.\.\.([^\]]+)\]\]/g, "(?:/(.+))?")
-            .replace(/\[\.\.\.([^\]]+)\]/g, "(.+)")
-            .replace(/\[([^\]]+)\]/g, "([^/]+)");
         if (pattern !== "/" && pattern.endsWith("/")) {
             pattern = pattern.slice(0, -1);
-            if (regex.endsWith("/"))
-                regex = regex.slice(0, -1);
         }
+        const parsed = parseRoute(pattern, page);
         const route = { pattern, page };
         this._routes.set(pattern, {
-            regex: new RegExp(`^${regex}$`),
+            regex: parsed.regex,
             route,
-            paramNames,
-            isOptionalCatchAll,
-            isCatchAll,
+            paramNames: parsed.paramNames,
+            isOptionalCatchAll: parsed.isOptionalCatchAll,
+            isCatchAll: parsed.isCatchAll,
         });
         // A path may have been negatively cached (null / 404) before this route was
         // registered (dev hot-reload / late route discovery). Invalidate so the newly

package/esm/src/routing/api/module-loader/esbuild-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAsR9E"}
+{"version":3,"file":"esbuild-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/esbuild-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAW,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CA0R9E"}

package/esm/src/routing/api/module-loader/esbuild-plugin.js

@@ -80,6 +80,7 @@ export function createHTTPPlugin(options) {
     const lockfile = opts.lockfile ??
         (opts.projectDir ? createLockfileManager(opts.projectDir) : null);
     const moduleCache = createHTTPModuleCache(opts.projectDir);
+    let lockfileFlushDisabled = false;
     return {
         name: "vf-api-http-fetch",
         setup(build) {
@@ -124,6 +125,8 @@ export function createHTTPPlugin(options) {
                 if (!lockfile)
                     return;
                 await lockfile.set(url, entry);
+                if (lockfileFlushDisabled)
+                    return;
                 try {
                     await lockfile.flush();
                     logger.debug(`[http] lockfile updated: ${url} -> ${entry.resolved}`);
@@ -131,7 +134,8 @@ export function createHTTPPlugin(options) {
                 catch (error) {
                     if (!isReadOnlyFileSystemError(error))
                         throw error;
-                    logger.warn(`[http] could not persist lockfile entry for ${url}: ${describePersistenceError(error)}`);
+                    lockfileFlushDisabled = true;
+                    logger.debug(`[http] lockfile flush disabled on read-only filesystem for ${url}: ${describePersistenceError(error)}`);
                 }
             }
             async function fetchRemoteModule(url) {

package/esm/src/routing/client/navigation-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation-handlers.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/client/navigation-handlers.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,eAAe,CAA4D;IACnF,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAA0C;gBAG/D,aAAa,SAA4B,EACzC,eAAe,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;IAM/D,kBAAkB,CAAC,SAAS,EAAE,mBAAmB,IACvC,OAAO,UAAU;IAc3B,qBAAqB,CAAC,SAAS,EAAE,mBAAmB,IAC1C,QAAQ,aAAa;IAM/B,sBAAsB,CAAC,SAAS,EAAE,mBAAmB,IAC3C,OAAO,UAAU;IAsB3B,OAAO,CAAC,qBAAqB;IAO7B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAoBtC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IASvC,UAAU,IAAI,OAAO;IAIrB,iBAAiB,IAAI,IAAI;IAIzB,KAAK,IAAI,IAAI;CAOd"}
+{"version":3,"file":"navigation-handlers.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/client/navigation-handlers.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,eAAe,CAA4D;IACnF,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAA0C;gBAG/D,aAAa,SAA4B,EACzC,eAAe,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;IAM/D,kBAAkB,CAAC,SAAS,EAAE,mBAAmB,IACvC,OAAO,UAAU;IAc3B,qBAAqB,CAAC,SAAS,EAAE,mBAAmB,IAC1C,QAAQ,aAAa;IAO/B,sBAAsB,CAAC,SAAS,EAAE,mBAAmB,IAC3C,OAAO,UAAU;IAsB3B,OAAO,CAAC,qBAAqB;IAO7B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAoBtC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IASvC,UAAU,IAAI,OAAO;IAIrB,iBAAiB,IAAI,IAAI;IAIzB,KAAK,IAAI,IAAI;CAOd"}

package/esm/src/routing/client/navigation-handlers.js

@@ -32,7 +32,8 @@ export class NavigationHandlers {
     createPopStateHandler(callbacks) {
         return (_event) => {
             this.isPopStateNav = true;
-            callbacks.onNavigate(globalThis.location.pathname);
+            const { pathname, search, hash } = globalThis.location;
+            callbacks.onNavigate(`${pathname}${search}${hash}`);
         };
     }
     createMouseOverHandler(callbacks) {

package/esm/src/routing/client/page-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page-loader.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/client/page-loader.ts"],"names":[],"mappings":"AAIA,YAAY,EACV,YAAY,EACZ,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAMzD,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,kBAAkB,CAA2C;IAErE,OAAO,CAAC,WAAW;IAOnB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI9C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAK7C,UAAU,IAAI,IAAI;IAOlB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAInD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI;IAK5C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YAIvC,YAAY;YAcZ,iBAAiB;IAmB/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAsBpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAerC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAqB1D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB7C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAetD,OAAO,CAAC,oBAAoB;CAgB7B"}
+{"version":3,"file":"page-loader.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/client/page-loader.ts"],"names":[],"mappings":"AAIA,YAAY,EACV,YAAY,EACZ,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAMzD,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,kBAAkB,CAA2C;IAErE,OAAO,CAAC,WAAW;IAOnB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI9C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAK7C,UAAU,IAAI,IAAI;IAOlB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAInD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI;IAK5C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YAIvC,YAAY;YAgBZ,iBAAiB;IAmB/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAsBpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAerC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAwB1D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB7C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAetD,OAAO,CAAC,oBAAoB;CAgB7B"}

package/esm/src/routing/client/page-loader.js

@@ -46,7 +46,9 @@ export class PageLoader {
     }
     async tryFetchJSON(path) {
         try {
-            const response = await fetch(`/_veryfront/data${path}.json`, {
+            const navigationUrl = new URL(path, "http://veryfront.local");
+            const dataPath = navigationUrl.pathname === "/" ? "/index" : navigationUrl.pathname;
+            const response = await fetch(`/_veryfront/data${dataPath}.json${navigationUrl.search}`, {
                 headers: { "X-Veryfront-Navigation": "client" },
             });
             if (!response.ok)
@@ -103,8 +105,11 @@ export class PageLoader {
         }
     }
     async fetchSpaPageData(path) {
-        const normalizedPath = path === "/" ? "" : path.replace(/^\//, "");
-        const endpoint = `/_veryfront/page-data/${normalizedPath}.json`;
+        const navigationUrl = new URL(path, "http://veryfront.local");
+        const normalizedPath = navigationUrl.pathname === "/"
+            ? "index"
+            : navigationUrl.pathname.replace(/^\//, "");
+        const endpoint = `/_veryfront/page-data/${normalizedPath}.json${navigationUrl.search}`;
         logger.debug(`Fetching SPA page data from ${endpoint}`);
         const response = await fetch(endpoint, {
             headers: { "X-Veryfront-Navigation": "spa" },

package/esm/src/routing/matchers/route-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/matchers/route-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CA8C/D;AAgBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAIxD"}
+{"version":3,"file":"route-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/matchers/route-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAQxC,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAuD/D;AAgBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAIxD"}

package/esm/src/routing/matchers/route-parser.js

@@ -1,36 +1,50 @@
+const ROUTE_PARAMETER_PATTERN = /\[\[\.\.\.(\w+)\]\]|\[\.\.\.(\w+)\]|\[(\w+)\]/g;
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 export function parseRoute(pattern, page) {
     const paramNames = [];
     let isCatchAll = false;
     let isOptionalCatchAll = false;
-    for (const match of pattern.matchAll(/\[\[\.\.\.(\w+)\]\]|\[\.\.\.(\w+)\]|\[(\w+)\]/g)) {
+    let regexPattern = "";
+    let cursor = 0;
+    for (const match of pattern.matchAll(ROUTE_PARAMETER_PATTERN)) {
+        const matchIndex = match.index;
+        const matchedText = match[0];
+        let literal = pattern.slice(cursor, matchIndex);
         const optionalCatchAll = match[1];
         if (optionalCatchAll) {
             paramNames.push(optionalCatchAll);
             isOptionalCatchAll = true;
             isCatchAll = true;
+            const isTrailingSegment = matchIndex + matchedText.length === pattern.length &&
+                literal.endsWith("/");
+            if (isTrailingSegment) {
+                literal = literal.slice(0, -1);
+                regexPattern += `${escapeRegex(literal)}(?:/(.*))?`;
+            }
+            else {
+                regexPattern += `${escapeRegex(literal)}(.*)`;
+            }
+            cursor = matchIndex + matchedText.length;
             continue;
         }
         const catchAll = match[2];
         if (catchAll) {
             paramNames.push(catchAll);
             isCatchAll = true;
+            regexPattern += `${escapeRegex(literal)}(.+)`;
+            cursor = matchIndex + matchedText.length;
             continue;
         }
         const param = match[3];
-        if (param)
+        if (param) {
             paramNames.push(param);
+            regexPattern += `${escapeRegex(literal)}([^/]+)`;
+            cursor = matchIndex + matchedText.length;
+        }
     }
-    let regexPattern = pattern
-        .replace(/\[\[\.\.\.(\w+)\]\]/g, "___OPTIONAL_CATCHALL___")
-        .replace(/\[\.\.\.(\w+)\]/g, "___CATCHALL___")
-        .replace(/\[(\w+)\]/g, "___PARAM___")
-        .replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&")
-        .replace(/___OPTIONAL_CATCHALL___/g, "(.*)")
-        .replace(/___CATCHALL___/g, "(.+)")
-        .replace(/___PARAM___/g, "([^/]+)");
-    if (isOptionalCatchAll) {
-        regexPattern = regexPattern.replace(/\\\/\(\.\*\)$/, "(?:\\/(.*))?");
-    }
+    regexPattern += escapeRegex(pattern.slice(cursor));
     return {
         pattern,
         page,

package/esm/src/security/client/html-sanitizer.d.ts

@@ -1,5 +1,6 @@
 import { escapeHtml } from "../../html/html-escape.js";
 export { escapeHtml };
+export declare function escapeInlineJsonText(value: string): string;
 export declare function jsonForInlineScript(value: unknown, space?: string | number): string;
 export declare function buildTrustedHtmlValidatorScript(): string;
 interface ValidateTrustedHtmlOptions {

package/esm/src/security/client/html-sanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-sanitizer.d.ts","sourceRoot":"","sources":["../../../../src/src/security/client/html-sanitizer.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,CAAC;AAoBtB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAOnF;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAwBxD;AAiBD,UAAU,0BAA0B;IAClC,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtC,GAAG,cAAc,CA+BjB"}
+{"version":3,"file":"html-sanitizer.d.ts","sourceRoot":"","sources":["../../../../src/src/security/client/html-sanitizer.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,CAAC;AAoBtB,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEnF;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAwBxD;AAiBD,UAAU,0BAA0B;IAClC,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtC,GAAG,cAAc,CA+BjB"}

package/esm/src/security/client/html-sanitizer.js

@@ -25,14 +25,17 @@ function createSuspiciousPatterns() {
         name,
     }));
 }
-export function jsonForInlineScript(value, space) {
-    return JSON.stringify(value, null, space)
+export function escapeInlineJsonText(value) {
+    return value
         .replace(/</g, "\\u003c")
         .replace(/>/g, "\\u003e")
         .replace(/&/g, "\\u0026")
         .replace(/\u2028/g, "\\u2028")
         .replace(/\u2029/g, "\\u2029");
 }
+export function jsonForInlineScript(value, space) {
+    return escapeInlineJsonText(JSON.stringify(value, null, space));
+}
 export function buildTrustedHtmlValidatorScript() {
     const specsJson = jsonForInlineScript(SUSPICIOUS_PATTERN_SPECS);
     return `

package/esm/src/security/http/base-handler.d.ts

@@ -1,5 +1,6 @@
 import type { Handler, HandlerContext, HandlerMetadata, HandlerResult } from "../../types/index.js";
 import type { WebSocketUpgradeResponse } from "../../platform/adapters/base.js";
+import type { RequestTokenTrust } from "../../platform/adapters/fs/veryfront/request-context.js";
 import { ResponseBuilder } from "./response/index.js";
 export interface HandlerHelpers {
     createResponseBuilder: (ctx: HandlerContext, nonce?: string) => ResponseBuilder;
@@ -23,6 +24,7 @@ export declare abstract class BaseHandler implements Handler {
     protected respond(response: Response | WebSocketUpgradeResponse, metadata?: Record<string, unknown>): HandlerResult;
     protected withProxyContext<T>(ctx: HandlerContext, fn: () => Promise<T>, options?: {
         requireToken?: boolean;
+        tokenTrust?: RequestTokenTrust;
     }): Promise<T>;
 }
 //# sourceMappingURL=base-handler.d.ts.map

package/esm/src/security/http/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAIhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,CAAC,CAAC;CAmFd"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yDAAyD,CAAC;AAEjG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAIhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,iBAAiB,CAAA;KAAO,GACvE,OAAO,CAAC,CAAC,CAAC;CAqFd"}

package/esm/src/security/http/base-handler.js

@@ -106,6 +106,7 @@ export class BaseHandler {
                 releaseId: ctx.releaseId,
                 branch,
                 environmentName: ctx.environmentName,
+                tokenTrust: options.tokenTrust,
             });
         }
         if (typeof fsWrapper.setRequestToken === "function" && effectiveToken) {

package/esm/src/security/http/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IARzB,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA;IAGpC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAQrB,IAAI;IAgBlB,OAAO,CAAC,WAAW;IAuBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IASnE,KAAK,IAAI,IAAI;CAMd"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IARzB,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA;IAGpC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAkBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAuBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IASnE,KAAK,IAAI,IAAI;CAMd"}

package/esm/src/security/http/config.js

@@ -21,25 +21,24 @@ export class SecurityConfigLoader {
             return;
         if (this.loadPromise)
             return this.loadPromise;
-        this.loadPromise = this.load();
-        return this.loadPromise;
-    }
-    async load() {
+        const loadPromise = this.load();
+        this.loadPromise = loadPromise;
         try {
-            const cfg = this.configOverride ?? (await getConfig(this.projectDir, this.adapter));
-            this.applyConfig(cfg);
+            await loadPromise;
         }
         catch (error) {
-            // A legitimately-absent config resolves (no throw) and is applied above.
-            // Reaching here means loading actually failed (e.g. transient FS error or
-            // a parse failure). Do NOT mark as loaded: marking loaded here would leave
-            // securityConfig null for the process lifetime, silently disabling CORS,
-            // CSRF, and CSP. Instead fail loud and clear loadPromise so the next
-            // ensureLoaded() retries rather than permanently degrading security.
+            // Fail this request closed, but allow a later request to retry after a
+            // transient filesystem, import, or parse failure.
+            if (Object.is(this.loadPromise, loadPromise))
+                this.loadPromise = null;
             logger.error("Failed to load security config; will retry on next request", { error });
-            this.loadPromise = null;
+            throw error;
         }
     }
+    async load() {
+        const cfg = this.configOverride ?? (await getConfig(this.projectDir, this.adapter));
+        this.applyConfig(cfg);
+    }
     applyConfig(cfg) {
         const security = cfg?.security ? { ...cfg.security } : {};
         if (security.headers)

package/esm/src/server/build-app-route-renderer.d.ts

@@ -3,6 +3,7 @@
  */
 import type { RuntimeAdapter } from "../platform/adapters/base.js";
 import type { ReleaseAssetManifest } from "../release-assets/manifest-schema.js";
+import type { VeryfrontConfig } from "../config/index.js";
 /**
  * Render an App Router route to HTML
  */
@@ -13,6 +14,7 @@ export declare function renderAppRouteToHTML(args: {
     pageFile: string;
     contentSourceId: string;
     reactVersion?: string;
+    config?: VeryfrontConfig;
     releaseAssetManifest?: ReleaseAssetManifest | null;
     stylesheetHref?: string;
     includePreviewStylesheet?: boolean;

package/esm/src/server/build-app-route-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-app-route-renderer.d.ts","sourceRoot":"","sources":["../../../src/src/server/build-app-route-renderer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAMnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AA4DjF;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkHlB"}
+{"version":3,"file":"build-app-route-renderer.d.ts","sourceRoot":"","sources":["../../../src/src/server/build-app-route-renderer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAMnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAOjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA4E1D;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CA0KlB"}