veryfront 0.1.1099 → 0.1.1100

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1099",
+    "version": "0.1.1100",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/data/helpers.d.ts

@@ -3,4 +3,25 @@ import type { DataResult } from "./types.js";
 export declare function redirect(destination: string, permanent?: boolean): DataResult;
 /** Return a 404 result from a data loader. */
 export declare function notFound(): DataResult;
+/**
+ * True when `value` is a control-flow result produced by {@link notFound} or
+ * {@link redirect}.
+ *
+ * These helpers are documented as return values, but `throw notFound()` reads
+ * naturally and is what people coming from other frameworks reach for. Thrown,
+ * the plain object is not an `Error`, so the SSR error handler stringified it
+ * to `[object Object]` and returned a 500 instead of the intended 404 or
+ * redirect. Recognising the shape lets a thrown result behave like a returned
+ * one.
+ */
+export declare function isDataControlResult(value: unknown): value is DataResult;
+/**
+ * Reduce a thrown control result to the shape a returned one produces.
+ *
+ * Callers apply this inside whatever wraps the data loader, not in an outer
+ * `catch`. A 404 is a routing decision, and a circuit breaker that sees it as a
+ * failure will open on the fifth legitimate one and fail every later data route
+ * for the project.
+ */
+export declare function toDataControlResult(result: DataResult): DataResult;
 //# sourceMappingURL=helpers.d.ts.map

package/esm/src/data/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAE3E;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,IAAI,UAAU,CAErC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAE3E;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAUvE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAGlE"}

package/esm/src/data/helpers.js

@@ -6,3 +6,38 @@ export function redirect(destination, permanent = false) {
 export function notFound() {
     return { notFound: true };
 }
+/**
+ * True when `value` is a control-flow result produced by {@link notFound} or
+ * {@link redirect}.
+ *
+ * These helpers are documented as return values, but `throw notFound()` reads
+ * naturally and is what people coming from other frameworks reach for. Thrown,
+ * the plain object is not an `Error`, so the SSR error handler stringified it
+ * to `[object Object]` and returned a 500 instead of the intended 404 or
+ * redirect. Recognising the shape lets a thrown result behave like a returned
+ * one.
+ */
+export function isDataControlResult(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (value instanceof Error)
+        return false;
+    const candidate = value;
+    if (candidate.notFound === true)
+        return true;
+    const destination = candidate.redirect?.destination;
+    return typeof destination === "string";
+}
+/**
+ * Reduce a thrown control result to the shape a returned one produces.
+ *
+ * Callers apply this inside whatever wraps the data loader, not in an outer
+ * `catch`. A 404 is a routing decision, and a circuit breaker that sees it as a
+ * failure will open on the fifth legitimate one and fail every later data route
+ * for the project.
+ */
+export function toDataControlResult(result) {
+    if (result.redirect)
+        return { redirect: result.redirect };
+    return { notFound: true };
+}

package/esm/src/data/server-data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAaxE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,iBAAiB;IAC5B,KAAK,CACH,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC;IA8EtB;;OAEG;YACW,aAAa;IAqE3B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}
+{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAcxE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,iBAAiB;IAC5B,KAAK,CACH,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAuFtB;;OAEG;YACW,aAAa;IAqE3B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/esm/src/data/server-data-fetcher.js

@@ -1,4 +1,5 @@
 import * as dntShim from "../../_dnt.shims.js";
+import { isDataControlResult, toDataControlResult } from "./helpers.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
@@ -26,9 +27,22 @@ export class ServerDataFetcher {
         return withSpan("data.fetch_server", async () => {
             const start = performance.now();
             try {
-                const result = await circuitBreaker.execute(() => withTimeoutThrow(useIsolation
-                    ? this.fetchIsolated(options.modulePath, options.projectDir, context)
-                    : Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`));
+                const result = await circuitBreaker.execute(async () => {
+                    try {
+                        return await withTimeoutThrow(useIsolation
+                            ? this.fetchIsolated(options.modulePath, options.projectDir, context)
+                            : Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`);
+                    }
+                    catch (error) {
+                        // `throw notFound()` / `throw redirect(...)`: treat a thrown
+                        // control result exactly like a returned one. This has to happen
+                        // inside the breaker, or five legitimate 404s on the same project
+                        // open it and every data route after that fails fast for 30s.
+                        if (isDataControlResult(error))
+                            return toDataControlResult(error);
+                        throw error;
+                    }
+                });
                 if (result.redirect)
                     return { redirect: result.redirect };
                 if (result.notFound)

package/esm/src/data/static-data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/static-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2DxE,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,YAAY;IAFhC,OAAO,CAAC,oBAAoB,CAAoC;gBAE5C,YAAY,EAAE,YAAY;IAExC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4ChF,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,eAAe;YAQT,iBAAiB;YA+BjB,UAAU;YAqEV,sBAAsB;IAoEpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;CAIjB"}
+{"version":3,"file":"static-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/static-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2DxE,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,YAAY;IAFhC,OAAO,CAAC,oBAAoB,CAAoC;gBAE5C,YAAY,EAAE,YAAY;IAExC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4ChF,OAAO,CAAC,uBAAuB;YAMjB,iBAAiB;IAuB/B,OAAO,CAAC,eAAe;YAQT,iBAAiB;YA+BjB,UAAU;YAqEV,sBAAsB;IAoEpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;CAIjB"}

package/esm/src/data/static-data-fetcher.js

@@ -1,3 +1,4 @@
+import { isDataControlResult, toDataControlResult } from "./helpers.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
@@ -78,8 +79,20 @@ export class StaticDataFetcher {
     createStaticDataContext(context) {
         return { params: context.params, url: context.url };
     }
-    executeStaticData(getStaticData, context, timeoutMs, label) {
-        return withTimeoutThrow(Promise.resolve(getStaticData(this.createStaticDataContext(context))), timeoutMs, label);
+    async executeStaticData(getStaticData, context, timeoutMs, label) {
+        try {
+            return await withTimeoutThrow(Promise.resolve(getStaticData(this.createStaticDataContext(context))), timeoutMs, label);
+        }
+        catch (error) {
+            // `throw notFound()` / `throw redirect(...)`: treat a thrown control
+            // result exactly like a returned one. Normalising at the one place every
+            // path runs the handler covers the cached path as well as the preview
+            // one, and keeps a 404 from counting against the caller's circuit
+            // breaker.
+            if (isDataControlResult(error))
+                return toDataControlResult(error);
+            throw error;
+        }
     }
     storeCacheEntry(cacheKey, result) {
         this.cacheManager.set(cacheKey, {

package/esm/src/html/hydration-script-builder/templates/renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../../src/src/html/hydration-script-builder/templates/renderer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,cA0P7B,CAAC"}
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../../src/src/html/hydration-script-builder/templates/renderer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,cA4R7B,CAAC"}

package/esm/src/html/hydration-script-builder/templates/renderer.js

@@ -1,6 +1,19 @@
 export const getRendererScript = () => `
     // Note: DEBUG, log, logError are defined in router.ts which loads first
 
+    // True when a dynamic import failed because the module could not be
+    // fetched (404 / network), as opposed to being fetched and then failing to
+    // link or evaluate. Browsers report the former as a TypeError with a
+    // "dynamically imported module" message; link failures are SyntaxErrors and
+    // evaluation failures are whatever the module threw.
+    function isModuleNotFoundError(error) {
+      if (!error) return false;
+      if (error instanceof SyntaxError) return false;
+      const message = String((error && error.message) || error);
+      return /(?:Failed to fetch|error loading|Importing a module script failed|Failed to load)/i
+        .test(message);
+    }
+
     async function renderPage(pathname) {
       const resolvedPathname = (() => {
         const input = typeof pathname === 'string' ? pathname : window.location.pathname;
@@ -92,6 +105,8 @@ export const getRendererScript = () => `
           };
         }
 
+        let pageModuleError = null;
+
         if (data.pagePath) {
           const moduleUrl = shouldRenderRscClientPage
             ? '/_veryfront/rsc/module?rel=' + encodeURIComponent(data.pagePath)
@@ -101,6 +116,7 @@ export const getRendererScript = () => `
           try {
             pageModule = await import(moduleUrl);
           } catch (error) {
+            pageModuleError = error;
             logError('Failed to load page from hydration data:', error);
           }
         }
@@ -115,8 +131,26 @@ export const getRendererScript = () => `
           try {
             pageModule = await import(basePath + '.js');
           } catch (error) {
-            if (pageSlug === 'index' || pageSlug.endsWith('/index')) throw error;
-            pageModule = await import(basePath + '/index.js');
+            pageModuleError = pageModuleError || error;
+
+            // Only retry at <route>/index.js when the module genuinely could not
+            // be found. If it was found but failed to link or evaluate, retrying
+            // a path that does not exist replaces a precise error ("does not
+            // provide an export named 'createHash'") with a misleading 404.
+            const canRetryAsIndex = isModuleNotFoundError(error) &&
+              pageSlug !== 'index' && !pageSlug.endsWith('/index');
+
+            if (!canRetryAsIndex) throw pageModuleError;
+
+            try {
+              pageModule = await import(basePath + '/index.js');
+            } catch (indexError) {
+              // For a real <route>/index.tsx page, the first 404 was expected
+              // and this retry is the path that matters: if it reached a module
+              // and failed to link or evaluate, its error is the real one. Only
+              // when the retry 404s as well does the original describe more.
+              throw isModuleNotFoundError(indexError) ? pageModuleError : indexError;
+            }
           }
         }
 

package/esm/src/internal-agents/run-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAEL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAyVD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA2anB"}
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAGL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AA6VD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA2anB"}

package/esm/src/internal-agents/run-stream.js

@@ -10,7 +10,7 @@ import { importFirstPartyExtensionModule } from "../extensions/first-party-impor
 import { SandboxShellToolsProviderName, } from "../extensions/sandbox/index.js";
 import { resolveHostedRuntimeAllowedToolNames } from "../agent/hosted/runtime-essential-tools.js";
 import { SKILL_TOOL_IDS } from "../skill/types.js";
-import { isToolVisibleTo, toolRegistry, } from "../tool/index.js";
+import { createToolsFromHostDefinitions, isToolVisibleTo, toolRegistry, } from "../tool/index.js";
 import { addSpanEvent, setSpanAttributes, withSpan, } from "../observability/tracing/otlp-setup.js";
 import { defineSchema, lazySchema } from "../schemas/index.js";
 import { createStreamTransformState, finalizeRunEvents, formatAgUiEvent, mapRuntimeEventToAgUi, parseSseJsonEvents, } from "./ag-ui-sse.js";
@@ -210,15 +210,17 @@ async function buildProjectAgentSandboxTools(input) {
             : {}),
         getProjectId: () => sandboxConfig.projectId ?? input.deps.projectAgentSandbox?.projectId,
     });
-    const bash = sandboxResult.tools[PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME];
-    if (!bash) {
+    const declaredTools = input.agent.config.tools;
+    const materializedTools = createToolsFromHostDefinitions(sandboxResult.tools);
+    const configuredTools = isRecord(declaredTools)
+        ? Object.fromEntries(Object.entries(materializedTools).filter(([toolName]) => declaredTools[toolName] === true))
+        : {};
+    if (!configuredTools[PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME]) {
         await sandboxResult.closeSandbox();
         return {};
     }
     return {
-        tools: {
-            [PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME]: bash,
-        },
+        tools: configuredTools,
         closeSandbox: sandboxResult.closeSandbox,
     };
 }

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts

@@ -8,6 +8,8 @@ export type ResolvedModuleDependency = {
     relativePath: string;
     depFilePath: string | null;
     isLocalLib: boolean;
+    /** True when discovered inside `import("…")` rather than a static import. */
+    isDynamic: boolean;
 };
 /** Resolved dependency after its source module has been transformed to a temp file. */
 export type TransformedModuleDependency = ResolvedModuleDependency & {

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAczE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgGD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAQR"}
+{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AA4BzE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AA4GD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAUR"}

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.js

@@ -1,25 +1,23 @@
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { parallelMap, rendererLogger } from "../../../utils/index.js";
-import { findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
+import { findDynamicImportSpans, findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
 import { findSourceFile } from "../file-resolver/index.js";
 const logger = rendererLogger.component("module-loader");
+const matchAlias = (specifier) => specifier.startsWith("@/") ? specifier : null;
+const matchRelative = (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1];
 function collectAliasImports(fileContent) {
-    return findStaticImportFromSpans(fileContent, (specifier) => specifier.startsWith("@/") ? specifier : null).map(({ original, path, start, end }) => ({
-        full: original,
-        path,
-        start,
-        end,
-    }));
+    const toAlias = (isDynamic) => ({ original, path, start, end }) => ({ full: original, path, start, end, isDynamic });
+    return [
+        ...findStaticImportFromSpans(fileContent, matchAlias).map(toAlias(false)),
+        ...findDynamicImportSpans(fileContent, matchAlias).map(toAlias(true)),
+    ];
 }
 function collectRelativeImports(fileContent, fileDir) {
-    return findStaticImportFromSpans(fileContent, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1])
-        .map(({ original, path, start, end }) => ({
-        full: original,
-        path,
-        fromDir: fileDir,
-        start,
-        end,
-    }))
+    const toRelative = (isDynamic) => ({ original, path, start, end }) => ({ full: original, path, fromDir: fileDir, start, end, isDynamic });
+    return [
+        ...findStaticImportFromSpans(fileContent, matchRelative).map(toRelative(false)),
+        ...findDynamicImportSpans(fileContent, matchRelative).map(toRelative(true)),
+    ]
         // Ignore already-transformed file:// imports.
         .filter((imp) => !imp.path.includes("file://"));
 }
@@ -70,6 +68,7 @@ async function resolveRelativeImport(imp, adapter) {
         relativePath: imp.path,
         depFilePath,
         isLocalLib: false,
+        isDynamic: imp.isDynamic,
     };
 }
 /** Resolves @/ alias and relative local imports from a source module. */
@@ -94,7 +93,9 @@ export function rewriteResolvedDependencyImports(fileContent, transformedDeps) {
         start: dep.start,
         end: dep.end,
         expected: dep.full,
-        replacement: `from "file://${dep.depTempPath}"`,
+        // A dynamic span covers only the quoted specifier; a static one covers the
+        // whole `from "…"` clause.
+        replacement: dep.isDynamic ? `"file://${dep.depTempPath}"` : `from "file://${dep.depTempPath}"`,
     }));
     return replaceSourceSpans(fileContent, replacements);
 }

package/esm/src/tool/host-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-tools.d.ts","sourceRoot":"","sources":["../../../src/src/tool/host-tools.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAElF,KAAK,eAAe,GAAG;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAChG,CAAC,gBAAgB,CAAC,CAAC;AAEpB,gCAAgC;AAChC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,eAAe,CAAC;IAC5C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAQ7D,qDAAqD;AACrD,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD;AAuDD,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC;AACX,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC"}
+{"version":3,"file":"host-tools.d.ts","sourceRoot":"","sources":["../../../src/src/tool/host-tools.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAElF,KAAK,eAAe,GAAG;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAChG,CAAC,gBAAgB,CAAC,CAAC;AAEpB,gCAAgC;AAChC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,eAAe,CAAC;IAC5C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAO7D,qDAAqD;AACrD,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD;AA2DD,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,WAAW,EACxB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC;AACX,0CAA0C;AAC1C,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC"}

package/esm/src/tool/host-tools.js

@@ -24,7 +24,9 @@ function isParserBackedPrecomputedSchema(input) {
 function isHostToolDefinition(value) {
     return (isRecord(value) &&
         typeof value.description === "string" &&
-        (isSchemaLike(value.inputSchema) || isParserBackedPrecomputedSchema(value)) &&
+        (isSchemaLike(value.inputSchema) ||
+            isParserBackedPrecomputedSchema(value) ||
+            (value.inputSchema === undefined && isRecord(value.inputSchemaJson))) &&
         typeof value.execute === "function");
 }
 function defaultToolCallId(toolName) {

package/esm/src/transforms/esm/transform-utils.d.ts

@@ -4,6 +4,18 @@ import type { Loader } from "../../extensions/bundler/index.js";
  * Use this for transform cache keys where a compact hash is preferred.
  */
 export declare function computeShortContentHash(content: string): Promise<string>;
+/**
+ * esbuild feature overrides shared by every source transform.
+ *
+ * Import attributes post-date the `es20xx` targets we lower to, so esbuild
+ * would silently *drop* `with { type: "json" }` rather than fail. Every runtime
+ * that consumes this output requires the attribute to load a JSON module, so
+ * dropping it turns a working import into a load-time error:
+ * `Attempted to load JSON module without specifying "type": "json"`.
+ */
+export declare const ESBUILD_SUPPORTED_FEATURES: {
+    readonly "import-attributes": true;
+};
 export declare function getLoaderFromPath(filePath: string): Loader;
 export declare function needsTransform(filePath: string): boolean;
 //# sourceMappingURL=transform-utils.d.ts.map

package/esm/src/transforms/esm/transform-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform-utils.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/transform-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAaD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}
+{"version":3,"file":"transform-utils.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/transform-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;;CAAyC,CAAC;AAajF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/esm/src/transforms/esm/transform-utils.js

@@ -6,6 +6,16 @@ import { shortHash } from "../../utils/hash-utils.js";
 export function computeShortContentHash(content) {
     return shortHash(content);
 }
+/**
+ * esbuild feature overrides shared by every source transform.
+ *
+ * Import attributes post-date the `es20xx` targets we lower to, so esbuild
+ * would silently *drop* `with { type: "json" }` rather than fail. Every runtime
+ * that consumes this output requires the attribute to load a JSON module, so
+ * dropping it turns a working import into a load-time error:
+ * `Attempted to load JSON module without specifying "type": "json"`.
+ */
+export const ESBUILD_SUPPORTED_FEATURES = { "import-attributes": true };
 const EXTENSION_LOADERS = {
     ".tsx": "tsx",
     ".ts": "ts",

package/esm/src/transforms/mdx/esm-module-loader/utils/source-spans.d.ts

@@ -18,6 +18,17 @@ export interface StaticImportSpan {
 type SpecifierMatcher = (specifier: string) => string | null | undefined;
 export declare function replaceSourceSpans(source: string, replacements: SourceSpanReplacement[]): string;
 export declare function findStaticImportFromSpans(source: string, matcher: SpecifierMatcher): StaticImportSpan[];
+/**
+ * Find `import("…")` expressions with a literal specifier.
+ *
+ * The returned span covers the quoted specifier itself (quotes included), not
+ * the surrounding `import(...)`, so a replacement is a bare quoted string.
+ * Dynamic imports whose argument is not a string literal are skipped, since
+ * their target is only known at runtime. That includes an argument the literal
+ * merely starts: rewriting the `"./foo"` in `import("./foo" + suffix)` would
+ * build a path out of a resolved prefix and an unresolved tail.
+ */
+export declare function findDynamicImportSpans(source: string, matcher: SpecifierMatcher): StaticImportSpan[];
 export declare function findStaticSideEffectImportSpans(source: string, matcher: SpecifierMatcher): StaticImportSpan[];
 export {};
 //# sourceMappingURL=source-spans.d.ts.map

package/esm/src/transforms/mdx/esm-module-loader/utils/source-spans.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-spans.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/utils/source-spans.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,KAAK,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,qBAAqB,EAAE,GACpC,MAAM,CAkCR;AAqID,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,EAAE,CAoCpB;AAED,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,EAAE,CAqCpB"}
+{"version":3,"file":"source-spans.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/utils/source-spans.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,KAAK,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,qBAAqB,EAAE,GACpC,MAAM,CAkCR;AAyJD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,EAAE,CAoCpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,EAAE,CAwDpB;AAED,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,EAAE,CAqCpB"}

package/esm/src/transforms/mdx/esm-module-loader/utils/source-spans.js

@@ -72,6 +72,23 @@ function skipWhitespace(source, index) {
         cursor++;
     return cursor;
 }
+// Comments are legal wherever whitespace is, so a dynamic import can carry a
+// bundler hint between the keyword, the parentheses and the specifier. Treating
+// the comment as an unexpected character would leave the specifier unresolved.
+function skipWhitespaceAndComments(source, index) {
+    let cursor = index;
+    while (cursor < source.length) {
+        const afterWhitespace = skipWhitespace(source, cursor);
+        const char = source[afterWhitespace];
+        const next = source[afterWhitespace + 1];
+        if (char === "/" && (next === "/" || next === "*")) {
+            cursor = skipIgnored(source, afterWhitespace);
+            continue;
+        }
+        return afterWhitespace;
+    }
+    return cursor;
+}
 function nextStatementCursor(source, index) {
     const semicolon = source.indexOf(";", index);
     const newline = source.indexOf("\n", index);
@@ -164,6 +181,63 @@ export function findStaticImportFromSpans(source, matcher) {
     }
     return spans;
 }
+/**
+ * Find `import("…")` expressions with a literal specifier.
+ *
+ * The returned span covers the quoted specifier itself (quotes included), not
+ * the surrounding `import(...)`, so a replacement is a bare quoted string.
+ * Dynamic imports whose argument is not a string literal are skipped, since
+ * their target is only known at runtime. That includes an argument the literal
+ * merely starts: rewriting the `"./foo"` in `import("./foo" + suffix)` would
+ * build a path out of a resolved prefix and an unresolved tail.
+ */
+export function findDynamicImportSpans(source, matcher) {
+    const spans = [];
+    let cursor = 0;
+    while (cursor < source.length) {
+        const skipped = skipIgnored(source, cursor);
+        if (skipped !== cursor) {
+            cursor = skipped;
+            continue;
+        }
+        // `import` used as an expression: not preceded by an identifier char or a
+        // dot (which would make it `foo.import` or part of a longer word).
+        if (!source.startsWith("import", cursor) ||
+            isIdentifierChar(source[cursor - 1]) ||
+            source[cursor - 1] === "." ||
+            isIdentifierChar(source[cursor + "import".length])) {
+            cursor++;
+            continue;
+        }
+        const parenIndex = skipWhitespaceAndComments(source, cursor + "import".length);
+        if (source[parenIndex] !== "(") {
+            cursor++;
+            continue;
+        }
+        const quoteIndex = skipWhitespaceAndComments(source, parenIndex + 1);
+        const quoted = readQuotedSpecifier(source, quoteIndex);
+        if (!quoted) {
+            cursor = parenIndex + 1;
+            continue;
+        }
+        // The literal must be the whole first argument. `)` closes the call and `,`
+        // starts the import-attributes argument; anything else (`+`, a template
+        // continuation, a ternary) means the runtime specifier is not this string.
+        const afterSpecifier = skipWhitespaceAndComments(source, quoted.end);
+        const isWholeArgument = source[afterSpecifier] === ")" || source[afterSpecifier] === ",";
+        const matchedPath = isWholeArgument ? matcher(quoted.specifier) : null;
+        if (matchedPath) {
+            spans.push({
+                original: source.slice(quoteIndex, quoted.end),
+                path: matchedPath,
+                start: quoteIndex,
+                end: quoted.end,
+            });
+        }
+        cursor = quoted.end;
+    }
+    return spans;
+}
 export function findStaticSideEffectImportSpans(source, matcher) {
     const spans = [];
     let cursor = 0;

package/esm/src/transforms/pipeline/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,eAAe,EAChB,MAAM,YAAY,CAAC;AA0HpB,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyI1B;AAqBD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CASjB;AAmCD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,eAAe,EAChB,MAAM,YAAY,CAAC;AA8HpB,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyI1B;AAqBD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CASjB;AAmCD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,YAAY,GACb,MAAM,cAAc,CAAC"}

package/esm/src/transforms/pipeline/index.js

@@ -9,7 +9,7 @@ import { createTransformContext, formatTimingLog, recordStageTiming } from "./co
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { computeConfigHash } from "../../cache/config-hash.js";
 import { computeDepsHash } from "../../cache/dependency-graph.js";
-import { compilePlugin, cssStripPlugin, finalizePlugin, parsePlugin, resolveImportsPlugin, ssrHttpCachePlugin, ssrHttpStubPlugin, ssrVfModulesPlugin, } from "./stages/index.js";
+import { browserNodeBuiltinImportsPlugin, browserServerExportsStripPlugin, compilePlugin, cssStripPlugin, finalizePlugin, parsePlugin, resolveImportsPlugin, ssrHttpCachePlugin, ssrHttpStubPlugin, ssrVfModulesPlugin, } from "./stages/index.js";
 import { createFileSystem, exists } from "../../platform/compat/fs.js";
 import { getHttpBundleCacheDir } from "../../utils/cache-dir.js";
 import { validateCachedBundlesByManifestOrCode } from "../esm/cached-bundle-validation.js";
@@ -28,6 +28,8 @@ const BROWSER_PIPELINE = [
     parsePlugin,
     compilePlugin,
     cssStripPlugin, // Strip CSS imports before they hit import resolution
+    browserServerExportsStripPlugin, // Drop server-only hooks + their now-unused imports
+    browserNodeBuiltinImportsPlugin, // node:* named imports -> namespace + destructure
     resolveImportsPlugin, // Unified import resolution
     finalizePlugin,
 ];

package/esm/src/transforms/pipeline/stages/browser-node-builtin-imports.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Browser Node-Builtin Imports Stage — converts named imports of Node built-ins
+ * into namespace imports plus a destructure.
+ *
+ * Browser-bound imports of `node:*` are pointed at a noop polyfill whose whole
+ * job, per its own documentation, is that "the import succeeds, and any actual
+ * usage of the imported API fails at the call site, which surfaces the problem
+ * clearly instead of a cryptic module resolution error".
+ *
+ * That contract cannot hold for a *named* import. ESM resolves named imports at
+ * link time, so `import { createHash } from "node:crypto"` fails the whole
+ * module graph before a line of it runs:
+ *
+ *     SyntaxError: The requested module '.../node-noop.js' does not provide an
+ *     export named 'createHash'
+ *
+ * One leaked builtin therefore takes down hydration for the entire page, and the
+ * error names the polyfill rather than the offending import.
+ *
+ * Rewriting to a namespace import restores the intended behaviour: linking
+ * succeeds, the binding is `undefined`, and the failure happens where the API is
+ * actually called. It also makes the two node-noop variants (source and compiled
+ * binary, which export different names) behave identically.
+ */
+import type { TransformPlugin } from "../types.js";
+/**
+ * Rewrite `import { a, b as c } from "node:x"` to a namespace import plus a
+ * destructure. Default and namespace imports already link successfully and are
+ * left untouched.
+ */
+export declare function rewriteNodeBuiltinNamedImports(code: string): Promise<string>;
+export declare const browserNodeBuiltinImportsPlugin: TransformPlugin;
+//# sourceMappingURL=browser-node-builtin-imports.d.ts.map

package/esm/src/transforms/pipeline/stages/browser-node-builtin-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-node-builtin-imports.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/browser-node-builtin-imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,aAAa,CAAC;AA+CrE;;;;GAIG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ClF;AAED,eAAO,MAAM,+BAA+B,EAAE,eAM7C,CAAC"}

package/esm/src/transforms/pipeline/stages/browser-node-builtin-imports.js

@@ -0,0 +1,116 @@
+/**
+ * Browser Node-Builtin Imports Stage — converts named imports of Node built-ins
+ * into namespace imports plus a destructure.
+ *
+ * Browser-bound imports of `node:*` are pointed at a noop polyfill whose whole
+ * job, per its own documentation, is that "the import succeeds, and any actual
+ * usage of the imported API fails at the call site, which surfaces the problem
+ * clearly instead of a cryptic module resolution error".
+ *
+ * That contract cannot hold for a *named* import. ESM resolves named imports at
+ * link time, so `import { createHash } from "node:crypto"` fails the whole
+ * module graph before a line of it runs:
+ *
+ *     SyntaxError: The requested module '.../node-noop.js' does not provide an
+ *     export named 'createHash'
+ *
+ * One leaked builtin therefore takes down hydration for the entire page, and the
+ * error names the polyfill rather than the offending import.
+ *
+ * Rewriting to a namespace import restores the intended behaviour: linking
+ * succeeds, the binding is `undefined`, and the failure happens where the API is
+ * actually called. It also makes the two node-noop variants (source and compiled
+ * binary, which export different names) behave identically.
+ */
+import { TransformStage } from "../types.js";
+import { rewriteImports } from "../../esm/lexer.js";
+const NAMESPACE_PREFIX = "__vf_node_builtin_";
+/**
+ * Pick a namespace prefix the module has never used. A source file is free to
+ * declare or import `__vf_node_builtin_0` itself, and shadowing it would either
+ * duplicate the binding or silently redirect the user's own one.
+ *
+ * Substring containment is the right test even though it over-matches: every
+ * name we go on to generate starts with the prefix, so a module that never
+ * mentions the prefix cannot collide with any of them. That keeps this cheap on
+ * post-esbuild output, where parsing for real bindings is not an option.
+ */
+function pickNamespacePrefix(code) {
+    let prefix = NAMESPACE_PREFIX;
+    while (code.includes(prefix))
+        prefix += "_";
+    return prefix;
+}
+/** Split a named-import clause into `local: imported` destructure pairs. */
+function toDestructurePairs(namedClause) {
+    const pairs = [];
+    for (const rawPart of namedClause.split(",")) {
+        const part = rawPart.trim();
+        if (!part)
+            continue;
+        const alias = part.match(/^([_$a-zA-Z][\w$]*)\s+as\s+([_$a-zA-Z][\w$]*)$/);
+        if (alias?.[1] && alias[2]) {
+            pairs.push(`${alias[1]}: ${alias[2]}`);
+            continue;
+        }
+        if (/^[_$a-zA-Z][\w$]*$/.test(part)) {
+            pairs.push(part);
+            continue;
+        }
+        return null; // Unrecognised clause — leave the statement alone.
+    }
+    return pairs.length > 0 ? pairs : null;
+}
+/**
+ * Rewrite `import { a, b as c } from "node:x"` to a namespace import plus a
+ * destructure. Default and namespace imports already link successfully and are
+ * left untouched.
+ */
+export async function rewriteNodeBuiltinNamedImports(code) {
+    if (!code.includes("node:"))
+        return code;
+    let counter = 0;
+    const prefix = pickNamespacePrefix(code);
+    return await rewriteImports(code, (imp, statement) => {
+        if (!imp.n?.startsWith("node:"))
+            return null;
+        if (imp.d > -1)
+            return null; // dynamic import resolves lazily already
+        if (!statement.startsWith("import"))
+            return null;
+        // The clause is everything between the `import` keyword and the specifier.
+        // Take it from the lexer's own offsets rather than by searching for
+        // " from ": esbuild emits `import{createHash as h}from"node:crypto";` when
+        // the build is minified, and there is no such substring in it.
+        const specifierStart = imp.s - imp.ss;
+        if (specifierStart <= "import".length || specifierStart > statement.length)
+            return null;
+        const clause = statement
+            .slice("import".length, specifierStart - 1) // -1 for the opening quote
+            .replace(/\bfrom\s*$/, "")
+            .trim();
+        if (clause === "")
+            return null; // side-effect-only import
+        const namedMatch = clause.match(/\{([^}]*)\}/);
+        if (!namedMatch?.[1])
+            return null; // no named bindings
+        const pairs = toDestructurePairs(namedMatch[1]);
+        if (!pairs)
+            return null;
+        const namespace = `${prefix}${counter++}`;
+        const source = JSON.stringify(imp.n);
+        // Anything left of the named clause (a default binding) keeps its own import.
+        const leading = clause.replace(/\{[^}]*\}/, "").replace(/,\s*$/, "").replace(/^\s*,/, "")
+            .trim();
+        const defaultImport = leading ? `import ${leading} from ${source};` : "";
+        return `${defaultImport}import * as ${namespace} from ${source};` +
+            `const { ${pairs.join(", ")} } = ${namespace};`;
+    });
+}
+export const browserNodeBuiltinImportsPlugin = {
+    name: "browser-node-builtin-imports",
+    // Before import resolution, while the specifier is still `node:*`.
+    stage: TransformStage.COMPILE + 0.7,
+    condition: (ctx) => ctx.target === "browser",
+    transform: (ctx) => rewriteNodeBuiltinNamedImports(ctx.code),
+};

package/esm/src/transforms/pipeline/stages/browser-server-exports-strip.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Browser Server-Exports Strip Stage: empties server-only data hooks in the
+ * client artifact, then drops the import bindings that only they used.
+ *
+ * `getServerData`, `getStaticData` and `getStaticPaths` run exclusively on the
+ * server, but the browser artifact is compiled from the same source file. Their
+ * bodies therefore ship to the client along with everything they import, so a
+ * page whose loader reaches `node:crypto` links against the node-builtin noop
+ * polyfill and hydration dies with:
+ *
+ *     The requested module '.../node-noop.js' does not provide an export
+ *     named 'createHash'
+ *
+ * esbuild cannot solve this for us: in transform mode (as opposed to bundle
+ * mode) it never drops an import, because it cannot prove the module is free of
+ * side effects.
+ *
+ * The pass runs on the AST from the `CodeParser` contract, for the same reason
+ * `rendering/rsc/export-extractor.ts` does: a module is not text. Matching
+ * declarations by hand means a private function that shares a hook's name gets
+ * emptied, a `}` inside a regular expression literal ends a body early, and a
+ * minified statement parses differently from the one a developer wrote.
+ *
+ * Two rules keep it conservative:
+ *
+ * - Only an exported declaration is emptied. A private helper called
+ *   `getServerData` is ordinary client code.
+ * - An import whose bindings all fall out of use is reduced to a side-effect
+ *   import rather than deleted, because this pass knows nothing about the
+ *   top-level code of the module it points at. Node built-ins are the
+ *   exception: in the browser they resolve to a noop polyfill, so there is no
+ *   side effect to keep. This matches what esbuild does with an external
+ *   import whose bindings go unused.
+ *
+ * Anything that cannot be parsed leaves the module exactly as it was.
+ */
+import type { TransformPlugin } from "../types.js";
+/**
+ * Empty the server-only hooks in `code` and drop the import bindings they were
+ * the last user of. Returns `code` unchanged when there is nothing to do, when
+ * no parser is registered, or when the module does not parse.
+ */
+export declare function stripServerOnlyExports(code: string, filePath?: string): Promise<string>;
+export declare const browserServerExportsStripPlugin: TransformPlugin;
+//# sourceMappingURL=browser-server-exports-strip.d.ts.map

package/esm/src/transforms/pipeline/stages/browser-server-exports-strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-server-exports-strip.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/browser-server-exports-strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,aAAa,CAAC;AAoPrE;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7F;AAED,eAAO,MAAM,+BAA+B,EAAE,eAO7C,CAAC"}

package/esm/src/transforms/pipeline/stages/browser-server-exports-strip.js

@@ -0,0 +1,300 @@
+/**
+ * Browser Server-Exports Strip Stage: empties server-only data hooks in the
+ * client artifact, then drops the import bindings that only they used.
+ *
+ * `getServerData`, `getStaticData` and `getStaticPaths` run exclusively on the
+ * server, but the browser artifact is compiled from the same source file. Their
+ * bodies therefore ship to the client along with everything they import, so a
+ * page whose loader reaches `node:crypto` links against the node-builtin noop
+ * polyfill and hydration dies with:
+ *
+ *     The requested module '.../node-noop.js' does not provide an export
+ *     named 'createHash'
+ *
+ * esbuild cannot solve this for us: in transform mode (as opposed to bundle
+ * mode) it never drops an import, because it cannot prove the module is free of
+ * side effects.
+ *
+ * The pass runs on the AST from the `CodeParser` contract, for the same reason
+ * `rendering/rsc/export-extractor.ts` does: a module is not text. Matching
+ * declarations by hand means a private function that shares a hook's name gets
+ * emptied, a `}` inside a regular expression literal ends a body early, and a
+ * minified statement parses differently from the one a developer wrote.
+ *
+ * Two rules keep it conservative:
+ *
+ * - Only an exported declaration is emptied. A private helper called
+ *   `getServerData` is ordinary client code.
+ * - An import whose bindings all fall out of use is reduced to a side-effect
+ *   import rather than deleted, because this pass knows nothing about the
+ *   top-level code of the module it points at. Node built-ins are the
+ *   exception: in the browser they resolve to a noop polyfill, so there is no
+ *   side effect to keep. This matches what esbuild does with an external
+ *   import whose bindings go unused.
+ *
+ * Anything that cannot be parsed leaves the module exactly as it was.
+ */
+import { tryResolve } from "../../../extensions/contracts.js";
+import { rendererLogger as logger } from "../../../utils/index.js";
+import { TransformStage } from "../types.js";
+/** Exports that only ever execute on the server. */
+const SERVER_ONLY_EXPORTS = ["getServerData", "getStaticData", "getStaticPaths"];
+/** Source the stub nodes are lifted from, so no node shape is hand-built. */
+const STUB_SOURCE = `function __vfStub() { throw new Error("server-only"); }
+const __vfStubInit = function () { throw new Error("server-only"); };`;
+function isNode(value) {
+    return typeof value === "object" && value !== null &&
+        typeof value.type === "string";
+}
+function children(node) {
+    const found = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === "loc" || key === "leadingComments" || key === "trailingComments")
+            continue;
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                if (isNode(entry))
+                    found.push(entry);
+            continue;
+        }
+        if (isNode(value))
+            found.push(value);
+    }
+    return found;
+}
+/**
+ * Walk every node in the tree. Returning `false` from `visit` skips the
+ * subtree, which is how import statements stay out of the reference count.
+ */
+function walk(node, visit) {
+    if (visit(node) === false)
+        return;
+    for (const child of children(node))
+        walk(child, visit);
+}
+function nodeName(value) {
+    if (!isNode(value))
+        return null;
+    const name = value.name;
+    return typeof name === "string" ? name : null;
+}
+function bodyOf(ast) {
+    const program = ast.program;
+    const source = isNode(program) ? program : ast;
+    const body = source.body;
+    return Array.isArray(body) ? body.filter(isNode) : [];
+}
+/** The stub body and stub initialiser, parsed rather than constructed. */
+async function parseStubs(parser) {
+    const ast = await parser.parse({ code: STUB_SOURCE, filePath: "vf-stub.ts" });
+    const [fn, variable] = bodyOf(ast);
+    const body = fn?.body;
+    const declarations = variable?.declarations;
+    const init = Array.isArray(declarations) && isNode(declarations[0])
+        ? declarations[0].init
+        : undefined;
+    if (!isNode(body) || !isNode(init))
+        return null;
+    return { body, init };
+}
+/** Names this module exports from its own local declarations. */
+function exportedLocalNames(body) {
+    const names = new Set();
+    for (const statement of body) {
+        if (statement.type !== "ExportNamedDeclaration")
+            continue;
+        if (statement.exportKind === "type")
+            continue;
+        // `export { getServerData }` and `export { getServerData as data }`: the
+        // local name is what a declaration in this module is called. The reverse,
+        // `export { other as getServerData }`, exports `other` and must not touch
+        // a same-named local.
+        for (const specifier of Array.isArray(statement.specifiers) ? statement.specifiers : []) {
+            if (!isNode(specifier))
+                continue;
+            if (specifier.exportKind === "type")
+                continue;
+            // A re-export (`export { x } from "./y"`) has no local declaration to
+            // empty, so recording the name is harmless.
+            const local = nodeName(specifier.local);
+            if (local)
+                names.add(local);
+        }
+        const declaration = statement.declaration;
+        if (!isNode(declaration))
+            continue;
+        const direct = nodeName(declaration.id);
+        if (direct)
+            names.add(direct);
+        for (const declarator of Array.isArray(declaration.declarations) ? declaration.declarations : []) {
+            if (!isNode(declarator))
+                continue;
+            const name = nodeName(declarator.id);
+            if (name)
+                names.add(name);
+        }
+    }
+    return names;
+}
+/**
+ * Empty the body of every exported server-only hook. Emptying rather than
+ * deleting keeps the binding, so an export clause or re-export stays valid.
+ */
+function emptyServerOnlyHooks(body, exported, stubs) {
+    const targets = SERVER_ONLY_EXPORTS.filter((name) => exported.has(name));
+    if (targets.length === 0)
+        return false;
+    let changed = false;
+    const declarationsIn = (statement) => {
+        const declaration = statement.type === "ExportNamedDeclaration"
+            ? statement.declaration
+            : statement;
+        return isNode(declaration) ? [declaration] : [];
+    };
+    for (const statement of body) {
+        for (const declaration of declarationsIn(statement)) {
+            if (declaration.type === "FunctionDeclaration") {
+                const name = nodeName(declaration.id);
+                if (!name || !targets.includes(name))
+                    continue;
+                declaration.body = structuredClone(stubs.body);
+                changed = true;
+                continue;
+            }
+            if (declaration.type !== "VariableDeclaration")
+                continue;
+            for (const declarator of Array.isArray(declaration.declarations) ? declaration.declarations : []) {
+                if (!isNode(declarator))
+                    continue;
+                const name = nodeName(declarator.id);
+                if (!name || !targets.includes(name))
+                    continue;
+                declarator.init = structuredClone(stubs.init);
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+/**
+ * Identifiers the module reads, ignoring import statements and the positions
+ * where an identifier is a fixed name rather than a reference (`a.hashOf`,
+ * `{ hashOf: 1 }`). Over-counting only ever keeps an import.
+ */
+function referencedIdentifiers(body) {
+    const referenced = new Set();
+    // Filled in as each parent is visited, which always happens before its
+    // children.
+    const fixedNames = new WeakSet();
+    const markFixedName = (node) => {
+        const property = node.type === "MemberExpression" || node.type === "OptionalMemberExpression"
+            ? node.property
+            : node.type === "ObjectProperty" || node.type === "ObjectMethod" ||
+                node.type === "ClassMethod" || node.type === "ClassProperty"
+                ? node.key
+                : undefined;
+        if (node.computed === true)
+            return;
+        if (isNode(property))
+            fixedNames.add(property);
+    };
+    for (const statement of body) {
+        if (statement.type === "ImportDeclaration")
+            continue;
+        walk(statement, (node) => {
+            if (node.type === "ImportDeclaration")
+                return false;
+            markFixedName(node);
+            if (node.type === "Identifier" || node.type === "JSXIdentifier") {
+                if (fixedNames.has(node))
+                    return true;
+                const name = nodeName(node);
+                if (name)
+                    referenced.add(name);
+            }
+            return true;
+        });
+    }
+    return referenced;
+}
+/** Local binding names an import statement introduces. */
+function importedBindings(statement) {
+    const bindings = [];
+    for (const specifier of Array.isArray(statement.specifiers) ? statement.specifiers : []) {
+        if (!isNode(specifier))
+            continue;
+        const name = nodeName(specifier.local);
+        if (name)
+            bindings.push(name);
+    }
+    return bindings;
+}
+/**
+ * Reduce imports nothing references any more to side-effect imports, and drop
+ * them outright when they point at a Node built-in.
+ */
+function dropUnusedImportBindings(body) {
+    const referenced = referencedIdentifiers(body);
+    return body.filter((statement) => {
+        if (statement.type !== "ImportDeclaration")
+            return true;
+        if (statement.importKind === "type")
+            return true;
+        const bindings = importedBindings(statement);
+        // Already a side-effect import: nothing to drop.
+        if (bindings.length === 0)
+            return true;
+        if (bindings.some((binding) => referenced.has(binding)))
+            return true;
+        const source = isNode(statement.source) ? statement.source.value : undefined;
+        if (typeof source === "string" && source.startsWith("node:"))
+            return false;
+        statement.specifiers = [];
+        return true;
+    });
+}
+function setBody(ast, body) {
+    const program = ast.program;
+    const target = isNode(program) ? program : ast;
+    target.body = body;
+}
+/**
+ * Empty the server-only hooks in `code` and drop the import bindings they were
+ * the last user of. Returns `code` unchanged when there is nothing to do, when
+ * no parser is registered, or when the module does not parse.
+ */
+export async function stripServerOnlyExports(code, filePath) {
+    // Cheap pre-check: no mention of a hook means no parse.
+    if (!SERVER_ONLY_EXPORTS.some((name) => code.includes(name)))
+        return code;
+    const parser = tryResolve("CodeParser");
+    if (!parser)
+        return code;
+    try {
+        const stubs = await parseStubs(parser);
+        if (!stubs)
+            return code;
+        const ast = await parser.parse({ code, filePath: filePath ?? "module.tsx" });
+        const body = bodyOf(ast);
+        if (!emptyServerOnlyHooks(body, exportedLocalNames(body), stubs))
+            return code;
+        setBody(ast, dropUnusedImportBindings(body));
+        const generated = await parser.generate(ast);
+        return generated.code;
+    }
+    catch (error) {
+        logger.debug("Left the module unchanged", {
+            filePath,
+            reason: error instanceof Error ? error.message : String(error),
+        });
+        return code;
+    }
+}
+export const browserServerExportsStripPlugin = {
+    name: "browser-server-exports-strip",
+    // After esbuild compile and CSS strip, before any import resolution, so the
+    // dropped bindings are never rewritten or pre-fetched.
+    stage: TransformStage.COMPILE + 0.6,
+    condition: (ctx) => ctx.target === "browser",
+    transform: (ctx) => stripServerOnlyExports(ctx.code, ctx.filePath),
+};

package/esm/src/transforms/pipeline/stages/compile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/compile.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyB,KAAK,eAAe,EAAkB,MAAM,aAAa,CAAC;AAI1F,eAAO,MAAM,aAAa,EAAE,eA4D3B,CAAC"}
+{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/compile.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyB,KAAK,eAAe,EAAkB,MAAM,aAAa,CAAC;AAI1F,eAAO,MAAM,aAAa,EAAE,eA6D3B,CAAC"}

package/esm/src/transforms/pipeline/stages/compile.js

@@ -2,7 +2,7 @@ import { getEsbuild } from "../../../platform/compat/esbuild.js";
 import { rendererLogger } from "../../../utils/index.js";
 import { COMPILATION_ERROR } from "../../../errors/index.js";
 import { getErrorCollector } from "../../../observability/index.js";
-import { getLoaderFromPath } from "../../esm/transform-utils.js";
+import { ESBUILD_SUPPORTED_FEATURES, getLoaderFromPath } from "../../esm/transform-utils.js";
 import { TransformStage } from "../types.js";
 const logger = rendererLogger.component("esm-transform");
 export const compilePlugin = {
@@ -16,6 +16,7 @@ export const compilePlugin = {
                 loader,
                 format: "esm",
                 target: "es2020",
+                supported: ESBUILD_SUPPORTED_FEATURES,
                 jsx: "automatic",
                 jsxImportSource: ctx.jsxImportSource,
                 minify: !ctx.dev,

package/esm/src/transforms/pipeline/stages/index.d.ts

@@ -6,6 +6,8 @@
 export { parsePlugin } from "./parse.js";
 export { compilePlugin } from "./compile.js";
 export { cssStripPlugin } from "./ssr-css-strip.js";
+export { browserServerExportsStripPlugin } from "./browser-server-exports-strip.js";
+export { browserNodeBuiltinImportsPlugin } from "./browser-node-builtin-imports.js";
 export { resolveImportsPlugin } from "./resolve-imports.js";
 export { ssrVfModulesPlugin } from "./ssr-vf-modules.js";
 export { ssrHttpStubPlugin } from "./ssr-http-stub.js";

package/esm/src/transforms/pipeline/stages/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/pipeline/stages/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/esm/src/transforms/pipeline/stages/index.js

@@ -6,6 +6,8 @@
 export { parsePlugin } from "./parse.js";
 export { compilePlugin } from "./compile.js";
 export { cssStripPlugin } from "./ssr-css-strip.js";
+export { browserServerExportsStripPlugin } from "./browser-server-exports-strip.js";
+export { browserNodeBuiltinImportsPlugin } from "./browser-node-builtin-imports.js";
 export { resolveImportsPlugin } from "./resolve-imports.js";
 export { ssrVfModulesPlugin } from "./ssr-vf-modules.js";
 export { ssrHttpStubPlugin } from "./ssr-http-stub.js";

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.d.ts

@@ -42,5 +42,16 @@ export declare function resolveAndTransformVeryfrontImport(specifier: string, ct
  * Transform framework source code with React import rewriting.
  * Entry point for top-level framework modules (e.g., Head.tsx, Router.tsx).
  */
+/**
+ * Drop `with { type: "json" }` from imports that now point at a JavaScript
+ * module.
+ *
+ * A framework import of a `.json` file (`#veryfront/server/dev-ui/manifest.json`)
+ * is resolved by transforming the JSON into a cached `.mjs` that default-exports
+ * the data. The attribute on the importer describes the *original* target, so
+ * leaving it in place makes the runtime reject the rewritten import with
+ * "Expected a Json module, but identified a Mjs module".
+ */
+export declare function stripJsonAttributesFromModuleImports(code: string): string;
 export declare function transformFrameworkSource(content: string, sourcePath: string, reactVersion: string, projectDir: string, fs: ReturnType<typeof createFileSystem>): Promise<string>;
 //# sourceMappingURL=transform.d.ts.map

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAmBrE,OAAO,EASL,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAoBxB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAgBD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA6MhE;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAsPD;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgDxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAmBrE,OAAO,EASL,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAoBxB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAgBD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA8MhE;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAyPD;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgDxB;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzE;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.js

@@ -4,6 +4,7 @@
  * Compiles framework TypeScript/TSX files to JavaScript and recursively
  * resolves all imports (#veryfront/, relative, React).
  */
+import { ESBUILD_SUPPORTED_FEATURES } from "../../../esm/transform-utils.js";
 import { join } from "../../../../platform/compat/path/index.js";
 import denoConfig from "../../../../../deno.js";
 import { rendererLogger as logger } from "../../../../utils/index.js";
@@ -122,6 +123,7 @@ async function compileFallbackSource(content, sourcePath) {
         jsxImportSource: "react",
         format: "esm",
         target: "es2022",
+        supported: ESBUILD_SUPPORTED_FEATURES,
     });
     return result.code;
 }
@@ -333,6 +335,7 @@ async function transformFrameworkCodeUncoalesced(content, sourcePath, ctx, throw
             jsxImportSource: "react",
             format: "esm",
             target: "es2022",
+            supported: ESBUILD_SUPPORTED_FEATURES,
         });
         let transformed = result.code;
         // Collect and recursively resolve all #veryfront/ imports
@@ -462,6 +465,7 @@ async function transformFrameworkCodeUncoalesced(content, sourcePath, ctx, throw
             reactVersion: ctx.reactVersion,
             reactImportMap,
         }));
+        transformed = stripJsonAttributesFromModuleImports(transformed);
         // Cache HTTP imports to local filesystem
         const importMap = await loadImportMap(ctx.projectDir);
         const cacheResult = await cacheHttpImportsToLocal(transformed, {
@@ -526,6 +530,19 @@ export async function resolveAndTransformVeryfrontImport(specifier, ctx) {
  * Transform framework source code with React import rewriting.
  * Entry point for top-level framework modules (e.g., Head.tsx, Router.tsx).
  */
+/**
+ * Drop `with { type: "json" }` from imports that now point at a JavaScript
+ * module.
+ *
+ * A framework import of a `.json` file (`#veryfront/server/dev-ui/manifest.json`)
+ * is resolved by transforming the JSON into a cached `.mjs` that default-exports
+ * the data. The attribute on the importer describes the *original* target, so
+ * leaving it in place makes the runtime reject the rewritten import with
+ * "Expected a Json module, but identified a Mjs module".
+ */
+export function stripJsonAttributesFromModuleImports(code) {
+    return code.replace(/(from\s*["'](?:file:\/\/)?[^"']+\.mjs["'])\s*with\s*\{[^}]*\}/g, "$1");
+}
 export async function transformFrameworkSource(content, sourcePath, reactVersion, projectDir, fs) {
     return transformFrameworkCode(content, sourcePath, { reactVersion, projectDir, fs }, true);
 }

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1099";
+export declare const VERSION = "0.1.1100";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1099";
+export const VERSION = "0.1.1100";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1099",
+  "version": "0.1.1100",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -328,10 +328,10 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "ws": "8.21.0",
-    "@veryfront/ext-bundler-esbuild": "0.1.1099",
-    "@veryfront/ext-content-mdx": "0.1.1099",
-    "@veryfront/ext-css-tailwind": "0.1.1099",
-    "@veryfront/ext-parser-babel": "0.1.1099"
+    "@veryfront/ext-bundler-esbuild": "0.1.1100",
+    "@veryfront/ext-content-mdx": "0.1.1100",
+    "@veryfront/ext-css-tailwind": "0.1.1100",
+    "@veryfront/ext-parser-babel": "0.1.1100"
   },
   "devDependencies": {
     "@types/node": "20.9.0"