veryfront 0.1.1099 → 0.1.1101

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1099",
+    "version": "0.1.1101",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/data/helpers.d.ts

@@ -3,4 +3,25 @@ import type { DataResult } from "./types.js";
 export declare function redirect(destination: string, permanent?: boolean): DataResult;
 /** Return a 404 result from a data loader. */
 export declare function notFound(): DataResult;
+/**
+ * True when `value` is a control-flow result produced by {@link notFound} or
+ * {@link redirect}.
+ *
+ * These helpers are documented as return values, but `throw notFound()` reads
+ * naturally and is what people coming from other frameworks reach for. Thrown,
+ * the plain object is not an `Error`, so the SSR error handler stringified it
+ * to `[object Object]` and returned a 500 instead of the intended 404 or
+ * redirect. Recognising the shape lets a thrown result behave like a returned
+ * one.
+ */
+export declare function isDataControlResult(value: unknown): value is DataResult;
+/**
+ * Reduce a thrown control result to the shape a returned one produces.
+ *
+ * Callers apply this inside whatever wraps the data loader, not in an outer
+ * `catch`. A 404 is a routing decision, and a circuit breaker that sees it as a
+ * failure will open on the fifth legitimate one and fail every later data route
+ * for the project.
+ */
+export declare function toDataControlResult(result: DataResult): DataResult;
 //# sourceMappingURL=helpers.d.ts.map

package/esm/src/data/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAE3E;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,IAAI,UAAU,CAErC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAE3E;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAUvE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAGlE"}

package/esm/src/data/helpers.js

@@ -6,3 +6,38 @@ export function redirect(destination, permanent = false) {
 export function notFound() {
     return { notFound: true };
 }
+/**
+ * True when `value` is a control-flow result produced by {@link notFound} or
+ * {@link redirect}.
+ *
+ * These helpers are documented as return values, but `throw notFound()` reads
+ * naturally and is what people coming from other frameworks reach for. Thrown,
+ * the plain object is not an `Error`, so the SSR error handler stringified it
+ * to `[object Object]` and returned a 500 instead of the intended 404 or
+ * redirect. Recognising the shape lets a thrown result behave like a returned
+ * one.
+ */
+export function isDataControlResult(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (value instanceof Error)
+        return false;
+    const candidate = value;
+    if (candidate.notFound === true)
+        return true;
+    const destination = candidate.redirect?.destination;
+    return typeof destination === "string";
+}
+/**
+ * Reduce a thrown control result to the shape a returned one produces.
+ *
+ * Callers apply this inside whatever wraps the data loader, not in an outer
+ * `catch`. A 404 is a routing decision, and a circuit breaker that sees it as a
+ * failure will open on the fifth legitimate one and fail every later data route
+ * for the project.
+ */
+export function toDataControlResult(result) {
+    if (result.redirect)
+        return { redirect: result.redirect };
+    return { notFound: true };
+}

package/esm/src/data/server-data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAaxE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,iBAAiB;IAC5B,KAAK,CACH,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC;IA8EtB;;OAEG;YACW,aAAa;IAqE3B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}
+{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAcxE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,iBAAiB;IAC5B,KAAK,CACH,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAuFtB;;OAEG;YACW,aAAa;IAqE3B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/esm/src/data/server-data-fetcher.js

@@ -1,4 +1,5 @@
 import * as dntShim from "../../_dnt.shims.js";
+import { isDataControlResult, toDataControlResult } from "./helpers.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
@@ -26,9 +27,22 @@ export class ServerDataFetcher {
         return withSpan("data.fetch_server", async () => {
             const start = performance.now();
             try {
-                const result = await circuitBreaker.execute(() => withTimeoutThrow(useIsolation
-                    ? this.fetchIsolated(options.modulePath, options.projectDir, context)
-                    : Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`));
+                const result = await circuitBreaker.execute(async () => {
+                    try {
+                        return await withTimeoutThrow(useIsolation
+                            ? this.fetchIsolated(options.modulePath, options.projectDir, context)
+                            : Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`);
+                    }
+                    catch (error) {
+                        // `throw notFound()` / `throw redirect(...)`: treat a thrown
+                        // control result exactly like a returned one. This has to happen
+                        // inside the breaker, or five legitimate 404s on the same project
+                        // open it and every data route after that fails fast for 30s.
+                        if (isDataControlResult(error))
+                            return toDataControlResult(error);
+                        throw error;
+                    }
+                });
                 if (result.redirect)
                     return { redirect: result.redirect };
                 if (result.notFound)

package/esm/src/data/static-data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/static-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2DxE,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,YAAY;IAFhC,OAAO,CAAC,oBAAoB,CAAoC;gBAE5C,YAAY,EAAE,YAAY;IAExC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4ChF,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,eAAe;YAQT,iBAAiB;YA+BjB,UAAU;YAqEV,sBAAsB;IAoEpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;CAIjB"}
+{"version":3,"file":"static-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/static-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2DxE,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,YAAY;IAFhC,OAAO,CAAC,oBAAoB,CAAoC;gBAE5C,YAAY,EAAE,YAAY;IAExC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4ChF,OAAO,CAAC,uBAAuB;YAMjB,iBAAiB;IAuB/B,OAAO,CAAC,eAAe;YAQT,iBAAiB;YA+BjB,UAAU;YAqEV,sBAAsB;IAoEpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;CAIjB"}

package/esm/src/data/static-data-fetcher.js

@@ -1,3 +1,4 @@
+import { isDataControlResult, toDataControlResult } from "./helpers.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
@@ -78,8 +79,20 @@ export class StaticDataFetcher {
     createStaticDataContext(context) {
         return { params: context.params, url: context.url };
     }
-    executeStaticData(getStaticData, context, timeoutMs, label) {
-        return withTimeoutThrow(Promise.resolve(getStaticData(this.createStaticDataContext(context))), timeoutMs, label);
+    async executeStaticData(getStaticData, context, timeoutMs, label) {
+        try {
+            return await withTimeoutThrow(Promise.resolve(getStaticData(this.createStaticDataContext(context))), timeoutMs, label);
+        }
+        catch (error) {
+            // `throw notFound()` / `throw redirect(...)`: treat a thrown control
+            // result exactly like a returned one. Normalising at the one place every
+            // path runs the handler covers the cached path as well as the preview
+            // one, and keeps a 404 from counting against the caller's circuit
+            // breaker.
+            if (isDataControlResult(error))
+                return toDataControlResult(error);
+            throw error;
+        }
     }
     storeCacheEntry(cacheKey, result) {
         this.cacheManager.set(cacheKey, {

package/esm/src/html/hydration-script-builder/templates/renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../../src/src/html/hydration-script-builder/templates/renderer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,cA0P7B,CAAC"}
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../../src/src/html/hydration-script-builder/templates/renderer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,cA4R7B,CAAC"}

package/esm/src/html/hydration-script-builder/templates/renderer.js

@@ -1,6 +1,19 @@
 export const getRendererScript = () => `
     // Note: DEBUG, log, logError are defined in router.ts which loads first
 
+    // True when a dynamic import failed because the module could not be
+    // fetched (404 / network), as opposed to being fetched and then failing to
+    // link or evaluate. Browsers report the former as a TypeError with a
+    // "dynamically imported module" message; link failures are SyntaxErrors and
+    // evaluation failures are whatever the module threw.
+    function isModuleNotFoundError(error) {
+      if (!error) return false;
+      if (error instanceof SyntaxError) return false;
+      const message = String((error && error.message) || error);
+      return /(?:Failed to fetch|error loading|Importing a module script failed|Failed to load)/i
+        .test(message);
+    }
+
     async function renderPage(pathname) {
       const resolvedPathname = (() => {
         const input = typeof pathname === 'string' ? pathname : window.location.pathname;
@@ -92,6 +105,8 @@ export const getRendererScript = () => `
           };
         }
 
+        let pageModuleError = null;
+
         if (data.pagePath) {
           const moduleUrl = shouldRenderRscClientPage
             ? '/_veryfront/rsc/module?rel=' + encodeURIComponent(data.pagePath)
@@ -101,6 +116,7 @@ export const getRendererScript = () => `
           try {
             pageModule = await import(moduleUrl);
           } catch (error) {
+            pageModuleError = error;
             logError('Failed to load page from hydration data:', error);
           }
         }
@@ -115,8 +131,26 @@ export const getRendererScript = () => `
           try {
             pageModule = await import(basePath + '.js');
           } catch (error) {
-            if (pageSlug === 'index' || pageSlug.endsWith('/index')) throw error;
-            pageModule = await import(basePath + '/index.js');
+            pageModuleError = pageModuleError || error;
+
+            // Only retry at <route>/index.js when the module genuinely could not
+            // be found. If it was found but failed to link or evaluate, retrying
+            // a path that does not exist replaces a precise error ("does not
+            // provide an export named 'createHash'") with a misleading 404.
+            const canRetryAsIndex = isModuleNotFoundError(error) &&
+              pageSlug !== 'index' && !pageSlug.endsWith('/index');
+
+            if (!canRetryAsIndex) throw pageModuleError;
+
+            try {
+              pageModule = await import(basePath + '/index.js');
+            } catch (indexError) {
+              // For a real <route>/index.tsx page, the first 404 was expected
+              // and this retry is the path that matters: if it reached a module
+              // and failed to link or evaluate, its error is the real one. Only
+              // when the retry 404s as well does the original describe more.
+              throw isModuleNotFoundError(indexError) ? pageModuleError : indexError;
+            }
           }
         }
 

package/esm/src/internal-agents/run-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAEL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAyVD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA2anB"}
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAGL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AA6VD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA2anB"}

package/esm/src/internal-agents/run-stream.js

@@ -10,7 +10,7 @@ import { importFirstPartyExtensionModule } from "../extensions/first-party-impor
 import { SandboxShellToolsProviderName, } from "../extensions/sandbox/index.js";
 import { resolveHostedRuntimeAllowedToolNames } from "../agent/hosted/runtime-essential-tools.js";
 import { SKILL_TOOL_IDS } from "../skill/types.js";
-import { isToolVisibleTo, toolRegistry, } from "../tool/index.js";
+import { createToolsFromHostDefinitions, isToolVisibleTo, toolRegistry, } from "../tool/index.js";
 import { addSpanEvent, setSpanAttributes, withSpan, } from "../observability/tracing/otlp-setup.js";
 import { defineSchema, lazySchema } from "../schemas/index.js";
 import { createStreamTransformState, finalizeRunEvents, formatAgUiEvent, mapRuntimeEventToAgUi, parseSseJsonEvents, } from "./ag-ui-sse.js";
@@ -210,15 +210,17 @@ async function buildProjectAgentSandboxTools(input) {
             : {}),
         getProjectId: () => sandboxConfig.projectId ?? input.deps.projectAgentSandbox?.projectId,
     });
-    const bash = sandboxResult.tools[PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME];
-    if (!bash) {
+    const declaredTools = input.agent.config.tools;
+    const materializedTools = createToolsFromHostDefinitions(sandboxResult.tools);
+    const configuredTools = isRecord(declaredTools)
+        ? Object.fromEntries(Object.entries(materializedTools).filter(([toolName]) => declaredTools[toolName] === true))
+        : {};
+    if (!configuredTools[PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME]) {
         await sandboxResult.closeSandbox();
         return {};
     }
     return {
-        tools: {
-            [PROJECT_AGENT_SANDBOX_BASH_TOOL_NAME]: bash,
-        },
+        tools: configuredTools,
         closeSandbox: sandboxResult.closeSandbox,
     };
 }

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts

@@ -8,6 +8,8 @@ export type ResolvedModuleDependency = {
     relativePath: string;
     depFilePath: string | null;
     isLocalLib: boolean;
+    /** True when discovered inside `import("…")` rather than a static import. */
+    isDynamic: boolean;
 };
 /** Resolved dependency after its source module has been transformed to a temp file. */
 export type TransformedModuleDependency = ResolvedModuleDependency & {

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAczE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgGD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAQR"}
+{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AA4BzE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AA4GD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAUR"}

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.js

@@ -1,25 +1,23 @@
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { parallelMap, rendererLogger } from "../../../utils/index.js";
-import { findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
+import { findDynamicImportSpans, findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
 import { findSourceFile } from "../file-resolver/index.js";
 const logger = rendererLogger.component("module-loader");
+const matchAlias = (specifier) => specifier.startsWith("@/") ? specifier : null;
+const matchRelative = (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1];
 function collectAliasImports(fileContent) {
-    return findStaticImportFromSpans(fileContent, (specifier) => specifier.startsWith("@/") ? specifier : null).map(({ original, path, start, end }) => ({
-        full: original,
-        path,
-        start,
-        end,
-    }));
+    const toAlias = (isDynamic) => ({ original, path, start, end }) => ({ full: original, path, start, end, isDynamic });
+    return [
+        ...findStaticImportFromSpans(fileContent, matchAlias).map(toAlias(false)),
+        ...findDynamicImportSpans(fileContent, matchAlias).map(toAlias(true)),
+    ];
 }
 function collectRelativeImports(fileContent, fileDir) {
-    return findStaticImportFromSpans(fileContent, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1])
-        .map(({ original, path, start, end }) => ({
-        full: original,
-        path,
-        fromDir: fileDir,
-        start,
-        end,
-    }))
+    const toRelative = (isDynamic) => ({ original, path, start, end }) => ({ full: original, path, fromDir: fileDir, start, end, isDynamic });
+    return [
+        ...findStaticImportFromSpans(fileContent, matchRelative).map(toRelative(false)),
+        ...findDynamicImportSpans(fileContent, matchRelative).map(toRelative(true)),
+    ]
         // Ignore already-transformed file:// imports.
         .filter((imp) => !imp.path.includes("file://"));
 }
@@ -70,6 +68,7 @@ async function resolveRelativeImport(imp, adapter) {
         relativePath: imp.path,
         depFilePath,
         isLocalLib: false,
+        isDynamic: imp.isDynamic,
     };
 }
 /** Resolves @/ alias and relative local imports from a source module. */
@@ -94,7 +93,9 @@ export function rewriteResolvedDependencyImports(fileContent, transformedDeps) {
         start: dep.start,
         end: dep.end,
         expected: dep.full,
-        replacement: `from "file://${dep.depTempPath}"`,
+        // A dynamic span covers only the quoted specifier; a static one covers the
+        // whole `from "…"` clause.
+        replacement: dep.isDynamic ? `"file://${dep.depTempPath}"` : `from "file://${dep.depTempPath}"`,
     }));
     return replaceSourceSpans(fileContent, replacements);
 }

package/esm/src/routing/api/context-builder.d.ts

@@ -11,10 +11,32 @@ export interface APIContext {
     cookies: Record<string, string>;
     headers: Headers;
     url: URL;
-    json: (data: unknown, init?: ResponseInit) => Response;
+    /**
+     * Read the request body as JSON, or build a JSON response.
+     *
+     * `ctx.json()` with no arguments parses and returns the request body.
+     * `ctx.json(data, init?)` returns a JSON `Response`.
+     */
+    json: {
+        (): Promise<unknown>;
+        (data: unknown, init?: ResponseInit): Response;
+    };
     text: (data: string, init?: ResponseInit) => Response;
     fs: FileSystemAdapter;
 }
+/**
+ * Build the `ctx.json` helper for a request.
+ *
+ * Overloaded on arity. `ctx.json(data)` builds a response; `ctx.json()` reads
+ * the request body, which is what handlers reach for, and what the zero-arg
+ * form was previously misread as. It used to stringify `undefined` into a
+ * Response, so `await ctx.json()` yielded a Response object that serialised
+ * back out as `{}` and silently dropped every posted payload.
+ *
+ * Exported because the isolation Worker builds its own context and has to
+ * behave identically. Handlers must not care which one ran them.
+ */
+export declare function createJsonHelper(request: Request): APIContext["json"];
 export declare function createContext(request: Request, match: RouteMatch, fs: FileSystemAdapter): APIContext;
 /**
  * @deprecated Use {@link flattenRouteParams} directly. Kept as a thin alias so

package/esm/src/routing/api/context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACvD,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACtD,EAAE,EAAE,iBAAiB,CAAC;CACvB;AAgBD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,iBAAiB,GACpB,UAAU,CAmBZ;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}
+{"version":3,"file":"context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT;;;;;OAKG;IACH,IAAI,EAAE;QACJ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;KAChD,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACtD,EAAE,EAAE,iBAAiB,CAAC;CACvB;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAUrE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,iBAAiB,GACpB,UAAU,CAmBZ;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}

package/esm/src/routing/api/context-builder.js

@@ -10,9 +10,30 @@ function createResponse(body, contentType, init) {
         },
     });
 }
+/**
+ * Build the `ctx.json` helper for a request.
+ *
+ * Overloaded on arity. `ctx.json(data)` builds a response; `ctx.json()` reads
+ * the request body, which is what handlers reach for, and what the zero-arg
+ * form was previously misread as. It used to stringify `undefined` into a
+ * Response, so `await ctx.json()` yielded a Response object that serialised
+ * back out as `{}` and silently dropped every posted payload.
+ *
+ * Exported because the isolation Worker builds its own context and has to
+ * behave identically. Handlers must not care which one ran them.
+ */
+export function createJsonHelper(request) {
+    function json(...args) {
+        if (args.length === 0)
+            return request.json();
+        const [data, init] = args;
+        return createResponse(JSON.stringify(data), "application/json", init);
+    }
+    return json;
+}
 export function createContext(request, match, fs) {
     const url = new URL(request.url);
-    const json = (data, init) => createResponse(JSON.stringify(data), "application/json", init);
+    const json = createJsonHelper(request);
     const text = (data, init) => createResponse(data, "text/plain", init);
     return {
         request,

package/esm/src/routing/api/handler.d.ts

@@ -6,6 +6,17 @@ import { loadHandlerModule } from "./module-loader/loader.js";
 import { discoverAppRoutes, discoverPagesRoutes } from "./route-discovery.js";
 import type { HandlerContext } from "../../types/index.js";
 export type { APIContext, APIRoute };
+/**
+ * Reduce a module load error to something safe to put in a response body.
+ *
+ * The message is worth returning, since it usually names a syntax or import
+ * error the developer can act on. The rest of it is not: a raw load error
+ * carries the temp directory the bundle was written to, absolute paths into the
+ * framework install, and a full stack trace. A path inside the project survives
+ * as a project-relative one, because that is the part that identifies the file
+ * to fix.
+ */
+export declare function sanitizeLoadErrorForResponse(message: string, projectDir?: string): string;
 /**
  * Injection interface for testing APIRouteHandler dependencies
  */
@@ -31,7 +42,6 @@ export declare class APIRouteHandler {
     private projectDir;
     private router;
     private routeCache;
-    private lastErrorMessage;
     private activeRequests;
     private destroyRequested;
     private destroyed;

package/esm/src/routing/api/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAE3E,qBAAa,eAAe;IAmBxB,OAAO,CAAC,UAAU;IAlBpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA2FxE,OAAO,CAAC,WAAW;IAuCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,UAAU;YAQJ,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAYrC;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAYzF;AAED;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAW3E,qBAAa,eAAe;IAkBxB,OAAO,CAAC,UAAU;IAjBpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAwGxE,OAAO,CAAC,WAAW;IAsCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,UAAU;YAQJ,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}

package/esm/src/routing/api/handler.js

@@ -12,6 +12,33 @@ import { executeAppRoute, executePagesRoute } from "./route-executor.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 /** Max entries in the loaded-handler LRU cache */
 const HANDLER_CACHE_MAX_ENTRIES = 256;
+/** Longest sanitised load error a response body carries. */
+const MAX_LOAD_ERROR_LENGTH = 300;
+/**
+ * Roots that only ever identify the machine running the server: home
+ * directories and the temp directories bundling writes to.
+ */
+const MACHINE_PATH_PATTERN = /(?:file:\/\/)?\/(?:private\/)?(?:Users|home|root|var\/folders|var\/tmp|tmp)\/\S*/g;
+/**
+ * Reduce a module load error to something safe to put in a response body.
+ *
+ * The message is worth returning, since it usually names a syntax or import
+ * error the developer can act on. The rest of it is not: a raw load error
+ * carries the temp directory the bundle was written to, absolute paths into the
+ * framework install, and a full stack trace. A path inside the project survives
+ * as a project-relative one, because that is the part that identifies the file
+ * to fix.
+ */
+export function sanitizeLoadErrorForResponse(message, projectDir) {
+    // A stack trace is never the actionable part.
+    let text = (message.split("\n")[0] ?? "").trim();
+    if (projectDir) {
+        const root = projectDir.replace(/\/+$/, "");
+        text = text.replaceAll(`file://${root}/`, "").replaceAll(`${root}/`, "");
+    }
+    text = text.replace(MACHINE_PATH_PATTERN, "<PATH>");
+    return text.length > MAX_LOAD_ERROR_LENGTH ? `${text.slice(0, MAX_LOAD_ERROR_LENGTH)}...` : text;
+}
 let injectedDeps = null;
 /**
  * Inject dependencies for testing. Pass null to reset to defaults.
@@ -31,7 +58,6 @@ export class APIRouteHandler {
     projectDir;
     router = new ApiRouteMatcher();
     routeCache = new LRUCache({ maxEntries: HANDLER_CACHE_MAX_ENTRIES });
-    lastErrorMessage = null;
     activeRequests = 0;
     destroyRequested = false;
     destroyed = false;
@@ -116,18 +142,27 @@ export class APIRouteHandler {
                 page: match.route.page,
                 params: match.params,
             });
-            const handler = await this.loadHandler(match);
+            const { handler, errorMessage } = await this.loadHandler(match);
             if (!handler) {
+                const msg = errorMessage ?? "Handler not found";
                 try {
-                    logger.error(`handler module failed to load: ${match.route.page}`);
+                    // The full detail, paths and all, belongs in the log.
+                    logger.error(`handler module failed to load: ${match.route.page}`, { reason: msg });
                 }
                 catch (e) {
                     logger.warn("API error log failed", e);
                 }
-                const msg = this.lastErrorMessage ?? "Handler not found";
                 if (msg.includes("Remote import blocked by allow-list"))
                     return badGateway(msg);
-                return internalServerError("Handler not found");
+                // The reason the module failed to load is the only useful thing here.
+                // Reporting a flat "Handler not found" for what is usually a syntax or
+                // import error sends people hunting for a routing problem that does
+                // not exist. Local development only, and sanitised: a raw load error
+                // carries temp directories, absolute paths and a stack trace, none of
+                // which belong in a response body.
+                return internalServerError(ctx?.isLocalProject
+                    ? sanitizeLoadErrorForResponse(msg, this.projectDir)
+                    : "Handler not found");
             }
             // App Router routes are always named route.ts/js/tsx/jsx
             // Pages Router routes have descriptive names like articles.ts
@@ -156,7 +191,7 @@ export class APIRouteHandler {
             await this.ensureConfig(adapter);
             const cached = this.routeCache.get(modulePath);
             if (cached)
-                return cached;
+                return { handler: cached, errorMessage: null };
             try {
                 const deps = getDeps();
                 const handler = await deps.loadHandlerModule({
@@ -168,16 +203,15 @@ export class APIRouteHandler {
                 // Only cache handlers that export at least one HTTP method.
                 // Empty objects ({}) from failed imports are truthy but useless —
                 // caching them would prevent retry after the user fixes the import.
-                if (handler && Object.keys(handler).length > 0) {
-                    this.routeCache.set(modulePath, handler);
-                }
-                return handler && Object.keys(handler).length > 0 ? handler : null;
+                const usable = handler && Object.keys(handler).length > 0 ? handler : null;
+                if (usable)
+                    this.routeCache.set(modulePath, usable);
+                return { handler: usable, errorMessage: null };
             }
             catch (error) {
                 const msg = error instanceof Error ? error.message : String(error);
-                this.lastErrorMessage = msg;
                 logger.error(`[API] Failed to load handler for ${modulePath}: ${msg}`);
-                return null;
+                return { handler: null, errorMessage: msg };
             }
         }, { "api.modulePath": modulePath });
     }

package/esm/src/routing/api/module-loader/loader.d.ts

@@ -2,4 +2,9 @@ import type { APIRoute, LoadModuleOptions } from "./types.js";
 export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveEsmUserDependencies, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
 export { toCjsDestructureBindings } from "./loader-helpers.js";
 export declare function loadHandlerModule(options: LoadModuleOptions): Promise<APIRoute | null>;
+/**
+ * True when a module failed to load because Deno could not resolve one of its
+ * import specifiers, rather than because the module itself is broken.
+ */
+export declare function isSpecifierResolutionError(error: unknown): boolean;
 //# sourceMappingURL=loader.d.ts.map

package/esm/src/routing/api/module-loader/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkB9D,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkB9D,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF;AA0DD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIlE"}