veryfront 0.1.112 → 0.1.113

package/esm/cli/commands/completions/command-help.d.ts

@@ -0,0 +1,3 @@
+import type { CommandHelp } from "../../help/types.js";
+export declare const completionsHelp: CommandHelp;
+//# sourceMappingURL=command-help.d.ts.map

package/esm/cli/commands/completions/command-help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-help.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/completions/command-help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,WAY7B,CAAC"}

package/esm/cli/commands/completions/command-help.js

@@ -0,0 +1,13 @@
+export const completionsHelp = {
+    name: "completions",
+    category: "development",
+    description: "Generate shell completion scripts",
+    usage: "veryfront completions <shell>",
+    options: [],
+    examples: [
+        "veryfront completions bash",
+        "veryfront completions zsh",
+        "veryfront completions fish",
+        'eval "$(veryfront completions bash)"',
+    ],
+};

package/esm/cli/commands/completions/command.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shell completion generators
+ *
+ * Generates completion scripts from the COMMANDS registry.
+ *
+ * @module cli/commands/completions
+ */
+import type { CommandOption } from "../../help/types.js";
+/** Escape a string for use in shell single-quoted contexts */
+export declare function shellEscape(s: string): string;
+/**
+ * Extract long flags (--name) from a CommandOption flag string.
+ * Handles formats like: "--port", "-p, --port", "-p, --port <number>"
+ */
+export declare function extractLongFlags(options: CommandOption[]): string[];
+/**
+ * Extract short and long flags for fish completions.
+ * Returns { short: "p", long: "port" } pairs.
+ */
+export declare function extractFishFlags(options: CommandOption[]): Array<{
+    short?: string;
+    long?: string;
+    description: string;
+}>;
+export declare function generateBashCompletions(): string;
+export declare function generateZshCompletions(): string;
+export declare function generateFishCompletions(): string;
+//# sourceMappingURL=command.d.ts.map

package/esm/cli/commands/completions/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/completions/command.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAOnE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,aAAa,EAAE,GACvB,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/D;AAaD,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CA4C/C;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAgChD"}

package/esm/cli/commands/completions/command.js

@@ -0,0 +1,133 @@
+/**
+ * Shell completion generators
+ *
+ * Generates completion scripts from the COMMANDS registry.
+ *
+ * @module cli/commands/completions
+ */
+import { COMMANDS } from "../../help/command-definitions.js";
+/** Escape a string for use in shell single-quoted contexts */
+export function shellEscape(s) {
+    return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+/**
+ * Extract long flags (--name) from a CommandOption flag string.
+ * Handles formats like: "--port", "-p, --port", "-p, --port <number>"
+ */
+export function extractLongFlags(options) {
+    return options.flatMap((o) => o.flag
+        .split(",")
+        .map((f) => f.trim().split(" ")[0])
+        .filter((f) => f.startsWith("--")));
+}
+/**
+ * Extract short and long flags for fish completions.
+ * Returns { short: "p", long: "port" } pairs.
+ */
+export function extractFishFlags(options) {
+    return options.map((o) => {
+        const parts = o.flag.split(",").map((f) => f.trim().split(" ")[0]);
+        const short = parts.find((p) => p.match(/^-[a-zA-Z]$/))?.slice(1);
+        const long = parts.find((p) => p.startsWith("--"))?.slice(2);
+        return { short, long, description: o.description };
+    });
+}
+const GLOBAL_FLAGS = [
+    "--json",
+    "--yes",
+    "--quiet",
+    "--verbose",
+    "--help",
+    "--version",
+    "--no-color",
+    "--output",
+];
+export function generateBashCompletions() {
+    const commands = Object.values(COMMANDS);
+    const cmdNames = commands.map((c) => c.name).join(" ");
+    let script = `# Veryfront CLI bash completions\n_veryfront_completions() {\n`;
+    script += `  local cur prev commands\n`;
+    script += `  cur="\${COMP_WORDS[COMP_CWORD]}"\n`;
+    script += `  prev="\${COMP_WORDS[COMP_CWORD-1]}"\n`;
+    script += `  commands="${cmdNames}"\n\n`;
+    script += `  if [[ \${COMP_CWORD} -eq 1 ]]; then\n`;
+    script += `    COMPREPLY=( $(compgen -W "\${commands}" -- "\${cur}") )\n`;
+    script += `    return\n`;
+    script += `  fi\n\n`;
+    script += `  case "\${COMP_WORDS[1]}" in\n`;
+    for (const cmd of commands) {
+        const flags = extractLongFlags(cmd.options ?? [])
+            .concat(GLOBAL_FLAGS)
+            .join(" ");
+        script += `    ${cmd.name}) COMPREPLY=( $(compgen -W "${flags}" -- "\${cur}") ) ;;\n`;
+    }
+    script += `    *) COMPREPLY=( $(compgen -W "${GLOBAL_FLAGS.join(" ")}" -- "\${cur}") ) ;;\n`;
+    script += `  esac\n`;
+    script += `}\n`;
+    script += `complete -F _veryfront_completions veryfront\n`;
+    return script;
+}
+export function generateZshCompletions() {
+    const commands = Object.values(COMMANDS);
+    let script = `#compdef veryfront\n# Veryfront CLI zsh completions\n\n`;
+    script += `_veryfront() {\n`;
+    script += `  local -a commands\n`;
+    script += `  commands=(\n`;
+    for (const cmd of commands) {
+        const desc = shellEscape(cmd.description);
+        script += `    '${cmd.name}:${desc}'\n`;
+    }
+    script += `  )\n\n`;
+    script += `  _arguments -C \\\n`;
+    script += `    '1:command:->command' \\\n`;
+    script += `    '*::arg:->args'\n\n`;
+    script += `  case $state in\n`;
+    script += `    command)\n`;
+    script += `      _describe 'command' commands\n`;
+    script += `      ;;\n`;
+    script += `    args)\n`;
+    script += `      case \${words[1]} in\n`;
+    for (const cmd of commands) {
+        const flags = extractLongFlags(cmd.options ?? []).concat(GLOBAL_FLAGS);
+        if (flags.length > 0) {
+            const zshFlags = flags.map((f) => `'${f}[${shellEscape((cmd.options ?? []).find((o) => o.flag.includes(f))?.description ??
+                "")}]'`).join(" ");
+            script += `        ${cmd.name}) _arguments ${zshFlags} ;;\n`;
+        }
+    }
+    script += `      esac\n`;
+    script += `      ;;\n`;
+    script += `  esac\n`;
+    script += `}\n\n`;
+    script += `_veryfront\n`;
+    return script;
+}
+export function generateFishCompletions() {
+    const commands = Object.values(COMMANDS);
+    let script = `# Veryfront CLI fish completions\n`;
+    for (const cmd of commands) {
+        const desc = shellEscape(cmd.description);
+        script += `complete -c veryfront -n '__fish_use_subcommand' -a '${cmd.name}' -d '${desc}'\n`;
+    }
+    script += `\n`;
+    for (const cmd of commands) {
+        const flags = extractFishFlags(cmd.options ?? []);
+        for (const flag of flags) {
+            if (flag.long) {
+                const desc = shellEscape(flag.description);
+                let line = `complete -c veryfront -n '__fish_seen_subcommand_from ${cmd.name}' -l '${flag.long}'`;
+                if (flag.short) {
+                    line += ` -s '${flag.short}'`;
+                }
+                line += ` -d '${desc}'\n`;
+                script += line;
+            }
+            else if (flag.short) {
+                const desc = shellEscape(flag.description);
+                script +=
+                    `complete -c veryfront -n '__fish_seen_subcommand_from ${cmd.name}' -s '${flag.short}' -d '${desc}'\n`;
+            }
+        }
+    }
+    return script;
+}

package/esm/cli/commands/completions/handler.d.ts

@@ -0,0 +1,3 @@
+import type { ParsedArgs } from "../../shared/types.js";
+export declare function handleCompletionsCommand(args: ParsedArgs): Promise<void>;
+//# sourceMappingURL=handler.d.ts.map

package/esm/cli/commands/completions/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/completions/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAOxD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/esm/cli/commands/completions/handler.js

@@ -0,0 +1,20 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import { generateBashCompletions, generateFishCompletions, generateZshCompletions, } from "./command.js";
+export async function handleCompletionsCommand(args) {
+    const shell = args._[1];
+    switch (shell) {
+        case "bash":
+            console.log(generateBashCompletions());
+            break;
+        case "zsh":
+            console.log(generateZshCompletions());
+            break;
+        case "fish":
+            console.log(generateFishCompletions());
+            break;
+        default:
+            console.error("Usage: veryfront completions <bash|zsh|fish>");
+            console.error('Example: eval "$(veryfront completions bash)"');
+            dntShim.Deno.exit(1);
+    }
+}

package/esm/cli/help/command-definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-definitions.d.ts","sourceRoot":"","sources":["../../../src/cli/help/command-definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAsClD;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,eAoCtB,CAAC"}
+{"version":3,"file":"command-definitions.d.ts","sourceRoot":"","sources":["../../../src/cli/help/command-definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAuClD;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,eAqCtB,CAAC"}

package/esm/cli/help/command-definitions.js

@@ -39,6 +39,7 @@ import { schemaHelp } from "../commands/schema/command-help.js";
 import { testHelp } from "../commands/test/command-help.js";
 import { lintHelp } from "../commands/lint/command-help.js";
 import { skillsHelp } from "../commands/skills/command-help.js";
+import { completionsHelp } from "../commands/completions/command-help.js";
 /**
  * Central registry of all command help definitions.
  * Each command's help is imported from its respective command-help.ts file.
@@ -79,4 +80,5 @@ export const COMMANDS = {
     test: testHelp,
     lint: lintHelp,
     skills: skillsHelp,
+    completions: completionsHelp,
 };

package/esm/cli/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/cli/router.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAgEpD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ClE"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/cli/router.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4CH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAiEpD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DlE"}

package/esm/cli/router.js

@@ -37,6 +37,7 @@ import { handleSchemaCommand } from "./commands/schema/handler.js";
 import { handleTestCommand } from "./commands/test/handler.js";
 import { handleLintCommand } from "./commands/lint/handler.js";
 import { handleSkillsCommand } from "./commands/skills/handler.js";
+import { handleCompletionsCommand } from "./commands/completions/handler.js";
 import { login, logout, whoami } from "./auth/index.js";
 import { parseLoginMethod } from "./auth/utils.js";
 import { showCommandHelp, showMainHelp } from "./help/index.js";
@@ -93,6 +94,7 @@ const commands = {
     "test": handleTestCommand,
     "lint": handleLintCommand,
     "skills": handleSkillsCommand,
+    "completions": handleCompletionsCommand,
 };
 /**
  * Show help for a specific command or main help
@@ -146,8 +148,22 @@ export async function routeCommand(args) {
         }
         const handler = command ? commands[command] : undefined;
         if (command && !handler) {
+            const { suggestCommand } = await import("./shared/suggest.js");
+            const { COMMANDS } = await import("./help/command-definitions.js");
+            // Use canonical command names from help registry (excludes aliases like "g", "preview")
+            const canonicalNames = Object.keys(COMMANDS);
+            const suggestions = suggestCommand(command, canonicalNames);
             cliLogger.error(`Unknown command: ${command}\n`);
-            showHelp();
+            if (suggestions.length > 0) {
+                cliLogger.info(`  Did you mean?`);
+                for (const s of suggestions) {
+                    const desc = COMMANDS[s]?.description ?? "";
+                    cliLogger.info(`    ${s}    ${desc}`);
+                }
+            }
+            else {
+                showHelp();
+            }
             exitProcess(1);
             return;
         }

package/esm/cli/shared/suggest.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Command suggestion via Levenshtein distance
+ *
+ * @module cli/shared/suggest
+ */
+export declare function levenshtein(a: string, b: string): number;
+export declare function suggestCommand(input: string, commands: string[], maxDistance?: number): string[];
+//# sourceMappingURL=suggest.d.ts.map

package/esm/cli/shared/suggest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/suggest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,SAAI,GACd,MAAM,EAAE,CAMV"}

package/esm/cli/shared/suggest.js

@@ -0,0 +1,25 @@
+/**
+ * Command suggestion via Levenshtein distance
+ *
+ * @module cli/shared/suggest
+ */
+export function levenshtein(a, b) {
+    const matrix = [];
+    for (let i = 0; i <= a.length; i++)
+        matrix[i] = [i];
+    for (let j = 0; j <= b.length; j++)
+        matrix[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            matrix[i][j] = Math.min(matrix[i - 1][j] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+    }
+    return matrix[a.length][b.length];
+}
+export function suggestCommand(input, commands, maxDistance = 2) {
+    return commands
+        .map((cmd) => ({ cmd, dist: levenshtein(input, cmd) }))
+        .filter(({ dist }) => dist <= maxDistance)
+        .sort((a, b) => a.dist - b.dist)
+        .map(({ cmd }) => cmd);
+}

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.112",
+    "version": "0.1.113",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/html/dev-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../src/src/html/dev-scripts.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BnD;AAMD,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,UAAU,mBAAmB;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAwBrE"}
+{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../src/src/html/dev-scripts.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BnD;AAMD,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,UAAU,mBAAmB;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAwBrE"}

package/esm/src/html/dev-scripts.js

@@ -1,5 +1,6 @@
+import { escapeHtml } from "./html-escape.js";
 export function getDevStyles(nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     return `
   <style${nonceAttr}>
     .dev-indicator {
@@ -30,7 +31,7 @@ export function getDevStyles(nonce) {
   </style>`;
 }
 function getNonceAttr(nonce) {
-    return nonce ? ` nonce="${nonce}"` : "";
+    return nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
 }
 export function getDevScripts(_hmrPort, nonce) {
     const nonceAttr = getNonceAttr(nonce);

package/esm/src/html/html-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-injection.d.ts","sourceRoot":"","sources":["../../../src/src/html/html-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAS/D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,MAAM,CAoFR"}
+{"version":3,"file":"html-injection.d.ts","sourceRoot":"","sources":["../../../src/src/html/html-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAU/D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,MAAM,CAoFR"}

package/esm/src/html/html-injection.js

@@ -1,4 +1,5 @@
 import { generateLinkTags, generateMetaTags, generateScriptTags, generateStyleTags, } from "./tag-generators.js";
+import { escapeHtml } from "./html-escape.js";
 import { getDevScripts, getDevStyles, getProdScripts, getStudioScripts } from "./dev-scripts.js";
 export function injectHTMLContent(template, content, metadata, options) {
     let html = template;
@@ -19,7 +20,7 @@ export function injectHTMLContent(template, content, metadata, options) {
     }
     // Inject import map into <head> for ESM module resolution (must be before any module scripts)
     if (options.importMapJson && /<\/head>/i.test(html)) {
-        const nonceAttr = options.nonce ? ` nonce="${options.nonce}"` : "";
+        const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
         const importMapTag = `<script type="importmap"${nonceAttr}>\n${options.importMapJson}\n</script>`;
         html = html.replace(/<\/head>/i, `${importMapTag}\n</head>`);
     }

package/esm/src/html/html-shell-generator.js

@@ -133,7 +133,7 @@ async function generateHTMLShellPartsImpl(meta, options, params, props, contentF
     const criticalDepsPreload = jsxRuntimeUrl
         ? `<link rel="modulepreload" href="${jsxRuntimeUrl}">`
         : "";
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHTML(nonce)}"` : "";
     // Expose project slug for runtime error overlay "Fix in Veryfront" button
     const overlaySlug = options.projectId || meta.slug;
     const slugForOverlay = useDevScripts && overlaySlug

package/esm/src/html/hydration-script-builder/dev-client-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-client-renderer.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-client-renderer.ts"],"names":[],"mappings":"AAEA,wBAAgB,+BAA+B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CActE"}
+{"version":3,"file":"dev-client-renderer.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-client-renderer.ts"],"names":[],"mappings":"AAGA,wBAAgB,+BAA+B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CActE"}

package/esm/src/html/hydration-script-builder/dev-client-renderer.js

@@ -1,6 +1,7 @@
 import { getLoaderScript, getRendererScript, getRouterScript } from "./templates/index.js";
+import { escapeHtml } from "../html-escape.js";
 export function generateDevClientRendererScript(nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     return `
   <script type="module"${nonceAttr}>
     import * as React from 'react';

package/esm/src/html/hydration-script-builder/dev-component-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-component-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-component-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAQR"}
+{"version":3,"file":"dev-component-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-component-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAQR"}

package/esm/src/html/hydration-script-builder/dev-component-manifest.js

@@ -1,5 +1,6 @@
+import { escapeHtml } from "../html-escape.js";
 export function generateDevComponentManifestScript(config, nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     const components = config.dev?.components ?? [];
     return `
   <script${nonceAttr}>

package/esm/src/html/hydration-script-builder/dev-error-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-error-logger.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-error-logger.ts"],"names":[],"mappings":"AAIA,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAyDnE"}
+{"version":3,"file":"dev-error-logger.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-error-logger.ts"],"names":[],"mappings":"AAMA,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAyDnE"}

package/esm/src/html/hydration-script-builder/dev-error-logger.js

@@ -1,5 +1,6 @@
+import { escapeHtml } from "../html-escape.js";
 function getOpenScriptTag(nonce) {
-    return nonce ? `<script nonce="${nonce}">` : "<script>";
+    return nonce ? `<script nonce="${escapeHtml(nonce)}">` : "<script>";
 }
 export function generateDevErrorLoggerScript(nonce) {
     const openScriptTag = getOpenScriptTag(nonce);

package/esm/src/html/hydration-script-builder/dev-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAiB7D,UAAU,iBAAiB;IACzB,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,iBAAiB,GAC1B,MAAM,CAaR"}
+{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/dev-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkB7D,UAAU,iBAAiB;IACzB,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,iBAAiB,GAC1B,MAAM,CAaR"}

package/esm/src/html/hydration-script-builder/dev-scripts.js

@@ -1,3 +1,4 @@
+import { escapeHtml } from "../html-escape.js";
 import { generateDevErrorLoggerScript } from "./dev-error-logger.js";
 import { generateDevComponentManifestScript } from "./dev-component-manifest.js";
 import { generateDevClientRendererScript } from "./dev-client-renderer.js";
@@ -5,7 +6,7 @@ function generateHMRScript(config, nonce, skipDevHMR) {
     // Skip dev HMR script when preview-hmr.js will be used instead
     if (skipDevHMR || !config.dev?.hmr)
         return "";
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     return `<script type="module" src="/_veryfront/hmr.js"${nonceAttr}></script>`;
 }
 export function getDevScripts(_slug, config, _params, _props, nonce, options) {

package/esm/src/html/hydration-script-builder/prod-hydration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-hydration.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/prod-hydration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,KAAK,CAAC,EAAE,cAAc,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgCR"}
+{"version":3,"file":"prod-hydration.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/prod-hydration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,KAAK,CAAC,EAAE,cAAc,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgCR"}

package/esm/src/html/hydration-script-builder/prod-hydration.js

@@ -1,5 +1,6 @@
+import { escapeHtml } from "../html-escape.js";
 export function generateProdHydrationScript(slug, _params, props, nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     const pageProps = JSON.stringify(props ?? {});
     return `
   <script type="module"${nonceAttr}>

package/esm/src/html/hydration-script-builder/prod-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-scripts.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/prod-scripts.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAeR"}
+{"version":3,"file":"prod-scripts.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/prod-scripts.ts"],"names":[],"mappings":"AAGA,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAeR"}

package/esm/src/html/hydration-script-builder/prod-scripts.js

@@ -1,6 +1,7 @@
 import { getLoaderScript, getRendererScript, getRouterScript } from "./templates/index.js";
+import { escapeHtml } from "../html-escape.js";
 export function getProdScripts(_slug, _params, _props, nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     return `
   <script type="module"${nonceAttr}>
     import * as React from 'react';

package/esm/src/html/styles-builder/dev-styles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-styles.d.ts","sourceRoot":"","sources":["../../../../src/src/html/styles-builder/dev-styles.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBnD"}
+{"version":3,"file":"dev-styles.d.ts","sourceRoot":"","sources":["../../../../src/src/html/styles-builder/dev-styles.ts"],"names":[],"mappings":"AAGA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBnD"}

package/esm/src/html/styles-builder/dev-styles.js

@@ -1,6 +1,7 @@
 import { Z_INDEX_ERROR_OVERLAY } from "../../utils/index.js";
+import { escapeHtml } from "../html-escape.js";
 export function getDevStyles(nonce) {
-    const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+    const nonceAttr = nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
     return `
   <style${nonceAttr}>
     #veryfront-error-overlay {

package/esm/src/modules/react-loader/ssr-module-loader/http-bundle-helpers.d.ts

@@ -7,6 +7,11 @@
  * @module module-system/react-loader/ssr-module-loader/http-bundle-helpers
  */
 import { LRUCache } from "../../../utils/lru-wrapper.js";
+/**
+ * Visit VF module code blocks imported by the given module, including nested VF modules.
+ * The visitor receives both the module code and the absolute vfmod file path.
+ */
+export declare function visitImportedVfModules(code: string, visitor: (vfModuleCode: string, vfModulePath?: string) => void | Promise<void>): Promise<void>;
 /**
  * Recursively extract all HTTP bundle paths from code and any VF modules it imports.
  * This ensures transitive HTTP bundle dependencies through VF modules are discovered.
@@ -27,6 +32,11 @@ export declare function extractHttpBundlePaths(code: string): Array<{
  * other pods with different temp directories.
  */
 export declare function extractAllFilePaths(code: string): string[];
+/**
+ * Extract all file:// paths from cached code and any transitively imported VF modules.
+ * This catches stale pod-local paths that only appear in nested vfmod dependencies.
+ */
+export declare function extractAllFilePathsRecursive(code: string): Promise<string[]>;
 /**
  * Track modules whose HTTP bundles have been verified, keyed by tempPath:contentHash.
  * Bounded LRU to prevent unbounded memory growth in long-running pods.

package/esm/src/modules/react-loader/ssr-module-loader/http-bundle-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-bundle-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/http-bundle-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AA2BzD;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmDhD;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAElC,CAAC"}
+{"version":3,"file":"http-bundle-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/http-bundle-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AA2BzD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAC7E,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAyBhD;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBlF;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAElC,CAAC"}