veryfront 0.1.1233 → 0.1.1235

package/esm/_dnt.shims.js

@@ -1,14 +1,29 @@
-import { Deno as dntShimDeno } from "@deno/shim-deno";
 const dntNativeDeno = globalThis.Deno;
 // Prefer the host runtime's own Deno. The `@deno/shim-deno` fallback exists
 // for Node and Bun; under Deno it shadows working native APIs with node:net
 // reimplementations that throw (e.g. Deno.listen reads `server._handle.fd`,
 // which is null on Deno's node compatibility layer).
+//
+// It loads lazily so Deno never resolves it at all. The esm transform
+// rewrites the bare specifier to an absolute file:// bundle, and Deno
+// refuses to prepare that graph node when node_modules is unmanaged, which
+// is what `deno install -g` produces (`nodeModulesDir: "manual"`). A static
+// import therefore failed every request with "Loading unprepared module"
+// naming a bundle that was present on disk, on the one runtime that never
+// reads the value.
 export const Deno = typeof dntNativeDeno?.version?.deno === "string"
     ? dntNativeDeno
-    : dntShimDeno;
-import { crypto } from "@deno/shim-crypto";
-export { crypto } from "@deno/shim-crypto";
+    : (await import("@deno/shim-deno")).Deno;
+const dntNativeCrypto = globalThis.crypto;
+// Web Crypto is a global on every runtime the framework supports (Deno,
+// Node 19+, Bun), so `@deno/shim-crypto` is a fallback for runtimes that no
+// longer exist in practice. It loads lazily for the same reason the Deno
+// shim does: the esm transform rewrites the bare specifier to an absolute
+// file:// bundle, and Deno cannot prepare that graph node when node_modules
+// is unmanaged.
+export const crypto = dntNativeCrypto !== undefined
+    ? dntNativeCrypto
+    : (await import("@deno/shim-crypto")).crypto;
 const dntGlobals = {
     Deno,
     crypto,

package/esm/deno.d.ts

@@ -432,6 +432,9 @@ declare namespace _default {
         "lint:chat-ratchets": string;
         "lint:esm-sh-codemod": string;
         "lint:test-typecheck": string;
+        "lint:client-bundle": string;
+        "lint:client-bundle:update": string;
+        "client-bundle:report": string;
         docs: string;
         "docs:api-reference:check": string;
         "docs:errors": string;

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1233",
+    "version": "0.1.1235",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {
@@ -496,7 +496,7 @@ export default {
         "build:storybook": "npm --prefix storybook run build-storybook",
         "storybook:check": "deno test --no-lock --config=scripts/test.deno.json --no-check --allow-read scripts/storybook/storybook-workbench.test.ts",
         "lint": "DENO_NO_PACKAGE_JSON=1 deno lint && deno lint --config=scripts/test.deno.json scripts/test/ scripts/build/dnt-meta-property-safety.ts scripts/build/dnt-meta-property-safety.test.ts scripts/build/dnt-polyfill.ts scripts/build/dnt-polyfill.test.ts scripts/build/npm-package-metadata.test.ts scripts/build/prepare-framework-sources.test.ts && deno lint --config=scripts/codemods/deno.json scripts/codemods/",
-        "lint:ci": "deno task lint && deno task lint:core-deps && deno task lint:cross-runtime-jsr && deno task lint:dependency-boundaries && deno task lint:module-boundaries && deno task lint:extension-contracts && deno task lint:extension-capabilities && deno task lint:ban-test-only && deno task lint:sanitizer-baseline && deno task lint:skipped-tests && deno task lint:chat-ratchets && deno task lint:chat-composability && deno task lint:rfc-status && deno task lint:esm-sh-codemod && deno task lint:test-typecheck && deno task lint:cwd-relative-test-reads && deno task lint:dnt-meta-properties && deno task storybook:check && deno task docs:api-reference:check && deno task docs:errors:check && deno task docs:public:check && deno test --frozen --config=scripts/test.deno.json --no-check --allow-read --allow-write --allow-run=bash scripts/ci/setup-deno-workflow.test.ts scripts/ci/prepare-rc-build.test.ts scripts/build/generated-artifact-checks.test.ts",
+        "lint:ci": "deno task lint && deno task lint:core-deps && deno task lint:cross-runtime-jsr && deno task lint:dependency-boundaries && deno task lint:module-boundaries && deno task lint:client-bundle && deno task lint:extension-contracts && deno task lint:extension-capabilities && deno task lint:ban-test-only && deno task lint:sanitizer-baseline && deno task lint:skipped-tests && deno task lint:chat-ratchets && deno task lint:chat-composability && deno task lint:rfc-status && deno task lint:esm-sh-codemod && deno task lint:test-typecheck && deno task lint:cwd-relative-test-reads && deno task lint:dnt-meta-properties && deno task storybook:check && deno task docs:api-reference:check && deno task docs:errors:check && deno task docs:public:check && deno test --frozen --config=scripts/test.deno.json --no-check --allow-read --allow-write --allow-run=bash scripts/ci/setup-deno-workflow.test.ts scripts/ci/prepare-rc-build.test.ts scripts/build/generated-artifact-checks.test.ts",
         "fmt": "deno fmt src/ cli/ react/ templates/ && deno fmt --config=scripts/test.deno.json scripts/test/ scripts/build/dnt-meta-property-safety.ts scripts/build/dnt-meta-property-safety.test.ts scripts/build/dnt-polyfill.ts scripts/build/dnt-polyfill.test.ts scripts/build/prepare-framework-sources.test.ts && deno fmt --config=scripts/codemods/deno.json scripts/codemods/",
         "fmt:check": "deno fmt --check src/ cli/ react/ templates/ && deno fmt --check --config=scripts/test.deno.json scripts/test/ scripts/build/dnt-meta-property-safety.ts scripts/build/dnt-meta-property-safety.test.ts scripts/build/dnt-polyfill.ts scripts/build/dnt-polyfill.test.ts scripts/build/prepare-framework-sources.test.ts && deno fmt --check --config=scripts/codemods/deno.json scripts/codemods/",
         "typecheck": "deno task generate:manifests:check && deno check src/index.ts cli/main.ts src/server/index.ts src/routing/api/index.ts src/rendering/index.ts src/platform/index.ts src/platform/adapters/index.ts src/build/index.ts src/build/production-build/index.ts src/transforms/index.ts src/config/index.ts src/utils/index.ts src/data/index.ts src/security/index.ts src/middleware/index.ts src/server/handlers/dev/index.ts src/server/handlers/request/api/index.ts src/rendering/cache/index.ts src/rendering/cache/stores/index.ts src/rendering/rsc/actions/index.ts src/html/index.ts src/html/hydration-script-builder/runtime/main.ts src/modules/index.ts src/proxy/main.ts src/react/components/ui/index.ts src/chat/index.ts src/markdown/index.ts src/mdx/index.ts src/fs/index.ts src/oauth/index.ts src/agent/index.ts src/agent/service/route-export.check.ts src/eval/index.ts src/tool/index.ts src/workflow/index.ts src/prompt/index.ts src/resource/index.ts src/runs/index.ts src/mcp/index.ts src/provider/index.ts",
@@ -508,6 +508,9 @@ export default {
         "lint:chat-ratchets": "deno run --allow-read scripts/lint/ban-chat-antipatterns.ts && deno check --no-config --frozen --lock=deno.lock scripts/codemods/migrate-chat-composition.ts && deno check --config=deno.json --frozen --lock=deno.lock src/react/chat-barrels.check.ts && deno test --frozen --config=scripts/codemods/deno.json --no-check --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-chat-composition.test.ts",
         "lint:esm-sh-codemod": "deno check --no-config --frozen --lock=deno.lock scripts/codemods/migrate-esm-sh-imports.ts && deno test --frozen --config=scripts/codemods/deno.json --no-check --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-esm-sh-imports.test.ts",
         "lint:test-typecheck": "deno run --allow-read --allow-run scripts/lint/check-test-typecheck-baseline.ts",
+        "lint:client-bundle": "deno lint --config=scripts/test.deno.json scripts/lint/client-bundle-graph.ts scripts/lint/audit-client-bundle.ts scripts/lint/client-bundle-graph.test.ts && deno run --allow-read scripts/lint/audit-client-bundle.ts && deno test --frozen --config=scripts/test.deno.json --no-check --allow-read scripts/lint/client-bundle-graph.test.ts",
+        "lint:client-bundle:update": "deno run --allow-read --allow-write scripts/lint/audit-client-bundle.ts --update",
+        "client-bundle:report": "deno run --allow-read scripts/lint/audit-client-bundle.ts --markdown",
         "docs": "deno run --allow-read --allow-write --allow-run --allow-env scripts/docs/generate-api-reference.ts",
         "docs:api-reference:check": "deno run --allow-read --allow-write --allow-run --allow-env scripts/docs/generate-api-reference.ts --check",
         "docs:errors": "deno run --allow-read --allow-write --allow-run --allow-env scripts/docs/generate-error-reference.ts",

package/esm/src/cache/backends/factory.js

@@ -15,7 +15,7 @@ export function isApiCacheAvailable() {
     const apiUrl = getHostEnv("VERYFRONT_API_BASE_URL");
     const isProduction = proxyMode === "1" ||
         nodeEnv === "production" ||
-        !!(apiUrl && !apiUrl.includes("localhost") && !apiUrl.includes("lvh.me"));
+        !!(apiUrl && !apiUrl.includes("localhost"));
     return isProduction && !!apiUrl;
 }
 export function isDiskCacheConfigured() {

package/esm/src/chat/upload-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/chat/upload-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAoBtE,yDAAyD;AACzD,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D,gDAAgD;AAChD,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,OAAO,KACb,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAE5E,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAqRD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,GAAE,uBAA4B,GACnC;IACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjD,CAqJA"}
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/chat/upload-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAqBtE,yDAAyD;AACzD,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D,gDAAgD;AAChD,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,OAAO,KACb,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAE5E,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAqRD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,GAAE,uBAA4B,GACnC;IACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjD,CA6JA"}

package/esm/src/chat/upload-handler.js

@@ -32,6 +32,7 @@ import { isProduction } from "../platform/environment.js";
 import { CONFIG_INVALID } from "../errors/index.js";
 import { isSafeBlobId } from "../workflow/blob/blob-id.js";
 import { serverLogger } from "../utils/index.js";
+import { resolveValidatedRequest } from "../security/input-validation/handler.js";
 import * as nodeBuffer from "node:buffer";
 /** 25 MB default cap. Attachments are references, not bulk transfer. */
 const DEFAULT_MAX_FILE_SIZE = 25 * 1024 * 1024;
@@ -407,5 +408,13 @@ export function createChatUploadHandler(config = {}) {
             return failureResponse(error, request.signal);
         }
     }
-    return { POST, GET, DELETE };
+    // Resolve at the boundary rather than at each use. The pages executor calls
+    // method handlers with its APIContext, and these handlers read `signal`,
+    // `headers` and `url` as well as the body, so unwrapping one of them would
+    // still leave the rest reading from the context.
+    return {
+        POST: (request) => POST(resolveValidatedRequest(request)),
+        GET: (request) => GET(resolveValidatedRequest(request)),
+        DELETE: (request) => DELETE(resolveValidatedRequest(request)),
+    };
 }

package/esm/src/embedding/upload-handler.d.ts

@@ -48,8 +48,8 @@ export interface UploadHandlerConfig {
 export declare function createUploadHandler(store: RagStore, config: UploadHandlerConfig): {
     POST: (request: Request) => Promise<Response>;
     GET: (request?: Request) => Promise<Response>;
-    DELETE: (request: Request, context: {
-        params: Record<string, string>;
+    DELETE: (request: Request, context?: {
+        params?: Record<string, string>;
     }) => Promise<Response>;
 };
 //# sourceMappingURL=upload-handler.d.ts.map

package/esm/src/embedding/upload-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyF5D,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,OAAO,KACb,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,IAAI,CAAA;CAAE,GAC5C;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AA+GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,mBAAmB;oBAOE,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAoF3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAc7C,OAAO,WACP;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1C,OAAO,CAAC,QAAQ,CAAC;EA6BrB"}
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AA0F5D,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,OAAO,KACb,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,IAAI,CAAA;CAAE,GAC5C;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAgJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,mBAAmB;oBA0IT,OAAO;oBACP,OAAO;sBACL,OAAO,YAAY;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;EAG3E"}

package/esm/src/embedding/upload-handler.js

@@ -4,6 +4,7 @@ import { VeryfrontCloudBlobStorage } from "../workflow/blob/veryfront-cloud-stor
 import { serverLogger } from "../utils/index.js";
 import { loadUpload } from "./upload-loader.js";
 import * as nodeBuffer from "node:buffer";
+import { resolveValidatedRequest } from "../security/input-validation/handler.js";
 const FileCtor = globalThis.File ??
     nodeBuffer.File;
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
@@ -156,8 +157,40 @@ function toUploadRegistryItem(upload) {
         ...(upload.url ? { url: upload.url } : {}),
     };
 }
+/**
+ * Recover route params from a pages-router context.
+ *
+ * The app router passes them as a second argument; the pages executor puts them
+ * on the context it passes as the only argument, as `Record<string, string |
+ * string[]>` for catch-all segments. Without this a handler mounted at
+ * `pages/api/uploads/[id].ts` loses its id and falls back to the `?id=` query
+ * that a dynamic route does not use.
+ */
+function paramsFromContext(candidate) {
+    if (typeof candidate !== "object" || candidate === null)
+        return undefined;
+    let raw;
+    try {
+        raw = candidate.params;
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const params = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value === "string")
+            params[key] = value;
+        else if (Array.isArray(value))
+            params[key] = value.join("/");
+    }
+    return { params };
+}
 function resolveDeleteId(request, context) {
-    const fromParams = context.params.id;
+    // The pages executor passes no second argument, so a route mounted there has
+    // no `params`. The `?id=` query fallback below is the documented form anyway.
+    const fromParams = context?.params?.id;
     if (fromParams)
         return fromParams;
     const fromQuery = new URL(request.url).searchParams.get("id");
@@ -307,5 +340,11 @@ export function createUploadHandler(store, config) {
             return Response.json({ error: "Delete failed" }, { status: 500 });
         }
     }
-    return { POST, GET, DELETE };
+    // Resolve at the boundary: these handlers read `formData`, `url` and headers,
+    // so unwrapping at one use would leave the others reading the context.
+    return {
+        POST: (request) => POST(resolveValidatedRequest(request)),
+        GET: (request) => GET(request ? resolveValidatedRequest(request) : undefined),
+        DELETE: (request, context) => DELETE(resolveValidatedRequest(request), context ?? paramsFromContext(request)),
+    };
 }

package/esm/src/html/hydration-script-builder/hydration-runtime.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hydration-runtime.generated.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/hydration-runtime.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,wBAAwB,EAAE,MAC6n3E,CAAC"}
+{"version":3,"file":"hydration-runtime.generated.d.ts","sourceRoot":"","sources":["../../../../src/src/html/hydration-script-builder/hydration-runtime.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,wBAAwB,EAAE,MAC073E,CAAC"}