veryfront 0.1.1239 → 0.1.1241

package/esm/src/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/src/config/loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAWnE,OAAO,EAAuB,KAAK,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAuBxF,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EAGtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,yCAAyC,EAC1C,MAAM,0CAA0C,CAAC;AA2WlD,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA2I1D,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,yBAAyB,CAAA;CAAE,CAAC,GACjE,QAAQ,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAgCD,KAAK,qBAAqB,GAAG,OAAO,yCAAyC,CAAC;AAqyB9E,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAuElF;AAkMD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcvF;AAED,gBAAgB;AAChB,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAoKD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,gCAAgC,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,mBAAmB,EACnB,eAAe,GAAG,iBAAiB,CACpC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,yBAAyB,CAAC;CACrC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAybD,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,4FAA4F;AAC5F,wBAAgB,kCAAkC,CAChD,SAAS,CAAC,EAAE,qBAAqB,GAChC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE3E;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,IAAI,QAAQ,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAaD;AAED,yFAAyF;AACzF,wBAAgB,oCAAoC,IAAI,QAAQ,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CASD;AAED,8EAA8E;AAC9E,wBAAgB,qCAAqC,IAAI,QAAQ,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAKD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAI9E"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/src/config/loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAWnE,OAAO,EAAuB,KAAK,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAuBxF,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EAGtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,yCAAyC,EAC1C,MAAM,0CAA0C,CAAC;AA2WlD,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA2I1D,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,yBAAyB,CAAA;CAAE,CAAC,GACjE,QAAQ,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAgCD,KAAK,qBAAqB,GAAG,OAAO,yCAAyC,CAAC;AAmyB9E,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAuElF;AAkMD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcvF;AAED,gBAAgB;AAChB,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAoKD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,gCAAgC,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,mBAAmB,EACnB,eAAe,GAAG,iBAAiB,CACpC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,yBAAyB,CAAC;CACrC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAybD,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,4FAA4F;AAC5F,wBAAgB,kCAAkC,CAChD,SAAS,CAAC,EAAE,qBAAqB,GAChC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE3E;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,IAAI,QAAQ,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAaD;AAED,yFAAyF;AACzF,wBAAgB,oCAAoC,IAAI,QAAQ,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CASD;AAED,8EAA8E;AAC9E,wBAAgB,qCAAqC,IAAI,QAAQ,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAKD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAI9E"}

package/esm/src/config/loader.js

@@ -15,11 +15,11 @@ import { CACHE_INVARIANT_VIOLATION, CONFIG_PARSE_ERROR, CONFIG_VALIDATION_FAILED
 import { VeryfrontError } from "../errors/types.js";
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../observability/tracing/span-names.js";
-import { getHostEnv } from "../platform/compat/process.js";
+import { getHostEnv } from "../platform/compat/process/env.js";
 import { LRUCache } from "../utils/lru-wrapper.js";
 import { registerLRUCache } from "../cache/registry.js";
 import { VERYFRONT_CONFIG_FILES } from "./config-files.js";
-import { getCurrentRequestContext } from "../platform/adapters/fs/veryfront/request-context.js";
+import { currentRequestContext } from "../platform/request-context-access.js";
 import { tryResolve as tryResolveContract } from "../extensions/contracts.js";
 import { importFirstPartyExtensionModule } from "../extensions/first-party-import.js";
 import { computeHash } from "../utils/hash-utils.js";
@@ -1385,7 +1385,7 @@ async function loadAndMergeConfig(configPath, cacheKey, adapter, selectedVirtual
     return validateAndMergeConfig(selectConfigModuleValue(configModule));
 }
 function getVirtualConfigSourceContext() {
-    const source = getCurrentRequestContext();
+    const source = currentRequestContext();
     if (!source)
         return undefined;
     return {
@@ -1534,7 +1534,7 @@ function getConfigInternal(projectDir, adapter, options) {
             assertMatchingVirtualConfigSource(options.sourceContext, ambientSourceContext);
         }
         if (hostedMultiProjectFilesystem) {
-            assertMatchingHostedProjectIdentity(options.cacheKey, getCurrentRequestContext());
+            assertMatchingHostedProjectIdentity(options.cacheKey, currentRequestContext());
         }
         const sourceContext = hasQualifiedCacheIdentity
             ? options.sourceContext ?? ambientSourceContext

package/esm/src/config/schemas/config.schema.d.ts

@@ -31,6 +31,8 @@ export declare const getVeryfrontConfigSchema: () => import("../../internal-agen
     build: import("../../internal-agents/schema.js").Schema<Partial<import("../../extensions/schema/schema-validator.js").InferShape<{
         outDir: import("../../internal-agents/schema.js").Schema<string | undefined>;
         trailingSlash: import("../../internal-agents/schema.js").Schema<boolean | undefined>;
+        /** Bare npm package roots that the runtime resolves instead of bundling. */
+        serverExternalPackages: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
         /**
          * Generate static HTML for all routes during `veryfront build`.
          * Defaults to true; disabling it produces no pages, so only turn it
@@ -135,6 +137,14 @@ export declare const getVeryfrontConfigSchema: () => import("../../internal-agen
          */
         csp: import("../../internal-agents/schema.js").Schema<Record<string, string[] | null> | undefined>;
         remoteHosts: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
+        /**
+         * Restrict project redirects to the request origin and exact allowed
+         * HTTP(S) origins. Omit this policy to preserve unrestricted redirect
+         * behavior. An empty allowlist permits same-origin redirects only.
+         */
+        redirects: import("../../internal-agents/schema.js").Schema<import("../../extensions/schema/schema-validator.js").InferShape<{
+            allowedOrigins: import("../../internal-agents/schema.js").Schema<string[]>;
+        }> | undefined>;
         cors: import("../../internal-agents/schema.js").Schema<boolean | import("../../extensions/schema/schema-validator.js").InferShape<{
             origin: import("../../internal-agents/schema.js").Schema<string | string[] | CorsOriginValidator | undefined>;
             credentials: import("../../internal-agents/schema.js").Schema<boolean | undefined>;
@@ -508,6 +518,8 @@ export declare const veryfrontConfigSchema: import("../../internal-agents/schema
     build: import("../../internal-agents/schema.js").Schema<Partial<import("../../extensions/schema/schema-validator.js").InferShape<{
         outDir: import("../../internal-agents/schema.js").Schema<string | undefined>;
         trailingSlash: import("../../internal-agents/schema.js").Schema<boolean | undefined>;
+        /** Bare npm package roots that the runtime resolves instead of bundling. */
+        serverExternalPackages: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
         /**
          * Generate static HTML for all routes during `veryfront build`.
          * Defaults to true; disabling it produces no pages, so only turn it
@@ -612,6 +624,14 @@ export declare const veryfrontConfigSchema: import("../../internal-agents/schema
          */
         csp: import("../../internal-agents/schema.js").Schema<Record<string, string[] | null> | undefined>;
         remoteHosts: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
+        /**
+         * Restrict project redirects to the request origin and exact allowed
+         * HTTP(S) origins. Omit this policy to preserve unrestricted redirect
+         * behavior. An empty allowlist permits same-origin redirects only.
+         */
+        redirects: import("../../internal-agents/schema.js").Schema<import("../../extensions/schema/schema-validator.js").InferShape<{
+            allowedOrigins: import("../../internal-agents/schema.js").Schema<string[]>;
+        }> | undefined>;
         cors: import("../../internal-agents/schema.js").Schema<boolean | import("../../extensions/schema/schema-validator.js").InferShape<{
             origin: import("../../internal-agents/schema.js").Schema<string | string[] | CorsOriginValidator | undefined>;
             credentials: import("../../internal-agents/schema.js").Schema<boolean | undefined>;

package/esm/src/config/schemas/config.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.schema.d.ts","sourceRoot":"","sources":["../../../../src/src/config/schemas/config.schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAahF,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,qCAAqC,CAAC;AAiG7C,KAAK,mBAAmB,GAAG,CACzB,MAAM,EAAE,MAAM,KACX,OAAO,GAAG,MAAM,CAAC;AAkMtB,eAAO,MAAM,wBAAwB;;;;;QAQ3B,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;;;;;;;;;QA0BH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAa3F,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;QA5vBxB,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;;;;;;;;;QA0BH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAcnB,CAAC;AAG1E,KAAK,uBAAuB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AACxF,KAAK,4BAA4B,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,EAAE,cAAc,CAAC,GAAG;IAC5E,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,GAAG;IACtF,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AAGF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAmCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEhF"}
+{"version":3,"file":"config.schema.d.ts","sourceRoot":"","sources":["../../../../src/src/config/schemas/config.schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAahF,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,qCAAqC,CAAC;AA4G7C,KAAK,mBAAmB,GAAG,CACzB,MAAM,EAAE,MAAM,KACX,OAAO,GAAG,MAAM,CAAC;AAkMtB,eAAO,MAAM,wBAAwB;;;;;QAQ3B,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF,4EAA4E;;QAmB5E;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;QAyBH;;;;WAIG;;;;;;;;;;;;QAcH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAa3F,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;QAhyBxB,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF,4EAA4E;;QAmB5E;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;QAyBH;;;;WAIG;;;;;;;;;;;;QAcH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAcnB,CAAC;AAG1E,KAAK,uBAAuB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AACxF,KAAK,4BAA4B,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,EAAE,cAAc,CAAC,GAAG;IAC5E,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,GAAG;IACtF,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AAGF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAmCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEhF"}

package/esm/src/config/schemas/config.schema.js

@@ -8,6 +8,7 @@ import { MAX_CACHE_TTL_MILLISECONDS } from "../../cache/backends/ttl.js";
 import { MAX_PORT, MIN_PORT } from "../../utils/constants/network.js";
 import { HTTP_TOKEN_PATTERN, isBoundedCorsOrigin, isBoundedCorsOriginList, isBoundedCorsTokenList, MAX_CORS_MAX_AGE, MAX_CORS_ORIGIN_COUNT, MAX_CORS_ORIGIN_LENGTH, MAX_CORS_TOKEN_COUNT, MAX_CORS_TOKEN_LENGTH, } from "../../utils/cors-policy-limits.js";
 import { MAX_REMOTE_HOST_COUNT, MAX_REMOTE_HOST_URL_LENGTH, } from "../../utils/remote-host-policy-limits.js";
+import { isValidRedirectOriginList, MAX_REDIRECT_ORIGIN_COUNT, MAX_REDIRECT_ORIGIN_LENGTH, } from "../../utils/redirect-policy.js";
 import { MAX_FILE_LOG_FILES, MAX_GITHUB_FILESYSTEM_ATTEMPTS, MAX_VERYFRONT_FILESYSTEM_RETRIES, } from "../../utils/config-resource-limits.js";
 import { MAX_CSRF_NAME_LENGTH, MAX_CSRF_TTL_SECONDS, MAX_PATH_LENGTH, } from "../../utils/constants/security.js";
 import { MAX_TIMER_DELAY_MS } from "../../utils/timer.js";
@@ -15,6 +16,7 @@ import { CSS_OPTIMIZATION, IMAGE_OPTIMIZATION } from "../../utils/constants/buil
 import { isProjectRelativeDiscoveryPath, MAX_PROJECT_DISCOVERY_DIRECTORIES, } from "../../utils/discovery-path-policy.js";
 import { MAX_PATH_LENGTH_CHARS } from "../../utils/constants/limits.js";
 import { isCanonicalProjectRelativePath } from "../../utils/project-relative-path.js";
+import { hasUniqueServerExternalPackages, isValidServerExternalPackageName, MAX_SERVER_EXTERNAL_PACKAGE_COUNT, MAX_SERVER_EXTERNAL_PACKAGE_NAME_LENGTH, } from "../server-external-packages.js";
 const integrationNames = new Set(ALL_INTEGRATION_NAMES);
 const MAX_CSRF_EXCLUDE_PATH_COUNT = 64;
 const MAX_CSRF_EXCLUDE_PATH_LIST_LENGTH = 16_384;
@@ -235,6 +237,17 @@ export const getVeryfrontConfigSchema = defineSchema((v) => v
         .object({
         outDir: v.string().optional(),
         trailingSlash: v.boolean().optional(),
+        /** Bare npm package roots that the runtime resolves instead of bundling. */
+        serverExternalPackages: v
+            .array(v
+            .string()
+            .min(1)
+            .max(MAX_SERVER_EXTERNAL_PACKAGE_NAME_LENGTH)
+            .refine(isValidServerExternalPackageName, "Expected a bare npm package name without a version or subpath"))
+            .min(1)
+            .max(MAX_SERVER_EXTERNAL_PACKAGE_COUNT)
+            .refine(hasUniqueServerExternalPackages, "Server external package names must be unique")
+            .optional(),
         /**
          * Generate static HTML for all routes during `veryfront build`.
          * Defaults to true; disabling it produces no pages, so only turn it
@@ -417,6 +430,20 @@ export const getVeryfrontConfigSchema = defineSchema((v) => v
             .array(v.string().max(MAX_REMOTE_HOST_URL_LENGTH).url())
             .max(MAX_REMOTE_HOST_COUNT)
             .optional(),
+        /**
+         * Restrict project redirects to the request origin and exact allowed
+         * HTTP(S) origins. Omit this policy to preserve unrestricted redirect
+         * behavior. An empty allowlist permits same-origin redirects only.
+         */
+        redirects: v
+            .object({
+            allowedOrigins: v
+                .array(v.string().min(1).max(MAX_REDIRECT_ORIGIN_LENGTH))
+                .max(MAX_REDIRECT_ORIGIN_COUNT)
+                .refine(isValidRedirectOriginList, "Redirect origins must be unique canonical HTTP(S) origins within the policy limits"),
+        })
+            .strict()
+            .optional(),
         cors: getCorsSchema().optional(),
         /**
          * CSRF protection using the double-submit cookie pattern.

package/esm/src/config/server-external-packages.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_SERVER_EXTERNAL_PACKAGE_COUNT = 128;
+export declare const MAX_SERVER_EXTERNAL_PACKAGE_NAME_LENGTH = 214;
+/** Return whether a value names one bare npm package root. */
+export declare function isValidServerExternalPackageName(value: string): boolean;
+/** Return whether every configured package name occurs exactly once. */
+export declare function hasUniqueServerExternalPackages(values: readonly string[]): boolean;
+/** Capture an immutable, order-independent package list for one transform graph. */
+export declare function canonicalizeServerExternalPackages(values: readonly string[] | undefined): readonly string[] | undefined;
+/** Build a stable framed identity for cache keys whose output depends on this list. */
+export declare function buildServerExternalPackagesIdentity(values: readonly string[] | undefined): string | undefined;
+//# sourceMappingURL=server-external-packages.d.ts.map

package/esm/src/config/server-external-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-external-packages.d.ts","sourceRoot":"","sources":["../../../src/src/config/server-external-packages.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAS3D,8DAA8D;AAC9D,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGvE;AAED,wEAAwE;AACxE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQlF;AAED,oFAAoF;AACpF,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACpC,SAAS,MAAM,EAAE,GAAG,SAAS,CAa/B;AAED,uFAAuF;AACvF,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAUpB"}

package/esm/src/config/server-external-packages.js

@@ -0,0 +1,53 @@
+import { primordialArrayPush, primordialArraySort, } from "../platform/compat/primordials/array.js";
+export const MAX_SERVER_EXTERNAL_PACKAGE_COUNT = 128;
+export const MAX_SERVER_EXTERNAL_PACKAGE_NAME_LENGTH = 214;
+const ObjectFreeze = Object.freeze;
+const RegExpExec = RegExp.prototype.exec;
+const ReflectApply = Reflect.apply;
+const SetAdd = Set.prototype.add;
+const SetHas = Set.prototype.has;
+const SERVER_EXTERNAL_PACKAGE_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+/** Return whether a value names one bare npm package root. */
+export function isValidServerExternalPackageName(value) {
+    return value.length <= MAX_SERVER_EXTERNAL_PACKAGE_NAME_LENGTH &&
+        ReflectApply(RegExpExec, SERVER_EXTERNAL_PACKAGE_PATTERN, [value]) !== null;
+}
+/** Return whether every configured package name occurs exactly once. */
+export function hasUniqueServerExternalPackages(values) {
+    const seen = new Set();
+    for (let index = 0; index < values.length; index++) {
+        const value = values[index];
+        if (ReflectApply(SetHas, seen, [value]))
+            return false;
+        ReflectApply(SetAdd, seen, [value]);
+    }
+    return true;
+}
+/** Capture an immutable, order-independent package list for one transform graph. */
+export function canonicalizeServerExternalPackages(values) {
+    if (!values || values.length === 0)
+        return undefined;
+    const canonical = [];
+    const seen = new Set();
+    for (let index = 0; index < values.length; index++) {
+        const value = values[index];
+        if (ReflectApply(SetHas, seen, [value]))
+            continue;
+        ReflectApply(SetAdd, seen, [value]);
+        primordialArrayPush(canonical, value);
+    }
+    primordialArraySort(canonical, (left, right) => left < right ? -1 : left > right ? 1 : 0);
+    return ObjectFreeze(canonical);
+}
+/** Build a stable framed identity for cache keys whose output depends on this list. */
+export function buildServerExternalPackagesIdentity(values) {
+    const canonical = canonicalizeServerExternalPackages(values);
+    if (!canonical)
+        return undefined;
+    let identity = "";
+    for (let index = 0; index < canonical.length; index++) {
+        const value = canonical[index];
+        identity += `${value.length}:${value};`;
+    }
+    return identity;
+}

package/esm/src/data/data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/data-fetcher.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3F;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,YAAY,CAAqB;gBAE7B,QAAQ,CAAC,EAAE,OAAO;IAO9B,SAAS,CACP,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE,aAAa,GAAG,YAA4B,EAClD,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,UAAU,CAAC;IAqCtB,cAAc,CAAC,UAAU,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI3E,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;CAQnC"}
+{"version":3,"file":"data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/data-fetcher.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3F;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,YAAY,CAAe;IAGnC,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,YAAY,CAAqB;gBAE7B,QAAQ,CAAC,EAAE,OAAO;IAO9B,SAAS,CACP,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE,aAAa,GAAG,YAA4B,EAClD,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,UAAU,CAAC;IA2CtB,cAAc,CAAC,UAAU,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI3E,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;CAQnC"}

package/esm/src/data/data-fetcher.js

@@ -1,17 +1,17 @@
 import { SpanNames } from "../observability/index.js";
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { CacheManager } from "./data-fetching-cache.js";
-import { ServerDataFetcher } from "./server-data-fetcher.js";
 import { StaticDataFetcher } from "./static-data-fetcher.js";
 import { StaticPathsFetcher } from "./static-paths-fetcher.js";
 export class DataFetcher {
     cacheManager;
+    // Constructed lazily: the server fetcher pulls the sandbox worker pool,
+    // which must stay out of browser bundles.
     serverFetcher;
     staticFetcher;
     pathsFetcher;
     constructor(_adapter) {
         this.cacheManager = new CacheManager();
-        this.serverFetcher = new ServerDataFetcher();
         this.staticFetcher = new StaticDataFetcher(this.cacheManager);
         this.pathsFetcher = new StaticPathsFetcher();
     }
@@ -34,9 +34,14 @@ export class DataFetcher {
                 sourceGeneration: options.sourceGeneration,
             }
             : undefined;
-        return withSpan(SpanNames.DATA_FETCH, () => {
-            if (useServer)
+        return withSpan(SpanNames.DATA_FETCH, async () => {
+            if (useServer) {
+                if (this.serverFetcher === undefined) {
+                    const { ServerDataFetcher } = await import("./server-data-fetcher.js");
+                    this.serverFetcher = new ServerDataFetcher();
+                }
                 return this.serverFetcher.fetch(pageModule, context, isolationOptions);
+            }
             if (useStatic)
                 return this.staticFetcher.fetch(pageModule, context, options);
             return Promise.resolve({ props: {} });

package/esm/src/data/data-result-validation.d.ts

@@ -0,0 +1,5 @@
+import type { DataResult, StaticDataResult } from "./types.js";
+/** Validate and snapshot a project hook result before recording success. */
+export declare function validateDataResult(value: unknown, hookName: "getStaticData"): StaticDataResult;
+export declare function validateDataResult(value: unknown, hookName: "getServerData"): DataResult;
+//# sourceMappingURL=data-result-validation.d.ts.map

package/esm/src/data/data-result-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-result-validation.d.ts","sourceRoot":"","sources":["../../../src/src/data/data-result-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG/D,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,eAAe,GACxB,gBAAgB,CAAC;AACpB,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,eAAe,GACxB,UAAU,CAAC"}

package/esm/src/data/data-result-validation.js

@@ -0,0 +1,56 @@
+import { normalizeDataResponseMetadata } from "./response-metadata.js";
+export function validateDataResult(value, hookName) {
+    const fail = () => {
+        throw new TypeError(`${hookName} must return a valid data result object`);
+    };
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return fail();
+    const result = value;
+    const props = result.props;
+    const redirect = result.redirect;
+    const notFound = result.notFound;
+    const revalidate = result.revalidate;
+    const responseMetadata = normalizeDataResponseMetadata(result, hookName);
+    let redirectDestination;
+    let redirectPermanent;
+    if (redirect !== undefined &&
+        (redirect === null || typeof redirect !== "object" || Array.isArray(redirect))) {
+        return fail();
+    }
+    if (redirect !== undefined) {
+        const redirectRecord = redirect;
+        if (typeof redirectRecord.destination !== "string" ||
+            (redirectRecord.permanent !== undefined && typeof redirectRecord.permanent !== "boolean"))
+            return fail();
+        redirectDestination = redirectRecord.destination;
+        redirectPermanent = redirectRecord.permanent;
+    }
+    if (notFound !== undefined && typeof notFound !== "boolean")
+        return fail();
+    const normalized = {};
+    if (redirectDestination !== undefined) {
+        normalized.redirect = {
+            destination: redirectDestination,
+            ...(redirectPermanent !== undefined ? { permanent: redirectPermanent } : {}),
+        };
+    }
+    else if (notFound === true) {
+        normalized.notFound = true;
+    }
+    else {
+        if (revalidate !== undefined && revalidate !== false &&
+            (typeof revalidate !== "number" || !Number.isFinite(revalidate) || revalidate < 0))
+            return fail();
+        if (props !== undefined)
+            normalized.props = props;
+        if (notFound !== undefined)
+            normalized.notFound = notFound;
+        if (revalidate !== undefined)
+            normalized.revalidate = revalidate;
+    }
+    if (responseMetadata.headers)
+        normalized.headers = responseMetadata.headers;
+    if (responseMetadata.cookies)
+        normalized.cookies = responseMetadata.cookies;
+    return normalized;
+}

package/esm/src/data/helpers.d.ts

@@ -1,11 +1,12 @@
-import type { DataResult } from "./types.js";
+import type { DataResponseMetadata, DataResult, StaticDataResult } from "./types.js";
 /**
  * Redirect the request from a data loader.
  *
  * Return it or throw it. `throw redirect("/login")` behaves exactly like
  * `return redirect("/login")`.
  */
-export declare function redirect(destination: string, permanent?: boolean): DataResult;
+export declare function redirect(destination: string, permanent?: boolean, response?: undefined): StaticDataResult;
+export declare function redirect(destination: string, permanent: boolean | undefined, response: DataResponseMetadata): DataResult;
 /**
  * Render the 404 page from a data loader.
  *
@@ -13,7 +14,8 @@ export declare function redirect(destination: string, permanent?: boolean): Data
  * `return notFound()`, which is useful deep inside a helper that has no clean
  * way to return to the loader.
  */
-export declare function notFound(): DataResult;
+export declare function notFound(response?: undefined): StaticDataResult;
+export declare function notFound(response: DataResponseMetadata): DataResult;
 /**
  * True when `value` is a control-flow result produced by {@link notFound} or
  * {@link redirect}.
@@ -41,6 +43,4 @@ export declare function isDataControlResult(value: unknown): value is DataResult
  * for the project.
  */
 export declare function toDataControlResult(result: DataResult): DataResult;
-/** Validate and snapshot a project hook result before recording success. */
-export declare function validateDataResult(value: unknown, hookName: "getServerData" | "getStaticData"): DataResult;
 //# sourceMappingURL=helpers.d.ts.map

package/esm/src/data/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA2B7C;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAIvE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAGlE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,eAAe,GAAG,eAAe,GAC1C,UAAU,CAkDZ"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/src/data/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA2BrF;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,OAAO,EACnB,QAAQ,CAAC,EAAE,SAAS,GACnB,gBAAgB,CAAC;AACpB,wBAAgB,QAAQ,CACtB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,GAC7B,UAAU,CAAC;AAad;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAC;AACjE,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,UAAU,CAAC;AASrE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAIvE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAalE"}

package/esm/src/data/helpers.js

@@ -21,24 +21,19 @@ function brandDataControlResult(result) {
     Object.defineProperty(result, DATA_CONTROL_RESULT, { value: true });
     return result;
 }
-/**
- * Redirect the request from a data loader.
- *
- * Return it or throw it. `throw redirect("/login")` behaves exactly like
- * `return redirect("/login")`.
- */
-export function redirect(destination, permanent = false) {
-    return brandDataControlResult({ redirect: { destination, permanent } });
+export function redirect(destination, permanent = false, response) {
+    return brandDataControlResult({
+        redirect: { destination, permanent },
+        ...(response?.headers !== undefined ? { headers: response.headers } : {}),
+        ...(response?.cookies !== undefined ? { cookies: response.cookies } : {}),
+    });
 }
-/**
- * Render the 404 page from a data loader.
- *
- * Return it or throw it. `throw notFound()` behaves exactly like
- * `return notFound()`, which is useful deep inside a helper that has no clean
- * way to return to the loader.
- */
-export function notFound() {
-    return brandDataControlResult({ notFound: true });
+export function notFound(response) {
+    return brandDataControlResult({
+        notFound: true,
+        ...(response?.headers !== undefined ? { headers: response.headers } : {}),
+        ...(response?.cookies !== undefined ? { cookies: response.cookies } : {}),
+    });
 }
 /**
  * True when `value` is a control-flow result produced by {@link notFound} or
@@ -71,57 +66,16 @@ export function isDataControlResult(value) {
  * for the project.
  */
 export function toDataControlResult(result) {
-    if (result.redirect)
-        return { redirect: result.redirect };
-    return { notFound: true };
-}
-/** Validate and snapshot a project hook result before recording success. */
-export function validateDataResult(value, hookName) {
-    const fail = () => {
-        throw new TypeError(`${hookName} must return a valid data result object`);
-    };
-    if (value === null || typeof value !== "object" || Array.isArray(value))
-        return fail();
-    const result = value;
-    const props = result.props;
-    const redirect = result.redirect;
-    const notFound = result.notFound;
-    const revalidate = result.revalidate;
-    let redirectDestination;
-    let redirectPermanent;
-    if (redirect !== undefined &&
-        (redirect === null || typeof redirect !== "object" || Array.isArray(redirect))) {
-        return fail();
-    }
-    if (redirect !== undefined) {
-        const redirectRecord = redirect;
-        if (typeof redirectRecord.destination !== "string" ||
-            (redirectRecord.permanent !== undefined && typeof redirectRecord.permanent !== "boolean"))
-            return fail();
-        redirectDestination = redirectRecord.destination;
-        redirectPermanent = redirectRecord.permanent;
-    }
-    if (notFound !== undefined && typeof notFound !== "boolean")
-        return fail();
-    if (revalidate !== undefined && revalidate !== false &&
-        (typeof revalidate !== "number" || !Number.isFinite(revalidate) || revalidate < 0))
-        return fail();
-    const activeOutcomes = Number(props !== undefined) + Number(redirect !== undefined) +
-        Number(notFound === true);
-    if (activeOutcomes > 1)
-        return fail();
-    const normalized = {};
-    if (props !== undefined)
-        normalized.props = props;
-    if (redirectDestination !== undefined) {
-        normalized.redirect = {
-            destination: redirectDestination,
-            ...(redirectPermanent !== undefined ? { permanent: redirectPermanent } : {}),
+    if (result.redirect) {
+        return {
+            redirect: result.redirect,
+            ...(result.headers ? { headers: result.headers } : {}),
+            ...(result.cookies ? { cookies: result.cookies } : {}),
         };
     }
-    if (notFound !== undefined)
-        normalized.notFound = notFound;
-    if (revalidate !== undefined)
-        normalized.revalidate = revalidate;
-    return normalized;
+    return {
+        notFound: true,
+        ...(result.headers ? { headers: result.headers } : {}),
+        ...(result.cookies ? { cookies: result.cookies } : {}),
+    };
 }

package/esm/src/data/index.d.ts

@@ -4,7 +4,7 @@
  *
  * @module data
  */
-export type { CacheEntry, DataContext, DataResult, InferGetServerDataProps, PageWithData, StaticPathsResult, } from "./types.js";
+export type { CacheEntry, DataContext, DataResponseMetadata, DataResult, InferGetServerDataProps, PageWithData, ResponseCookie, StaticDataResult, StaticPathsResult, } from "./types.js";
 export { DataFetcher, type FetchDataOptions } from "./data-fetcher.js";
 export { notFound, redirect } from "./helpers.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/data/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/data/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,UAAU,EACV,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/data/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/esm/src/data/response-metadata.d.ts

@@ -0,0 +1,23 @@
+import type { DataResponseMetadata, ResponseCookie } from "./schemas/data.schema.js";
+export declare function normalizeDataResponseMetadata(value: {
+    headers?: unknown;
+    cookies?: unknown;
+}, hookName?: "getServerData" | "getStaticData"): DataResponseMetadata;
+export declare function mergeDataResponseMetadata(metadata: readonly DataResponseMetadata[]): DataResponseMetadata;
+/**
+ * Carry validated response metadata through an internal error path without
+ * placing cookie values in enumerable error context, logs, or telemetry.
+ */
+export declare function attachDataResponseMetadata<T extends Error>(carrier: T, metadata: DataResponseMetadata): T;
+/**
+ * Carry response metadata on a request-local error while retaining the project
+ * error for classification, reporting, and stack rendering.
+ */
+export declare function wrapDataResponseMetadataError(error: unknown, metadata: DataResponseMetadata): Error;
+/** Return the project failure carried by {@link wrapDataResponseMetadataError}. */
+export declare function unwrapDataResponseMetadataError(error: Error): unknown;
+/** Read response metadata attached by {@link attachDataResponseMetadata}. */
+export declare function getAttachedDataResponseMetadata(carrier: Error): DataResponseMetadata;
+export declare function serializeResponseCookie(cookie: ResponseCookie): string;
+export declare function appendDataResponseMetadata(target: Headers, metadata: DataResponseMetadata): void;
+//# sourceMappingURL=response-metadata.d.ts.map

package/esm/src/data/response-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-metadata.d.ts","sourceRoot":"","sources":["../../../src/src/data/response-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAoRrF,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC/C,QAAQ,GAAE,eAAe,GAAG,eAAiC,GAC5D,oBAAoB,CActB;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACxC,oBAAoB,CActB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,KAAK,EACxD,OAAO,EAAE,CAAC,EACV,QAAQ,EAAE,oBAAoB,GAC7B,CAAC,CAGH;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,oBAAoB,GAC7B,KAAK,CAWP;AAED,mFAAmF;AACnF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,KAAK,GAAG,oBAAoB,CAEpF;AAgBD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEtE;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,oBAAoB,GAC7B,IAAI,CAQN"}