veryfront 0.1.128 → 0.1.129

package/esm/src/jobs/runtime-env.js

@@ -2,7 +2,7 @@ import { logger as baseLogger } from "../utils/index.js";
 const logger = baseLogger.component("job-runtime-env");
 export const INJECTED_TASK_ENV_JSON = "VERYFRONT_TASK_ENV_JSON";
 const UNSAFE_INJECTED_ENV_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-const HIDDEN_TASK_CONTEXT_ENV_KEYS = new Set([
+const RESERVED_TASK_ENV_KEYS = new Set([
     "VERYFRONT_API_TOKEN",
     "VERYFRONT_API_URL",
     "VERYFRONT_PROJECT_API_URL",
@@ -15,30 +15,14 @@ const HIDDEN_TASK_CONTEXT_ENV_KEYS = new Set([
     "VERYFRONT_JOB_RESULT_PATH",
     INJECTED_TASK_ENV_JSON,
 ]);
-const DISALLOWED_INJECTED_ENV_KEYS = new Set([
-    "VERYFRONT_API_TOKEN",
-    "VERYFRONT_API_URL",
-    "VERYFRONT_PROJECT_API_URL",
-    "VERYFRONT_API_BASE_URL",
-    "VERYFRONT_PROJECT_ID",
-    "VERYFRONT_PROJECT_SLUG",
-    "VERYFRONT_BRANCH_REF",
-    "VERYFRONT_API_USER",
-    "VERYFRONT_API_PASS",
-    "VERYFRONT_JOB_RESULT_PATH",
-    INJECTED_TASK_ENV_JSON,
-]);
-function isHiddenTaskContextEnvKey(key) {
-    return key.startsWith("TENANT_") || HIDDEN_TASK_CONTEXT_ENV_KEYS.has(key);
-}
-function isDisallowedInjectedEnvKey(key) {
-    return key.startsWith("TENANT_") || DISALLOWED_INJECTED_ENV_KEYS.has(key);
+function isReservedTaskEnvKey(key) {
+    return key.startsWith("TENANT_") || RESERVED_TASK_ENV_KEYS.has(key);
 }
-function filterExistingProjectEnv(env) {
+function filterSafeWorkflowEnv(env) {
     const filtered = {};
     for (const [key, value] of Object.entries(env ?? {})) {
         if (UNSAFE_INJECTED_ENV_KEYS.has(key) ||
-            isDisallowedInjectedEnvKey(key) ||
+            isReservedTaskEnvKey(key) ||
             typeof value !== "string") {
             continue;
         }
@@ -47,25 +31,18 @@ function filterExistingProjectEnv(env) {
     return filtered;
 }
 export function readInjectedProjectEnv(allEnv) {
-    const raw = allEnv[INJECTED_TASK_ENV_JSON];
-    if (!raw) {
+    const rawInjectedEnv = allEnv[INJECTED_TASK_ENV_JSON];
+    if (!rawInjectedEnv) {
         return {};
     }
     try {
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        const parsedInjectedEnv = JSON.parse(rawInjectedEnv);
+        if (!parsedInjectedEnv ||
+            typeof parsedInjectedEnv !== "object" ||
+            Array.isArray(parsedInjectedEnv)) {
             return {};
         }
-        const injectedEnv = Object.create(null);
-        for (const [key, value] of Object.entries(parsed)) {
-            if (UNSAFE_INJECTED_ENV_KEYS.has(key) ||
-                isDisallowedInjectedEnvKey(key) ||
-                typeof value !== "string") {
-                continue;
-            }
-            injectedEnv[key] = value;
-        }
-        return injectedEnv;
+        return filterSafeWorkflowEnv(parsedInjectedEnv);
     }
     catch {
         logger.warn(`Ignoring invalid ${INJECTED_TASK_ENV_JSON}`);
@@ -73,28 +50,28 @@ export function readInjectedProjectEnv(allEnv) {
     }
 }
 export function buildTaskContextEnv(allEnv, envAllowlist) {
-    const allowlistedEnvKeys = envAllowlist ? new Set(envAllowlist) : null;
-    const env = {};
+    const allowedEnvKeys = envAllowlist ? new Set(envAllowlist) : null;
+    const taskContextEnv = {};
     for (const [key, value] of Object.entries(allEnv)) {
-        if (isHiddenTaskContextEnvKey(key)) {
+        if (isReservedTaskEnvKey(key)) {
             continue;
         }
-        if (allowlistedEnvKeys && !allowlistedEnvKeys.has(key)) {
+        if (allowedEnvKeys && !allowedEnvKeys.has(key)) {
             continue;
         }
-        env[key] = value;
+        taskContextEnv[key] = value;
     }
     for (const [key, value] of Object.entries(readInjectedProjectEnv(allEnv))) {
-        if (allowlistedEnvKeys && !allowlistedEnvKeys.has(key)) {
+        if (allowedEnvKeys && !allowedEnvKeys.has(key)) {
             continue;
         }
-        env[key] = value;
+        taskContextEnv[key] = value;
     }
-    return env;
+    return taskContextEnv;
 }
 export function mergeInjectedWorkflowEnv(existingEnv, allEnv) {
     const mergedEnv = {
-        ...filterExistingProjectEnv(existingEnv),
+        ...filterSafeWorkflowEnv(existingEnv),
         ...readInjectedProjectEnv(allEnv),
     };
     return Object.keys(mergedEnv).length > 0 ? mergedEnv : undefined;

package/esm/src/markdown/index.d.ts

@@ -11,6 +11,5 @@
  * ```
  */
 import "../../_dnt.polyfills.js";
-export { Markdown } from "../react/components/ai/markdown.js";
-export type { CodeBlockProps, MarkdownProps } from "../react/components/ai/markdown.js";
+export { type CodeBlockProps, Markdown, type MarkdownProps, } from "../react/components/ai/markdown.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/markdown/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/markdown/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAC9D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/markdown/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EACL,KAAK,cAAc,EACnB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,oCAAoC,CAAC"}

package/esm/src/markdown/index.js

@@ -10,10 +10,5 @@
  * <Markdown># Hello{"\n\n"}Some **bold** text with `code`.</Markdown>
  * ```
  */
-// veryfront/markdown — Markdown rendering component
-//
-// Renders markdown strings at runtime with syntax highlighting and
-// Mermaid diagram support. Used for displaying AI-generated content.
-// For MDX page customization, use veryfront/mdx instead.
 import "../../_dnt.polyfills.js";
-export { Markdown } from "../react/components/ai/markdown.js";
+export { Markdown, } from "../react/components/ai/markdown.js";

package/esm/src/mcp/server.d.ts

@@ -49,7 +49,6 @@ export declare class MCPServer {
     createHTTPHandler(): (request: dntShim.Request) => Promise<dntShim.Response>;
     private extractRequestContext;
     private validateAuth;
-    private handleCORS;
     private getCORSHeaders;
     private loadRemoteIntegrationTools;
 }

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAOzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAOzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAQnC;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA0BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA+E5E,OAAO,CAAC,qBAAqB;YAkBf,YAAY;IAsB1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CAqBzC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAWzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAoCzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAQnC;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA0BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAiD5E,OAAO,CAAC,qBAAqB;YAgBf,YAAY;IAsB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CAqBzC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -12,11 +12,34 @@ import { VeryfrontError } from "../security/input-validation/errors.js";
 import { logger as baseLogger } from "../utils/index.js";
 const logger = baseLogger.component("mcp-server");
 const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
-function asParamsRecord(params) {
+const MAX_CONTEXT_HEADER_LENGTH = 255;
+const JSON_CONTENT_TYPE = "application/json";
+const END_USER_ID_PATTERN = /^[a-zA-Z0-9._@-]+$/;
+const PROJECT_ID_PATTERN = /^[a-zA-Z0-9._-]+$/;
+function toParamsRecord(params) {
     if (!params || Array.isArray(params))
         return {};
     return params;
 }
+function createJSONResponse(body, init) {
+    const headers = new dntShim.Headers(init?.headers);
+    headers.set("Content-Type", JSON_CONTENT_TYPE);
+    return new dntShim.Response(JSON.stringify(body), { ...init, headers });
+}
+function createJSONRPCErrorResponse(status, code, message) {
+    return createJSONResponse({
+        jsonrpc: "2.0",
+        id: null,
+        error: { code, message },
+    }, { status });
+}
+function readAllowedHeader(request, headerName, pattern) {
+    const value = request.headers.get(headerName);
+    if (!value || value.length > MAX_CONTEXT_HEADER_LENGTH || !pattern.test(value)) {
+        return undefined;
+    }
+    return value;
+}
 export class MCPServer {
     config;
     integrationLoader;
@@ -114,7 +137,7 @@ export class MCPServer {
         return { tools };
     }
     callTool(params, context) {
-        const { name, arguments: args } = asParamsRecord(params);
+        const { name, arguments: args } = toParamsRecord(params);
         if (!name) {
             throw toError(createError({
                 type: "agent",
@@ -148,7 +171,7 @@ export class MCPServer {
         return Promise.resolve({ resources });
     }
     readResource(params) {
-        const { uri } = asParamsRecord(params);
+        const { uri } = toParamsRecord(params);
         if (!uri) {
             throw toError(createError({
                 type: "agent",
@@ -189,7 +212,7 @@ export class MCPServer {
         return Promise.resolve({ prompts });
     }
     getPrompt(params) {
-        const { name, arguments: args } = asParamsRecord(params);
+        const { name, arguments: args } = toParamsRecord(params);
         if (!name) {
             throw toError(createError({
                 type: "agent",
@@ -216,8 +239,9 @@ export class MCPServer {
     createHTTPHandler() {
         return async (request) => {
             const requestOrigin = request.headers.get("Origin");
-            if (request.method === "OPTIONS")
-                return this.handleCORS(requestOrigin);
+            if (request.method === "OPTIONS") {
+                return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
+            }
             if (this.config.auth?.type && this.config.auth.type !== "none") {
                 const authorized = await this.validateAuth(request);
                 if (!authorized)
@@ -226,52 +250,32 @@ export class MCPServer {
             // Enforce request body size limit (fast path via Content-Length header)
             const contentLength = request.headers.get("content-length");
             if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
-                return new dntShim.Response(JSON.stringify({
-                    jsonrpc: "2.0",
-                    id: null,
-                    error: { code: -32600, message: "Request body too large" },
-                }), { status: 413, headers: { "Content-Type": "application/json" } });
+                return createJSONRPCErrorResponse(413, -32600, "Request body too large");
             }
             try {
-                validateContentType(request, "application/json");
+                validateContentType(request, JSON_CONTENT_TYPE);
             }
             catch (error) {
                 const message = error instanceof VeryfrontError ? error.message : "Invalid Content-Type";
-                return new dntShim.Response(JSON.stringify({
-                    jsonrpc: "2.0",
-                    id: null,
-                    error: { code: -32700, message },
-                }), { status: 400, headers: { "Content-Type": "application/json" } });
+                return createJSONRPCErrorResponse(400, -32700, message);
             }
             let rpcRequest;
             try {
                 const bodyText = await request.text();
                 if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
-                    return new dntShim.Response(JSON.stringify({
-                        jsonrpc: "2.0",
-                        id: null,
-                        error: { code: -32600, message: "Request body too large" },
-                    }), { status: 413, headers: { "Content-Type": "application/json" } });
+                    return createJSONRPCErrorResponse(413, -32600, "Request body too large");
                 }
                 rpcRequest = JSON.parse(bodyText);
             }
             catch (_) {
                 // expected: malformed JSON in request body
-                return new dntShim.Response(JSON.stringify({
-                    jsonrpc: "2.0",
-                    id: null,
-                    error: { code: -32700, message: "Parse error" },
-                }), {
-                    status: 400,
-                    headers: { "Content-Type": "application/json" },
-                });
+                return createJSONRPCErrorResponse(400, -32700, "Parse error");
             }
             // Extract end-user identity from request headers for per-user token flows
             const context = this.extractRequestContext(request);
             const rpcResponse = await this.handleRequest(rpcRequest, context);
-            return new dntShim.Response(JSON.stringify(rpcResponse), {
+            return createJSONResponse(rpcResponse, {
                 headers: {
-                    "Content-Type": "application/json",
                     ...this.getCORSHeaders(requestOrigin),
                 },
             });
@@ -279,14 +283,12 @@ export class MCPServer {
     }
     extractRequestContext(request) {
         const context = {};
-        const endUserId = request.headers.get("x-end-user-id");
-        // Allowlist: alphanumeric, hyphens, underscores, dots, @ (for email-style IDs)
-        if (endUserId && endUserId.length <= 255 && /^[a-zA-Z0-9._@-]+$/.test(endUserId)) {
+        const endUserId = readAllowedHeader(request, "x-end-user-id", END_USER_ID_PATTERN);
+        if (endUserId) {
             context.endUserId = endUserId;
         }
-        const projectId = request.headers.get("x-project-id");
-        // Keep project IDs strict but compatible with UUID/slug formats.
-        if (projectId && projectId.length <= 255 && /^[a-zA-Z0-9._-]+$/.test(projectId)) {
+        const projectId = readAllowedHeader(request, "x-project-id", PROJECT_ID_PATTERN);
+        if (projectId) {
             context.projectId = projectId;
         }
         return Object.keys(context).length > 0 ? context : undefined;
@@ -310,9 +312,6 @@ export class MCPServer {
         const validate = auth.validate;
         return await validate(token);
     }
-    handleCORS(requestOrigin) {
-        return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
-    }
     getCORSHeaders(requestOrigin) {
         if (!this.config.cors?.enabled)
             return {};

package/esm/src/mdx/index.d.ts

@@ -11,8 +11,9 @@
  *   {children}
  * </MDXProvider>
  * ```
+ *
+ * For runtime markdown string rendering, use `veryfront/markdown` instead.
  */
 import "../../_dnt.polyfills.js";
-export { MDXProvider, useMDXComponents } from "../react/components/MDXProvider.js";
-export type { MDXProviderProps } from "../react/components/MDXProvider.js";
+export { MDXProvider, type MDXProviderProps, useMDXComponents, } from "../react/components/MDXProvider.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/mdx/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/mdx/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACnF,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/mdx/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,yBAAyB,CAAC;AAEjC,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,oCAAoC,CAAC"}

package/esm/src/mdx/index.js

@@ -11,10 +11,8 @@
  *   {children}
  * </MDXProvider>
  * ```
+ *
+ * For runtime markdown string rendering, use `veryfront/markdown` instead.
  */
-// veryfront/mdx — MDX provider and component overrides
-//
-// For customizing how .mdx pages render components.
-// For runtime markdown string rendering, use veryfront/markdown instead.
 import "../../_dnt.polyfills.js";
-export { MDXProvider, useMDXComponents } from "../react/components/MDXProvider.js";
+export { MDXProvider, useMDXComponents, } from "../react/components/MDXProvider.js";

package/esm/src/middleware/builtin/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../src/src/middleware/builtin/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7C,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAElF,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAiID,wBAAgB,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,UAAU,CAsD1D;AAED,wBAAgB,SAAS,IAAI,UAAU,CAEtC;AAED,wBAAgB,UAAU,IAAI,UAAU,CAEvC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../src/src/middleware/builtin/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7C,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAElF,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAoJD,wBAAgB,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,UAAU,CAkD1D;AAED,wBAAgB,SAAS,IAAI,UAAU,CAEtC;AAED,wBAAgB,UAAU,IAAI,UAAU,CAEvC"}

package/esm/src/middleware/builtin/logger.js

@@ -41,6 +41,18 @@ function getTimestamp() {
 function getRemoteAddr(req) {
     return req.headers.get("x-forwarded-for") ?? req.headers.get("x-real-ip") ?? "-";
 }
+function getRequestLogDetails(req) {
+    return {
+        method: req.method,
+        pathname: new URL(req.url).pathname,
+        remoteAddr: getRemoteAddr(req),
+        referer: req.headers.get("referer") ?? undefined,
+        requestId: req.headers.get("x-request-id") ?? undefined,
+        traceId: req.headers.get("x-trace-id") ?? req.headers.get("traceparent") ?? undefined,
+        projectSlug: req.headers.get("x-project-slug") ?? undefined,
+        userAgent: req.headers.get("user-agent") ?? undefined,
+    };
+}
 function getLogLevel(status) {
     if (status >= HTTP_STATUS_SERVER_ERROR_MIN)
         return "error";
@@ -49,29 +61,24 @@ function getLogLevel(status) {
     return "info";
 }
 function formatJsonLog(req, status, duration) {
-    const { pathname } = new URL(req.url);
-    const userAgent = req.headers.get("user-agent");
-    const referer = req.headers.get("referer");
-    const requestId = req.headers.get("x-request-id");
-    const traceId = req.headers.get("x-trace-id") ?? req.headers.get("traceparent");
-    const projectSlug = req.headers.get("x-project-slug");
+    const details = getRequestLogDetails(req);
     const entry = {
         timestamp: new Date().toISOString(),
         level: getLogLevel(status),
         service: "server",
-        message: `${req.method} ${pathname} ${status}`,
+        message: `${details.method} ${details.pathname} ${status}`,
         http: {
-            method: req.method,
-            path: pathname,
+            method: details.method,
+            path: details.pathname,
             status,
             durationMs: Math.round(duration),
-            remoteAddr: getRemoteAddr(req),
-            ...(userAgent && userAgent !== "-" ? { userAgent } : {}),
-            ...(referer && referer !== "-" ? { referer } : {}),
+            remoteAddr: details.remoteAddr,
+            ...(details.userAgent && details.userAgent !== "-" ? { userAgent: details.userAgent } : {}),
+            ...(details.referer && details.referer !== "-" ? { referer: details.referer } : {}),
         },
-        ...(requestId ? { requestId } : {}),
-        ...(traceId ? { traceId } : {}),
-        ...(projectSlug ? { projectSlug } : {}),
+        ...(details.requestId ? { requestId: details.requestId } : {}),
+        ...(details.traceId ? { traceId: details.traceId } : {}),
+        ...(details.projectSlug ? { projectSlug: details.projectSlug } : {}),
     };
     return JSON.stringify(entry);
 }
@@ -117,21 +124,17 @@ export function logger(options) {
             serverLogger.info(formatLog(format, req, status, duration));
             return;
         }
-        const { pathname } = new URL(req.url);
-        const requestId = req.headers.get("x-request-id") ?? undefined;
-        const traceId = req.headers.get("x-trace-id") ?? req.headers.get("traceparent") ?? undefined;
-        const projectSlug = req.headers.get("x-project-slug") ?? undefined;
-        const userAgent = req.headers.get("user-agent") ?? undefined;
-        serverLogger.info(`${req.method} ${pathname} ${status}`, {
-            requestId,
-            traceId,
-            project_slug: projectSlug,
-            request_url: pathname,
+        const details = getRequestLogDetails(req);
+        serverLogger.info(`${details.method} ${details.pathname} ${status}`, {
+            requestId: details.requestId,
+            traceId: details.traceId,
+            project_slug: details.projectSlug,
+            request_url: details.pathname,
             durationMs: Math.round(duration),
-            method: req.method,
+            method: details.method,
             statusCode: status,
-            remoteAddr: getRemoteAddr(req),
-            ...(userAgent ? { userAgent } : {}),
+            remoteAddr: details.remoteAddr,
+            ...(details.userAgent ? { userAgent: details.userAgent } : {}),
         });
     }
     return async (ctx, next) => {

package/esm/src/middleware/builtin/security/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,eAAe,CAAC,CAAyC;gBAErD,QAAQ,EAAE,MAAM;IAgB5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAcjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,IAAI;CAIhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC;CACjD;AAED,wBAAgB,SAAS,CACvB,oBAAoB,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAChD,WAAW,CAAC,EAAE,MAAM,GACnB,UAAU,CAkCZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAMhE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA4BjE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,eAAe,CAAC,CAAyC;gBAErD,QAAQ,EAAE,MAAM;IAgB5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAcjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,IAAI;CAKhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC;CACjD;AAED,wBAAgB,SAAS,CACvB,oBAAoB,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAChD,WAAW,CAAC,EAAE,MAAM,GACnB,UAAU,CA0BZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAMhE"}

package/esm/src/middleware/builtin/security/rate-limit.js

@@ -5,6 +5,19 @@ import { CLEANUP_INTERVAL_MULTIPLIER } from "../../../utils/constants/cache.js";
 import { unrefTimer } from "../../../platform/compat/process.js";
 const DEFAULT_RATE_LIMIT_REQUESTS = 100;
 const DEFAULT_RATE_LIMIT_WINDOW_MS = MS_PER_MINUTE;
+function createRateLimitEntry(windowMs) {
+    return { count: 1, resetAt: Date.now() + windowMs };
+}
+function getRightmostForwardedIp(req) {
+    const forwarded = req.headers.get("x-forwarded-for");
+    if (!forwarded)
+        return undefined;
+    const parts = forwarded.split(",").map((value) => value.trim()).filter(Boolean);
+    return parts.at(-1);
+}
+function defaultKeyGenerator(req) {
+    return getRightmostForwardedIp(req) ?? "anonymous";
+}
 export class MemoryRateLimitStore {
     counts = new Map();
     cleanupInterval;
@@ -22,10 +35,10 @@ export class MemoryRateLimitStore {
         unrefTimer(this.cleanupInterval);
     }
     increment(key, windowMs) {
-        const now = Date.now();
         const existing = this.counts.get(key);
+        const now = Date.now();
         if (!existing || existing.resetAt < now) {
-            const entry = { count: 1, resetAt: now + windowMs };
+            const entry = createRateLimitEntry(windowMs);
             this.counts.set(key, entry);
             return Promise.resolve(entry);
         }
@@ -40,6 +53,7 @@ export class MemoryRateLimitStore {
         if (!this.cleanupInterval)
             return;
         clearInterval(this.cleanupInterval);
+        this.cleanupInterval = undefined;
     }
 }
 export function rateLimit(optionsOrMaxRequests, windowMsArg) {
@@ -49,16 +63,7 @@ export function rateLimit(optionsOrMaxRequests, windowMsArg) {
     const maxRequests = options.maxRequests ?? DEFAULT_RATE_LIMIT_REQUESTS;
     const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
     const store = options.store ?? new MemoryRateLimitStore(windowMs);
-    const keyGenerator = options.keyGenerator ?? ((req) => {
-        const forwarded = req.headers.get("x-forwarded-for");
-        if (forwarded) {
-            const parts = forwarded.split(",").map((s) => s.trim()).filter(Boolean);
-            // Use rightmost IP — added by nearest trusted proxy, not spoofable by clients
-            if (parts.length > 0)
-                return parts[parts.length - 1];
-        }
-        return "anonymous";
-    });
+    const keyGenerator = options.keyGenerator ?? defaultKeyGenerator;
     return async (ctx, next) => {
         const req = getRequest(ctx);
         const key = keyGenerator(req);

package/esm/src/middleware/builtin/timeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../../../../src/src/middleware/builtin/timeout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,oCAAoC,CAAC;AAQ5C,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CA6C5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,iBAA0C,GAAG,MAAM,CAGzF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,CAEtF"}
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../../../../src/src/middleware/builtin/timeout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,oCAAoC,CAAC;AAS5C,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAoBD;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAmC5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,iBAA0C,GAAG,MAAM,CAGzF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,CAEtF"}

package/esm/src/middleware/builtin/timeout.js

@@ -6,6 +6,20 @@ import { HTTP_GATEWAY_TIMEOUT } from "../../utils/constants/http.js";
 const logger = serverLogger.component("timeout");
 const DEFAULT_TIMEOUT_MS = 60_000;
 const TIMEOUT_SENTINEL = Symbol("timeout");
+const DEFAULT_EXCLUDE_PATHS = ["/healthz", "/readyz", "/_health"];
+function isExcludedPath(pathname, exclude) {
+    return exclude.some((path) => pathname === path || pathname.startsWith(path));
+}
+function timeoutResponse(pathname, timeoutMs, message) {
+    return new dntShim.Response(JSON.stringify({
+        error: message,
+        timeoutMs,
+        path: pathname,
+    }), {
+        status: HTTP_GATEWAY_TIMEOUT,
+        headers: { "Content-Type": "application/json" },
+    });
+}
 /**
  * Creates a middleware that enforces request timeouts.
  *
@@ -15,11 +29,11 @@ const TIMEOUT_SENTINEL = Symbol("timeout");
 export function timeout(options) {
     const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const message = options?.message ?? "Request timeout";
-    const exclude = options?.exclude ?? ["/healthz", "/readyz", "/_health"];
+    const exclude = options?.exclude ?? DEFAULT_EXCLUDE_PATHS;
     return async (ctx, next) => {
         const req = getRequest(ctx);
         const { pathname } = new URL(req.url);
-        if (exclude.some((path) => pathname === path || pathname.startsWith(path))) {
+        if (isExcludedPath(pathname, exclude)) {
             return next();
         }
         let timeoutId;
@@ -37,14 +51,7 @@ export function timeout(options) {
                 method: req.method,
                 timeoutMs,
             });
-            return new dntShim.Response(JSON.stringify({
-                error: message,
-                timeoutMs,
-                path: pathname,
-            }), {
-                status: HTTP_GATEWAY_TIMEOUT,
-                headers: { "Content-Type": "application/json" },
-            });
+            return timeoutResponse(pathname, timeoutMs, message);
         }
         finally {
             if (timeoutId)

package/esm/src/modules/import-map/default-import-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-import-map.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/import-map/default-import-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAwDlD,wBAAgB,mBAAmB,IAAI,eAAe,CAIrD"}
+{"version":3,"file":"default-import-map.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/import-map/default-import-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAyDlD,wBAAgB,mBAAmB,IAAI,eAAe,CAIrD"}

package/esm/src/modules/import-map/default-import-map.js

@@ -10,9 +10,10 @@ import { getReactImportMap } from "../../transforms/esm/package-registry.js";
 function getVeryfrontSsrImportMap() {
     const base = "/_vf_modules/_veryfront";
     const ssr = "?ssr=true";
-    const head = `${base}/react/components/Head.js${ssr}`;
-    const router = `${base}/react/router/index.js${ssr}`;
-    const context = `${base}/react/context/index.js${ssr}`;
+    const coreReact = `${base}/react/runtime/core.js${ssr}`;
+    const head = coreReact;
+    const router = coreReact;
+    const context = coreReact;
     const fonts = `${base}/react/fonts/index.js${ssr}`;
     const markdown = `${base}/markdown/index.js${ssr}`;
     const chat = `${base}/chat/index.js${ssr}`;

package/esm/src/oauth/handlers/callback-handler.d.ts

@@ -1,8 +1,3 @@
-/**************************************************
- * OAuth Callback Handler
- *
- * Reusable handler for OAuth callback routes.
- **************************************************/
 import * as dntShim from "../../../_dnt.shims.js";
 import { type EnvironmentConfig } from "../../config/environment-config.js";
 import { type EnvReader } from "../providers/base.js";

package/esm/src/oauth/handlers/callback-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/handlers/callback-handler.ts"],"names":[],"mappings":"AAAA;;;;oDAIoD;AACpD,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAKlD,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,KAAK,SAAS,EAAgB,MAAM,sBAAsB,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9E,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,4BAA4B;IAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,gFAAgF;IAChF,GAAG,CAAC,EAAE,iBAAiB,CAAC;IAExB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,2BAAgC,GACxC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAkHzD"}
+{"version":3,"file":"callback-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/handlers/callback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAGlD,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,KAAK,SAAS,EAAgB,MAAM,sBAAsB,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9E,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,4BAA4B;IAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,gFAAgF;IAChF,GAAG,CAAC,EAAE,iBAAiB,CAAC;IAExB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,2BAAgC,GACxC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAkHzD"}