veryfront 0.1.1284 → 0.1.1285

package/esm/src/routing/api/module-loader/loader.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../../../_dnt.shims.js";
 import { computeCodeHash, computeHash, isCompiledBinary, serverLogger } from "../../../utils/index.js";
 import { readTypeScriptDecoratorOptions } from "../../../extensions/bundler/index.js";
 import { createHTTPPlugin } from "./esbuild-plugin.js";
+import { isSeparator, redactFreeText, remoteOrigin, replaceMatches, structuralPathLabel, } from "./path-redaction.js";
 import { rewriteImportMetaLocations } from "./source-capability-analyzer.js";
 import { restrictedRuntimeModuleReason, validateHTTPImports, validateModuleSpecifierHosts, } from "./http-validator.js";
 import { loadSecurityConfig } from "./security-config.js";
@@ -34,6 +35,9 @@ const IntrinsicReflectOwnKeys = Reflect.ownKeys;
 const MapPrototypeDelete = Map.prototype.delete;
 const MapPrototypeGet = Map.prototype.get;
 const MapPrototypeSet = Map.prototype.set;
+// Redaction runs after project code has evaluated in this realm, so it must
+// not dispatch through prototypes that code could have replaced.
+const RegExpPrototypeExec = RegExp.prototype.exec;
 const trustedRequestContextAccessor = currentRequestContext;
 /**
  * A specifier the HTTP plugin fetches rather than a path. URL schemes are
@@ -67,7 +71,7 @@ export function loadHandlerModule(options) {
             return extractAPIRouteHandlers(module);
         }
         catch (error) {
-            const errorMsg = redactAbsolutePaths(error instanceof Error ? error.message : String(error), projectDir);
+            const errorMsg = redactFreeText(error instanceof Error ? error.message : String(error));
             // The reason, not the error: its stack names host-absolute paths.
             logger.error(`Failed to load API handler ${projectModuleLabel(modulePath, projectDir)}:`, { reason: errorMsg });
             throw toError(createError({
@@ -105,7 +109,7 @@ export function prepareHandlerModule(options) {
             });
         }
         catch (error) {
-            const errorMsg = redactAbsolutePaths(error instanceof Error ? error.message : String(error), projectDir);
+            const errorMsg = redactFreeText(error instanceof Error ? error.message : String(error));
             logger.error(`Failed to prepare isolated API handler ${projectModuleLabel(modulePath, projectDir)}:`, { reason: errorMsg });
             throw toError(createError({
                 type: "api",
@@ -161,13 +165,13 @@ async function loadModule(args) {
             if (!isSpecifierResolutionError(error))
                 throw error;
             logger.debug("Direct import could not resolve a specifier, bundling instead", {
-                modulePath,
-                error: error instanceof Error ? error.message : String(error),
+                modulePath: projectModuleLabel(modulePath, projectDir),
+                error: redactFreeText(error instanceof Error ? error.message : String(error)),
             });
             return loadAndTranspileModule(modulePath, projectDir, adapter, fs, config, decoratorOptions, allowHostTypeScriptConfigReads);
         }
     }
-    logger.debug(`File not local, using adapter-based loading: ${modulePath}`);
+    logger.debug(`File not local, using adapter-based loading: ${projectModuleLabel(modulePath, projectDir)}`);
     return loadAndTranspileModule(modulePath, projectDir, adapter, fs, config, undefined, allowHostTypeScriptConfigReads);
 }
 /** @internal Exported for the runtime-selection regression test. */
@@ -305,7 +309,7 @@ function loadTSModuleDirect(modulePath, revision) {
     const url = modulePath.startsWith("file://")
         ? `${modulePath}${cacheBuster}`
         : `file://${modulePath}${cacheBuster}`;
-    logger.debug(`Direct import (Deno): ${url}`);
+    logger.debug(`Direct import (Deno): ${pathHelper.basename(modulePath)}`);
     return import(url);
 }
 /** Directly import a JavaScript route, keyed by revision so an edit is not served from the module cache. */
@@ -409,11 +413,11 @@ function markDirectGraphVisit(visited, filePath) {
  * absolute one, which would expose the machine's directory layout.
  */
 function projectModuleLabel(filePath, projectDir) {
-    if (!pathHelper.isAbsolute(filePath))
+    const absolute = isSeparator(filePath[0]) ||
+        (filePath[1] === ":" && isSeparator(filePath[2]));
+    if (!absolute)
         return filePath;
-    return isWithinDirectory(projectDir, filePath)
-        ? pathHelper.relative(projectDir, filePath)
-        : pathHelper.basename(filePath);
+    return structuralPathLabel(filePath, pathHelper.resolve(projectDir));
 }
 async function inspectDirectGraphModule(options) {
     const { filePath, routeModulePath, projectRoot, fs, allowedHosts, importMap, pending } = options;
@@ -974,7 +978,7 @@ function createImportMapPlugin(projectDir, sourceSnapshot, routeModulePath, allo
                 if (!resolvedPath && args.namespace === "import-map" && args.path.startsWith(".")) {
                     const modulePath = modulePathOfSpecifier(args.path);
                     const absolutePath = resolveContainedLocalModule(projectDir, args.importer, modulePath);
-                    logger.debug(`[API] Import map relative resolve: ${args.path} (from ${args.importer}) -> ${absolutePath}`);
+                    logger.debug(`[API] Import map relative resolve: ${args.path} (from ${projectModuleLabel(args.importer, projectDir)}) -> ${projectModuleLabel(absolutePath, projectDir)}`);
                     return {
                         path: absolutePath,
                         namespace: "import-map",
@@ -1014,10 +1018,10 @@ function createImportMapPlugin(projectDir, sourceSnapshot, routeModulePath, allo
                     ? resolveContainedLocalModule(projectDir, args.importer || projectDir, resolvedPath)
                     : pathHelper.resolve(projectDir, mappedModulePath);
                 if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
-                    logger.error(`[API] Import map entry escapes project directory: ${args.path} -> ${absolutePath}`);
+                    logger.error(`[API] Import map entry escapes project directory: ${args.path} -> ${projectModuleLabel(absolutePath, projectDir)}`);
                     return { errors: [{ text: `Import map path escapes project: ${args.path}` }] };
                 }
-                logger.debug(`Import map resolved: ${args.path} -> ${absolutePath}`);
+                logger.debug(`Import map resolved: ${args.path} -> ${projectModuleLabel(absolutePath, projectDir)}`);
                 return {
                     path: absolutePath,
                     namespace: "import-map",
@@ -1068,7 +1072,7 @@ function createNamespaceOnLoadHandler(options) {
             };
         }
         catch (error) {
-            const msg = redactAbsolutePaths(error instanceof Error ? error.message : String(error), projectDir);
+            const msg = redactFreeText(error instanceof Error ? error.message : String(error));
             logger.error(`Failed to load ${errorLabel}: ${projectModuleLabel(args.path, projectDir)}`, { reason: msg });
             return { errors: [{ text: `Failed to load: ${msg}` }] };
         }
@@ -1236,7 +1240,7 @@ function createProjectAliasPlugin(sourceSnapshot, projectDir, routeModulePath, a
                 const aliasedPath = args.path.slice(2);
                 const absolutePath = pathHelper.resolve(projectRoot, modulePathOfSpecifier(aliasedPath));
                 if (!isWithinDirectory(projectRoot, absolutePath)) {
-                    logger.error(`[API] Project alias escapes project: ${args.path} -> ${absolutePath}`);
+                    logger.error(`[API] Project alias escapes project: ${args.path} -> ${projectModuleLabel(absolutePath, projectRoot)}`);
                     return { errors: [{ text: `Project alias escapes project: ${args.path}` }] };
                 }
                 return {
@@ -1270,12 +1274,12 @@ function createAdapterResolvePlugin(sourceSnapshot, projectDir, routeModulePath,
                 const modulePath = modulePathOfSpecifier(args.path);
                 const absolutePath = pathHelper.resolve(baseDir, modulePath);
                 if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
-                    logger.error(`[API] Adapter resolve path escapes project: ${args.path} -> ${absolutePath}`);
+                    logger.error(`[API] Adapter resolve path escapes project: ${args.path} -> ${projectModuleLabel(absolutePath, projectDir)}`);
                     return {
                         errors: [{ text: `Relative import escapes project: ${args.path}` }],
                     };
                 }
-                logger.debug(`[API] Adapter resolve: ${args.path} (from ${args.importer || "stdin"}) -> ${absolutePath}`);
+                logger.debug(`[API] Adapter resolve: ${args.path} (from ${args.importer ? projectModuleLabel(args.importer, projectDir) : "stdin"}) -> ${projectModuleLabel(absolutePath, projectDir)}`);
                 return {
                     path: absolutePath,
                     namespace: "vf-adapter",
@@ -1311,11 +1315,12 @@ function createAdapterResolvePlugin(sourceSnapshot, projectDir, routeModulePath,
  * are admitted only through the project's own canonical `node_modules` root;
  * an unrelated path is never trusted merely because one segment has that name.
  */
-function projectBoundaryError(path) {
-    logger.error(`[API] Resolved import escapes project: ${path}`);
+function projectBoundaryError(path, projectDir) {
+    const label = projectModuleLabel(path, projectDir);
+    logger.error(`[API] Resolved import escapes project: ${label}`);
     return {
         errors: [{
-                text: `Import escapes the project directory: ${path}. ` +
+                text: `Import escapes the project directory: ${label}. ` +
                     `API routes may only import project files and project-owned dependencies.`,
             }],
     };
@@ -1354,7 +1359,7 @@ function createProjectBoundaryPlugin(sourceSnapshot, projectDir, routeModulePath
                 }
                 catch (error) {
                     if (error instanceof ProjectBoundaryViolationError) {
-                        return projectBoundaryError(args.path);
+                        return projectBoundaryError(args.path, projectDir);
                     }
                     const message = error instanceof Error ? error.message : String(error);
                     return {
@@ -1366,61 +1371,19 @@ function createProjectBoundaryPlugin(sourceSnapshot, projectDir, routeModulePath
     };
 }
 /**
- * `text` with every absolute filesystem path replaced by its project label:
- * project-relative inside the project, the file name outside it. A URL's path
- * is not a filesystem path and is left alone.
+ * A build location by its label. The location is held structurally, so a
+ * project file keeps its project-relative path; a remote module keeps only its
+ * origin.
  */
-function redactAbsolutePaths(text, projectDir) {
-    // `file:` URLs are paths. Then the project root, so a root containing spaces
-    // is caught whole, and only where a path starts: a web URL may contain it.
-    const root = pathHelper.resolve(projectDir).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return text
-        .replace(/(?<![\w-])file:[^\s'"`(),;]+/gi, (url) => fileUrlLabel(url, projectDir))
-        .replace(new RegExp(`(?<![\\w.:/\\\\])${root}[\\\\/]`, "g"), "").replace(/(?<![\w.:/\\])(?:[A-Za-z]:[\\/]|\\\\|\/)[^\s'"`(),;]+/g, 
-    // A path another platform calls absolute (a drive or UNC path on POSIX)
-    // keeps only its file name.
-    (path) => pathHelper.isAbsolute(path)
-        ? projectModuleLabel(path, projectDir)
-        : path.split(/[\\/]/).pop() ?? "");
-}
-/**
- * A `file:` URL by its project label, whatever its authority: a UNC path
- * converts to `file://server/share/...`, which must not leak either.
- */
-function fileUrlLabel(url, projectDir) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        return "file";
-    }
-    // Extra safety: a query or fragment can carry a credential. fromFileUrl and
-    // the pathname fallback already ignore both.
-    parsed.search = "";
-    parsed.hash = "";
-    try {
-        const path = pathHelper.fromFileUrl(parsed);
-        if (pathHelper.isAbsolute(path))
-            return projectModuleLabel(path, projectDir);
-    }
-    catch {
-        // Not a path this platform can convert; fall back to the file name.
-    }
-    return parsed.pathname.split("/").pop() ?? "";
-}
-/** A remote module by its origin and path, without credentials or query. */
 function buildLocationLabel(file, projectDir, workingDir) {
-    if (/^https?:\/\//i.test(file)) {
-        try {
-            const url = new URL(file);
-            return `${url.origin}${url.pathname}`;
-        }
-        catch {
-            return "remote module";
-        }
-    }
-    return projectModuleLabel(pathHelper.resolve(workingDir, file), projectDir);
+    if (testPattern(/^https?:\/\//i, file))
+        return remoteOrigin(file);
+    const absolute = isSeparator(file[0]) || (file[1] === ":" && isSeparator(file[2]));
+    return structuralPathLabel(absolute ? file : pathHelper.resolve(workingDir, file), projectDir);
+}
+function testPattern(pattern, text) {
+    pattern.lastIndex = 0;
+    return IntrinsicReflectApply(RegExpPrototypeExec, pattern, [text]) !== null;
 }
 /**
  * A failed build, reported by its first error with a project-relative
@@ -1433,15 +1396,18 @@ function buildLocationLabel(file, projectDir, workingDir) {
 export function buildFailure(errors, projectDir, workingDir) {
     const first = errors[0];
     // Drop an esbuild namespace such as `http-url:`, but not a URL's own scheme.
-    const file = first?.location?.file?.replace(/^[a-z][a-z-]+:(?!\/\/)/, "");
+    const location = first?.location?.file;
+    const file = location === undefined
+        ? undefined
+        : replaceMatches(location, /^[a-z][a-z-]+:(?!\/\/)/g, () => "");
     const where = file
-        ? `${buildLocationLabel(file, projectDir, workingDir)}:` +
+        ? `${buildLocationLabel(file, pathHelper.resolve(projectDir), workingDir)}:` +
             // esbuild columns are zero-based; editors count from one.
             `${first?.location?.line}:${(first?.location?.column ?? 0) + 1}: `
         : "";
     return toError(createError({
         type: "api",
-        message: `[API] handler build failed: ${where}${redactAbsolutePaths(first?.text || "unknown error", projectDir)}`,
+        message: `[API] handler build failed: ${where}${redactFreeText(first?.text || "unknown error")}`,
     }));
 }
 async function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config, decoratorOptions, allowHostTypeScriptConfigReads = false) {
@@ -1599,7 +1565,7 @@ function buildTranspiledModuleSource(modulePath, projectDir, adapter, config, re
         });
         if (result.errors?.length)
             throw buildFailure(result.errors, projectDir, workingDir);
-        logger.debug(`built handler ${resolvedPath}`);
+        logger.debug(`built handler ${projectModuleLabel(resolvedPath, projectDir)}`);
         const js = result.outputFiles?.[0]?.text ?? "export {}";
         logger.debug(`transpiled size ${js.length} bytes`);
         return await rewriteExternalImports(js, projectDir, sourceSnapshot, userDeps);
@@ -1746,8 +1712,9 @@ async function importModuleFromCode(code, fs) {
         return await import(`file://${tempFile}?v=${Date.now()}`);
     }
     catch (e) {
-        const errorMessage = e instanceof Error && e.stack ? e.stack : String(e);
-        logger.error(`dynamic import failed ${tempFile}: ${errorMessage}`);
+        // The message, not the stack: its frames name host-absolute paths.
+        const errorMessage = e instanceof Error ? e.message : String(e);
+        logger.error(`dynamic import failed: ${redactFreeText(errorMessage)}`);
         throw e;
     }
     finally {

package/esm/src/routing/api/module-loader/path-redaction.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Keep host paths out of API module loader errors and logs.
+ *
+ * Redaction can run after project code has evaluated in this realm, so it uses
+ * intrinsics captured at module load, never the live string, RegExp or URL
+ * prototypes that code could have replaced.
+ *
+ * @module routing/api/module-loader/path-redaction
+ */
+/** Every match of global `pattern` in `text` replaced, in one linear pass. */
+export declare function replaceMatches(text: string, pattern: RegExp, replace: (match: RegExpExecArray) => string): string;
+export declare function isSeparator(char: string | undefined): boolean;
+/** The text after the last `/` or `\`. */
+export declare function lastPathSegment(path: string): string;
+/**
+ * A path the code holds structurally (a module or location path, not text
+ * scanned out of a message): project-relative inside the resolved
+ * `projectDir`, else its file name. A `..` segment is never trusted inside.
+ */
+export declare function structuralPathLabel(path: string, projectDir: string): string;
+/** An `http(s)` URL by scheme and host only: a path can carry a token. */
+export declare function remoteOrigin(url: string): string;
+/**
+ * `text` with every absolute path and `file:` URL cut to its file name and
+ * every `http(s)` URL cut to its origin. A path is taken through to the next
+ * whitespace or quote, so a directory name is never left behind; an outside
+ * path that itself contains whitespace is the accepted exception, since text
+ * gives no way to tell where it ends. Never throws.
+ */
+export declare function redactFreeText(text: string): string;
+//# sourceMappingURL=path-redaction.d.ts.map

package/esm/src/routing/api/module-loader/path-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-redaction.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/path-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,8EAA8E;AAC9E,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,GAC1C,MAAM,CAgBR;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE7D;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAiCD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI5E;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYhD;AAmCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUnD"}

package/esm/src/routing/api/module-loader/path-redaction.js

@@ -0,0 +1,149 @@
+/**
+ * Keep host paths out of API module loader errors and logs.
+ *
+ * Redaction can run after project code has evaluated in this realm, so it uses
+ * intrinsics captured at module load, never the live string, RegExp or URL
+ * prototypes that code could have replaced.
+ *
+ * @module routing/api/module-loader/path-redaction
+ */
+const IntrinsicReflectApply = Reflect.apply;
+const IntrinsicDecodeURIComponent = decodeURIComponent;
+const RegExpPrototypeExec = RegExp.prototype.exec;
+const StringPrototypeSlice = String.prototype.slice;
+const REDACTION_FAILED = "<redacted path>";
+function slice(text, start, end = text.length) {
+    return IntrinsicReflectApply(StringPrototypeSlice, text, [start, end]);
+}
+/** Every match of global `pattern` in `text` replaced, in one linear pass. */
+export function replaceMatches(text, pattern, replace) {
+    let result = "";
+    let last = 0;
+    pattern.lastIndex = 0;
+    for (let match = IntrinsicReflectApply(RegExpPrototypeExec, pattern, [text]); match !== null; match = IntrinsicReflectApply(RegExpPrototypeExec, pattern, [text])) {
+        result += slice(text, last, match.index) + replace(match);
+        last = match.index + match[0].length;
+        if (match[0].length === 0)
+            pattern.lastIndex++;
+    }
+    return result + slice(text, last);
+}
+export function isSeparator(char) {
+    return char === "/" || char === "\\";
+}
+/** The text after the last `/` or `\`. */
+export function lastPathSegment(path) {
+    let start = 0;
+    for (let index = 0; index < path.length; index++) {
+        if (isSeparator(path[index]))
+            start = index + 1;
+    }
+    return slice(path, start);
+}
+/** `projectDir` without trailing separators, so `/app/` and `/app` agree. */
+function trimmedRoot(projectDir) {
+    let end = projectDir.length;
+    while (end > 1 && isSeparator(projectDir[end - 1]))
+        end--;
+    return slice(projectDir, 0, end);
+}
+/** Whether `path` starts with `root` followed by a separator, either kind. */
+function startsWithRoot(path, root) {
+    for (let index = 0; index < root.length; index++) {
+        const same = path[index] === root[index] ||
+            (isSeparator(path[index]) && isSeparator(root[index]));
+        if (!same)
+            return false;
+    }
+    return isSeparator(path[root.length]);
+}
+/** Whether `path` climbs with a `..` segment, so its prefix proves nothing. */
+function hasParentSegment(path) {
+    let segmentStart = 0;
+    for (let index = 0; index <= path.length; index++) {
+        if (index === path.length || isSeparator(path[index])) {
+            if (index - segmentStart === 2 && path[segmentStart] === "." && path[segmentStart + 1] === ".")
+                return true;
+            segmentStart = index + 1;
+        }
+    }
+    return false;
+}
+/**
+ * A path the code holds structurally (a module or location path, not text
+ * scanned out of a message): project-relative inside the resolved
+ * `projectDir`, else its file name. A `..` segment is never trusted inside.
+ */
+export function structuralPathLabel(path, projectDir) {
+    const root = trimmedRoot(projectDir);
+    if (!hasParentSegment(path) && startsWithRoot(path, root))
+        return slice(path, root.length + 1);
+    return lastPathSegment(path);
+}
+/** An `http(s)` URL by scheme and host only: a path can carry a token. */
+export function remoteOrigin(url) {
+    const schemeEnd = url[4] === ":" ? 7 : 8;
+    let hostEnd = schemeEnd;
+    while (hostEnd < url.length && !isSeparator(url[hostEnd]) && url[hostEnd] !== "?" &&
+        url[hostEnd] !== "#")
+        hostEnd++;
+    let hostStart = schemeEnd;
+    for (let index = schemeEnd; index < hostEnd; index++) {
+        if (url[index] === "@")
+            hostStart = index + 1;
+    }
+    return (schemeEnd === 7 ? "http://" : "https://") + slice(url, hostStart, hostEnd);
+}
+/** A `file:` URL by its file name, without its query or fragment. */
+function fileUrlName(url) {
+    let end = url.length;
+    for (let index = 0; index < url.length; index++) {
+        if (url[index] === "?" || url[index] === "#") {
+            end = index;
+            break;
+        }
+    }
+    let path = slice(url, 5, end);
+    if (path[0] === "/" && path[1] === "/") {
+        // The authority is a host, never a file name.
+        let start = 2;
+        while (start < path.length && path[start] !== "/")
+            start++;
+        path = slice(path, start);
+    }
+    let name = lastPathSegment(path);
+    try {
+        name = IntrinsicDecodeURIComponent(name);
+    }
+    catch {
+        // A malformed escape stays encoded.
+    }
+    // A decoded `%2F` or `%5C` is a separator too.
+    return lastPathSegment(name);
+}
+// One pass, three kinds of token, each running to the next whitespace or quote:
+// a `file:` URL, an `http(s)` URL, and an absolute path. A path may follow `:`
+// or a sentence's `.` (`error:/home/a.ts`, `end./home/a.ts`), but not a word,
+// another path character, or a relative `./` or `../`.
+const FREE_TEXT_PATTERN = /(?<![\w-])(file:[^\s'"`]+)|(https?:\/\/[^\s'"`]+)|(?<![\w/\\])(?<!(?<![\w])\.)(?:[A-Za-z]:[\\/]|\\\\|\/)[^\s'"`]+/gi;
+/**
+ * `text` with every absolute path and `file:` URL cut to its file name and
+ * every `http(s)` URL cut to its origin. A path is taken through to the next
+ * whitespace or quote, so a directory name is never left behind; an outside
+ * path that itself contains whitespace is the accepted exception, since text
+ * gives no way to tell where it ends. Never throws.
+ */
+export function redactFreeText(text) {
+    try {
+        return replaceMatches(text, FREE_TEXT_PATTERN, (match) => {
+            if (match[1] !== undefined)
+                return fileUrlName(match[1]);
+            if (match[2] !== undefined)
+                return remoteOrigin(match[2]);
+            return lastPathSegment(match[0]);
+        });
+    }
+    catch {
+        return REDACTION_FAILED;
+    }
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1284";
+export declare const VERSION = "0.1.1285";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1284";
+export const VERSION = "0.1.1285";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1284",
+  "version": "0.1.1285",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -504,17 +504,17 @@
   "dependencies": {
     "ajv": "8.18.0",
     "ajv-formats": "3.0.1",
-    "zod": "4.3.6",
+    "zod": "4.6.7",
     "@deno/shim-deno": "0.18.0",
     "@deno/shim-crypto": "0.3.1",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "@veryfront/ext-bundler-esbuild": "0.1.1284",
-    "@veryfront/ext-css-tailwind": "0.1.1284",
-    "@veryfront/ext-dev-ui-react": "0.1.1284",
-    "@veryfront/ext-node-websocket-ws": "0.1.1284",
-    "@veryfront/ext-parser-babel": "0.1.1284",
-    "@veryfront/ext-yaml": "0.1.1284"
+    "@veryfront/ext-bundler-esbuild": "0.1.1285",
+    "@veryfront/ext-css-tailwind": "0.1.1285",
+    "@veryfront/ext-dev-ui-react": "0.1.1285",
+    "@veryfront/ext-node-websocket-ws": "0.1.1285",
+    "@veryfront/ext-parser-babel": "0.1.1285",
+    "@veryfront/ext-yaml": "0.1.1285"
   },
   "devDependencies": {
     "@types/node": "20.9.0"
@@ -527,7 +527,7 @@
     "@huggingface/transformers": "^4.3.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
-    "@veryfront/ext-content-mdx": "0.1.1284"
+    "@veryfront/ext-content-mdx": "0.1.1285"
   },
   "peerDependenciesMeta": {
     "@huggingface/transformers": {
@@ -556,5 +556,5 @@
     "NOTICE",
     "README.md"
   ],
-  "gitHead": "ee34c936d96f979a54dc2f32def75772677f4cfd"
+  "gitHead": "2bac963100515224f14213021beb42e128b201ea"
 }