veryfront 0.1.131 → 0.1.136

package/src/src/server/handlers/dev/framework-candidates.generated.ts

@@ -1041,6 +1041,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "Hover",
   "HydratingChatRootFixture():",
   "HydratingChatStyleProviderFixture():",
+  "HydratingColorModeScriptFixture():",
   "HydratingHeadStyleFixture():",
   "I",
   "IconElementSpec",
@@ -2040,6 +2041,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "as",
   "asking",
   "assert(root,",
+  "assert(script,",
   "assert(style,",
   "assert,",
   "assertEquals",
@@ -3157,6 +3159,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "hover:underline",
   "href={doc.url}",
   "href={props.href}",
+  "html",
   "html.replaceAll(",
   "html:",
   "html>",
@@ -3170,6 +3173,8 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "https://example.com/",
   "hydrateAndReadManagedHeadStyleNonce(",
   "hydrateAndReadManagedHeadStyleNonce(<HydratingHeadStyleFixture",
+  "hydrateAndReadScriptNonce(<HydratingColorModeScriptFixture",
+  "hydrateAndReadScriptNonce(element:",
   "hydrateAndReadStyleNonce(<HydratingChatRootFixture",
   "hydrateAndReadStyleNonce(<HydratingChatStyleProviderFixture",
   "hydrateAndReadStyleNonce(element:",
@@ -3238,6 +3243,8 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "initialContent:",
   "initialContent={content}",
   "initialize(config:",
+  "injectNonceIntoInlineTags(html:",
+  "injectNonceIntoInlineTags(renderToString(element),",
   "injectNonceIntoStyleTags(html:",
   "injectNonceIntoStyleTags(renderToString(element),",
   "injected",
@@ -4381,6 +4388,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "replace(",
   "replace(/",
   "replace(/:",
+  "replaceAll(",
   "requestAnimationFrame(()",
   "requestAnimationFrame:",
   "reset",
@@ -4457,6 +4465,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "score:",
   "score?:",
   "script",
+  "script.getAttribute(",
   "script[nonce],",
   "script}",
   "scrollAreaRef",

package/src/src/server/handlers/request/ssr/ssr-response-builder.ts

@@ -15,15 +15,7 @@ import { getContentType } from "../../utils/content-types.js";
 import type { SSRRenderResult } from "../../../services/rendering/ssr.service.js";
 import { ErrorPages } from "../../../utils/error-html.js";
 import type { ResponseBuilder } from "../../../../security/http/response/builder.js";
-import { escapeHtml } from "../../../../html/html-escape.js";
-
-function addNonceToInlineTags(html: string, nonce: string): string {
-  const escapedNonce = escapeHtml(nonce);
-  return html.replace(
-    /<(script|style)\b(?![^>]*\bnonce\s*=)([^>]*)>/giu,
-    `<$1$2 nonce="${escapedNonce}">`,
-  );
-}
+import { addNonceToHtmlStream, addNonceToHtmlTags } from "../../../../html/nonce-injection.js";
 
 /**
  * Build an HTTP response from an SSR render result.
@@ -47,7 +39,11 @@ export async function buildSSRResponse(
       .withSecurity(ctx.securityConfig ?? undefined, req)
       .withClientHints()
       .withCache("no-cache")
-      .withContentType(getContentType(".html"), result.stream, result.status);
+      .withContentType(
+        getContentType(".html"),
+        addNonceToHtmlStream(result.stream, builder.nonce),
+        result.status,
+      );
 
     if (!isHeadRequest) return response;
 
@@ -70,7 +66,7 @@ export async function buildSSRResponse(
     : typeof result.stream === "string"
     ? result.stream
     : ErrorPages.serverError();
-  const html = addNonceToInlineTags(content, builder.nonce);
+  const html = addNonceToHtmlTags(content, builder.nonce);
   const body = isHeadRequest ? null : html;
 
   let response = builder

package/src/src/server/handlers/request/static.handler.ts

@@ -21,6 +21,12 @@ import {
 } from "../../../utils/constants/index.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { StaticFileService } from "../../services/static/index.js";
+import { addNonceToHtmlTags } from "../../../html/nonce-injection.js";
+import { computeEtag } from "../utils/etag.js";
+
+function isHtmlResponse(contentType: string): boolean {
+  return /\btext\/html\b/i.test(contentType);
+}
 
 export class StaticHandler extends BaseHandler {
   metadata: HandlerMetadata = {
@@ -59,6 +65,8 @@ export class StaticHandler extends BaseHandler {
         const isHead = method === "HEAD";
         const isLocal = !!ctx.isLocalProject;
         const isPreviewMode = ctx.requestContext?.mode === "preview" && !isLocal;
+        const builder = this.createResponseBuilder(ctx)
+          .withCORS(req, ctx.securityConfig?.cors);
 
         const result = await this.staticService.resolveFile(pathname, {
           projectDir: ctx.projectDir,
@@ -70,8 +78,7 @@ export class StaticHandler extends BaseHandler {
         if (!result) {
           if (!this.staticService.isAssetRequest(pathname)) return null;
 
-          return this.createResponseBuilder(ctx)
-            .withCORS(req, ctx.securityConfig?.cors)
+          return builder
             .withSecurity(ctx.securityConfig ?? undefined, req)
             .withCache("no-cache")
             .withContentType(
@@ -81,19 +88,24 @@ export class StaticHandler extends BaseHandler {
             );
         }
 
-        if (hasMatchingEtag(req, result.etag)) {
-          return this.createResponseBuilder(ctx)
-            .withCORS(req, ctx.securityConfig?.cors)
+        const responseData = isHtmlResponse(result.contentType)
+          ? new TextEncoder().encode(
+            addNonceToHtmlTags(new TextDecoder().decode(result.data), builder.nonce),
+          )
+          : result.data;
+        const etag = computeEtag(responseData);
+
+        if (hasMatchingEtag(req, etag)) {
+          return builder
             .withSecurity(ctx.securityConfig ?? undefined, req)
-            .notModified(result.etag);
+            .notModified(etag);
         }
 
-        const body: dntShim.BodyInit | null = isHead ? null : result.data.slice();
-        const response = this.createResponseBuilder(ctx)
-          .withCORS(req, ctx.securityConfig?.cors)
+        const body: dntShim.BodyInit | null = isHead ? null : responseData.slice();
+        const response = builder
           .withSecurity(ctx.securityConfig ?? undefined, req)
           .withCache(result.cacheStrategy)
-          .withETag(result.etag)
+          .withETag(etag)
           .withContentType(result.contentType, body, HTTP_OK);
 
         this.logDebug(

package/src/src/tool/factory.ts

@@ -127,10 +127,18 @@ function generateToolId(): string {
   return `tool_${Date.now()}_${toolIdCounter++}`;
 }
 
+function markGeneratedToolId<TInput, TOutput>(tool: Tool<TInput, TOutput>): Tool<TInput, TOutput> {
+  return {
+    ...tool,
+    __veryfrontGeneratedId: tool.id,
+  };
+}
+
 export function tool<TInput = unknown, TOutput = unknown>(
   config: ToolConfig<TInput, TOutput>,
 ): Tool<TInput, TOutput> {
-  const id = config.id || generateToolId();
+  const explicitId = typeof config.id === "string" && config.id.length > 0 ? config.id : undefined;
+  const id = explicitId ?? generateToolId();
 
   const inputSchemaJson = convertSchemaToJson(
     config.inputSchema,
@@ -139,7 +147,7 @@ export function tool<TInput = unknown, TOutput = unknown>(
     config.allowUnknownSchema ?? false,
   );
 
-  return {
+  const createdTool: Tool<TInput, TOutput> = {
     id,
     type: "function" as const,
     description: config.description,
@@ -163,6 +171,8 @@ export function tool<TInput = unknown, TOutput = unknown>(
     },
     mcp: config.mcp,
   };
+
+  return explicitId ? createdTool : markGeneratedToolId(createdTool);
 }
 
 export interface DynamicToolConfig {
@@ -179,11 +189,12 @@ export interface DynamicToolConfig {
 }
 
 export function dynamicTool(config: DynamicToolConfig): Tool<unknown, unknown> {
-  const id = config.id || generateToolId();
+  const explicitId = typeof config.id === "string" && config.id.length > 0 ? config.id : undefined;
+  const id = explicitId ?? generateToolId();
 
   const inputSchemaJson = convertSchemaToJson(config.inputSchema, id, "DYNAMIC_TOOL", true);
 
-  return {
+  const createdTool: Tool<unknown, unknown> = {
     id,
     type: "dynamic" as const,
     description: config.description,
@@ -202,4 +213,6 @@ export function dynamicTool(config: DynamicToolConfig): Tool<unknown, unknown> {
     },
     mcp: config.mcp,
   };
+
+  return explicitId ? createdTool : markGeneratedToolId(createdTool);
 }

package/src/src/tool/types.ts

@@ -74,6 +74,8 @@ type ToolType = "function" | "dynamic";
 export interface Tool<TInput = any, TOutput = any> {
   /** Tool ID */
   id: string;
+  /** Internal marker used to distinguish autogenerated placeholder ids from explicit ids. */
+  __veryfrontGeneratedId?: string;
 
   /**
    * Tool type discriminator

package/src/src/transforms/pipeline/stages/ssr-vf-modules/constants.ts

@@ -39,6 +39,10 @@ export const FRAMEWORK_LOOKUPS: Array<[prefix: string, frameworkDir: string]> =
 // Singleflight for framework module file writes to prevent race conditions
 export const frameworkWriteFlight = new Singleflight<string>();
 
+// Singleflight for top-level framework source transforms so concurrent user
+// modules importing the same veryfront/* module do not receive cycle placeholders.
+export const frameworkTransformFlight = new Singleflight<string>();
+
 // Cache for already-transformed #veryfront/ dependencies to avoid cycles and redundant work
 export const veryfrontTransformCache = new Map<string, string>();
 

package/src/src/transforms/pipeline/stages/ssr-vf-modules/import-finder.ts

@@ -9,8 +9,10 @@
 export function findVfModuleImports(code: string): string[] {
   const imports: string[] = [];
   // Note: \s* allows zero whitespace (minified code: from"..." has no space)
-  // Only match _veryfront/ framework modules, not user project files
-  const pattern = /from\s*["'](\/\_vf\_modules\/_veryfront\/[^"']+)["']/g;
+  // Only match _veryfront/ framework modules, not user project files.
+  // Handle both raw "/_vf_modules/..." specifiers and malformed
+  // "file:///_vf_modules/..." variants that can leak out of stale caches.
+  const pattern = /from\s*["']((?:file:\/\/)?\/_vf_modules\/_veryfront\/[^"']+)["']/g;
 
   let match: RegExpExecArray | null;
   while ((match = pattern.exec(code)) !== null) {

package/src/src/transforms/pipeline/stages/ssr-vf-modules/index.ts

@@ -32,6 +32,7 @@ import {
   EXTENSIONS,
   FRAMEWORK_LOOKUPS,
   FRAMEWORK_ROOT,
+  frameworkTransformFlight,
   LOG_PREFIX,
 } from "./constants.js";
 
@@ -56,6 +57,7 @@ export {
   FRAMEWORK_LOOKUPS,
   FRAMEWORK_ROOT,
   frameworkFileCache,
+  frameworkTransformFlight,
   frameworkWriteFlight,
   LOG_PREFIX,
   MAX_RELATIVE_IMPORT_DEPTH,
@@ -138,21 +140,22 @@ export const ssrVfModulesPlugin: TransformPlugin = {
           contentLength: resolved.content.length,
         });
 
-        const transformed = await transformFrameworkSource(
-          resolved.content,
-          resolved.sourcePath,
-          ctx.reactVersion ?? REACT_DEFAULT_VERSION,
-          ctx.projectDir,
-          fs,
-        );
-
-        // Skip cycle placeholders - don't cache or use them
-        if (isCyclePlaceholder(transformed)) {
-          logger.warn(`${LOG_PREFIX} Cycle detected for ${vfModulePath}, skipping cache`);
-          continue;
-        }
-
-        const cachePath = await cacheTransformedCode(transformed, vfModulePath, fs);
+        const cachePath = await frameworkTransformFlight.do(resolved.sourcePath, async () => {
+          const transformed = await transformFrameworkSource(
+            resolved.content,
+            resolved.sourcePath,
+            ctx.reactVersion ?? REACT_DEFAULT_VERSION,
+            ctx.projectDir,
+            fs,
+          );
+
+          // Skip cycle placeholders - don't cache or use them
+          if (isCyclePlaceholder(transformed)) {
+            throw new Error(`Cycle detected while transforming ${vfModulePath}`);
+          }
+
+          return await cacheTransformedCode(transformed, vfModulePath, fs);
+        });
         replacements.set(vfModulePath, `file://${cachePath}`);
 
         logger.debug(`${LOG_PREFIX} Transformed ${vfModulePath} -> file://${cachePath}`);

package/src/src/transforms/pipeline/stages/ssr-vf-modules/path-resolver.ts

@@ -51,13 +51,16 @@ export async function resolveFrameworkFile(
   fs: ReturnType<typeof createFileSystem>,
   existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<{ sourcePath: string; content: string } | null> {
-  const pathWithoutPrefix = vfModulePath
+  const normalizedVfModulePath = vfModulePath.replace(/^file:\/\/(?=\/_vf_modules\/)/, "");
+
+  const pathWithoutPrefix = normalizedVfModulePath
     .replace(/^\/_vf_modules\//, "")
     .replace(/\?.*$/, "")
     .replace(/\.js$/, "");
 
   logger.debug(`${LOG_PREFIX} resolveFrameworkFile`, {
     input: vfModulePath,
+    normalizedVfModulePath,
     pathWithoutPrefix,
     lookupDirs: FRAMEWORK_LOOKUPS.map(([p, d]) => ({ prefix: p, dir: d })),
   });

package/src/src/utils/version-constant.ts

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.131";
+export const VERSION = "0.1.136";