veryfront 0.1.216 → 0.1.217

package/esm/src/provider/runtime-loader.js

@@ -1,160 +1,7 @@
-import * as dntShim from "../../_dnt.shims.js";
 import { getAnthropicMessagesUrl, getGoogleEmbeddingUrl, getGoogleGenerateContentUrl, getGoogleStreamGenerateContentUrl, getOpenAIChatCompletionsUrl, getOpenAIEmbeddingUrl, getOpenAIResponsesUrl, } from "./runtime-loader/provider-endpoints.js";
 import { createAnthropicRequestInit, createGoogleRequestInit, createOpenAIRequestInit, } from "./runtime-loader/provider-request-init.js";
-export const TOOL_INPUT_PENDING_THRESHOLD_MS = 5_000;
-function getToolCallIdFromStreamPart(part) {
-    if (!part || typeof part !== "object") {
-        return null;
-    }
-    const record = part;
-    if (typeof record.toolCallId === "string" && record.toolCallId.length > 0) {
-        return record.toolCallId;
-    }
-    if (typeof record.id === "string" && record.id.length > 0) {
-        return record.id;
-    }
-    return null;
-}
-function collectDueToolStatuses(toolStates, now, thresholdMs) {
-    const events = [];
-    for (const [toolCallId, state] of toolStates.entries()) {
-        if (state.dueAt === null || state.dueAt > now) {
-            continue;
-        }
-        state.dueAt = now + thresholdMs;
-        state.lastStatus = "pending_input";
-        events.push({
-            type: "data-tool-call-status",
-            data: {
-                toolCallId,
-                status: "pending_input",
-            },
-        });
-    }
-    return events;
-}
-export async function* withToolInputStatusTransitions(stream, thresholdMs = TOOL_INPUT_PENDING_THRESHOLD_MS) {
-    const iterator = stream[Symbol.asyncIterator]();
-    const toolStates = new Map();
-    const buffered = [];
-    let nextPartPromise = null;
-    const closeTool = (toolCallId) => {
-        if (!toolCallId) {
-            return;
-        }
-        toolStates.delete(toolCallId);
-    };
-    const schedulePending = (toolCallId) => {
-        if (!toolCallId) {
-            return;
-        }
-        const state = toolStates.get(toolCallId) ?? {
-            dueAt: null,
-            lastStatus: null,
-        };
-        state.dueAt = Date.now() + thresholdMs;
-        toolStates.set(toolCallId, state);
-    };
-    const markStreaming = (toolCallId) => {
-        if (!toolCallId) {
-            return;
-        }
-        const state = toolStates.get(toolCallId) ?? {
-            dueAt: null,
-            lastStatus: null,
-        };
-        if (state.lastStatus !== "streaming_input") {
-            buffered.push({
-                type: "data-tool-call-status",
-                data: {
-                    toolCallId,
-                    status: "streaming_input",
-                },
-            });
-        }
-        state.lastStatus = "streaming_input";
-        state.dueAt = Date.now() + thresholdMs;
-        toolStates.set(toolCallId, state);
-    };
-    const processPart = (part) => {
-        if (!part || typeof part !== "object") {
-            buffered.push(part);
-            return;
-        }
-        const record = part;
-        const partType = typeof record.type === "string" ? record.type : null;
-        const toolCallId = getToolCallIdFromStreamPart(part);
-        switch (partType) {
-            case "tool-input-start":
-                schedulePending(toolCallId);
-                buffered.push(part);
-                return;
-            case "tool-input-delta":
-                markStreaming(toolCallId);
-                buffered.push(part);
-                return;
-            case "tool-call":
-            case "tool-result":
-            case "tool-error":
-                closeTool(toolCallId);
-                buffered.push(part);
-                return;
-            case "finish":
-            case "error":
-                toolStates.clear();
-                buffered.push(part);
-                return;
-            default:
-                buffered.push(part);
-                return;
-        }
-    };
-    while (true) {
-        if (buffered.length > 0) {
-            yield buffered.shift();
-            continue;
-        }
-        if (!nextPartPromise) {
-            nextPartPromise = iterator.next();
-        }
-        const nextDueAt = [...toolStates.values()]
-            .map((state) => state.dueAt)
-            .filter((value) => value !== null)
-            .sort((left, right) => left - right)[0] ?? null;
-        if (nextDueAt !== null) {
-            let timeoutId = null;
-            const timeoutResult = await Promise.race([
-                nextPartPromise.then((result) => ({ kind: "part", result })),
-                new Promise((resolve) => {
-                    timeoutId = dntShim.setTimeout(() => resolve({ kind: "timeout" }), Math.max(0, nextDueAt - Date.now()));
-                }),
-            ]);
-            if (timeoutId !== null) {
-                clearTimeout(timeoutId);
-            }
-            if (timeoutResult.kind === "timeout") {
-                buffered.push(...collectDueToolStatuses(toolStates, Date.now(), thresholdMs));
-                continue;
-            }
-            nextPartPromise = null;
-            if (timeoutResult.result.done) {
-                buffered.push(...collectDueToolStatuses(toolStates, Date.now(), thresholdMs));
-                while (buffered.length > 0) {
-                    yield buffered.shift();
-                }
-                return;
-            }
-            processPart(timeoutResult.result.value);
-            continue;
-        }
-        const result = await nextPartPromise;
-        nextPartPromise = null;
-        if (result.done) {
-            return;
-        }
-        processPart(result.value);
-    }
-}
+import { TOOL_INPUT_PENDING_THRESHOLD_MS, withToolInputStatusTransitions, } from "./runtime-loader/tool-input-status.js";
+export { TOOL_INPUT_PENDING_THRESHOLD_MS, withToolInputStatusTransitions };
 function isNumberArray(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === "number");
 }

package/esm/src/rendering/orchestrator/pipeline-helpers.d.ts

@@ -0,0 +1,8 @@
+import type { LayoutItem } from "../../types/index.js";
+export declare function extractRenderedCssHash(html: string): string | undefined;
+export declare function serializeLayouts(nestedLayouts: LayoutItem[], projectDir: string): Array<{
+    kind: LayoutItem["kind"];
+    path: string;
+}>;
+export declare function serializeLayoutProps(layoutProps: Map<string, Record<string, unknown>>): Record<string, Record<string, unknown>>;
+//# sourceMappingURL=pipeline-helpers.d.ts.map

package/esm/src/rendering/orchestrator/pipeline-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAED,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,UAAU,EAAE,EAC3B,UAAU,EAAE,MAAM,GACjB,KAAK,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAUnD;AAED,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQzC"}

package/esm/src/rendering/orchestrator/pipeline-helpers.js

@@ -0,0 +1,20 @@
+import { extractRelativePath as extractRelativePathShared } from "../../utils/route-path-utils.js";
+const RENDERED_CSS_HASH_RE = /href="\/_vf\/css\/([a-z0-9-]{1,16})\.css"/i;
+export function extractRenderedCssHash(html) {
+    return html.match(RENDERED_CSS_HASH_RE)?.[1];
+}
+export function serializeLayouts(nestedLayouts, projectDir) {
+    return nestedLayouts
+        .filter((layout) => layout.componentPath || layout.path)
+        .map((layout) => ({
+        kind: layout.kind,
+        path: extractRelativePathShared(layout.componentPath || layout.path || "", projectDir),
+    }));
+}
+export function serializeLayoutProps(layoutProps) {
+    const serialized = {};
+    for (const [layoutId, props] of layoutProps.entries()) {
+        serialized[layoutId] = props;
+    }
+    return serialized;
+}

package/esm/src/rendering/orchestrator/pipeline.d.ts

@@ -53,7 +53,6 @@ export declare class RenderPipeline {
      */
     clearModuleCache(): void;
     private loadModule;
-    private extractRenderedCssHash;
     private resolveCssFromRenderedHtml;
     /**
      * Load modules in parallel and return only successfully loaded ones.
@@ -76,8 +75,6 @@ export declare class RenderPipeline {
     /** Resolve page data for SPA client-side navigation without rendering HTML. */
     resolvePageData(slug: string, options?: RenderOptions): Promise<PageDataResponse>;
     private extractMdxMetadata;
-    private serializeLayouts;
-    private serializeLayoutProps;
     private resolveAppPath;
     private resolveProjectUpdatedAt;
     private resolvePageDataCss;

package/esm/src/rendering/orchestrator/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6ChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAyBD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;gBAEnC,MAAM,EAAE,oBAAoB;IAaxC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,sBAAsB;YAIhB,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAyDnC;;;OAGG;YACW,mBAAmB;IAiGjC,OAAO,CAAC,uBAAuB;IAkCzB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA+P9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;YA+EzE,kBAAkB;IA2ChC,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,oBAAoB;YAYd,cAAc;IAW5B,OAAO,CAAC,uBAAuB;YAYjB,kBAAkB;YAmElB,uBAAuB;IAmBrC;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAetB"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2ChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAyBD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;gBAEnC,MAAM,EAAE,oBAAoB;IAaxC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;YAIJ,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAyDnC;;;OAGG;YACW,mBAAmB;IAiGjC,OAAO,CAAC,uBAAuB;IAkCzB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA+P9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;YA+EzE,kBAAkB;YA2ClB,cAAc;IAW5B,OAAO,CAAC,uBAAuB;YAYjB,kBAAkB;YAmElB,uBAAuB;IAmBrC;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAetB"}

package/esm/src/rendering/orchestrator/pipeline.js

@@ -22,6 +22,7 @@ import { VeryfrontError } from "../../errors/index.js";
 import { FILE_NOT_FOUND, RENDER_ERROR } from "../../errors/error-registry.js";
 import { buildQueryAwareCacheKey } from "../../cache/keys.js";
 import { extractRelativePath as extractRelativePathShared, extractRouteParams as extractRouteParamsShared, } from "../../utils/route-path-utils.js";
+import { extractRenderedCssHash, serializeLayoutProps, serializeLayouts, } from "./pipeline-helpers.js";
 import { join } from "../../platform/compat/path/index.js";
 import { isExtendedFSAdapter } from "../../platform/adapters/fs/wrapper.js";
 import { DataFetcher } from "../../data/index.js";
@@ -40,7 +41,6 @@ import { collectModulesToLoad, DATA_FETCH_TIMEOUT_MS, hasDataFetchingFunction, M
 const renderPageLog = logger.component("render-page");
 const renderPipelineLog = logger.component("render-pipeline");
 const resolvePageDataLog = logger.component("resolve-page-data");
-const RENDERED_CSS_HASH_RE = /href="\/_vf\/css\/([a-z0-9-]{1,16})\.css"/i;
 // Re-export test helper for backward compatibility
 export { __injectCssCacheForTests } from "./css-cache.js";
 export class RenderPipeline {
@@ -70,11 +70,8 @@ export class RenderPipeline {
     loadModule(filePath) {
         return loadModule(filePath, this.moduleLoaderConfig);
     }
-    extractRenderedCssHash(html) {
-        return html.match(RENDERED_CSS_HASH_RE)?.[1];
-    }
     async resolveCssFromRenderedHtml(html, projectSlug) {
-        const cssHash = this.extractRenderedCssHash(html);
+        const cssHash = extractRenderedCssHash(html);
         if (!cssHash)
             return undefined;
         const cachedCss = await getCSSByHashAsync(cssHash);
@@ -407,9 +404,9 @@ export class RenderPipeline {
         const dataResolution = await this.resolveDataFetching(slug, pageInfo.entity.path, layoutResult.nestedLayouts, options);
         const pageProps = dataResolution.pageProps;
         const params = dataResolution.params;
-        const layoutProps = this.serializeLayoutProps(dataResolution.layoutProps);
+        const layoutProps = serializeLayoutProps(dataResolution.layoutProps);
         const { frontmatter, headings } = await this.extractMdxMetadata(pageType, pageInfo, slug, options, params);
-        const layouts = this.serializeLayouts(layoutResult.nestedLayouts);
+        const layouts = serializeLayouts(layoutResult.nestedLayouts, this.config.projectDir);
         const providers = [];
         const projectUpdatedAt = this.resolveProjectUpdatedAt();
         const appPath = await this.resolveAppPath();
@@ -469,21 +466,6 @@ export class RenderPipeline {
             return { frontmatter: {}, headings: [] };
         }
     }
-    serializeLayouts(nestedLayouts) {
-        return nestedLayouts
-            .filter((layout) => layout.componentPath || layout.path)
-            .map((layout) => ({
-            kind: layout.kind,
-            path: extractRelativePathShared(layout.componentPath || layout.path || "", this.config.projectDir),
-        }));
-    }
-    serializeLayoutProps(layoutProps) {
-        const serialized = {};
-        for (const [layoutId, props] of layoutProps.entries()) {
-            serialized[layoutId] = props;
-        }
-        return serialized;
-    }
     async resolveAppPath() {
         for (const ext of LAYOUT_EXTENSIONS) {
             const candidatePath = join(this.config.projectDir, `components/app.${ext}`);

package/esm/src/routing/api/module-loader/loader-helpers.d.ts

@@ -0,0 +1,10 @@
+export declare const FILE_EXTENSIONS: string[];
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+export declare function validateModulePath(modulePath: string, projectDir: string): void;
+export declare function resolveExportEntry(entry: unknown): string | undefined;
+export declare function toCjsDestructureBindings(bindings: string): string;
+export declare function getLoaderForFile(filePath: string): "tsx" | "jsx" | "ts" | "js" | "json";
+//# sourceMappingURL=loader-helpers.d.ts.map

package/esm/src/routing/api/module-loader/loader-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader-helpers.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe,EAAE,MAAM,EAA+C,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAY/E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAcrE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAejE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,MAAM,CAGvF"}

package/esm/src/routing/api/module-loader/loader-helpers.js

@@ -0,0 +1,62 @@
+import * as pathHelper from "../../../platform/compat/path/index.js";
+import { createError, toError } from "../../../errors/veryfront-error.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
+const EXT_TO_LOADER = {
+    tsx: "tsx",
+    jsx: "jsx",
+    ts: "ts",
+    json: "json",
+};
+export const FILE_EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+export function validateModulePath(modulePath, projectDir) {
+    const resolved = pathHelper.resolve(modulePath);
+    const resolvedProject = pathHelper.resolve(projectDir);
+    if (!isWithinDirectory(resolvedProject, resolved)) {
+        throw toError(createError({
+            type: "api",
+            message: `[API] module path escapes project directory: ${modulePath}`,
+        }));
+    }
+}
+export function resolveExportEntry(entry) {
+    if (typeof entry === "string")
+        return entry;
+    if (entry && typeof entry === "object") {
+        const obj = entry;
+        for (const key of ["import", "default"]) {
+            const value = obj[key];
+            if (typeof value === "string")
+                return value;
+            if (value && typeof value === "object") {
+                const nested = value;
+                if (typeof nested.default === "string")
+                    return nested.default;
+            }
+        }
+    }
+    return undefined;
+}
+export function toCjsDestructureBindings(bindings) {
+    const inner = bindings.trim().replace(/^\{\s*/, "").replace(/\s*\}$/, "");
+    if (!inner)
+        return "{}";
+    const converted = inner
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => {
+        const aliasMatch = part.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
+        if (aliasMatch)
+            return `${aliasMatch[1]}: ${aliasMatch[2]}`;
+        return part;
+    });
+    return `{ ${converted.join(", ")} }`;
+}
+export function getLoaderForFile(filePath) {
+    const ext = filePath.split(".").pop() ?? "";
+    return EXT_TO_LOADER[ext] ?? "js";
+}

package/esm/src/routing/api/module-loader/loader.d.ts

@@ -1,6 +1,6 @@
 import type { APIRoute, LoadModuleOptions } from "./types.js";
 import type { FileSystem } from "../../../platform/compat/fs.js";
-export declare function toCjsDestructureBindings(bindings: string): string;
+export { toCjsDestructureBindings } from "./loader-helpers.js";
 export declare function loadHandlerModule(options: LoadModuleOptions): Promise<APIRoute | null>;
 export declare function getNodeExternalPackagesToResolve(userDeps: Map<string, string>): string[];
 export declare function resolveNodePackageToFileUrl(projectDir: string, packageName: string, fs: FileSystem, pathToFileURL: typeof import("node:url").pathToFileURL): Promise<string | null>;

package/esm/src/routing/api/module-loader/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AA4KjE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAejE;AAgBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF;AAuaD,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,MAAM,CAoDR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAkBjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAgI/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF;AAuaD,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,MAAM,CAoDR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE"}

package/esm/src/routing/api/module-loader/loader.js

@@ -7,6 +7,7 @@ import { createError, toError } from "../../../errors/veryfront-error.js";
 import { getEsbuildLoader } from "../../../utils/path-utils.js";
 import { createFileSystem } from "../../../platform/compat/fs.js";
 import * as pathHelper from "../../../platform/compat/path/index.js";
+import { FILE_EXTENSIONS, getLoaderForFile, resolveExportEntry, toCjsDestructureBindings, validateModulePath, } from "./loader-helpers.js";
 import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { isCompiledBinary } from "../../../utils/index.js";
@@ -14,20 +15,7 @@ import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/
 import { isWithinDirectory } from "../../../security/path-validation.js";
 import { rewriteNpmImports } from "../../../transforms/npm-import-rewrites.js";
 const logger = serverLogger.component("api");
-/**
- * Validates that a module path is contained within the project directory.
- * Prevents path traversal attacks that could load arbitrary files from the host.
- */
-function validateModulePath(modulePath, projectDir) {
-    const resolved = pathHelper.resolve(modulePath);
-    const resolvedProject = pathHelper.resolve(projectDir);
-    if (!isWithinDirectory(resolvedProject, resolved)) {
-        throw toError(createError({
-            type: "api",
-            message: `[API] module path escapes project directory: ${modulePath}`,
-        }));
-    }
-}
+export { toCjsDestructureBindings } from "./loader-helpers.js";
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
 const NODE_BUILTINS = [
     "assert",
@@ -148,52 +136,6 @@ require.resolve = function(id) { return __vf_builtinRequire.resolve(id); };
 require.ensure = function(mods, cb) { cb(); };
 `.trim();
 }
-function resolveExportEntry(entry) {
-    if (typeof entry === "string")
-        return entry;
-    if (entry && typeof entry === "object") {
-        const obj = entry;
-        // Prefer import > default > first string value
-        for (const key of ["import", "default"]) {
-            const val = obj[key];
-            if (typeof val === "string")
-                return val;
-            if (val && typeof val === "object") {
-                const nested = val;
-                if (typeof nested.default === "string")
-                    return nested.default;
-            }
-        }
-    }
-    return undefined;
-}
-export function toCjsDestructureBindings(bindings) {
-    const inner = bindings.trim().replace(/^\{\s*/, "").replace(/\s*\}$/, "");
-    if (!inner)
-        return "{}";
-    const converted = inner
-        .split(",")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const aliasMatch = part.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
-        if (aliasMatch)
-            return `${aliasMatch[1]}: ${aliasMatch[2]}`;
-        return part;
-    });
-    return `{ ${converted.join(", ")} }`;
-}
-const FILE_EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
-const EXT_TO_LOADER = {
-    tsx: "tsx",
-    jsx: "jsx",
-    ts: "ts",
-    json: "json",
-};
-function getLoaderForFile(filePath) {
-    const ext = filePath.split(".").pop() ?? "";
-    return EXT_TO_LOADER[ext] ?? "js";
-}
 export function loadHandlerModule(options) {
     return withSpan("api.loadHandlerModule", async () => {
         const { projectDir, modulePath, adapter, config } = options;

package/esm/src/server/bootstrap.d.ts

@@ -1,5 +1,6 @@
 import type { RuntimeAdapter } from "../platform/adapters/base.js";
 import type { VeryfrontConfig } from "../config/index.js";
+import { type ExtensionLoader } from "../extensions/index.js";
 export interface BootstrapResult {
     /** Enhanced runtime adapter (with FSAdapter if configured) */
     adapter: RuntimeAdapter;
@@ -9,9 +10,28 @@ export interface BootstrapResult {
     usingFSAdapter: boolean;
     /** FSAdapter type (if used) */
     fsAdapterType?: string;
-    /** Dispose FSAdapter resources (WebSocket connections, caches) */
-    dispose?: () => void;
+    /**
+     * Extension loader that ran setup for all discovered extensions.
+     * Even when no extensions exist, a loader instance is present so callers
+     * can safely invoke `teardownAll()` unconditionally.
+     */
+    extensionLoader: ExtensionLoader;
+    /**
+     * Dispose bootstrap resources: tears down extensions (reverse order),
+     * then releases any FSAdapter resources (WebSocket connections, caches).
+     */
+    dispose?: () => void | Promise<void>;
 }
+/**
+ * Run extension orchestration, disposing the FS adapter if orchestration fails.
+ *
+ * Exported for unit testing. In the FS-adapter path the caller has already
+ * allocated FS resources (WebSocket connections, caches) that must be
+ * released before the bootstrap error propagates.
+ *
+ * @internal
+ */
+export declare function orchestrateOrDisposeFS(orchestrate: () => Promise<ExtensionLoader>, fsDispose: (() => void) | undefined): Promise<ExtensionLoader>;
 export declare function bootstrap(projectDir: string, adapter: RuntimeAdapter): Promise<BootstrapResult>;
 export declare function bootstrapDev(projectDir: string, adapter: RuntimeAdapter): Promise<BootstrapResult>;
 export declare function bootstrapProd(projectDir: string, adapter: RuntimeAdapter): Promise<BootstrapResult>;

package/esm/src/server/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/src/server/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA6B1D,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,EAAE,cAAc,CAAC;IAExB,2BAA2B;IAC3B,MAAM,EAAE,eAAe,CAAC;IAExB,wCAAwC;IACxC,cAAc,EAAE,OAAO,CAAC;IAExB,+BAA+B;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAkDD,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAqG1B;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyB1B"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/src/server/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,wBAAwB,CAAC;AA2BrF,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,EAAE,cAAc,CAAC;IAExB,2BAA2B;IAC3B,MAAM,EAAE,eAAe,CAAC;IAExB,wCAAwC;IACxC,cAAc,EAAE,OAAO,CAAC;IAExB,+BAA+B;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,eAAe,EAAE,eAAe,CAAC;IAEjC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAeD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,EAC3C,SAAS,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAO1B;AAkDD,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyI1B;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyB1B"}

package/esm/src/server/bootstrap.js

@@ -1,4 +1,5 @@
 import { clearConfigCache, getConfig } from "../config/index.js";
+import { orchestrateExtensions } from "../extensions/index.js";
 import { getEnvironmentConfig, refreshEnvironmentConfig, } from "../config/environment-config.js";
 import { getErrorMessage } from "../errors/veryfront-error.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
@@ -14,6 +15,36 @@ import { clearDomainCache } from "./utils/domain-lookup.js";
 const bootstrapLog = logger.component("bootstrap");
 const bootstrapDevLog = logger.component("bootstrap-dev");
 const bootstrapProdLog = logger.component("bootstrap-prod");
+function combineDispose(extensionLoader, fsDispose) {
+    return async () => {
+        try {
+            await extensionLoader.teardownAll();
+        }
+        finally {
+            if (fsDispose)
+                fsDispose();
+        }
+    };
+}
+/**
+ * Run extension orchestration, disposing the FS adapter if orchestration fails.
+ *
+ * Exported for unit testing. In the FS-adapter path the caller has already
+ * allocated FS resources (WebSocket connections, caches) that must be
+ * released before the bootstrap error propagates.
+ *
+ * @internal
+ */
+export async function orchestrateOrDisposeFS(orchestrate, fsDispose) {
+    try {
+        return await orchestrate();
+    }
+    catch (err) {
+        if (fsDispose)
+            fsDispose();
+        throw err;
+    }
+}
 let envLogged = false;
 async function ensureEnvLoaded(projectDir, adapter) {
     if (hasEnvLoaded()) {
@@ -72,7 +103,18 @@ export async function bootstrap(projectDir, adapter) {
     const needsFSAdapter = fsType != null && fsType !== "local";
     if (!needsFSAdapter) {
         bootstrapLog.debug("Using local filesystem (no FSAdapter needed)");
-        return { adapter, config, usingFSAdapter: false };
+        const extensionLoader = await orchestrateExtensions({
+            projectDir,
+            config,
+            logger: bootstrapLog,
+        });
+        return {
+            adapter,
+            config,
+            usingFSAdapter: false,
+            extensionLoader,
+            dispose: combineDispose(extensionLoader),
+        };
     }
     bootstrapLog.debug("Initializing FSAdapter", { type: fsType });
     // Inject server-layer callbacks into FS config so the platform layer
@@ -91,7 +133,18 @@ export async function bootstrap(projectDir, adapter) {
             runtime: adapter.id,
             fsAdapter: "local",
         });
-        return { adapter, config, usingFSAdapter: false };
+        const extensionLoader = await orchestrateExtensions({
+            projectDir,
+            config,
+            logger: bootstrapLog,
+        });
+        return {
+            adapter,
+            config,
+            usingFSAdapter: false,
+            extensionLoader,
+            dispose: combineDispose(extensionLoader),
+        };
     }
     const isProxyMode = config.fs?.veryfront?.proxyMode === true;
     const isProductionMode = config.fs?.veryfront?.productionMode === true;
@@ -122,20 +175,29 @@ export async function bootstrap(projectDir, adapter) {
         runtime: adapter.id,
         fsAdapter: fsType,
     });
-    let dispose;
+    let fsDispose;
     if (isExtendedFSAdapter(enhancedAdapter.fs)) {
         const underlying = enhancedAdapter.fs.getUnderlyingAdapter();
         if ("dispose" in underlying &&
             typeof underlying.dispose === "function") {
-            dispose = () => underlying.dispose();
+            fsDispose = () => underlying.dispose();
         }
     }
+    // If extension orchestration fails after the FS adapter has been wired up,
+    // release the FS resources (WebSocket connections, caches) before
+    // propagating the error — otherwise the adapter would leak.
+    const extensionLoader = await orchestrateOrDisposeFS(() => orchestrateExtensions({
+        projectDir,
+        config,
+        logger: bootstrapLog,
+    }), fsDispose);
     return {
         adapter: enhancedAdapter,
         config,
         usingFSAdapter: true,
         fsAdapterType: fsType,
-        dispose,
+        extensionLoader,
+        dispose: combineDispose(extensionLoader, fsDispose),
     };
 }
 export async function bootstrapDev(projectDir, adapter) {

package/esm/src/server/dev-ui/manifest.d.ts

@@ -11,6 +11,7 @@ declare namespace _default {
         "dashboard/App.tsx": string;
         "dashboard/components/AgentsTab.tsx": string;
         "dashboard/components/Sidebar.tsx": string;
+        "dashboard/components/WorkflowsTab.helpers.ts": string;
         "dashboard/components/WorkflowsTab.tsx": string;
         "dashboard/components/shared.tsx": string;
         "dashboard/components/Card.tsx": string;
@@ -23,6 +24,7 @@ declare namespace _default {
         "dashboard/components/FilesTab.tsx": string;
         "dashboard/components/APITab.tsx": string;
         "dashboard/components/AgentTab.tsx": string;
+        "dashboard/components/WorkflowsTab.helpers.test.ts": string;
         "dashboard/components/Header.tsx": string;
         "dashboard/index.tsx": string;
     };