veryfront 0.1.47 → 0.1.49

package/esm/src/server/handlers/dev/styles-candidate-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"styles-candidate-scanner.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/styles-candidate-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuMlD;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAqCxF"}
+{"version":3,"file":"styles-candidate-scanner.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/styles-candidate-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAWlD;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAqCxF"}

package/esm/src/server/handlers/dev/styles-candidate-scanner.js

@@ -11,199 +11,12 @@ import { extractCandidates } from "../../../html/styles-builder/tailwind-compile
 import { serverLogger } from "../../../utils/index.js";
 import { createFileSystem } from "../../../platform/compat/fs.js";
 import { join } from "../../../platform/compat/path/index.js";
+import { FRAMEWORK_CANDIDATES } from "./framework-candidates.generated.js";
 const logger = serverLogger.component("styles-candidate-scanner");
 const SOURCE_EXTENSIONS = [".tsx", ".jsx", ".mdx", ".ts", ".js"];
 const SKIP_DIRS = new Set(["node_modules", ".cache", ".git", "dist", "build", ".vscode"]);
-/**
- * Tailwind classes used by framework React components (chat, agent-card, etc.).
- * These live inside the compiled binary and aren't in the user's project directory,
- * so the local file scanner can't discover them. Must be kept in sync with the
- * component source files in src/react/components/ai/ and src/react/primitives/.
- */
-const FRAMEWORK_SAFELIST = [
-    // ChatContainer / Chat layout (theme.ts defaultChatTheme + chat/index.tsx)
-    "flex",
-    "flex-col",
-    "flex-1",
-    "h-full",
-    "h-screen",
-    "min-h-0",
-    "overflow-hidden",
-    "overflow-y-auto",
-    "relative",
-    "bg-white",
-    "dark:bg-neutral-900",
-    "flex-shrink-0",
-    "border-t",
-    "border-neutral-200",
-    "dark:border-neutral-800",
-    "max-w-2xl",
-    "mx-auto",
-    "px-4",
-    "py-3",
-    "py-4",
-    "gap-2",
-    "items-center",
-    "justify-center",
-    "justify-end",
-    "justify-start",
-    "justify-between",
-    "space-y-2",
-    "text-center",
-    // Message bubbles (theme.ts)
-    "bg-blue-500",
-    "text-white",
-    "rounded-[20px]",
-    "rounded-br-[4px]",
-    "rounded-bl-[4px]",
-    "px-4",
-    "py-2.5",
-    "max-w-[75%]",
-    "bg-neutral-100",
-    "dark:bg-neutral-800",
-    "text-neutral-900",
-    "dark:text-neutral-100",
-    "text-neutral-500",
-    "dark:text-neutral-400",
-    "rounded-2xl",
-    "text-sm",
-    "bg-neutral-50",
-    "text-neutral-600",
-    "dark:text-neutral-300",
-    "rounded-xl",
-    "px-3",
-    "py-2",
-    "font-mono",
-    "border",
-    "border-neutral-200",
-    "dark:border-neutral-700",
-    // Input (theme.ts)
-    "bg-neutral-100",
-    "border-0",
-    "rounded-full",
-    "focus:outline-none",
-    "focus:ring-2",
-    "focus:ring-blue-500/30",
-    "dark:text-neutral-100",
-    "placeholder-neutral-400",
-    "dark:placeholder-neutral-500",
-    "text-[15px]",
-    // Button (theme.ts)
-    "w-9",
-    "h-9",
-    "bg-blue-500",
-    "hover:bg-blue-600",
-    "active:scale-95",
-    "rounded-full",
-    "transition-all",
-    "disabled:opacity-30",
-    "disabled:cursor-not-allowed",
-    "disabled:hover:bg-blue-500",
-    "disabled:active:scale-100",
-    // Loading dots (theme.ts)
-    "w-1.5",
-    "h-1.5",
-    "bg-neutral-400",
-    "animate-bounce",
-    // Empty state
-    "text-3xl",
-    "font-semibold",
-    "mb-4",
-    "mt-2",
-    "max-w-md",
-    "text-base",
-    "text-muted-foreground",
-    "text-foreground",
-    // Icons
-    "size-3",
-    "size-3.5",
-    "size-4",
-    "size-10",
-    "w-4",
-    "h-4",
-    "shrink-0",
-    // Chat messages
-    "whitespace-pre-wrap",
-    "leading-relaxed",
-    "my-3",
-    // Loading animation
-    "gap-1.5",
-    "bg-neutral-100",
-    // Error state
-    "pb-2",
-    "bg-red-50",
-    "dark:bg-red-900/20",
-    "text-red-600",
-    "dark:text-red-400",
-    "gap-3",
-    "inline-flex",
-    "px-3",
-    "py-1.5",
-    "text-xs",
-    "font-medium",
-    "bg-red-100",
-    "dark:bg-red-900/40",
-    "hover:bg-red-200",
-    "dark:hover:bg-red-900/60",
-    "transition-colors",
-    // Tool UI
-    "not-prose",
-    "w-full",
-    "rounded-md",
-    "border-border",
-    "bg-card",
-    "p-3",
-    "hover:bg-muted/50",
-    "font-medium",
-    "bg-muted/50",
-    "text-secondary-foreground",
-    "bg-secondary",
-    "border-l-2",
-    "border-muted",
-    "pl-4",
-    "ml-2",
-    "uppercase",
-    "tracking-wide",
-    "overflow-x-auto",
-    "bg-destructive/10",
-    "text-destructive",
-    // Suggestions
-    "mt-6",
-    "mb-8",
-    "line-clamp-2",
-    // Scroll button, reasoning, model selector
-    "rotate-180",
-    "transition-transform",
-    "animate-pulse",
-    "min-w-full",
-    "text-left",
-    "font-semibold",
-    "text-neutral-700",
-    "dark:text-neutral-300",
-    // Agent card (theme.ts defaultAgentTheme)
-    "p-6",
-    "space-y-4",
-    "bg-amber-50",
-    "dark:bg-amber-900/20",
-    "italic",
-    "border-amber-200",
-    "dark:border-amber-800",
-    "bg-blue-50",
-    "dark:bg-blue-900/20",
-    "border-blue-200",
-    "dark:border-blue-800",
-    "mt-2",
-    "overflow-x-auto",
-    // MessageActions
-    "gap-1",
-    "mt-2",
-    "hover:text-foreground",
-    "hover:bg-muted",
-    // Markdown
-    "group",
-];
-/** De-duplicated set of framework candidates, computed once. */
-const frameworkCandidates = new Set(FRAMEWORK_SAFELIST);
+/** De-duplicated set of framework candidates, computed once at import time. */
+const frameworkCandidates = new Set(FRAMEWORK_CANDIDATES);
 /**
  * Extract Tailwind CSS candidate class names from all project source files.
  *

package/esm/src/server/handlers/request/module/module-server-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-server-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/module-server-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,cAAc,EACnB,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAC/D,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,aAAa,EACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,EACvF,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAC1C,OAAO,CAAC,aAAa,CAAC,CAiDxB"}
+{"version":3,"file":"module-server-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/module-server-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,cAAc,EACnB,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAC/D,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,aAAa,EACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,EACvF,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAC1C,OAAO,CAAC,aAAa,CAAC,CAkDxB"}

package/esm/src/server/handlers/request/module/module-server-handler.js

@@ -21,6 +21,7 @@ export function handleModuleServer(req, ctx, createResponseBuilder, respond, log
                 releaseId: ctx.releaseId ?? null,
                 allowedImportDirs: ctx.config?.security?.allowedImportDirs,
                 reactVersion,
+                mode: ctx.requestContext?.mode,
             });
             const response = createResponseBuilder(ctx)
                 .withCORS(req, ctx.securityConfig?.cors)

package/esm/src/server/runtime-handler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAQlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAwF7D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAkbnF;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAQlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAwF7D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAuanF;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}

package/esm/src/server/runtime-handler/index.js

@@ -210,31 +210,24 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
                 // proceeding would cause cryptic 500s deep in the rendering pipeline.
                 if (isProxyMode && !isLightweightPath(url.pathname) && !isWebSocketPath(url.pathname)) {
                     const token = req.headers.get("x-token");
-                    if (!headers.projectSlug) {
-                        logger.error("Missing required x-project-slug header in proxy mode", {
-                            pathname: url.pathname,
-                            domain,
-                            host: req.headers.get("host"),
-                            forwardedHost: req.headers.get("x-forwarded-host"),
-                        });
-                        endContentMetrics({
-                            requestId: lifecycle.requestId,
-                            pathname: url.pathname,
-                            mode: "proxy",
-                        });
-                        completeRequestTracking(lifecycle.requestId, 502, false);
-                        completeIsolatedRequest(headers.projectSlug, lifecycle.shouldCheckIsolation, false);
-                        endRequestTracing(spanInfo.span, 502);
-                        return new dntShim.Response(JSON.stringify({
+                    const missingHeader = !headers.projectSlug
+                        ? {
                             error: "Missing project context",
                             detail: "x-project-slug header is required in proxy mode",
-                        }), { status: 502, headers: { "Content-Type": "application/json" } });
-                    }
-                    if (!token) {
-                        logger.error("Missing required x-token header in proxy mode", {
+                        }
+                        : !token
+                            ? {
+                                error: "Missing authentication context",
+                                detail: "x-token header is required in proxy mode",
+                            }
+                            : null;
+                    if (missingHeader) {
+                        logger.error(missingHeader.detail, {
                             pathname: url.pathname,
                             domain,
                             projectSlug: headers.projectSlug,
+                            host: req.headers.get("host"),
+                            forwardedHost: req.headers.get("x-forwarded-host"),
                         });
                         endContentMetrics({
                             requestId: lifecycle.requestId,
@@ -244,10 +237,7 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
                         completeRequestTracking(lifecycle.requestId, 502, false);
                         completeIsolatedRequest(headers.projectSlug, lifecycle.shouldCheckIsolation, false);
                         endRequestTracing(spanInfo.span, 502);
-                        return new dntShim.Response(JSON.stringify({
-                            error: "Missing authentication context",
-                            detail: "x-token header is required in proxy mode",
-                        }), { status: 502, headers: { "Content-Type": "application/json" } });
+                        return new dntShim.Response(JSON.stringify(missingHeader), { status: 502, headers: { "Content-Type": "application/json" } });
                     }
                 }
                 const executeHandler = async () => {

package/esm/src/server/shared/renderer/memory/pressure.d.ts

@@ -13,12 +13,5 @@
  *
  * @module server/shared/renderer/memory/pressure
  */
-export type MemoryPressureLevel = "normal" | "warning" | "high" | "critical";
-export declare function getMemoryPressure(): {
-    level: MemoryPressureLevel;
-    heapUsedPercent: number;
-};
 export declare function shouldRejectDueToMemory(): boolean;
-export declare function getCacheTTLMultiplier(): number;
-export declare function shouldEvictAggressively(): boolean;
 //# sourceMappingURL=pressure.d.ts.map

package/esm/src/server/shared/renderer/memory/pressure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pressure.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/shared/renderer/memory/pressure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAqB7E,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAQ3F;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAMjD;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAGjD"}
+{"version":3,"file":"pressure.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/shared/renderer/memory/pressure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwCH,wBAAgB,uBAAuB,IAAI,OAAO,CAMjD"}

package/esm/src/server/shared/renderer/memory/pressure.js

@@ -34,7 +34,7 @@ const THRESHOLDS = {
     HIGH: parseEnvThreshold("MEMORY_HIGH_THRESHOLD", 75),
     CRITICAL: parseEnvThreshold("MEMORY_CRITICAL_THRESHOLD", 80),
 };
-export function getMemoryPressure() {
+function getMemoryPressure() {
     const { heapUsedPercent } = getHeapStats();
     if (heapUsedPercent >= THRESHOLDS.CRITICAL)
         return { level: "critical", heapUsedPercent };
@@ -51,15 +51,3 @@ export function shouldRejectDueToMemory() {
     rendererLog.warn("Rejecting request - memory critical", { heapUsedPercent });
     return true;
 }
-export function getCacheTTLMultiplier() {
-    const { level } = getMemoryPressure();
-    if (level === "warning")
-        return 0.5;
-    if (level === "high" || level === "critical")
-        return 0.25;
-    return 1.0;
-}
-export function shouldEvictAggressively() {
-    const { level } = getMemoryPressure();
-    return level === "high" || level === "critical";
-}

package/esm/src/server/utils/domain-lookup.d.ts

@@ -15,10 +15,6 @@ export interface DomainLookupConfig {
 }
 export declare function lookupProjectByDomain(domain: string, config: DomainLookupConfig): Promise<DomainLookupResult | null>;
 export declare function clearDomainCache(): void;
-export declare function getDomainCacheStats(): {
-    size: number;
-    maxSize: number;
-};
 /**
  * Inject a CacheRepository for testing or distributed caching.
  * Call with null to restore default Map-based caching.

package/esm/src/server/utils/domain-lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-lookup.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/domain-lookup.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAMnE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4BpC;AA4FD,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED,wBAAgB,mBAAmB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEvE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAErF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,SAAS,GAAG,YAAY,GAAG,SAAS,CAatC"}
+{"version":3,"file":"domain-lookup.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/domain-lookup.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAMnE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4BpC;AA4FD,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAErF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,SAAS,GAAG,YAAY,GAAG,SAAS,CAatC"}

package/esm/src/server/utils/domain-lookup.js

@@ -144,9 +144,6 @@ export function clearDomainCache() {
         void injectedCacheRepo.clear();
     logger.debug("Cache cleared");
 }
-export function getDomainCacheStats() {
-    return { size: domainCache.size, maxSize: DOMAIN_CACHE_MAX_ENTRIES };
-}
 /**
  * Inject a CacheRepository for testing or distributed caching.
  * Call with null to restore default Map-based caching.

package/esm/src/skill/allowed-tools.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Allowed-Tools Enforcement
+ *
+ * Dual-layer enforcement for skill tool access restrictions.
+ * Layer 1: Filter tool definitions before sending to model (planning-time)
+ * Layer 2: Check individual tool calls at execution time
+ *
+ * @module
+ */
+/**
+ * Check if a tool name matches a single allowed-tools pattern.
+ *
+ * Supports:
+ * - Exact match: "Read" matches "Read"
+ * - Prefix wildcard: "api:*" matches "api:list-users"
+ */
+export declare function matchesAllowedTool(toolName: string, pattern: string): boolean;
+/** Minimal tool definition shape for filtering */
+export interface FilterableToolDefinition {
+    name: string;
+    description: string;
+    parameters: unknown;
+}
+/**
+ * Layer 1: Filter tool definitions before sending to model.
+ *
+ * Removes tools not in the allowed list. Always-allowed tools
+ * (skill system tools) pass through regardless.
+ *
+ * @param tools - Full list of tool definitions
+ * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
+ * @returns Filtered tool definitions
+ */
+export declare function filterToolsForSkill<T extends FilterableToolDefinition>(tools: T[], allowedTools: string[] | undefined): T[];
+/**
+ * Layer 2: Check if a specific tool call is allowed at execution time.
+ *
+ * @param toolName - Name of the tool being called
+ * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
+ * @returns true if the tool call is allowed
+ */
+export declare function isToolAllowedBySkill(toolName: string, allowedTools: string[] | undefined): boolean;
+/**
+ * Validate allowed-tool patterns at parse time.
+ *
+ * Ensures each pattern matches the expected format.
+ * Rejects unsupported patterns with a descriptive error (fail closed).
+ *
+ * @param patterns - Array of tool patterns to validate
+ * @returns Validated patterns (same array if all valid)
+ * @throws If any pattern is invalid
+ */
+export declare function validateAllowedToolPatterns(patterns: string[]): string[];
+//# sourceMappingURL=allowed-tools.d.ts.map

package/esm/src/skill/allowed-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-tools.d.ts","sourceRoot":"","sources":["../../../src/src/skill/allowed-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAc7E;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,wBAAwB,EACpE,KAAK,EAAE,CAAC,EAAE,EACV,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,GACjC,CAAC,EAAE,CASL;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,GACjC,OAAO,CAIT;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAaxE"}

package/esm/src/skill/allowed-tools.js

@@ -0,0 +1,87 @@
+/**
+ * Allowed-Tools Enforcement
+ *
+ * Dual-layer enforcement for skill tool access restrictions.
+ * Layer 1: Filter tool definitions before sending to model (planning-time)
+ * Layer 2: Check individual tool calls at execution time
+ *
+ * @module
+ */
+import { SKILL_ALLOWED_TOOL_PATTERN_REGEX, SKILL_TOOL_IDS } from "./types.js";
+import { createError, toError } from "../errors/veryfront-error.js";
+/**
+ * Check if a tool name matches a single allowed-tools pattern.
+ *
+ * Supports:
+ * - Exact match: "Read" matches "Read"
+ * - Prefix wildcard: "api:*" matches "api:list-users"
+ */
+export function matchesAllowedTool(toolName, pattern) {
+    // Invalid patterns always fail (fail closed)
+    if (!SKILL_ALLOWED_TOOL_PATTERN_REGEX.test(pattern)) {
+        return false;
+    }
+    // Prefix wildcard
+    if (pattern.endsWith(":*")) {
+        const prefix = pattern.slice(0, -1); // keep the colon: "api:"
+        return toolName.startsWith(prefix);
+    }
+    // Exact match
+    return toolName === pattern;
+}
+/**
+ * Layer 1: Filter tool definitions before sending to model.
+ *
+ * Removes tools not in the allowed list. Always-allowed tools
+ * (skill system tools) pass through regardless.
+ *
+ * @param tools - Full list of tool definitions
+ * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
+ * @returns Filtered tool definitions
+ */
+export function filterToolsForSkill(tools, allowedTools) {
+    if (allowedTools === undefined) {
+        return tools;
+    }
+    return tools.filter((tool) => {
+        if (SKILL_TOOL_IDS.has(tool.name))
+            return true;
+        return allowedTools.some((pattern) => matchesAllowedTool(tool.name, pattern));
+    });
+}
+/**
+ * Layer 2: Check if a specific tool call is allowed at execution time.
+ *
+ * @param toolName - Name of the tool being called
+ * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
+ * @returns true if the tool call is allowed
+ */
+export function isToolAllowedBySkill(toolName, allowedTools) {
+    if (allowedTools === undefined)
+        return true;
+    if (SKILL_TOOL_IDS.has(toolName))
+        return true;
+    return allowedTools.some((pattern) => matchesAllowedTool(toolName, pattern));
+}
+/**
+ * Validate allowed-tool patterns at parse time.
+ *
+ * Ensures each pattern matches the expected format.
+ * Rejects unsupported patterns with a descriptive error (fail closed).
+ *
+ * @param patterns - Array of tool patterns to validate
+ * @returns Validated patterns (same array if all valid)
+ * @throws If any pattern is invalid
+ */
+export function validateAllowedToolPatterns(patterns) {
+    for (const pattern of patterns) {
+        if (!SKILL_ALLOWED_TOOL_PATTERN_REGEX.test(pattern)) {
+            throw toError(createError({
+                type: "agent",
+                message: `Invalid allowed-tools pattern "${pattern}". ` +
+                    `Only exact tool IDs (e.g. "Read") and prefix wildcards (e.g. "api:*") are supported.`,
+            }));
+        }
+    }
+    return patterns;
+}

package/esm/src/skill/executor.d.ts

@@ -0,0 +1,28 @@
+import type { SkillScriptExecutor, SkillScriptExecutorInput, SkillScriptResult } from "./types.js";
+/**
+ * Detect the runtime command for a script based on file extension.
+ */
+export declare function detectRuntime(scriptPath: string): {
+    command: string;
+    args: string[];
+};
+/**
+ * Local script executor using runCommand() from the compat layer.
+ */
+export declare class LocalScriptExecutor implements SkillScriptExecutor {
+    execute(input: SkillScriptExecutorInput): Promise<SkillScriptResult>;
+}
+/**
+ * Cloud script executor using sandbox.
+ * Requires SANDBOX_AUTH_TOKEN environment variable.
+ */
+export declare class CloudScriptExecutor implements SkillScriptExecutor {
+    execute(input: SkillScriptExecutorInput): Promise<SkillScriptResult>;
+}
+/**
+ * Get the appropriate script executor.
+ * Checks SANDBOX_AUTH_TOKEN on every call so request-scoped env overlays
+ * (e.g. project-env AsyncLocalStorage) are respected.
+ */
+export declare function getSkillScriptExecutor(): SkillScriptExecutor;
+//# sourceMappingURL=executor.d.ts.map

package/esm/src/skill/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/src/skill/executor.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAoEnG;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBrF;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,mBAAmB;IACvD,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAsB3E;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,mBAAmB;IACvD,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA+D3E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAE5D"}