veryfront 0.1.48 → 0.1.49

package/esm/src/routing/api/module-loader/loader.js

@@ -11,7 +11,22 @@ import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { isCompiledBinary } from "../../../utils/index.js";
 import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/multi-project-adapter.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
 const logger = serverLogger.component("api");
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+function validateModulePath(modulePath, projectDir) {
+    const resolved = pathHelper.resolve(modulePath);
+    const resolvedProject = pathHelper.resolve(projectDir);
+    if (!isWithinDirectory(resolvedProject, resolved)) {
+        throw toError(createError({
+            type: "api",
+            message: `[API] module path escapes project directory: ${modulePath}`,
+        }));
+    }
+}
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
 const NODE_BUILTINS = [
     "assert",
@@ -71,12 +86,21 @@ async function readProjectDependencies(projectDir, fs) {
 function generateCompiledBinaryRequireShim(projectDir) {
     const builtinSet = JSON.stringify(NODE_BUILTINS);
     const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+    const safeProjectRoot = JSON.stringify(pathHelper.resolve(projectDir));
     return `
 import { createRequire as __vf_createRequire } from "node:module";
 import { dirname as __vf_dirname, resolve as __vf_resolve } from "node:path";
 var __vf_builtinRequire = __vf_createRequire(${safeProjectDir});
 var __vf_builtinSet = new Set(${builtinSet});
+var __vf_projectRoot = ${safeProjectRoot};
 var __vf_cache = Object.create(null);
+function __vf_assertContained(resolved) {
+  var norm = __vf_resolve(resolved).replace(/\\\\/g, "/");
+  var root = __vf_projectRoot.replace(/\\\\/g, "/");
+  if (!norm.startsWith(root + "/") && norm !== root) {
+    throw new Error("CJS loader blocked path outside project: " + resolved);
+  }
+}
 function __vf_loadCjs(id, parentDir) {
   if (id.startsWith("node:")) return __vf_builtinRequire(id);
   if (__vf_builtinSet.has(id)) return __vf_builtinRequire(id);
@@ -91,6 +115,7 @@ function __vf_loadCjs(id, parentDir) {
         try { Deno.statSync(resolved + exts[i]); resolved += exts[i]; break; } catch {}
       }
     }
+    __vf_assertContained(resolved);
   } else {
     resolved = __vf_builtinRequire.resolve(id);
   }
@@ -171,6 +196,7 @@ export function loadHandlerModule(options) {
     return withSpan("api.loadHandlerModule", async () => {
         const { projectDir, modulePath, adapter, config } = options;
         const fs = createFileSystem();
+        validateModulePath(modulePath, projectDir);
         try {
             const module = await loadModule({ modulePath, projectDir, adapter, fs, config });
             return extractAPIRouteHandlers(module);
@@ -262,12 +288,16 @@ function createImportMapPlugin(projectDir, adapter, config) {
                 const absolutePath = pathHelper.isAbsolute(resolvedPath)
                     ? resolvedPath
                     : pathHelper.resolve(projectDir, resolvedPath);
+                if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+                    logger.error(`[API] Import map entry escapes project directory: ${args.path} -> ${absolutePath}`);
+                    return { errors: [{ text: `Import map path escapes project: ${args.path}` }] };
+                }
                 logger.debug(`Import map resolved: ${args.path} -> ${absolutePath}`);
                 return { path: absolutePath, namespace: "import-map" };
             });
             build.onLoad({ filter: /.*/, namespace: "import-map" }, wrapWithCurrentContext(async (args) => {
                 try {
-                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS);
+                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS, projectDir);
                     return {
                         contents,
                         loader: getLoaderForFile(filePath),
@@ -284,7 +314,7 @@ function createImportMapPlugin(projectDir, adapter, config) {
     };
 }
 /** Resolves relative imports through the adapter's virtual FS for remote projects. */
-function createAdapterResolvePlugin(adapter) {
+function createAdapterResolvePlugin(adapter, projectDir) {
     return {
         name: "vf-adapter-resolve",
         setup(build) {
@@ -295,6 +325,12 @@ function createAdapterResolvePlugin(adapter) {
                 if (!baseDir)
                     return undefined;
                 const absolutePath = pathHelper.resolve(baseDir, args.path);
+                if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+                    logger.error(`[API] Adapter resolve path escapes project: ${args.path} -> ${absolutePath}`);
+                    return {
+                        errors: [{ text: `Relative import escapes project: ${args.path}` }],
+                    };
+                }
                 logger.debug(`[API] Adapter resolve: ${args.path} (from ${args.importer || "stdin"}) -> ${absolutePath}`);
                 return { path: absolutePath, namespace: "vf-adapter" };
             });
@@ -305,7 +341,7 @@ function createAdapterResolvePlugin(adapter) {
             // cannot resolve the per-project adapter and all file reads fail silently.
             build.onLoad({ filter: /.*/, namespace: "vf-adapter" }, wrapWithCurrentContext(async (args) => {
                 try {
-                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS);
+                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS, projectDir);
                     return {
                         contents,
                         loader: getLoaderForFile(filePath),
@@ -323,7 +359,7 @@ function createAdapterResolvePlugin(adapter) {
 }
 function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
     return withSpan("api.loadAndTranspileModule", async () => {
-        const { filePath: resolvedPath, contents: source } = await readFileWithExtensions(adapter, modulePath, FILE_EXTENSIONS);
+        const { filePath: resolvedPath, contents: source } = await readFileWithExtensions(adapter, modulePath, FILE_EXTENSIONS, projectDir);
         if (!source) {
             throw toError(createError({
                 type: "file",
@@ -401,7 +437,7 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
             },
             plugins: [
                 createImportMapPlugin(projectDir, adapter, config),
-                createAdapterResolvePlugin(adapter),
+                createAdapterResolvePlugin(adapter, projectDir),
                 createHTTPPlugin(allowedHosts),
             ],
         });
@@ -418,9 +454,19 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
         return loadModuleFromCode(js, projectDir, fs, userDeps);
     }, { "api.modulePath": modulePath, "api.projectDir": projectDir });
 }
-async function readFileWithExtensions(adapter, basePath, extensions) {
+async function readFileWithExtensions(adapter, basePath, extensions, projectDir) {
+    const resolvedProjectDir = projectDir ? pathHelper.resolve(projectDir) : undefined;
     for (const ext of extensions) {
         const filePath = ext ? basePath + ext : basePath;
+        if (resolvedProjectDir) {
+            const resolved = pathHelper.resolve(filePath);
+            if (!isWithinDirectory(resolvedProjectDir, resolved)) {
+                throw toError(createError({
+                    type: "api",
+                    message: `[API] file path escapes project directory: ${filePath}`,
+                }));
+            }
+        }
         try {
             const contents = await adapter.fs.readFile(filePath);
             return { filePath, contents };
@@ -760,11 +806,21 @@ function extractSubpathsFromCode(code) {
  */
 async function registerVfModules(subpaths) {
     const modules = (dntShim.dntGlobalThis.__vfModules ?? {});
+    // __VERYFRONT_MODULES__ is populated by the discovery transpiler via hash
+    // imports (#veryfront/...) which resolve correctly in compiled binaries.
+    // Check it first before attempting bare specifier dynamic imports.
+    const discoveryModules = dntShim.dntGlobalThis.__VERYFRONT_MODULES__;
     for (const subpath of subpaths) {
         if (modules[subpath])
             continue;
+        const specifier = `veryfront/${subpath}`;
+        const fromDiscovery = discoveryModules?.[specifier];
+        if (fromDiscovery) {
+            modules[subpath] = fromDiscovery;
+            logger.debug(`[API] Registered module ${specifier} from discovery globals`);
+            continue;
+        }
         try {
-            const specifier = `veryfront/${subpath}`;
             modules[subpath] = await import(specifier);
             logger.debug(`[API] Registered module ${specifier} on globalThis`);
         }

package/esm/src/routing/api/openapi/path-utils.d.ts

@@ -56,25 +56,6 @@ export declare function toOpenAPIPath(pattern: string): string;
  * ```
  */
 export declare function extractPathParams(pattern: string): PathParam[];
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export declare function filePathToPattern(filePath: string, routePrefix?: string): string;
 /**
  * Generate a unique operation ID from method and path.
  *

package/esm/src/routing/api/openapi/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAyB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,GAAE,MAAW,GAAG,MAAM,CAmBpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxE"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAyB9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxE"}

package/esm/src/routing/api/openapi/path-utils.js

@@ -71,40 +71,6 @@ export function extractPathParams(pattern) {
     }
     return params;
 }
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export function filePathToPattern(filePath, routePrefix = "") {
-    let pattern = filePath
-        .replace(/\.(ts|tsx|js|jsx)$/, "")
-        .replace(/\/route$/, "")
-        .replace(/\/index$/, "");
-    if (!pattern.startsWith("/"))
-        pattern = `/${pattern}`;
-    if (routePrefix && !pattern.startsWith(routePrefix)) {
-        pattern = `${routePrefix}${pattern}`;
-    }
-    pattern = pattern.replace(/\/+/g, "/");
-    if (pattern.length > 1 && pattern.endsWith("/")) {
-        pattern = pattern.slice(0, -1);
-    }
-    return pattern;
-}
 /**
  * Generate a unique operation ID from method and path.
  *

package/esm/src/routing/api/openapi/spec-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/spec-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAmID,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/spec-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAmID,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAEpD"}

package/esm/src/routing/api/openapi/spec-generator.js

@@ -6,7 +6,7 @@
  * @module routing/api/openapi/spec-generator
  */
 import { loadHandlerModule } from "../module-loader/loader.js";
-import { OPENAPI_METADATA, } from "./types.js";
+import { getDefaultStatusDescription, OPENAPI_METADATA, } from "./types.js";
 import { extractPathParams, generateOperationId, toOpenAPIPath } from "./path-utils.js";
 import { logger as baseLogger } from "../../../utils/index.js";
 const logger = baseLogger.component("open-api");
@@ -181,21 +181,3 @@ function toYaml(obj, indent) {
     }
     return String(obj);
 }
-function getDefaultStatusDescription(statusCode) {
-    const descriptions = {
-        200: "Successful response",
-        201: "Resource created",
-        204: "No content",
-        400: "Bad request",
-        401: "Unauthorized",
-        403: "Forbidden",
-        404: "Not found",
-        409: "Conflict",
-        422: "Unprocessable entity",
-        429: "Too many requests",
-        500: "Internal server error",
-        502: "Bad gateway",
-        503: "Service unavailable",
-    };
-    return descriptions[statusCode] || `Response with status ${statusCode}`;
-}

package/esm/src/routing/api/openapi/types.d.ts

@@ -99,4 +99,5 @@ export interface OpenAPIResponse {
         };
     };
 }
+export declare function getDefaultStatusDescription(statusCode: number): string;
 //# sourceMappingURL=types.d.ts.map

package/esm/src/routing/api/openapi/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,eAAO,MAAM,gBAAgB,eAA2C,CAAC;AAEzE,MAAM,WAAW,kBAAkB,CACjC,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAC3C,MAAM,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAC1C,KAAK,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;IAEzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CACf,MAAM,EACN,CAAC,CAAC,UAAU,GAAG;QAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAC9D,CAAC;IACF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE;YACR,kBAAkB,CAAC,EAAE;gBAAE,MAAM,EAAE,UAAU,CAAA;aAAE,CAAC;SAC7C,CAAC;KACH,CACF,CAAC;CACH;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,CAAC,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,kBAAkB,CAAC,EAAE;YAAE,MAAM,EAAE,UAAU,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,kBAAkB,CAAC,EAAE;YAAE,MAAM,EAAE,UAAU,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,eAAO,MAAM,gBAAgB,eAA2C,CAAC;AAEzE,MAAM,WAAW,kBAAkB,CACjC,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAC3C,MAAM,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAC1C,KAAK,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;IAEzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CACf,MAAM,EACN,CAAC,CAAC,UAAU,GAAG;QAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAC9D,CAAC;IACF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE;YACR,kBAAkB,CAAC,EAAE;gBAAE,MAAM,EAAE,UAAU,CAAA;aAAE,CAAC;SAC7C,CAAC;KACH,CACF,CAAC;CACH;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,CAAC,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,kBAAkB,CAAC,EAAE;YAAE,MAAM,EAAE,UAAU,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,kBAAkB,CAAC,EAAE;YAAE,MAAM,EAAE,UAAU,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAkBD,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtE"}

package/esm/src/routing/api/openapi/types.js

@@ -1 +1,19 @@
 export const OPENAPI_METADATA = Symbol.for("veryfront.openapi.metadata");
+const STATUS_DESCRIPTIONS = {
+    200: "Successful response",
+    201: "Resource created",
+    204: "No content",
+    400: "Bad request",
+    401: "Unauthorized",
+    403: "Forbidden",
+    404: "Not found",
+    409: "Conflict",
+    422: "Unprocessable entity",
+    429: "Too many requests",
+    500: "Internal server error",
+    502: "Bad gateway",
+    503: "Service unavailable",
+};
+export function getDefaultStatusDescription(statusCode) {
+    return STATUS_DESCRIPTIONS[statusCode] ?? `Response with status ${statusCode}`;
+}

package/esm/src/sandbox/sandbox.d.ts

@@ -31,6 +31,7 @@ export declare class Sandbox {
     private authToken;
     private apiUrl;
     private constructor();
+    private static resolveApiUrl;
     /** Create a new sandbox session. Claims a warm pod or creates a new one. */
     static create(options: SandboxOptions): Promise<Sandbox>;
     /** Reconnect to an existing sandbox session. */

package/esm/src/sandbox/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8FAA8F;AAC9F,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAJhB,OAAO;IAOP,4EAA4E;WAC/D,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B9D,gDAAgD;WACnC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;mBAmBlD,YAAY;IA0BjC,wEAAwE;IAClE,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsB1D,6DAA6D;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC,eAAe,CAAC;IAsCtE,8CAA8C;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAe7C,4CAA4C;IACtC,UAAU,CACd,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAehB,gDAAgD;IAC1C,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC,uDAAuD;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,oCAAoC;IACpC,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8FAA8F;AAC9F,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAJhB,OAAO;IAOP,OAAO,CAAC,MAAM,CAAC,aAAa;IAQ5B,4EAA4E;WAC/D,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAyB9D,gDAAgD;WACnC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;mBAelD,YAAY;IA0BjC,wEAAwE;IAClE,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsB1D,6DAA6D;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC,eAAe,CAAC;IAsCtE,8CAA8C;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAe7C,4CAA4C;IACtC,UAAU,CACd,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAehB,gDAAgD;IAC1C,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC,uDAAuD;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,oCAAoC;IACpC,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF"}

package/esm/src/sandbox/sandbox.js

@@ -20,13 +20,16 @@ export class Sandbox {
         this.authToken = authToken;
         this.apiUrl = apiUrl;
     }
-    /** Create a new sandbox session. Claims a warm pod or creates a new one. */
-    static async create(options) {
-        const apiUrl = options.apiUrl ||
+    static resolveApiUrl(options) {
+        return options.apiUrl ||
             (typeof dntShim.Deno !== "undefined"
                 ? dntShim.Deno.env.get("VERYFRONT_API_URL")
                 : process.env.VERYFRONT_API_URL) ||
             "https://api.veryfront.com";
+    }
+    /** Create a new sandbox session. Claims a warm pod or creates a new one. */
+    static async create(options) {
+        const apiUrl = Sandbox.resolveApiUrl(options);
         const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions`, {
             method: "POST",
             headers: {
@@ -46,11 +49,7 @@ export class Sandbox {
     }
     /** Reconnect to an existing sandbox session. */
     static async get(id, options) {
-        const apiUrl = options.apiUrl ||
-            (typeof dntShim.Deno !== "undefined"
-                ? dntShim.Deno.env.get("VERYFRONT_API_URL")
-                : process.env.VERYFRONT_API_URL) ||
-            "https://api.veryfront.com";
+        const apiUrl = Sandbox.resolveApiUrl(options);
         const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
             headers: { Authorization: `Bearer ${options.authToken}` },
         });

package/esm/src/security/http/cors/constants.d.ts

@@ -1,8 +1,6 @@
-import { DEV_LOCALHOST_ORIGINS } from "../../../config/index.js";
 export declare const DEFAULT_METHODS: string[];
 export declare const DEFAULT_HEADERS: string[];
 export declare const DEFAULT_MAX_AGE = 86400;
-export { DEV_LOCALHOST_ORIGINS };
 export declare const HTTP_NO_CONTENT = 204;
 export declare const HTTP_FORBIDDEN = 403;
 //# sourceMappingURL=constants.d.ts.map

package/esm/src/security/http/cors/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/cors/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,eAAO,MAAM,eAAe,UAAuD,CAAC;AACpF,eAAO,MAAM,eAAe,UAAoC,CAAC;AACjE,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,cAAc,MAAM,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/cors/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,UAAuD,CAAC;AACpF,eAAO,MAAM,eAAe,UAAoC,CAAC;AACjE,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,cAAc,MAAM,CAAC"}

package/esm/src/security/http/cors/constants.js

@@ -1,7 +1,5 @@
-import { DEV_LOCALHOST_ORIGINS } from "../../../config/index.js";
 export const DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 export const DEFAULT_HEADERS = ["Content-Type", "Authorization"];
 export const DEFAULT_MAX_AGE = 86400;
-export { DEV_LOCALHOST_ORIGINS };
 export const HTTP_NO_CONTENT = 204;
 export const HTTP_FORBIDDEN = 403;

package/esm/src/security/http/response/index.d.ts

@@ -3,10 +3,9 @@
  *
  * @module security/http/response
  */
-export type { CacheStrategy, CORSConfig, ResponseBuilderConfig, SecurityConfig } from "./types.js";
-export { CACHE_DURATIONS, CONTENT_TYPES } from "./constants.js";
+export type { CacheStrategy, ResponseBuilderConfig } from "./types.js";
+export { CACHE_DURATIONS } from "./constants.js";
 export { createResponseBuilder, ResponseBuilder } from "./builder.js";
-export { applyCORSHeaders, shouldApplyCORS } from "../cors/index.js";
-export { applySecurityHeaders, buildCSP, generateNonce, getSecurityHeader, } from "./security-handler.js";
+export { applySecurityHeaders, generateNonce, getSecurityHeader } from "./security-handler.js";
 export { buildCacheControl } from "./cache-handler.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/security/http/response/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/esm/src/security/http/response/index.js

@@ -3,8 +3,7 @@
  *
  * @module security/http/response
  */
-export { CACHE_DURATIONS, CONTENT_TYPES } from "./constants.js";
+export { CACHE_DURATIONS } from "./constants.js";
 export { createResponseBuilder, ResponseBuilder } from "./builder.js";
-export { applyCORSHeaders, shouldApplyCORS } from "../cors/index.js";
-export { applySecurityHeaders, buildCSP, generateNonce, getSecurityHeader, } from "./security-handler.js";
+export { applySecurityHeaders, generateNonce, getSecurityHeader } from "./security-handler.js";
 export { buildCacheControl } from "./cache-handler.js";

package/esm/src/server/context/enriched-context.d.ts

@@ -54,13 +54,5 @@ export interface BuildEnrichedContextOptions {
     debug?: boolean;
 }
 export declare function buildEnrichedContext(options: BuildEnrichedContextOptions): EnrichedContext;
-export declare function toRequestContext(enriched: EnrichedContext): {
-    token: string;
-    slug: string;
-    branch: string | null;
-    mode: Environment;
-};
-export declare function shouldEnableCacheFromEnriched(enriched: EnrichedContext): boolean;
-export declare function shouldUseNoCacheHeadersFromEnriched(enriched: EnrichedContext): boolean;
 export declare function shouldUseNoCacheHeadersFromHandler(ctx: HandlerContext): boolean;
 //# sourceMappingURL=enriched-context.d.ts.map

package/esm/src/server/context/enriched-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enriched-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/enriched-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,YAAY,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,YAAY,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IAEjB,2GAA2G;IAC3G,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IAEpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe,CAoC1F;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;CACnB,CAOA;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEhF;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAK/E"}
+{"version":3,"file":"enriched-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/enriched-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,YAAY,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,YAAY,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IAEjB,2GAA2G;IAC3G,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IAEpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe,CAoC1F;AAMD,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAK/E"}

package/esm/src/server/context/enriched-context.js

@@ -29,18 +29,7 @@ export function buildEnrichedContext(options) {
         createdAt: Date.now(),
     };
 }
-export function toRequestContext(enriched) {
-    return {
-        token: enriched.token,
-        slug: enriched.projectSlug,
-        branch: enriched.branch,
-        mode: enriched.environment,
-    };
-}
-export function shouldEnableCacheFromEnriched(enriched) {
-    return !enriched.isLocalProject && enriched.environment !== "preview";
-}
-export function shouldUseNoCacheHeadersFromEnriched(enriched) {
+function shouldUseNoCacheHeadersFromEnriched(enriched) {
     return enriched.isLocalProject || enriched.environment === "preview";
 }
 export function shouldUseNoCacheHeadersFromHandler(ctx) {

package/esm/src/server/dev-server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAclD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkCvD,qBAAa,SAAS;IAiBR,OAAO,CAAC,OAAO;IAhB3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,CAAsD;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,iBAAiB,CAAC,CAAa;IACvC,OAAO,CAAC,qBAAqB,CAAC,CAAa;IAC3C,OAAO,CAAC,8BAA8B,CAAC,CAAa;gBAEhC,OAAO,EAAE,gBAAgB;IAQ7C,OAAO,CAAC,OAAO;YAID,YAAY;IAWpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqL5B,sEAAsE;IACtE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAGjE;IAED,OAAO,CAAC,oBAAoB;YAcd,cAAc;YAiBd,yBAAyB;YAoBzB,uBAAuB;YA4BvB,wBAAwB;IAkBtC,OAAO,CAAC,kBAAkB;IAuBpB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAarB,iBAAiB;IAoC/B,qBAAqB,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI;IAIlE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAclD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkCvD,qBAAa,SAAS;IAiBR,OAAO,CAAC,OAAO;IAhB3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,CAAsD;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,iBAAiB,CAAC,CAAa;IACvC,OAAO,CAAC,qBAAqB,CAAC,CAAa;IAC3C,OAAO,CAAC,8BAA8B,CAAC,CAAa;gBAEhC,OAAO,EAAE,gBAAgB;IAQ7C,OAAO,CAAC,OAAO;YAID,YAAY;IAWpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqL5B,sEAAsE;IACtE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAGjE;IAED,OAAO,CAAC,oBAAoB;YAgBd,cAAc;YAkBd,yBAAyB;YAoBzB,uBAAuB;YA4BvB,wBAAwB;IAkBtC,OAAO,CAAC,kBAAkB;IAuBpB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAerB,iBAAiB;IAsC/B,qBAAqB,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI;IAIlE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B"}

package/esm/src/server/dev-server/server.js

@@ -215,10 +215,12 @@ export class DevServer {
     }
     buildDiscoveryConfig() {
         const ai = this.appConfig?.ai;
+        const skillDiscoveryEnabled = ai?.skills?.discovery?.enabled ?? true;
         return {
             baseDir: this.options.projectDir,
             toolDirs: ai?.tools?.discovery?.paths ?? ["tools"],
             agentDirs: ai?.agents?.discovery?.paths ?? ["agents"],
+            skillDirs: skillDiscoveryEnabled ? (ai?.skills?.discovery?.paths ?? ["skills"]) : [],
             resourceDirs: ["resources"],
             promptDirs: ["prompts"],
             workflowDirs: ["workflows"],
@@ -230,11 +232,12 @@ export class DevServer {
         try {
             const config = this.buildDiscoveryConfig();
             const result = await discoverAll(config);
-            const total = result.tools.size + result.agents.size + result.workflows.size +
-                result.prompts.size + result.resources.size;
+            const total = result.tools.size + result.agents.size + result.skills.size +
+                result.workflows.size + result.prompts.size + result.resources.size;
             if (total > 0) {
                 logger.debug(`[Discovery] Registered ${result.tools.size} tools, ${result.agents.size} agents, ` +
-                    `${result.workflows.size} workflows, ${result.prompts.size} prompts, ${result.resources.size} resources`);
+                    `${result.skills.size} skills, ${result.workflows.size} workflows, ` +
+                    `${result.prompts.size} prompts, ${result.resources.size} resources`);
             }
         }
         catch (error) {
@@ -323,7 +326,9 @@ export class DevServer {
             clearTranspileCache();
             const config = this.buildDiscoveryConfig();
             const result = await discoverAll(config);
-            logger.info(`[HMR] Re-discovered AI primitives: ${result.tools.size} tools, ${result.agents.size} agents, ${result.workflows.size} workflows`);
+            logger.info(`[HMR] Re-discovered: ${result.tools.size} tools, ${result.agents.size} agents, ` +
+                `${result.skills.size} skills, ${result.workflows.size} workflows, ` +
+                `${result.prompts.size} prompts, ${result.resources.size} resources`);
         }
         catch (error) {
             hmrLog.warn("AI re-discovery failed:", error);
@@ -338,9 +343,11 @@ export class DevServer {
         const routeDiscovery = new RouteDiscovery(this.options.projectDir, this.adapter, this.router, this.appConfig);
         const debounceMs = this.options.fileWatcherDebounceMs ?? 100;
         const ai = this.appConfig?.ai;
+        const skillDiscoveryEnabled = ai?.skills?.discovery?.enabled ?? true;
         const aiDirNames = [
             ...(ai?.tools?.discovery?.paths ?? ["tools"]),
             ...(ai?.agents?.discovery?.paths ?? ["agents"]),
+            ...(skillDiscoveryEnabled ? (ai?.skills?.discovery?.paths ?? ["skills"]) : []),
             "resources",
             "prompts",
             "workflows",

package/esm/src/server/dev-ui/manifest.d.ts

@@ -1,30 +1,30 @@
 declare namespace _default {
     let version: number;
     let files: {
-        "projects/index.tsx": string;
-        "projects/App.tsx": string;
-        "projects/components/ProjectCard.tsx": string;
-        "projects/components/Header.tsx": string;
-        "projects/components/EmptyState.tsx": string;
-        "projects/components/SearchInput.tsx": string;
-        "shared/mount-react-app.tsx": string;
-        "dashboard/index.tsx": string;
-        "dashboard/App.tsx": string;
-        "dashboard/components/MCPTab.tsx": string;
-        "dashboard/components/AITab.tsx": string;
-        "dashboard/components/FilesTab.tsx": string;
-        "dashboard/components/TabNav.tsx": string;
-        "dashboard/components/Card.tsx": string;
-        "dashboard/components/RuntimeTab.tsx": string;
+        "dashboard/components/ErrorsTab.tsx": string;
         "dashboard/components/shared.tsx": string;
-        "dashboard/components/APITab.tsx": string;
         "dashboard/components/ServerTab.tsx": string;
-        "dashboard/components/ConfigTab.tsx": string;
-        "dashboard/components/ErrorsTab.tsx": string;
-        "dashboard/components/WorkflowsTab.tsx": string;
-        "dashboard/components/Header.tsx": string;
+        "dashboard/components/Card.tsx": string;
+        "dashboard/components/RuntimeTab.tsx": string;
         "dashboard/components/Sidebar.tsx": string;
+        "dashboard/components/AITab.tsx": string;
+        "dashboard/components/MCPTab.tsx": string;
+        "dashboard/components/WorkflowsTab.tsx": string;
+        "dashboard/components/TabNav.tsx": string;
         "dashboard/components/AgentsTab.tsx": string;
+        "dashboard/components/Header.tsx": string;
+        "dashboard/components/FilesTab.tsx": string;
+        "dashboard/components/ConfigTab.tsx": string;
+        "dashboard/components/APITab.tsx": string;
+        "dashboard/App.tsx": string;
+        "dashboard/index.tsx": string;
+        "projects/components/ProjectCard.tsx": string;
+        "projects/components/SearchInput.tsx": string;
+        "projects/components/EmptyState.tsx": string;
+        "projects/components/Header.tsx": string;
+        "projects/App.tsx": string;
+        "projects/index.tsx": string;
+        "shared/mount-react-app.tsx": string;
     };
 }
 export default _default;