veryfront 0.1.48 → 0.1.49

package/src/src/react/components/ai/chat/composition/message.tsx

@@ -31,6 +31,7 @@ import { MessageActions as ActionsImpl } from "../components/message-actions.js"
 import { MessageFeedback as FeedbackImpl } from "../components/message-feedback.js";
 import { BranchPicker as BranchPickerImpl } from "../components/branch-picker.js";
 import { ReasoningCard } from "../components/reasoning.js";
+import { SkillBadge } from "../components/skill-badge.js";
 import { ToolCallCard } from "../components/tool-ui.js";
 import { StepIndicator } from "../components/step-indicator.js";
 import { Sources as SourcesImpl } from "../components/sources.js";
@@ -40,6 +41,7 @@ import {
   extractSourcesFromParts,
   getTextContent,
   groupPartsInOrder,
+  isSkillToolPart,
 } from "../utils/message-parts.js";
 
 // ---------------------------------------------------------------------------
@@ -241,9 +243,14 @@ function MessageContent({
             )
             : null;
         }
+        const isSkill = isSkillToolPart(group.tool);
         return (
-          <div key={group.tool.toolCallId} className="my-3">
-            {renderTool ? renderTool(group.tool) : <ToolCallCard tool={group.tool} />}
+          <div key={group.tool.toolCallId} className={isSkill ? "my-2" : "my-3"}>
+            {renderTool
+              ? renderTool(group.tool)
+              : isSkill
+              ? <SkillBadge tool={group.tool} />
+              : <ToolCallCard tool={group.tool} />}
           </div>
         );
       })}

package/src/src/react/components/ai/chat/index.tsx

@@ -98,6 +98,7 @@ export { MessageActions, type MessageActionsProps } from "./components/message-a
 export { MessageEditForm, type MessageEditFormProps } from "./components/message-edit-form.js";
 export { BranchPicker, type BranchPickerProps } from "./components/branch-picker.js";
 export { DropZoneOverlay, type DropZoneOverlayProps } from "./components/drop-zone.js";
+export { SkillBadge, type SkillBadgeProps } from "./components/skill-badge.js";
 export { ToolCallCard, ToolStatusBadge } from "./components/tool-ui.js";
 export { InferenceBadge, type InferenceBadgeProps } from "./components/inference-badge.js";
 export { UpgradeCTA, type UpgradeCTAProps } from "./components/upgrade-cta.js";
@@ -142,6 +143,7 @@ export {
   getTextContent,
   groupPartsInOrder,
   isReasoningPart,
+  isSkillToolPart,
   isToolPart,
   type PartGroup,
 } from "./utils/message-parts.js";
@@ -218,6 +220,8 @@ export interface ChatProps {
   showMessageActions?: boolean;
   models?: ModelOption[];
   model?: string;
+  /** The actual resolved model after auto-upgrade (used for avatar display) */
+  activeModel?: string;
   onModelChange?: (model: string) => void;
   inferenceMode?: InferenceMode;
   browserStatus?: BrowserInferenceStatus | null;
@@ -282,6 +286,7 @@ export const Chat = React.forwardRef<HTMLDivElement, ChatProps>(function Chat(
     showMessageActions = true,
     models,
     model,
+    activeModel,
     onModelChange,
     inferenceMode,
     browserStatus,
@@ -445,7 +450,7 @@ export const Chat = React.forwardRef<HTMLDivElement, ChatProps>(function Chat(
             theme={theme}
             renderMessage={renderMessage}
             renderTool={renderTool}
-            model={model}
+            model={activeModel || model}
             showMessageActions={showMessageActions}
             showSources={showSources}
             showSteps={showSteps}

package/src/src/react/components/ai/chat/utils/message-parts.ts

@@ -28,6 +28,17 @@ export function isToolPart(part: UIMessagePart): part is ToolUIPart | DynamicToo
   return part.type.startsWith("tool-") && part.type !== "tool-result";
 }
 
+const SKILL_TOOL_NAMES: ReadonlySet<string> = new Set([
+  "load-skill",
+  "load-skill-reference",
+  "execute-skill-script",
+]);
+
+/** Check if a tool part is a skill-related tool (load-skill, load-skill-reference, execute-skill-script) */
+export function isSkillToolPart(tool: ToolUIPart | DynamicToolUIPart): boolean {
+  return SKILL_TOOL_NAMES.has(tool.toolName);
+}
+
 /** Check if a part is a reasoning part */
 export function isReasoningPart(
   part: UIMessagePart,

package/src/src/react/components/ai/chat-with-sidebar.tsx

@@ -24,6 +24,7 @@ export interface ChatWithSidebarChatController {
   isLoading?: ChatProps["isLoading"];
   error?: ChatProps["error"];
   model?: ChatProps["model"];
+  activeModel?: ChatProps["activeModel"];
   onModelChange?: ChatProps["onModelChange"];
   inferenceMode?: ChatProps["inferenceMode"];
   browserStatus?: ChatProps["browserStatus"];
@@ -170,6 +171,7 @@ export const ChatWithSidebar = React.forwardRef<HTMLDivElement, ChatWithSidebarP
       showScrollButton: features?.scrollButton,
       showMessageActions: features?.messageActions,
       models: models?.options,
+      activeModel: chat.activeModel,
       inferenceMode: chat.inferenceMode,
       browserStatus: chat.browserStatus,
       showSources: features?.sources,

package/src/src/react/components/ai/chat.tsx

@@ -84,6 +84,7 @@ export {
   InlineCitation,
   type InlineCitationProps,
   isReasoningPart,
+  isSkillToolPart,
   isToolPart,
   Loader,
   MessageActions,
@@ -99,6 +100,8 @@ export {
   ReasoningCard,
   RichCodeBlock,
   Shimmer,
+  SkillBadge,
+  type SkillBadgeProps,
   type Source,
   Sources,
   type SourcesProps,

package/src/src/rendering/cache/index.ts

@@ -10,8 +10,15 @@ export {
   type CacheLookupResult,
 } from "./cache-coordinator.js";
 export type { CachePayload, CacheStore } from "./types.js";
-export { APICacheStore, type APICacheStoreOptions } from "./stores/index.js";
-export { FilesystemCacheStore, type FilesystemCacheStoreOptions } from "./stores/index.js";
-export { KVCacheStore, type KVCacheStoreOptions } from "./stores/index.js";
-export { MemoryCacheStore, type MemoryCacheStoreOptions } from "./stores/index.js";
-export { RedisCacheStore, type RedisCacheStoreOptions } from "./stores/index.js";
+export {
+  APICacheStore,
+  type APICacheStoreOptions,
+  FilesystemCacheStore,
+  type FilesystemCacheStoreOptions,
+  KVCacheStore,
+  type KVCacheStoreOptions,
+  MemoryCacheStore,
+  type MemoryCacheStoreOptions,
+  RedisCacheStore,
+  type RedisCacheStoreOptions,
+} from "./stores/index.js";

package/src/src/rendering/orchestrator/pipeline.ts

@@ -30,7 +30,7 @@ import { join } from "../../platform/compat/path/index.js";
 import type { MdxBundle, PageBundle } from "../../types/index.js";
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import { isExtendedFSAdapter } from "../../platform/adapters/fs/wrapper.js";
-import type { CacheCoordinator } from "../cache/cache-coordinator.js";
+import type { CacheLookupResult } from "../cache/cache-coordinator.js";
 import type { PageRenderer } from "../page-renderer.js";
 import type { PageResolver } from "../page-resolution/index.js";
 import type { LayoutOrchestrator } from "./layout.js";
@@ -77,9 +77,19 @@ const resolvePageDataLog = logger.component("resolve-page-data");
 // Re-export test helper for backward compatibility
 export { __injectCssCacheForTests } from "./css-cache.js";
 
+/**
+ * Minimal cache interface used by RenderPipeline.
+ * Decoupled from the concrete CacheCoordinator class so that Renderer
+ * can supply a context-aware adapter without an unsafe `as any` cast.
+ */
+export interface PipelineCacheCoordinator {
+  checkCache(slug: string, cacheKey?: string): Promise<CacheLookupResult>;
+  persistResult(result: RenderResult, slug: string, cacheKey?: string): Promise<void>;
+}
+
 export interface RenderPipelineConfig {
   pageResolver: PageResolver;
-  cacheCoordinator: CacheCoordinator;
+  cacheCoordinator: PipelineCacheCoordinator;
   pageRenderer: PageRenderer;
   layoutOrchestrator: LayoutOrchestrator;
   ssrOrchestrator: SSROrchestrator;

package/src/src/rendering/renderer.ts

@@ -518,7 +518,7 @@ export class Renderer {
 
     const pipeline = new RenderPipeline({
       pageResolver,
-      cacheCoordinator: pipelineCacheCoordinator as any,
+      cacheCoordinator: pipelineCacheCoordinator,
       pageRenderer,
       layoutOrchestrator,
       ssrOrchestrator,

package/src/src/rendering/shared/context-aware-cache.ts

@@ -70,11 +70,6 @@ export class ContextAwareCacheCoordinator {
           await this.store.delete(cacheKey);
 
           logger.debug("Cache expired", {
-            slug,
-            projectId: ctx.projectId,
-          });
-
-          logger.debug("Cache miss", {
             slug,
             cacheKey,
             projectId: ctx.projectId,

package/src/src/repositories/schemas/index.ts

@@ -9,8 +9,6 @@ export {
   CacheRepositoryOptionsSchema,
   type CacheStats,
   CacheStatsSchema,
-  type FileSystemRepositoryOptions,
-  FileSystemRepositoryOptionsSchema,
   type RepositoryContext,
   RepositoryContextSchema,
 } from "./repository.schema.js";

package/src/src/repositories/schemas/repository.schema.ts

@@ -21,22 +21,7 @@ export const CacheRepositoryOptionsSchema = z.object({
   maxEntries: z.number().int().positive().optional(),
 });
 
-export const FileSystemRepositoryOptionsSchema = z.object({
-  baseDir: z.string(),
-  securityContext: z
-    .enum([
-      "user-input",
-      "static-serving",
-      "build",
-      "internal",
-      "route-discovery",
-      "module-loading",
-    ])
-    .optional(),
-});
-
 // Inferred types
 export type RepositoryContext = z.infer<typeof RepositoryContextSchema>;
 export type CacheStats = z.infer<typeof CacheStatsSchema>;
 export type CacheRepositoryOptions = z.infer<typeof CacheRepositoryOptionsSchema>;
-export type FileSystemRepositoryOptions = z.infer<typeof FileSystemRepositoryOptionsSchema>;

package/src/src/repositories/types.ts

@@ -1,12 +1,7 @@
 import type { DirEntry, FileInfo } from "../platform/adapters/base.js";
 
 // Re-export schema-based types
-export type {
-  CacheRepositoryOptions,
-  CacheStats,
-  FileSystemRepositoryOptions,
-  RepositoryContext,
-} from "./schemas/index.js";
+export type { CacheRepositoryOptions, CacheStats, RepositoryContext } from "./schemas/index.js";
 
 // Import for use in interface definitions
 import type { CacheStats, RepositoryContext } from "./schemas/index.js";

package/src/src/routing/api/module-loader/loader.ts

@@ -16,9 +16,28 @@ import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { isCompiledBinary } from "../../../utils/index.js";
 import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/multi-project-adapter.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
 
 const logger = serverLogger.component("api");
 
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+function validateModulePath(modulePath: string, projectDir: string): void {
+  const resolved = pathHelper.resolve(modulePath);
+  const resolvedProject = pathHelper.resolve(projectDir);
+
+  if (!isWithinDirectory(resolvedProject, resolved)) {
+    throw toError(
+      createError({
+        type: "api",
+        message: `[API] module path escapes project directory: ${modulePath}`,
+      }),
+    );
+  }
+}
+
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
 const NODE_BUILTINS = [
   "assert",
@@ -82,13 +101,22 @@ async function readProjectDependencies(
 function generateCompiledBinaryRequireShim(projectDir: string): string {
   const builtinSet = JSON.stringify(NODE_BUILTINS);
   const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+  const safeProjectRoot = JSON.stringify(pathHelper.resolve(projectDir));
 
   return `
 import { createRequire as __vf_createRequire } from "node:module";
 import { dirname as __vf_dirname, resolve as __vf_resolve } from "node:path";
 var __vf_builtinRequire = __vf_createRequire(${safeProjectDir});
 var __vf_builtinSet = new Set(${builtinSet});
+var __vf_projectRoot = ${safeProjectRoot};
 var __vf_cache = Object.create(null);
+function __vf_assertContained(resolved) {
+  var norm = __vf_resolve(resolved).replace(/\\\\/g, "/");
+  var root = __vf_projectRoot.replace(/\\\\/g, "/");
+  if (!norm.startsWith(root + "/") && norm !== root) {
+    throw new Error("CJS loader blocked path outside project: " + resolved);
+  }
+}
 function __vf_loadCjs(id, parentDir) {
   if (id.startsWith("node:")) return __vf_builtinRequire(id);
   if (__vf_builtinSet.has(id)) return __vf_builtinRequire(id);
@@ -103,6 +131,7 @@ function __vf_loadCjs(id, parentDir) {
         try { Deno.statSync(resolved + exts[i]); resolved += exts[i]; break; } catch {}
       }
     }
+    __vf_assertContained(resolved);
   } else {
     resolved = __vf_builtinRequire.resolve(id);
   }
@@ -189,6 +218,8 @@ export function loadHandlerModule(options: LoadModuleOptions): Promise<APIRoute
       const { projectDir, modulePath, adapter, config } = options;
       const fs = createFileSystem();
 
+      validateModulePath(modulePath, projectDir);
+
       try {
         const module = await loadModule({ modulePath, projectDir, adapter, fs, config });
         return extractAPIRouteHandlers(module);
@@ -312,6 +343,13 @@ function createImportMapPlugin(
           ? resolvedPath
           : pathHelper.resolve(projectDir, resolvedPath);
 
+        if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+          logger.error(
+            `[API] Import map entry escapes project directory: ${args.path} -> ${absolutePath}`,
+          );
+          return { errors: [{ text: `Import map path escapes project: ${args.path}` }] };
+        }
+
         logger.debug(`Import map resolved: ${args.path} -> ${absolutePath}`);
 
         return { path: absolutePath, namespace: "import-map" };
@@ -325,6 +363,7 @@ function createImportMapPlugin(
               adapter,
               args.path,
               FILE_EXTENSIONS,
+              projectDir,
             );
 
             return {
@@ -344,7 +383,10 @@ function createImportMapPlugin(
 }
 
 /** Resolves relative imports through the adapter's virtual FS for remote projects. */
-function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
+function createAdapterResolvePlugin(
+  adapter: RuntimeAdapter,
+  projectDir: string,
+): Plugin {
   return {
     name: "vf-adapter-resolve",
     setup(build) {
@@ -355,6 +397,16 @@ function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
         if (!baseDir) return undefined;
 
         const absolutePath = pathHelper.resolve(baseDir, args.path);
+
+        if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+          logger.error(
+            `[API] Adapter resolve path escapes project: ${args.path} -> ${absolutePath}`,
+          );
+          return {
+            errors: [{ text: `Relative import escapes project: ${args.path}` }],
+          };
+        }
+
         logger.debug(
           `[API] Adapter resolve: ${args.path} (from ${
             args.importer || "stdin"
@@ -376,6 +428,7 @@ function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
               adapter,
               args.path,
               FILE_EXTENSIONS,
+              projectDir,
             );
 
             return {
@@ -408,6 +461,7 @@ function loadAndTranspileModule(
         adapter,
         modulePath,
         FILE_EXTENSIONS,
+        projectDir,
       );
 
       if (!source) {
@@ -495,7 +549,7 @@ function loadAndTranspileModule(
         },
         plugins: [
           createImportMapPlugin(projectDir, adapter, config),
-          createAdapterResolvePlugin(adapter),
+          createAdapterResolvePlugin(adapter, projectDir),
           createHTTPPlugin(allowedHosts),
         ],
       });
@@ -524,9 +578,25 @@ async function readFileWithExtensions(
   adapter: RuntimeAdapter,
   basePath: string,
   extensions: string[],
+  projectDir?: string,
 ): Promise<{ filePath: string; contents: string }> {
+  const resolvedProjectDir = projectDir ? pathHelper.resolve(projectDir) : undefined;
+
   for (const ext of extensions) {
     const filePath = ext ? basePath + ext : basePath;
+
+    if (resolvedProjectDir) {
+      const resolved = pathHelper.resolve(filePath);
+      if (!isWithinDirectory(resolvedProjectDir, resolved)) {
+        throw toError(
+          createError({
+            type: "api",
+            message: `[API] file path escapes project directory: ${filePath}`,
+          }),
+        );
+      }
+    }
+
     try {
       const contents = await adapter.fs.readFile(filePath);
       return { filePath, contents };
@@ -974,11 +1044,26 @@ async function registerVfModules(subpaths: Set<string>): Promise<void> {
     Record<string, unknown>
   >;
 
+  // __VERYFRONT_MODULES__ is populated by the discovery transpiler via hash
+  // imports (#veryfront/...) which resolve correctly in compiled binaries.
+  // Check it first before attempting bare specifier dynamic imports.
+  const discoveryModules = (dntShim.dntGlobalThis as Record<string, unknown>).__VERYFRONT_MODULES__ as
+    | Record<string, Record<string, unknown>>
+    | undefined;
+
   for (const subpath of subpaths) {
     if (modules[subpath]) continue;
 
+    const specifier = `veryfront/${subpath}`;
+
+    const fromDiscovery = discoveryModules?.[specifier];
+    if (fromDiscovery) {
+      modules[subpath] = fromDiscovery;
+      logger.debug(`[API] Registered module ${specifier} from discovery globals`);
+      continue;
+    }
+
     try {
-      const specifier = `veryfront/${subpath}`;
       modules[subpath] = await import(specifier) as Record<string, unknown>;
       logger.debug(`[API] Registered module ${specifier} on globalThis`);
     } catch (e) {

package/src/src/routing/api/openapi/path-utils.ts

@@ -97,45 +97,6 @@ export function extractPathParams(pattern: string): PathParam[] {
   return params;
 }
 
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export function filePathToPattern(filePath: string, routePrefix: string = ""): string {
-  let pattern = filePath
-    .replace(/\.(ts|tsx|js|jsx)$/, "")
-    .replace(/\/route$/, "")
-    .replace(/\/index$/, "");
-
-  if (!pattern.startsWith("/")) pattern = `/${pattern}`;
-
-  if (routePrefix && !pattern.startsWith(routePrefix)) {
-    pattern = `${routePrefix}${pattern}`;
-  }
-
-  pattern = pattern.replace(/\/+/g, "/");
-
-  if (pattern.length > 1 && pattern.endsWith("/")) {
-    pattern = pattern.slice(0, -1);
-  }
-
-  return pattern;
-}
-
 /**
  * Generate a unique operation ID from method and path.
  *

package/src/src/routing/api/openapi/spec-generator.ts

@@ -11,6 +11,7 @@ import type { VeryfrontConfig } from "../../../config/index.js";
 import type { DynamicRouter, RouteEntry } from "../api-route-matcher.js";
 import { loadHandlerModule } from "../module-loader/loader.js";
 import {
+  getDefaultStatusDescription,
   OPENAPI_METADATA,
   type OpenAPIOperation,
   type OpenAPIParameter,
@@ -261,23 +262,3 @@ function toYaml(obj: unknown, indent: number): string {
 
   return String(obj);
 }
-
-function getDefaultStatusDescription(statusCode: number): string {
-  const descriptions: Record<number, string> = {
-    200: "Successful response",
-    201: "Resource created",
-    204: "No content",
-    400: "Bad request",
-    401: "Unauthorized",
-    403: "Forbidden",
-    404: "Not found",
-    409: "Conflict",
-    422: "Unprocessable entity",
-    429: "Too many requests",
-    500: "Internal server error",
-    502: "Bad gateway",
-    503: "Service unavailable",
-  };
-
-  return descriptions[statusCode] || `Response with status ${statusCode}`;
-}

package/src/src/routing/api/openapi/types.ts

@@ -113,3 +113,23 @@ export interface OpenAPIResponse {
     "application/json"?: { schema: JsonSchema };
   };
 }
+
+const STATUS_DESCRIPTIONS: Record<number, string> = {
+  200: "Successful response",
+  201: "Resource created",
+  204: "No content",
+  400: "Bad request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not found",
+  409: "Conflict",
+  422: "Unprocessable entity",
+  429: "Too many requests",
+  500: "Internal server error",
+  502: "Bad gateway",
+  503: "Service unavailable",
+};
+
+export function getDefaultStatusDescription(statusCode: number): string {
+  return STATUS_DESCRIPTIONS[statusCode] ?? `Response with status ${statusCode}`;
+}

package/src/src/sandbox/sandbox.ts

@@ -40,13 +40,17 @@ export class Sandbox {
     private apiUrl: string,
   ) {}
 
-  /** Create a new sandbox session. Claims a warm pod or creates a new one. */
-  static async create(options: SandboxOptions): Promise<Sandbox> {
-    const apiUrl = options.apiUrl ||
+  private static resolveApiUrl(options: SandboxOptions): string {
+    return options.apiUrl ||
       (typeof dntShim.Deno !== "undefined"
         ? dntShim.Deno.env.get("VERYFRONT_API_URL")
         : process.env.VERYFRONT_API_URL) ||
       "https://api.veryfront.com";
+  }
+
+  /** Create a new sandbox session. Claims a warm pod or creates a new one. */
+  static async create(options: SandboxOptions): Promise<Sandbox> {
+    const apiUrl = Sandbox.resolveApiUrl(options);
 
     const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions`, {
       method: "POST",
@@ -72,11 +76,7 @@ export class Sandbox {
 
   /** Reconnect to an existing sandbox session. */
   static async get(id: string, options: SandboxOptions): Promise<Sandbox> {
-    const apiUrl = options.apiUrl ||
-      (typeof dntShim.Deno !== "undefined"
-        ? dntShim.Deno.env.get("VERYFRONT_API_URL")
-        : process.env.VERYFRONT_API_URL) ||
-      "https://api.veryfront.com";
+    const apiUrl = Sandbox.resolveApiUrl(options);
 
     const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
       headers: { Authorization: `Bearer ${options.authToken}` },

package/src/src/security/http/cors/constants.ts

@@ -1,10 +1,6 @@
-import { DEV_LOCALHOST_ORIGINS } from "../../../config/index.js";
-
 export const DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 export const DEFAULT_HEADERS = ["Content-Type", "Authorization"];
 export const DEFAULT_MAX_AGE = 86400;
 
-export { DEV_LOCALHOST_ORIGINS };
-
 export const HTTP_NO_CONTENT = 204;
 export const HTTP_FORBIDDEN = 403;

package/src/src/security/http/response/index.ts

@@ -4,14 +4,8 @@
  * @module security/http/response
  */
 
-export type { CacheStrategy, CORSConfig, ResponseBuilderConfig, SecurityConfig } from "./types.js";
-export { CACHE_DURATIONS, CONTENT_TYPES } from "./constants.js";
+export type { CacheStrategy, ResponseBuilderConfig } from "./types.js";
+export { CACHE_DURATIONS } from "./constants.js";
 export { createResponseBuilder, ResponseBuilder } from "./builder.js";
-export { applyCORSHeaders, shouldApplyCORS } from "../cors/index.js";
-export {
-  applySecurityHeaders,
-  buildCSP,
-  generateNonce,
-  getSecurityHeader,
-} from "./security-handler.js";
+export { applySecurityHeaders, generateNonce, getSecurityHeader } from "./security-handler.js";
 export { buildCacheControl } from "./cache-handler.js";

package/src/src/server/context/enriched-context.ts

@@ -103,25 +103,7 @@ export function buildEnrichedContext(options: BuildEnrichedContextOptions): Enri
   };
 }
 
-export function toRequestContext(enriched: EnrichedContext): {
-  token: string;
-  slug: string;
-  branch: string | null;
-  mode: Environment;
-} {
-  return {
-    token: enriched.token,
-    slug: enriched.projectSlug,
-    branch: enriched.branch,
-    mode: enriched.environment,
-  };
-}
-
-export function shouldEnableCacheFromEnriched(enriched: EnrichedContext): boolean {
-  return !enriched.isLocalProject && enriched.environment !== "preview";
-}
-
-export function shouldUseNoCacheHeadersFromEnriched(enriched: EnrichedContext): boolean {
+function shouldUseNoCacheHeadersFromEnriched(enriched: EnrichedContext): boolean {
   return enriched.isLocalProject || enriched.environment === "preview";
 }