veryfront 0.1.49 → 0.1.51

package/esm/src/server/handlers/dev/dashboard/api.js

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import { getMCPRegistry, getMCPStats } from "../../../../mcp/index.js";
+import { REQUEST_ERROR } from "../../../../errors/index.js";
 import { executeTool, toolRegistry } from "../../../../tool/index.js";
 import { resourceRegistry } from "../../../../resource/index.js";
 import { promptRegistry } from "../../../../prompt/index.js";
@@ -17,6 +18,16 @@ import { getEnvironmentConfig } from "../../../../config/environment-config.js";
 import { getErrorCollector } from "../../../../observability/error-collector.js";
 import { getLogBuffer } from "../../../../observability/log-buffer.js";
 import { ReloadNotifier } from "../../../reload-notifier.js";
+const WORKFLOW_EXECUTION_TIMEOUT_MS = 30_000;
+/** Validate a relative path for directory traversal and null bytes.
+ *  Note: searchParams.get() already percent-decodes, so no extra decoding needed. */
+function isValidRelativePath(path) {
+    if (path.includes("\0"))
+        return false;
+    if (path.includes(".."))
+        return false;
+    return true;
+}
 const JSON_HEADERS = {
     "Content-Type": "application/json",
     "Cache-Control": "no-cache",
@@ -273,11 +284,19 @@ async function handleStartWorkflow(req) {
         const client = getDevWorkflowClient();
         const startTime = Date.now();
         const handle = await client.start(workflowId, input ?? {});
-        const timeoutMs = 30000;
-        const result = await Promise.race([
-            handle.result(),
-            new Promise((_, reject) => dntShim.setTimeout(() => reject(new Error("Workflow execution timed out (30s)")), timeoutMs)),
-        ]);
+        let timeoutId;
+        let result;
+        try {
+            result = await Promise.race([
+                handle.result(),
+                new Promise((_, reject) => {
+                    timeoutId = dntShim.setTimeout(() => reject(REQUEST_ERROR.create({ detail: "Workflow execution timed out (30s)" })), WORKFLOW_EXECUTION_TIMEOUT_MS);
+                }),
+            ]);
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
         const run = await client.getRun(handle.runId);
         return jsonResponse({
             success: true,
@@ -332,7 +351,7 @@ async function handleListFiles(req, ctx) {
     if (!projectDir)
         return errorResponse("No project directory configured", 500);
     const relativePath = new URL(req.url).searchParams.get("path") ?? "";
-    if (relativePath.includes(".."))
+    if (!isValidRelativePath(relativePath))
         return errorResponse("Invalid path", 400);
     const fullPath = relativePath ? `${projectDir}/${relativePath}` : projectDir;
     try {
@@ -365,7 +384,7 @@ async function handleReadFileContent(req, ctx) {
     const relativePath = new URL(req.url).searchParams.get("path") ?? "";
     if (!relativePath)
         return errorResponse("path parameter is required", 400);
-    if (relativePath.includes(".."))
+    if (!isValidRelativePath(relativePath))
         return errorResponse("Invalid path", 400);
     try {
         const content = await adapter.fs.readFile(`${projectDir}/${relativePath}`);

package/esm/src/server/handlers/dev/dashboard/ui-handler.js

@@ -6,7 +6,7 @@ import { logger as baseLogger } from "../../../../utils/index.js";
 import devUiManifest from "../../../dev-ui/manifest.js";
 const logger = baseLogger.component("dev-dashboard");
 const moduleCache = new Map();
-const CACHE_TTL = 5000;
+const CACHE_TTL_MS = 5_000;
 const JS_HEADERS = {
     "Content-Type": "application/javascript",
     "Cache-Control": "no-cache",
@@ -24,15 +24,15 @@ async function readUiModule(uiDir, relativePath) {
     try {
         return { filePath: tsxPath, source: await readTextFile(tsxPath) };
     }
-    catch {
-        // try .ts from filesystem
+    catch (_) {
+        // expected: .tsx not found, try .ts next
     }
     const tsPath = `${uiDir}/${relativePath}.ts`;
     try {
         return { filePath: tsPath, source: await readTextFile(tsPath) };
     }
-    catch {
-        // Filesystem failed, try embedded manifest (for compiled binary)
+    catch (_) {
+        // expected: .ts not found on filesystem, try embedded manifest
     }
     // Try embedded manifest - paths are relative to dev-ui directory
     // The manifest uses "dashboard/..." paths, so we need to match that
@@ -66,7 +66,7 @@ export function handleDashboardUI(req) {
         const { filePath, source } = module;
         const now = Date.now();
         const cached = moduleCache.get(filePath);
-        if (cached && now - cached.timestamp < CACHE_TTL) {
+        if (cached && now - cached.timestamp < CACHE_TTL_MS) {
             return new dntShim.Response(cached.code, { headers: JS_HEADERS });
         }
         try {

package/esm/src/server/handlers/dev/debug-context.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"debug-context.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/debug-context.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAKnG,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,QAAQ,EAAE,eAAe,CAMvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDzE,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,eAAe;CAkBxB"}
+{"version":3,"file":"debug-context.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/debug-context.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAKnG,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,QAAQ,EAAE,eAAe,CAMvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDzE,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,eAAe;CAmBxB"}

package/esm/src/server/handlers/dev/debug-context.handler.js

@@ -62,7 +62,8 @@ export class DebugContextHandler extends BaseHandler {
             const fs = ctx.adapter?.fs;
             return fs?.isMultiProjectMode?.() ?? false;
         }
-        catch {
+        catch (_) {
+            /* expected: adapter may not support multi-project mode */
             return false;
         }
     }
@@ -75,7 +76,8 @@ export class DebugContextHandler extends BaseHandler {
             }
             return underlying.getManagerStats();
         }
-        catch {
+        catch (_) {
+            /* expected: adapter may not support getManagerStats */
             return null;
         }
     }

package/esm/src/server/handlers/dev/endpoints.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/endpoints.handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAMnG,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,QAAQ,EAAE,eAAe,CAUvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAkBzE,OAAO,CAAC,gBAAgB;CAkBzB"}
+{"version":3,"file":"endpoints.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/endpoints.handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAQnG,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,QAAQ,EAAE,eAAe,CAUvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAkBzE,OAAO,CAAC,gBAAgB;CAkBzB"}

package/esm/src/server/handlers/dev/endpoints.handler.js

@@ -3,6 +3,7 @@ import { HTTP_OK, PRIORITY_HIGH_DEV } from "../../../utils/constants/index.js";
 import { getHMRScript, getPreviewHMRScript } from "./scripts/hmr-scripts.js";
 import { getErrorOverlay } from "./scripts/error-overlay.js";
 import { getHydrateScript } from "./scripts/dev-loader.js";
+const DEFAULT_HMR_PORT = "3000";
 export class DevEndpointsHandler extends BaseHandler {
     metadata = {
         name: "DevEndpointsHandler",
@@ -30,7 +31,7 @@ export class DevEndpointsHandler extends BaseHandler {
     getScriptForPath(pathname, url) {
         switch (pathname) {
             case "/_veryfront/hmr.js": {
-                const port = url.searchParams.get("port") ?? "3000";
+                const port = url.searchParams.get("port") ?? DEFAULT_HMR_PORT;
                 return getHMRScript(parseInt(port, 10));
             }
             case "/_veryfront/hydrate.js": {

package/esm/src/server/handlers/dev/files/esbuild-plugins.d.ts

@@ -3,7 +3,7 @@ import type { RuntimeAdapter } from "../../../../platform/adapters/base.js";
 import { type LockfileManager } from "../../../../utils/import-lockfile.js";
 /** Create relative file system plugin for resolving imports via adapter's fs */
 export declare function createRelativeFsPlugin(projectDir: string, adapter: RuntimeAdapter): Plugin;
-export interface BareExternalPluginOptions {
+interface BareExternalPluginOptions {
     bundle?: boolean;
     lockfile?: LockfileManager;
     projectDir?: string;
@@ -11,4 +11,5 @@ export interface BareExternalPluginOptions {
 }
 /** Create bare module external plugin that rewrites npm imports to esm.sh URLs */
 export declare function createBareExternalPlugin(options?: BareExternalPluginOptions | boolean): Plugin;
+export {};
 //# sourceMappingURL=esbuild-plugins.d.ts.map

package/esm/src/server/handlers/dev/files/esbuild-plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugins.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/esbuild-plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA6B,MAAM,EAAe,MAAM,SAAS,CAAC;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAU5E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,sCAAsC,CAAC;AAc9C,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CA6C1F;AAWD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA+DD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAAyB,GAAG,OAAe,GACnD,MAAM,CA0DR"}
+{"version":3,"file":"esbuild-plugins.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/esbuild-plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA6B,MAAM,EAAe,MAAM,SAAS,CAAC;AAG9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAU5E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,sCAAsC,CAAC;AAc9C,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CA6C1F;AAWD,UAAU,yBAAyB;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA+DD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAAyB,GAAG,OAAe,GACnD,MAAM,CA8DR"}

package/esm/src/server/handlers/dev/files/esbuild-plugins.js

@@ -1,4 +1,5 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
+import { NETWORK_ERROR } from "../../../../errors/index.js";
 import { getDirectory, joinPath } from "../../../../utils/path-utils.js";
 import { getReactCDNUrl, getReactDOMCDNUrl, getReactDOMClientCDNUrl, getReactJSXDevRuntimeCDNUrl, getReactJSXRuntimeCDNUrl, REACT_DEFAULT_VERSION, } from "../../../../utils/constants/cdn.js";
 import { computeIntegrity, createLockfileManager, } from "../../../../utils/import-lockfile.js";
@@ -35,8 +36,8 @@ export function createRelativeFsPlugin(projectDir, adapter) {
                         if (st.isFile)
                             return { path: f };
                     }
-                    catch {
-                        // next
+                    catch (_) {
+                        // expected: candidate path doesn't exist, try next
                     }
                 }
                 return undefined;
@@ -108,7 +109,7 @@ async function loadFromLockfile(lockfile, url, strict) {
         logger.warn(`integrity mismatch, refetching: ${url}`);
         return null;
     }
-    catch {
+    catch (_) {
         logger.warn(`cached URL failed, refetching: ${url}`);
         return null;
     }
@@ -141,8 +142,11 @@ export function createBareExternalPlugin(options = false) {
                 }
                 try {
                     const response = await dntShim.fetch(args.path, { redirect: "follow" });
-                    if (!response.ok)
-                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+                    if (!response.ok) {
+                        throw NETWORK_ERROR.create({
+                            detail: `HTTP ${response.status}: ${response.statusText}`,
+                        });
+                    }
                     const contents = await response.text();
                     const resolvedUrl = response.url || args.path;
                     if (lockfile) {

package/esm/src/server/handlers/dev/files/path-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/path-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAwBrD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,MAAM,CAAC,CA+BjB"}
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/path-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAwBrD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,MAAM,CAAC,CAgCjB"}

package/esm/src/server/handlers/dev/files/path-validator.js

@@ -36,7 +36,8 @@ export async function validateDevFilePath(encoded, ctx) {
         if (!info.isFile)
             return "Error: Not a file";
     }
-    catch {
+    catch (_) {
+        /* expected: file may not exist */
         return "Error: File not found";
     }
     return absPath;

package/esm/src/server/handlers/dev/framework-candidates.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-candidates.generated.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/framework-candidates.generated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EA2jKjD,CAAC"}
+{"version":3,"file":"framework-candidates.generated.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/framework-candidates.generated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAkkKjD,CAAC"}

package/esm/src/server/handlers/dev/framework-candidates.generated.js

@@ -555,6 +555,8 @@ export const FRAMEWORK_CANDIDATES = [
     "AgentContainerProps",
     "AgentContainerProps,",
     "AgentContainerProps>(",
+    "AgentMessage,",
+    "AgentMessage[];",
     "AgentStatus",
     "AgentStatus):",
     "AgentStatus,",
@@ -655,6 +657,8 @@ export const FRAMEWORK_CANDIDATES = [
     "CLOCK_ICON_ELEMENTS:",
     "CODE_BRACKETS_ICON_ELEMENTS);",
     "CODE_BRACKETS_ICON_ELEMENTS:",
+    "COMPONENT_ERROR",
+    "COMPONENT_ERROR.create({",
     "COPY_ICON_ELEMENTS);",
     "COPY_ICON_ELEMENTS:",
     "CSS",
@@ -938,7 +942,6 @@ export const FRAMEWORK_CANDIDATES = [
     "End",
     "Enter",
     "Error",
-    "Error(",
     "Error)",
     "Error):",
     "Error,",
@@ -966,7 +969,6 @@ export const FRAMEWORK_CANDIDATES = [
     "FadeIn({",
     "FadeIn,",
     "Failed",
-    "Fallback",
     "FallbackMarkdown",
     "FallbackMarkdown({",
     "Features",
@@ -1221,7 +1223,6 @@ export const FRAMEWORK_CANDIDATES = [
     "MessageSquareIcon",
     "MessageSquareIcon(",
     "MessageSquareIcon,",
-    "Message[];",
     "Messages",
     "Mode",
     "Model",
@@ -1357,7 +1358,9 @@ export const FRAMEWORK_CANDIDATES = [
     "React.ReactNode",
     "React.ReactNode);",
     "React.ReactNode;",
+    "React.RefObject<HTMLInputElement>}",
     "React.RefObject<HTMLTextAreaElement>)",
+    "React.RefObject<HTMLTextAreaElement>}",
     "React.TextareaHTMLAttributes<HTMLTextAreaElement>)}",
     "React.createContext<ChatContextValue",
     "React.createContext<ColorModeContextValue",
@@ -1533,7 +1536,6 @@ export const FRAMEWORK_CANDIDATES = [
     "StopIcon",
     "StopIcon():",
     "StopIcon({",
-    "Storage",
     "Streaming",
     "StreamingMessage",
     "StreamingMessage({",
@@ -1954,7 +1956,6 @@ export const FRAMEWORK_CANDIDATES = [
     "any",
     "any)",
     "anything",
-    "any}",
     "api/chat",
     "api:",
     "application",
@@ -2563,6 +2564,7 @@ export const FRAMEWORK_CANDIDATES = [
     "description?:",
     "description}",
     "design",
+    "detail:",
     "diagram",
     "diagram...",
     "diff",
@@ -2593,6 +2595,7 @@ export const FRAMEWORK_CANDIDATES = [
     "doc",
     "doc.name}",
     "doc.size",
+    "doc.url",
     "docs",
     "docs)",
     "document.addEventListener(",
@@ -2742,6 +2745,7 @@ export const FRAMEWORK_CANDIDATES = [
     "execute-skill-script",
     "execute-skill-script)",
     "execute-skill-script).",
+    "expected:",
     "export",
     "export?:",
     "exportAsMarkdown",
@@ -3049,6 +3053,7 @@ export const FRAMEWORK_CANDIDATES = [
     "hover:text-[var(--foreground)]",
     "hover:text-emerald-500",
     "hover:underline",
+    "href={doc.url}",
     "href={props.href}",
     "html:",
     "html>",
@@ -3461,7 +3466,6 @@ export const FRAMEWORK_CANDIDATES = [
     "messageVariants,",
     "messageVariants:",
     "messages",
-    "messages!.map((msg)",
     "messages)",
     "messages,",
     "messages.",
@@ -3474,6 +3478,7 @@ export const FRAMEWORK_CANDIDATES = [
     "messages={chat.messages}",
     "messages={messages}",
     "messages?.length",
+    "messages?.map((msg)",
     "messages?:",
     "messagesEndRef",
     "messagesEndRef.current?.scrollIntoView({",
@@ -4967,6 +4972,7 @@ export const FRAMEWORK_CANDIDATES = [
     "types",
     "typing",
     "unavailable",
+    "unavailable,",
     "undefined",
     "undefined)",
     "undefined,",
@@ -5106,6 +5112,7 @@ export const FRAMEWORK_CANDIDATES = [
     "veryfront/agent",
     "veryfront/agent/react",
     "veryfront/chat",
+    "veryfront/errors",
     "veryfront/platform/compat/runtime.ts",
     "veryfront/security/client/html-sanitizer.ts",
     "veryfront/testing/assert.ts",

package/esm/src/server/handlers/dev/projects/ui-handler.js

@@ -6,7 +6,7 @@ import { logger as baseLogger } from "../../../../utils/index.js";
 import devUiManifest from "../../../dev-ui/manifest.js";
 const logger = baseLogger.component("projects");
 const moduleCache = new Map();
-const CACHE_TTL = 5000;
+const CACHE_TTL_MS = 5_000;
 const JS_HEADERS = {
     "Content-Type": "application/javascript",
     "Cache-Control": "no-cache",
@@ -39,15 +39,15 @@ async function readUiSource(uiDir, relativePath) {
     try {
         return { filePath: tsxPath, source: await readTextFile(tsxPath) };
     }
-    catch {
-        // try .ts from filesystem
+    catch (_) {
+        /* expected: .tsx file may not exist, try .ts */
     }
     const tsPath = `${uiDir}/${resolvedPath}.ts`;
     try {
         return { filePath: tsPath, source: await readTextFile(tsPath) };
     }
-    catch {
-        // Filesystem failed, try embedded manifest (for compiled binary)
+    catch (_) {
+        /* expected: filesystem files may not exist, try embedded manifest */
     }
     // Try embedded manifest - paths match the resolved path
     const manifest = devUiManifest;
@@ -86,7 +86,7 @@ export function handleProjectsUI(req) {
         const { filePath, source } = module;
         const cached = moduleCache.get(filePath);
         const now = Date.now();
-        if (cached && now - cached.timestamp < CACHE_TTL) {
+        if (cached && now - cached.timestamp < CACHE_TTL_MS) {
             return new dntShim.Response(cached.code, { headers: JS_HEADERS });
         }
         try {

package/esm/src/server/handlers/dev/scripts/hmr-scripts.d.ts

@@ -6,12 +6,6 @@
  * Connects to /_ws WebSocket with exponential backoff reconnection,
  * keepalive pings, debounced updates, and CSS hot-swap.
  */
-export interface HMRScriptOptions {
-    /** Log prefix for console messages */
-    logPrefix: string;
-    /** Whether to use debug-gated logging (localStorage VERYFRONT_DEBUG_HMR) */
-    debugMode: boolean;
-}
 /**
  * HMR script for local development.
  * Uses console.log for all messages since dev is single-user.

package/esm/src/server/handlers/dev/scripts/hmr-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr-scripts.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/scripts/hmr-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AA4TD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}
+{"version":3,"file":"hmr-scripts.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/scripts/hmr-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmUH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/esm/src/server/handlers/dev/scripts/hmr-scripts.js

@@ -98,7 +98,7 @@ function generateHMRClient(opts) {
     const debugPreamble = debugMode
         ? `
   const HMR_DEBUG = (() => {
-    try { return window.localStorage.getItem('VERYFRONT_DEBUG_HMR') === '1'; } catch { return false; }
+    try { return window.localStorage.getItem('VERYFRONT_DEBUG_HMR') === '1'; } catch (_) { return false; }
   })();
   const dlog = (...args) => { if (HMR_DEBUG) console.log(...args); };`
         : "";
@@ -116,7 +116,7 @@ function generateHMRClient(opts) {
         isInitialLoad: true,
         url: window.location.href
       }, '*');
-    } catch { /* cross-origin iframe - expected */ }
+    } catch (_) { /* cross-origin iframe - expected */ }
   }
 
   const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
@@ -129,10 +129,10 @@ function generateHMRClient(opts) {
   let lastReloadAt = 0;
 
   const RECONNECT_BASE_DELAY_MS = 500;
-  const RECONNECT_MAX_DELAY_MS = 5000;
-  const RELOAD_THROTTLE_MS = 2000;
-  const PING_INTERVAL_MS = 30000;
-  const PONG_TIMEOUT_MS = 90000;
+  const RECONNECT_MAX_DELAY_MS = 5_000;
+  const RELOAD_THROTTLE_MS = 2_000;
+  const PING_INTERVAL_MS = 30_000;
+  const PONG_TIMEOUT_MS = 90_000;
 
   let pingIntervalId = null;
   let lastPongAt = Date.now();
@@ -147,7 +147,7 @@ function generateHMRClient(opts) {
     if (window.parent === window) return;
     try {
       window.parent.postMessage({ action: 'appUpdated', url: window.location.href }, '*');
-    } catch { /* ignore */ }
+    } catch (_) { /* expected: cross-origin iframe */ }
   }
 
   function notifyStudioAndReload(reason) {
@@ -183,7 +183,7 @@ function generateHMRClient(opts) {
       if (!ws || ws.readyState !== WebSocket.OPEN) return;
       if (Date.now() - lastPongAt > PONG_TIMEOUT_MS) {
         console.warn('${logPrefix} Pong timeout, reconnecting...');
-        try { ws.close(); } catch { /* ignore */ }
+        try { ws.close(); } catch (_) { /* expected: socket already closed */ }
         return;
       }
       try { ws.send(JSON.stringify({ type: 'ping', timestamp: Date.now() })); }
@@ -224,7 +224,7 @@ function generateHMRClient(opts) {
             break;
           case 'ping':
             lastPongAt = Date.now();
-            try { ws.send(JSON.stringify({ type: 'pong' })); } catch { /* ignore */ }
+            try { ws.send(JSON.stringify({ type: 'pong' })); } catch (_) { /* expected: socket closed */ }
             break;
           case 'update':
             handleUpdate(data);
@@ -288,7 +288,7 @@ function generateHMRClient(opts) {
       }
 
       // Single re-render handles all paths (server propagates timestamps to all imports)
-      await updateJS(paths[0]);
+      if (paths.length > 0) await updateJS(paths[0]);
     }, UPDATE_DEBOUNCE_MS);
   }
 ${getUpdateJSFunction(logPrefix)}
@@ -302,8 +302,8 @@ ${getUpdateJSFunction(logPrefix)}
       clearTimeout(reconnectTimerId);
       reconnectTimerId = null;
     }
-    try { ws && ws.close(); } catch { /* ignore */ }
-  });
+    try { ws && ws.close(); } catch (_) { /* expected: socket already closed */ }
+  }, { once: true });
 
   window.__veryfrontHMR = { getSocket: () => ws };
 })();

package/esm/src/server/handlers/dev/shared/ui-module-transform.d.ts

@@ -1,7 +1,8 @@
-export interface TransformUiModuleOptions {
+interface TransformUiModuleOptions {
     spanName: string;
     importBasePath: string;
 }
 export declare function resolveRelativeImport(currentDir: string, importPath: string): string;
 export declare function transformUiModule(filePath: string, source: string, relativePath: string, options: TransformUiModuleOptions): Promise<string>;
+export {};
 //# sourceMappingURL=ui-module-transform.d.ts.map

package/esm/src/server/handlers/dev/shared/ui-module-transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-module-transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/shared/ui-module-transform.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAapF;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CA2BjB"}
+{"version":3,"file":"ui-module-transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/shared/ui-module-transform.ts"],"names":[],"mappings":"AAGA,UAAU,wBAAwB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAapF;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CA2BjB"}

package/esm/src/server/handlers/dev/styles-candidate-scanner.js

@@ -61,7 +61,8 @@ async function scanLocalFiles(projectDir, ctx) {
         try {
             entries = fs.readDir(dir);
         }
-        catch {
+        catch (_) {
+            /* expected: directory may not exist */
             return;
         }
         for await (const entry of entries) {
@@ -80,8 +81,8 @@ async function scanLocalFiles(projectDir, ctx) {
                 for (const cls of extractCandidates(content))
                     candidates.add(cls);
             }
-            catch {
-                // Skip files that can't be read
+            catch (_) {
+                /* expected: skip files that can't be read */
             }
         }
     };

package/esm/src/server/handlers/dev/styles-css.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"styles-css.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/styles-css.handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAanG,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YAgGjE,cAAc;CAgB7B"}
+{"version":3,"file":"styles-css.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/dev/styles-css.handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAanG,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YAgGjE,cAAc;CAiB7B"}

package/esm/src/server/handlers/dev/styles-css.handler.js

@@ -106,7 +106,8 @@ body::before {
         try {
             return await ctx.adapter.fs.readFile(globalsPath);
         }
-        catch {
+        catch (_) {
+            /* expected: globals.css may not exist */
             logger.debug("No stylesheet found, using default");
             return DEFAULT_STYLESHEET;
         }

package/esm/src/server/handlers/monitoring/client-log.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-log.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/client-log.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAYnG,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAwD/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIzB;IAEX,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,gBAAgB;CAiCzB"}
+{"version":3,"file":"client-log.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/client-log.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAkBnG,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAwD/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIzB;IAEX,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,gBAAgB;CAiCzB"}

package/esm/src/server/handlers/monitoring/client-log.handler.js

@@ -7,6 +7,10 @@ import { VeryfrontError } from "../../../errors/types.js";
 const logger = serverLogger.component("client-log-handler");
 /** Max body size for client log payloads (64 KB) */
 const CLIENT_LOG_MAX_BODY_BYTES = 64 * 1024;
+/** Max length of the log message field */
+const CLIENT_LOG_MESSAGE_MAX_LENGTH = 5_000;
+/** Max chars of raw body shown in parse-error diagnostics */
+const CLIENT_LOG_BODY_PREVIEW_LENGTH = 500;
 export class ClientLogHandler extends BaseHandler {
     metadata = {
         name: "ClientLogHandler",
@@ -27,7 +31,7 @@ export class ClientLogHandler extends BaseHandler {
             const logData = JSON.parse(body);
             const level = typeof logData?.level === "string" ? logData.level : "info";
             const message = typeof logData?.message === "string"
-                ? logData.message.slice(0, 5000)
+                ? logData.message.slice(0, CLIENT_LOG_MESSAGE_MAX_LENGTH)
                 : "[invalid message]";
             const details = logData?.details && typeof logData.details === "object"
                 ? logData.details
@@ -68,7 +72,7 @@ export class ClientLogHandler extends BaseHandler {
     }
     handleParseError(e, body) {
         serverLogger.error("[ClientLogHandler] Failed to parse client log. Error:", getErrorMessage(e));
-        serverLogger.error("[ClientLogHandler] Raw body received (first 500 chars):", body.slice(0, 500));
+        serverLogger.error(`[ClientLogHandler] Raw body received (first ${CLIENT_LOG_BODY_PREVIEW_LENGTH} chars):`, body.slice(0, CLIENT_LOG_BODY_PREVIEW_LENGTH));
         logger.error("Body length:", body.length);
         // Try to identify the problematic character for SyntaxError
         if (!(e instanceof SyntaxError) || !e.message.includes("position")) {

package/esm/src/server/handlers/monitoring/health.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/health.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAQnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,qBAAa,aAAc,SAAQ,WAAW;IAC5C,QAAQ,EAAE,eAAe,CAQvB;YAEY,cAAc;IAatB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YA4CjE,gBAAgB;CAQ/B"}
+{"version":3,"file":"health.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/health.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAQnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,qBAAa,aAAc,SAAQ,WAAW;IAC5C,QAAQ,EAAE,eAAe,CAQvB;YAEY,cAAc;IActB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YA4CjE,gBAAgB;CAS/B"}

package/esm/src/server/handlers/monitoring/health.handler.js

@@ -29,7 +29,8 @@ export class HealthHandler extends BaseHandler {
             const projectDirStat = await ctx.adapter.fs.stat(ctx.projectDir);
             return !!projectDirStat?.isDirectory;
         }
-        catch {
+        catch (_) {
+            /* expected: project directory may not exist */
             return false;
         }
     }
@@ -68,7 +69,8 @@ export class HealthHandler extends BaseHandler {
             const st = await ctx.adapter.fs.stat(joinPath(ctx.projectDir, "dist"));
             return !!st?.isDirectory;
         }
-        catch {
+        catch (_) {
+            /* expected: dist directory may not exist */
             return false;
         }
     }

package/esm/src/server/handlers/monitoring/memory.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/memory.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAkBnG,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,QAAQ,EAAE,eAAe,CAIvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAqC/E,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,gBAAgB;YAeV,QAAQ;IAsBtB,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,kBAAkB;CAmB3B"}
+{"version":3,"file":"memory.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/memory.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBnG,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAyC/E,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,gBAAgB;YAeV,QAAQ;IAsBtB,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,kBAAkB;CAmB3B"}