veryfront 0.1.502 → 0.1.503

package/src/src/schemas/primitives.ts

@@ -1,48 +1,84 @@
-import { z } from "zod";
+/**
+ * Reusable validation primitives, expressed against the `SchemaValidator`
+ * contract via `defineSchema`. Each export is a lazy getter — calling it
+ * materializes (and caches) the schema on first use.
+ *
+ * @module schemas/primitives
+ */
 
-export const nonEmptyString = z.string().min(1, "String cannot be empty");
-export type NonEmptyString = z.infer<typeof nonEmptyString>;
+import type { InferSchema, Schema } from "../extensions/schema/index.js";
+import { defineSchema } from "./define.js";
 
-export const positiveInt = z.number().int().positive("Must be a positive integer");
-export type PositiveInt = z.infer<typeof positiveInt>;
+export const getNonEmptyStringSchema = defineSchema((v) =>
+  v.string().min(1, "String cannot be empty")
+);
+export type NonEmptyString = InferSchema<ReturnType<typeof getNonEmptyStringSchema>>;
+
+export const getPositiveIntSchema = defineSchema((v) =>
+  v.number().int().positive("Must be a positive integer")
+);
+export type PositiveInt = InferSchema<ReturnType<typeof getPositiveIntSchema>>;
+
+export const getNonNegativeIntSchema = defineSchema((v) =>
+  v.number().int().nonnegative("Must be a non-negative integer")
+);
+export type NonNegativeInt = InferSchema<ReturnType<typeof getNonNegativeIntSchema>>;
 
-export const nonNegativeInt = z.number().int().nonnegative("Must be a non-negative integer");
-export type NonNegativeInt = z.infer<typeof nonNegativeInt>;
+export const getPortNumberSchema = defineSchema((v) =>
+  v.number().int().min(1).max(65535, "Port must be between 1 and 65535")
+);
+export type PortNumber = InferSchema<ReturnType<typeof getPortNumberSchema>>;
 
-export const portNumber = z.number().int().min(1).max(65535, "Port must be between 1 and 65535");
-export type PortNumber = z.infer<typeof portNumber>;
+export const getTimestampSchema = defineSchema((v) => v.string().datetime());
+export type Timestamp = InferSchema<ReturnType<typeof getTimestampSchema>>;
 
-export const timestamp = z.string().datetime();
-export type Timestamp = z.infer<typeof timestamp>;
+/**
+ * Recursive JSON value type — a string, number, boolean, null, array of
+ * JsonValue, or object with string keys and JsonValue values.
+ */
+export type JsonValue =
+  | string
+  | number
+  | boolean
+  | null
+  | JsonValue[]
+  | { [key: string]: JsonValue };
 
-export const jsonValue: z.ZodType<
-  string | number | boolean | null | { [key: string]: unknown } | unknown[]
-> = z.lazy(() =>
-  z.union([
-    z.string(),
-    z.number(),
-    z.boolean(),
-    z.null(),
-    z.array(jsonValue),
-    z.record(z.string(), jsonValue),
-  ])
+export const getJsonValueSchema = defineSchema<JsonValue>((v): Schema<JsonValue> =>
+  v.lazy<JsonValue>(() =>
+    v.union([
+      v.string(),
+      v.number(),
+      v.boolean(),
+      v.null(),
+      v.array(getJsonValueSchema()),
+      v.record(v.string(), getJsonValueSchema()),
+    ]) as Schema<JsonValue>
+  )
 );
-export type JsonValue = z.infer<typeof jsonValue>;
 
-export const hexColor = z.string().regex(/^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/, "Invalid hex color");
-export type HexColor = z.infer<typeof hexColor>;
+export const getHexColorSchema = defineSchema((v) =>
+  v.string().regex(/^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/, "Invalid hex color")
+);
+export type HexColor = InferSchema<ReturnType<typeof getHexColorSchema>>;
 
-export const semver = z.string().regex(
-  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/,
-  "Invalid semantic version",
+export const getSemverSchema = defineSchema((v) =>
+  v.string().regex(
+    /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/,
+    "Invalid semantic version",
+  )
 );
-export type Semver = z.infer<typeof semver>;
+export type Semver = InferSchema<ReturnType<typeof getSemverSchema>>;
 
-export const filePath = z.string().min(1, "File path cannot be empty");
-export type FilePath = z.infer<typeof filePath>;
+export const getFilePathSchema = defineSchema((v) =>
+  v.string().min(1, "File path cannot be empty")
+);
+export type FilePath = InferSchema<ReturnType<typeof getFilePathSchema>>;
 
-export const absolutePath = z.string().regex(
-  /^(?:\/|[A-Za-z]:\\)/,
-  "Path must be absolute (start with / or drive letter)",
+export const getAbsolutePathSchema = defineSchema((v) =>
+  v.string().regex(
+    /^(?:\/|[A-Za-z]:\\)/,
+    "Path must be absolute (start with / or drive letter)",
+  )
 );
-export type AbsolutePath = z.infer<typeof absolutePath>;
+export type AbsolutePath = InferSchema<ReturnType<typeof getAbsolutePathSchema>>;

package/src/src/security/http/config.ts

@@ -39,7 +39,7 @@ export class SecurityConfigLoader {
   }
 
   private applyConfig(cfg?: VeryfrontConfig): void {
-    const security: SecurityConfig = cfg?.security ? { ...cfg.security } : {};
+    const security: SecurityConfig = cfg?.security ? { ...cfg.security } as SecurityConfig : {};
 
     if (security.headers) security.headers = { ...security.headers };
 

package/src/src/security/input-validation/handler.ts

@@ -1,11 +1,11 @@
-import { z } from "zod";
+import type { Schema } from "../../extensions/schema/index.js";
 import { VeryfrontError } from "./errors.js";
 import { parseJsonBody, parseQueryParams } from "./parsers.js";
 import { type RequestLimits, type ValidatedData } from "./types.js";
 
 export interface ValidatedHandlerConfig<TBody = unknown, TQuery = unknown> {
-  body?: z.ZodSchema<TBody>;
-  query?: z.ZodSchema<TQuery>;
+  body?: Schema<TBody>;
+  query?: Schema<TQuery>;
   limits?: RequestLimits;
 }
 

package/src/src/security/input-validation/parsers.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import type { Schema } from "../../extensions/schema/index.js";
 import { createValidationError, VeryfrontError } from "./errors.js";
 import { readBodyWithLimit, validateContentType, validateRequestLimits } from "./limits.js";
 import { sanitizeData } from "./sanitizers.js";
@@ -9,7 +9,7 @@ import { File } from "node:buffer";
 
 export async function parseJsonBody<T>(
   request: Request,
-  schema: z.ZodSchema<T>,
+  schema: Schema<T>,
   options?: ParseJsonOptions,
 ): Promise<T> {
   validateRequestLimits(request, options?.limits);
@@ -27,57 +27,54 @@ export async function parseJsonBody<T>(
     });
   }
 
-  try {
-    const validated = await schema.parseAsync(data);
-    return options?.sanitize ? (sanitizeData(validated) as T) : validated;
-  } catch (error) {
-    if (!(error instanceof z.ZodError)) throw error;
-
-    throw createValidationError("Validation failed", {
-      errors: error.issues.map((e) => ({
-        path: e.path.join("."),
-        message: e.message,
-        code: e.code,
-      })),
-    });
+  const result = schema.safeParse(data);
+  if (result.success) {
+    return options?.sanitize ? (sanitizeData(result.data) as T) : result.data;
   }
+
+  const issues = result.issues ?? [];
+  throw createValidationError("Validation failed", {
+    errors: issues.map((e) => ({
+      path: e.path.join("."),
+      message: e.message,
+      code: e.code ?? "custom",
+    })),
+  });
 }
 
 export async function parseFormData<T>(
   request: Request,
-  schema: z.ZodSchema<T>,
+  schema: Schema<T>,
   options?: ParseFormOptions,
 ): Promise<T> {
   validateRequestLimits(request, options?.limits);
 
   validateContentType(request, ["multipart/form-data", "application/x-www-form-urlencoded"]);
 
-  try {
-    const formData = await request.formData();
-    const data: Record<string, unknown> = {};
-    const maxFileSize = options?.limits?.maxFileSize ?? DEFAULT_LIMITS.maxFileSize;
-
-    for (const [key, value] of formData.entries()) {
-      if (value instanceof File && value.size > maxFileSize) {
-        throw createValidationError(`File ${key} too large`, {
-          maxSize: maxFileSize,
-          actualSize: value.size,
-        });
-      }
-      data[key] = value;
+  const formData = await request.formData();
+  const data: Record<string, unknown> = {};
+  const maxFileSize = options?.limits?.maxFileSize ?? DEFAULT_LIMITS.maxFileSize;
+
+  for (const [key, value] of formData.entries()) {
+    if (value instanceof File && value.size > maxFileSize) {
+      throw createValidationError(`File ${key} too large`, {
+        maxSize: maxFileSize,
+        actualSize: value.size,
+      });
     }
+    data[key] = value;
+  }
 
-    return await schema.parseAsync(data);
-  } catch (error) {
-    if (!(error instanceof z.ZodError)) throw error;
+  const result = schema.safeParse(data);
+  if (result.success) return result.data;
 
-    throw createValidationError("Form validation failed", {
-      errors: error.issues,
-    });
-  }
+  const issues = result.issues ?? [];
+  throw createValidationError("Form validation failed", {
+    errors: issues,
+  });
 }
 
-export function parseQueryParams<T>(request: Request, schema: z.ZodSchema<T>): T {
+export function parseQueryParams<T>(request: Request, schema: Schema<T>): T {
   const url = new URL(request.url);
   const params: Record<string, unknown> = {};
 
@@ -97,13 +94,11 @@ export function parseQueryParams<T>(request: Request, schema: z.ZodSchema<T>): T
     params[key] = [existing, value];
   }
 
-  try {
-    return schema.parse(params);
-  } catch (error) {
-    if (!(error instanceof z.ZodError)) throw error;
+  const result = schema.safeParse(params);
+  if (result.success) return result.data;
 
-    throw createValidationError("Query parameter validation failed", {
-      errors: error.issues,
-    });
-  }
+  const issues = result.issues ?? [];
+  throw createValidationError("Query parameter validation failed", {
+    errors: issues,
+  });
 }

package/src/src/server/bootstrap.ts

@@ -147,8 +147,8 @@ function maybeAttachFileLogSubscriber(config: VeryfrontConfig): FileLogHandle |
     path: fileConfig.path ?? DEFAULT_FILE_LOG_PATH,
     maxSize: fileConfig.maxSize ?? DEFAULT_FILE_LOG_MAX_SIZE,
     maxFiles: fileConfig.maxFiles ?? DEFAULT_FILE_LOG_MAX_FILES,
-    level: fileConfig.level ?? DEFAULT_FILE_LOG_LEVEL,
-    format: fileConfig.format ?? DEFAULT_FILE_LOG_FORMAT,
+    level: (fileConfig.level ?? DEFAULT_FILE_LOG_LEVEL) as "debug" | "info" | "warn" | "error",
+    format: (fileConfig.format ?? DEFAULT_FILE_LOG_FORMAT) as "text" | "json",
   };
 
   const subscriber = createFileLogSubscriber(resolved);
@@ -312,7 +312,7 @@ export async function bootstrap(
 
     const enhancedAdapter = await enhanceAdapterWithFS(
       adapter,
-      { ...config, fs: fsWithCallbacks },
+      { ...config, fs: fsWithCallbacks } as any,
       projectDir,
     );
 

package/src/src/server/dev-ui/manifest.js

@@ -24,7 +24,7 @@ export default {
     "dashboard/components/FilesTab.tsx": "import { useEffect, useMemo, useState } from \"react\";\nimport type { FileItem } from \"../App.tsx\";\nimport { Card } from \"./Card.tsx\";\nimport { Sidebar } from \"./Sidebar.tsx\";\nimport { DetailHeader, ErrorState, formatSize, LoadingState, TwoColumnLayout } from \"./shared.tsx\";\n\nexport function FilesTab(): React.ReactElement {\n  const [currentPath, setCurrentPath] = useState(\"\");\n  const [files, setFiles] = useState<FileItem[]>([]);\n  const [selectedFile, setSelectedFile] = useState<string | null>(null);\n  const [search, setSearch] = useState(\"\");\n  const [loading, setLoading] = useState(true);\n\n  useEffect(() => {\n    async function loadFiles(path: string): Promise<void> {\n      setLoading(true);\n      try {\n        const res = await fetch(`/_dev/api/files?path=${encodeURIComponent(path)}`);\n        const data = await res.json();\n        setFiles(data.files ?? []);\n      } catch (e) {\n        console.error(\"Failed to load files:\", e);\n        setFiles([]);\n      } finally {\n        setLoading(false);\n      }\n    }\n\n    void loadFiles(currentPath);\n  }, [currentPath]);\n\n  const filteredFiles = useMemo((): FileItem[] => {\n    if (!search) return files;\n    const q = search.toLowerCase();\n    return files.filter((f) => f.name.toLowerCase().includes(q));\n  }, [files, search]);\n\n  function handleSelect(id: string): void {\n    const file = files.find((f) => f.path === id);\n    if (!file) return;\n\n    if (file.type !== \"directory\") {\n      setSelectedFile(file.path);\n      return;\n    }\n\n    setCurrentPath(file.path);\n    setSelectedFile(null);\n    setSearch(\"\");\n  }\n\n  function handleBack(): void {\n    setCurrentPath(currentPath.split(\"/\").slice(0, -1).join(\"/\"));\n    setSelectedFile(null);\n  }\n\n  const sidebar = (\n    <Sidebar\n      search={search}\n      onSearchChange={setSearch}\n      items={filteredFiles.map((f) => ({\n        id: f.path,\n        label: f.type === \"directory\" ? `${f.name}/` : f.name,\n        bold: f.type === \"directory\",\n      }))}\n      selectedId={selectedFile}\n      onSelect={handleSelect}\n      emptyMessage={loading ? \"Loading...\" : \"No files found\"}\n      onBack={currentPath && !search ? handleBack : undefined}\n    />\n  );\n\n  return (\n    <TwoColumnLayout sidebar={sidebar}>\n      {selectedFile\n        ? <FileDetail path={selectedFile} />\n        : <DirectoryInfo path={currentPath} fileCount={files.length} />}\n    </TwoColumnLayout>\n  );\n}\n\nfunction DirectoryInfo(\n  { path, fileCount }: { path: string; fileCount: number },\n): React.ReactElement {\n  return (\n    <div>\n      <DetailHeader title={path || \"Project Root\"} description={`${fileCount} items`} />\n      <Card>\n        <div className=\"p-4 text-sm text-gray-400\">Select a file to view its contents</div>\n      </Card>\n    </div>\n  );\n}\n\ninterface FileContent {\n  content?: string;\n  lines?: number;\n  size?: number;\n  isBinary?: boolean;\n  message?: string;\n  error?: string;\n}\n\nfunction FileDetail({ path }: { path: string }): React.ReactElement {\n  const [content, setContent] = useState<FileContent | null>(null);\n  const [loading, setLoading] = useState(true);\n\n  const filename = useMemo((): string => path.split(\"/\").pop() ?? \"\", [path]);\n  const ext = useMemo((): string => path.split(\".\").pop()?.toLowerCase() ?? \"\", [path]);\n\n  useEffect(() => {\n    async function loadContent(): Promise<void> {\n      setLoading(true);\n      try {\n        const res = await fetch(`/_dev/api/file-content?path=${encodeURIComponent(path)}`);\n        const data = await res.json();\n        setContent(data);\n      } catch (e: unknown) {\n        const message = e instanceof Error ? e.message : String(e);\n        setContent({ error: message });\n      } finally {\n        setLoading(false);\n      }\n    }\n    loadContent();\n  }, [path]);\n\n  const title = !loading && content?.content !== undefined ? \"Contents\" : undefined;\n  const titleRight = content?.lines\n    ? <span className=\"text-[11px] text-gray-400 font-normal\">{content.lines} lines</span>\n    : undefined;\n\n  let body: React.ReactNode = null;\n  if (loading) {\n    body = <LoadingState message=\"Loading file contents...\" />;\n  } else if (content?.error) {\n    body = <ErrorState error={content.error} />;\n  } else if (content?.isBinary) {\n    body = <div className=\"p-4 text-sm text-gray-400\">{content.message}</div>;\n  } else if (content?.content !== undefined) {\n    body = (\n      <pre className=\"p-3 text-xs font-mono text-gray-600 overflow-auto max-h-[500px] whitespace-pre-wrap bg-gray-50\">\n        {content.content}\n      </pre>\n    );\n  }\n\n  return (\n    <div>\n      <DetailHeader title={filename} description={path} />\n\n      <Card title=\"File Info\" className=\"mb-4\">\n        <table className=\"w-full text-sm\">\n          <tbody>\n            <tr className=\"border-b\">\n              <td className=\"px-3 py-2.5 w-24 font-medium text-gray-600\">Path</td>\n              <td className=\"px-3 py-2.5 text-gray-900\">{path}</td>\n            </tr>\n            <tr className=\"border-b\">\n              <td className=\"px-3 py-2.5 font-medium text-gray-600\">Extension</td>\n              <td className=\"px-3 py-2.5 text-gray-900\">{ext}</td>\n            </tr>\n            {content?.lines\n              ? (\n                <tr className=\"border-b\">\n                  <td className=\"px-3 py-2.5 font-medium text-gray-600\">Lines</td>\n                  <td className=\"px-3 py-2.5 text-gray-900\">{content.lines}</td>\n                </tr>\n              )\n              : null}\n            {content?.size\n              ? (\n                <tr>\n                  <td className=\"px-3 py-2.5 font-medium text-gray-600\">Size</td>\n                  <td className=\"px-3 py-2.5 text-gray-900\">{formatSize(content.size)}</td>\n                </tr>\n              )\n              : null}\n          </tbody>\n        </table>\n      </Card>\n\n      <Card title={title} titleRight={titleRight}>\n        {body}\n      </Card>\n    </div>\n  );\n}\n",
     "dashboard/components/APITab.tsx": "export function APITab(): JSX.Element {\n  return (\n    <div className=\"h-[calc(100vh-89px)] overflow-y-auto\">\n      <main className=\"bg-gray-50 p-5\">\n        <div className=\"mb-6\">\n          <h1 className=\"text-lg font-semibold tracking-tight\">API Documentation</h1>\n          <p className=\"text-sm text-gray-500\">\n            Interactive API docs powered by Scalar.{\" \"}\n            <a\n              href=\"/_docs\"\n              target=\"_blank\"\n              rel=\"noopener noreferrer\"\n              className=\"text-sky-500 hover:text-sky-600\"\n            >\n              Open in new tab\n            </a>\n          </p>\n        </div>\n\n        <div className=\"overflow-hidden rounded-md border border-gray-200 bg-white shadow-sm\">\n          <iframe\n            src=\"/_docs\"\n            className=\"w-full border-0\"\n            style={{ height: \"calc(100vh - 180px)\" }}\n          />\n        </div>\n      </main>\n    </div>\n  );\n}\n",
     "dashboard/components/AgentTab.tsx": "import { useEffect, useState } from \"react\";\nimport type { Agent, Prompt, Resource, Tool } from \"../App.tsx\";\nimport { MCPTab } from \"./MCPTab.tsx\";\nimport { AgentsTab } from \"./AgentsTab.tsx\";\nimport { WorkflowsTab } from \"./WorkflowsTab.tsx\";\nimport { Card } from \"./Card.tsx\";\nimport { ErrorState, LoadingState, PageLayout } from \"./shared.tsx\";\n\ntype SubTab = \"mcp\" | \"agents\" | \"workflows\" | \"providers\";\n\ninterface Provider {\n  name: string;\n  configured: boolean;\n}\n\ninterface NodeInfo {\n  id: string;\n  type: string;\n  agent?: string;\n  tool?: string;\n  dependsOn?: string[];\n  children?: string[];\n  message?: string;\n}\n\ninterface WorkflowMetadata {\n  id: string;\n  description?: string;\n  version?: string;\n  timeout?: string | number;\n  nodeCount: number;\n  nodeTypes: string[];\n  nodes: NodeInfo[];\n  agentRefs: string[];\n  toolRefs: string[];\n  hasInputSchema: boolean;\n  hasOutputSchema: boolean;\n  inputSchemaJson?: Record<string, unknown>;\n  registeredAt: string;\n}\n\ninterface AgentTabProps {\n  tools: Tool[];\n  resources: Resource[];\n  prompts: Prompt[];\n  agents: Agent[];\n}\n\nexport function AgentTab({\n  tools,\n  resources,\n  prompts,\n  agents,\n}: AgentTabProps): React.ReactElement {\n  const [subTab, setSubTab] = useState<SubTab>(\"mcp\");\n\n  const [providers, setProviders] = useState<Provider[]>([]);\n  const [providersLoading, setProvidersLoading] = useState(true);\n  const [providersError, setProvidersError] = useState<string | null>(null);\n\n  const [workflows, setWorkflows] = useState<WorkflowMetadata[]>([]);\n  const [workflowsLoading, setWorkflowsLoading] = useState(true);\n  const [workflowsError, setWorkflowsError] = useState<string | null>(null);\n\n  useEffect(() => {\n    async function loadProviders(): Promise<void> {\n      try {\n        const res = await fetch(\"/_dev/api/infrastructure\");\n        const d = await res.json();\n        setProviders(d.providers ?? []);\n        setProvidersError(null);\n      } catch (e: unknown) {\n        setProvidersError(e instanceof Error ? e.message : String(e));\n      } finally {\n        setProvidersLoading(false);\n      }\n    }\n\n    async function loadWorkflows(): Promise<void> {\n      try {\n        const res = await fetch(\"/_dev/api/workflows\");\n        const d = await res.json();\n        setWorkflows(d.workflows ?? []);\n        setWorkflowsError(null);\n      } catch (e: unknown) {\n        setWorkflowsError(e instanceof Error ? e.message : String(e));\n      } finally {\n        setWorkflowsLoading(false);\n      }\n    }\n\n    loadProviders();\n    loadWorkflows();\n  }, []);\n\n  function navigateToMCP(mcpSubTab: \"tools\" | \"resources\" | \"prompts\", itemId: string): void {\n    setSubTab(\"mcp\");\n    globalThis.dispatchEvent(\n      new CustomEvent(\"mcp-navigate\", { detail: { subTab: mcpSubTab, itemId } }),\n    );\n  }\n\n  const mcpCount = tools.length + resources.length + prompts.length;\n  const configuredProvidersCount = providers.filter((p) => p.configured).length;\n\n  return (\n    <div className=\"min-h-screen\">\n      <div className=\"bg-white border-b\">\n        <div className=\"px-6 py-4\">\n          <div className=\"mb-3\">\n            <h1 className=\"text-xl font-semibold text-gray-900\">Agent</h1>\n            <p className=\"text-sm text-gray-500\">MCP, agents, workflows, and providers</p>\n          </div>\n          <div className=\"flex gap-1 border border-gray-200 rounded-lg p-1 bg-gray-50 w-fit\">\n            <TabButton\n              active={subTab === \"mcp\"}\n              onClick={() => setSubTab(\"mcp\")}\n              label={`MCP (${mcpCount})`}\n            />\n            <TabButton\n              active={subTab === \"agents\"}\n              onClick={() => setSubTab(\"agents\")}\n              label={`Agents (${agents.length})`}\n            />\n            <TabButton\n              active={subTab === \"workflows\"}\n              onClick={() => setSubTab(\"workflows\")}\n              label={`Workflows (${workflows.length})`}\n            />\n            <TabButton\n              active={subTab === \"providers\"}\n              onClick={() => setSubTab(\"providers\")}\n              label={`Providers (${configuredProvidersCount})`}\n            />\n          </div>\n        </div>\n      </div>\n\n      {subTab === \"mcp\" && <MCPTab tools={tools} resources={resources} prompts={prompts} />}\n\n      {subTab === \"agents\" && (\n        <AgentsTab agents={agents} tools={tools} onNavigateToMCP={navigateToMCP} />\n      )}\n\n      {subTab === \"workflows\" && (\n        <WorkflowsSection\n          loading={workflowsLoading}\n          error={workflowsError}\n          workflows={workflows}\n          agents={agents}\n          tools={tools}\n          onNavigateToTool={(toolId) => navigateToMCP(\"tools\", toolId)}\n          onNavigateToAgent={() => {\n            setSubTab(\"agents\");\n            // AgentsTab will need to handle this\n          }}\n        />\n      )}\n\n      {subTab === \"providers\" && (\n        <ProvidersSection providers={providers} loading={providersLoading} error={providersError} />\n      )}\n    </div>\n  );\n}\n\nfunction TabButton({\n  active,\n  onClick,\n  label,\n}: {\n  active: boolean;\n  onClick: () => void;\n  label: string;\n}): React.ReactElement {\n  const className = `px-3 py-1.5 text-sm font-medium rounded-md transition-colors ${\n    active ? \"bg-white text-sky-600 shadow-sm\" : \"text-gray-500 hover:text-gray-700\"\n  }`;\n\n  return (\n    <button type=\"button\" onClick={onClick} className={className}>\n      {label}\n    </button>\n  );\n}\n\nfunction WorkflowsSection({\n  loading,\n  error,\n  workflows,\n  agents,\n  tools,\n  onNavigateToAgent,\n  onNavigateToTool,\n}: {\n  loading: boolean;\n  error: string | null;\n  workflows: WorkflowMetadata[];\n  agents: Agent[];\n  tools: Tool[];\n  onNavigateToAgent: (agentId: string) => void;\n  onNavigateToTool: (toolId: string) => void;\n}): React.ReactElement {\n  if (loading) {\n    return (\n      <PageLayout title=\"\" description=\"\">\n        <Card>\n          <LoadingState message=\"Loading workflows...\" />\n        </Card>\n      </PageLayout>\n    );\n  }\n\n  if (error) {\n    return (\n      <PageLayout title=\"\" description=\"\">\n        <Card>\n          <ErrorState error={error} />\n        </Card>\n      </PageLayout>\n    );\n  }\n\n  return (\n    <WorkflowsTab\n      workflows={workflows}\n      agents={agents}\n      tools={tools}\n      onNavigateToAgent={onNavigateToAgent}\n      onNavigateToTool={onNavigateToTool}\n    />\n  );\n}\n\nfunction ProvidersSection({\n  providers,\n  loading,\n  error,\n}: {\n  providers: Provider[];\n  loading: boolean;\n  error: string | null;\n}): React.ReactElement {\n  if (loading) {\n    return (\n      <PageLayout title=\"\" description=\"\">\n        <Card>\n          <LoadingState message=\"Loading providers...\" />\n        </Card>\n      </PageLayout>\n    );\n  }\n\n  if (error) {\n    return (\n      <PageLayout title=\"\" description=\"\">\n        <Card>\n          <ErrorState error={error} />\n        </Card>\n      </PageLayout>\n    );\n  }\n\n  const configured: Provider[] = [];\n  const notConfigured: Provider[] = [];\n\n  for (const provider of providers) {\n    if (provider.configured) {\n      configured.push(provider);\n    } else {\n      notConfigured.push(provider);\n    }\n  }\n\n  return (\n    <div className=\"max-w-7xl mx-auto px-6 py-6\">\n      <div className=\"grid grid-cols-1 md:grid-cols-3 gap-4 mb-6\">\n        <Card className=\"p-4\">\n          <div className=\"text-2xl font-bold text-gray-900\">{configured.length}</div>\n          <div className=\"text-sm text-gray-500\">Configured</div>\n        </Card>\n        <Card className=\"p-4\">\n          <div className=\"text-2xl font-bold text-gray-400\">{notConfigured.length}</div>\n          <div className=\"text-sm text-gray-500\">Not Configured</div>\n        </Card>\n        <Card className=\"p-4\">\n          <div className=\"text-2xl font-bold text-gray-900\">{providers.length}</div>\n          <div className=\"text-sm text-gray-500\">Total Available</div>\n        </Card>\n      </div>\n\n      <Card title=\"AGENT PROVIDERS\">\n        <table className=\"w-full text-sm\">\n          <thead>\n            <tr className=\"bg-gray-50 border-b\">\n              <th className=\"text-left px-3 py-2 text-[10px] font-semibold uppercase tracking-wide text-gray-500\">\n                Provider\n              </th>\n              <th className=\"text-left px-3 py-2 text-[10px] font-semibold uppercase tracking-wide text-gray-500\">\n                Status\n              </th>\n              <th className=\"text-left px-3 py-2 text-[10px] font-semibold uppercase tracking-wide text-gray-500\">\n                API Key\n              </th>\n            </tr>\n          </thead>\n          <tbody>\n            {providers.map((provider) => {\n              const status = provider.configured\n                ? {\n                  className: \"inline-flex items-center gap-1.5 text-green-600\",\n                  dotClassName: \"w-2 h-2 rounded-full bg-green-500\",\n                  label: \"Ready\",\n                  apiKey: <span className=\"text-green-600\">(set)</span>,\n                }\n                : {\n                  className: \"inline-flex items-center gap-1.5 text-gray-400\",\n                  dotClassName: \"w-2 h-2 rounded-full bg-gray-300\",\n                  label: \"Not configured\",\n                  apiKey: <span className=\"text-gray-400\">(not set)</span>,\n                };\n\n              return (\n                <tr key={provider.name} className=\"border-b last:border-0\">\n                  <td className=\"px-3 py-3\">\n                    <code className=\"text-sm text-sky-600 font-medium\">{provider.name}</code>\n                  </td>\n                  <td className=\"px-3 py-3\">\n                    <span className={status.className}>\n                      <span className={status.dotClassName} />\n                      {status.label}\n                    </span>\n                  </td>\n                  <td className=\"px-3 py-3 text-gray-500 text-sm\">{status.apiKey}</td>\n                </tr>\n              );\n            })}\n          </tbody>\n        </table>\n      </Card>\n    </div>\n  );\n}\n",
-    "dashboard/components/WorkflowsTab.helpers.test.ts": "import { assertEquals } from \"#veryfront/testing/assert.ts\";\nimport { describe, it } from \"#veryfront/testing/bdd.ts\";\nimport {\n  filterItemsByIdSearch,\n  generateExampleFromSchema,\n  getNodeTypeStyle,\n} from \"./WorkflowsTab.helpers.ts\";\n\ndescribe(\"WorkflowsTab helpers\", () => {\n  it(\"returns configured node styles and falls back for unknown types\", () => {\n    assertEquals(getNodeTypeStyle(\"step\"), {\n      badge: \"bg-blue-50 text-blue-600\",\n      node: \"bg-blue-50 border-blue-200 text-blue-700\",\n    });\n    assertEquals(getNodeTypeStyle(\"unknown\"), {\n      badge: \"bg-gray-100 text-gray-600\",\n      node: \"bg-gray-50 border-gray-200 text-gray-700\",\n    });\n  });\n\n  it(\"filters items by id using case-insensitive search\", () => {\n    const items = [{ id: \"Alpha\" }, { id: \"beta\" }, { id: \"gamma\" }];\n    assertEquals(filterItemsByIdSearch(items, \"A\"), [{ id: \"Alpha\" }, { id: \"beta\" }, {\n      id: \"gamma\",\n    }]);\n    assertEquals(filterItemsByIdSearch(items, \"BET\"), [{ id: \"beta\" }]);\n  });\n\n  it(\"generates examples from nested schemas\", () => {\n    assertEquals(\n      generateExampleFromSchema({\n        type: \"object\",\n        properties: {\n          email: { type: \"string\" },\n          url: { type: \"string\" },\n          count: { type: \"integer\" },\n          enabled: { type: \"boolean\" },\n          mode: { enum: [\"fast\", \"slow\"] },\n          nested: {\n            type: \"object\",\n            properties: {\n              name: { type: \"string\", default: \"preset\" },\n            },\n          },\n          tags: { type: \"array\" },\n        },\n      }),\n      {\n        email: \"user@example.com\",\n        url: \"https://example.com/data\",\n        count: 1,\n        enabled: true,\n        mode: \"fast\",\n        nested: { name: \"preset\" },\n        tags: [],\n      },\n    );\n  });\n});\n",
+    "dashboard/components/WorkflowsTab.helpers.test.ts": "import \"#veryfront/schemas/_test-setup.ts\";\nimport { assertEquals } from \"#veryfront/testing/assert.ts\";\nimport { describe, it } from \"#veryfront/testing/bdd.ts\";\nimport {\n  filterItemsByIdSearch,\n  generateExampleFromSchema,\n  getNodeTypeStyle,\n} from \"./WorkflowsTab.helpers.ts\";\n\ndescribe(\"WorkflowsTab helpers\", () => {\n  it(\"returns configured node styles and falls back for unknown types\", () => {\n    assertEquals(getNodeTypeStyle(\"step\"), {\n      badge: \"bg-blue-50 text-blue-600\",\n      node: \"bg-blue-50 border-blue-200 text-blue-700\",\n    });\n    assertEquals(getNodeTypeStyle(\"unknown\"), {\n      badge: \"bg-gray-100 text-gray-600\",\n      node: \"bg-gray-50 border-gray-200 text-gray-700\",\n    });\n  });\n\n  it(\"filters items by id using case-insensitive search\", () => {\n    const items = [{ id: \"Alpha\" }, { id: \"beta\" }, { id: \"gamma\" }];\n    assertEquals(filterItemsByIdSearch(items, \"A\"), [{ id: \"Alpha\" }, { id: \"beta\" }, {\n      id: \"gamma\",\n    }]);\n    assertEquals(filterItemsByIdSearch(items, \"BET\"), [{ id: \"beta\" }]);\n  });\n\n  it(\"generates examples from nested schemas\", () => {\n    assertEquals(\n      generateExampleFromSchema({\n        type: \"object\",\n        properties: {\n          email: { type: \"string\" },\n          url: { type: \"string\" },\n          count: { type: \"integer\" },\n          enabled: { type: \"boolean\" },\n          mode: { enum: [\"fast\", \"slow\"] },\n          nested: {\n            type: \"object\",\n            properties: {\n              name: { type: \"string\", default: \"preset\" },\n            },\n          },\n          tags: { type: \"array\" },\n        },\n      }),\n      {\n        email: \"user@example.com\",\n        url: \"https://example.com/data\",\n        count: 1,\n        enabled: true,\n        mode: \"fast\",\n        nested: { name: \"preset\" },\n        tags: [],\n      },\n    );\n  });\n});\n",
     "dashboard/components/Header.tsx": "export function Header(): JSX.Element {\n  return (\n    <header className=\"bg-white border-b border-gray-200 px-5 h-12 flex items-center sticky top-0 z-50\">\n      <div className=\"flex items-center gap-2\">\n        <div className=\"w-6 h-6 bg-sky-500 rounded flex items-center justify-center text-white font-bold text-xs\">\n          V\n        </div>\n        <span className=\"font-semibold text-sm tracking-tight\">Dev</span>\n      </div>\n    </header>\n  );\n}\n",
     "dashboard/index.tsx": "import { App } from \"./App.tsx\";\nimport { mountReactApp } from \"../shared/mount-react-app.tsx\";\n\nmountReactApp(<App />);\n"
   }

package/src/src/server/handlers/dev/framework-candidates.generated.ts

@@ -5305,6 +5305,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "veryfront/chat",
   "veryfront/errors/error-registry.ts",
   "veryfront/platform/compat/runtime.ts",
+  "veryfront/schemas/_test-setup.ts",
   "veryfront/security/client/html-sanitizer.ts",
   "veryfront/testing/assert",
   "veryfront/testing/assert.ts",

package/src/src/server/handlers/request/agent-run-cancel.handler.ts

@@ -1,7 +1,4 @@
-import {
-  CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX,
-  LEGACY_INTERNAL_AGENT_RUNS_PATH_PREFIX,
-} from "../../../channels/control-plane.js";
+import { CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX } from "../../../channels/control-plane.js";
 import {
   ControlPlaneRequestError,
   verifyControlPlaneRequest,
@@ -19,7 +16,7 @@ import { BaseHandler } from "../response/base.js";
 import type { HandlerContext, HandlerMetadata, HandlerPriority, HandlerResult } from "../types.js";
 import { PRIORITY_MEDIUM_API } from "../../../utils/constants/index.js";
 
-const CANCEL_PATH_REGEX = /^\/(?:api\/control-plane\/agents|internal\/agents)\/runs\/([^/]+)$/;
+const CANCEL_PATH_REGEX = /^\/api\/control-plane\/agents\/runs\/([^/]+)$/;
 
 function getRunId(pathname: string): string | null {
   return CANCEL_PATH_REGEX.exec(pathname)?.[1] ?? null;
@@ -31,7 +28,6 @@ export class AgentRunCancelHandler extends BaseHandler {
     priority: PRIORITY_MEDIUM_API as HandlerPriority,
     patterns: [
       { pattern: CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX, prefix: true, method: "DELETE" },
-      { pattern: LEGACY_INTERNAL_AGENT_RUNS_PATH_PREFIX, prefix: true, method: "DELETE" },
     ],
   };
 

package/src/src/server/handlers/request/agent-run-resume.handler.ts

@@ -1,7 +1,4 @@
-import {
-  CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX,
-  LEGACY_INTERNAL_AGENT_RUNS_PATH_PREFIX,
-} from "../../../channels/control-plane.js";
+import { CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX } from "../../../channels/control-plane.js";
 import {
   ControlPlaneRequestError,
   verifyControlPlaneRequest,
@@ -18,13 +15,12 @@ import {
   InternalAgentRequestBodyTooLargeError,
   readInternalAgentRequestBody,
 } from "../../../internal-agents/request-body.js";
-import { ResumeSignalSchema } from "../../../internal-agents/schema.js";
+import { getResumeSignalSchema } from "../../../internal-agents/schema.js";
 import { BaseHandler } from "../response/base.js";
 import type { HandlerContext, HandlerMetadata, HandlerPriority, HandlerResult } from "../types.js";
 import { PRIORITY_MEDIUM_API } from "../../../utils/constants/index.js";
 
-const RESUME_PATH_REGEX =
-  /^\/(?:api\/control-plane\/agents|internal\/agents)\/runs\/([^/]+)\/resume$/;
+const RESUME_PATH_REGEX = /^\/api\/control-plane\/agents\/runs\/([^/]+)\/resume$/;
 
 function getRunId(pathname: string): string | null {
   return RESUME_PATH_REGEX.exec(pathname)?.[1] ?? null;
@@ -36,7 +32,6 @@ export class AgentRunResumeHandler extends BaseHandler {
     priority: PRIORITY_MEDIUM_API as HandlerPriority,
     patterns: [
       { pattern: CONTROL_PLANE_AGENT_RUNS_PATH_PREFIX, prefix: true, method: "POST" },
-      { pattern: LEGACY_INTERNAL_AGENT_RUNS_PATH_PREFIX, prefix: true, method: "POST" },
     ],
   };
 
@@ -69,7 +64,7 @@ export class AgentRunResumeHandler extends BaseHandler {
           expectedSurface: "studio",
         });
 
-        const signal = ResumeSignalSchema.parse(JSON.parse(rawBody));
+        const signal = getResumeSignalSchema().parse(JSON.parse(rawBody));
         const outcome = this.sessionManager.submitToolResult(runId, {
           toolCallId: signal.toolCallId,
           result: signal.result,

package/src/src/server/handlers/request/agent-stream.handler.ts

@@ -2,7 +2,6 @@ import type { Agent } from "../../../agent/index.js";
 import { defaultChannelInvokeDeps } from "../../../channels/invoke.js";
 import {
   CONTROL_PLANE_AGENT_STREAM_PATH,
-  LEGACY_INTERNAL_AGENT_STREAM_PATH,
   type RuntimeAgentDiscoveryDeps,
 } from "../../../channels/control-plane.js";
 import {
@@ -27,7 +26,7 @@ import {
   agentRunSessionManager,
 } from "../../../internal-agents/session-manager.js";
 import {
-  InternalAgentStreamRequestSchema,
+  getInternalAgentStreamRequestSchema,
   type RuntimeAgentSourceContext,
   toRuntimeRunAgentInput,
 } from "../../../internal-agents/schema.js";
@@ -122,7 +121,6 @@ export class AgentStreamHandler extends BaseHandler {
     priority: PRIORITY_MEDIUM_API as HandlerPriority,
     patterns: [
       { pattern: CONTROL_PLANE_AGENT_STREAM_PATH, exact: true, method: "POST" },
-      { pattern: LEGACY_INTERNAL_AGENT_STREAM_PATH, exact: true, method: "POST" },
     ],
   };
 
@@ -169,7 +167,7 @@ export class AgentStreamHandler extends BaseHandler {
           req,
           INTERNAL_AGENT_STREAM_MAX_BODY_BYTES,
         );
-        const payload = InternalAgentStreamRequestSchema.parse(JSON.parse(rawBody));
+        const payload = getInternalAgentStreamRequestSchema().parse(JSON.parse(rawBody));
         await verifyControlPlaneRequest(req, ctx, rawBody, {
           expectedSubject: payload.runId,
           expectedSurface: "studio",

package/src/src/server/handlers/request/internal-agents-list.handler.ts

@@ -4,7 +4,6 @@ import {
   CONTROL_PLANE_AGENTS_LIST_PATH,
   type ControlPlaneAgentsListRequest,
   ControlPlaneAgentsListRequestSchema,
-  LEGACY_INTERNAL_AGENTS_LIST_PATH,
   listRuntimeAgents,
   type RuntimeAgentDiscoveryDeps,
 } from "../../../channels/control-plane.js";
@@ -19,7 +18,6 @@ import {
   readInternalAgentRequestBody,
 } from "../../../internal-agents/request-body.js";
 import { PRIORITY_MEDIUM_API } from "../../../utils/constants/index.js";
-import { ZodError } from "zod";
 
 export class InternalAgentsListHandler extends BaseHandler {
   metadata: HandlerMetadata = {
@@ -27,7 +25,6 @@ export class InternalAgentsListHandler extends BaseHandler {
     priority: PRIORITY_MEDIUM_API as HandlerPriority,
     patterns: [
       { pattern: CONTROL_PLANE_AGENTS_LIST_PATH, exact: true, method: "POST" },
-      { pattern: LEGACY_INTERNAL_AGENTS_LIST_PATH, exact: true, method: "POST" },
     ],
   };
 
@@ -55,7 +52,7 @@ export class InternalAgentsListHandler extends BaseHandler {
         );
         const claims = await verifyControlPlaneRequest(req, ctx, rawBody, {
           expectedSubject: payload.requestId,
-          expectedSurface: payload.surface,
+          expectedSurface: payload.surface as any,
         });
 
         if (
@@ -88,7 +85,7 @@ export class InternalAgentsListHandler extends BaseHandler {
           return this.respond(builder.json({ error: error.message }, error.status));
         }
 
-        if (error instanceof SyntaxError || error instanceof ZodError) {
+        if (error instanceof SyntaxError || (error instanceof Error && "issues" in error)) {
           this.logWarn("Internal agents list request validation failed", {
             error: error instanceof Error ? error.message : String(error),
             projectSlug: ctx.projectSlug,

package/src/src/server/runtime-handler/environment-resolution.ts

@@ -62,16 +62,15 @@ export function resolveEnvironment(
 
   let releaseId = opts.releaseId;
 
-  // Some internal framework surfaces are routed directly to a runtime owner pod and
+  // Some framework control-plane surfaces are routed directly to a runtime owner pod and
   // rely on signed control-plane auth instead of a user-facing release address.
-  const isInternalAgentControlPlanePath = opts.pathname.startsWith("/internal/agents/") ||
-    opts.pathname.startsWith("/api/control-plane/agents/");
+  const isAgentControlPlanePath = opts.pathname.startsWith("/api/control-plane/agents/");
 
-  // Skip releaseId validation for development assets and signed internal control-plane
+  // Skip releaseId validation for development assets and signed control-plane
   // requests because they do not require a user-facing release context.
   const canSkipReleaseIdValidation = opts.pathname === "/_ws" ||
     opts.pathname.startsWith("/_veryfront/") ||
-    isInternalAgentControlPlanePath;
+    isAgentControlPlanePath;
 
   // Validate releaseId in proxy mode production
   if (

package/src/src/server/runtime-handler/request-utils.ts

@@ -84,6 +84,5 @@ export function isWebSocketPath(pathname: string): boolean {
  * render cache prefix/content-source derivation and the enriched render payload.
  */
 export function shouldSkipEnrichedContext(pathname: string): boolean {
-  return pathname.startsWith("/api/") || pathname.startsWith("/internal/agents/") ||
-    pathname.startsWith("/api/control-plane/agents/");
+  return pathname.startsWith("/api/") || pathname.startsWith("/api/control-plane/agents/");
 }

package/src/src/server/schemas/action.schema.ts

@@ -1,9 +1,15 @@
-import { z } from "zod";
+import { defineSchema } from "../../schemas/index.js";
+import type { InferSchema } from "../../extensions/schema/index.js";
 
 /** Action payload from client for RSC server actions */
-export const ActionPayloadSchema = z.object({
-  id: z.string().min(1),
-  args: z.array(z.unknown()).max(50).optional().default([]),
-});
+export const getActionPayloadSchema = defineSchema((v) =>
+  v.object({
+    id: v.string().min(1),
+    args: v.array(v.unknown()).max(50).optional().default([]),
+  })
+);
 
-export type ActionPayload = z.infer<typeof ActionPayloadSchema>;
+export type ActionPayload = InferSchema<ReturnType<typeof getActionPayloadSchema>>;
+
+// Backward compat alias
+export const ActionPayloadSchema = getActionPayloadSchema();