veryfront 0.1.614 → 0.1.616

package/esm/src/provider/local/local-engine.js

@@ -18,6 +18,70 @@ import { throwIfLocalAIDisabled } from "./env.js";
 const logger = serverLogger.component("local-llm");
 /** Default maximum new tokens for local model generation */
 const DEFAULT_MAX_NEW_TOKENS = 512;
+/**
+ * Build a StoppingCriteriaList that halts generation as soon as any of the
+ * provided stop strings appears in the *newly generated* output.
+ *
+ * Transformers.js (>=3.x) does not expose a `stop_strings` generate option,
+ * so we decode the running sequence with the tokenizer and match the stop
+ * strings against the suffix — the documented `stopping_criteria` mechanism.
+ *
+ * Transformers.js passes the full sequence (prompt + generated tokens) to
+ * `_call` on every step. We must scan only the generated suffix: if a system
+ * or user message contains a configured stop string (e.g. an instruction that
+ * mentions "END"), scanning the whole sequence would return `true` on the very
+ * first generation step and truncate the response to empty.
+ *
+ * The prompt token length is not cheaply known where this list is built (the
+ * pipeline tokenizes `messages` internally), so per batch item we self-calibrate
+ * on the first `_call`: the sequence length seen on the first invocation is
+ * recorded as the prompt boundary, and only tokens at or after that boundary are
+ * decoded and matched on subsequent steps.
+ */
+function buildStopStringCriteria(transformers, tokenizer, stopSequences) {
+    const list = new transformers.StoppingCriteriaList();
+    const base = new transformers.StoppingCriteria();
+    const criterion = base;
+    // Per-batch-item prompt token length, captured on the first invocation.
+    const promptLengths = [];
+    criterion._call = (inputIds) => inputIds.map((ids, item) => {
+        if (promptLengths[item] === undefined) {
+            // First step for this item: everything seen so far is prompt. Record the
+            // boundary and never trip on the prompt itself.
+            promptLengths[item] = ids.length;
+            return false;
+        }
+        const generated = ids.slice(promptLengths[item]);
+        if (generated.length === 0)
+            return false;
+        const text = tokenizer.decode(generated);
+        return stopSequences.some((stop) => stop.length > 0 && text.includes(stop));
+    });
+    list.push(criterion);
+    return list;
+}
+/**
+ * Translate engine-level {@link GenerateOptions} into the options object passed
+ * to the Transformers.js text-generation pipeline.
+ *
+ * Exported for unit testing the option-forwarding seam (notably that
+ * `stopSequences` is not silently dropped) without downloading a model.
+ */
+export function buildPipeOptions(options, transformers, tokenizer, streamer) {
+    const { maxNewTokens = DEFAULT_MAX_NEW_TOKENS, temperature = 0.7, topP, topK, stopSequences, } = options;
+    const pipeOptions = {
+        max_new_tokens: maxNewTokens,
+        temperature,
+        top_p: topP,
+        top_k: topK,
+        do_sample: temperature > 0,
+        streamer,
+    };
+    if (stopSequences && stopSequences.length > 0) {
+        pipeOptions.stopping_criteria = buildStopStringCriteria(transformers, tokenizer, stopSequences);
+    }
+    return pipeOptions;
+}
 /** Cached pipeline instances keyed by HuggingFace model ID */
 const pipelineCache = new Map();
 /** Whether a model is currently being loaded (prevents concurrent loads) */
@@ -132,7 +196,6 @@ export async function* generateStream(modelId, messages, options = {}) {
     const modelInfo = resolveLocalModel(modelId);
     const pipe = await loadPipeline(modelInfo);
     const transformers = await getTransformers();
-    const { maxNewTokens = DEFAULT_MAX_NEW_TOKENS, temperature = 0.7, topP, topK, } = options;
     // Use a queue to bridge TextStreamer callbacks → async generator
     const tokenQueue = [];
     let resolveWaiting = null;
@@ -151,17 +214,11 @@ export async function* generateStream(modelId, messages, options = {}) {
             flushWaiting();
         },
     });
+    const pipeOptions = buildPipeOptions(options, transformers, pipe.tokenizer, streamer);
     // Start generation in the background
     const generatePromise = (async () => {
         try {
-            await pipe(messages, {
-                max_new_tokens: maxNewTokens,
-                temperature,
-                top_p: topP,
-                top_k: topK,
-                do_sample: temperature > 0,
-                streamer,
-            });
+            await pipe(messages, pipeOptions);
         }
         finally {
             done = true;

package/esm/src/provider/runtime-loader/provider-usage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-usage.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/provider-usage.ts"],"names":[],"mappings":"AAEA,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBhF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAoB7E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAmB7E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAwBtF;AAED,qCAAqC;AACrC,wBAAgB,UAAU,CACxB,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,IAAI,EAAE,YAAY,GAAG,SAAS,GAC7B,YAAY,GAAG,SAAS,CAsB1B"}
+{"version":3,"file":"provider-usage.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/provider-usage.ts"],"names":[],"mappings":"AAEA,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBhF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAoB7E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAmB7E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAwBtF;AAED,qCAAqC;AACrC,wBAAgB,UAAU,CACxB,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,IAAI,EAAE,YAAY,GAAG,SAAS,GAC7B,YAAY,GAAG,SAAS,CAkC1B"}

package/esm/src/provider/runtime-loader/provider-usage.js

@@ -100,10 +100,21 @@ export function mergeUsage(current, next) {
     const cacheCreationInputTokens = next.cacheCreationInputTokens ??
         current.cacheCreationInputTokens;
     const cacheReadInputTokens = next.cacheReadInputTokens ?? current.cacheReadInputTokens;
+    // Prefer the provider-reported total (latest non-undefined wins, matching the
+    // ?? semantics used for input/output above). Providers like Gemini 2.5
+    // thinking models and OpenAI reasoning models report a total that exceeds
+    // input + output because it includes reasoning/thoughts tokens. Recomputing
+    // the sum would discard those, undercounting usage. Take the larger of the
+    // provider total and the recomputed sum so we never undercount.
+    const reportedTotal = next.totalTokens ?? current.totalTokens;
+    const recomputedTotal = (inputTokens ?? 0) + (outputTokens ?? 0);
+    const totalTokens = reportedTotal !== undefined
+        ? Math.max(reportedTotal, recomputedTotal)
+        : recomputedTotal;
     return {
         inputTokens,
         outputTokens,
-        totalTokens: (inputTokens ?? 0) + (outputTokens ?? 0),
+        totalTokens,
         ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
         ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     };

package/esm/src/rendering/rsc/server-renderer/tree-processor.js

@@ -2,7 +2,7 @@ import * as React from "../../../../react/react.js";
 import { serverLogger } from "../../../utils/index.js";
 import { renderToStringAdapter } from "../../../react/index.js";
 import { getComponentId, isClientComponent, registerClientRef, } from "./component-detector.js";
-import { renderAttributes, treeToHTML } from "./html-generator.js";
+import { escapeHtml, renderAttributes, treeToHTML } from "./html-generator.js";
 import { serializeProps } from "./prop-serializer.js";
 const logger = serverLogger.component("rsc");
 /** Recursively renders a component tree to RSC nodes */
@@ -10,13 +10,13 @@ export async function renderTree(
 // deno-lint-ignore no-explicit-any -- RSC components accept arbitrary props at runtime
 Component, props, clientManifest, clientRefs) {
     if (Component == null || typeof Component === "string" || typeof Component === "number") {
-        return { type: "html", html: Component == null ? "" : String(Component) };
+        return { type: "html", html: Component == null ? "" : escapeHtml(String(Component)) };
     }
     if (React.isValidElement(Component)) {
         return processElement(Component, clientManifest, clientRefs);
     }
     if (typeof Component !== "function") {
-        return { type: "html", html: String(Component) };
+        return { type: "html", html: escapeHtml(String(Component)) };
     }
     const rscComponent = Component;
     if (isClientComponent(rscComponent, clientManifest)) {
@@ -36,7 +36,7 @@ Component, props, clientManifest, clientRefs) {
             return { type: "html", html: "" };
         if (React.isValidElement(element))
             return processElement(element, clientManifest, clientRefs);
-        return { type: "html", html: String(element) };
+        return { type: "html", html: escapeHtml(String(element)) };
     }
     catch (error) {
         logger.error("Error rendering component:", error);
@@ -76,6 +76,6 @@ export function renderChildren(children, clientManifest, clientRefs) {
         if (React.isValidElement(child)) {
             return processElement(child, clientManifest, clientRefs);
         }
-        return Promise.resolve({ type: "html", html: String(child) });
+        return Promise.resolve({ type: "html", html: escapeHtml(String(child)) });
     }));
 }

package/esm/src/routing/api/api-route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/api-route-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAU9D,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAsC;;IAUxD,wCAAwC;IACxC,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEpC;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAkD7C,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAgB5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAoBtC,OAAO,CAAC,aAAa;IAiCrB,UAAU,IAAI,KAAK,EAAE;IAIrB,KAAK,IAAI,IAAI;IAKb,UAAU,IAAI,IAAI;IAIlB,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"api-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/api-route-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAW9D,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAsC;;IAUxD,wCAAwC;IACxC,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEpC;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAkD7C,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAgB5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAoBtC,OAAO,CAAC,aAAa;IAiCrB,UAAU,IAAI,KAAK,EAAE;IAIrB,KAAK,IAAI,IAAI;IAKb,UAAU,IAAI,IAAI;IAIlB,OAAO,IAAI,IAAI;CAGhB"}

package/esm/src/routing/api/api-route-matcher.js

@@ -1,6 +1,7 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { getDisableLruIntervalEnv } from "../../config/env.js";
 import { LRUCache } from "../../utils/lru-wrapper.js";
+import { safeDecodeParam } from "../matchers/decode-param.js";
 /** Max entries in the route-match LRU cache */
 const ROUTE_CACHE_MAX_ENTRIES = 500;
 /** Time-to-live for cached route matches (5 minutes) */
@@ -121,10 +122,10 @@ export class ApiRouteMatcher {
             const value = match[i + 1];
             if (catchAllParamNames.has(paramName)) {
                 const segments = value ? value.split("/").filter((segment) => segment.length > 0) : [];
-                params[paramName] = segments.map((segment) => decodeURIComponent(segment));
+                params[paramName] = segments.map((segment) => safeDecodeParam(segment));
                 continue;
             }
-            params[paramName] = decodeURIComponent(value ?? "");
+            params[paramName] = safeDecodeParam(value ?? "");
         }
         return params;
     }

package/esm/src/routing/matchers/decode-param.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Decode a single URL path segment, tolerating malformed percent-encoding.
+ *
+ * `decodeURIComponent` throws `URIError` on invalid sequences (e.g. `%zz`).
+ * For route param extraction we prefer to fall back to the raw value so a
+ * malformed request yields a normal route miss / 4xx instead of crashing.
+ */
+export declare function safeDecodeParam(value: string): string;
+//# sourceMappingURL=decode-param.d.ts.map

package/esm/src/routing/matchers/decode-param.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-param.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/matchers/decode-param.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD"}

package/esm/src/routing/matchers/decode-param.js

@@ -0,0 +1,17 @@
+/**
+ * Decode a single URL path segment, tolerating malformed percent-encoding.
+ *
+ * `decodeURIComponent` throws `URIError` on invalid sequences (e.g. `%zz`).
+ * For route param extraction we prefer to fall back to the raw value so a
+ * malformed request yields a normal route miss / 4xx instead of crashing.
+ */
+export function safeDecodeParam(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch (error) {
+        if (error instanceof URIError)
+            return value;
+        throw error;
+    }
+}

package/esm/src/routing/matchers/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/matchers/route-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAyBpD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,GAAG,IAAI,CAe5E"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/matchers/route-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA0BpD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,GAAG,IAAI,CAa5E"}

package/esm/src/routing/matchers/route-matcher.js

@@ -1,3 +1,4 @@
+import { safeDecodeParam } from "./decode-param.js";
 const CATCH_ALL_PATTERN = /\[\[?\.\.\.(\w+)\]\]?/g;
 function extractCatchAllParams(pattern) {
     const params = new Set();
@@ -16,7 +17,7 @@ function decodeCatchAllValue(value) {
     return value
         .split("/")
         .filter(Boolean)
-        .map((segment) => decodeURIComponent(segment));
+        .map((segment) => safeDecodeParam(segment));
 }
 export function matchRoute(pathname, route) {
     const match = pathname.match(route.regex);
@@ -26,9 +27,7 @@ export function matchRoute(pathname, route) {
     const params = {};
     for (const [index, name] of (route.paramNames ?? []).entries()) {
         const value = match[index + 1] ?? "";
-        params[name] = catchAllParams.has(name)
-            ? decodeCatchAllValue(value)
-            : decodeURIComponent(value);
+        params[name] = catchAllParams.has(name) ? decodeCatchAllValue(value) : safeDecodeParam(value);
     }
     return { params, route };
 }

package/esm/src/routing/slug-mapper/dynamic-route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/slug-mapper/dynamic-route-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAUjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAsC/E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAErE"}
+{"version":3,"file":"dynamic-route-matcher.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/slug-mapper/dynamic-route-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAkBjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAsC/E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAErE"}

package/esm/src/routing/slug-mapper/dynamic-route-matcher.js

@@ -1,10 +1,16 @@
 export { isDynamicRoute } from "../../utils/route-path-utils.js";
+function isOptionalSpreadParam(part) {
+    return part.startsWith("[[...") && part.endsWith("]]");
+}
 function isSpreadParam(part) {
-    return part.startsWith("[...") && part.endsWith("]");
+    return isOptionalSpreadParam(part) || (part.startsWith("[...") && part.endsWith("]"));
 }
 function isDynamicParam(part) {
     return part.startsWith("[") && part.endsWith("]");
 }
+function spreadParamName(part) {
+    return isOptionalSpreadParam(part) ? part.slice(5, -2) : part.slice(4, -1);
+}
 export function extractParams(pattern, slug) {
     const patternParts = pattern.split("/").filter(Boolean);
     const slugParts = slug.split("/").filter(Boolean);
@@ -16,7 +22,7 @@ export function extractParams(pattern, slug) {
     let slugIndex = 0;
     for (const patternPart of patternParts) {
         if (isSpreadParam(patternPart)) {
-            const paramName = patternPart.slice(4, -1);
+            const paramName = spreadParamName(patternPart);
             params[paramName] = slugParts.slice(slugIndex);
             return params;
         }

package/esm/src/server/node-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-handler.d.ts","sourceRoot":"","sources":["../../../src/src/server/node-handler.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GACtD,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,IAAI,CAqC7F"}
+{"version":3,"file":"node-handler.d.ts","sourceRoot":"","sources":["../../../src/src/server/node-handler.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GACtD,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,IAAI,CAqE7F"}

package/esm/src/server/node-handler.js

@@ -4,12 +4,14 @@ export function toNodeHandler(handler) {
     return async (req, res) => {
         try {
             const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-            const headers = {};
+            const headers = new Headers();
             for (const [key, value] of Object.entries(req.headers)) {
                 if (typeof value === "string")
-                    headers[key] = value;
-                else if (Array.isArray(value))
-                    headers[key] = value[0] ?? "";
+                    headers.append(key, value);
+                else if (Array.isArray(value)) {
+                    for (const entry of value)
+                        headers.append(key, entry);
+                }
             }
             const method = req.method ?? "GET";
             const body = method === "GET" || method === "HEAD" ? null : req;
@@ -23,7 +25,40 @@ export function toNodeHandler(handler) {
             const response = await handler(new Request(url.toString(), init));
             if (response.status === 101)
                 return;
-            res.writeHead(response.status, Object.fromEntries(response.headers));
+            const outHeaders = {};
+            const setCookies = [];
+            // Headers.prototype.getSetCookie landed in Node ~18.14, but our published
+            // engines.node is ">=18.0.0". On early 18.x it is undefined, so calling it
+            // unconditionally throws for every response and turns valid requests into
+            // 500s. Feature-detect it and fall back to the header iterator.
+            const getSetCookie = response.headers.getSetCookie;
+            if (typeof getSetCookie === "function") {
+                // Modern path: getSetCookie returns each Set-Cookie as a distinct value.
+                setCookies.push(...getSetCookie.call(response.headers));
+                for (const [key, value] of response.headers) {
+                    if (key.toLowerCase() === "set-cookie")
+                        continue;
+                    outHeaders[key] = value;
+                }
+            }
+            else {
+                // Fallback for runtimes without getSetCookie. The undici-based Headers
+                // iterator yields each Set-Cookie as its own entry (it is the one header
+                // that is NOT comma-joined during iteration), so iterating preserves
+                // multiples where the platform allows it. If a runtime does collapse
+                // them into a single comma-joined string we still pass that one value
+                // through unchanged rather than throwing — degrade gracefully, never 500.
+                for (const [key, value] of response.headers) {
+                    if (key.toLowerCase() === "set-cookie") {
+                        setCookies.push(value);
+                        continue;
+                    }
+                    outHeaders[key] = value;
+                }
+            }
+            if (setCookies.length > 0)
+                outHeaders["Set-Cookie"] = setCookies;
+            res.writeHead(response.status, outHeaders);
             if (response.body) {
                 const reader = response.body.getReader();
                 while (true) {

package/esm/src/tool/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AAyJxE,sCAAsC;AACtC,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CA+CvB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CA4B7E"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AAyJxE,sCAAsC;AACtC,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAgDvB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CA4B7E"}

package/esm/src/tool/factory.js

@@ -102,9 +102,10 @@ export function tool(config) {
         outputSchema: config.outputSchema,
         outputSchemaJson,
         execute: async (input, context) => {
+            let validated = input;
             if (hasSchemaParse(config.inputSchema)) {
                 try {
-                    config.inputSchema.parse(input);
+                    validated = config.inputSchema.parse(input);
                 }
                 catch (error) {
                     throw toError(createError({
@@ -113,7 +114,7 @@ export function tool(config) {
                     }));
                 }
             }
-            return await config.execute(input, context);
+            return await config.execute(validated, context);
         },
         mcp: config.mcp,
     };
@@ -133,7 +134,7 @@ export function dynamicTool(config) {
         inputSchemaJson,
         execute: async (input, context) => {
             if (hasSchemaParse(config.inputSchema)) {
-                config.inputSchema.parse(input);
+                input = config.inputSchema.parse(input);
             }
             else if (input === undefined) {
                 input = {};

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.614";
+export declare const VERSION = "0.1.616";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.614";
+export const VERSION = "0.1.616";

package/esm/src/workflow/backends/redis/index.d.ts

@@ -9,6 +9,8 @@ export declare class RedisBackend implements WorkflowBackend {
     private connectionPromise;
     private config;
     private initialized;
+    /** Per-run lock tokens for ownership-checked release/extend (Redlock pattern). */
+    private lockValues;
     constructor(config?: RedisBackendConfig);
     private runKey;
     private checkpointsKey;

package/esm/src/workflow/backends/redis/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/backends/redis/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,WAAW,EAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAYnD,YAAY,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAA8B,MAAM,YAAY,CAAC;AAIjF,+BAA+B;AAC/B,qBAAa,YAAa,YAAW,eAAe;IAClD,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,GAAE,kBAAuB;IAa3C,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,cAAc;IAqEtB,OAAO,CAAC,YAAY;YAcN,gBAAgB;IAiCxB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAUlD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCpE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAuCnD,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7C,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS9D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAUpD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlF,OAAO,CAAC,aAAa;IAUf,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAM9D,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKtF,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IA8BV,oBAAoB,CAAC,MAAM,CAAC,EAAE;QAClC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAsC1D,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9C,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAwBlD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ9D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzC,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAWjE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC;IAmCb,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAW/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB/B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/backends/redis/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,WAAW,EAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAYnD,YAAY,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAA8B,MAAM,YAAY,CAAC;AAmBjF,+BAA+B;AAC/B,qBAAa,YAAa,YAAW,eAAe;IAClD,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,WAAW,CAAS;IAC5B,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAA6B;gBAEnC,MAAM,GAAE,kBAAuB;IAa3C,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,cAAc;IAqEtB,OAAO,CAAC,YAAY;YAcN,gBAAgB;IAiCxB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAUlD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCpE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAuCnD,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7C,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS9D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAUpD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlF,OAAO,CAAC,aAAa;IAUf,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAM9D,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKtF,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IA8BV,oBAAoB,CAAC,MAAM,CAAC,EAAE;QAClC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAsC1D,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9C,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAwBlD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa9D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzC,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAWjE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC;IAmCb,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAW/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB/B"}

package/esm/src/workflow/backends/redis/index.js

@@ -12,12 +12,25 @@ import { requeueRun } from "../shared/requeue-run.js";
 import { INITIALIZATION_ERROR, INVALID_ARGUMENT, RESOURCE_NOT_FOUND } from "../../../errors/index.js";
 import { DenoRedisAdapter, getRedisModule, NodeRedisAdapter, } from "../../../platform/adapters/redis/index.js";
 const logger = agentLogger.component("redis-backend");
+/**
+ * Atomic compare-and-delete: delete the lock only if it still holds our token.
+ * Server-side Lua (Redis EVAL) so the GET and DEL are one indivisible step,
+ * preventing a stale owner from deleting another worker's reacquired lock.
+ */
+const RELEASE_LOCK_SCRIPT = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
+/**
+ * Atomic compare-and-pexpire: extend the lock TTL only if it still holds our
+ * token. Same TOCTOU protection as the release script.
+ */
+const EXTEND_LOCK_SCRIPT = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('pexpire', KEYS[1], ARGV[2]) else return 0 end";
 /** Implement redis backend. */
 export class RedisBackend {
     client = null;
     connectionPromise = null;
     config;
     initialized = false;
+    /** Per-run lock tokens for ownership-checked release/extend (Redlock pattern). */
+    lockValues = new Map();
     constructor(config = {}) {
         this.config = {
             prefix: "vf:workflow:",
@@ -442,20 +455,40 @@ export class RedisBackend {
         const client = await this.ensureClient();
         const lockValue = dntShim.crypto.randomUUID();
         const result = await client.set(this.lockKey(runId), lockValue, { nx: true, px: duration });
-        return result === "OK";
+        if (result === "OK") {
+            // Remember our token so release/extend can verify ownership (Redlock).
+            this.lockValues.set(runId, lockValue);
+            return true;
+        }
+        return false;
     }
     async releaseLock(runId) {
         const client = await this.ensureClient();
-        await client.del(this.lockKey(runId));
+        const key = this.lockKey(runId);
+        const ourValue = this.lockValues.get(runId);
+        // Only release if we still own the lock (compare-and-delete). Without a
+        // known token we never owned it, so do nothing.
+        if (ourValue === undefined)
+            return;
+        // Atomic GET + DEL via Lua so a stale owner cannot delete a lock that was
+        // reacquired by another worker between the check and the delete (TOCTOU).
+        await client.eval(RELEASE_LOCK_SCRIPT, [key], [ourValue]);
+        this.lockValues.delete(runId);
     }
     async extendLock(runId, duration) {
         const client = await this.ensureClient();
         const key = this.lockKey(runId);
-        const exists = await client.exists(key);
-        if (exists === 0)
+        const ourValue = this.lockValues.get(runId);
+        // Only extend if we still own the lock (compare-and-pexpire).
+        if (ourValue === undefined)
             return false;
-        await client.expire(key, Math.ceil(duration / 1000));
-        return true;
+        // Atomic GET + PEXPIRE via Lua. PEXPIRE returns 1 when the key existed and
+        // the TTL was set, 0 otherwise (e.g. our token no longer owns the lock).
+        const result = await client.eval(EXTEND_LOCK_SCRIPT, [key], [
+            ourValue,
+            String(duration),
+        ]);
+        return Number(result) === 1;
     }
     async isLocked(runId) {
         const client = await this.ensureClient();

package/esm/src/workflow/executor/dag/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/executor/dag/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAYV,YAAY,EAEZ,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAIxB,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7F,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAGlB,MAAM,YAAY,CAAC;AAIpB,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,iBAAiB;IAQ/B,OAAO,CACX,KAAK,EAAE,YAAY,EAAE,EACrB,GAAG,EAAE,WAAW,EAChB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;YAsGhB,WAAW;YA8CX,eAAe;YA0Bf,mBAAmB;YA0CnB,cAAc;YAmGd,iBAAiB;YA6DjB,eAAe;YA8Bf,sBAAsB;YA+DtB,eAAe;YA6If,UAAU;CAoBzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/executor/dag/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAYV,YAAY,EAEZ,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAIxB,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7F,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAGlB,MAAM,YAAY,CAAC;AAIpB,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,iBAAiB;IAQ/B,OAAO,CACX,KAAK,EAAE,YAAY,EAAE,EACrB,GAAG,EAAE,WAAW,EAChB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;YAsGhB,WAAW;YA8CX,eAAe;YA0Bf,mBAAmB;YA4CnB,cAAc;YAqGd,iBAAiB;YA+DjB,eAAe;YA8Bf,sBAAsB;YA+DtB,eAAe;YAsKf,UAAU;CAoBzB"}

package/esm/src/workflow/executor/dag/index.js

@@ -160,7 +160,9 @@ export class DAGExecutor {
             workflowId: "",
             status: "running",
             input: context.input,
-            nodeStates: {},
+            // Carry already-accumulated child states so completed children are
+            // skipped on resume instead of re-executing (H8).
+            nodeStates,
             currentNodes: [],
             context,
             checkpoints: [],
@@ -232,7 +234,9 @@ export class DAGExecutor {
                 workflowId: "",
                 status: "running",
                 input: context.input,
-                nodeStates: {},
+                // Carry already-accumulated child states so completed children are
+                // skipped on resume instead of re-executing (H8).
+                nodeStates,
                 currentNodes: [],
                 context: { ...context },
                 checkpoints: [],
@@ -281,7 +285,9 @@ export class DAGExecutor {
             workflowId: "",
             status: "running",
             input: context.input,
-            nodeStates: {},
+            // Carry already-accumulated child states so completed children are
+            // skipped on resume instead of re-executing (H8).
+            nodeStates,
             currentNodes: [],
             context,
             checkpoints: [],
@@ -384,9 +390,15 @@ export class DAGExecutor {
         let exitReason = "condition";
         let lastError;
         const existingLoopState = context[`${node.id}_loop_state`];
+        // Child node states for the in-flight (resumed) iteration, so its already
+        // completed steps are not re-executed on resume (H9).
+        let resumeIterationNodeStates;
+        let resumeIteration;
         if (existingLoopState) {
             iteration = existingLoopState.iteration;
             previousResults.push(...existingLoopState.previousResults);
+            resumeIterationNodeStates = existingLoopState.iterationNodeStates;
+            resumeIteration = existingLoopState.iteration;
         }
         while (iteration < config.maxIterations) {
             const loopContext = {
@@ -403,12 +415,19 @@ export class DAGExecutor {
             const steps = typeof config.steps === "function"
                 ? config.steps(context, loopContext)
                 : config.steps;
+            // On resume, rehydrate the in-flight iteration's child node states so its
+            // already-completed steps are skipped instead of re-executed (H9).
+            const iterationNodeStates = resumeIteration === iteration && resumeIterationNodeStates
+                ? { ...resumeIterationNodeStates }
+                : {};
+            // Only rehydrate once; subsequent iterations start fresh.
+            resumeIterationNodeStates = undefined;
             const result = await this.execute(steps, {
                 id: `${node.id}_iter_${iteration}`,
                 workflowId: "",
                 status: "running",
                 input: context.input,
-                nodeStates: {},
+                nodeStates: iterationNodeStates,
                 currentNodes: [],
                 context: { ...context, _loop: loopContext },
                 checkpoints: [],
@@ -428,7 +447,13 @@ export class DAGExecutor {
                     state,
                     contextUpdates: {
                         ...result.context,
-                        [`${node.id}_loop_state`]: { iteration, previousResults },
+                        [`${node.id}_loop_state`]: {
+                            iteration,
+                            previousResults,
+                            // Persist the in-flight iteration's child states so completed
+                            // steps are not re-executed when this iteration resumes (H9).
+                            iterationNodeStates: result.nodeStates,
+                        },
                     },
                     waiting: true,
                 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.614",
+  "version": "0.1.616",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -73,6 +73,10 @@
       "import": "./esm/src/agent/index.js",
       "types": "./esm/src/agent/index.d.ts"
     },
+    "./agent/identity": {
+      "import": "./esm/src/agent/identity-contracts.js",
+      "types": "./esm/src/agent/identity-contracts.d.ts"
+    },
     "./agent/testing": {
       "import": "./esm/src/agent/testing/index.js",
       "types": "./esm/src/agent/testing/index.d.ts"