veryfront 0.1.656 → 0.1.657

package/esm/src/mcp/server.d.ts

@@ -34,6 +34,7 @@ export declare class MCPServer {
     private sessionManager;
     private taskStore;
     private pendingTasks;
+    private pendingRequestAbortControllers;
     private clientCapabilities;
     private sessionCapabilities;
     /** Callback for server-initiated notifications. Set by transport layer. */
@@ -60,15 +61,11 @@ export declare class MCPServer {
     notifyResourcesChanged(): void;
     notifyPromptsChanged(): void;
     /**
-     * Configure integration tools to be loaded from the API.
-     *
-     * When API-side integration tools are available (apiBaseUrl + apiToken),
-     * tools are loaded remotely via the API's /integrations/tools/list endpoint.
-     * Otherwise falls back to the legacy local loading path.
+     * Configure API-backed integration tool loading.
      */
     setIntegrationLoader(config: IntegrationLoaderConfig): void;
     clientSupportsElicitation(mode: "form" | "url", sessionId?: string): boolean;
-    handleRequest(request: JSONRPCRequest, context?: ToolExecutionContext): Promise<JSONRPCResponse>;
+    handleRequest(request: JSONRPCRequest, context?: ToolExecutionContext, sessionId?: string): Promise<JSONRPCResponse>;
     private dispatch;
     private initialize;
     private listTools;
@@ -80,6 +77,7 @@ export declare class MCPServer {
     private getPrompt;
     private complete;
     private setLogLevel;
+    private cancelRequest;
     private getTask;
     private getTaskResult;
     private cancelTask;

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAIjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA2CzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAOD,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,2BAA2B;AAC3B,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CASd;IACX,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;gBAElF,MAAM,EAAE,eAAe;IAWnC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAyCjC,kBAAkB,IAAI,IAAI;IAI1B,sBAAsB,IAAI,IAAI;IAI9B,oBAAoB,IAAI,IAAI;IAI5B;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAY5E,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmBhG,OAAO,CAAC,QAAQ;IAiDhB,OAAO,CAAC,UAAU;YAgCJ,SAAS;IAgCvB,OAAO,CAAC,QAAQ;IAiHhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,SAAS;IAIjB,0EAA0E;IAC1E,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpC,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAiB5D,OAAO,CAAC,qBAAqB;YAWf,YAAY;IAoB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CA6BzC;AAED,wBAAwB;AACxB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAIjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA2CzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAWD,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,2BAA2B;AAC3B,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CASd;IACX,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,8BAA8B,CAAsC;IAC5E,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;gBAElF,MAAM,EAAE,eAAe;IAWnC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAyCjC,kBAAkB,IAAI,IAAI;IAI1B,sBAAsB,IAAI,IAAI;IAI9B,oBAAoB,IAAI,IAAI;IAI5B;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAY5E,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,EAC9B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC;IAyB3B,OAAO,CAAC,QAAQ;IAkDhB,OAAO,CAAC,UAAU;YAgCJ,SAAS;IAgCvB,OAAO,CAAC,QAAQ;IA0IhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,SAAS;IAIjB,0EAA0E;IAC1E,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpC,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAkB5D,OAAO,CAAC,qBAAqB;YAWf,YAAY;IAoB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CA6BzC;AAED,wBAAwB;AACxB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -48,6 +48,9 @@ function readAllowedHeader(request, headerName, pattern) {
     }
     return value;
 }
+function pendingRequestKey(requestId, sessionId) {
+    return JSON.stringify([sessionId ?? null, typeof requestId, requestId]);
+}
 const MCP_SUPPORTED_VERSIONS = ["2025-11-25", "2024-11-05"];
 /** Implement mcpserver. */
 export class MCPServer {
@@ -68,6 +71,7 @@ export class MCPServer {
     sessionManager = new SessionManager();
     taskStore = new TaskStore();
     pendingTasks = new Map();
+    pendingRequestAbortControllers = new Map();
     clientCapabilities = {};
     sessionCapabilities = new Map();
     /** Callback for server-initiated notifications. Set by transport layer. */
@@ -127,11 +131,7 @@ export class MCPServer {
         this.onNotification?.({ jsonrpc: "2.0", method: "notifications/prompts/list_changed" });
     }
     /**
-     * Configure integration tools to be loaded from the API.
-     *
-     * When API-side integration tools are available (apiBaseUrl + apiToken),
-     * tools are loaded remotely via the API's /integrations/tools/list endpoint.
-     * Otherwise falls back to the legacy local loading path.
+     * Configure API-backed integration tool loading.
      */
     setIntegrationLoader(config) {
         this.integrationLoader = config;
@@ -150,10 +150,10 @@ export class MCPServer {
             return true;
         return mode in elicitation;
     }
-    handleRequest(request, context) {
+    handleRequest(request, context, sessionId) {
         return withSpan("mcp.handleRequest", async () => {
             try {
-                const result = await this.dispatch(request.method, request.params, context);
+                const result = await this.dispatch(request.method, request.params, context, request.id, sessionId);
                 return { jsonrpc: "2.0", id: request.id, result };
             }
             catch (error) {
@@ -165,12 +165,12 @@ export class MCPServer {
             }
         }, { "mcp.method": request.method });
     }
-    dispatch(method, params, context) {
+    dispatch(method, params, context, requestId, sessionId) {
         switch (method) {
             case "tools/list":
                 return this.listTools(params);
             case "tools/call":
-                return this.callTool(params, context);
+                return this.callTool(params, context, requestId, sessionId);
             case "resources/list":
                 return this.listResources(params);
             case "resources/read":
@@ -186,8 +186,7 @@ export class MCPServer {
             case "notifications/initialized":
                 return Promise.resolve({});
             case "notifications/cancelled":
-                // TODO(#841): propagate cancellation to in-flight tool executions via AbortController
-                return Promise.resolve({});
+                return this.cancelRequest(params, sessionId);
             case "completion/complete":
                 return this.complete(params);
             case "logging/setLevel":
@@ -265,7 +264,7 @@ export class MCPServer {
         }
         return { tools };
     }
-    callTool(params, context) {
+    callTool(params, context, requestId, sessionId) {
         const p = toParamsRecord(params);
         const { name, arguments: args } = p;
         const meta = (p._meta ?? {});
@@ -345,8 +344,23 @@ export class MCPServer {
             return Promise.resolve({ task });
         }
         return withSpan("mcp.callTool", async () => {
+            const abortController = requestId === undefined ? undefined : new AbortController();
+            const outerAbortSignal = toolContext?.abortSignal;
+            const abortFromOuterSignal = () => abortController?.abort();
+            if (abortController) {
+                if (outerAbortSignal?.aborted) {
+                    abortController.abort();
+                }
+                else {
+                    outerAbortSignal?.addEventListener("abort", abortFromOuterSignal, { once: true });
+                }
+                this.pendingRequestAbortControllers.set(pendingRequestKey(requestId, sessionId), abortController);
+            }
+            const foregroundToolContext = abortController
+                ? { ...toolContext, abortSignal: abortController.signal }
+                : toolContext;
             try {
-                const result = await executeTool(toolName, args, toolContext);
+                const result = await executeTool(toolName, args, foregroundToolContext);
                 return {
                     content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
                     isError: false,
@@ -359,6 +373,12 @@ export class MCPServer {
                     isError: true,
                 };
             }
+            finally {
+                if (requestId !== undefined) {
+                    this.pendingRequestAbortControllers.delete(pendingRequestKey(requestId, sessionId));
+                }
+                outerAbortSignal?.removeEventListener("abort", abortFromOuterSignal);
+            }
         }, { "mcp.tool.name": toolName });
     }
     listResourceTemplates(_params) {
@@ -481,6 +501,14 @@ export class MCPServer {
         this.logLevel = level;
         return Promise.resolve({});
     }
+    cancelRequest(params, sessionId) {
+        const { requestId } = toParamsRecord(params);
+        if (typeof requestId !== "string" && typeof requestId !== "number") {
+            return Promise.resolve({});
+        }
+        this.pendingRequestAbortControllers.get(pendingRequestKey(requestId, sessionId))?.abort();
+        return Promise.resolve({});
+    }
     getTask(params) {
         const { taskId } = toParamsRecord(params);
         if (!taskId) {
@@ -532,7 +560,7 @@ export class MCPServer {
             authEnabled: this.config.auth.type !== "none",
             getCORSHeaders: (requestOrigin) => this.getCORSHeaders(requestOrigin),
             validateAuth: (request) => this.validateAuth(request),
-            handleRequest: (request, context) => this.handleRequest(request, context),
+            handleRequest: (request, context, sessionId) => this.handleRequest(request, context, sessionId),
             extractRequestContext: (request) => this.extractRequestContext(request),
             isOriginAllowed: (requestOrigin) => !requestOrigin ||
                 !this.config.cors?.enabled ||

package/esm/src/resource/index.d.ts

@@ -6,7 +6,7 @@
  * @example
  * ```ts
  * import { resource } from "veryfront/resource";
- * import { z } from "zod";
+ * import { defineSchema } from "veryfront/schemas";
  *
  * const docsBySection: Record<string, string> = {
  *   agents: "Agents accept messages, tools, context, and runtime options.",
@@ -16,7 +16,7 @@
  * const docs = resource({
  *   pattern: "docs/:section",
  *   description: "API documentation",
- *   paramsSchema: z.object({ section: z.string() }),
+ *   paramsSchema: defineSchema((v) => v.object({ section: v.string() }))(),
  *   load: ({ section }) => {
  *     return { content: docsBySection[section] ?? "Section not found." };
  *   },

package/esm/src/resource/index.js

@@ -6,7 +6,7 @@
  * @example
  * ```ts
  * import { resource } from "veryfront/resource";
- * import { z } from "zod";
+ * import { defineSchema } from "veryfront/schemas";
  *
  * const docsBySection: Record<string, string> = {
  *   agents: "Agents accept messages, tools, context, and runtime options.",
@@ -16,7 +16,7 @@
  * const docs = resource({
  *   pattern: "docs/:section",
  *   description: "API documentation",
- *   paramsSchema: z.object({ section: z.string() }),
+ *   paramsSchema: defineSchema((v) => v.object({ section: v.string() }))(),
  *   load: ({ section }) => {
  *     return { content: docsBySection[section] ?? "Section not found." };
  *   },

package/esm/src/resource/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/src/resource/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAK7E,cAAM,gBAAiB,SAAQ,oBAAoB,CAAC,QAAQ,CAAC;IAC3D,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAOhD,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAIpB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAInE,IAAI,IAAI,MAAM,EAAE;CAGjB;AAED,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,kBAAgD,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/src/resource/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS7E,cAAM,gBAAiB,SAAQ,oBAAoB,CAAC,QAAQ,CAAC;IAC3D,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAOhD,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,YAAY;IAIpB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAInE,IAAI,IAAI,MAAM,EAAE;CAGjB;AAED,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,kBAAgD,CAAC"}

package/esm/src/resource/registry.js

@@ -9,6 +9,9 @@
 import { ScopedRegistryFacade } from "../registry/scoped-registry-facade.js";
 import { ProjectScopedRegistryManager } from "../registry/project-scoped-registry-manager.js";
 const resourceRegistryManager = new ProjectScopedRegistryManager("resource");
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 class ResourceRegistry extends ScopedRegistryFacade {
     findByPattern(uri) {
         for (const resource of this.getAll().values()) {
@@ -18,7 +21,8 @@ class ResourceRegistry extends ScopedRegistryFacade {
         return undefined;
     }
     patternToRegex(pattern) {
-        return new RegExp(`^${pattern.replace(/:(\w+)/g, "(?<$1>[^/]+)")}$`);
+        const escapedPattern = escapeRegExp(pattern).replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, "(?<$1>[^/]+)");
+        return new RegExp(`^${escapedPattern}$`);
     }
     matchPattern(uri, pattern) {
         return uri.match(this.patternToRegex(pattern));

package/esm/src/routing/api/module-loader/external-import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AASjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAkChB,CAAC;AAEX,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,+FAA+F;AAC/F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;CACpB;AAoCD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAmC7C;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAa,GACtD,MAAM,CAgGR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}
+{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAUjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAkChB,CAAC;AAEX,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,+FAA+F;AAC/F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;CACpB;AAoCD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAmC7C;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAa,GACtD,MAAM,CAgGR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}

package/esm/src/routing/api/module-loader/external-import-rewriter.js

@@ -2,6 +2,7 @@ import { isCompiledBinary, serverLogger } from "../../../utils/index.js";
 import * as pathHelper from "../../../platform/compat/path/index.js";
 import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { rewriteNpmImports } from "../../../transforms/npm-import-rewrites.js";
+import { parseImports, replaceSpecifiers } from "../../../transforms/esm/lexer.js";
 import { isWithinDirectory } from "../../../security/path-validation.js";
 import { resolveExportEntry, toCjsDestructureBindings } from "./loader-helpers.js";
 const logger = serverLogger.component("api");
@@ -256,66 +257,57 @@ export async function loadVeryfrontExportsMap(projectDir, fs) {
 }
 export async function rewriteNodeExternalImports(code, projectDir, fs, userDeps) {
     const { pathToFileURL } = await import("node:url");
-    let transformed = code;
+    const replacements = new Map();
     logger.debug(`Rewriting external imports for Node.js, projectDir: ${projectDir}`);
-    for (const pkg of getNodeExternalPackagesToResolve(userDeps)) {
-        const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        const staticImportRegex = new RegExp(`from\\s*["']${escapedPkg}(/[^"']*)?["']`, "g");
-        const dynamicImportRegex = new RegExp(`import\\s*\\(\\s*["']${escapedPkg}(/[^"']*)?["']\\s*\\)`, "g");
-        const needsStatic = staticImportRegex.test(transformed);
-        staticImportRegex.lastIndex = 0;
-        const needsDynamic = dynamicImportRegex.test(transformed);
-        dynamicImportRegex.lastIndex = 0;
-        if (!needsStatic && !needsDynamic)
+    const importedSpecifiers = new Set((await parseImports(code))
+        .map((imp) => imp.n)
+        .filter((specifier) => typeof specifier === "string"));
+    const packages = getNodeExternalPackagesToResolve(userDeps);
+    for (const specifier of importedSpecifiers) {
+        const pkg = packages.find((name) => specifier === name || specifier.startsWith(`${name}/`));
+        if (!pkg)
+            continue;
+        const subpath = specifier.slice(pkg.length);
+        if (subpath) {
+            const packageDir = pathToFileURL(pathHelper.join(projectDir, "node_modules", pkg)).href;
+            const resolvedSubpath = `${packageDir}${subpath}`;
+            logger.debug(`Resolved ${specifier} -> ${resolvedSubpath}`);
+            replacements.set(specifier, resolvedSubpath);
             continue;
-        const packageDir = pathToFileURL(pathHelper.join(projectDir, "node_modules", pkg)).href;
-        const resolvedUrl = await resolveNodePackageToFileUrl(projectDir, pkg, fs, pathToFileURL);
-        if (needsStatic) {
-            transformed = transformed.replace(staticImportRegex, (_, subpath) => {
-                if (subpath) {
-                    const subUrl = `${packageDir}${subpath}`;
-                    logger.debug(`Resolved ${pkg}${subpath} -> ${subUrl}`);
-                    return `from "${subUrl}"`;
-                }
-                if (!resolvedUrl)
-                    return `from "${pkg}"`;
-                logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
-                return `from "${resolvedUrl}"`;
-            });
-        }
-        if (needsDynamic) {
-            transformed = transformed.replace(dynamicImportRegex, (_, subpath) => {
-                if (subpath) {
-                    return `import("${packageDir}${subpath}")`;
-                }
-                if (!resolvedUrl)
-                    return `import("${pkg}")`;
-                return `import("${resolvedUrl}")`;
-            });
         }
+        const resolvedUrl = await resolveNodePackageToFileUrl(projectDir, pkg, fs, pathToFileURL);
+        if (!resolvedUrl)
+            continue;
+        logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
+        replacements.set(specifier, resolvedUrl);
     }
     const vfPackagePath = pathHelper.join(projectDir, "node_modules", "veryfront");
     const exportsMap = await loadVeryfrontExportsMap(projectDir, fs);
-    transformed = transformed.replace(/from\s+["'](veryfront\/[^"']+)["']/g, (match, fullSpecifier) => {
-        const subpath = "./" + fullSpecifier.replace("veryfront/", "");
-        const exportEntry = exportsMap[subpath];
-        if (!exportEntry?.import) {
-            logger.warn(`No export found for ${subpath}`);
-            return match;
+    for (const specifier of importedSpecifiers) {
+        if (specifier === "veryfront") {
+            const exportEntry = exportsMap["."];
+            if (!exportEntry?.import)
+                continue;
+            const resolvedPath = pathHelper.join(vfPackagePath, exportEntry.import);
+            logger.debug(`Resolved veryfront -> ${resolvedPath}`);
+            replacements.set(specifier, pathToFileURL(resolvedPath).href);
+            continue;
         }
-        const resolvedPath = pathHelper.join(vfPackagePath, exportEntry.import);
-        logger.debug(`Resolved ${fullSpecifier} -> ${resolvedPath}`);
-        return `from "${pathToFileURL(resolvedPath).href}"`;
-    });
-    transformed = transformed.replace(/from\s+["']veryfront["']/g, () => {
-        const exportEntry = exportsMap["."];
-        if (!exportEntry?.import)
-            return 'from "veryfront"';
-        const resolvedPath = pathHelper.join(vfPackagePath, exportEntry.import);
-        logger.debug(`Resolved veryfront -> ${resolvedPath}`);
-        return `from "${pathToFileURL(resolvedPath).href}"`;
-    });
-    return transformed;
+        if (specifier.startsWith("veryfront/")) {
+            const subpath = "./" + specifier.replace("veryfront/", "");
+            const exportEntry = exportsMap[subpath];
+            if (!exportEntry?.import) {
+                logger.warn(`No export found for ${subpath}`);
+                continue;
+            }
+            const resolvedPath = pathHelper.join(vfPackagePath, exportEntry.import);
+            logger.debug(`Resolved ${specifier} -> ${resolvedPath}`);
+            replacements.set(specifier, pathToFileURL(resolvedPath).href);
+        }
+    }
+    if (replacements.size === 0)
+        return code;
+    return await replaceSpecifiers(code, (specifier) => replacements.get(specifier));
 }
 export function rewriteCompiledBinaryVeryfrontImports(code) {
     let transformed = code;
@@ -380,9 +372,15 @@ export function rewriteCompiledBinaryUserDependencyImports(code, userDeps, esmDe
     return transformed;
 }
 export async function rewriteDenoNpmDependencyImports(code, projectDir, fs, userDeps) {
-    let transformed = code;
-    for (const [name, version] of userDeps) {
-        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const importedSpecifiers = new Set((await parseImports(code))
+        .map((imp) => imp.n)
+        .filter((specifier) => typeof specifier === "string"));
+    const replacements = new Map();
+    for (const specifier of importedSpecifiers) {
+        const entry = [...userDeps].find(([name]) => specifier === name || specifier.startsWith(`${name}/`));
+        if (!entry)
+            continue;
+        const [name, version] = entry;
         let resolvedVersion = version;
         try {
             const pkgPath = pathHelper.join(projectDir, "node_modules", name, "package.json");
@@ -394,10 +392,12 @@ export async function rewriteDenoNpmDependencyImports(code, projectDir, fs, user
         catch (_) {
             /* expected: installed package.json may not exist, fall back to declared range */
         }
-        transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}(/[^"']*)?["']`, "g"), (_, subpath) => `from "npm:${name}@${resolvedVersion}${subpath || ""}"`);
-        transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"), (_, subpath) => `import("npm:${name}@${resolvedVersion}${subpath || ""}")`);
+        const subpath = specifier.slice(name.length);
+        replacements.set(specifier, `npm:${name}@${resolvedVersion}${subpath}`);
     }
-    return transformed;
+    if (replacements.size === 0)
+        return code;
+    return await replaceSpecifiers(code, (specifier) => replacements.get(specifier));
 }
 export function rewriteDenoNodeBuiltinImports(code) {
     let transformed = code;

package/esm/src/security/client/html-sanitizer.d.ts

@@ -1,5 +1,6 @@
 import { escapeHtml } from "../../html/html-escape.js";
 export { escapeHtml };
+export declare function buildTrustedHtmlValidatorScript(): string;
 interface ValidateTrustedHtmlOptions {
     /** Throw on suspicious patterns even in dev mode */
     strict?: boolean;

package/esm/src/security/client/html-sanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-sanitizer.d.ts","sourceRoot":"","sources":["../../../../src/src/security/client/html-sanitizer.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,CAAC;AA4BtB,UAAU,0BAA0B;IAClC,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtC,GAAG,cAAc,CA+BjB"}
+{"version":3,"file":"html-sanitizer.d.ts","sourceRoot":"","sources":["../../../../src/src/security/client/html-sanitizer.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,CAAC;AA6BtB,wBAAgB,+BAA+B,IAAI,MAAM,CAwBxD;AAiBD,UAAU,0BAA0B;IAClC,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtC,GAAG,cAAc,CA+BjB"}

package/esm/src/security/client/html-sanitizer.js

@@ -13,12 +13,50 @@ export { escapeHtml };
  * Patterns that RSC should never generate.
  * These indicate potential server compromise or misconfiguration.
  */
-const SUSPICIOUS_PATTERNS = [
-    { pattern: /<script[^>]*>[\s\S]*?<\/script>/gi, name: "inline script" },
-    { pattern: /javascript:/gi, name: "javascript: URL" },
-    { pattern: /\bon\w+\s*=/gi, name: "event handler attribute" },
-    { pattern: /data:\s*text\/html/gi, name: "data: HTML URL" },
+const SUSPICIOUS_PATTERN_SPECS = [
+    { source: String.raw `<script[^>]*>[\s\S]*?<\/script>`, flags: "gi", name: "inline script" },
+    { source: String.raw `javascript:`, flags: "gi", name: "javascript: URL" },
+    { source: String.raw `\bon\w+\s*=`, flags: "gi", name: "event handler attribute" },
+    { source: String.raw `data:\s*text\/html`, flags: "gi", name: "data: HTML URL" },
 ];
+function createSuspiciousPatterns() {
+    return SUSPICIOUS_PATTERN_SPECS.map(({ source, flags, name }) => ({
+        pattern: new RegExp(source, flags),
+        name,
+    }));
+}
+function jsonForInlineScript(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+export function buildTrustedHtmlValidatorScript() {
+    const specsJson = jsonForInlineScript(SUSPICIOUS_PATTERN_SPECS);
+    return `
+    function isDevMode() {
+      return window.__VERYFRONT_DEV__ === true;
+    }
+
+    const suspiciousHtmlPatterns = ${specsJson}.map(({ source, flags, name }) => ({
+      pattern: new RegExp(source, flags),
+      name,
+    }));
+
+    function validateTrustedHtml(html) {
+      for (const { pattern, name } of suspiciousHtmlPatterns) {
+        pattern.lastIndex = 0;
+        if (!pattern.test(html)) continue;
+        console.warn(\`[Security] Suspicious \${name} detected in server HTML\`);
+        if (!isDevMode()) throw new Error(\`Potentially unsafe HTML: \${name} detected\`);
+      }
+
+      return html;
+    }
+  `.trim();
+}
 function isDevMode() {
     const g = globalThis;
     return g.__VERYFRONT_DEV__ === true || g.Deno?.env?.get?.("VERYFRONT_ENV") === "development";
@@ -36,7 +74,7 @@ function isDevMode() {
  */
 export function validateTrustedHtml(html, options = {}) {
     const { strict = false, warn = true } = options;
-    for (const { pattern, name } of SUSPICIOUS_PATTERNS) {
+    for (const { pattern, name } of createSuspiciousPatterns()) {
         pattern.lastIndex = 0;
         if (!pattern.test(html))
             continue;

package/esm/src/server/services/rsc/endpoints/rsc-bundles.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-bundles.generated.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/endpoints/rsc-bundles.generated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,kBAAkB,EAAE,MACi11B,CAAC;AAEn31B,eAAO,MAAM,iBAAiB,EAAE,MAC40mB,CAAC"}
+{"version":3,"file":"rsc-bundles.generated.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/endpoints/rsc-bundles.generated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,kBAAkB,EAAE,MACw/1B,CAAC;AAE1h2B,eAAO,MAAM,iBAAiB,EAAE,MACm/mB,CAAC"}