veryfront 0.1.738 → 0.1.742

package/esm/cli/templates/manifest.js

@@ -39,9 +39,9 @@ export default {
                 "app/page.tsx": "'use client'\n\nimport { Chat, useChat } from 'veryfront/chat'\n\nexport default function CodeAgent(): JSX.Element {\n  const chat = useChat({ api: '/api/ag-ui' })\n\n  return (\n    <Chat\n      {...chat}\n      className=\"flex-1 min-h-0\"\n      placeholder=\"Describe what you want to build or fix...\"\n    />\n  )\n}\n",
                 "globals.css": "@import \"tailwindcss\";\n",
                 "README.md": "# Coding Agent\n\nAn AI assistant that can read, understand, and modify project files.\n\n## What's included\n\n- Coder agent with file system tools\n- Read, list, and edit files through conversation\n- Safe search/replace editing pattern\n\n## Structure\n\n```\nagents/coder.ts        Agent with coding instructions\ntools/\n  read-file.ts         Read file contents\n  list-files.ts        List directory contents\n  edit-file.ts         Search and replace in files\napp/\n  api/ag-ui/route.ts    AG-UI endpoint\n  page.tsx             Chat interface\n```\n\nThis starter is not production-ready.\n",
-                "tools/edit-file.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { readTextFile, writeTextFile, resolve, cwd } from \"veryfront/fs\";\n\nexport default tool({\n  id: \"edit-file\",\n  description: \"Edit a file by replacing a specific string with new content\",\n  inputSchema: defineSchema((v) => v.object({\n    path: v.string().describe(\"File path relative to the project root\"),\n    search: v.string().describe(\"Exact string to find in the file\"),\n    replace: v.string().describe(\"String to replace it with\"),\n  }))(),\n  execute: async ({ path, search, replace }) => {\n    const absolute = resolve(cwd(), path);\n\n    let content: string;\n    try {\n      content = await readTextFile(absolute);\n    } catch {\n      return { error: `File not found: ${path}` };\n    }\n\n    if (!content.includes(search)) {\n      return { error: \"Search string not found in file\" };\n    }\n\n    const updated = content.replace(search, replace);\n    await writeTextFile(absolute, updated);\n    return { path, success: true };\n  },\n});\n",
-                "tools/list-files.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { readDir, resolve, cwd } from \"veryfront/fs\";\n\nexport default tool({\n  id: \"list-files\",\n  description: \"List files in a project directory\",\n  inputSchema: defineSchema((v) => v.object({\n    directory: v\n      .string()\n      .default(\".\")\n      .describe(\"Directory path relative to project root\"),\n    extensions: v\n      .array(v.string())\n      .optional()\n      .describe(\"Filter by file extensions (e.g. ['.ts', '.tsx'])\"),\n  }))(),\n  execute: async ({ directory, extensions }) => {\n    const absolute = resolve(cwd(), directory);\n    const entries = await readDir(absolute);\n\n    let files = entries\n      .filter((e) => e.isFile)\n      .map((e) => e.name);\n\n    if (extensions?.length) {\n      files = files.filter((f) =>\n        extensions.some((ext) => f.endsWith(ext))\n      );\n    }\n\n    return { directory, files, count: files.length };\n  },\n});\n",
-                "tools/read-file.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { readTextFile, resolve, cwd } from \"veryfront/fs\";\n\nexport default tool({\n  id: \"read-file\",\n  description: \"Read the contents of a file in the project\",\n  inputSchema: defineSchema((v) => v.object({\n    path: v.string().describe(\"File path relative to the project root\"),\n  }))(),\n  execute: async ({ path }) => {\n    try {\n      const absolute = resolve(cwd(), path);\n      const content = await readTextFile(absolute);\n      return { path, content };\n    } catch {\n      return { error: `File not found: ${path}` };\n    }\n  },\n});\n",
+                "tools/edit-file.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { cwd, readTextFile, realPath, resolve, writeTextFile } from \"veryfront/fs\";\n\n/** True when `target` is the same as, or nested under, `root` (both canonical). */\nfunction isWithin(root: string, target: string): boolean {\n  const r = root.replace(/\\\\/g, \"/\");\n  const t = target.replace(/\\\\/g, \"/\");\n  return t === r || t.startsWith(`${r}/`);\n}\n\nexport default tool({\n  id: \"edit-file\",\n  description: \"Edit a file by replacing a specific string with new content\",\n  inputSchema: defineSchema((v) => v.object({\n    path: v.string().describe(\"File path relative to the project root\"),\n    search: v.string().describe(\"Exact string to find in the file\"),\n    replace: v.string().describe(\"String to replace it with\"),\n  }))(),\n  execute: async ({ path, search, replace }) => {\n    let projectDir: string;\n    let absolute: string;\n    try {\n      // Canonicalize both sides so a symlink that points outside the project\n      // is resolved to its real target before the containment check.\n      projectDir = await realPath(cwd());\n      absolute = await realPath(resolve(projectDir, path));\n    } catch {\n      return { error: `File not found: ${path}` };\n    }\n    if (!isWithin(projectDir, absolute)) {\n      return { error: `Path escapes project directory: ${path}` };\n    }\n\n    const content = await readTextFile(absolute);\n    if (!content.includes(search)) {\n      return { error: \"Search string not found in file\" };\n    }\n\n    const updated = content.replace(search, replace);\n    await writeTextFile(absolute, updated);\n    return { path, success: true };\n  },\n});\n",
+                "tools/list-files.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { cwd, readDir, realPath, resolve } from \"veryfront/fs\";\n\n/** True when `target` is the same as, or nested under, `root` (both canonical). */\nfunction isWithin(root: string, target: string): boolean {\n  const r = root.replace(/\\\\/g, \"/\");\n  const t = target.replace(/\\\\/g, \"/\");\n  return t === r || t.startsWith(`${r}/`);\n}\n\nexport default tool({\n  id: \"list-files\",\n  description: \"List files in a project directory\",\n  inputSchema: defineSchema((v) => v.object({\n    directory: v\n      .string()\n      .default(\".\")\n      .describe(\"Directory path relative to project root\"),\n    extensions: v\n      .array(v.string())\n      .optional()\n      .describe(\"Filter by file extensions (e.g. ['.ts', '.tsx'])\"),\n  }))(),\n  execute: async ({ directory, extensions }) => {\n    let projectDir: string;\n    let absolute: string;\n    try {\n      // Canonicalize both sides so a symlink that points outside the project\n      // is resolved to its real target before the containment check.\n      projectDir = await realPath(cwd());\n      absolute = await realPath(resolve(projectDir, directory));\n    } catch {\n      return { error: `Directory not found: ${directory}` };\n    }\n    if (!isWithin(projectDir, absolute)) {\n      return { error: `Path escapes project directory: ${directory}` };\n    }\n\n    const entries = await readDir(absolute);\n\n    let files = entries\n      .filter((e) => e.isFile)\n      .map((e) => e.name);\n\n    if (extensions?.length) {\n      files = files.filter((f) =>\n        extensions.some((ext) => f.endsWith(ext))\n      );\n    }\n\n    return { directory, files, count: files.length };\n  },\n});\n",
+                "tools/read-file.ts": "import { tool } from \"veryfront/tool\";\nimport { defineSchema } from \"veryfront/schemas\";\nimport { cwd, readTextFile, realPath, resolve } from \"veryfront/fs\";\n\n/** True when `target` is the same as, or nested under, `root` (both canonical). */\nfunction isWithin(root: string, target: string): boolean {\n  const r = root.replace(/\\\\/g, \"/\");\n  const t = target.replace(/\\\\/g, \"/\");\n  return t === r || t.startsWith(`${r}/`);\n}\n\nexport default tool({\n  id: \"read-file\",\n  description: \"Read the contents of a file in the project\",\n  inputSchema: defineSchema((v) => v.object({\n    path: v.string().describe(\"File path relative to the project root\"),\n  }))(),\n  execute: async ({ path }) => {\n    let projectDir: string;\n    let absolute: string;\n    try {\n      // Canonicalize both sides so a symlink that points outside the project\n      // is resolved to its real target before the containment check.\n      projectDir = await realPath(cwd());\n      absolute = await realPath(resolve(projectDir, path));\n    } catch {\n      return { error: `File not found: ${path}` };\n    }\n    if (!isWithin(projectDir, absolute)) {\n      return { error: `Path escapes project directory: ${path}` };\n    }\n    const content = await readTextFile(absolute);\n    return { path, content };\n  },\n});\n",
                 "tsconfig.json": "{\n  \"compilerOptions\": {\n    \"target\": \"ES2022\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"jsx\": \"react-jsx\",\n    \"skipLibCheck\": true,\n    \"esModuleInterop\": true,\n    \"paths\": {\n      \"@/*\": [\"./*\"]\n    }\n  },\n  \"include\": [\"**/*.ts\", \"**/*.tsx\"],\n  \"exclude\": [\"node_modules\"]\n}\n"
             }
         },

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.738",
+    "version": "0.1.742",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/agent/ag-ui/sse-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/ag-ui/sse-parser.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;CAmBpB,CAAC;AAEX,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjG;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,GAChB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEhC;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAEvE;AAoLD,yGAAyG;AACzG,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CA6C3B"}
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/ag-ui/sse-parser.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;CAmBpB,CAAC;AAEX,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjG;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,GAChB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEhC;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAEvE;AAoLD,yGAAyG;AACzG,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAoD3B"}

package/esm/src/agent/ag-ui/sse-parser.js

@@ -197,20 +197,28 @@ export async function parseAgUiSseResponse(response, options = {}) {
     else {
         const reader = response.body.getReader();
         let buffer = "";
-        while (true) {
-            const result = await reader.read();
-            if (result.done) {
-                const tail = decoder.decode();
-                if (tail.length > 0) {
-                    rawChunks.push(tail);
-                    buffer += tail;
+        // try/finally so an error/abort mid-read still releases the reader lock;
+        // otherwise the underlying ReadableStream stays locked and the response
+        // body leaks.
+        try {
+            while (true) {
+                const result = await reader.read();
+                if (result.done) {
+                    const tail = decoder.decode();
+                    if (tail.length > 0) {
+                        rawChunks.push(tail);
+                        buffer += tail;
+                    }
+                    break;
                 }
-                break;
+                const decoded = decoder.decode(result.value, { stream: true });
+                rawChunks.push(decoded);
+                buffer += decoded;
+                buffer = consumeSseBuffer(run, buffer, options, state);
             }
-            const decoded = decoder.decode(result.value, { stream: true });
-            rawChunks.push(decoded);
-            buffer += decoded;
-            buffer = consumeSseBuffer(run, buffer, options, state);
+        }
+        finally {
+            reader.releaseLock();
         }
     }
     if (options.onProgress) {

package/esm/src/agent/hosted/child-tool-input.js

@@ -5,7 +5,7 @@ export const DEFAULT_HOSTED_CHILD_AGENT_ID = "invoke-agent-child";
 export const getHostedChildForkToolInputSchema = defineSchema((v) => v.object({
     description: v.string().describe("3-5 word task summary"),
     prompt: v.string().describe("Detailed instructions for the task"),
-    context: v.record(v.string(), getJsonValueSchema()).describe("Required structured data payload for the child task. Use this for critical facts, records, ids, decisions, and values the child must act on. Use {} only when the delegation has no record or evidence payload."),
+    context: v.record(v.string(), getJsonValueSchema()).default({}).describe("Structured data payload for the child task. Use this for critical facts, records, ids, decisions, and values the child must act on. Defaults to {} when the delegation has no record or evidence payload."),
     project_id: v.string().optional().describe("Override project context. Use after studio_open_project."),
     tools: v.array(v.string()).optional().describe("Tool subset for this fork. Omit = inherit all parent tools."),
     model: v.string().optional().describe('Model override (e.g. "sonnet" for cheaper work).'),

package/esm/src/agent/react/use-chat/streaming/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/agent/react/use-chat/streaming/handler.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAKV,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AA8BpB,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmDf;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAsCf"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/agent/react/use-chat/streaming/handler.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAKV,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AA8BpB,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAyDf;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA4Cf"}

package/esm/src/agent/react/use-chat/streaming/handler.js

@@ -21,41 +21,48 @@ export async function handleStreamingResponse(body, callbacks) {
     const state = createStreamingState();
     const getBuildParts = () => buildCurrentParts(state.textBlocks, state.reasoningBlocks, state.toolCalls, state.steps, state.dataParts);
     let buffer = "";
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
-        buffer = lines.pop() ?? ""; // last element may be incomplete
-        for (const line of lines) {
-            if (!line.startsWith("data: ") || !line.trim())
-                continue;
-            const data = line.slice(6);
-            try {
-                const raw = JSON.parse(data);
-                if (!raw || typeof raw !== "object")
+    // try/finally so a read error or a throwing event handler still releases
+    // the reader lock, otherwise the stream stays locked and leaks.
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop() ?? ""; // last element may be incomplete
+            for (const line of lines) {
+                if (!line.startsWith("data: ") || !line.trim())
                     continue;
-                const parsed = raw;
-                processStreamEvent(parsed, state, callbacks, getBuildParts);
-            }
-            catch (_) {
-                /* expected: skip malformed JSON in SSE stream */
+                const data = line.slice(6);
+                try {
+                    const raw = JSON.parse(data);
+                    if (!raw || typeof raw !== "object")
+                        continue;
+                    const parsed = raw;
+                    processStreamEvent(parsed, state, callbacks, getBuildParts);
+                }
+                catch (_) {
+                    /* expected: skip malformed JSON in SSE stream */
+                }
             }
         }
-    }
-    // Process any remaining buffered data
-    if (buffer.startsWith("data: ") && buffer.trim()) {
-        try {
-            const raw = JSON.parse(buffer.slice(6));
-            if (raw && typeof raw === "object") {
-                const parsed = raw;
-                processStreamEvent(parsed, state, callbacks, getBuildParts);
+        // Process any remaining buffered data
+        if (buffer.startsWith("data: ") && buffer.trim()) {
+            try {
+                const raw = JSON.parse(buffer.slice(6));
+                if (raw && typeof raw === "object") {
+                    const parsed = raw;
+                    processStreamEvent(parsed, state, callbacks, getBuildParts);
+                }
+            }
+            catch {
+                // Skip invalid JSON
             }
         }
-        catch {
-            // Skip invalid JSON
-        }
+    }
+    finally {
+        reader.releaseLock();
     }
 }
 export async function handleAgUiStreamingResponse(body, callbacks) {
@@ -69,18 +76,25 @@ export async function handleAgUiStreamingResponse(body, callbacks) {
             processChatStreamEvent(event, state, callbacks, getBuildParts);
         }
     };
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const decoded = decodeAgUiSseChunk(decoderState, decoder.decode(value, { stream: true }));
-        for (const event of decoded.events) {
+    // try/finally so a read error or a throwing event handler still releases
+    // the reader lock, otherwise the stream stays locked and leaks.
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const decoded = decodeAgUiSseChunk(decoderState, decoder.decode(value, { stream: true }));
+            for (const event of decoded.events) {
+                processDecodedEvents(event.chatEvents);
+            }
+        }
+        const flushed = flushAgUiSseChunk(decoderState);
+        for (const event of flushed.events) {
             processDecodedEvents(event.chatEvents);
         }
     }
-    const flushed = flushAgUiSseChunk(decoderState);
-    for (const event of flushed.events) {
-        processDecodedEvents(event.chatEvents);
+    finally {
+        reader.releaseLock();
     }
 }
 function processStreamEvent(parsed, state, callbacks, getBuildParts) {

package/esm/src/fs/index.d.ts

@@ -28,7 +28,7 @@
  * ```
  */
 import "../../_dnt.polyfills.js";
-export { createFileSystem, exists, type FileSystem, mkdir, readDir, readTextFile, remove, writeTextFile, } from "../platform/compat/fs.js";
+export { createFileSystem, exists, type FileSystem, mkdir, readDir, readTextFile, realPath, remove, writeTextFile, } from "../platform/compat/fs.js";
 export { basename, dirname, extname, join, resolve, } from "../platform/compat/path/index.js";
 export { cwd } from "../platform/compat/process.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/fs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/fs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,KAAK,UAAU,EACf,KAAK,EACL,OAAO,EACP,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,GACR,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/fs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,KAAK,UAAU,EACf,KAAK,EACL,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,GACR,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAC"}

package/esm/src/fs/index.js

@@ -28,6 +28,6 @@
  * ```
  */
 import "../../_dnt.polyfills.js";
-export { createFileSystem, exists, mkdir, readDir, readTextFile, remove, writeTextFile, } from "../platform/compat/fs.js";
+export { createFileSystem, exists, mkdir, readDir, readTextFile, realPath, remove, writeTextFile, } from "../platform/compat/fs.js";
 export { basename, dirname, extname, join, resolve, } from "../platform/compat/path/index.js";
 export { cwd } from "../platform/compat/process.js";

package/esm/src/mcp/http-transport.js

@@ -76,7 +76,7 @@ export function createMCPHTTPHandler(dependencies) {
             return createJSONResponse(rpcResponse, { headers: responseHeaders });
         }
         let sessionId;
-        if (sessionManager.size > 0) {
+        if (sessionManager.requiresSessionHeader()) {
             sessionId = request.headers.get("MCP-Session-Id") ?? undefined;
             if (!sessionId) {
                 return createJSONRPCErrorResponse(400, -32600, "Missing MCP-Session-Id header");

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAIjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA2CzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAWD,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,2BAA2B;AAC3B,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CASd;IACX,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,8BAA8B,CAAsC;IAC5E,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;gBAElF,MAAM,EAAE,eAAe;IAWnC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAyCjC,kBAAkB,IAAI,IAAI;IAI1B,sBAAsB,IAAI,IAAI;IAI9B,oBAAoB,IAAI,IAAI;IAI5B;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAY5E,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,EAC9B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC;IAyB3B,OAAO,CAAC,QAAQ;IAkDhB,OAAO,CAAC,UAAU;YAgCJ,SAAS;IAgCvB,OAAO,CAAC,QAAQ;IA0IhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,SAAS;IAIjB,0EAA0E;IAC1E,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpC,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAkB5D,OAAO,CAAC,qBAAqB;YAWf,YAAY;IAoB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CA6BzC;AAED,wBAAwB;AACxB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAIjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA2CzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAWD,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,2BAA2B;AAC3B,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CASd;IACX,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,8BAA8B,CAAsC;IAC5E,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;gBAElF,MAAM,EAAE,eAAe;IAWnC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAyCjC,kBAAkB,IAAI,IAAI;IAI1B,sBAAsB,IAAI,IAAI;IAI9B,oBAAoB,IAAI,IAAI;IAI5B;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAY5E,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,EAC9B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC;IAyB3B,OAAO,CAAC,QAAQ;IAkDhB,OAAO,CAAC,UAAU;YAgCJ,SAAS;IAgCvB,OAAO,CAAC,QAAQ;IA0IhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,WAAW;IAqBnB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,SAAS;IAIjB,0EAA0E;IAC1E,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpC,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAkB5D,OAAO,CAAC,qBAAqB;YAWf,YAAY;IAoB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CA6BzC;AAED,wBAAwB;AACxB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -493,10 +493,7 @@ export class MCPServer {
         const p = toParamsRecord(params);
         const level = p.level;
         if (!MCPServer.LOG_LEVELS.includes(level)) {
-            return Promise.reject({
-                code: -32602,
-                message: `Invalid log level: ${level}. Valid levels: ${MCPServer.LOG_LEVELS.join(", ")}`,
-            });
+            return Promise.reject(new JsonRpcError(-32602, `Invalid log level: ${level}. Valid levels: ${MCPServer.LOG_LEVELS.join(", ")}`));
         }
         this.logLevel = level;
         return Promise.resolve({});

package/esm/src/mcp/session.d.ts

@@ -1,9 +1,32 @@
+/**
+ * Manages MCP sessions for the Streamable HTTP transport.
+ * Sessions are created during initialization and validated on subsequent requests.
+ *
+ * Sessions expire after a period of inactivity so that clients which disconnect
+ * uncleanly (closed tab, crash, dropped network) don't leak entries forever.
+ * Expiry is lazy: stale entries are pruned on access, so no background timer is
+ * required.
+ */
+export interface SessionManagerOptions {
+    /** Inactivity TTL in ms (default 30 minutes). */
+    ttlMs?: number;
+    /** Clock, injectable for tests. Defaults to Date.now. */
+    now?: () => number;
+}
 export declare class SessionManager {
+    /** id -> last-seen timestamp (ms). */
     private sessions;
+    private readonly ttlMs;
+    private readonly now;
+    private sessionHeaderRequired;
+    constructor(options?: SessionManagerOptions);
     create(): string;
     isValid(id: string): boolean;
     terminate(id: string): void;
     get size(): number;
     clear(): void;
+    requiresSessionHeader(): boolean;
+    private isExpired;
+    private pruneExpired;
 }
 //# sourceMappingURL=session.d.ts.map

package/esm/src/mcp/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/session.ts"],"names":[],"mappings":"AAMA,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IAErC,MAAM,IAAI,MAAM;IAMhB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,cAAc;IACzB,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,OAAO,GAAE,qBAA0B;IAK/C,MAAM,IAAI,MAAM;IAQhB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAY5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAK3B,IAAI,IAAI,IAAI,MAAM,CAGjB;IAED,KAAK,IAAI,IAAI;IAKb,qBAAqB,IAAI,OAAO;IAIhC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;CAMrB"}

package/esm/src/mcp/session.js

@@ -1,25 +1,68 @@
 /**
  * Manages MCP sessions for the Streamable HTTP transport.
  * Sessions are created during initialization and validated on subsequent requests.
+ *
+ * Sessions expire after a period of inactivity so that clients which disconnect
+ * uncleanly (closed tab, crash, dropped network) don't leak entries forever.
+ * Expiry is lazy: stale entries are pruned on access, so no background timer is
+ * required.
  */
+/** Default inactivity window before a session is considered expired (30 min). */
 import * as dntShim from "../../_dnt.shims.js";
+const DEFAULT_SESSION_TTL_MS = 30 * 60_000;
 export class SessionManager {
-    sessions = new Set();
+    /** id -> last-seen timestamp (ms). */
+    sessions = new Map();
+    ttlMs;
+    now;
+    sessionHeaderRequired = false;
+    constructor(options = {}) {
+        this.ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
+        this.now = options.now ?? Date.now;
+    }
     create() {
+        this.pruneExpired();
         const id = dntShim.crypto.randomUUID();
-        this.sessions.add(id);
+        this.sessions.set(id, this.now());
+        this.sessionHeaderRequired = true;
         return id;
     }
     isValid(id) {
-        return this.sessions.has(id);
+        const lastSeen = this.sessions.get(id);
+        if (lastSeen === undefined)
+            return false;
+        if (this.isExpired(lastSeen)) {
+            this.sessions.delete(id);
+            return false;
+        }
+        // Touch: activity refreshes the inactivity window.
+        this.sessions.set(id, this.now());
+        return true;
     }
     terminate(id) {
         this.sessions.delete(id);
+        if (this.sessions.size === 0)
+            this.sessionHeaderRequired = false;
     }
     get size() {
+        this.pruneExpired();
         return this.sessions.size;
     }
     clear() {
         this.sessions.clear();
+        this.sessionHeaderRequired = false;
+    }
+    requiresSessionHeader() {
+        return this.sessionHeaderRequired;
+    }
+    isExpired(lastSeen) {
+        return this.now() - lastSeen > this.ttlMs;
+    }
+    pruneExpired() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [id, lastSeen] of this.sessions) {
+            if (lastSeen < cutoff)
+                this.sessions.delete(id);
+        }
     }
 }

package/esm/src/modules/manifest/route-module-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-module-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/manifest/route-module-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAuBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,UAAQ,GAChB,IAAI,CAEN;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,eAAe,GAAE,MAAM,EAAO,GAC7B,IAAI,CAwCN;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,IAAI,CAYtB;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAOV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,IAAI,CA2BN;AAED,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,SAAK,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,IAAI;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E,CAcA;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAS/D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC"}
+{"version":3,"file":"route-module-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/manifest/route-module-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAyBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,UAAQ,GAChB,IAAI,CAEN;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,eAAe,GAAE,MAAM,EAAO,GAC7B,IAAI,CAwCN;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,IAAI,CAYtB;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAOV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,IAAI,CA2BN;AAED,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,SAAK,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,IAAI;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E,CAcA;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAU/D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC"}

package/esm/src/modules/manifest/route-module-manifest.js

@@ -10,9 +10,16 @@
  * @module module-system/manifest/route-module-manifest
  */
 import { serverLogger } from "../../utils/index.js";
+import { LRUCache } from "../../utils/lru-wrapper.js";
 const logger = serverLogger.component("route-module-manifest");
-const manifestStore = new Map();
-const pendingCollections = new Map();
+/** Bound on tracked routes; manifests are a regenerable preload optimization. */
+const MAX_TRACKED_ROUTES = 2_000;
+/** Bound on in-flight collections; abandoned ones (render errors) get evicted. */
+const MAX_PENDING_COLLECTIONS = 2_000;
+const manifestStore = new LRUCache({ maxEntries: MAX_TRACKED_ROUTES });
+const pendingCollections = new LRUCache({
+    maxEntries: MAX_PENDING_COLLECTIONS,
+});
 function buildKey(projectSlug, route) {
     return `${projectSlug ?? "default"}:${route || "index"}`;
 }
@@ -132,7 +139,7 @@ export function generateModulePreloadHintsFromManifest(projectSlug, route, maxHi
 export function getManifestStats() {
     const routes = [];
     let totalModules = 0;
-    for (const [key, manifest] of manifestStore) {
+    for (const [key, manifest] of manifestStore.entries()) {
         routes.push({
             route: key,
             moduleCount: manifest.moduleCount,
@@ -144,7 +151,8 @@ export function getManifestStats() {
 }
 export function clearProjectManifests(projectSlug) {
     const prefix = `${projectSlug}:`;
-    for (const key of manifestStore.keys()) {
+    // Snapshot keys before deleting to avoid mutating during iteration.
+    for (const key of [...manifestStore.keys()]) {
         if (!key.startsWith(prefix))
             continue;
         manifestStore.delete(key);

package/esm/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-project-import-loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,UAAU,uBAAuB;IAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,IAAI,UAAU,CAAC;CACrB;AAED,UAAU,sCAAsC;IAC9C,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,OAAO,EAAE,IAAI,CACX,sBAAsB,EACtB,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAC/E,CAAC;IACF,KAAK,EAAE,uBAAuB,CAAC;IAC/B,qBAAqB,EAAE,CAAC,CAAC,EACvB,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,cAAc,CAAC;IAC3C,iBAAiB,CAAC,EAAE,OAAO,aAAa,CAAC;IACzC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,sCAAsC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0GjB"}
+{"version":3,"file":"cross-project-import-loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAGzD,UAAU,uBAAuB;IAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,IAAI,UAAU,CAAC;CACrB;AAED,UAAU,sCAAsC;IAC9C,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,OAAO,EAAE,IAAI,CACX,sBAAsB,EACtB,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAC/E,CAAC;IACF,KAAK,EAAE,uBAAuB,CAAC;IAC/B,qBAAqB,EAAE,CAAC,CAAC,EACvB,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,cAAc,CAAC;IAC3C,iBAAiB,CAAC,EAAE,OAAO,aAAa,CAAC;IACzC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,sCAAsC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0GjB"}

package/esm/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.js

@@ -7,6 +7,7 @@ import { HTTP_FETCH_TIMEOUT_MS } from "../../../utils/constants/http.js";
 import { writeCacheFile } from "../../../utils/cache-file-ops.js";
 import { rendererLogger as logger } from "../../../utils/index.js";
 import { globalCrossProjectCache } from "./cache/index.js";
+import { readLimitedCrossProjectSource } from "../../server/cross-project-source-limit.js";
 function getRegistryBaseUrl(apiBaseUrl) {
     const resolvedApiBaseUrl = apiBaseUrl || getApiBaseUrlEnv();
     return resolvedApiBaseUrl.replace(/\/api\/?$/, "");
@@ -40,7 +41,7 @@ export async function transformCrossProjectImportFlow(flowOptions) {
                 detail: `Failed to fetch ${registryUrl}: ${response.status} ${response.statusText}`,
             });
         }
-        const sourceCode = await response.text();
+        const sourceCode = await readLimitedCrossProjectSource(response, registryUrl);
         const contentHash = await cache.hashContentAsync(sourceCode);
         const ext = path.match(/\.(tsx?|jsx?|mdx)$/)?.[0] ?? ".tsx";
         const syntheticFilePath = `cross-project/${projectRef}/@/${path}`;

package/esm/src/modules/server/cross-project-source-limit.d.ts

@@ -0,0 +1,7 @@
+/** Max size of a fetched cross-project module source, to bound memory use. */
+export declare const MAX_CROSS_PROJECT_SOURCE_BYTES: number;
+export declare class CrossProjectSourceTooLargeError extends Error {
+    constructor(registryUrl: string, maxBytes?: number);
+}
+export declare function readLimitedCrossProjectSource(response: Response, registryUrl: string, maxBytes?: number): Promise<string>;
+//# sourceMappingURL=cross-project-source-limit.d.ts.map

package/esm/src/modules/server/cross-project-source-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-project-source-limit.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/cross-project-source-limit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,QAAkB,CAAC;AAE9D,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,WAAW,EAAE,MAAM,EAAE,QAAQ,SAAiC;CAI3E;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAiC,GACxC,OAAO,CAAC,MAAM,CAAC,CAwCjB"}

package/esm/src/modules/server/cross-project-source-limit.js

@@ -0,0 +1,46 @@
+/** Max size of a fetched cross-project module source, to bound memory use. */
+export const MAX_CROSS_PROJECT_SOURCE_BYTES = 5 * 1024 * 1024; // 5MB
+export class CrossProjectSourceTooLargeError extends Error {
+    constructor(registryUrl, maxBytes = MAX_CROSS_PROJECT_SOURCE_BYTES) {
+        super(`Cross-project source exceeds size limit: ${registryUrl} (${maxBytes} bytes)`);
+        this.name = "CrossProjectSourceTooLargeError";
+    }
+}
+export async function readLimitedCrossProjectSource(response, registryUrl, maxBytes = MAX_CROSS_PROJECT_SOURCE_BYTES) {
+    const declaredLength = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        await response.body?.cancel();
+        throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+    }
+    if (!response.body) {
+        const text = await response.text();
+        if (new TextEncoder().encode(text).byteLength > maxBytes) {
+            throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+        }
+        return text;
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                await reader.cancel();
+                throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+            }
+            chunks.push(decoder.decode(value, { stream: true }));
+        }
+        const tail = decoder.decode();
+        if (tail.length > 0)
+            chunks.push(tail);
+        return chunks.join("");
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/esm/src/modules/server/module-batch-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-batch-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-batch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqDtE,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2K/F;AA4JD;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAY1D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrE"}
+{"version":3,"file":"module-batch-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-batch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqDtE,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2K/F;AA2JD;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAY1D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrE"}

package/esm/src/modules/server/module-batch-handler.js

@@ -298,10 +298,9 @@ function generateBatchBundle(successes, failures) {
  * Converts ES module syntax to work within the bundle wrapper
  */
 function transformExportsForBundle(code) {
-    return code
-        .split("\n")
-        .map((line) => `  ${line}`)
-        .join("\n");
+    // Indent every line by two spaces. A single regex avoids allocating an
+    // intermediate array of lines per module on the batch hot path.
+    return code.replace(/^/gm, "  ");
 }
 /**
  * Clear the transform cache (on deployment or memory pressure)

package/esm/src/modules/server/module-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-server.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-server.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAsBtE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAsDrD,CAAC;AASF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0TzF;AA+PD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGrD"}
+{"version":3,"file":"module-server.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-server.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAuBtE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAsDrD,CAAC;AAQF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0TzF;AA+PD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGrD"}

package/esm/src/modules/server/module-server.js

@@ -15,6 +15,7 @@ import { applySSRImportRewrites } from "./ssr-import-rewriter.js";
 import { addHMRTimestamps } from "../../transforms/esm/import-rewriter.js";
 import { FRAMEWORK_ROOT, resolveFrameworkSourcePath, } from "../../platform/compat/framework-source-resolver.js";
 import { getReactUrls, REACT_DEFAULT_VERSION } from "../../utils/constants/cdn.js";
+import { readLimitedCrossProjectSource } from "./cross-project-source-limit.js";
 const logger = serverLogger.component("module-server");
 /**
  * Embedded polyfills for compiled Deno binaries.
@@ -600,5 +601,14 @@ async function fetchCrossProjectSource(projectRef, filePath) {
         });
         return null;
     }
-    return response.text();
+    try {
+        return await readLimitedCrossProjectSource(response, registryUrl);
+    }
+    catch (error) {
+        logger.warn("Cross-project source too large", {
+            registryUrl,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }