veryfront 0.1.738 → 0.1.742

package/esm/src/oauth/handlers/init-handler.js

@@ -41,11 +41,11 @@ function createNotConfiguredResponse(config) {
     });
     return Response.json({ error: `${config.displayName} OAuth not configured` }, { status: 503 });
 }
-function createInitErrorResponse(error) {
-    return Response.json({
-        error: "Failed to initiate OAuth flow",
-        details: error instanceof Error ? error.message : "Unknown error",
-    }, { status: 500 });
+function createInitErrorResponse() {
+    // SEC-009: do NOT leak internal error details (file paths, library
+    // internals) to the client. The caller already logs the full error
+    // server-side; return a generic message here.
+    return Response.json({ error: "Failed to initiate OAuth flow" }, { status: 500 });
 }
 /** Handler for create oauth init. */
 export function createOAuthInitHandler(config, options) {
@@ -78,7 +78,7 @@ export function createOAuthInitHandler(config, options) {
         }
         catch (error) {
             logger.error("Init error", { serviceId: config.serviceId }, error);
-            return createInitErrorResponse(error);
+            return createInitErrorResponse();
         }
     };
 }

package/esm/src/oauth/providers/base.d.ts

@@ -36,9 +36,11 @@ export declare class OAuthProvider {
 export declare class OAuthService extends OAuthProvider {
     protected serviceConfig: OAuthServiceConfig;
     protected tokenStore?: TokenStore;
+    private refreshPromises;
     constructor(config: OAuthServiceConfig, tokenStore?: TokenStore, envReader?: EnvReader);
     get serviceId(): string;
     get apiBaseUrl(): string;
+    private refreshKey;
     createAuthorizationUrl(options?: AuthorizationUrlOptions): Promise<{
         url: string;
         state: OAuthState;
@@ -51,6 +53,7 @@ export declare class OAuthService extends OAuthProvider {
      * tokens. See VULN-AUTH-2.
      */
     getAccessToken(userId: string): Promise<string | null>;
+    private refreshAndStoreAccessToken;
     /**
      * Resolve `endpoint` against `apiBaseUrl`, validating that absolute URLs
      * share the configured origin.

package/esm/src/oauth/providers/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/providers/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EAEV,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACX,MAAM,aAAa,CAAC;AAarB,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAuB5D,gCAAgC;AAChC,qBAAa,aAAa;IACxB,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACtC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAEnB,MAAM,EAAE,mBAAmB,EAAE,SAAS,GAAE,SAAkB;IAKtE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,IAAI,OAAO;IAIjB,sBAAsB,CAC1B,OAAO,GAAE,uBAAuB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACnE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IA0C9C,OAAO,CAAC,iBAAiB;IAazB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;YA0CZ,gBAAgB;IAe9B,OAAO,CAAC,4BAA4B;YAQtB,aAAa;IAyCrB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA+BzE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBnD;AAED,+BAA+B;AAC/B,qBAAa,YAAa,SAAQ,aAAa;IAC7C,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC5C,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBAEtB,MAAM,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS;IAMtF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,sBAAsB,CAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAO9C;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAuBpB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;CA+BxF"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/providers/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EAEV,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACX,MAAM,aAAa,CAAC;AAarB,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAuB5D,gCAAgC;AAChC,qBAAa,aAAa;IACxB,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACtC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAEnB,MAAM,EAAE,mBAAmB,EAAE,SAAS,GAAE,SAAkB;IAKtE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,IAAI,OAAO;IAIjB,sBAAsB,CAC1B,OAAO,GAAE,uBAAuB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACnE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IA0C9C,OAAO,CAAC,iBAAiB;IAazB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;YA0CZ,gBAAgB;IAe9B,OAAO,CAAC,4BAA4B;YAQtB,aAAa;IAyCrB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgCzE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBnD;AAED,+BAA+B;AAC/B,qBAAa,YAAa,SAAQ,aAAa;IAC7C,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC5C,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAClC,OAAO,CAAC,eAAe,CAA6C;gBAExD,MAAM,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS;IAMtF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,OAAO,CAAC,UAAU;IAIT,sBAAsB,CAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAO9C;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAyB9C,0BAA0B;IAcxC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAuBpB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;CA+BxF"}

package/esm/src/oauth/providers/base.js

@@ -183,7 +183,9 @@ export class OAuthProvider {
             return {
                 success: false,
                 error: "OAuth not configured",
-                errorDescription: `Missing ${this.config.clientIdEnvVar} or ${this.config.clientSecretEnvVar}`,
+                // Don't leak internal env var names to the caller; this result can
+                // propagate to HTTP responses via OAuthService.
+                errorDescription: "OAuth provider credentials are not configured",
             };
         }
         const body = new URLSearchParams({
@@ -231,6 +233,7 @@ export class OAuthProvider {
 export class OAuthService extends OAuthProvider {
     serviceConfig;
     tokenStore;
+    refreshPromises = new Map();
     constructor(config, tokenStore, envReader) {
         super(config, envReader);
         this.serviceConfig = config;
@@ -242,6 +245,9 @@ export class OAuthService extends OAuthProvider {
     get apiBaseUrl() {
         return this.serviceConfig.apiBaseUrl;
     }
+    refreshKey(userId) {
+        return JSON.stringify([this.serviceId, userId]);
+    }
     createAuthorizationUrl(options = {}) {
         return super.createAuthorizationUrl({
             ...options,
@@ -264,7 +270,23 @@ export class OAuthService extends OAuthProvider {
             return tokens.accessToken;
         if (!tokens.refreshToken)
             return null;
-        const result = await this.refreshTokens(tokens.refreshToken);
+        const key = this.refreshKey(userId);
+        const existingRefresh = this.refreshPromises.get(key);
+        if (existingRefresh)
+            return existingRefresh;
+        const refreshPromise = this.refreshAndStoreAccessToken(userId, tokens.refreshToken);
+        this.refreshPromises.set(key, refreshPromise);
+        try {
+            return await refreshPromise;
+        }
+        finally {
+            if (this.refreshPromises.get(key) === refreshPromise) {
+                this.refreshPromises.delete(key);
+            }
+        }
+    }
+    async refreshAndStoreAccessToken(userId, refreshToken) {
+        const result = await this.refreshTokens(refreshToken);
         if (!result.success || !result.tokens)
             return null;
         if (!this.tokenStore) {

package/esm/src/platform/compat/fs.d.ts

@@ -58,6 +58,12 @@ export declare function makeTempDir(options?: {
 /** Change file permissions. */
 export declare function chmod(path: string, mode: number): Promise<void>;
 export declare function symlink(target: string, path: string): Promise<void>;
+/**
+ * Resolve a path to its canonical absolute form, following symlinks.
+ * Throws if the path does not exist. Useful for containment checks where a
+ * symlink could otherwise escape an intended directory.
+ */
+export declare function realPath(path: string): Promise<string>;
 /** Error shape for is not found. */
 export declare function isNotFoundError(error: unknown): boolean;
 /** Error shape for is already exists. */

package/esm/src/platform/compat/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../src/src/platform/compat/fs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAgBpD,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAwOD,0BAA0B;AAC1B,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C;AASD,2BAA2B;AAC3B,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1D;AAED,4BAA4B;AAC5B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1D;AAED,4BAA4B;AAC5B,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,6BAA6B;AAC7B,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,mCAAmC;AACnC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErD;AAED,0BAA0B;AAC1B,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpD;AAED,0BAA0B;AAC1B,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;AAED,kCAAkC;AAClC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAED,8BAA8B;AAC9B,wBAAgB,OAAO,CACrB,IAAI,EAAE,MAAM,GACX,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAExE;AAED,uBAAuB;AACvB,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1E;AAED,+BAA+B;AAC/B,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAWD,oCAAoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvD;AAED,yCAAyC;AACzC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI5D"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../src/src/platform/compat/fs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAgBpD,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAwOD,0BAA0B;AAC1B,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C;AASD,2BAA2B;AAC3B,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1D;AAED,4BAA4B;AAC5B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1D;AAED,4BAA4B;AAC5B,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,6BAA6B;AAC7B,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,mCAAmC;AACnC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErD;AAED,0BAA0B;AAC1B,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpD;AAED,0BAA0B;AAC1B,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;AAED,kCAAkC;AAClC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAED,8BAA8B;AAC9B,wBAAgB,OAAO,CACrB,IAAI,EAAE,MAAM,GACX,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAExE;AAED,uBAAuB;AACvB,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1E;AAED,+BAA+B;AAC/B,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5D;AAWD,oCAAoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvD;AAED,yCAAyC;AACzC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI5D"}

package/esm/src/platform/compat/fs.js

@@ -243,6 +243,18 @@ export async function symlink(target, path) {
     const fs = await import("node:fs/promises");
     await fs.symlink(target, path);
 }
+/**
+ * Resolve a path to its canonical absolute form, following symlinks.
+ * Throws if the path does not exist. Useful for containment checks where a
+ * symlink could otherwise escape an intended directory.
+ */
+export async function realPath(path) {
+    if (isDeno) {
+        return await denoGlobal().realPath(path);
+    }
+    const fs = await import("node:fs/promises");
+    return await fs.realpath(path);
+}
 /** Error shape for is not found. */
 export function isNotFoundError(error) {
     const NotFound = dntShim.dntGlobalThis.Deno?.errors?.NotFound;

package/esm/src/provider/runtime-loader/tool-input-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-input-status.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/tool-input-status.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,KAAK,uBAAuB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,KAAK,oBAAoB,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAC5C,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAexE;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAA;CAAE,CAAC,CAsBjG;AAED,6CAA6C;AAC7C,wBAAuB,8BAA8B,CACnD,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,WAAW,SAAkC,GAC5C,aAAa,CAAC,OAAO,CAAC,CAkLxB"}
+{"version":3,"file":"tool-input-status.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/tool-input-status.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,KAAK,uBAAuB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,KAAK,oBAAoB,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAC5C,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAexE;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAA;CAAE,CAAC,CAsBjG;AAED,6CAA6C;AAC7C,wBAAuB,8BAA8B,CACnD,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,WAAW,SAAkC,GAC5C,aAAa,CAAC,OAAO,CAAC,CA2LxB"}

package/esm/src/provider/runtime-loader/tool-input-status.js

@@ -137,14 +137,22 @@ export async function* withToolInputStatusTransitions(stream, thresholdMs = TOOL
             .sort((left, right) => left - right)[0] ?? null;
         if (nextDueAt !== null) {
             let timeoutId = null;
-            const timeoutResult = await Promise.race([
-                nextPartPromise.then((result) => ({ kind: "part", result })),
-                new Promise((resolve) => {
-                    timeoutId = dntShim.setTimeout(() => resolve({ kind: "timeout" }), Math.max(0, nextDueAt - Date.now()));
-                }),
-            ]);
-            if (timeoutId !== null) {
-                clearTimeout(timeoutId);
+            // Clear the timer in finally so it is released even when the race
+            // rejects (iterator error) or the generator is abandoned mid-await
+            // (consumer break/return), not just on the happy path.
+            let timeoutResult;
+            try {
+                timeoutResult = await Promise.race([
+                    nextPartPromise.then((result) => ({ kind: "part", result })),
+                    new Promise((resolve) => {
+                        timeoutId = dntShim.setTimeout(() => resolve({ kind: "timeout" }), Math.max(0, nextDueAt - Date.now()));
+                    }),
+                ]);
+            }
+            finally {
+                if (timeoutId !== null) {
+                    clearTimeout(timeoutId);
+                }
             }
             if (timeoutResult.kind === "timeout") {
                 const readyResult = await readPartIfReady();

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts

@@ -3,6 +3,8 @@ import type { RuntimeAdapter } from "../../../platform/adapters/base.js";
 export type ResolvedModuleDependency = {
     full: string;
     path: string;
+    start: number;
+    end: number;
     relativePath: string;
     depFilePath: string | null;
     isLocalLib: boolean;

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AASzE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgFD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAMR"}
+{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAczE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgGD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAQR"}

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.js

@@ -1,16 +1,25 @@
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { parallelMap, rendererLogger } from "../../../utils/index.js";
+import { findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
 import { findSourceFile } from "../file-resolver/index.js";
 const logger = rendererLogger.component("module-loader");
 function collectAliasImports(fileContent) {
-    return [...fileContent.matchAll(/from\s+["'](@\/[^"']+)["']/g)].map((m) => ({
-        full: m[0],
-        path: m[1] ?? "",
+    return findStaticImportFromSpans(fileContent, (specifier) => specifier.startsWith("@/") ? specifier : null).map(({ original, path, start, end }) => ({
+        full: original,
+        path,
+        start,
+        end,
     }));
 }
 function collectRelativeImports(fileContent, fileDir) {
-    return [...fileContent.matchAll(/from\s+["'](\.\.?\/[^"']+)["']/g)]
-        .map((m) => ({ full: m[0], path: m[1] ?? "", fromDir: fileDir }))
+    return findStaticImportFromSpans(fileContent, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1])
+        .map(({ original, path, start, end }) => ({
+        full: original,
+        path,
+        fromDir: fileDir,
+        start,
+        end,
+    }))
         // Ignore already-transformed file:// imports.
         .filter((imp) => !imp.path.includes("file://"));
 }
@@ -56,6 +65,8 @@ async function resolveRelativeImport(imp, adapter) {
     return {
         full: imp.full,
         path: imp.path,
+        start: imp.start,
+        end: imp.end,
         relativePath: imp.path,
         depFilePath,
         isLocalLib: false,
@@ -79,9 +90,11 @@ export async function resolveModuleDependencies(input) {
 }
 /** Rewrites resolved local imports to their transformed temp file URLs. */
 export function rewriteResolvedDependencyImports(fileContent, transformedDeps) {
-    let rewritten = fileContent;
-    for (const dep of transformedDeps) {
-        rewritten = rewritten.replace(dep.full, `from "file://${dep.depTempPath}"`);
-    }
-    return rewritten;
+    const replacements = transformedDeps.map((dep) => ({
+        start: dep.start,
+        end: dep.end,
+        expected: dep.full,
+        replacement: `from "file://${dep.depTempPath}"`,
+    }));
+    return replaceSourceSpans(fileContent, replacements);
 }

package/esm/src/rendering/renderer-concurrency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderer-concurrency.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer-concurrency.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,oEAAoE,CAAC;AAQ/F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA8C,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QACC,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAS/C;;;;GAIG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IA+BhD,OAAO,CAAC,OAAO;IASf,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF;AAYD,eAAO,MAAM,eAAe,WAE1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAA4B,CAAC;AA8B7D;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"renderer-concurrency.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer-concurrency.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,oEAAoE,CAAC;AAQ/F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA8C,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QACC,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAS/C;;;;GAIG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IA+BhD,OAAO,CAAC,OAAO;IASf,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF;AAYD,eAAO,MAAM,eAAe,WAE1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAA4B,CAAC;AA8B7D;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/esm/src/rendering/renderer-concurrency.js

@@ -154,17 +154,24 @@ export async function acquireProjectSlot(projectId) {
 export async function releaseProjectSlot(projectId) {
     if (RENDER_PER_PROJECT_LIMIT <= 0)
         return;
-    const release = await acquireProjectLock(projectId);
+    const mutex = getProjectMutex(projectId);
+    const release = await mutex.acquire(LOCK_TIMEOUT_MS);
+    let deleteIdleMutex = false;
     try {
         const current = projectRenderCounts.get(projectId) ?? 0;
         if (current <= 1) {
             projectRenderCounts.delete(projectId);
-            projectMutexes.delete(projectId);
+            deleteIdleMutex = mutex.waiting === 0;
             return;
         }
         projectRenderCounts.set(projectId, current - 1);
     }
     finally {
         release();
+        if (deleteIdleMutex &&
+            !projectRenderCounts.has(projectId) &&
+            projectMutexes.get(projectId) === mutex) {
+            projectMutexes.delete(projectId);
+        }
     }
 }

package/esm/src/security/sandbox/worker-permissions.d.ts

@@ -1,10 +1,6 @@
 /**
- * Worker Permission Builder
- *
- * Builds scoped Deno Worker permissions for per-project isolation.
- * Each project worker gets the minimum required permissions.
- *
- * @module security/sandbox/worker-permissions
+ * Deno Worker permission object.
+ * See: https://docs.deno.com/runtime/fundamentals/permissions/
  */
 export interface WorkerPermissions {
     read: string[] | boolean;
@@ -15,6 +11,12 @@ export interface WorkerPermissions {
     ffi: boolean;
     sys: boolean;
 }
+interface WorkerPermissionOptions {
+    /** Override for tests that need to exercise compiled-binary behavior. */
+    isCompiledBinary?: boolean;
+    /** Override for tests that need deterministic compiled-binary support paths. */
+    compiledReadPaths?: string[];
+}
 /**
  * Build scoped permissions for a project worker.
  *
@@ -26,5 +28,6 @@ export interface WorkerPermissions {
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)
  */
-export declare function buildWorkerPermissions(readPaths: string[]): WorkerPermissions;
+export declare function buildWorkerPermissions(readPaths: string[], options?: WorkerPermissionOptions): WorkerPermissions;
+export {};
 //# sourceMappingURL=worker-permissions.d.ts.map

package/esm/src/security/sandbox/worker-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,GAClB,iBAAiB,CA0BnB"}
+{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAED,UAAU,uBAAuB;IAC/B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CA2BnB"}

package/esm/src/security/sandbox/worker-permissions.js

@@ -6,11 +6,10 @@
  *
  * @module security/sandbox/worker-permissions
  */
-/**
- * Deno Worker permission object.
- * See: https://docs.deno.com/runtime/fundamentals/permissions/
- */
 import * as dntShim from "../../../_dnt.shims.js";
+import { getFrameworkRootFromMeta } from "../../platform/compat/vfs-paths.js";
+import { getHostEnv } from "../../platform/compat/process.js";
+import { getCacheBaseDir, getHttpBundleCacheDir, getMdxEsmCacheDir, } from "../../utils/cache-dir.js";
 // Cache compiled binary check — Deno.execPath() is a syscall that never changes at runtime
 const _isCompiledBinary = (() => {
     try {
@@ -24,6 +23,27 @@ const _isCompiledBinary = (() => {
         return false;
     }
 })();
+function normalizeReadPaths(paths) {
+    const unique = new Set();
+    for (const path of paths) {
+        if (!path)
+            continue;
+        const trimmed = path.trim();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return [...unique];
+}
+function getDefaultCompiledReadPaths() {
+    return normalizeReadPaths([
+        getFrameworkRootFromMeta(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url),
+        getCacheBaseDir(),
+        getMdxEsmCacheDir(),
+        getHttpBundleCacheDir(),
+        getHostEnv("DENO_DIR"),
+    ]);
+}
 /**
  * Build scoped permissions for a project worker.
  *
@@ -35,14 +55,14 @@ const _isCompiledBinary = (() => {
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)
  */
-export function buildWorkerPermissions(readPaths) {
-    // In compiled binaries, user modules import from the VFS temp dir which
-    // is outside the project directory. Rather than trying to enumerate all
-    // read paths, grant full read access — the security boundary is enforced
-    // by denying write/run/ffi/sys, not by restricting reads.
-    if (_isCompiledBinary) {
+export function buildWorkerPermissions(readPaths, options = {}) {
+    const isCompiledBinary = options.isCompiledBinary ?? _isCompiledBinary;
+    const normalizedReadPaths = normalizeReadPaths(readPaths);
+    if (isCompiledBinary) {
+        const compiledReadPaths = options.compiledReadPaths ?? getDefaultCompiledReadPaths();
+        const scopedReadPaths = normalizeReadPaths([...normalizedReadPaths, ...compiledReadPaths]);
         return {
-            read: true,
+            read: scopedReadPaths.length > 0 ? scopedReadPaths : false,
             write: false,
             net: true,
             env: true,
@@ -52,7 +72,7 @@ export function buildWorkerPermissions(readPaths) {
         };
     }
     return {
-        read: readPaths.length > 0 ? readPaths : false,
+        read: normalizedReadPaths.length > 0 ? normalizedReadPaths : false,
         write: false,
         net: true,
         env: true,

package/esm/src/security/utils/constant-time.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constant-time.d.ts","sourceRoot":"","sources":["../../../../src/src/security/utils/constant-time.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAY/D"}
+{"version":3,"file":"constant-time.d.ts","sourceRoot":"","sources":["../../../../src/src/security/utils/constant-time.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAe/D"}

package/esm/src/security/utils/constant-time.js

@@ -4,8 +4,11 @@ export function constantTimeEqual(a, b) {
     const bBuf = encoder.encode(b);
     const len = Math.max(aBuf.length, bBuf.length);
     let xor = aBuf.length ^ bBuf.length;
+    // Pad out-of-range positions with 0xff (not 0x00) so a padded slot can
+    // never coincide with a real 0x00 byte on the other side and read as a
+    // match. Matches the CSRF comparison in src/security/csrf/helpers.ts.
     for (let i = 0; i < len; i++) {
-        xor |= (aBuf[i] ?? 0) ^ (bBuf[i] ?? 0);
+        xor |= (aBuf[i] ?? 0xff) ^ (bBuf[i] ?? 0xff);
     }
     return xor === 0;
 }

package/esm/src/server/services/rendering/ssr.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAsB1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAqBD,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAI1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2G1F,OAAO,CAAC,iBAAiB;IAyHzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAS1D"}
+{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAuB1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAqBD,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAI1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+G1F,OAAO,CAAC,iBAAiB;IAyHzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAS1D"}

package/esm/src/server/services/rendering/ssr.service.js

@@ -4,7 +4,7 @@ import { serverLogger, timeAsync } from "../../../utils/index.js";
 import { computeSSRETag } from "../../handlers/request/ssr/etag-handler.js";
 import { VeryfrontError } from "../../../errors/index.js";
 import { getColorSchemeFromRequest } from "../../../security/http/client-hints.js";
-import { endRenderSession, hasRenderSession, startRenderSession, } from "../../../transforms/mdx/esm-module-loader/module-fetcher/index.js";
+import { endRenderSession, hasRenderSession, runInRenderSession, startRenderSession, } from "../../../transforms/mdx/esm-module-loader/module-fetcher/index.js";
 import { getErrorCollector } from "../../../observability/error-collector.js";
 import { profilePhase } from "../../../observability/request-profiler.js";
 import { ErrorOverlay, parseErrorLocation } from "../../dev-server/error-overlay/index.js";
@@ -68,7 +68,10 @@ export class SSRService {
                 slug,
             });
             const renderStartTime = performance.now();
-            const result = await profilePhase("ssr.render_page", () => timeAsync("render-page", () => renderer.renderPage(slug, {
+            // Bind the render session to this async context so modules fetched
+            // during the render are attributed to THIS render, not whichever
+            // concurrent session started first.
+            const result = await runInRenderSession(renderSessionId, () => profilePhase("ssr.render_page", () => timeAsync("render-page", () => renderer.renderPage(slug, {
                 delivery: "stream",
                 request,
                 url,
@@ -84,7 +87,7 @@ export class SSRService {
                 noHmr,
                 forceProductionScripts: options.forceProductionScripts,
                 renderSessionId,
-            })));
+            }))));
             logger.debug("renderPage DONE", {
                 projectSlug: ctx.projectSlug,
                 slug,

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.d.ts

@@ -25,6 +25,8 @@ export declare function initializeCacheDir(context: ESMLoaderContext): Promise<s
 export declare function findVfModuleImports(code: string): Array<{
     original: string;
     path: string;
+    start: number;
+    end: number;
 }>;
 /**
  * Process /_vf_modules/ imports and replace them with file:// paths.
@@ -32,5 +34,7 @@ export declare function findVfModuleImports(code: string): Array<{
 export declare function processVfModuleImports(code: string, imports: Array<{
     original: string;
     path: string;
+    start: number;
+    end: number;
 }>, context: ESMLoaderContext, projectDir: string, strictMissingModules: boolean): Promise<string>;
 //# sourceMappingURL=loader-helpers.d.ts.map

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/mdx/esm-module-loader/loader-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAapF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAWnE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCnF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3F;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAAC,MAAM,CAAC,CAwGjB"}
+{"version":3,"file":"loader-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/mdx/esm-module-loader/loader-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAapF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAWnE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCnF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAAC,MAAM,CAAC,CAoHjB"}

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.js

@@ -17,6 +17,7 @@ import { exists as fsExists } from "../../../platform/compat/fs.js";
 import { LOG_PREFIX_MDX_LOADER } from "./constants.js";
 import { getLocalFs } from "./cache/index.js";
 import { createStubModule } from "./utils/stub-module.js";
+import { findStaticImportFromSpans, replaceSourceSpans, } from "./utils/source-spans.js";
 import { createModuleFetcherContext, fetchAndCacheModule } from "./module-fetcher/index.js";
 import { buildMissingModuleError } from "./missing-module.js";
 /**
@@ -89,15 +90,7 @@ export async function initializeCacheDir(context) {
  * Find /_vf_modules/ imports in code.
  */
 export function findVfModuleImports(code) {
-    const imports = [];
-    const pattern = /from\s*["'](\/?)(_vf_modules\/[^"']+)["']/g;
-    let match;
-    while ((match = pattern.exec(code)) !== null) {
-        const [original, , path] = match;
-        if (path)
-            imports.push({ original, path });
-    }
-    return imports;
+    return findStaticImportFromSpans(code, (specifier) => specifier.match(/^\/?(_vf_modules\/[^?]+)(?:\?.*)?$/)?.[1]);
 }
 /**
  * Process /_vf_modules/ imports and replace them with file:// paths.
@@ -136,7 +129,7 @@ export async function processVfModuleImports(code, imports, context, projectDir,
         strictMissingModules,
     });
     const fetchStart = performance.now();
-    const results = await Promise.all(imports.map(async ({ original, path }, index) => {
+    const results = await Promise.all(imports.map(async ({ original, path, start, end }, index) => {
         return await withSpan(SpanNames.MDX_FETCH_MODULE, async () => {
             const moduleStart = performance.now();
             logger.debug(`${LOG_PREFIX_MDX_LOADER} Fetching module START`, {
@@ -151,7 +144,7 @@ export async function processVfModuleImports(code, imports, context, projectDir,
                 path,
                 durationMs: (performance.now() - moduleStart).toFixed(1),
             });
-            return { original, filePath, path };
+            return { original, start, end, filePath, path };
         }, {
             "mdx.module_path": path,
             "mdx.module_index": index,
@@ -163,10 +156,15 @@ export async function processVfModuleImports(code, imports, context, projectDir,
         moduleCount: imports.length,
         durationMs: (performance.now() - fetchStart).toFixed(1),
     });
-    let result = code;
-    for (const { original, filePath, path } of results) {
+    const replacements = [];
+    for (const { original, start, end, filePath, path } of results) {
         if (filePath) {
-            result = result.replace(original, `from "file://${filePath}"`);
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${filePath}"`,
+            });
             continue;
         }
         if (strictMissingModules) {
@@ -178,9 +176,15 @@ export async function processVfModuleImports(code, imports, context, projectDir,
                 projectSlug,
             });
         }
-        const stubPath = await createStubModule(path, result, original, context.esmCacheDir);
-        if (stubPath)
-            result = result.replace(original, `from "file://${stubPath}"`);
+        const stubPath = await createStubModule(path, code, original, context.esmCacheDir);
+        if (stubPath) {
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${stubPath}"`,
+            });
+        }
     }
-    return result;
+    return replaceSourceSpans(code, replacements);
 }

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-fetcher.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,cAAc,EACvB,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqDxB"}
+{"version":3,"file":"http-fetcher.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAM5E;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,cAAc,EACvB,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuExB"}