veryfront 0.1.739 → 0.1.742

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.739",
+    "version": "0.1.742",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/agent/hosted/child-tool-input.js

@@ -5,7 +5,7 @@ export const DEFAULT_HOSTED_CHILD_AGENT_ID = "invoke-agent-child";
 export const getHostedChildForkToolInputSchema = defineSchema((v) => v.object({
     description: v.string().describe("3-5 word task summary"),
     prompt: v.string().describe("Detailed instructions for the task"),
-    context: v.record(v.string(), getJsonValueSchema()).describe("Required structured data payload for the child task. Use this for critical facts, records, ids, decisions, and values the child must act on. Use {} only when the delegation has no record or evidence payload."),
+    context: v.record(v.string(), getJsonValueSchema()).default({}).describe("Structured data payload for the child task. Use this for critical facts, records, ids, decisions, and values the child must act on. Defaults to {} when the delegation has no record or evidence payload."),
     project_id: v.string().optional().describe("Override project context. Use after studio_open_project."),
     tools: v.array(v.string()).optional().describe("Tool subset for this fork. Omit = inherit all parent tools."),
     model: v.string().optional().describe('Model override (e.g. "sonnet" for cheaper work).'),

package/esm/src/mcp/http-transport.js

@@ -76,7 +76,7 @@ export function createMCPHTTPHandler(dependencies) {
             return createJSONResponse(rpcResponse, { headers: responseHeaders });
         }
         let sessionId;
-        if (sessionManager.size > 0) {
+        if (sessionManager.requiresSessionHeader()) {
             sessionId = request.headers.get("MCP-Session-Id") ?? undefined;
             if (!sessionId) {
                 return createJSONRPCErrorResponse(400, -32600, "Missing MCP-Session-Id header");

package/esm/src/mcp/session.d.ts

@@ -1,9 +1,32 @@
+/**
+ * Manages MCP sessions for the Streamable HTTP transport.
+ * Sessions are created during initialization and validated on subsequent requests.
+ *
+ * Sessions expire after a period of inactivity so that clients which disconnect
+ * uncleanly (closed tab, crash, dropped network) don't leak entries forever.
+ * Expiry is lazy: stale entries are pruned on access, so no background timer is
+ * required.
+ */
+export interface SessionManagerOptions {
+    /** Inactivity TTL in ms (default 30 minutes). */
+    ttlMs?: number;
+    /** Clock, injectable for tests. Defaults to Date.now. */
+    now?: () => number;
+}
 export declare class SessionManager {
+    /** id -> last-seen timestamp (ms). */
     private sessions;
+    private readonly ttlMs;
+    private readonly now;
+    private sessionHeaderRequired;
+    constructor(options?: SessionManagerOptions);
     create(): string;
     isValid(id: string): boolean;
     terminate(id: string): void;
     get size(): number;
     clear(): void;
+    requiresSessionHeader(): boolean;
+    private isExpired;
+    private pruneExpired;
 }
 //# sourceMappingURL=session.d.ts.map

package/esm/src/mcp/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/session.ts"],"names":[],"mappings":"AAMA,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IAErC,MAAM,IAAI,MAAM;IAMhB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,cAAc;IACzB,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,OAAO,GAAE,qBAA0B;IAK/C,MAAM,IAAI,MAAM;IAQhB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAY5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAK3B,IAAI,IAAI,IAAI,MAAM,CAGjB;IAED,KAAK,IAAI,IAAI;IAKb,qBAAqB,IAAI,OAAO;IAIhC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;CAMrB"}

package/esm/src/mcp/session.js

@@ -1,25 +1,68 @@
 /**
  * Manages MCP sessions for the Streamable HTTP transport.
  * Sessions are created during initialization and validated on subsequent requests.
+ *
+ * Sessions expire after a period of inactivity so that clients which disconnect
+ * uncleanly (closed tab, crash, dropped network) don't leak entries forever.
+ * Expiry is lazy: stale entries are pruned on access, so no background timer is
+ * required.
  */
+/** Default inactivity window before a session is considered expired (30 min). */
 import * as dntShim from "../../_dnt.shims.js";
+const DEFAULT_SESSION_TTL_MS = 30 * 60_000;
 export class SessionManager {
-    sessions = new Set();
+    /** id -> last-seen timestamp (ms). */
+    sessions = new Map();
+    ttlMs;
+    now;
+    sessionHeaderRequired = false;
+    constructor(options = {}) {
+        this.ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
+        this.now = options.now ?? Date.now;
+    }
     create() {
+        this.pruneExpired();
         const id = dntShim.crypto.randomUUID();
-        this.sessions.add(id);
+        this.sessions.set(id, this.now());
+        this.sessionHeaderRequired = true;
         return id;
     }
     isValid(id) {
-        return this.sessions.has(id);
+        const lastSeen = this.sessions.get(id);
+        if (lastSeen === undefined)
+            return false;
+        if (this.isExpired(lastSeen)) {
+            this.sessions.delete(id);
+            return false;
+        }
+        // Touch: activity refreshes the inactivity window.
+        this.sessions.set(id, this.now());
+        return true;
     }
     terminate(id) {
         this.sessions.delete(id);
+        if (this.sessions.size === 0)
+            this.sessionHeaderRequired = false;
     }
     get size() {
+        this.pruneExpired();
         return this.sessions.size;
     }
     clear() {
         this.sessions.clear();
+        this.sessionHeaderRequired = false;
+    }
+    requiresSessionHeader() {
+        return this.sessionHeaderRequired;
+    }
+    isExpired(lastSeen) {
+        return this.now() - lastSeen > this.ttlMs;
+    }
+    pruneExpired() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [id, lastSeen] of this.sessions) {
+            if (lastSeen < cutoff)
+                this.sessions.delete(id);
+        }
     }
 }

package/esm/src/modules/manifest/route-module-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-module-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/manifest/route-module-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAuBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,UAAQ,GAChB,IAAI,CAEN;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,eAAe,GAAE,MAAM,EAAO,GAC7B,IAAI,CAwCN;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,IAAI,CAYtB;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAOV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,IAAI,CA2BN;AAED,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,SAAK,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,IAAI;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E,CAcA;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAS/D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC"}
+{"version":3,"file":"route-module-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/manifest/route-module-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAyBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,UAAQ,GAChB,IAAI,CAEN;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,eAAe,GAAE,MAAM,EAAO,GAC7B,IAAI,CAwCN;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,IAAI,CAYtB;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAOV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,IAAI,CA2BN;AAED,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,SAAK,GACZ,MAAM,EAAE,CAQV;AAED,wBAAgB,gBAAgB,IAAI;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E,CAcA;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAU/D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC"}

package/esm/src/modules/manifest/route-module-manifest.js

@@ -10,9 +10,16 @@
  * @module module-system/manifest/route-module-manifest
  */
 import { serverLogger } from "../../utils/index.js";
+import { LRUCache } from "../../utils/lru-wrapper.js";
 const logger = serverLogger.component("route-module-manifest");
-const manifestStore = new Map();
-const pendingCollections = new Map();
+/** Bound on tracked routes; manifests are a regenerable preload optimization. */
+const MAX_TRACKED_ROUTES = 2_000;
+/** Bound on in-flight collections; abandoned ones (render errors) get evicted. */
+const MAX_PENDING_COLLECTIONS = 2_000;
+const manifestStore = new LRUCache({ maxEntries: MAX_TRACKED_ROUTES });
+const pendingCollections = new LRUCache({
+    maxEntries: MAX_PENDING_COLLECTIONS,
+});
 function buildKey(projectSlug, route) {
     return `${projectSlug ?? "default"}:${route || "index"}`;
 }
@@ -132,7 +139,7 @@ export function generateModulePreloadHintsFromManifest(projectSlug, route, maxHi
 export function getManifestStats() {
     const routes = [];
     let totalModules = 0;
-    for (const [key, manifest] of manifestStore) {
+    for (const [key, manifest] of manifestStore.entries()) {
         routes.push({
             route: key,
             moduleCount: manifest.moduleCount,
@@ -144,7 +151,8 @@ export function getManifestStats() {
 }
 export function clearProjectManifests(projectSlug) {
     const prefix = `${projectSlug}:`;
-    for (const key of manifestStore.keys()) {
+    // Snapshot keys before deleting to avoid mutating during iteration.
+    for (const key of [...manifestStore.keys()]) {
         if (!key.startsWith(prefix))
             continue;
         manifestStore.delete(key);

package/esm/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-project-import-loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,UAAU,uBAAuB;IAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,IAAI,UAAU,CAAC;CACrB;AAED,UAAU,sCAAsC;IAC9C,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,OAAO,EAAE,IAAI,CACX,sBAAsB,EACtB,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAC/E,CAAC;IACF,KAAK,EAAE,uBAAuB,CAAC;IAC/B,qBAAqB,EAAE,CAAC,CAAC,EACvB,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,cAAc,CAAC;IAC3C,iBAAiB,CAAC,EAAE,OAAO,aAAa,CAAC;IACzC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,sCAAsC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0GjB"}
+{"version":3,"file":"cross-project-import-loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAGzD,UAAU,uBAAuB;IAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,IAAI,UAAU,CAAC;CACrB;AAED,UAAU,sCAAsC;IAC9C,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,OAAO,EAAE,IAAI,CACX,sBAAsB,EACtB,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAC/E,CAAC;IACF,KAAK,EAAE,uBAAuB,CAAC;IAC/B,qBAAqB,EAAE,CAAC,CAAC,EACvB,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,cAAc,CAAC;IAC3C,iBAAiB,CAAC,EAAE,OAAO,aAAa,CAAC;IACzC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,sCAAsC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0GjB"}

package/esm/src/modules/react-loader/ssr-module-loader/cross-project-import-loader.js

@@ -7,6 +7,7 @@ import { HTTP_FETCH_TIMEOUT_MS } from "../../../utils/constants/http.js";
 import { writeCacheFile } from "../../../utils/cache-file-ops.js";
 import { rendererLogger as logger } from "../../../utils/index.js";
 import { globalCrossProjectCache } from "./cache/index.js";
+import { readLimitedCrossProjectSource } from "../../server/cross-project-source-limit.js";
 function getRegistryBaseUrl(apiBaseUrl) {
     const resolvedApiBaseUrl = apiBaseUrl || getApiBaseUrlEnv();
     return resolvedApiBaseUrl.replace(/\/api\/?$/, "");
@@ -40,7 +41,7 @@ export async function transformCrossProjectImportFlow(flowOptions) {
                 detail: `Failed to fetch ${registryUrl}: ${response.status} ${response.statusText}`,
             });
         }
-        const sourceCode = await response.text();
+        const sourceCode = await readLimitedCrossProjectSource(response, registryUrl);
         const contentHash = await cache.hashContentAsync(sourceCode);
         const ext = path.match(/\.(tsx?|jsx?|mdx)$/)?.[0] ?? ".tsx";
         const syntheticFilePath = `cross-project/${projectRef}/@/${path}`;

package/esm/src/modules/server/cross-project-source-limit.d.ts

@@ -0,0 +1,7 @@
+/** Max size of a fetched cross-project module source, to bound memory use. */
+export declare const MAX_CROSS_PROJECT_SOURCE_BYTES: number;
+export declare class CrossProjectSourceTooLargeError extends Error {
+    constructor(registryUrl: string, maxBytes?: number);
+}
+export declare function readLimitedCrossProjectSource(response: Response, registryUrl: string, maxBytes?: number): Promise<string>;
+//# sourceMappingURL=cross-project-source-limit.d.ts.map

package/esm/src/modules/server/cross-project-source-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-project-source-limit.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/cross-project-source-limit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,QAAkB,CAAC;AAE9D,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,WAAW,EAAE,MAAM,EAAE,QAAQ,SAAiC;CAI3E;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAiC,GACxC,OAAO,CAAC,MAAM,CAAC,CAwCjB"}

package/esm/src/modules/server/cross-project-source-limit.js

@@ -0,0 +1,46 @@
+/** Max size of a fetched cross-project module source, to bound memory use. */
+export const MAX_CROSS_PROJECT_SOURCE_BYTES = 5 * 1024 * 1024; // 5MB
+export class CrossProjectSourceTooLargeError extends Error {
+    constructor(registryUrl, maxBytes = MAX_CROSS_PROJECT_SOURCE_BYTES) {
+        super(`Cross-project source exceeds size limit: ${registryUrl} (${maxBytes} bytes)`);
+        this.name = "CrossProjectSourceTooLargeError";
+    }
+}
+export async function readLimitedCrossProjectSource(response, registryUrl, maxBytes = MAX_CROSS_PROJECT_SOURCE_BYTES) {
+    const declaredLength = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        await response.body?.cancel();
+        throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+    }
+    if (!response.body) {
+        const text = await response.text();
+        if (new TextEncoder().encode(text).byteLength > maxBytes) {
+            throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+        }
+        return text;
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                await reader.cancel();
+                throw new CrossProjectSourceTooLargeError(registryUrl, maxBytes);
+            }
+            chunks.push(decoder.decode(value, { stream: true }));
+        }
+        const tail = decoder.decode();
+        if (tail.length > 0)
+            chunks.push(tail);
+        return chunks.join("");
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/esm/src/modules/server/module-batch-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-batch-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-batch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqDtE,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2K/F;AA4JD;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAY1D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrE"}
+{"version":3,"file":"module-batch-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-batch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqDtE,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2K/F;AA2JD;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAY1D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrE"}

package/esm/src/modules/server/module-batch-handler.js

@@ -298,10 +298,9 @@ function generateBatchBundle(successes, failures) {
  * Converts ES module syntax to work within the bundle wrapper
  */
 function transformExportsForBundle(code) {
-    return code
-        .split("\n")
-        .map((line) => `  ${line}`)
-        .join("\n");
+    // Indent every line by two spaces. A single regex avoids allocating an
+    // intermediate array of lines per module on the batch hot path.
+    return code.replace(/^/gm, "  ");
 }
 /**
  * Clear the transform cache (on deployment or memory pressure)

package/esm/src/modules/server/module-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-server.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-server.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAsBtE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAsDrD,CAAC;AASF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0TzF;AA+PD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGrD"}
+{"version":3,"file":"module-server.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/server/module-server.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAuBtE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAsDrD,CAAC;AAQF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0TzF;AA+PD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGrD"}

package/esm/src/modules/server/module-server.js

@@ -15,6 +15,7 @@ import { applySSRImportRewrites } from "./ssr-import-rewriter.js";
 import { addHMRTimestamps } from "../../transforms/esm/import-rewriter.js";
 import { FRAMEWORK_ROOT, resolveFrameworkSourcePath, } from "../../platform/compat/framework-source-resolver.js";
 import { getReactUrls, REACT_DEFAULT_VERSION } from "../../utils/constants/cdn.js";
+import { readLimitedCrossProjectSource } from "./cross-project-source-limit.js";
 const logger = serverLogger.component("module-server");
 /**
  * Embedded polyfills for compiled Deno binaries.
@@ -600,5 +601,14 @@ async function fetchCrossProjectSource(projectRef, filePath) {
         });
         return null;
     }
-    return response.text();
+    try {
+        return await readLimitedCrossProjectSource(response, registryUrl);
+    }
+    catch (error) {
+        logger.warn("Cross-project source too large", {
+            registryUrl,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }

package/esm/src/oauth/providers/base.d.ts

@@ -36,9 +36,11 @@ export declare class OAuthProvider {
 export declare class OAuthService extends OAuthProvider {
     protected serviceConfig: OAuthServiceConfig;
     protected tokenStore?: TokenStore;
+    private refreshPromises;
     constructor(config: OAuthServiceConfig, tokenStore?: TokenStore, envReader?: EnvReader);
     get serviceId(): string;
     get apiBaseUrl(): string;
+    private refreshKey;
     createAuthorizationUrl(options?: AuthorizationUrlOptions): Promise<{
         url: string;
         state: OAuthState;
@@ -51,6 +53,7 @@ export declare class OAuthService extends OAuthProvider {
      * tokens. See VULN-AUTH-2.
      */
     getAccessToken(userId: string): Promise<string | null>;
+    private refreshAndStoreAccessToken;
     /**
      * Resolve `endpoint` against `apiBaseUrl`, validating that absolute URLs
      * share the configured origin.

package/esm/src/oauth/providers/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/providers/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EAEV,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACX,MAAM,aAAa,CAAC;AAarB,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAuB5D,gCAAgC;AAChC,qBAAa,aAAa;IACxB,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACtC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAEnB,MAAM,EAAE,mBAAmB,EAAE,SAAS,GAAE,SAAkB;IAKtE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,IAAI,OAAO;IAIjB,sBAAsB,CAC1B,OAAO,GAAE,uBAAuB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACnE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IA0C9C,OAAO,CAAC,iBAAiB;IAazB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;YA0CZ,gBAAgB;IAe9B,OAAO,CAAC,4BAA4B;YAQtB,aAAa;IAyCrB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA+BzE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBnD;AAED,+BAA+B;AAC/B,qBAAa,YAAa,SAAQ,aAAa;IAC7C,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC5C,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBAEtB,MAAM,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS;IAMtF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,sBAAsB,CAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAO9C;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAuBpB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;CA+BxF"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/providers/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EAEV,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACX,MAAM,aAAa,CAAC;AAarB,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAuB5D,gCAAgC;AAChC,qBAAa,aAAa;IACxB,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACtC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAEnB,MAAM,EAAE,mBAAmB,EAAE,SAAS,GAAE,SAAkB;IAKtE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,IAAI,OAAO;IAIjB,sBAAsB,CAC1B,OAAO,GAAE,uBAAuB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACnE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IA0C9C,OAAO,CAAC,iBAAiB;IAazB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;YA0CZ,gBAAgB;IAe9B,OAAO,CAAC,4BAA4B;YAQtB,aAAa;IAyCrB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgCzE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBnD;AAED,+BAA+B;AAC/B,qBAAa,YAAa,SAAQ,aAAa;IAC7C,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC5C,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAClC,OAAO,CAAC,eAAe,CAA6C;gBAExD,MAAM,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS;IAMtF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,OAAO,CAAC,UAAU;IAIT,sBAAsB,CAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAO9C;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAyB9C,0BAA0B;IAcxC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAuBpB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;CA+BxF"}

package/esm/src/oauth/providers/base.js

@@ -183,7 +183,9 @@ export class OAuthProvider {
             return {
                 success: false,
                 error: "OAuth not configured",
-                errorDescription: `Missing ${this.config.clientIdEnvVar} or ${this.config.clientSecretEnvVar}`,
+                // Don't leak internal env var names to the caller; this result can
+                // propagate to HTTP responses via OAuthService.
+                errorDescription: "OAuth provider credentials are not configured",
             };
         }
         const body = new URLSearchParams({
@@ -231,6 +233,7 @@ export class OAuthProvider {
 export class OAuthService extends OAuthProvider {
     serviceConfig;
     tokenStore;
+    refreshPromises = new Map();
     constructor(config, tokenStore, envReader) {
         super(config, envReader);
         this.serviceConfig = config;
@@ -242,6 +245,9 @@ export class OAuthService extends OAuthProvider {
     get apiBaseUrl() {
         return this.serviceConfig.apiBaseUrl;
     }
+    refreshKey(userId) {
+        return JSON.stringify([this.serviceId, userId]);
+    }
     createAuthorizationUrl(options = {}) {
         return super.createAuthorizationUrl({
             ...options,
@@ -264,7 +270,23 @@ export class OAuthService extends OAuthProvider {
             return tokens.accessToken;
         if (!tokens.refreshToken)
             return null;
-        const result = await this.refreshTokens(tokens.refreshToken);
+        const key = this.refreshKey(userId);
+        const existingRefresh = this.refreshPromises.get(key);
+        if (existingRefresh)
+            return existingRefresh;
+        const refreshPromise = this.refreshAndStoreAccessToken(userId, tokens.refreshToken);
+        this.refreshPromises.set(key, refreshPromise);
+        try {
+            return await refreshPromise;
+        }
+        finally {
+            if (this.refreshPromises.get(key) === refreshPromise) {
+                this.refreshPromises.delete(key);
+            }
+        }
+    }
+    async refreshAndStoreAccessToken(userId, refreshToken) {
+        const result = await this.refreshTokens(refreshToken);
         if (!result.success || !result.tokens)
             return null;
         if (!this.tokenStore) {

package/esm/src/provider/runtime-loader/tool-input-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-input-status.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/tool-input-status.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,KAAK,uBAAuB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,KAAK,oBAAoB,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAC5C,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAexE;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAA;CAAE,CAAC,CAsBjG;AAED,6CAA6C;AAC7C,wBAAuB,8BAA8B,CACnD,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,WAAW,SAAkC,GAC5C,aAAa,CAAC,OAAO,CAAC,CAkLxB"}
+{"version":3,"file":"tool-input-status.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/runtime-loader/tool-input-status.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,KAAK,uBAAuB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,KAAK,oBAAoB,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAC5C,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAexE;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAA;CAAE,CAAC,CAsBjG;AAED,6CAA6C;AAC7C,wBAAuB,8BAA8B,CACnD,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,WAAW,SAAkC,GAC5C,aAAa,CAAC,OAAO,CAAC,CA2LxB"}

package/esm/src/provider/runtime-loader/tool-input-status.js

@@ -137,14 +137,22 @@ export async function* withToolInputStatusTransitions(stream, thresholdMs = TOOL
             .sort((left, right) => left - right)[0] ?? null;
         if (nextDueAt !== null) {
             let timeoutId = null;
-            const timeoutResult = await Promise.race([
-                nextPartPromise.then((result) => ({ kind: "part", result })),
-                new Promise((resolve) => {
-                    timeoutId = dntShim.setTimeout(() => resolve({ kind: "timeout" }), Math.max(0, nextDueAt - Date.now()));
-                }),
-            ]);
-            if (timeoutId !== null) {
-                clearTimeout(timeoutId);
+            // Clear the timer in finally so it is released even when the race
+            // rejects (iterator error) or the generator is abandoned mid-await
+            // (consumer break/return), not just on the happy path.
+            let timeoutResult;
+            try {
+                timeoutResult = await Promise.race([
+                    nextPartPromise.then((result) => ({ kind: "part", result })),
+                    new Promise((resolve) => {
+                        timeoutId = dntShim.setTimeout(() => resolve({ kind: "timeout" }), Math.max(0, nextDueAt - Date.now()));
+                    }),
+                ]);
+            }
+            finally {
+                if (timeoutId !== null) {
+                    clearTimeout(timeoutId);
+                }
             }
             if (timeoutResult.kind === "timeout") {
                 const readyResult = await readPartIfReady();

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts

@@ -3,6 +3,8 @@ import type { RuntimeAdapter } from "../../../platform/adapters/base.js";
 export type ResolvedModuleDependency = {
     full: string;
     path: string;
+    start: number;
+    end: number;
     relativePath: string;
     depFilePath: string | null;
     isLocalLib: boolean;

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AASzE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgFD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAMR"}
+{"version":3,"file":"dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/dependency-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAczE,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgGD,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuBrC;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,2BAA2B,EAAE,GAC7C,MAAM,CAQR"}

package/esm/src/rendering/orchestrator/module-loader/dependency-resolver.js

@@ -1,16 +1,25 @@
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { parallelMap, rendererLogger } from "../../../utils/index.js";
+import { findStaticImportFromSpans, replaceSourceSpans, } from "../../../transforms/mdx/esm-module-loader/utils/source-spans.js";
 import { findSourceFile } from "../file-resolver/index.js";
 const logger = rendererLogger.component("module-loader");
 function collectAliasImports(fileContent) {
-    return [...fileContent.matchAll(/from\s+["'](@\/[^"']+)["']/g)].map((m) => ({
-        full: m[0],
-        path: m[1] ?? "",
+    return findStaticImportFromSpans(fileContent, (specifier) => specifier.startsWith("@/") ? specifier : null).map(({ original, path, start, end }) => ({
+        full: original,
+        path,
+        start,
+        end,
     }));
 }
 function collectRelativeImports(fileContent, fileDir) {
-    return [...fileContent.matchAll(/from\s+["'](\.\.?\/[^"']+)["']/g)]
-        .map((m) => ({ full: m[0], path: m[1] ?? "", fromDir: fileDir }))
+    return findStaticImportFromSpans(fileContent, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1])
+        .map(({ original, path, start, end }) => ({
+        full: original,
+        path,
+        fromDir: fileDir,
+        start,
+        end,
+    }))
         // Ignore already-transformed file:// imports.
         .filter((imp) => !imp.path.includes("file://"));
 }
@@ -56,6 +65,8 @@ async function resolveRelativeImport(imp, adapter) {
     return {
         full: imp.full,
         path: imp.path,
+        start: imp.start,
+        end: imp.end,
         relativePath: imp.path,
         depFilePath,
         isLocalLib: false,
@@ -79,9 +90,11 @@ export async function resolveModuleDependencies(input) {
 }
 /** Rewrites resolved local imports to their transformed temp file URLs. */
 export function rewriteResolvedDependencyImports(fileContent, transformedDeps) {
-    let rewritten = fileContent;
-    for (const dep of transformedDeps) {
-        rewritten = rewritten.replace(dep.full, `from "file://${dep.depTempPath}"`);
-    }
-    return rewritten;
+    const replacements = transformedDeps.map((dep) => ({
+        start: dep.start,
+        end: dep.end,
+        expected: dep.full,
+        replacement: `from "file://${dep.depTempPath}"`,
+    }));
+    return replaceSourceSpans(fileContent, replacements);
 }

package/esm/src/rendering/renderer-concurrency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderer-concurrency.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer-concurrency.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,oEAAoE,CAAC;AAQ/F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA8C,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QACC,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAS/C;;;;GAIG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IA+BhD,OAAO,CAAC,OAAO;IASf,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF;AAYD,eAAO,MAAM,eAAe,WAE1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAA4B,CAAC;AA8B7D;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"renderer-concurrency.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer-concurrency.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,oEAAoE,CAAC;AAQ/F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA8C,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QACC,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAS/C;;;;GAIG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IA+BhD,OAAO,CAAC,OAAO;IASf,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF;AAYD,eAAO,MAAM,eAAe,WAE1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAA4B,CAAC;AA8B7D;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/esm/src/rendering/renderer-concurrency.js

@@ -154,17 +154,24 @@ export async function acquireProjectSlot(projectId) {
 export async function releaseProjectSlot(projectId) {
     if (RENDER_PER_PROJECT_LIMIT <= 0)
         return;
-    const release = await acquireProjectLock(projectId);
+    const mutex = getProjectMutex(projectId);
+    const release = await mutex.acquire(LOCK_TIMEOUT_MS);
+    let deleteIdleMutex = false;
     try {
         const current = projectRenderCounts.get(projectId) ?? 0;
         if (current <= 1) {
             projectRenderCounts.delete(projectId);
-            projectMutexes.delete(projectId);
+            deleteIdleMutex = mutex.waiting === 0;
             return;
         }
         projectRenderCounts.set(projectId, current - 1);
     }
     finally {
         release();
+        if (deleteIdleMutex &&
+            !projectRenderCounts.has(projectId) &&
+            projectMutexes.get(projectId) === mutex) {
+            projectMutexes.delete(projectId);
+        }
     }
 }

package/esm/src/security/sandbox/worker-permissions.d.ts

@@ -1,10 +1,6 @@
 /**
- * Worker Permission Builder
- *
- * Builds scoped Deno Worker permissions for per-project isolation.
- * Each project worker gets the minimum required permissions.
- *
- * @module security/sandbox/worker-permissions
+ * Deno Worker permission object.
+ * See: https://docs.deno.com/runtime/fundamentals/permissions/
  */
 export interface WorkerPermissions {
     read: string[] | boolean;
@@ -15,6 +11,12 @@ export interface WorkerPermissions {
     ffi: boolean;
     sys: boolean;
 }
+interface WorkerPermissionOptions {
+    /** Override for tests that need to exercise compiled-binary behavior. */
+    isCompiledBinary?: boolean;
+    /** Override for tests that need deterministic compiled-binary support paths. */
+    compiledReadPaths?: string[];
+}
 /**
  * Build scoped permissions for a project worker.
  *
@@ -26,5 +28,6 @@ export interface WorkerPermissions {
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)
  */
-export declare function buildWorkerPermissions(readPaths: string[]): WorkerPermissions;
+export declare function buildWorkerPermissions(readPaths: string[], options?: WorkerPermissionOptions): WorkerPermissions;
+export {};
 //# sourceMappingURL=worker-permissions.d.ts.map

package/esm/src/security/sandbox/worker-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,GAClB,iBAAiB,CAgCnB"}
+{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAED,UAAU,uBAAuB;IAC/B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CA2BnB"}