veryfront 0.1.746 → 0.1.749

package/esm/src/embedding/rag-store.js

@@ -1,5 +1,5 @@
 import * as dntShim from "../../_dnt.shims.js";
-import { isNotFoundError, mkdir, readDir, readTextFile, writeTextFile, } from "../platform/compat/fs.js";
+import { isNotFoundError, mkdir, readDir, readTextFile, stat, writeTextFile, } from "../platform/compat/fs.js";
 import { dirname, extname, join } from "../platform/compat/path/basic-operations.js";
 import { serverLogger } from "../utils/index.js";
 import { isVeryfrontCloudEnabled } from "../platform/cloud/resolver.js";
@@ -12,6 +12,77 @@ import { cosineSimilarity } from "../runtime/runtime-bridge.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
 /** Default number of top results returned by similarity search. */
 const DEFAULT_TOP_K = 5;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function isNumberArray(value) {
+    return Array.isArray(value) && value.every(isFiniteNumber);
+}
+function isNonNegativeInteger(value) {
+    return Number.isInteger(value) && Number(value) >= 0;
+}
+function isRagDocumentMeta(value) {
+    if (!isRecord(value))
+        return false;
+    return typeof value.id === "string" &&
+        typeof value.title === "string" &&
+        typeof value.source === "string" &&
+        typeof value.type === "string" &&
+        isFiniteNumber(value.createdAt) &&
+        (value.url === undefined || typeof value.url === "string");
+}
+function isRagChunk(value) {
+    if (!isRecord(value))
+        return false;
+    return typeof value.id === "string" &&
+        typeof value.documentId === "string" &&
+        typeof value.text === "string" &&
+        isNumberArray(value.embedding) &&
+        isNonNegativeInteger(value.index);
+}
+function isRagStoreData(value) {
+    if (!isRecord(value))
+        return false;
+    return Array.isArray(value.documents) &&
+        value.documents.every(isRagDocumentMeta) &&
+        Array.isArray(value.chunks) &&
+        value.chunks.every(isRagChunk);
+}
+function cloneRagStoreData(data) {
+    return {
+        documents: data.documents.map((document) => ({ ...document })),
+        chunks: data.chunks.map((chunk) => ({
+            ...chunk,
+            embedding: [...chunk.embedding],
+        })),
+    };
+}
+function hashStoreText(text) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+function sameStoreFileSignature(left, right) {
+    return left.contentHash === right.contentHash &&
+        left.changeTimeMs === right.changeTimeMs &&
+        left.mtimeMs === right.mtimeMs &&
+        left.size === right.size;
+}
+function isLegacyStoredChunk(value) {
+    if (!isRecord(value))
+        return false;
+    return typeof value.id === "string" &&
+        typeof value.uploadId === "string" &&
+        typeof value.text === "string" &&
+        isNumberArray(value.embedding) &&
+        isNonNegativeInteger(value.index);
+}
 /**
  * Creates a persistent RAG store with lazy embedding and similarity search.
  *
@@ -109,6 +180,7 @@ function createLocalJsonRagStore(config) {
     const contentDir = config.contentDir;
     const contentExtensions = new Set(config.contentExtensions ?? [".md", ".mdx", ".txt"]);
     const chunkOptions = config.chunkOptions;
+    let storeDataCache = null;
     const MAX_TEXT_LENGTH = 5 * 1024 * 1024; // 5 MB text limit per document
     // Serialize all load→modify→save operations to prevent concurrent overwrites.
     // NOTE: This is a single-process, single-instance mutex. In multi-instance
@@ -133,7 +205,10 @@ function createLocalJsonRagStore(config) {
         if (!value || typeof value !== "object")
             return false;
         const data = value;
-        return Array.isArray(data.uploads) && Array.isArray(data.chunks);
+        return Array.isArray(data.uploads) &&
+            data.uploads.every(isRagDocumentMeta) &&
+            Array.isArray(data.chunks) &&
+            data.chunks.every(isLegacyStoredChunk);
     }
     function migrateLegacyUploadStoreData(data) {
         return {
@@ -147,25 +222,98 @@ function createLocalJsonRagStore(config) {
             })),
         };
     }
+    async function getStoreFileMetadata() {
+        try {
+            if (typeof dntShim.Deno !== "undefined") {
+                const info = await dntShim.Deno.stat(storagePath);
+                const changeTime = info.ctime;
+                return {
+                    changeTimeMs: changeTime?.getTime() ?? null,
+                    mtimeMs: info.mtime?.getTime() ?? null,
+                    size: info.size,
+                };
+            }
+            const info = await stat(storagePath);
+            let changeTimeMs = null;
+            try {
+                const nodeFs = await import("node:fs/promises");
+                const nodeInfo = await nodeFs.stat(storagePath);
+                changeTimeMs = nodeInfo.ctime.getTime();
+            }
+            catch {
+                // expected: not every runtime exposes a file change time
+            }
+            return {
+                changeTimeMs,
+                mtimeMs: info.mtime?.getTime() ?? null,
+                size: info.size,
+            };
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return null;
+            throw err;
+        }
+    }
+    async function readStoreFileSnapshot() {
+        const metadata = await getStoreFileMetadata();
+        if (metadata === null)
+            return null;
+        const text = await readTextFile(storagePath);
+        return {
+            signature: {
+                ...metadata,
+                contentHash: hashStoreText(text),
+            },
+            text,
+        };
+    }
+    async function updateStoreDataCache(data, payload) {
+        const metadata = await getStoreFileMetadata();
+        storeDataCache = metadata === null ? null : {
+            signature: {
+                ...metadata,
+                contentHash: hashStoreText(payload),
+            },
+            data: cloneRagStoreData(data),
+        };
+    }
     async function load() {
         try {
-            const data = await readTextFile(storagePath);
-            const parsed = JSON.parse(data);
+            const snapshot = await readStoreFileSnapshot();
+            if (snapshot === null) {
+                storeDataCache = null;
+                return { documents: [], chunks: [] };
+            }
+            if (storeDataCache !== null &&
+                sameStoreFileSignature(storeDataCache.signature, snapshot.signature)) {
+                return cloneRagStoreData(storeDataCache.data);
+            }
+            const parsed = JSON.parse(snapshot.text);
             if (isLegacyUploadStoreData(parsed)) {
-                return migrateLegacyUploadStoreData(parsed);
+                const migrated = migrateLegacyUploadStoreData(parsed);
+                storeDataCache = {
+                    signature: snapshot.signature,
+                    data: cloneRagStoreData(migrated),
+                };
+                return cloneRagStoreData(migrated);
             }
-            if (!parsed || !Array.isArray(parsed.documents) || !Array.isArray(parsed.chunks)) {
+            if (!isRagStoreData(parsed)) {
                 serverLogger.warn("[rag-store] Corrupted store file, resetting", { storagePath });
+                storeDataCache = null;
                 return { documents: [], chunks: [] };
             }
-            return parsed;
+            storeDataCache = { signature: snapshot.signature, data: cloneRagStoreData(parsed) };
+            return cloneRagStoreData(parsed);
         }
         catch (err) {
             // File not found is expected on first run; anything else is worth logging
             if (isNotFoundError(err)) {
+                storeDataCache = null;
                 return { documents: [], chunks: [] };
             }
             serverLogger.warn("[rag-store] Failed to load store, resetting", err);
+            storeDataCache = null;
             return { documents: [], chunks: [] };
         }
     }
@@ -174,7 +322,7 @@ function createLocalJsonRagStore(config) {
         if (dir && dir !== ".") {
             await mkdir(dir, { recursive: true });
         }
-        const payload = JSON.stringify(data, null, 2);
+        const payload = JSON.stringify(data);
         // Atomic write: write to temp file then rename to prevent corruption on crash
         const tmpPath = storagePath + ".tmp";
         await writeTextFile(tmpPath, payload);
@@ -191,6 +339,7 @@ function createLocalJsonRagStore(config) {
             // expected: rename not available in all environments, fall back to direct write
             await writeTextFile(storagePath, payload);
         }
+        await updateStoreDataCache(data, payload);
     }
     async function ensureEmbeddings(data) {
         const unembedded = data.chunks.filter((c) => c.embedding.length === 0);

package/esm/src/embedding/react/use-uploads.d.ts

@@ -25,6 +25,7 @@ export interface UseUploadsResult {
     /** Re-fetch the upload list */
     refresh: () => Promise<void>;
 }
+export declare function buildUploadResourceUrl(api: string, id: string): string;
 /**
  * useUploads hook for managing RAG upload lifecycle.
  */

package/esm/src/embedding/react/use-uploads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-uploads.d.ts","sourceRoot":"","sources":["../../../../src/src/embedding/react/use-uploads.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qCAAqC;IACrC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,6BAA6B;IAC7B,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+BAA+B;IAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAmEvE"}
+{"version":3,"file":"use-uploads.d.ts","sourceRoot":"","sources":["../../../../src/src/embedding/react/use-uploads.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qCAAqC;IACrC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,6BAA6B;IAC7B,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+BAA+B;IAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAmEvE"}

package/esm/src/embedding/react/use-uploads.js

@@ -6,6 +6,9 @@
  */
 import { useCallback, useEffect, useRef, useState } from "../../../react/react.js";
 import { API_ERROR } from "../../errors/index.js";
+export function buildUploadResourceUrl(api, id) {
+    return `${api}/${encodeURIComponent(id)}`;
+}
 /**
  * useUploads hook for managing RAG upload lifecycle.
  */
@@ -61,7 +64,7 @@ export function useUploads(options) {
     const remove = useCallback(async (id) => {
         setError(null);
         try {
-            await fetch(`${options.api}/${id}`, { method: "DELETE" });
+            await fetch(buildUploadResourceUrl(options.api, id), { method: "DELETE" });
             await refresh();
         }
         catch (error) {

package/esm/src/embedding/upload-handler.d.ts

@@ -1,12 +1,24 @@
 import type { RagStore } from "./types.js";
-interface UploadHandlerConfig {
+export type UploadAuthorizationResult = boolean | Response | void | undefined;
+export type UploadAuthorize = (request: Request) => UploadAuthorizationResult | Promise<UploadAuthorizationResult>;
+export type UploadHandlerAuthConfig = {
+    type: "none";
+    allowUnauthenticated: true;
+} | {
+    authorize: UploadAuthorize;
+};
+export interface UploadHandlerConfig {
     maxFileSize?: number;
+    auth?: UploadHandlerAuthConfig;
 }
 /**
  * Creates HTTP route handlers for upload, listing, and deletion.
  *
- * **Important:** These handlers do not include authentication or authorization.
- * Add your own auth middleware before exposing them in production.
+ * Pass `auth: { authorize }` to protect these handlers before they read
+ * request bodies or access the RAG store. For local development, pass
+ * `auth: { type: "none", allowUnauthenticated: true }` to explicitly allow
+ * unauthenticated upload routes. Omitting `auth` still allows the route for
+ * compatibility and logs a warning.
  *
  * Returns `{ POST, GET, DELETE }` handlers compatible with file-based routing.
  * POST accepts multipart form data with a `file` field, extracts text via
@@ -21,7 +33,15 @@ interface UploadHandlerConfig {
  * import { createUploadHandler } from "veryfront/embedding";
  * import { store } from "lib/store.ts";
  *
- * export const { POST, GET } = createUploadHandler(store);
+ * export const { POST, GET } = createUploadHandler(store, {
+ *   auth: {
+ *     authorize: (request) => {
+ *       const token = Deno.env.get("UPLOAD_TOKEN");
+ *       return token !== undefined &&
+ *         request.headers.get("authorization") === `Bearer ${token}`;
+ *     },
+ *   },
+ * });
  * ```
  *
  * @example
@@ -30,15 +50,16 @@ interface UploadHandlerConfig {
  * import { createUploadHandler } from "veryfront/embedding";
  * import { store } from "lib/store.ts";
  *
- * export const { DELETE } = createUploadHandler(store);
+ * export const { DELETE } = createUploadHandler(store, {
+ *   auth: { type: "none", allowUnauthenticated: true },
+ * });
  * ```
  */
 export declare function createUploadHandler(store: RagStore, config?: UploadHandlerConfig): {
     POST: (request: Request) => Promise<Response>;
-    GET: () => Promise<Response>;
-    DELETE: (_request: Request, context: {
+    GET: (request?: Request) => Promise<Response>;
+    DELETE: (request: Request, context: {
         params: Record<string, string>;
     }) => Promise<Response>;
 };
-export {};
 //# sourceMappingURL=upload-handler.d.ts.map

package/esm/src/embedding/upload-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqF3C,UAAU,mBAAmB;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,mBAAmB;oBAIC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;eA8ElC,OAAO,CAAC,QAAQ,CAAC;uBAW3B,OAAO,WACR;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1C,OAAO,CAAC,QAAQ,CAAC;EA0BrB"}
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqF3C,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,OAAO,KACb,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,IAAI,CAAA;CAAE,GAC5C;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,uBAAuB,CAAC;CAChC;AA6FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,mBAAmB;oBAKC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAiF3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAc7C,OAAO,WACP;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1C,OAAO,CAAC,QAAQ,CAAC;EA6BrB"}

package/esm/src/embedding/upload-handler.js

@@ -75,6 +75,43 @@ function sanitizeFileName(raw) {
     return sanitized || "untitled";
 }
 const MAX_CONCURRENT_URL_LOOKUPS = 5;
+let missingAuthWarningEmitted = false;
+function warnMissingAuthConfig() {
+    if (missingAuthWarningEmitted)
+        return;
+    missingAuthWarningEmitted = true;
+    serverLogger.warn("createUploadHandler registered without auth. Pass auth: { authorize } for protected routes, " +
+        "or auth: { type: 'none', allowUnauthenticated: true } to explicitly allow unauthenticated uploads.");
+}
+function resolveUploadAuthorize(auth) {
+    if (auth === undefined) {
+        warnMissingAuthConfig();
+        return null;
+    }
+    if ("type" in auth) {
+        if (auth.type === "none" && auth.allowUnauthenticated === true)
+            return null;
+        throw new Error("createUploadHandler auth type 'none' requires allowUnauthenticated: true.");
+    }
+    if (typeof auth.authorize === "function")
+        return auth.authorize;
+    throw new Error("createUploadHandler auth must be { authorize } or " +
+        "{ type: 'none', allowUnauthenticated: true }.");
+}
+async function authorizeUploadRequest(request, authorize) {
+    if (!authorize)
+        return null;
+    if (!request) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const result = await authorize(request);
+    if (result instanceof Response)
+        return result;
+    if (result === false) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    return null;
+}
 async function enrichUploadsWithSourceUrls(uploads) {
     const sourceBlobStorage = getSourceBlobStorage();
     if (!sourceBlobStorage)
@@ -111,8 +148,11 @@ function getSourceBlobStorage() {
 /**
  * Creates HTTP route handlers for upload, listing, and deletion.
  *
- * **Important:** These handlers do not include authentication or authorization.
- * Add your own auth middleware before exposing them in production.
+ * Pass `auth: { authorize }` to protect these handlers before they read
+ * request bodies or access the RAG store. For local development, pass
+ * `auth: { type: "none", allowUnauthenticated: true }` to explicitly allow
+ * unauthenticated upload routes. Omitting `auth` still allows the route for
+ * compatibility and logs a warning.
  *
  * Returns `{ POST, GET, DELETE }` handlers compatible with file-based routing.
  * POST accepts multipart form data with a `file` field, extracts text via
@@ -127,7 +167,15 @@ function getSourceBlobStorage() {
  * import { createUploadHandler } from "veryfront/embedding";
  * import { store } from "lib/store.ts";
  *
- * export const { POST, GET } = createUploadHandler(store);
+ * export const { POST, GET } = createUploadHandler(store, {
+ *   auth: {
+ *     authorize: (request) => {
+ *       const token = Deno.env.get("UPLOAD_TOKEN");
+ *       return token !== undefined &&
+ *         request.headers.get("authorization") === `Bearer ${token}`;
+ *     },
+ *   },
+ * });
  * ```
  *
  * @example
@@ -136,13 +184,19 @@ function getSourceBlobStorage() {
  * import { createUploadHandler } from "veryfront/embedding";
  * import { store } from "lib/store.ts";
  *
- * export const { DELETE } = createUploadHandler(store);
+ * export const { DELETE } = createUploadHandler(store, {
+ *   auth: { type: "none", allowUnauthenticated: true },
+ * });
  * ```
  */
 export function createUploadHandler(store, config) {
     const maxSize = config?.maxFileSize ?? MAX_FILE_SIZE;
+    const authorize = resolveUploadAuthorize(config?.auth);
     async function POST(request) {
         try {
+            const unauthorized = await authorizeUploadRequest(request, authorize);
+            if (unauthorized)
+                return unauthorized;
             const formData = await request.formData();
             const file = formData.get("file");
             if (!file || !(file instanceof FileCtor)) {
@@ -201,8 +255,11 @@ export function createUploadHandler(store, config) {
             return Response.json({ error: message }, { status: 500 });
         }
     }
-    async function GET() {
+    async function GET(request) {
         try {
+            const unauthorized = await authorizeUploadRequest(request, authorize);
+            if (unauthorized)
+                return unauthorized;
             const uploads = await enrichUploadsWithSourceUrls(await store.listDocuments());
             return Response.json({ uploads });
         }
@@ -211,8 +268,11 @@ export function createUploadHandler(store, config) {
             return Response.json({ error: "Failed to list uploads" }, { status: 500 });
         }
     }
-    async function DELETE(_request, context) {
+    async function DELETE(request, context) {
         try {
+            const unauthorized = await authorizeUploadRequest(request, authorize);
+            if (unauthorized)
+                return unauthorized;
             const id = context.params.id;
             if (!id) {
                 return Response.json({ error: "Missing upload ID" }, { status: 400 });

package/esm/src/html/html-shell-generator.js

@@ -10,7 +10,7 @@ import { generateHydrationData, getDevScripts, getProdScripts, PROD_HYDRATION_MO
 import { getPreviewStylesheetLink, getStudioScripts } from "./dev-scripts.js";
 import { processMetadata } from "./metadata-builder.js";
 import { extractCandidates, getDevStyles as getErrorOverlayStyles, getProjectCSS, } from "./styles-builder/index.js";
-import { buildImportMapJson, buildRootAttributes, shouldDisableLayout } from "./utils.js";
+import { buildImportMap, buildRootAttributes, shouldDisableLayout } from "./utils.js";
 function pathToModuleUrl(path, studioEmbed) {
     if (!path)
         return "";
@@ -114,7 +114,7 @@ async function generateHTMLShellPartsImpl(meta, options, params, props, contentF
     // Enable dev scripts for local dev OR preview mode (for HMR support in Studio),
     // unless a caller explicitly forces production client scripts for fair benchmarking.
     const useDevScripts = !options.forceProductionScripts && (isLocalProject || isPreviewMode);
-    const importMapJsonPromise = buildImportMapJson({
+    const importMapPromise = buildImportMap({
         projectDir: options.projectDir,
         config: options.config,
         customImports: options.importMap,
@@ -130,11 +130,11 @@ async function generateHTMLShellPartsImpl(meta, options, params, props, contentF
         : getProdScripts(meta.slug || "", params, props, nonce);
     const modeStyles = useDevScripts ? getErrorOverlayStyles(nonce) : "";
     const modulePreloadHints = generateModulePreloadHints(options);
-    const importMapJson = await profilePhase("html.import_map", () => importMapJsonPromise);
+    const importMap = await profilePhase("html.import_map", () => importMapPromise);
+    const importMapJson = importMap.json;
     // Preload critical React dependencies to avoid waterfall delays.
     // jsx-runtime is discovered late (only when modules execute), adding ~500ms latency.
-    const importMapData = JSON.parse(importMapJson);
-    const jsxRuntimeUrl = importMapData.imports?.["react/jsx-runtime"];
+    const jsxRuntimeUrl = importMap.imports["react/jsx-runtime"];
     const criticalDepsPreload = jsxRuntimeUrl
         ? `<link rel="modulepreload" href="${jsxRuntimeUrl}">`
         : "";

package/esm/src/html/nonce-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nonce-injection.d.ts","sourceRoot":"","sources":["../../../src/src/html/nonce-injection.ts"],"names":[],"mappings":"AA8HA,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA6DvE;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,cAAc,CAAC,UAAU,CAAC,CAuI5B"}
+{"version":3,"file":"nonce-injection.d.ts","sourceRoot":"","sources":["../../../src/src/html/nonce-injection.ts"],"names":[],"mappings":"AA8HA,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA6DvE;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,cAAc,CAAC,UAAU,CAAC,CA8I5B"}

package/esm/src/html/nonce-injection.js

@@ -160,11 +160,11 @@ export function addNonceToHtmlStream(stream, nonce) {
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
     let buffer = "";
+    let lowerBuffer = "";
     let rawTextTag = null;
     function transformBuffer(flush) {
         let result = "";
         let index = 0;
-        const lowerBuffer = buffer.toLowerCase();
         while (index < buffer.length) {
             if (rawTextTag) {
                 const closingIndex = findRawTextClosingTagStart(lowerBuffer, rawTextTag, index);
@@ -227,7 +227,10 @@ export function addNonceToHtmlStream(stream, nonce) {
                 rawTextTag = tagName;
             }
         }
-        buffer = buffer.slice(index);
+        if (index > 0) {
+            buffer = buffer.slice(index);
+            lowerBuffer = buffer.toLowerCase();
+        }
         return result;
     }
     const reader = stream.getReader();
@@ -244,7 +247,9 @@ export function addNonceToHtmlStream(stream, nonce) {
                 while (true) {
                     const { done, value } = await reader.read();
                     if (done) {
-                        buffer += decoder.decode();
+                        const decoded = decoder.decode();
+                        buffer += decoded;
+                        lowerBuffer += decoded.toLowerCase();
                         const transformed = transformBuffer(true);
                         if (transformed)
                             controller.enqueue(encoder.encode(transformed));
@@ -252,7 +257,9 @@ export function addNonceToHtmlStream(stream, nonce) {
                         releaseReaderLock();
                         return;
                     }
-                    buffer += decoder.decode(value, { stream: true });
+                    const decoded = decoder.decode(value, { stream: true });
+                    buffer += decoded;
+                    lowerBuffer += decoded.toLowerCase();
                     const transformed = transformBuffer(false);
                     if (transformed) {
                         controller.enqueue(encoder.encode(transformed));

package/esm/src/html/utils.d.ts

@@ -1,11 +1,16 @@
 import type { VeryfrontConfig } from "../config/index.js";
 export declare function buildRootAttributes(slug: string, mode: string, noLayout: boolean, ssrHash?: string): string;
+export interface BuiltImportMap {
+    imports: Record<string, string>;
+    json: string;
+}
 interface BuildImportMapOptions {
     projectDir?: string;
     config?: VeryfrontConfig;
     customImports?: Record<string, string>;
     pretty?: boolean;
 }
+export declare function buildImportMap(options?: BuildImportMapOptions | Record<string, string>): Promise<BuiltImportMap>;
 export declare function buildImportMapJson(options?: BuildImportMapOptions | Record<string, string>): Promise<string>;
 export declare function clearImportMapCache(): void;
 export declare function shouldDisableLayout(frontmatter?: Record<string, unknown>): boolean;

package/esm/src/html/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/src/html/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAc1D,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAQR;AAsOD,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAWD,wBAAsB,kBAAkB,CACtC,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACvD,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAElF"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/src/html/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAc1D,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAQR;AAaD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AA4ND,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAqBD,wBAAsB,cAAc,CAClC,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACvD,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACvD,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAElF"}

package/esm/src/html/utils.js

@@ -178,19 +178,25 @@ async function resolveVersions(projectDir, config) {
     }
     return { react: await reactVersion, veryfront: veryfrontVersion };
 }
+function stringifyImportMap(imports, pretty = true) {
+    return JSON.stringify({ imports }, null, pretty ? 2 : undefined);
+}
+function stableMapKey(imports) {
+    return imports
+        ? JSON.stringify(Object.entries(imports).sort(([a], [b]) => a.localeCompare(b)))
+        : "";
+}
 function isImportMapOnlyOptions(options) {
     return !("projectDir" in options) &&
         !("config" in options) &&
         !("customImports" in options) &&
         !("pretty" in options);
 }
-export async function buildImportMapJson(options) {
-    const stringifyImportMap = (imports, pretty = true) => JSON.stringify({ imports }, null, pretty ? 2 : undefined);
-    const stableMapKey = (imports) => imports ? JSON.stringify(Object.entries(imports).sort(([a], [b]) => a.localeCompare(b))) : "";
+export async function buildImportMap(options) {
     if (options && isImportMapOnlyOptions(options)) {
-        const imports = options;
+        const imports = { ...options };
         if (Object.keys(imports).length > 0) {
-            return stringifyImportMap(imports);
+            return { imports, json: stringifyImportMap(imports) };
         }
     }
     const { projectDir, config, customImports, pretty = true } = (options ?? {});
@@ -206,7 +212,7 @@ export async function buildImportMapJson(options) {
             "react/jsx-dev-runtime": reactTemplates.jsxDevRuntime(versions.react),
             ...customImports,
         };
-        return stringifyImportMap(imports, pretty);
+        return { imports, json: stringifyImportMap(imports, pretty) };
     }
     let imports;
     if (mode === "self-hosted") {
@@ -230,10 +236,14 @@ export async function buildImportMapJson(options) {
     });
     const cached = importMapJsonCache.get(cacheKey);
     if (cached)
-        return cached.json;
+        return cached;
     const json = stringifyImportMap(imports, pretty);
-    importMapJsonCache.set(cacheKey, { cacheKey, json });
-    return json;
+    const built = { cacheKey, imports, json };
+    importMapJsonCache.set(cacheKey, built);
+    return built;
+}
+export async function buildImportMapJson(options) {
+    return (await buildImportMap(options)).json;
 }
 export function clearImportMapCache() {
     importMapJsonCache.clear();

package/esm/src/middleware/builtin/security/redis-rate-limit.d.ts

@@ -12,6 +12,8 @@ export declare class RedisRateLimitStore implements RateLimitStore {
     private readonly keyPrefix;
     constructor(options?: RedisRateLimitOptions);
     private ensureClient;
+    private clearCachedClient;
+    private attachClientLifecycleHandlers;
     private connectClient;
     private storageKey;
     increment(key: string, windowMs: number): Promise<RateLimitEntry>;

package/esm/src/middleware/builtin/security/redis-rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/redis-rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjE,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wCAAwC;AACxC,qBAAa,mBAAoB,YAAW,cAAc;IACxD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,GAAE,qBAA0B;IAK/C,OAAO,CAAC,YAAY;YAMN,aAAa;IAmC3B,OAAO,CAAC,UAAU;IAIZ,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqBjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAK/B"}
+{"version":3,"file":"redis-rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/redis-rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA4BjE,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wCAAwC;AACxC,qBAAa,mBAAoB,YAAW,cAAc;IACxD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,GAAE,qBAA0B;IAK/C,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,6BAA6B;YAWvB,aAAa;IAiC3B,OAAO,CAAC,UAAU;IAIZ,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAcjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAK/B"}