veryfront 0.1.749 → 0.1.751

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.749",
+    "version": "0.1.751",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/config/schemas/config.schema.d.ts

@@ -110,7 +110,7 @@ export declare const getVeryfrontConfigSchema: () => import("../../internal-agen
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;
@@ -508,7 +508,7 @@ export declare const veryfrontConfigSchema: import("../../internal-agents/schema
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;

package/esm/src/config/schemas/config.schema.js

@@ -161,7 +161,7 @@ export const getVeryfrontConfigSchema = defineSchema((v) => v
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;

package/esm/src/modules/react-loader/ssr-module-loader/ssr-cache-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-cache-manager.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/ssr-cache-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAYlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAW3E;;;;;;;GAOG;AACH,qBAAa,eAAe;IAId,OAAO,CAAC,OAAO;IAH3B,OAAO,CAAC,EAAE,CAAsB;IAChC,OAAO,CAAC,gBAAgB,CAAqB;gBAEzB,OAAO,EAAE,sBAAsB;IAEnD,4DAA4D;IAC5D,aAAa,IAAI,MAAM;IAUvB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAkB/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBlD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1E,yBAAyB,IAAI,OAAO;IAoB9B,kBAAkB,CACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,GAAG,aAAa,EACtC,OAAO,EAAE;QAAE,eAAe,EAAE,OAAO,CAAC;QAAC,qBAAqB,EAAE,OAAO,CAAA;KAAE,GACpE,OAAO,CAAC,OAAO,CAAC;IAgCb,wBAAwB,CAC5B,WAAW,EAAE,gBAAgB,EAC7B,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAuBnB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAOnF,oCAAoC,CAClC,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,EACxB,UAAU,CAAC,EAAE,gBAAgB,GAC5B,IAAI;IAQP,wDAAwD;IACxD,KAAK,IAAI,UAAU,CAAC,OAAO,gBAAgB,CAAC;IAI5C,OAAO,CAAC,4BAA4B;YAItB,qBAAqB;YAsBrB,oBAAoB;YAoDpB,YAAY;CA2B3B"}
+{"version":3,"file":"ssr-cache-manager.d.ts","sourceRoot":"","sources":["../../../../../src/src/modules/react-loader/ssr-module-loader/ssr-cache-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAYlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAW3E;;;;;;;GAOG;AACH,qBAAa,eAAe;IAId,OAAO,CAAC,OAAO;IAH3B,OAAO,CAAC,EAAE,CAAsB;IAChC,OAAO,CAAC,gBAAgB,CAAqB;gBAEzB,OAAO,EAAE,sBAAsB;IAEnD,4DAA4D;IAC5D,aAAa,IAAI,MAAM;IAUvB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAkB/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBlD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1E,yBAAyB,IAAI,OAAO;IAoB9B,kBAAkB,CACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,GAAG,aAAa,EACtC,OAAO,EAAE;QAAE,eAAe,EAAE,OAAO,CAAC;QAAC,qBAAqB,EAAE,OAAO,CAAA;KAAE,GACpE,OAAO,CAAC,OAAO,CAAC;IAgCb,wBAAwB,CAC5B,WAAW,EAAE,gBAAgB,EAC7B,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAuBnB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAOnF,oCAAoC,CAClC,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,EACxB,UAAU,CAAC,EAAE,gBAAgB,GAC5B,IAAI;IAQP,wDAAwD;IACxD,KAAK,IAAI,UAAU,CAAC,OAAO,gBAAgB,CAAC;IAI5C,OAAO,CAAC,4BAA4B;YAItB,qBAAqB;YAsBrB,oBAAoB;YAuDpB,YAAY;CA2B3B"}

package/esm/src/modules/react-loader/ssr-module-loader/ssr-cache-manager.js

@@ -178,12 +178,13 @@ export class SSRCacheManager {
     }
     async hasMissingLocalPaths(code, filePath) {
         const allPaths = await extractAllFilePathsRecursive(code);
-        let hasMissingPath = false;
-        for (const path of allPaths) {
+        let firstMissingPathIndex = -1;
+        for (let index = 0; index < allPaths.length; index++) {
+            const path = allPaths[index];
             try {
                 const stat = await this.fs.stat(path);
                 if (!stat.isFile) {
-                    hasMissingPath = true;
+                    firstMissingPathIndex = index;
                     break;
                 }
             }
@@ -193,12 +194,13 @@ export class SSRCacheManager {
                     missingPath: path.slice(-60),
                     error,
                 });
-                hasMissingPath = true;
+                firstMissingPathIndex = index;
                 break;
             }
         }
-        if (hasMissingPath &&
-            this.options.projectId &&
+        if (firstMissingPathIndex === -1)
+            return false;
+        if (this.options.projectId &&
             this.options.contentSourceId) {
             const recovered = await ensureMdxModuleDependencies(code, {
                 projectId: this.options.projectId,
@@ -212,7 +214,8 @@ export class SSRCacheManager {
                 });
             }
         }
-        for (const path of allPaths) {
+        for (let index = firstMissingPathIndex; index < allPaths.length; index++) {
+            const path = allPaths[index];
             try {
                 const stat = await this.fs.stat(path);
                 if (!stat.isFile)

package/esm/src/security/csrf/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/security/csrf/helpers.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAeA;AAmBD,yDAAyD;AACzD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAChC,IAAI,CAyCN"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/security/csrf/helpers.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAeA;AAmBD,yDAAyD;AACzD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAChC,IAAI,CA0CN"}

package/esm/src/security/csrf/helpers.js

@@ -11,12 +11,13 @@ import { base64urlEncodeBytes } from "../../utils/base64url.js";
 import { parseCookiesFromHeaders } from "../../utils/cookie-utils.js";
 /** Default CSRF token TTL: 24 hours (longer than session action TTL to avoid stale-form 403s). */
 const CSRF_DEFAULT_TTL_SEC = 86_400;
+const DEFAULT_CSRF_COOKIE_NAME = "__Host-vf_csrf";
 /** Generate a CSRF token and return value + Set-Cookie header string */
 export function generateCsrfToken(options) {
-    const cookieName = options?.cookieName ?? "vf_csrf";
+    const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     const maxAge = options?.ttlSec ?? CSRF_DEFAULT_TTL_SEC;
     const httpOnly = options?.httpOnly ?? true;
-    const secure = options?.secure ?? true;
+    const secure = cookieName.startsWith("__Host-") ? true : options?.secure ?? true;
     const bytes = new Uint8Array(32);
     dntShim.crypto.getRandomValues(bytes);
     const token = base64urlEncodeBytes(bytes);
@@ -44,7 +45,7 @@ function timingSafeEqual(a, b) {
 }
 /** Validate CSRF token by comparing header and cookie */
 export function validateCsrf(req, options) {
-    const cookieName = options?.cookieName ?? "vf_csrf";
+    const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     const headerName = options?.headerName ?? "x-csrf-token";
     let cookieToken;
     try {
@@ -83,7 +84,7 @@ export function applyCsrfCookie(req, responseHeaders, csrfConfig) {
         return;
     }
     const config = typeof csrfConfig === "boolean" ? {} : csrfConfig;
-    const cookieName = config.cookieName ?? "vf_csrf";
+    const cookieName = config.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     // Skip if cookie already present in request
     let cookies;
     try {
@@ -96,7 +97,8 @@ export function applyCsrfCookie(req, responseHeaders, csrfConfig) {
     if (cookies[cookieName])
         return;
     // Detect HTTPS from request URL or forwarded proto
-    const isSecure = req.url.startsWith("https://") ||
+    const isSecure = cookieName.startsWith("__Host-") ||
+        req.url.startsWith("https://") ||
         req.headers.get("x-forwarded-proto") === "https";
     const { setCookie } = generateCsrfToken({
         cookieName,

package/esm/src/security/http/csrf/csrf-handler.d.ts

@@ -10,7 +10,7 @@
  * are **not** exempt and require a valid CSRF token. Client-side code that calls
  * Server Actions must:
  *
- * 1. Read the `vf_csrf` cookie (set automatically on HTML responses)
+ * 1. Read the `__Host-vf_csrf` cookie (set automatically on HTML responses)
  * 2. Include it as the `x-csrf-token` request header on every POST
  *
  * Example (client-side fetch wrapper):
@@ -21,7 +21,7 @@
  *
  * const res = await fetch("/_veryfront/rsc/action", {
  *   method: "POST",
- *   headers: { "x-csrf-token": getCookie("vf_csrf") ?? "" },
+ *   headers: { "x-csrf-token": getCookie("__Host-vf_csrf") ?? "" },
  *   body: actionPayload,
  * });
  * ```

package/esm/src/security/http/csrf/csrf-handler.js

@@ -10,7 +10,7 @@
  * are **not** exempt and require a valid CSRF token. Client-side code that calls
  * Server Actions must:
  *
- * 1. Read the `vf_csrf` cookie (set automatically on HTML responses)
+ * 1. Read the `__Host-vf_csrf` cookie (set automatically on HTML responses)
  * 2. Include it as the `x-csrf-token` request header on every POST
  *
  * Example (client-side fetch wrapper):
@@ -21,7 +21,7 @@
  *
  * const res = await fetch("/_veryfront/rsc/action", {
  *   method: "POST",
- *   headers: { "x-csrf-token": getCookie("vf_csrf") ?? "" },
+ *   headers: { "x-csrf-token": getCookie("__Host-vf_csrf") ?? "" },
  *   body: actionPayload,
  * });
  * ```

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.749";
+export declare const VERSION = "0.1.751";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.749";
+export const VERSION = "0.1.751";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.749",
+  "version": "0.1.751",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",