veryfront 0.1.755 → 0.1.756

package/esm/src/rendering/orchestrator/module-loader/module-persistence.js

@@ -0,0 +1,80 @@
+/**
+ * Final module-loader persistence phase.
+ *
+ * @module rendering/orchestrator/module-loader/module-persistence
+ */
+import { join } from "../../../platform/compat/path/index.js";
+import { rendererLogger } from "../../../utils/index.js";
+import { hashCodeHex } from "../../../utils/hash-utils.js";
+import { getModulePathCache, saveModulePathCache, } from "../../../transforms/mdx/esm-module-loader/cache/index.js";
+import { buildMdxEsmPathCacheKey } from "../../../transforms/mdx/esm-module-loader/cache-format.js";
+const logger = rendererLogger.component("module-loader");
+/** Maximum number of directories to track to prevent memory leaks. */
+const MAX_CREATED_DIRS = 5_000;
+/** Cache for created directories to avoid repeated mkdir calls (LRU-style). */
+const createdDirs = new Set();
+/** Prune oldest entries when cache exceeds limit. */
+function pruneCreatedDirs() {
+    if (createdDirs.size <= MAX_CREATED_DIRS)
+        return;
+    const toDelete = createdDirs.size - MAX_CREATED_DIRS;
+    let deleted = 0;
+    for (const dir of createdDirs) {
+        if (deleted >= toDelete)
+            break;
+        createdDirs.delete(dir);
+        deleted++;
+    }
+}
+async function ensureDir(adapter, dir) {
+    if (createdDirs.has(dir))
+        return;
+    try {
+        await adapter.fs.mkdir(dir, { recursive: true });
+    }
+    catch (_) {
+        /* expected: directory might already exist */
+    }
+    finally {
+        createdDirs.add(dir);
+        pruneCreatedDirs();
+    }
+}
+/** Write a transformed module artifact and register cache pointers. */
+export async function persistTransformedModule(input) {
+    const transformedHash = hashCodeHex(input.transformedCode).slice(0, 8);
+    const relativePath = input.filePath.startsWith(input.projectDir)
+        ? input.filePath.slice(input.projectDir.length).replace(/^\/+/, "")
+        : input.filePath.replace(/^\/+/, "");
+    const jsPath = relativePath.replace(/\.(tsx?|jsx|mdx)$/, `.${transformedHash}.js`);
+    const tempFilePath = join(input.tmpDir, jsPath);
+    const tempDir = tempFilePath.substring(0, tempFilePath.lastIndexOf("/"));
+    await ensureDir(input.localAdapter, tempDir);
+    try {
+        await input.localAdapter.fs.writeFile(tempFilePath, input.transformedCode);
+    }
+    catch (error) {
+        logger.error("Failed to write module:", {
+            filePath: input.filePath,
+            tempFilePath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    if (input.contentSourceId) {
+        const normalizedPath = `_vf_modules/${relativePath.replace(/\.(tsx?|jsx|mdx)$/, ".js")}`;
+        const mdxCacheKey = buildMdxEsmPathCacheKey(normalizedPath, input.reactVersion);
+        const cache = await getModulePathCache(input.tmpDir);
+        cache.set(mdxCacheKey, tempFilePath);
+        saveModulePathCache(input.tmpDir).catch((err) => {
+            logger.debug("Failed to save module cache", { error: String(err) });
+        });
+        logger.debug("Registered module in MDX-ESM cache", {
+            file: input.filePath.slice(-40),
+            mdxCacheKey,
+            tempFilePath: tempFilePath.slice(-60),
+        });
+    }
+    input.moduleCache.set(input.cacheKey, tempFilePath);
+    return tempFilePath;
+}

package/esm/src/rendering/orchestrator/module-loader/module-transform-cache.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Transform-cache and retry phase for the SSR module loader.
+ *
+ * @module rendering/orchestrator/module-loader/module-transform-cache
+ */
+import type { RuntimeAdapter } from "../../../platform/adapters/base.js";
+import { initializeTransformCache, setCachedTransformAsync } from "../../../transforms/esm/transform-cache.js";
+import { getHttpBundleCacheDir } from "../../../utils/cache-dir.js";
+/** Pattern to detect unresolved /_vf_modules/ imports that will fail at runtime. */
+export declare const UNRESOLVED_VF_MODULES_RE: RegExp;
+export interface ModuleTransformCacheResult {
+    code: string;
+    cacheKey: string;
+    contentHash: string;
+}
+interface TransformCacheResult {
+    code: string;
+    cacheHit: boolean;
+    bundleManifestId?: string;
+}
+interface BundleValidationResult {
+    valid: boolean;
+    failedHashes: string[];
+    reason?: string;
+    source: string;
+}
+interface TransformOptions {
+    projectId: string;
+    dev: boolean;
+    ssr: boolean;
+    reactVersion?: string;
+}
+interface PipelineResult {
+    code: string;
+}
+export interface ModuleTransformCacheDeps {
+    initializeTransformCache: typeof initializeTransformCache;
+    getOrComputeTransform: (key: string, compute: () => Promise<string>, ttlSeconds: number) => Promise<TransformCacheResult>;
+    transformToESM: (code: string, filePath: string, projectDir: string, adapter: RuntimeAdapter, options: TransformOptions) => Promise<string>;
+    validateCachedBundlesByManifestOrCode: (code: string, bundleManifestId: string | undefined, cacheDir: string) => Promise<BundleValidationResult>;
+    getHttpBundleCacheDir: typeof getHttpBundleCacheDir;
+    setCachedTransformAsync: typeof setCachedTransformAsync;
+    runPipeline: (code: string, filePath: string, projectDir: string, options: TransformOptions) => Promise<PipelineResult>;
+}
+export interface TransformModuleCodeWithCacheInput {
+    fileContent: string;
+    filePath: string;
+    projectDir: string;
+    effectiveProjectId: string;
+    mode: "development" | "production";
+    adapter: RuntimeAdapter;
+    reactVersion?: string;
+    ttlSeconds?: number;
+    deps?: ModuleTransformCacheDeps;
+}
+/** Transform module source through the shared cache and stale-cache retry checks. */
+export declare function transformModuleCodeWithCache(input: TransformModuleCodeWithCacheInput): Promise<ModuleTransformCacheResult>;
+export {};
+//# sourceMappingURL=module-transform-cache.d.ts.map

package/esm/src/rendering/orchestrator/module-loader/module-transform-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-transform-cache.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/module-transform-cache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,OAAO,EAGL,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKpE,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAA6D,CAAC;AAEnG,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,sBAAsB;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,gBAAgB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,qBAAqB,EAAE,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,cAAc,EAAE,CACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,qCAAqC,EAAE,CACrC,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IACpD,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,WAAW,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B;AAeD,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,wBAAwB,CAAC;CACjC;AAED,qFAAqF;AACrF,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,0BAA0B,CAAC,CAoHrC"}

package/esm/src/rendering/orchestrator/module-loader/module-transform-cache.js

@@ -0,0 +1,97 @@
+/**
+ * Transform-cache and retry phase for the SSR module loader.
+ *
+ * @module rendering/orchestrator/module-loader/module-transform-cache
+ */
+import { rendererLogger } from "../../../utils/index.js";
+import { hashCodeHex } from "../../../utils/hash-utils.js";
+import { transformToESM } from "../../../transforms/esm-transform.js";
+import { generateCacheKey as generateTransformCacheKey, getOrComputeTransform, initializeTransformCache, setCachedTransformAsync, } from "../../../transforms/esm/transform-cache.js";
+import { validateCachedBundlesByManifestOrCode } from "../../../transforms/esm/cached-bundle-validation.js";
+import { getHttpBundleCacheDir } from "../../../utils/cache-dir.js";
+import { TRANSFORM_DISTRIBUTED_TTL_SEC } from "../../../utils/constants/cache.js";
+const logger = rendererLogger.component("module-loader");
+/** Pattern to detect unresolved /_vf_modules/ imports that will fail at runtime. */
+export const UNRESOLVED_VF_MODULES_RE = /from\s*["']((?:file:\/\/)?\/?\/?_vf_modules\/[^"']+)["']/;
+const defaultDeps = {
+    initializeTransformCache,
+    getOrComputeTransform,
+    transformToESM,
+    validateCachedBundlesByManifestOrCode,
+    getHttpBundleCacheDir,
+    setCachedTransformAsync,
+    runPipeline: async (code, filePath, projectDir, options) => {
+        const { runPipeline } = await import("../../../transforms/pipeline/index.js");
+        return await runPipeline(code, filePath, projectDir, options);
+    },
+};
+/** Transform module source through the shared cache and stale-cache retry checks. */
+export async function transformModuleCodeWithCache(input) {
+    const deps = input.deps ?? defaultDeps;
+    const ttlSeconds = input.ttlSeconds ?? TRANSFORM_DISTRIBUTED_TTL_SEC;
+    const contentHash = hashCodeHex(input.fileContent);
+    const scopedPath = `${input.effectiveProjectId}:${input.filePath}`;
+    const cacheKey = generateTransformCacheKey(scopedPath, contentHash, true);
+    const transformOptions = {
+        projectId: input.effectiveProjectId,
+        dev: input.mode === "development",
+        ssr: true,
+        reactVersion: input.reactVersion,
+    };
+    await deps.initializeTransformCache();
+    const transformResult = await deps.getOrComputeTransform(cacheKey, () => {
+        logger.debug("Transform cache miss, transforming", { filePath: input.filePath });
+        return deps.transformToESM(input.fileContent, input.filePath, input.projectDir, input.adapter, transformOptions);
+    }, ttlSeconds);
+    let transformedCode = transformResult.code;
+    if (transformResult.cacheHit) {
+        const validation = await deps.validateCachedBundlesByManifestOrCode(transformedCode, transformResult.bundleManifestId, deps.getHttpBundleCacheDir());
+        if (!validation.valid) {
+            logger.warn("Cached HTTP bundle validation failed, re-transforming", {
+                filePath: input.filePath,
+                manifestId: transformResult.bundleManifestId?.slice(0, 12),
+                failedHashes: validation.failedHashes,
+                reason: validation.reason,
+                source: validation.source,
+            });
+            transformedCode = await deps.transformToESM(input.fileContent, input.filePath, input.projectDir, input.adapter, transformOptions);
+            deps.setCachedTransformAsync(cacheKey, transformedCode, contentHash, ttlSeconds).catch((error) => {
+                logger.debug("Failed to update transform cache after re-transform", {
+                    filePath: input.filePath,
+                    error,
+                });
+            });
+        }
+    }
+    // CRITICAL: Validate that no unresolved /_vf_modules/ imports remain after transform.
+    // These imports should have been resolved to file:// paths by ssrVfModulesPlugin.
+    // If they're still present, retry the transform bypassing all caches.
+    if (UNRESOLVED_VF_MODULES_RE.test(transformedCode)) {
+        const match = transformedCode.match(UNRESOLVED_VF_MODULES_RE);
+        const unresolvedImport = match?.[1] || "unknown";
+        logger.warn("[ModuleLoader] Transform has unresolved _vf_modules import, retrying without cache", {
+            filePath: input.filePath.slice(-60),
+            unresolvedImport: unresolvedImport.slice(0, 80),
+            cacheHit: transformResult.cacheHit,
+        });
+        const pipelineResult = await deps.runPipeline(input.fileContent, input.filePath, input.projectDir, transformOptions);
+        transformedCode = pipelineResult.code;
+        if (UNRESOLVED_VF_MODULES_RE.test(transformedCode)) {
+            const retryMatch = transformedCode.match(UNRESOLVED_VF_MODULES_RE);
+            logger.error("Transform still has unresolved _vf_modules after retry", {
+                filePath: input.filePath.slice(-60),
+                unresolvedImport: retryMatch?.[1]?.slice(0, 80) || "unknown",
+                hint: "Check that framework sources exist in dist/framework-src/ and ssrVfModulesPlugin is running",
+            });
+        }
+        else {
+            deps.setCachedTransformAsync(cacheKey, transformedCode, hashCodeHex(transformedCode).slice(0, 16), ttlSeconds).catch((error) => {
+                logger.debug("Failed to update cache after retry", {
+                    filePath: input.filePath,
+                    error,
+                });
+            });
+        }
+    }
+    return { code: transformedCode, cacheKey, contentHash };
+}

package/esm/src/routing/api/handler.d.ts

@@ -4,6 +4,7 @@ import { type APIContext } from "./context-builder.js";
 import type { APIRoute } from "./module-loader/types.js";
 import { loadHandlerModule } from "./module-loader/loader.js";
 import { discoverAppRoutes, discoverPagesRoutes } from "./route-discovery.js";
+import type { HandlerContext } from "../../types/index.js";
 export type { APIContext, APIRoute };
 /**
  * Injection interface for testing APIRouteHandler dependencies
@@ -40,7 +41,7 @@ export declare class APIRouteHandler {
     private configPromise;
     constructor(projectDir: string, adapter?: RuntimeAdapter);
     initialize(): Promise<void>;
-    handle(request: Request): Promise<Response | null>;
+    handle(request: Request, ctx?: HandlerContext): Promise<Response | null>;
     private loadHandler;
     clearCache(): void;
     destroy(): void;

package/esm/src/routing/api/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAO9E,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAE3E,qBAAa,eAAe;IAgBxB,OAAO,CAAC,UAAU;IAfpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAyFlD,OAAO,CAAC,WAAW;IAuCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;YAKD,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAE3E,qBAAa,eAAe;IAgBxB,OAAO,CAAC,UAAU;IAfpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA0FxE,OAAO,CAAC,WAAW;IAuCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;YAKD,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}

package/esm/src/routing/api/handler.js

@@ -79,7 +79,7 @@ export class APIRouteHandler {
             logger.debug("Route handler initialized");
         }, { "api.projectDir": this.projectDir });
     }
-    handle(request) {
+    handle(request, ctx) {
         const { pathname } = new URL(request.url);
         return withSpan("api.handle", async () => {
             const adapter = await this.ensureAdapter();
@@ -132,6 +132,7 @@ export class APIRouteHandler {
             const isolationOptions = {
                 modulePath: match.route.page,
                 projectDir: this.projectDir,
+                isLocalProject: ctx?.isLocalProject,
             };
             const response = isAppRoute
                 ? await executeAppRoute(handler, request, match, pathname, adapter, isolationOptions)

package/esm/src/routing/api/route-executor.d.ts

@@ -1,11 +1,14 @@
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import type { RouteMatch } from "./api-route-matcher.js";
 import type { APIRoute } from "./module-loader/types.js";
+export declare function __resetInProcessIsolationWarningForTests(): void;
 export interface ExecuteRouteOptions {
     /** Absolute path to the handler module on disk (for isolated execution) */
     modulePath?: string;
     /** Project directory (for isolated execution scope) */
     projectDir?: string;
+    /** Whether the handler module belongs to a trusted local development project. */
+    isLocalProject?: boolean;
 }
 export declare function executeAppRoute(handler: APIRoute, request: Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter, options?: ExecuteRouteOptions): Promise<Response>;
 export declare function executePagesRoute(handler: APIRoute, request: Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter, projectDir?: string, options?: ExecuteRouteOptions): Promise<Response>;

package/esm/src/routing/api/route-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EACV,QAAQ,EAKT,MAAM,0BAA0B,CAAC;AA0UlC,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA6CnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAuCnB"}
+{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EACV,QAAQ,EAKT,MAAM,0BAA0B,CAAC;AAoJlC,wBAAgB,wCAAwC,IAAI,IAAI,CAE/D;AAqND,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAwCnB"}

package/esm/src/routing/api/route-executor.js

@@ -106,6 +106,32 @@ function checkContentLengthLimit(request) {
         });
     }
 }
+let warnedUntrustedInProcessExecution = false;
+export function __resetInProcessIsolationWarningForTests() {
+    warnedUntrustedInProcessExecution = false;
+}
+function warnIfUntrustedInProcessExecution(routeKind, pathname, options) {
+    if (options?.isLocalProject !== false)
+        return;
+    if (isWorkerIsolationEnabled())
+        return;
+    if (warnedUntrustedInProcessExecution)
+        return;
+    warnedUntrustedInProcessExecution = true;
+    try {
+        logger.warn("Untrusted project code is executing in-process with worker isolation disabled. Enable WORKER_ISOLATION_ENABLED=1 and WORKER_ISOLATION_API=1 to run project routes in a permission-restricted worker.", {
+            modulePath: options.modulePath,
+            pathname,
+            projectDir: options.projectDir,
+            requiredEnv: ["WORKER_ISOLATION_ENABLED", "WORKER_ISOLATION_API"],
+            routeKind,
+            workerIsolationEnabled: false,
+        });
+    }
+    catch {
+        // A diagnostic warning must not prevent the API route from running.
+    }
+}
 async function readBodyWithSizeGuard(request) {
     if (!request.body)
         return null;
@@ -237,6 +263,7 @@ export function executeAppRoute(handler, request, match, pathname, adapter, opti
         return executeAppRouteIsolated(options.modulePath, request, match, pathname, adapter, options.projectDir);
     }
     // Default path: execute in main process (existing behavior)
+    warnIfUntrustedInProcessExecution("app", pathname, options);
     const method = request.method.toUpperCase();
     return withSpan("api.executeAppRoute", async () => {
         const handlerModule = handler;
@@ -266,6 +293,7 @@ export function executePagesRoute(handler, request, match, pathname, adapter, pr
         return executePagesRouteIsolated(options.modulePath, request, match, pathname, adapter, options.projectDir ?? projectDir);
     }
     // Default path: execute in main process (existing behavior)
+    warnIfUntrustedInProcessExecution("pages", pathname, options);
     const method = request.method;
     return withSpan("api.executePagesRoute", async () => {
         const methodHandler = handler[method] ?? handler.default;

package/esm/src/runtime/runtime-bridge.js

@@ -271,7 +271,7 @@ export function generateText(options) {
     return resolveDirectTools(options.tools).then((tools) => options.model.doGenerate({
         prompt: toRuntimePrompt(normalizeSystemPrompt(options.system), options.messages),
         maxOutputTokens: options.maxOutputTokens,
-        temperature: options.temperature,
+        ...(options.temperature === undefined ? {} : { temperature: options.temperature }),
         topP: options.topP,
         topK: options.topK,
         stopSequences: options.stopSequences,
@@ -293,7 +293,7 @@ export function streamText(options) {
     const directResultPromise = resolveDirectTools(options.tools).then((tools) => options.model.doStream({
         prompt: toRuntimePrompt(normalizeSystemPrompt(options.system), options.messages),
         maxOutputTokens: options.maxOutputTokens,
-        temperature: options.temperature,
+        ...(options.temperature === undefined ? {} : { temperature: options.temperature }),
         topP: options.topP,
         topK: options.topK,
         stopSequences: options.stopSequences,

package/esm/src/security/http/base-handler.d.ts

@@ -1,8 +1,9 @@
 import type { Handler, HandlerContext, HandlerMetadata, HandlerResult } from "../../types/index.js";
+import type { WebSocketUpgradeResponse } from "../../platform/adapters/base.js";
 import { ResponseBuilder } from "./response/index.js";
 export interface HandlerHelpers {
     createResponseBuilder: (ctx: HandlerContext, nonce?: string) => ResponseBuilder;
-    respond: (response: Response, metadata?: Record<string, unknown>) => HandlerResult;
+    respond: (response: Response | WebSocketUpgradeResponse, metadata?: Record<string, unknown>) => HandlerResult;
     logDebug: (message: string, extra?: Record<string, unknown>, ctx?: HandlerContext) => void;
     getErrorMessage: (error: unknown) => string;
     continue: () => HandlerResult;
@@ -19,7 +20,7 @@ export declare abstract class BaseHandler implements Handler {
     protected logInfo(message: string, extra?: Record<string, unknown>, _ctx?: HandlerContext): void;
     protected getErrorMessage(error: unknown): string;
     protected continue(): HandlerResult;
-    protected respond(response: Response, metadata?: Record<string, unknown>): HandlerResult;
+    protected respond(response: Response | WebSocketUpgradeResponse, metadata?: Record<string, unknown>): HandlerResult;
     protected withProxyContext<T>(ctx: HandlerContext, fn: () => Promise<T>, options?: {
         requireToken?: boolean;
     }): Promise<T>;

package/esm/src/security/http/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,aAAa,CAAC;IACnF,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAIxF,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,CAAC,CAAC;CAyEd"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAIhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,CAAC,CAAC;CAyEd"}

package/esm/src/security/http/base-handler.js

@@ -64,7 +64,7 @@ export class BaseHandler {
         return { continue: true };
     }
     respond(response, metadata) {
-        return { response, continue: false, metadata };
+        return { response: response, continue: false, metadata };
     }
     withProxyContext(ctx, fn, options = {}) {
         // Framework-owned token: bypass project env overlay so proxy mode works

package/esm/src/security/sandbox/project-worker.d.ts

@@ -56,6 +56,7 @@ export declare class ProjectWorker {
      */
     terminate(): void;
     private getWorkerScriptUrl;
+    private withEgressPolicy;
     private handleMessage;
     private updateIdleStatus;
     private rejectAllPending;

package/esm/src/security/sandbox/project-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-worker.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/project-worker.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAY3B,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAEtE,qBAAa,aAAa;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,EAAE,oBAAoB;IAOzC,IAAI,MAAM,IAAI,YAAY,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;OAEG;IACH,KAAK,IAAI,IAAI;IA8Bb;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAqCxD;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC;IA+FjE;;OAEG;IACG,SAAS,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BpD;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAKxB;;OAEG;IACH,SAAS,IAAI,IAAI;IAuBjB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,aAAa;IA+CrB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,gBAAgB;CAazB"}
+{"version":3,"file":"project-worker.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/project-worker.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAa3B,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAEtE,qBAAa,aAAa;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,EAAE,oBAAoB;IAOzC,IAAI,MAAM,IAAI,YAAY,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;OAEG;IACH,KAAK,IAAI,IAAI;IA8Bb;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAqCxD;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC;IA+FjE;;OAEG;IACG,SAAS,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BpD;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAKxB;;OAEG;IACH,SAAS,IAAI,IAAI;IAuBjB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,aAAa;IA+CrB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,gBAAgB;CAazB"}

package/esm/src/security/sandbox/project-worker.js

@@ -12,8 +12,11 @@ import { serverLogger } from "../../utils/index.js";
 import { isCompiledBinary } from "../../utils/index.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { TIMEOUT_ERROR, UNKNOWN_ERROR } from "../../errors/index.js";
+import { getHostEnv } from "../../platform/compat/process.js";
+import { isInternalEgressOverrideEnabled, WORKER_INTERNAL_EGRESS_OVERRIDE_ENV, } from "./worker-egress-guard.js";
 const logger = serverLogger.component("project-worker");
 const textEncoder = new TextEncoder();
+const WORKER_ALLOW_INTERNAL_EGRESS_PARAM = "allowInternalEgress";
 export class ProjectWorker {
     projectId;
     worker = null;
@@ -262,7 +265,20 @@ export class ProjectWorker {
         }
         // Use import.meta.resolve to get the absolute URL of the worker script.
         // This works in both `deno run` and `deno compile` contexts.
-        return globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).resolve("./worker-script.ts");
+        return this.withEgressPolicy(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).resolve("./worker-script.ts"));
+    }
+    withEgressPolicy(workerScriptUrl) {
+        if (!isInternalEgressOverrideEnabled(getHostEnv(WORKER_INTERNAL_EGRESS_OVERRIDE_ENV))) {
+            return workerScriptUrl;
+        }
+        try {
+            const url = new URL(workerScriptUrl);
+            url.searchParams.set(WORKER_ALLOW_INTERNAL_EGRESS_PARAM, "1");
+            return url.toString();
+        }
+        catch {
+            return workerScriptUrl;
+        }
     }
     handleMessage(data) {
         if (data.type === "pong") {

package/esm/src/security/sandbox/worker-egress-guard.d.ts

@@ -0,0 +1,15 @@
+export declare const WORKER_INTERNAL_EGRESS_OVERRIDE_ENV = "VERYFRONT_WORKER_ALLOW_INTERNAL_EGRESS";
+export declare class WorkerEgressBlockedError extends Error {
+    name: string;
+}
+export type ResolveWorkerHost = (hostname: string) => Promise<string[]>;
+export interface WorkerEgressGuardOptions {
+    allowInternalEgress?: boolean;
+    resolveHost?: ResolveWorkerHost;
+}
+export declare function isInternalEgressOverrideEnabled(value: string | undefined): boolean;
+export declare function isInternalEgressIp(address: string): boolean;
+export declare function assertWorkerEgressAllowed(target: string | URL | Request, options?: WorkerEgressGuardOptions): Promise<void>;
+export declare function assertWorkerHostEgressAllowed(hostname: string, options?: WorkerEgressGuardOptions): Promise<void>;
+export declare function installWorkerEgressGuard(options?: WorkerEgressGuardOptions): void;
+//# sourceMappingURL=worker-egress-guard.d.ts.map

package/esm/src/security/sandbox/worker-egress-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-egress-guard.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-egress-guard.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,mCAAmC,2CAA2C,CAAC;AAE5F,qBAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,SAA8B;CAC5C;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAWD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWlF;AAuDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK3D;AA4CD,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC9B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAgBD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI,CA+CrF"}