veryfront 0.1.997 → 0.1.999

package/esm/src/chat/upload-handler.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Chat upload handler: the server side of `<Chat>`'s batteries-included
+ * attachments. Mount it at `app/api/uploads/route.ts` (the same endpoint the
+ * composer POSTs to) and files "just work": stored on the local disk in dev,
+ * on Veryfront Cloud (or a `BlobStorage` you pass) once deployed.
+ *
+ * ```ts
+ * // app/api/uploads/route.ts
+ * import { createChatUploadHandler } from "veryfront/chat/uploads";
+ *
+ * function authorize(request: Request) {
+ *   const token = Deno.env.get("UPLOAD_TOKEN");
+ *   return Boolean(token && request.headers.get("authorization") === `Bearer ${token}`);
+ * }
+ *
+ * export const { POST, GET, DELETE } = createChatUploadHandler({ authorize });
+ * ```
+ *
+ * `POST` stores the multipart `file` field and returns `{ id, url, name,
+ * mediaType, size }`. The composer sends that `url` as a `file` message part,
+ * which the runtime fetches, so the URL must be reachable by the runtime
+ * (true for local dev, where `GET` streams the file back from the same origin).
+ *
+ * @module chat/upload-handler
+ */
+import "../../_dnt.polyfills.js";
+import type { BlobStorage } from "../workflow/blob/types.js";
+/** Configuration for {@link createChatUploadHandler}. */
+export interface ChatUploadHandlerConfig {
+    /** Max accepted file size in bytes. @default 25 MB */
+    maxFileSize?: number;
+    /** Storage backend. Defaults to local disk in dev, Veryfront Cloud when deployed. */
+    storage?: BlobStorage;
+    /**
+     * Gate every request. Return `false` or a `Response` to reject.
+     * Required unless `allowUnauthenticated` is explicitly set.
+     */
+    authorize?: (request: Request) => boolean | Response | void | Promise<boolean | Response | void>;
+    /**
+     * Allow POST, GET, and DELETE without an authorization callback.
+     * Use this only for local prototypes or deliberately public upload routes.
+     */
+    allowUnauthenticated?: boolean;
+}
+/**
+ * Build `{ POST, GET, DELETE }` route handlers for chat attachments.
+ * Auto-selects local disk storage in dev and Veryfront Cloud once deployed, or
+ * the `storage` you provide. `DELETE ?id=` removes the file from storage.
+ */
+export declare function createChatUploadHandler(config?: ChatUploadHandlerConfig): {
+    POST: (request: Request) => Promise<Response>;
+    GET: (request: Request) => Promise<Response>;
+    DELETE: (request: Request) => Promise<Response>;
+};
+//# sourceMappingURL=upload-handler.d.ts.map

package/esm/src/chat/upload-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/chat/upload-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,2BAA2B,CAAC;AActE,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAiDD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,GAAE,uBAA4B,GACnC;IACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjD,CAgHA"}

package/esm/src/chat/upload-handler.js

@@ -0,0 +1,180 @@
+/**
+ * Chat upload handler: the server side of `<Chat>`'s batteries-included
+ * attachments. Mount it at `app/api/uploads/route.ts` (the same endpoint the
+ * composer POSTs to) and files "just work": stored on the local disk in dev,
+ * on Veryfront Cloud (or a `BlobStorage` you pass) once deployed.
+ *
+ * ```ts
+ * // app/api/uploads/route.ts
+ * import { createChatUploadHandler } from "veryfront/chat/uploads";
+ *
+ * function authorize(request: Request) {
+ *   const token = Deno.env.get("UPLOAD_TOKEN");
+ *   return Boolean(token && request.headers.get("authorization") === `Bearer ${token}`);
+ * }
+ *
+ * export const { POST, GET, DELETE } = createChatUploadHandler({ authorize });
+ * ```
+ *
+ * `POST` stores the multipart `file` field and returns `{ id, url, name,
+ * mediaType, size }`. The composer sends that `url` as a `file` message part,
+ * which the runtime fetches, so the URL must be reachable by the runtime
+ * (true for local dev, where `GET` streams the file back from the same origin).
+ *
+ * @module chat/upload-handler
+ */
+import "../../_dnt.polyfills.js";
+import * as dntShim from "../../_dnt.shims.js";
+import { LocalBlobStorage } from "../workflow/blob/local-storage.js";
+import { VeryfrontCloudBlobStorage } from "../workflow/blob/veryfront-cloud-storage.js";
+import { isVeryfrontCloudEnabled } from "../platform/cloud/resolver.js";
+import { isProduction } from "../platform/environment.js";
+import { CONFIG_INVALID } from "../errors/index.js";
+/** 25 MB default cap. Attachments are references, not bulk transfer. */
+const DEFAULT_MAX_FILE_SIZE = 25 * 1024 * 1024;
+const MAX_FILE_NAME_LENGTH = 200;
+/** Ids are storage-issued UUIDs; this guards the `GET ?id=` path against traversal. */
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const CLOUD_PREFIX = ".veryfront/chat-uploads/";
+const FileCtor = globalThis.File;
+/** Strip path separators, HTML-significant and control chars from a filename. */
+function sanitizeFileName(raw) {
+    const cleaned = raw
+        .replace(/[/\\]/g, "_")
+        .replace(/[<>"'`&]/g, "")
+        // deno-lint-ignore no-control-regex
+        .replace(/[\x00-\x1f\x7f]/g, "")
+        .trim()
+        .slice(0, MAX_FILE_NAME_LENGTH);
+    return cleaned || "untitled";
+}
+function resolveStorage(config) {
+    if (config.storage)
+        return config.storage;
+    // Cloud storage only when actually deployed. In local dev the cloud bootstrap
+    // is present (you're logged in) but the project isn't, so default to disk.
+    if (isProduction() && isVeryfrontCloudEnabled()) {
+        return new VeryfrontCloudBlobStorage({ prefix: CLOUD_PREFIX });
+    }
+    return new LocalBlobStorage(`${dntShim.Deno.cwd()}/.veryfront/uploads`);
+}
+function fallbackUrl(requestUrl, id) {
+    const url = new URL(requestUrl);
+    url.search = "";
+    url.searchParams.set("id", id);
+    return url.href;
+}
+function rejectsDeclaredSize(request, maxFileSize) {
+    const value = request.headers.get("content-length");
+    if (!value)
+        return false;
+    const declared = Number.parseInt(value, 10);
+    return Number.isFinite(declared) && declared > maxFileSize;
+}
+async function reject(request, authorize) {
+    if (!authorize)
+        return null;
+    const result = await authorize(request);
+    if (result instanceof Response)
+        return result;
+    if (result === false)
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+    return null;
+}
+/**
+ * Build `{ POST, GET, DELETE }` route handlers for chat attachments.
+ * Auto-selects local disk storage in dev and Veryfront Cloud once deployed, or
+ * the `storage` you provide. `DELETE ?id=` removes the file from storage.
+ */
+export function createChatUploadHandler(config = {}) {
+    const maxFileSize = config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+    if (!config.authorize && config.allowUnauthenticated !== true) {
+        throw CONFIG_INVALID.create({
+            message: "createChatUploadHandler requires `authorize` or `allowUnauthenticated: true`.",
+            detail: "Pass authorize to protect upload requests, or set allowUnauthenticated: true for a deliberately public endpoint.",
+        });
+    }
+    const storage = resolveStorage(config);
+    async function POST(request) {
+        const denied = await reject(request, config.authorize);
+        if (denied)
+            return denied;
+        if (rejectsDeclaredSize(request, maxFileSize)) {
+            return Response.json({ error: `File exceeds ${Math.round(maxFileSize / 1024 / 1024)} MB limit` }, { status: 413 });
+        }
+        const form = await request.formData();
+        const file = form.get("file");
+        if (!FileCtor || !(file instanceof FileCtor)) {
+            return Response.json({ error: "No file provided" }, { status: 400 });
+        }
+        if (file.size > maxFileSize) {
+            return Response.json({ error: `File exceeds ${Math.round(maxFileSize / 1024 / 1024)} MB limit` }, { status: 413 });
+        }
+        const name = sanitizeFileName(file.name);
+        const mediaType = file.type || "application/octet-stream";
+        const ref = await storage.put(file, {
+            mimeType: mediaType,
+            metadata: { filename: name },
+        });
+        // Use the backend's own URL when it has one (cloud/S3); otherwise serve the
+        // bytes back ourselves from the same origin (local disk in dev).
+        const external = ref.url ?? (await storage.stat(ref.id))?.url;
+        const url = external ?? fallbackUrl(request.url, ref.id);
+        return Response.json({ id: ref.id, url, name, mediaType, size: file.size });
+    }
+    function toListItem(ref, requestUrl) {
+        return {
+            id: ref.id,
+            url: ref.url ?? fallbackUrl(requestUrl, ref.id),
+            name: ref.metadata?.filename ?? ref.id,
+            mediaType: ref.mimeType,
+            size: ref.size,
+        };
+    }
+    async function GET(request) {
+        const denied = await reject(request, config.authorize);
+        if (denied)
+            return denied;
+        const id = new URL(request.url).searchParams.get("id");
+        // No `id` → list the adapter's stored files (newest first). This is the
+        // source of truth for an "Uploads" surface, so it survives across sessions
+        // and browsers, unlike a client-only index.
+        if (!id) {
+            if (!storage.list) {
+                return Response.json({ error: "This storage backend does not support listing", items: [] }, { status: 501 });
+            }
+            const refs = await storage.list();
+            return Response.json({ items: refs.map((ref) => toListItem(ref, request.url)) });
+        }
+        if (!SAFE_ID.test(id)) {
+            return Response.json({ error: "Invalid id" }, { status: 400 });
+        }
+        const ref = await storage.stat(id);
+        const stream = ref ? await storage.getStream(id) : null;
+        if (!ref || !stream) {
+            return Response.json({ error: "Not found" }, { status: 404 });
+        }
+        return new Response(stream, {
+            headers: {
+                "Content-Type": ref.mimeType,
+                "Content-Length": String(ref.size),
+                "Content-Disposition": `attachment; filename="${ref.metadata?.filename ?? ref.id}"`,
+                "X-Content-Type-Options": "nosniff",
+                "Cache-Control": "private, max-age=3600",
+            },
+        });
+    }
+    async function DELETE(request) {
+        const denied = await reject(request, config.authorize);
+        if (denied)
+            return denied;
+        const id = new URL(request.url).searchParams.get("id");
+        if (!id || !SAFE_ID.test(id)) {
+            return Response.json({ error: "Invalid id" }, { status: 400 });
+        }
+        // Idempotent: deleting an already-gone file is a success, not a 404.
+        await storage.delete(id);
+        return Response.json({ id, deleted: true });
+    }
+    return { POST, GET, DELETE };
+}

package/esm/src/discovery/import-rewriter.d.ts

@@ -5,7 +5,7 @@
  * (Deno, Node.js) and handles veryfront package resolution.
  */
 import { createFileSystem } from "../platform/compat/fs.js";
-export declare const DISCOVERY_GLOBAL_VERYFRONT_MODULES: readonly ["veryfront/agent", "veryfront/tool", "veryfront/platform", "veryfront/prompt", "veryfront/resource", "veryfront/embedding", "veryfront/knowledge", "veryfront/workflow", "veryfront/work", "veryfront/eval", "veryfront/metrics", "veryfront/schemas"];
+export declare const DISCOVERY_GLOBAL_VERYFRONT_MODULES: readonly ["veryfront/agent", "veryfront/tool", "veryfront/platform", "veryfront/prompt", "veryfront/resource", "veryfront/embedding", "veryfront/knowledge", "veryfront/workflow", "veryfront/work", "veryfront/eval", "veryfront/metrics", "veryfront/schemas", "veryfront/chat/uploads"];
 interface DenoRewriteOptions {
     compiled?: boolean;
     resolveSpecifier?: (specifier: string) => string;

package/esm/src/discovery/import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../src/src/discovery/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAI5D,eAAO,MAAM,kCAAkC,kQAarC,CAAC;AAEX,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAClD;AAkHD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CA2BR;AAqFD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,EACvC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CA2PjB"}
+{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../src/src/discovery/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAI5D,eAAO,MAAM,kCAAkC,4RAerC,CAAC;AAEX,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAClD;AAkHD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CA2BR;AAqFD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,EACvC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CA2PjB"}

package/esm/src/discovery/import-rewriter.js

@@ -20,6 +20,8 @@ export const DISCOVERY_GLOBAL_VERYFRONT_MODULES = [
     "veryfront/eval",
     "veryfront/metrics",
     "veryfront/schemas",
+    // Server-side chat upload route handler (app/api/uploads/route.ts).
+    "veryfront/chat/uploads",
 ];
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/esm/src/discovery/transpiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transpiler.d.ts","sourceRoot":"","sources":["../../../src/src/discovery/transpiler.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA2IvD;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAkGlB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"transpiler.d.ts","sourceRoot":"","sources":["../../../src/src/discovery/transpiler.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA6IvD;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAkGlB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/esm/src/discovery/transpiler.js

@@ -25,6 +25,7 @@ import * as workMod from "../work/index.js";
 import * as evalMod from "../eval/index.js";
 import * as metricsMod from "../metrics/index.js";
 import * as schemasMod from "../schemas/index.js";
+import * as chatUploadsMod from "../chat/upload-handler.js";
 const transpileCache = new Map();
 // Setup veryfront modules as globals for compiled binary support
 let veryfrontGlobalsInitialized = false;
@@ -47,6 +48,7 @@ async function ensureVeryfrontGlobals() {
         "veryfront/eval": evalMod,
         "veryfront/metrics": metricsMod,
         "veryfront/schemas": schemasMod,
+        "veryfront/chat/uploads": chatUploadsMod,
     };
     dntShim.dntGlobalThis.__VERYFRONT_MODULES__ = modules;
     veryfrontGlobalsInitialized = true;

package/esm/src/embedding/index.d.ts

@@ -21,8 +21,6 @@ export { vectorStore } from "./vector-store.js";
 export { ragStore } from "./rag-store.js";
 export { createUploadHandler } from "./upload-handler.js";
 export { loadUpload } from "./upload-loader.js";
-export { useUploads } from "./react/use-uploads.js";
-export type { UseUploadsOptions, UseUploadsResult } from "./react/use-uploads.js";
 export { clearEmbeddingProviders, registerEmbeddingProvider, resolveEmbeddingModel, } from "./resolve.js";
 export type { ChunkOptions, Embedding, EmbeddingConfig, RagChunk, RagDocumentMeta, RagRefreshOptions, RagSearchOptions, RagSearchResult, RagStore, RagStoreBackend, RagStoreConfig, RagStoreData, SearchOptions, SearchResult, VectorStore, VectorStoreConfig, } from "./types.js";
 export type { UploadAuthorizationResult, UploadAuthorize, UploadHandlerAuthConfig, UploadHandlerConfig, } from "./upload-handler.js";

package/esm/src/embedding/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,IAAI,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,IAAI,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}

package/esm/src/embedding/index.js

@@ -21,5 +21,4 @@ export { vectorStore } from "./vector-store.js";
 export { ragStore } from "./rag-store.js";
 export { createUploadHandler } from "./upload-handler.js";
 export { loadUpload } from "./upload-loader.js";
-export { useUploads } from "./react/use-uploads.js";
 export { clearEmbeddingProviders, registerEmbeddingProvider, resolveEmbeddingModel, } from "./resolve.js";

package/esm/src/embedding/upload-handler.d.ts

@@ -25,7 +25,7 @@ export interface UploadHandlerConfig {
  * `loadUpload`, and ingests into the provided RAG store. When Veryfront Cloud
  * bootstrap is present, the original binary is also stored in the project's
  * uploads store via the cloud adapter. GET returns the upload list. DELETE
- * removes an upload by ID from route params.
+ * removes an upload by ID from the `id` query parameter or route params.
  *
  * @example
  * ```ts
@@ -34,7 +34,7 @@ export interface UploadHandlerConfig {
  * import { getEnv } from "veryfront";
  * import { store } from "lib/store.ts";
  *
- * export const { POST, GET } = createUploadHandler(store, {
+ * export const { POST, GET, DELETE } = createUploadHandler(store, {
  *   auth: {
  *     authorize: (request) => {
  *       const token = getEnv("UPLOAD_TOKEN");
@@ -44,17 +44,6 @@ export interface UploadHandlerConfig {
  *   },
  * });
  * ```
- *
- * @example
- * ```ts
- * // app/api/uploads/[id]/route.ts
- * import { createUploadHandler } from "veryfront/embedding";
- * import { store } from "lib/store.ts";
- *
- * export const { DELETE } = createUploadHandler(store, {
- *   auth: { type: "none", allowUnauthenticated: true },
- * });
- * ```
  */
 export declare function createUploadHandler(store: RagStore, config?: UploadHandlerConfig): {
     POST: (request: Request) => Promise<Response>;

package/esm/src/embedding/upload-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqF3C,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,OAAO,KACb,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,IAAI,CAAA;CAAE,GAC5C;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,uBAAuB,CAAC;CAChC;AA6FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,mBAAmB;oBAKC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAiF3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAc7C,OAAO,WACP;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1C,OAAO,CAAC,QAAQ,CAAC;EA6BrB"}
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/src/embedding/upload-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqF5D,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,OAAO,KACb,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,IAAI,CAAA;CAAE,GAC5C;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,uBAAuB,CAAC;CAChC;AAuHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,mBAAmB;oBAKC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAmF3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAc7C,OAAO,WACP;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1C,OAAO,CAAC,QAAQ,CAAC;EA6BrB"}

package/esm/src/embedding/upload-handler.js

@@ -145,6 +145,22 @@ function getSourceBlobStorage() {
         ? new VeryfrontCloudBlobStorage({ prefix: CLOUD_UPLOAD_PREFIX })
         : null;
 }
+function toUploadRegistryItem(upload) {
+    return {
+        id: upload.id,
+        name: upload.title,
+        mediaType: typeToMime(upload.type),
+        size: 0,
+        ...(upload.url ? { url: upload.url } : {}),
+    };
+}
+function resolveDeleteId(request, context) {
+    const fromParams = context.params.id;
+    if (fromParams)
+        return fromParams;
+    const fromQuery = new URL(request.url).searchParams.get("id");
+    return fromQuery ?? "";
+}
 /**
  * Creates HTTP route handlers for upload, listing, and deletion.
  *
@@ -159,7 +175,7 @@ function getSourceBlobStorage() {
  * `loadUpload`, and ingests into the provided RAG store. When Veryfront Cloud
  * bootstrap is present, the original binary is also stored in the project's
  * uploads store via the cloud adapter. GET returns the upload list. DELETE
- * removes an upload by ID from route params.
+ * removes an upload by ID from the `id` query parameter or route params.
  *
  * @example
  * ```ts
@@ -168,7 +184,7 @@ function getSourceBlobStorage() {
  * import { getEnv } from "veryfront";
  * import { store } from "lib/store.ts";
  *
- * export const { POST, GET } = createUploadHandler(store, {
+ * export const { POST, GET, DELETE } = createUploadHandler(store, {
  *   auth: {
  *     authorize: (request) => {
  *       const token = getEnv("UPLOAD_TOKEN");
@@ -178,17 +194,6 @@ function getSourceBlobStorage() {
  *   },
  * });
  * ```
- *
- * @example
- * ```ts
- * // app/api/uploads/[id]/route.ts
- * import { createUploadHandler } from "veryfront/embedding";
- * import { store } from "lib/store.ts";
- *
- * export const { DELETE } = createUploadHandler(store, {
- *   auth: { type: "none", allowUnauthenticated: true },
- * });
- * ```
  */
 export function createUploadHandler(store, config) {
     const maxSize = config?.maxFileSize ?? MAX_FILE_SIZE;
@@ -247,8 +252,10 @@ export function createUploadHandler(store, config) {
                 }
             }
             return Response.json({
-                success: true,
-                upload: { id, title: safeName, type: fileType },
+                id,
+                name: safeName,
+                mediaType: file.type || typeToMime(fileType),
+                size: file.size,
             });
         }
         catch (error) {
@@ -262,7 +269,7 @@ export function createUploadHandler(store, config) {
             if (unauthorized)
                 return unauthorized;
             const uploads = await enrichUploadsWithSourceUrls(await store.listDocuments());
-            return Response.json({ uploads });
+            return Response.json({ items: uploads.map(toUploadRegistryItem) });
         }
         catch (error) {
             serverLogger.error("Upload list failed:", error);
@@ -274,7 +281,7 @@ export function createUploadHandler(store, config) {
             const unauthorized = await authorizeUploadRequest(request, authorize);
             if (unauthorized)
                 return unauthorized;
-            const id = context.params.id;
+            const id = resolveDeleteId(request, context);
             if (!id) {
                 return Response.json({ error: "Missing upload ID" }, { status: 400 });
             }

package/esm/src/modules/import-map/default-import-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-import-map.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/import-map/default-import-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAyDlD,wBAAgB,mBAAmB,IAAI,eAAe,CAIrD"}
+{"version":3,"file":"default-import-map.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/import-map/default-import-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmDlD,wBAAgB,mBAAmB,IAAI,eAAe,CAIrD"}

package/esm/src/modules/import-map/default-import-map.js

@@ -25,10 +25,6 @@ function getVeryfrontSsrImportMap() {
     const workflowReact = `${base}/workflow/react/index.js${ssr}`;
     // veryfront/react is a barrel that re-exports all browser-side modules.
     const react = `${base}/react/public.js${ssr}`;
-    // Map veryfront/embedding to the React hooks submodule for SSR.
-    // The full embedding/index.ts imports heavy server-side code (vectorStore, ragStore)
-    // that fails to transform. SSR only needs the React hook (useUploads).
-    const embedding = `${base}/embedding/react/index.js${ssr}`;
     return {
         "veryfront/react": react,
         "veryfront/head": head,
@@ -38,7 +34,6 @@ function getVeryfrontSsrImportMap() {
         "veryfront/markdown": markdown,
         "veryfront/chat": chat,
         "veryfront/mdx": mdx,
-        "veryfront/embedding": embedding,
         "veryfront/workflow": workflowReact,
         "veryfront/react/head": head,
         "veryfront/react/router": router,

package/esm/src/react/components/chat/agent-card.d.ts

@@ -1,23 +1,96 @@
+/**
+ * AgentCard — a running agent rendered as a `Card` wrapping the `Message`
+ * anatomy: a header row (agent Avatar + name on the left, `<Status>` on the
+ * right) over the agent's reasoning, tool calls, and message text. Composed
+ * entirely from the shared primitives — `Card`, `Avatar`, `Status`,
+ * `Reasoning`, `ToolCall`, `Markdown` — so it reads like a `Message` inside a
+ * card (mirrors Studio's agent/message anatomy).
+ *
+ * @module react/components/chat/agent-card
+ */
 import * as React from "../../../../react/react.js";
 import type { AgentMessage, AgentStatus, ToolCall } from "../../../agent/index.js";
-import { type AgentTheme } from "./theme.js";
+import { type StatusColor } from "./ui/status.js";
 /** Props accepted by agent card. */
 export interface AgentCardProps {
-    /** Agent messages */
+    /** Agent display name shown in the header (default "Agent"). */
+    name?: string;
+    /** Agent avatar image; falls back to an initial. */
+    avatarUrl?: string;
+    /** Agent messages — rendered as Markdown, mirroring `Message.Content`. */
     messages?: AgentMessage[];
-    /** Tool calls */
+    /** Tool calls — rendered through the shared `ToolCall` card. */
     toolCalls?: ToolCall[];
-    /** Agent status */
+    /** Agent status — drives the header `Status` dot + label. */
     status: AgentStatus;
-    /** Thinking/reasoning text */
+    /** Thinking/reasoning text — rendered through the `Reasoning` component. */
     thinking?: string;
-    /** Additional class name */
+    /** Additional class name for the card. */
     className?: string;
-    /** Theme customization */
-    theme?: Partial<AgentTheme>;
-    /** Custom tool renderer */
+    /** Custom tool renderer — overrides the default `ToolCall` card. */
     renderTool?: (toolCall: ToolCall) => React.ReactNode;
+    /** Compose your own card; when omitted, the default anatomy is rendered. */
+    children?: React.ReactNode;
 }
-/** Render agent card. */
-export declare const AgentCard: React.ForwardRefExoticComponent<AgentCardProps & React.RefAttributes<HTMLDivElement>>;
+/** Per-card state shared with `AgentCard.*` sub-parts. */
+export interface AgentCardContextValue {
+    name: string;
+    avatarUrl?: string;
+    messages?: AgentMessage[];
+    toolCalls: ToolCall[];
+    status: AgentStatus;
+    thinking?: string;
+    renderTool?: (toolCall: ToolCall) => React.ReactNode;
+    presentation: {
+        color: StatusColor;
+        label: string;
+        pulse: boolean;
+    };
+}
+/** Read the enclosing `AgentCard` state. Throws when used outside an `AgentCard`. */
+export declare function useAgentCard(): AgentCardContextValue;
+/**
+ * The header row: Avatar + name (left), Status (right). Mirrors
+ * `ChatMessageHeader` / `Message.Header`.
+ */
+declare function AgentCardHeader({ className }: {
+    className?: string;
+}): React.JSX.Element;
+declare namespace AgentCardHeader {
+    var displayName: string;
+}
+/** The reasoning block. Renders only when `thinking` text is present. */
+declare function AgentCardReasoning({ className }: {
+    className?: string;
+}): React.JSX.Element | null;
+declare namespace AgentCardReasoning {
+    var displayName: string;
+}
+/** The tool-call list. Renders one `ToolCall` card per entry, or `renderTool`. */
+declare function AgentCardTools({ className }: {
+    className?: string;
+}): React.JSX.Element | null;
+declare namespace AgentCardTools {
+    var displayName: string;
+}
+/** The message body — each message's text rendered as `Markdown`. */
+declare function AgentCardBody({ className }: {
+    className?: string;
+}): React.JSX.Element | null;
+declare namespace AgentCardBody {
+    var displayName: string;
+}
+/**
+ * AgentCard — render `<AgentCard {...props} />` for the default card, or compose
+ * `AgentCard.Header` / `Reasoning` / `Tools` / `Body` for a custom layout.
+ * Mirrors the `ToolCall` compound: render it, or compose it.
+ */
+export declare const AgentCard: React.ForwardRefExoticComponent<AgentCardProps & React.RefAttributes<HTMLDivElement>> & {
+    Root: React.ForwardRefExoticComponent<AgentCardProps & React.RefAttributes<HTMLDivElement>>;
+    Header: typeof AgentCardHeader;
+    Reasoning: typeof AgentCardReasoning;
+    Tools: typeof AgentCardTools;
+    Body: typeof AgentCardBody;
+};
+export {};
 //# sourceMappingURL=agent-card.d.ts.map

package/esm/src/react/components/chat/agent-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../../../../src/src/react/components/chat/agent-card.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,4BAA4B,CAAC;AAQpD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,KAAK,UAAU,EAAsC,MAAM,YAAY,CAAC;AAEjF,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAE1B,iBAAiB;IACjB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IAEvB,mBAAmB;IACnB,MAAM,EAAE,WAAW,CAAC;IAEpB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0BAA0B;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5B,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC;CACtD;AAED,yBAAyB;AACzB,eAAO,MAAM,SAAS,uFA0GrB,CAAC"}
+{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../../../../src/src/react/components/chat/agent-card.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,KAAK,MAAM,4BAA4B,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAMnF,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAK1D,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,gEAAgE;IAChE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAmDD,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC;IACrD,YAAY,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CACrE;AAMD,qFAAqF;AACrF,wBAAgB,YAAY,IAAI,qBAAqB,CAQpD;AA0DD;;;GAGG;AACH,iBAAS,eAAe,CACtB,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAgBnB;kBAlBQ,eAAe;;;AAqBxB,yEAAyE;AACzE,iBAAS,kBAAkB,CACzB,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAI1B;kBANQ,kBAAkB;;;AAS3B,kFAAkF;AAClF,iBAAS,cAAc,CACrB,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAY1B;kBAdQ,cAAc;;;AAiBvB,qEAAqE;AACrE,iBAAS,aAAa,CACpB,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAgB1B;kBAlBQ,aAAa;;;AAqBtB;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;CAMpB,CAAC"}