fix(modules): harden the import-map preloader against poisoning and unbounded growth

scripts/lint/test-typecheck-baseline.json

@@ -32,7 +32,6 @@
   "src/mcp/server.test.ts",
   "src/middleware/builtin/security/security-headers.test.ts",
   "src/middleware/core/pipeline/composer.test.ts",
-  "src/modules/import-map/preloader.test.ts",
   "src/modules/react-loader/ssr-module-loader.stress.test.ts",
   "src/platform/adapters/fs/veryfront/directory-operations.test.ts",
   "src/platform/adapters/redis/node.test.ts",

src/cache/config-hash.test.ts

@@ -1,13 +1,99 @@
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertNotEquals } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
+import { buildDependencyPinningCacheVariant } from "#veryfront/cache/keys/dependency-pinning.ts";
+import {
+  CSSTYPE_VERSION,
+  DEFAULT_REACT_VERSION,
+  TAILWIND_VERSION,
+} from "#veryfront/transforms/import-rewriter/url-builder.ts";
+import { computeHash } from "#veryfront/utils/hash-utils.ts";
+import { VERSION } from "#veryfront/utils/version.ts";
 import { computeConfigHash, computeConfigHashSync } from "./config-hash.ts";
 
 const CANONICAL_PIN_KEY = "on:z7bg3qnfgtcb";
 const CHANGED_CANONICAL_PIN_KEY = "on:z7bg3qnfgtcc";
 
 describe("cache/config-hash", () => {
   describe("computeConfigHash", () => {
+    it("preserves the established serialized identity for the default config", async () => {
+      const identity = JSON.stringify({
+        transformVersion: VERSION,
+        reactVersion: DEFAULT_REACT_VERSION,
+        jsxImportSource: "react",
+        moduleServerUrl: null,
+        vendorBundleHash: null,
+        apiBaseUrl: null,
+        studioEmbed: false,
+        dev: false,
+        csstype: CSSTYPE_VERSION,
+        tailwind: TAILWIND_VERSION,
+      });
+      assertEquals(
+        await computeConfigHash({}),
+        await computeHash(identity),
+      );
+    });
+
+    it("preserves the established serialized identity for a fully scoped config", async () => {
+      const dependencyPinningCacheVariant = buildDependencyPinningCacheVariant(
+        CANONICAL_PIN_KEY,
+        "https://preview.example.test",
+      );
+      const identity = JSON.stringify({
+        transformVersion: VERSION,
+        reactVersion: "18.3.1",
+        jsxImportSource: "preact",
+        moduleServerUrl: "https://modules.example.test/_vf_modules",
+        vendorBundleHash: "vendor-a",
+        apiBaseUrl: "https://api.example.test",
+        studioEmbed: true,
+        dev: true,
+        ...(dependencyPinningCacheVariant ? { dependencyPinningCacheVariant } : {}),
+        csstype: CSSTYPE_VERSION,
+        tailwind: TAILWIND_VERSION,
+      });
+      assertEquals(
+        await computeConfigHash({
+          reactVersion: "18.3.1",
+          jsxImportSource: "preact",
+          moduleServerUrl: "https://modules.example.test/_vf_modules",
+          moduleServerOrigin: "https://preview.example.test",
+          vendorBundleHash: "vendor-a",
+          apiBaseUrl: "https://api.example.test",
+          studioEmbed: true,
+          dev: true,
+          dependencyPinningCacheKey: CANONICAL_PIN_KEY,
+        }),
+        await computeHash(identity),
+      );
+    });
+
+    it("keeps distinct hashes stable when array push and join are poisoned", async () => {
+      const firstConfig = { reactVersion: "18.3.1", dev: false };
+      const secondConfig = { reactVersion: "19.2.4", dev: true };
+      const firstBaseline = await computeConfigHash(firstConfig);
+      const secondBaseline = await computeConfigHash(secondConfig);
+      const originalPush = Array.prototype.push;
+      const originalJoin = Array.prototype.join;
+      let firstPoisoned: string | undefined;
+      let secondPoisoned: string | undefined;
+
+      try {
+        Reflect.set(Array.prototype, "push", () => 0);
+        Reflect.set(Array.prototype, "join", () => "poisoned");
+        firstPoisoned = await computeConfigHash(firstConfig);
+        secondPoisoned = await computeConfigHash(secondConfig);
+      } finally {
+        Reflect.set(Array.prototype, "push", originalPush);
+        Reflect.set(Array.prototype, "join", originalJoin);
+      }
+
+      assertEquals(firstPoisoned, firstBaseline);
+      assertEquals(secondPoisoned, secondBaseline);
+      assertNotEquals(firstPoisoned, secondPoisoned);
+    });
+
     it("should return a 64-char hex hash", async () => {
       const hash = await computeConfigHash({});
       assertEquals(hash.length, 64);
@@ -115,6 +201,83 @@ describe("cache/config-hash", () => {
   });
 
   describe("computeConfigHashSync", () => {
+    it("matches the golden identity for the default transform config", () => {
+      assertEquals(
+        computeConfigHashSync({}),
+        `v${VERSION}:${DEFAULT_REACT_VERSION}:react`,
+      );
+    });
+
+    it("matches the golden identity for a fully scoped transform config", () => {
+      assertEquals(
+        computeConfigHashSync({
+          reactVersion: "18.3.1",
+          jsxImportSource: "preact",
+          moduleServerUrl: "https://modules.example.test/_vf_modules",
+          moduleServerOrigin: "https://preview.example.test",
+          vendorBundleHash: "vendor-a",
+          apiBaseUrl: "https://api.example.test",
+          studioEmbed: true,
+          dev: true,
+          dependencyPinningCacheKey: CANONICAL_PIN_KEY,
+        }),
+        `v${VERSION}:18.3.1:preact:modules:40:https://modules.example.test/_vf_modules:vendor:8:vendor-a:api:24:https://api.example.test:studio:dev:pins:on:z7bg3qnfgtcb:origin:aHR0cHM6Ly9wcmV2aWV3LmV4YW1wbGUudGVzdA`,
+      );
+    });
+
+    it("preserves the established identity after array primordial poisoning", () => {
+      const originalFilter = Array.prototype.filter;
+      const originalJoin = Array.prototype.join;
+      const originalPush = Array.prototype.push;
+      let identity: string | undefined;
+      try {
+        Reflect.set(Array.prototype, "filter", () => []);
+        Reflect.set(Array.prototype, "join", () => "poisoned");
+        Reflect.set(Array.prototype, "push", () => 0);
+        identity = computeConfigHashSync({
+          moduleServerUrl: "https://modules.example.test/_vf_modules",
+          vendorBundleHash: "vendor-a",
+          apiBaseUrl: "https://api.example.test",
+          studioEmbed: true,
+          dev: true,
+        });
+      } finally {
+        Reflect.set(Array.prototype, "filter", originalFilter);
+        Reflect.set(Array.prototype, "join", originalJoin);
+        Reflect.set(Array.prototype, "push", originalPush);
+      }
+
+      assertEquals(
+        identity,
+        `v${VERSION}:${DEFAULT_REACT_VERSION}:react:modules:40:https://modules.example.test/_vf_modules:vendor:8:vendor-a:api:24:https://api.example.test:studio:dev`,
+      );
+    });
+
+    it("keeps distinct sync identities stable when array push and join are poisoned", () => {
+      const firstConfig = { reactVersion: "18.3.1", dev: false };
+      const secondConfig = { reactVersion: "19.2.4", dev: true };
+      const firstBaseline = computeConfigHashSync(firstConfig);
+      const secondBaseline = computeConfigHashSync(secondConfig);
+      const originalPush = Array.prototype.push;
+      const originalJoin = Array.prototype.join;
+      let firstPoisoned: string | undefined;
+      let secondPoisoned: string | undefined;
+
+      try {
+        Reflect.set(Array.prototype, "push", () => 0);
+        Reflect.set(Array.prototype, "join", () => "poisoned");
+        firstPoisoned = computeConfigHashSync(firstConfig);
+        secondPoisoned = computeConfigHashSync(secondConfig);
+      } finally {
+        Reflect.set(Array.prototype, "push", originalPush);
+        Reflect.set(Array.prototype, "join", originalJoin);
+      }
+
+      assertEquals(firstPoisoned, firstBaseline);
+      assertEquals(secondPoisoned, secondBaseline);
+      assertNotEquals(firstPoisoned, secondPoisoned);
+    });
+
     it("should return a string", () => {
       const hash = computeConfigHashSync({});
       assertEquals(typeof hash, "string");

src/cache/config-hash.ts

@@ -7,13 +7,20 @@
 
 import { computeHash } from "#veryfront/utils";
 import { VERSION } from "#veryfront/utils/version.ts";
+import {
+  primordialArrayJoin as arrayJoin,
+  primordialArrayPush as arrayPush,
+} from "#veryfront/platform/compat/primordials/array.ts";
 import {
   CSSTYPE_VERSION,
   DEFAULT_REACT_VERSION,
   TAILWIND_VERSION,
 } from "#veryfront/transforms/import-rewriter/url-builder.ts";
 import { buildDependencyPinningCacheVariant } from "./keys/dependency-pinning.ts";
 
+const JSONStringify = JSON.stringify;
+const ObjectCreate = Object.create;
+
 /**
  * Configuration that affects transform output.
  */
@@ -48,21 +55,24 @@ export function computeConfigHash(config: TransformConfig): Promise<string> {
     config.dependencyPinningCacheKey,
     config.moduleServerOrigin,
   );
-  const normalized = {
-    transformVersion: VERSION,
-    reactVersion: config.reactVersion ?? DEFAULT_REACT_VERSION,
-    jsxImportSource: config.jsxImportSource ?? "react",
-    moduleServerUrl: config.moduleServerUrl ?? null,
-    vendorBundleHash: config.vendorBundleHash ?? null,
-    apiBaseUrl: config.apiBaseUrl ?? null,
-    studioEmbed: config.studioEmbed ?? false,
-    dev: config.dev ?? false,
-    ...(dependencyPinningCacheVariant ? { dependencyPinningCacheVariant } : {}),
-    csstype: CSSTYPE_VERSION,
-    tailwind: TAILWIND_VERSION,
-  };
+  // Null-prototype storage preserves the existing JSON cache-key format while
+  // preventing project code from injecting an inherited toJSON hook.
+  const normalized = ObjectCreate(null) as Record<string, string | boolean | null>;
+  normalized.transformVersion = VERSION;
+  normalized.reactVersion = config.reactVersion ?? DEFAULT_REACT_VERSION;
+  normalized.jsxImportSource = config.jsxImportSource ?? "react";
+  normalized.moduleServerUrl = config.moduleServerUrl ?? null;
+  normalized.vendorBundleHash = config.vendorBundleHash ?? null;
+  normalized.apiBaseUrl = config.apiBaseUrl ?? null;
+  normalized.studioEmbed = config.studioEmbed ?? false;
+  normalized.dev = config.dev ?? false;
+  if (dependencyPinningCacheVariant) {
+    normalized.dependencyPinningCacheVariant = dependencyPinningCacheVariant;
+  }
+  normalized.csstype = CSSTYPE_VERSION;
+  normalized.tailwind = TAILWIND_VERSION;
 
-  return computeHash(JSON.stringify(normalized));
+  return computeHash(JSONStringify(normalized));
 }
 
 /**
@@ -71,25 +81,27 @@ export function computeConfigHash(config: TransformConfig): Promise<string> {
  * Use this when you need a config hash but can't afford async overhead.
  */
 export function computeConfigHashSync(config: TransformConfig): string {
-  const parts = [
-    `v${VERSION}`,
-    config.reactVersion ?? DEFAULT_REACT_VERSION,
-    config.jsxImportSource ?? "react",
-    encodeConfigPart("modules", config.moduleServerUrl),
-    encodeConfigPart("vendor", config.vendorBundleHash),
-    encodeConfigPart("api", config.apiBaseUrl),
-    config.studioEmbed ? "studio" : "",
-    config.dev ? "dev" : "",
-  ].filter(Boolean);
+  const parts: string[] = [];
+  arrayPush(parts, `v${VERSION}`);
+  arrayPush(parts, config.reactVersion ?? DEFAULT_REACT_VERSION);
+  arrayPush(parts, config.jsxImportSource ?? "react");
+  const moduleServerUrlPart = encodeConfigPart("modules", config.moduleServerUrl);
+  if (moduleServerUrlPart) arrayPush(parts, moduleServerUrlPart);
+  const vendorBundleHashPart = encodeConfigPart("vendor", config.vendorBundleHash);
+  if (vendorBundleHashPart) arrayPush(parts, vendorBundleHashPart);
+  const apiBaseUrlPart = encodeConfigPart("api", config.apiBaseUrl);
+  if (apiBaseUrlPart) arrayPush(parts, apiBaseUrlPart);
+  if (config.studioEmbed) arrayPush(parts, "studio");
+  if (config.dev) arrayPush(parts, "dev");
   const dependencyPinningCacheVariant = buildDependencyPinningCacheVariant(
     config.dependencyPinningCacheKey,
     config.moduleServerOrigin,
   );
   if (dependencyPinningCacheVariant) {
-    parts.push(`pins:${dependencyPinningCacheVariant}`);
+    arrayPush(parts, `pins:${dependencyPinningCacheVariant}`);
   }
 
-  return parts.join(":");
+  return arrayJoin(parts, ":");
 }
 
 function encodeConfigPart(label: string, value: string | undefined): string {

src/embedding/rag-store.test.ts

@@ -839,14 +839,36 @@ describe("ragStore", () => {
 
       const searchPromise = store.search("needle");
       await queryEmbeddingStarted;
+      const listDocumentsPromise = store.listDocuments();
+      let blockedTimer: ReturnType<typeof setTimeout> | undefined;
+      let observedDocuments: Awaited<ReturnType<typeof store.listDocuments>> | "blocked";
+      try {
+        observedDocuments = await Promise.race([
+          listDocumentsPromise,
+          new Promise<"blocked">((resolve) => {
+            blockedTimer = setTimeout(() => resolve("blocked"), 5_000);
+          }),
+        ]);
+      } finally {
+        if (blockedTimer !== undefined) clearTimeout(blockedTimer);
+        releaseQueryEmbedding();
+      }
+      let settleTimer: ReturnType<typeof setTimeout> | undefined;
       const documents = await Promise.race([
-        store.listDocuments(),
-        new Promise<"blocked">((resolve) => setTimeout(() => resolve("blocked"), 50)),
-      ]);
-      releaseQueryEmbedding();
+        listDocumentsPromise,
+        new Promise<never>((_, reject) => {
+          settleTimer = setTimeout(
+            () => reject(new Error("listDocuments did not settle after query embedding release")),
+            5_000,
+          );
+        }),
+      ]).finally(() => {
+        if (settleTimer !== undefined) clearTimeout(settleTimer);
+      });
       await searchPromise;
 
-      assert(Array.isArray(documents));
+      assert(Array.isArray(observedDocuments));
+      assertEquals(observedDocuments, documents);
       assertEquals(documents.length, 1);
       assertEquals(documents[0]?.title, "Doc");
     });

src/modules/README.md

@@ -142,12 +142,14 @@ module before importing it.
 
 ```typescript
 import { loadImportMap, mergeImportMaps, resolveImport } from "#veryfront/modules";
+import type { VeryfrontConfig } from "#veryfront/config";
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 
 export async function resolveReact(
   adapter: RuntimeAdapter,
+  validatedConfig?: VeryfrontConfig,
 ) {
-  const projectMap = await loadImportMap("/workspace/site", adapter);
+  const projectMap = await loadImportMap("/workspace/site", adapter, validatedConfig);
   const overrides = {
     imports: {
       "@app/": "/_vf_modules/app/",
@@ -162,7 +164,9 @@ export async function resolveReact(
 `mergeImportMaps` accepts maps as separate arguments. Later maps win for exact
 keys, while scoped maps are merged per scope. `loadImportMap` applies framework
 defaults, project `deno.json`, and Veryfront configuration in that order and
-then enforces the framework React mappings.
+then enforces the framework React mappings. Its optional third argument accepts
+an already validated request configuration; without it, the loader discovers
+the project configuration from the project path.
 
 ## Operational contracts