veryfront 0.1.38 → 0.1.40

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.38",
+    "version": "0.1.40",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [
@@ -283,7 +283,7 @@ export default {
         "proxy": "deno run --allow-all cli/main.ts serve --mode=proxy",
         "dev": "deno run --allow-all cli/main.ts dev",
         "production": "deno run --allow-all cli/main.ts serve --mode=production",
-        "build": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/generate-templates-manifest.ts && deno run -A scripts/build/generate-dev-ui-manifest.ts && deno run -A scripts/build/prepare-framework-sources.ts && deno run -A scripts/build/prebundle-client-scripts.ts && deno compile --allow-all --include src/platform/polyfills --include src/proxy/main.ts --include dist/framework-src --output ./bin/veryfront cli/main.ts",
+        "build": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/generate-templates-manifest.ts && deno run -A scripts/build/generate-dev-ui-manifest.ts && deno run -A scripts/build/prepare-framework-sources.ts && deno run -A scripts/build/prebundle-client-scripts.ts && deno run -A scripts/build/prebundle-bridge.ts && deno compile --allow-all --include src/platform/polyfills --include src/proxy/main.ts --include dist/framework-src --output ./bin/veryfront cli/main.ts",
         "build:npm": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/build-npm-dnt.ts",
         "release": "deno run -A scripts/release.ts",
         "test": "VF_DISABLE_LRU_INTERVAL=1 SSR_TRANSFORM_PER_PROJECT_LIMIT=0 REVALIDATION_PER_PROJECT_LIMIT=0 NODE_ENV=production LOG_FORMAT=text deno test --no-check --parallel --allow-all '--ignore=tests/e2e,tests/integration/compiled-binary-e2e.test.ts' --unstable-worker-options --unstable-net",
@@ -352,7 +352,8 @@ export default {
         ],
         "exclude": [
             "dist/",
-            "coverage/"
+            "coverage/",
+            "src/studio/bridge/"
         ],
         "rules": {
             "tags": [

package/esm/src/html/dev-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../src/src/html/dev-scripts.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BnD;AAMD,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAiBrE"}
+{"version":3,"file":"dev-scripts.d.ts","sourceRoot":"","sources":["../../../src/src/html/dev-scripts.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BnD;AAMD,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAwBrE"}

package/esm/src/html/dev-scripts.js

@@ -47,16 +47,22 @@ export function getProdScripts(slug, nonce) {
 }
 export function getStudioScripts(options) {
     const nonceAttr = getNonceAttr(options.nonce);
-    const params = new URLSearchParams({
+    const bridgeConfig = {
         projectId: options.projectId,
         pageId: options.pageId,
-        ...(options.pagePath ? { pagePath: options.pagePath } : {}),
-        ...(options.wsUrl ? { wsUrl: options.wsUrl } : {}),
-        ...(options.yjsGuid ? { yjsGuid: options.yjsGuid } : {}),
-    }).toString();
+        pagePath: options.pagePath ?? options.pageId,
+    };
+    if (options.wsUrl)
+        bridgeConfig.wsUrl = options.wsUrl;
+    if (options.yjsGuid)
+        bridgeConfig.yjsGuid = options.yjsGuid;
     const sourceHashScript = options.sourceHash
-        ? `<script${nonceAttr}>window.__VERYFRONT_SOURCE_HASH__="${options.sourceHash}";</script>\n  `
+        ? `<script${nonceAttr}>window.__VERYFRONT_SOURCE_HASH__=${JSON.stringify(options.sourceHash).replace(/</g, "\\u003c")};</script>\n  `
         : "";
+    // Escape </script> sequences to prevent XSS breakout from inline JSON
+    const safeJson = JSON.stringify(bridgeConfig).replace(/</g, "\\u003c");
+    const configScript = `<script${nonceAttr}>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>`;
     return `
-  ${sourceHashScript}<script type="module" src="/_veryfront/studio-bridge.js?${params}"${nonceAttr}></script>`;
+  ${sourceHashScript}${configScript}
+  <script type="module" src="/_veryfront/studio-bridge.js"${nonceAttr}></script>`;
 }

package/esm/src/server/handlers/preview/markdown-html-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-html-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/markdown-html-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAMrD,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IACzB,gDAAgD;IAChD,GAAG,EAAE,GAAG,CAAC;IACT,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAuED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2FzE"}
+{"version":3,"file":"markdown-html-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/markdown-html-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAKrD,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IACzB,gDAAgD;IAChD,GAAG,EAAE,GAAG,CAAC;IACT,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA0ED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2FzE"}

package/esm/src/server/handlers/preview/markdown-html-generator.js

@@ -1,4 +1,3 @@
-import { generateStudioBridgeScript } from "../../../studio/bridge-template.js";
 import { escapeHtml } from "../../../utils/html-escape.js";
 /**
  * Detect the preferred color theme from request parameters and client hints.
@@ -49,13 +48,19 @@ function buildStudioScript(url, projectId, filePath, branchId, apiBaseUrl) {
         }
     }
     const yjsGuid = branchId ? `${canonicalProjectId}:${branchId}` : canonicalProjectId;
-    return `<script>${generateStudioBridgeScript({
+    const bridgeConfig = {
         projectId: canonicalProjectId,
         pageId: canonicalPageId,
         pagePath: filePath,
-        wsUrl,
-        yjsGuid,
-    })}</script>`;
+    };
+    if (wsUrl)
+        bridgeConfig.wsUrl = wsUrl;
+    if (yjsGuid)
+        bridgeConfig.yjsGuid = yjsGuid;
+    // Escape </script> sequences to prevent XSS breakout from inline JSON
+    const safeJson = JSON.stringify(bridgeConfig).replace(/</g, "\\u003c");
+    return `<script>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>
+  <script type="module" src="/_veryfront/studio-bridge.js"></script>`;
 }
 /**
  * Generate a complete HTML document for markdown preview rendering.

package/esm/src/server/handlers/studio/bridge-modules.handler.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Studio Bridge Handler
+ *
+ * Serves the studio bridge script. In compiled binaries, uses a pre-bundled
+ * version generated at build time. In dev mode, bundles on-the-fly with esbuild.
+ *
+ * Route: /_veryfront/studio-bridge.js
+ *
+ * @module server/handlers/studio/bridge-modules
+ */
+import * as dntShim from "../../../../_dnt.shims.js";
+import { BaseHandler } from "../../../security/index.js";
+import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
+export declare class StudioBridgeModulesHandler extends BaseHandler {
+    metadata: HandlerMetadata;
+    handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult>;
+}
+/**
+ * Invalidate the bundle cache.
+ * Used by dev file watchers to bust the cache on source changes.
+ */
+export declare function invalidateBridgeModuleCache(): void;
+//# sourceMappingURL=bridge-modules.handler.d.ts.map

package/esm/src/server/handlers/studio/bridge-modules.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-modules.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/studio/bridge-modules.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,aAAa,CAAC;AA4DrB,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAwChF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/esm/src/server/handlers/studio/bridge-modules.handler.js

@@ -0,0 +1,109 @@
+/**
+ * Studio Bridge Handler
+ *
+ * Serves the studio bridge script. In compiled binaries, uses a pre-bundled
+ * version generated at build time. In dev mode, bundles on-the-fly with esbuild.
+ *
+ * Route: /_veryfront/studio-bridge.js
+ *
+ * @module server/handlers/studio/bridge-modules
+ */
+import * as dntShim from "../../../../_dnt.shims.js";
+import { BaseHandler } from "../../../security/index.js";
+import { HTTP_OK, PRIORITY_HIGH_DEV } from "../../../utils/constants/index.js";
+import { STUDIO_BRIDGE_BUNDLE } from "../../../studio/bridge/bridge-bundle.generated.js";
+/** Cached bundle output. */
+let bundleCache = null;
+/** Resolve the bridge source directory from this module's location. */
+const BRIDGE_DIR = new URL("../../../studio/bridge/", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;
+/**
+ * Compute a content hash for ETag.
+ */
+async function computeEtag(content) {
+    const data = new TextEncoder().encode(content);
+    const hashBuffer = await dntShim.crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.slice(0, 16).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+ * Bundle the bridge coordinator (and all its imports) into a single JS file.
+ * Uses pre-bundled output when available (compiled binary), falls back to
+ * esbuild JIT bundling in dev mode.
+ */
+async function bundleBridge() {
+    if (bundleCache)
+        return bundleCache;
+    // Use pre-bundled output if available (compiled binary / CI builds)
+    if (STUDIO_BRIDGE_BUNDLE) {
+        const etag = await computeEtag(STUDIO_BRIDGE_BUNDLE);
+        bundleCache = { js: STUDIO_BRIDGE_BUNDLE, etag };
+        return bundleCache;
+    }
+    // Dev mode: bundle on-the-fly with esbuild
+    const entryPoint = `${BRIDGE_DIR}bridge-coordinator.ts`;
+    const source = await dntShim.Deno.readTextFile(entryPoint);
+    const { build } = await import("esbuild");
+    const { outputFiles } = await build({
+        bundle: true,
+        write: false,
+        format: "esm",
+        platform: "browser",
+        target: "es2022",
+        stdin: {
+            contents: source,
+            loader: "ts",
+            resolveDir: BRIDGE_DIR,
+            sourcefile: entryPoint,
+        },
+    });
+    const js = outputFiles?.[0]?.text ?? "";
+    const etag = await computeEtag(js);
+    bundleCache = { js, etag };
+    return bundleCache;
+}
+export class StudioBridgeModulesHandler extends BaseHandler {
+    metadata = {
+        name: "StudioBridgeModulesHandler",
+        priority: PRIORITY_HIGH_DEV,
+        patterns: [{ pattern: "/_veryfront/studio-bridge.js", exact: true }],
+        enabled: () => true,
+    };
+    async handle(req, ctx) {
+        if (!this.shouldHandle(req, ctx)) {
+            return this.continue();
+        }
+        const ifNoneMatch = req.headers.get("if-none-match");
+        try {
+            const { js, etag } = await bundleBridge();
+            if (ifNoneMatch === `"${etag}"`) {
+                return this.respond(new dntShim.Response(null, {
+                    status: 304,
+                    headers: { ETag: `"${etag}"`, "Cache-Control": "no-cache" },
+                }));
+            }
+            return this.respond(new dntShim.Response(js, {
+                status: HTTP_OK,
+                headers: {
+                    "Content-Type": "application/javascript; charset=utf-8",
+                    "Cache-Control": "no-cache",
+                    ETag: `"${etag}"`,
+                },
+            }));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error("[StudioBridgeHandler] Bundle error:", message);
+            return this.respond(new dntShim.Response(`// Bundle error: ${message}`, {
+                status: 500,
+                headers: { "Content-Type": "application/javascript; charset=utf-8" },
+            }));
+        }
+    }
+}
+/**
+ * Invalidate the bundle cache.
+ * Used by dev file watchers to bust the cache on source changes.
+ */
+export function invalidateBridgeModuleCache() {
+    bundleCache = null;
+}

package/esm/src/server/runtime-handler/index.js

@@ -28,7 +28,7 @@ import { DevEndpointsHandler } from "../handlers/dev/endpoints.handler.js";
 import { DevFileHandler } from "../handlers/dev/files/index.js";
 import { DebugContextHandler } from "../handlers/dev/debug-context.handler.js";
 import { StylesCSSHandler } from "../handlers/dev/styles-css.handler.js";
-import { StudioEndpointsHandler } from "../handlers/studio/endpoints.handler.js";
+import { StudioBridgeModulesHandler } from "../handlers/studio/bridge-modules.handler.js";
 import { StaticHandler } from "../handlers/request/static.handler.js";
 import { SnippetHandler } from "../handlers/request/snippet.handler.js";
 import { LibModulesHandler } from "../handlers/request/lib-modules.handler.js";
@@ -123,7 +123,7 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
         new OpenAPIDocsHandler(),
         new DevDashboardHandler(),
         new ProjectsHandler(),
-        new StudioEndpointsHandler(),
+        new StudioBridgeModulesHandler(),
         new CSSHandler(),
         new DevFileHandler(),
         new SnippetHandler(),

package/esm/src/studio/bridge/bridge-bundle.generated.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Pre-bundled Studio Bridge Script
+ *
+ * AUTO-GENERATED by scripts/build/prebundle-bridge.ts
+ * Do not edit manually — run `deno task build` to regenerate.
+ * @module
+ */
+export declare const STUDIO_BRIDGE_BUNDLE: string | undefined;
+//# sourceMappingURL=bridge-bundle.generated.d.ts.map

package/esm/src/studio/bridge/bridge-bundle.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-bundle.generated.d.ts","sourceRoot":"","sources":["../../../../src/src/studio/bridge/bridge-bundle.generated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,oBAAoB,EAAE,MAAM,GAAG,SAAqB,CAAC"}

package/esm/src/studio/bridge/bridge-bundle.generated.js

@@ -0,0 +1,8 @@
+/**
+ * Pre-bundled Studio Bridge Script
+ *
+ * AUTO-GENERATED by scripts/build/prebundle-bridge.ts
+ * Do not edit manually — run `deno task build` to regenerate.
+ * @module
+ */
+export const STUDIO_BRIDGE_BUNDLE = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [
@@ -283,7 +283,7 @@ export default {
     "proxy": "deno run --allow-all cli/main.ts serve --mode=proxy",
     "dev": "deno run --allow-all cli/main.ts dev",
     "production": "deno run --allow-all cli/main.ts serve --mode=production",
-    "build": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/generate-templates-manifest.ts && deno run -A scripts/build/generate-dev-ui-manifest.ts && deno run -A scripts/build/prepare-framework-sources.ts && deno run -A scripts/build/prebundle-client-scripts.ts && deno compile --allow-all --include src/platform/polyfills --include src/proxy/main.ts --include dist/framework-src --output ./bin/veryfront cli/main.ts",
+    "build": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/generate-templates-manifest.ts && deno run -A scripts/build/generate-dev-ui-manifest.ts && deno run -A scripts/build/prepare-framework-sources.ts && deno run -A scripts/build/prebundle-client-scripts.ts && deno run -A scripts/build/prebundle-bridge.ts && deno compile --allow-all --include src/platform/polyfills --include src/proxy/main.ts --include dist/framework-src --output ./bin/veryfront cli/main.ts",
     "build:npm": "deno run -A scripts/build/generate-integrations-module.ts && deno run -A scripts/build/build-npm-dnt.ts",
     "release": "deno run -A scripts/release.ts",
     "test": "VF_DISABLE_LRU_INTERVAL=1 SSR_TRANSFORM_PER_PROJECT_LIMIT=0 REVALIDATION_PER_PROJECT_LIMIT=0 NODE_ENV=production LOG_FORMAT=text deno test --no-check --parallel --allow-all '--ignore=tests/e2e,tests/integration/compiled-binary-e2e.test.ts' --unstable-worker-options --unstable-net",
@@ -352,7 +352,8 @@ export default {
     ],
     "exclude": [
       "dist/",
-      "coverage/"
+      "coverage/",
+      "src/studio/bridge/"
     ],
     "rules": {
       "tags": [

package/src/src/html/dev-scripts.ts

@@ -68,18 +68,25 @@ export interface StudioScriptOptions {
 export function getStudioScripts(options: StudioScriptOptions): string {
   const nonceAttr = getNonceAttr(options.nonce);
 
-  const params = new URLSearchParams({
+  const bridgeConfig: Record<string, unknown> = {
     projectId: options.projectId,
     pageId: options.pageId,
-    ...(options.pagePath ? { pagePath: options.pagePath } : {}),
-    ...(options.wsUrl ? { wsUrl: options.wsUrl } : {}),
-    ...(options.yjsGuid ? { yjsGuid: options.yjsGuid } : {}),
-  }).toString();
+    pagePath: options.pagePath ?? options.pageId,
+  };
+  if (options.wsUrl) bridgeConfig.wsUrl = options.wsUrl;
+  if (options.yjsGuid) bridgeConfig.yjsGuid = options.yjsGuid;
 
   const sourceHashScript = options.sourceHash
-    ? `<script${nonceAttr}>window.__VERYFRONT_SOURCE_HASH__="${options.sourceHash}";</script>\n  `
+    ? `<script${nonceAttr}>window.__VERYFRONT_SOURCE_HASH__=${
+      JSON.stringify(options.sourceHash).replace(/</g, "\\u003c")
+    };</script>\n  `
     : "";
 
+  // Escape </script> sequences to prevent XSS breakout from inline JSON
+  const safeJson = JSON.stringify(bridgeConfig).replace(/</g, "\\u003c");
+  const configScript = `<script${nonceAttr}>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>`;
+
   return `
-  ${sourceHashScript}<script type="module" src="/_veryfront/studio-bridge.js?${params}"${nonceAttr}></script>`;
+  ${sourceHashScript}${configScript}
+  <script type="module" src="/_veryfront/studio-bridge.js"${nonceAttr}></script>`;
 }

package/src/src/server/handlers/preview/markdown-html-generator.ts

@@ -10,7 +10,6 @@
 import * as dntShim from "../../../../_dnt.shims.js";
 
 
-import { generateStudioBridgeScript } from "../../../studio/bridge-template.js";
 import { escapeHtml } from "../../../utils/html-escape.js";
 
 /** Options for generating markdown preview HTML. */
@@ -93,15 +92,18 @@ function buildStudioScript(
   }
   const yjsGuid = branchId ? `${canonicalProjectId}:${branchId}` : canonicalProjectId;
 
-  return `<script>${
-    generateStudioBridgeScript({
-      projectId: canonicalProjectId,
-      pageId: canonicalPageId,
-      pagePath: filePath,
-      wsUrl,
-      yjsGuid,
-    })
-  }</script>`;
+  const bridgeConfig: Record<string, unknown> = {
+    projectId: canonicalProjectId,
+    pageId: canonicalPageId,
+    pagePath: filePath,
+  };
+  if (wsUrl) bridgeConfig.wsUrl = wsUrl;
+  if (yjsGuid) bridgeConfig.yjsGuid = yjsGuid;
+
+  // Escape </script> sequences to prevent XSS breakout from inline JSON
+  const safeJson = JSON.stringify(bridgeConfig).replace(/</g, "\\u003c");
+  return `<script>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>
+  <script type="module" src="/_veryfront/studio-bridge.js"></script>`;
 }
 
 /**

package/src/src/server/handlers/studio/bridge-modules.handler.ts

@@ -0,0 +1,136 @@
+/**
+ * Studio Bridge Handler
+ *
+ * Serves the studio bridge script. In compiled binaries, uses a pre-bundled
+ * version generated at build time. In dev mode, bundles on-the-fly with esbuild.
+ *
+ * Route: /_veryfront/studio-bridge.js
+ *
+ * @module server/handlers/studio/bridge-modules
+ */
+import * as dntShim from "../../../../_dnt.shims.js";
+
+
+import { BaseHandler } from "../../../security/index.js";
+import type {
+  HandlerContext,
+  HandlerMetadata,
+  HandlerPriority,
+  HandlerResult,
+} from "../types.js";
+import { HTTP_OK, PRIORITY_HIGH_DEV } from "../../../utils/constants/index.js";
+import { STUDIO_BRIDGE_BUNDLE } from "../../../studio/bridge/bridge-bundle.generated.js";
+
+/** Cached bundle output. */
+let bundleCache: { js: string; etag: string } | null = null;
+
+/** Resolve the bridge source directory from this module's location. */
+const BRIDGE_DIR = new URL("../../../studio/bridge/", import.meta.url).pathname;
+
+/**
+ * Compute a content hash for ETag.
+ */
+async function computeEtag(content: string): Promise<string> {
+  const data = new TextEncoder().encode(content);
+  const hashBuffer = await dntShim.crypto.subtle.digest("SHA-256", data);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.slice(0, 16).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/**
+ * Bundle the bridge coordinator (and all its imports) into a single JS file.
+ * Uses pre-bundled output when available (compiled binary), falls back to
+ * esbuild JIT bundling in dev mode.
+ */
+async function bundleBridge(): Promise<{ js: string; etag: string }> {
+  if (bundleCache) return bundleCache;
+
+  // Use pre-bundled output if available (compiled binary / CI builds)
+  if (STUDIO_BRIDGE_BUNDLE) {
+    const etag = await computeEtag(STUDIO_BRIDGE_BUNDLE);
+    bundleCache = { js: STUDIO_BRIDGE_BUNDLE, etag };
+    return bundleCache;
+  }
+
+  // Dev mode: bundle on-the-fly with esbuild
+  const entryPoint = `${BRIDGE_DIR}bridge-coordinator.ts`;
+  const source = await dntShim.Deno.readTextFile(entryPoint);
+
+  const { build } = await import("esbuild");
+  const { outputFiles } = await build({
+    bundle: true,
+    write: false,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    stdin: {
+      contents: source,
+      loader: "ts",
+      resolveDir: BRIDGE_DIR,
+      sourcefile: entryPoint,
+    },
+  });
+
+  const js = outputFiles?.[0]?.text ?? "";
+  const etag = await computeEtag(js);
+  bundleCache = { js, etag };
+  return bundleCache;
+}
+
+export class StudioBridgeModulesHandler extends BaseHandler {
+  metadata: HandlerMetadata = {
+    name: "StudioBridgeModulesHandler",
+    priority: PRIORITY_HIGH_DEV as HandlerPriority,
+    patterns: [{ pattern: "/_veryfront/studio-bridge.js", exact: true }],
+    enabled: () => true,
+  };
+
+  async handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!this.shouldHandle(req, ctx)) {
+      return this.continue();
+    }
+
+    const ifNoneMatch = req.headers.get("if-none-match");
+
+    try {
+      const { js, etag } = await bundleBridge();
+
+      if (ifNoneMatch === `"${etag}"`) {
+        return this.respond(
+          new dntShim.Response(null, {
+            status: 304,
+            headers: { ETag: `"${etag}"`, "Cache-Control": "no-cache" },
+          }),
+        );
+      }
+
+      return this.respond(
+        new dntShim.Response(js, {
+          status: HTTP_OK,
+          headers: {
+            "Content-Type": "application/javascript; charset=utf-8",
+            "Cache-Control": "no-cache",
+            ETag: `"${etag}"`,
+          },
+        }),
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error("[StudioBridgeHandler] Bundle error:", message);
+      return this.respond(
+        new dntShim.Response(`// Bundle error: ${message}`, {
+          status: 500,
+          headers: { "Content-Type": "application/javascript; charset=utf-8" },
+        }),
+      );
+    }
+  }
+}
+
+/**
+ * Invalidate the bundle cache.
+ * Used by dev file watchers to bust the cache on source changes.
+ */
+export function invalidateBridgeModuleCache(): void {
+  bundleCache = null;
+}

package/src/src/server/runtime-handler/index.ts

@@ -39,7 +39,7 @@ import { DevEndpointsHandler } from "../handlers/dev/endpoints.handler.js";
 import { DevFileHandler } from "../handlers/dev/files/index.js";
 import { DebugContextHandler } from "../handlers/dev/debug-context.handler.js";
 import { StylesCSSHandler } from "../handlers/dev/styles-css.handler.js";
-import { StudioEndpointsHandler } from "../handlers/studio/endpoints.handler.js";
+import { StudioBridgeModulesHandler } from "../handlers/studio/bridge-modules.handler.js";
 import { StaticHandler } from "../handlers/request/static.handler.js";
 import { SnippetHandler } from "../handlers/request/snippet.handler.js";
 import { LibModulesHandler } from "../handlers/request/lib-modules.handler.js";
@@ -206,7 +206,7 @@ export function createVeryfrontHandler(
     new OpenAPIDocsHandler(),
     new DevDashboardHandler(),
     new ProjectsHandler(),
-    new StudioEndpointsHandler(),
+    new StudioBridgeModulesHandler(),
     new CSSHandler(),
     new DevFileHandler(),
     new SnippetHandler(),

package/src/src/studio/bridge/bridge-bundle.generated.ts

@@ -0,0 +1,9 @@
+/**
+ * Pre-bundled Studio Bridge Script
+ *
+ * AUTO-GENERATED by scripts/build/prebundle-bridge.ts
+ * Do not edit manually — run `deno task build` to regenerate.
+ * @module
+ */
+
+export const STUDIO_BRIDGE_BUNDLE: string | undefined = undefined;

package/esm/src/server/handlers/studio/endpoints.handler.d.ts

@@ -1,12 +0,0 @@
-/**
- * Studio Endpoints Handler
- * Handles studio bridge script and other studio-specific endpoints
- */
-import * as dntShim from "../../../../_dnt.shims.js";
-import { BaseHandler } from "../../../security/index.js";
-import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
-export declare class StudioEndpointsHandler extends BaseHandler {
-    metadata: HandlerMetadata;
-    handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult>;
-}
-//# sourceMappingURL=endpoints.handler.d.ts.map

package/esm/src/server/handlers/studio/endpoints.handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoints.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/studio/endpoints.handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,qBAAa,sBAAuB,SAAQ,WAAW;IACrD,QAAQ,EAAE,eAAe,CAKvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAuB1E"}

package/esm/src/server/handlers/studio/endpoints.handler.js

@@ -1,29 +0,0 @@
-import { BaseHandler } from "../../../security/index.js";
-import { HTTP_OK, PRIORITY_HIGH_DEV } from "../../../utils/constants/index.js";
-import { generateStudioBridgeScript } from "../../../studio/bridge-template.js";
-export class StudioEndpointsHandler extends BaseHandler {
-    metadata = {
-        name: "StudioEndpointsHandler",
-        priority: PRIORITY_HIGH_DEV,
-        patterns: [{ pattern: "/_veryfront/studio-bridge.js", exact: true }],
-        enabled: () => true, // Always enabled - studio_embed check is in the script
-    };
-    handle(req, ctx) {
-        if (!this.shouldHandle(req, ctx)) {
-            return Promise.resolve(this.continue());
-        }
-        const url = new URL(req.url);
-        if (url.pathname !== "/_veryfront/studio-bridge.js") {
-            return Promise.resolve(this.continue());
-        }
-        const builder = this.createResponseBuilder(ctx);
-        const projectId = url.searchParams.get("projectId") ?? "";
-        const pageId = url.searchParams.get("pageId") ?? "";
-        const pagePath = url.searchParams.get("pagePath") ?? undefined;
-        const wsUrl = url.searchParams.get("wsUrl") ?? undefined;
-        const yjsGuid = url.searchParams.get("yjsGuid") ?? undefined;
-        const script = generateStudioBridgeScript({ projectId, pageId, pagePath, wsUrl, yjsGuid });
-        const response = builder.withCache("no-cache").javascript(script, HTTP_OK);
-        return Promise.resolve(this.respond(response));
-    }
-}

package/esm/src/studio/bridge-template.d.ts

@@ -1,11 +0,0 @@
-export interface StudioBridgeOptions {
-    projectId: string;
-    pageId: string;
-    pagePath?: string;
-    wsUrl?: string;
-    yjsGuid?: string;
-    debugSkipInit?: boolean;
-    debugExposeInternals?: boolean;
-}
-export declare function generateStudioBridgeScript(options: StudioBridgeOptions): string;
-//# sourceMappingURL=bridge-template.d.ts.map

package/esm/src/studio/bridge-template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bridge-template.d.ts","sourceRoot":"","sources":["../../../src/src/studio/bridge-template.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAyrJ/E"}