veryfront 0.1.49 → 0.1.50

package/src/src/modules/react-loader/ssr-module-loader/http-bundle-helpers.ts

@@ -10,11 +10,14 @@
 import { createFileSystem, exists } from "../../../platform/compat/fs.js";
 import { LRUCache } from "../../../utils/lru-wrapper.js";
 
+/** Max entries in the verified HTTP bundle paths LRU cache */
+const VERIFIED_BUNDLE_CACHE_MAX_ENTRIES = 2_000;
+
 /**
  * Extract VF module paths (veryfront-mdx-esm/*.mjs) from code.
  * These are user project modules that may import HTTP bundles.
  */
-export function extractVfModulePaths(code: string): string[] {
+function extractVfModulePaths(code: string): string[] {
   // Create regex per call to avoid shared lastIndex state across concurrent calls.
   const vfModulePattern = /file:\/\/([^"'\s]+veryfront-mdx-esm\/[^"'\s]+\.mjs)/gi;
   const paths: string[] = [];
@@ -83,8 +86,8 @@ export async function extractAllHttpBundlePathsRecursive(
           pendingVfModules.push(nestedPath);
         }
       }
-    } catch {
-      // Ignore read errors for VF modules
+    } catch (_) {
+      /* expected: VF module file may fail to read */
     }
   }
 
@@ -154,4 +157,6 @@ export function extractAllFilePaths(code: string): string[] {
  * Bounded LRU to prevent unbounded memory growth in long-running pods.
  * Keying by contentHash ensures verification is re-done when content changes at the same path.
  */
-export const verifiedHttpBundlePaths = new LRUCache<string, true>({ maxEntries: 2000 });
+export const verifiedHttpBundlePaths = new LRUCache<string, true>({
+  maxEntries: VERIFIED_BUNDLE_CACHE_MAX_ENTRIES,
+});

package/src/src/modules/react-loader/ssr-module-loader/loader.ts

@@ -642,7 +642,7 @@ export class SSRModuleLoader {
         }
 
         if (isSSRDistributedCacheEnabled()) {
-          setInRedis(contentCacheKey, transformed, {
+          void setInRedis(contentCacheKey, transformed, {
             isProduction: this.cache.isProductionContentSource(),
           }).catch((error) => {
             logger.debug("Distributed cache set failed", {

package/src/src/modules/react-loader/ssr-module-loader/preflight-imports.ts

@@ -1,7 +1,7 @@
 import { createFileSystem } from "../../../platform/compat/fs.js";
 import type { LocalImport, MissingImport } from "../../../transforms/esm/import-parser.js";
 
-export interface PreflightImportsResult {
+interface PreflightImportsResult {
   validImports: LocalImport[];
   missingImports: MissingImport[];
 }
@@ -31,7 +31,8 @@ export async function preflightLocalImports(
           reason: `Pre-flight: not a file on disk: ${imp.absolutePath}`,
         });
       }
-    } catch {
+    } catch (_) {
+      /* expected: file may not be accessible on disk */
       missingImports.push({
         specifier: imp.specifier,
         fromFile: filePath,

package/src/src/modules/react-loader/ssr-module-loader/ssr-cache-manager.ts

@@ -10,6 +10,7 @@ import * as dntShim from "../../../../_dnt.shims.js";
 
 
 import { VERSION } from "../../../utils/version.js";
+import { INVALID_ARGUMENT } from "../../../errors/index.js";
 import { buildSSRModuleCacheKey } from "../../../cache/keys.js";
 import { computeConfigHashSync } from "../../../cache/config-hash.js";
 import { createFileSystem } from "../../../platform/compat/fs.js";
@@ -28,6 +29,9 @@ import type { ModuleCacheEntry, SSRModuleLoaderOptions } from "./types.js";
 
 const logger = rendererLogger.component("ssr-module-loader");
 
+/** Content length threshold: below this, use fast sync hash; above, use async SHA-256 */
+const SYNC_HASH_THRESHOLD = 10_000;
+
 const UNRESOLVED_VF_MODULE_IMPORT_PATTERN =
   /from\s*["']((?:file:\/\/)?\/?\/?_vf_modules\/[^"']+)["']/;
 
@@ -58,9 +62,10 @@ export class SSRCacheManager {
 
   getCacheKey(filePath: string): string {
     if (!this.options.contentSourceId) {
-      throw new Error(
-        `Missing contentSourceId for SSR module cache (project: ${this.options.projectId}, file: ${filePath})`,
-      );
+      throw INVALID_ARGUMENT.create({
+        detail:
+          `Missing contentSourceId for SSR module cache (project: ${this.options.projectId}, file: ${filePath})`,
+      });
     }
 
     const reactVersion = this.options.reactVersion ?? "default";
@@ -74,7 +79,7 @@ export class SSRCacheManager {
   }
 
   async hashContentAsync(content: string): Promise<string> {
-    if (content.length < 10000) return hashCodeHex(content);
+    if (content.length < SYNC_HASH_THRESHOLD) return hashCodeHex(content);
 
     try {
       const data = new TextEncoder().encode(content);
@@ -84,7 +89,8 @@ export class SSRCacheManager {
         .slice(0, 8)
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("");
-    } catch {
+    } catch (_) {
+      /* expected: WebCrypto may not be available, fall back to sync hash */
       return hashCodeHex(content);
     }
   }
@@ -172,7 +178,8 @@ export class SSRCacheManager {
       }
       verifiedHttpBundlePaths.set(verifyKey, true);
       return globalModuleCache.has(contentCacheKey);
-    } catch {
+    } catch (error) {
+      logger.debug("Failed to validate memory cache entry, invalidating", { error });
       this.invalidateContentAndFileCacheEntries(contentCacheKey, filePathCacheKey, cachedEntry);
       return false;
     }
@@ -236,10 +243,11 @@ export class SSRCacheManager {
         if (!stat.isFile) {
           return true;
         }
-      } catch {
+      } catch (error) {
         logger.debug("Redis cache has invalid local path, re-transforming", {
           file: filePath.slice(-40),
           missingPath: path.slice(-60),
+          error,
         });
         return true;
       }
@@ -252,12 +260,14 @@ export class SSRCacheManager {
     const { projectId, contentSourceId } = this.options;
 
     if (!projectId) {
-      throw new Error(
-        `Missing projectId for SSR temp directory (projectDir: ${this.options.projectDir})`,
-      );
+      throw INVALID_ARGUMENT.create({
+        detail: `Missing projectId for SSR temp directory (projectDir: ${this.options.projectDir})`,
+      });
     }
     if (!contentSourceId) {
-      throw new Error(`Missing contentSourceId for SSR temp directory (project: ${projectId})`);
+      throw INVALID_ARGUMENT.create({
+        detail: `Missing contentSourceId for SSR temp directory (project: ${projectId})`,
+      });
     }
 
     const baseCacheDir = getMdxEsmCacheDir();

package/src/src/modules/react-loader/ssr-module-loader/vf-module-resolver.ts

@@ -86,8 +86,17 @@ export async function resolveVfModuleImports(
 
   const results = await Promise.all(
     imports.map(async ({ original, path }) => {
-      const cachedFilePath = await fetchAndCacheModule(path, fetcherContext);
-      return { original, path, cachedFilePath };
+      try {
+        const cachedFilePath = await fetchAndCacheModule(path, fetcherContext);
+        return { original, path, cachedFilePath };
+      } catch (error) {
+        logger.warn("Failed to fetch _vf_modules import", {
+          file: options.filePath.slice(-40),
+          path,
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return { original, path, cachedFilePath: null };
+      }
     }),
   );
 

package/src/src/modules/react-loader/unified-loader.ts

@@ -58,13 +58,13 @@ export function loadComponentsUnified(
   );
 }
 
-function transformAllComponents(
+async function transformAllComponents(
   components: ComponentSource[],
   projectDir: string,
   adapter: RuntimeAdapter,
   transformOpts: TransformOptions,
 ): Promise<TransformedComponent[]> {
-  return Promise.all(
+  return await Promise.all(
     components.map(async (comp) => ({
       name: comp.name,
       code: await transformToESM(comp.source, comp.filePath, projectDir, adapter, transformOpts),

package/src/src/modules/server/module-batch-handler.ts

@@ -45,9 +45,15 @@ const SLOW_REQUEST_THRESHOLD_MS = 500;
 /** Slow module transform threshold in milliseconds */
 const SLOW_TRANSFORM_THRESHOLD_MS = 100;
 
+/** Max entries in the per-project transform LRU cache */
+const TRANSFORM_CACHE_MAX_ENTRIES = 1_000;
+
+/** Immutable cache max-age in seconds (1 year) */
+const IMMUTABLE_CACHE_MAX_AGE_SECONDS = 31_536_000;
+
 /** Cache for transformed modules (path -> code) */
 const transformCache = new LRUCache<string, string>({
-  maxEntries: 1000,
+  maxEntries: TRANSFORM_CACHE_MAX_ENTRIES,
 });
 
 // Register cache for monitoring
@@ -250,7 +256,7 @@ export function handleModuleBatch(req: dntShim.Request, options: BatchHandlerOpt
         status: HTTP_OK,
         headers: {
           "Content-Type": "application/javascript; charset=utf-8",
-          "Cache-Control": "public, max-age=31536000, immutable",
+          "Cache-Control": `public, max-age=${IMMUTABLE_CACHE_MAX_AGE_SECONDS}, immutable`,
           "X-Batch-Modules": String(successes.length),
           "X-Batch-Duration": String(Math.round(duration)),
           "X-Batch-Slow": isSlow ? "true" : "false",
@@ -291,8 +297,8 @@ async function loadAndTransformModule(
 
       const source = await secureFs.readFile(fullPath);
       return transformModule(source, fullPath, projectDir, adapter, options);
-    } catch {
-      // Continue trying
+    } catch (_) {
+      /* expected: file may not exist at this extension */
     }
   }
 
@@ -314,8 +320,8 @@ async function loadAndTransformModule(
 
         const source = await platformFs.readTextFile(frameworkPath);
         return transformModule(source, frameworkPath, projectDir, adapter, options);
-      } catch {
-        // Continue trying
+      } catch (_) {
+        /* expected: framework file may not exist at this extension */
       }
     }
   }

package/src/src/modules/server/module-server.ts

@@ -18,7 +18,6 @@ import { parseProjectDomain } from "../../server/utils/domain-parser.js";
 import { applySSRImportRewrites } from "./ssr-import-rewriter.js";
 import { addHMRTimestamps } from "../../transforms/esm/import-rewriter.js";
 import { getFrameworkRootFromMeta } from "../../platform/compat/vfs-paths.js";
-import { isDenoCompiled } from "../../platform/compat/runtime.js";
 
 const logger = serverLogger.component("module-server");
 
@@ -84,37 +83,6 @@ export default {};
   "_dnt.polyfills": `export default {};\n`,
 };
 
-/**
- * Validate that all required polyfills are embedded.
- * Call this at startup in compiled mode to fail fast if polyfills are missing.
- *
- * @throws Error if any required polyfill is missing from EMBEDDED_POLYFILLS
- */
-export async function validateEmbeddedPolyfills(): Promise<void> {
-  if (!isDenoCompiled) return; // Only validate in compiled mode
-
-  // Dynamic import to avoid circular dependency at module load time
-  const { getRequiredPolyfillPaths } = await import(
-    "../../transforms/import-rewriter/strategies/node-builtin-strategy.js"
-  );
-
-  const requiredPaths = getRequiredPolyfillPaths();
-  const embeddedPaths = new Set(Object.keys(EMBEDDED_POLYFILLS));
-
-  const missing = requiredPaths.filter((path: string) => !embeddedPaths.has(path));
-
-  if (missing.length > 0) {
-    const errorMsg = `FATAL: Missing embedded polyfills (will cause 404 errors in browser):\n` +
-      missing.map((p: string) => `  - ${p}`).join("\n") +
-      `\n\nAdd these to EMBEDDED_POLYFILLS in src/modules/server/module-server.ts`;
-
-    logger.error(errorMsg);
-    throw new Error(errorMsg);
-  }
-
-  logger.info(`Validated ${embeddedPaths.size} embedded polyfills`);
-}
-
 const DEV_MODULE_PREFIX = /^\/(?:_vf_modules|_veryfront\/modules)\//;
 const SNIPPET_MODULE_PREFIX = /^\/_vf_modules\/_snippets\/([a-f0-9]+)\.js/;
 // Cross-project import patterns: /_vf_modules/_cross/<slug>[@<version>]/@/<path>
@@ -557,8 +525,8 @@ async function findSourceFile(
             });
             return { path: frameworkPath, isFrameworkFile: true };
           }
-        } catch {
-          // continue
+        } catch (_) {
+          /* expected: file may not exist at this extension */
         }
       }
     }
@@ -590,8 +558,8 @@ async function findSourceFile(
         });
         return { path: fullPath, isFrameworkFile: false };
       }
-    } catch {
-      // continue
+    } catch (_) {
+      /* expected: file may not exist at this path */
     }
   }
 
@@ -604,8 +572,8 @@ async function findSourceFile(
         logger.debug("Found file", { basePath, resolvedPath: fullPath });
         return { path: fullPath, isFrameworkFile: false };
       }
-    } catch {
-      // continue
+    } catch (_) {
+      /* expected: file may not exist at this extension */
     }
   }
 
@@ -626,8 +594,8 @@ async function findSourceFile(
           });
           return { path: fullPath, isFrameworkFile: false };
         }
-      } catch {
-        // continue
+      } catch (_) {
+        /* expected: file may not exist after stripping prefix */
       }
     }
   }
@@ -643,8 +611,8 @@ async function findSourceFile(
         });
         return { path: fullPath, isFrameworkFile: false };
       }
-    } catch {
-      // continue
+    } catch (_) {
+      /* expected: index file may not exist at this extension */
     }
   }
 
@@ -662,8 +630,8 @@ async function findSourceFile(
           });
           return { path: fullPath, isFrameworkFile: false };
         }
-      } catch {
-        // continue
+      } catch (_) {
+        /* expected: file may not exist in common directory */
       }
     }
   }

package/src/src/modules/server/ssr-import-rewriter.ts

@@ -5,7 +5,7 @@ import {
 import { isDeno, isNode } from "../../platform/compat/runtime.js";
 import { getLocalReactPaths } from "../../platform/compat/react-paths.js";
 
-export interface SSRRewriteOptions {
+interface SSRRewriteOptions {
   /** Project slug for multi-project routing */
   projectSlug?: string | null;
   /** Branch name for branch-aware routing */

package/src/src/modules/server/websocket-handler.ts

@@ -123,7 +123,7 @@ export async function closeAllConnections(
   // Alternate between microtasks and macrotasks to ensure all I/O completes.
   for (let i = 0; i < 10; i++) {
     await Promise.resolve();
-    await new Promise((resolve) => dntShim.setTimeout(resolve, 50));
+    await new Promise((resolve) => dntShim.setTimeout(resolve, 50)); // no cleanup needed: one-shot
   }
 
   for (const client of clients) {

package/src/src/oauth/providers/base.ts

@@ -10,6 +10,13 @@ import type {
   TokenStore,
 } from "../types.js";
 import { getEnv } from "../../platform/compat/process.js";
+import { INVALID_ARGUMENT, TOKEN_STORAGE_ERROR } from "../../errors/index.js";
+
+/** Buffer before token expiry to trigger proactive refresh (5 minutes). */
+const TOKEN_REFRESH_BUFFER_MS = 300_000;
+
+/** Multiplier to convert `expires_in` (seconds) to milliseconds. */
+const SECONDS_TO_MS = 1_000;
 
 export type EnvReader = (key: string) => string | undefined;
 
@@ -59,7 +66,9 @@ export class OAuthProvider {
     options: AuthorizationUrlOptions & { defaultScopes?: string[] } = {},
   ): Promise<{ url: string; state: OAuthState }> {
     const clientId = this.getClientId();
-    if (!clientId) throw new Error(`${this.config.clientIdEnvVar} not configured`);
+    if (!clientId) {
+      throw INVALID_ARGUMENT.create({ detail: `${this.config.clientIdEnvVar} not configured` });
+    }
 
     const state = options.state ?? generateRandomString(32);
     const scopes = options.scopes ?? options.defaultScopes ?? [];
@@ -116,12 +125,21 @@ export class OAuthProvider {
   ): OAuthTokens {
     const mapping = this.config.tokenResponseMapping ?? {};
 
-    const accessToken = data[mapping.accessToken ?? "access_token"] as string;
-    const refreshToken = (data[mapping.refreshToken ?? "refresh_token"] as string | undefined) ??
+    const str = (key: string): string => {
+      const v = data[key];
+      return typeof v === "string" ? v : "";
+    };
+    const optStr = (key: string): string | undefined => {
+      const v = data[key];
+      return typeof v === "string" ? v : undefined;
+    };
+
+    const accessToken = str(mapping.accessToken ?? "access_token");
+    const refreshToken = optStr(mapping.refreshToken ?? "refresh_token") ??
       fallbackRefreshToken;
-    const tokenType = data[mapping.tokenType ?? "token_type"] as string;
-    const scope = data[mapping.scope ?? "scope"] as string;
-    const idToken = data.id_token as string | undefined;
+    const tokenType = str(mapping.tokenType ?? "token_type");
+    const scope = str(mapping.scope ?? "scope");
+    const idToken = optStr("id_token");
 
     const tokens: OAuthTokens = {
       accessToken,
@@ -131,8 +149,13 @@ export class OAuthProvider {
       idToken,
     };
 
-    const expiresIn = data[mapping.expiresIn ?? "expires_in"] as number | undefined;
-    if (expiresIn) tokens.expiresAt = Date.now() + expiresIn * 1000;
+    const rawExpiresIn = data[mapping.expiresIn ?? "expires_in"];
+    const expiresIn = typeof rawExpiresIn === "number"
+      ? rawExpiresIn
+      : typeof rawExpiresIn === "string"
+      ? Number(rawExpiresIn) || undefined
+      : undefined;
+    if (expiresIn) tokens.expiresAt = Date.now() + expiresIn * SECONDS_TO_MS;
 
     return tokens;
   }
@@ -174,8 +197,9 @@ export class OAuthProvider {
       if (!response.ok) {
         return {
           success: false,
-          error: (data.error as string) || errorFallback,
-          errorDescription: (data.error_description as string) ||
+          error: (typeof data.error === "string" ? data.error : "") || errorFallback,
+          errorDescription:
+            (typeof data.error_description === "string" ? data.error_description : "") ||
             (errorDescriptionFallback ? errorDescriptionFallback(response.status) : undefined),
         };
       }
@@ -257,7 +281,8 @@ export class OAuthProvider {
       });
 
       return response.ok;
-    } catch {
+    } catch (_) {
+      // expected: network failure during token revocation
       return false;
     }
   }
@@ -294,7 +319,7 @@ export class OAuthService extends OAuthProvider {
     const tokens = await this.tokenStore?.getTokens(this.serviceId);
     if (!tokens) return null;
 
-    const isExpired = tokens.expiresAt && Date.now() > tokens.expiresAt - 300000;
+    const isExpired = tokens.expiresAt && Date.now() > tokens.expiresAt - TOKEN_REFRESH_BUFFER_MS;
     if (!isExpired) return tokens.accessToken;
 
     if (!tokens.refreshToken) return null;
@@ -302,13 +327,20 @@ export class OAuthService extends OAuthProvider {
     const result = await this.refreshTokens(tokens.refreshToken);
     if (!result.success || !result.tokens) return null;
 
-    await this.tokenStore!.setTokens(this.serviceId, result.tokens);
+    if (!this.tokenStore) {
+      throw new Error("TokenStore not configured");
+    }
+    await this.tokenStore.setTokens(this.serviceId, result.tokens);
     return result.tokens.accessToken;
   }
 
   async fetch<T>(endpoint: string, options: dntShim.RequestInit = {}): Promise<T> {
     const token = await this.getAccessToken();
-    if (!token) throw new Error(`Not authenticated with ${this.serviceConfig.displayName}`);
+    if (!token) {
+      throw TOKEN_STORAGE_ERROR.create({
+        detail: `Not authenticated with ${this.serviceConfig.displayName}`,
+      });
+    }
 
     const url = endpoint.startsWith("http") ? endpoint : `${this.apiBaseUrl}${endpoint}`;
 
@@ -323,7 +355,9 @@ export class OAuthService extends OAuthProvider {
 
     if (!response.ok) {
       const error = await response.text();
-      throw new Error(`${this.serviceConfig.displayName} API error: ${response.status} ${error}`);
+      throw INVALID_ARGUMENT.create({
+        detail: `${this.serviceConfig.displayName} API error: ${response.status} ${error}`,
+      });
     }
 
     return response.json();

package/src/src/oauth/token-store/memory.ts

@@ -1,12 +1,12 @@
 import type { OAuthState, OAuthTokens, TokenStore } from "../types.js";
 
+/** How long an OAuth state nonce remains valid (10 minutes). */
+const STATE_EXPIRATION_MS = 10 * 60 * 1_000;
+
 export class MemoryTokenStore implements TokenStore {
   private tokens = new Map<string, OAuthTokens>();
   private states = new Map<string, OAuthState>();
 
-  /** State expiration time in ms (10 minutes) */
-  private stateExpirationMs = 10 * 60 * 1000;
-
   async getTokens(serviceId: string): Promise<OAuthTokens | null> {
     return this.tokens.get(serviceId) ?? null;
   }
@@ -23,7 +23,7 @@ export class MemoryTokenStore implements TokenStore {
     const oauthState = this.states.get(state);
     if (!oauthState) return null;
 
-    if (Date.now() - oauthState.createdAt > this.stateExpirationMs) {
+    if (Date.now() - oauthState.createdAt > STATE_EXPIRATION_MS) {
       this.states.delete(state);
       return null;
     }
@@ -43,7 +43,7 @@ export class MemoryTokenStore implements TokenStore {
   private cleanupExpiredStates(): void {
     const now = Date.now();
     for (const [state, oauthState] of this.states) {
-      if (now - oauthState.createdAt > this.stateExpirationMs) {
+      if (now - oauthState.createdAt > STATE_EXPIRATION_MS) {
         this.states.delete(state);
       }
     }

package/src/src/observability/auto-instrument/http-instrumentation.ts

@@ -93,8 +93,8 @@ export function createInstrumentedFetch(
       fetchAttrs["http.target"] = parsed.pathname;
       fetchAttrs["http.host"] = parsed.host;
       fetchAttrs["http.scheme"] = parsed.protocol.replace(":", "");
-    } catch {
-      // Relative URLs are fine; leave defaults
+    } catch (_) {
+      /* expected: relative URLs cannot be parsed, leave defaults */
     }
 
     try {

package/src/src/observability/auto-instrument/types.ts

@@ -1,8 +1,8 @@
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 
-export type AttributeValue = string | number | boolean;
+type AttributeValue = string | number | boolean;
 
-export type SpanAttributes = Record<string, AttributeValue>;
+type SpanAttributes = Record<string, AttributeValue>;
 export type ErrorAttributes = Record<string, AttributeValue>;
 export type HttpAttributes = Record<string, AttributeValue>;
 
@@ -29,7 +29,7 @@ export interface AutoInstrumentConfig {
   captureErrors?: boolean;
 }
 
-export interface InstrumentationContext {
+interface InstrumentationContext {
   config: AutoInstrumentConfig;
   adapter?: RuntimeAdapter;
   initialized: boolean;

package/src/src/observability/error-collector.ts

@@ -6,6 +6,7 @@
  **************************/
 
 import type { ErrorCategory } from "../errors/types.js";
+import { INVALID_ARGUMENT } from "../errors/index.js";
 
 export type ErrorType = "compile" | "runtime" | "bundle" | "hmr" | "module";
 
@@ -75,9 +76,10 @@ export class ErrorCollector {
   add(error: Omit<DevError, "id" | "timestamp">): DevError {
     const expectedCategory = ERROR_TYPE_TO_CATEGORY[error.type];
     if (error.category !== expectedCategory) {
-      throw new Error(
-        `ErrorCollector.add() received mismatched type/category: ${error.type} must use ${expectedCategory}, got ${error.category}`,
-      );
+      throw INVALID_ARGUMENT.create({
+        detail:
+          `ErrorCollector.add() received mismatched type/category: ${error.type} must use ${expectedCategory}, got ${error.category}`,
+      });
     }
 
     const fullError: DevError = {
@@ -96,8 +98,8 @@ export class ErrorCollector {
     for (const subscriber of this.subscribers) {
       try {
         subscriber(fullError);
-      } catch {
-        // Ignore subscriber errors
+      } catch (_) {
+        /* expected: subscriber errors must not break error collection */
       }
     }
 

package/src/src/observability/log-buffer.ts

@@ -49,8 +49,8 @@ export class LogBuffer {
     for (const subscriber of this.subscribers) {
       try {
         subscriber(fullEntry);
-      } catch {
-        // Ignore subscriber errors
+      } catch (_) {
+        /* expected: subscriber errors must not break log buffering */
       }
     }
 
@@ -187,7 +187,8 @@ export function interceptConsole(buffer: LogBuffer, source = "console"): () => v
 
         try {
           return JSON.stringify(a);
-        } catch {
+        } catch (_) {
+          /* expected: circular references or non-serializable values */
           return String(a);
         }
       })

package/src/src/observability/metrics/config.ts

@@ -75,8 +75,8 @@ export function loadConfig(
       metricsEndpoint: metricsConfig.metricsEndpoint,
       exporter: metricsConfig.exporter,
     });
-  } catch {
-    // getEnv access may fail, silently continue
+  } catch (_) {
+    /* expected: getEnv access may fail in some runtimes */
   }
 
   return finalConfig;
@@ -89,7 +89,8 @@ export function getMemoryUsage(): {
 } | null {
   try {
     return platformMemoryUsage();
-  } catch {
+  } catch (_) {
+    /* expected: memory usage API may be unavailable on some platforms */
     return null;
   }
 }

package/src/src/observability/simple-metrics/metrics-recorder.ts

@@ -11,11 +11,14 @@ import type { RSCRequestKind } from "./types.js";
 function recordObservability(
   fn: (obs: Awaited<ReturnType<typeof getObservabilityMetrics>>) => void,
 ): void {
-  void getObservabilityMetrics()
-    .then(fn)
-    .catch(() => {
+  void (async () => {
+    try {
+      const obs = await getObservabilityMetrics();
+      fn(obs);
+    } catch {
       /* metrics recording failure - non-critical */
-    });
+    }
+  })();
 }
 
 /**