veryfront 0.1.49 → 0.1.50

package/src/src/routing/api/route-discovery.ts

@@ -1,6 +1,6 @@
 import { relative } from "../../platform/compat/path/index.js";
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
-import type { DynamicRouter } from "./api-route-matcher.js";
+import type { ApiRouteMatcher } from "./api-route-matcher.js";
 import { discoverFiles } from "../../utils/file-discovery.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 
@@ -9,7 +9,7 @@ const ROUTE_FILE_RE = /^route\.(ts|js|tsx|jsx)$/;
 const PAGE_EXT_RE = /\.(ts|js|tsx|jsx)$/;
 
 export function discoverPagesRoutes(
-  router: DynamicRouter,
+  router: ApiRouteMatcher,
   dir: string,
   prefix: string,
   adapter: RuntimeAdapter,
@@ -30,7 +30,7 @@ export function discoverPagesRoutes(
 }
 
 export function discoverAppRoutes(
-  router: DynamicRouter,
+  router: ApiRouteMatcher,
   dir: string,
   prefix: string,
   adapter: RuntimeAdapter,

package/src/src/routing/index.ts

@@ -7,10 +7,10 @@
 
 export type { Route, RouteMatch } from "./matchers/index.js";
 export {
-  DynamicRouter,
   getSpecificityScore,
   matchRoute,
   normalizePath,
+  PageRouteMatcher,
   parseRoute,
 } from "./matchers/index.js";
 

package/src/src/routing/matchers/index.ts

@@ -5,7 +5,7 @@
  */
 
 export type { Route, RouteMatch } from "./types.js";
-export { DynamicRouter, PageRouteMatcher } from "./pattern-route-matcher.js";
+export { PageRouteMatcher } from "./pattern-route-matcher.js";
 export { getSpecificityScore, parseRoute } from "./route-parser.js";
 export { matchRoute } from "./route-matcher.js";
 export { normalizePath } from "../../utils/index.js";

package/src/src/routing/matchers/pattern-route-matcher.ts

@@ -44,6 +44,3 @@ export class PageRouteMatcher {
     return [...this.routes];
   }
 }
-
-/** @deprecated Use PageRouteMatcher instead - kept for backwards compatibility */
-export { PageRouteMatcher as DynamicRouter };

package/src/src/sandbox/sandbox.ts

@@ -6,10 +6,13 @@
  *
  * @module
  */
-
-/** Options for creating a sandbox session. */
 import * as dntShim from "../../_dnt.shims.js";
 
+
+import { INITIALIZATION_ERROR, REQUEST_ERROR, TIMEOUT_ERROR } from "../errors/index.js";
+import { getHostEnv } from "../platform/compat/process.js";
+
+/** Options for creating a sandbox session. */
 export interface SandboxOptions {
   /** Base URL of the Veryfront API. Defaults to VERYFRONT_API_URL env. */
   apiUrl?: string;
@@ -42,9 +45,7 @@ export class Sandbox {
 
   private static resolveApiUrl(options: SandboxOptions): string {
     return options.apiUrl ||
-      (typeof dntShim.Deno !== "undefined"
-        ? dntShim.Deno.env.get("VERYFRONT_API_URL")
-        : process.env.VERYFRONT_API_URL) ||
+      getHostEnv("VERYFRONT_API_URL") ||
       "https://api.veryfront.com";
   }
 
@@ -61,7 +62,9 @@ export class Sandbox {
     });
 
     if (!res.ok) {
-      throw new Error(`Failed to create sandbox: ${res.status} ${await res.text()}`);
+      throw REQUEST_ERROR.create({
+        detail: `Failed to create sandbox: ${res.status} ${await res.text()}`,
+      });
     }
 
     const { id, endpoint, status } = await res.json();
@@ -83,7 +86,9 @@ export class Sandbox {
     });
 
     if (!res.ok) {
-      throw new Error(`Failed to get sandbox: ${res.status} ${await res.text()}`);
+      throw REQUEST_ERROR.create({
+        detail: `Failed to get sandbox: ${res.status} ${await res.text()}`,
+      });
     }
 
     const { endpoint } = await res.json();
@@ -99,6 +104,7 @@ export class Sandbox {
   ): Promise<void> {
     const start = Date.now();
     while (Date.now() - start < maxWaitMs) {
+      // no cleanup needed: one-shot
       await new Promise((r) => dntShim.setTimeout(r, pollIntervalMs));
 
       const res = await dntShim.fetch(`${apiUrl}/sandbox-sessions/${id}`, {
@@ -109,11 +115,13 @@ export class Sandbox {
         const data = await res.json();
         if (data.status === "running") return;
         if (data.status === "error" || data.status === "deleting") {
-          throw new Error(`Sandbox failed to start: status=${data.status}`);
+          throw INITIALIZATION_ERROR.create({
+            detail: `Sandbox failed to start: status=${data.status}`,
+          });
         }
       }
     }
-    throw new Error("Sandbox did not become ready within timeout");
+    throw TIMEOUT_ERROR.create({ detail: "Sandbox did not become ready within timeout" });
   }
 
   /** Execute a bash command in the sandbox and return buffered result. */
@@ -151,10 +159,13 @@ export class Sandbox {
     });
 
     if (!res.ok) {
-      throw new Error(`Exec failed: ${res.status} ${await res.text()}`);
+      throw REQUEST_ERROR.create({ detail: `Exec failed: ${res.status} ${await res.text()}` });
     }
 
-    const reader = res.body!.getReader();
+    if (!res.body) {
+      throw new Error("Exec response has no body");
+    }
+    const reader = res.body.getReader();
     const decoder = new TextDecoder();
     let buffer = "";
 
@@ -188,7 +199,7 @@ export class Sandbox {
     );
 
     if (!res.ok) {
-      throw new Error(`Read file failed: ${res.status} ${await res.text()}`);
+      throw REQUEST_ERROR.create({ detail: `Read file failed: ${res.status} ${await res.text()}` });
     }
 
     return res.text();
@@ -208,7 +219,9 @@ export class Sandbox {
     });
 
     if (!res.ok) {
-      throw new Error(`Write files failed: ${res.status} ${await res.text()}`);
+      throw REQUEST_ERROR.create({
+        detail: `Write files failed: ${res.status} ${await res.text()}`,
+      });
     }
   }
 

package/src/src/security/client/html-sanitizer.ts

@@ -10,23 +10,10 @@ import * as dntShim from "../../../_dnt.shims.js";
 
 
 import { escapeHtml } from "../../html/html-escape.js";
+import { SECURITY_VIOLATION } from "../../errors/index.js";
 
 export { escapeHtml };
 
-/**
- * Create text node safely (alternative to innerHTML for simple text).
- */
-export function createSafeTextNode(text: string): Text {
-  return document.createTextNode(text);
-}
-
-/**
- * Set text content safely (never interprets HTML).
- */
-export function setSafeTextContent(element: HTMLElement, text: string): void {
-  element.textContent = text;
-}
-
 /**
  * Patterns that RSC should never generate.
  * These indicate potential server compromise or misconfiguration.
@@ -53,7 +40,7 @@ function isDevMode(): boolean {
   return g.__VERYFRONT_DEV__ === true || g.Deno?.env?.get?.("VERYFRONT_ENV") === "development";
 }
 
-export interface ValidateTrustedHtmlOptions {
+interface ValidateTrustedHtmlOptions {
   /** Throw on suspicious patterns even in dev mode */
   strict?: boolean;
   /** Log warnings for suspicious patterns */
@@ -82,7 +69,9 @@ export function validateTrustedHtml(
     if (!pattern.test(html)) continue;
 
     if (warn) console.warn(`[Security] Suspicious ${name} detected in server HTML`);
-    if (strict || !isDevMode()) throw new Error(`Potentially unsafe HTML: ${name} detected`);
+    if (strict || !isDevMode()) {
+      throw SECURITY_VIOLATION.create({ detail: `Potentially unsafe HTML: ${name} detected` });
+    }
   }
 
   return html;

package/src/src/security/csrf/helpers.ts

@@ -80,8 +80,8 @@ export function validateCsrf(
   let cookieToken: string | undefined;
   try {
     cookieToken = parseCookiesFromHeaders(req.headers)[cookieName];
-  } catch {
-    // Malformed cookie (e.g. bad percent-encoding) → treat as missing
+  } catch (_) {
+    /* expected: malformed cookie (e.g. bad percent-encoding) → treat as missing */
     return false;
   }
   if (!cookieToken) return false;
@@ -123,8 +123,8 @@ export function applyCsrfCookie(
   let cookies: Record<string, string>;
   try {
     cookies = parseCookiesFromHeaders(req.headers);
-  } catch {
-    // Malformed cookie header — issue a fresh token
+  } catch (_) {
+    /* expected: malformed cookie header — issue a fresh token */
     cookies = {};
   }
   if (cookies[cookieName]) return;

package/src/src/security/http/auth.ts

@@ -15,8 +15,8 @@ function encodeBase64(value: string): string {
   if (typeof globalThis.btoa === "function") {
     try {
       return globalThis.btoa(value);
-    } catch {
-      // Fallback for non-Latin1 strings
+    } catch (_) {
+      /* expected: non-Latin1 string — fall back to TextEncoder */
       const bytes = new TextEncoder().encode(value);
       let binary = "";
       for (const byte of bytes) binary += String.fromCharCode(byte);
@@ -37,7 +37,7 @@ function encodeBase64(value: string): string {
 }
 
 function sanitizeRealm(realm: unknown): string {
-  // deno-lint-ignore no-control-regex
+  // deno-lint-ignore no-control-regex -- intentional: strips control chars and special chars from HTTP realm header
   return String(realm).replace(/[\x00-\x1f\x7f"\\]/g, "");
 }
 

package/src/src/security/http/base-handler.ts

@@ -124,8 +124,8 @@ export abstract class BaseHandler implements Handler {
     if (typeof fsWrapper.setRequestBranch === "function") {
       try {
         fsWrapper.setRequestBranch(ctx.parsedDomain?.branch ?? null);
-      } catch {
-        // Ignore - multi-project mode uses runWithContext for branch context
+      } catch (_) {
+        /* expected: multi-project mode uses runWithContext for branch context */
       }
     }
 

package/src/src/security/http/middleware/config-loader.ts

@@ -51,7 +51,8 @@ export function loadSecurityConfig(
         }
 
         return securityConfig;
-      } catch {
+      } catch (error) {
+        serverLogger.debug("Failed to load security config", { error });
         return null;
       }
     },

package/src/src/security/http/response/fluent-methods.ts

@@ -36,12 +36,16 @@ export function withCORS<T extends FluentMethodsContext>(
 }
 
 /** Apply CORS headers asynchronously */
-export function withCORSAsync<T extends FluentMethodsContext>(this: T, req: dntShim.Request): Promise<T> {
-  return applyCORSHeaders({
+export async function withCORSAsync<T extends FluentMethodsContext>(
+  this: T,
+  req: dntShim.Request,
+): Promise<T> {
+  await applyCORSHeaders({
     request: req,
     headers: this.headers,
     config: this.securityConfig?.cors,
-  }).then((): T => this);
+  });
+  return this;
 }
 
 /** Apply security headers (CSP, COOP, CORP, COEP) and optionally set CSRF cookie */

package/src/src/security/http/response/security-handler.ts

@@ -3,8 +3,14 @@ import type { RuntimeAdapter } from "../../../platform/adapters/base.js";
 import { recordSecurityHeaders } from "../../../observability/index.js";
 import type { SecurityConfig } from "./types.js";
 
+/** HSTS max-age default: 1 year in seconds */
+const HSTS_MAX_AGE_SECONDS = 31_536_000;
+
+/** Number of random bytes used to generate CSP nonces */
+const NONCE_BYTE_LENGTH = 16;
+
 export function generateNonce(): string {
-  const array = new Uint8Array(16);
+  const array = new Uint8Array(NONCE_BYTE_LENGTH);
   dntShim.crypto.getRandomValues(array);
   return btoa(String.fromCharCode(...array));
 }
@@ -83,7 +89,7 @@ export function applySecurityHeaders(
   if (csp) headers.set("Content-Security-Policy", csp);
 
   if (!isDev) {
-    const hstsMaxAge = config?.hsts?.maxAge ?? 31536000;
+    const hstsMaxAge = config?.hsts?.maxAge ?? HSTS_MAX_AGE_SECONDS;
     const hstsIncludeSubDomains = config?.hsts?.includeSubDomains ?? true;
     const hstsPreload = config?.hsts?.preload ?? false;
 

package/src/src/security/path-validation/canonical.ts

@@ -22,7 +22,8 @@ export async function getCanonicalPath(
   try {
     const stat = await adapter.fs.stat(path);
     return { path: resolvedPath, isSymlink: stat.isSymlink };
-  } catch {
+  } catch (_) {
+    /* expected: file may not exist when checking symlink status */
     return { path: resolvedPath, isSymlink: false };
   }
 }

package/src/src/security/path-validation/index.ts

@@ -108,7 +108,8 @@ export async function validatePath(
   if (checkExists && adapter) {
     try {
       await adapter.fs.stat(canonicalPath);
-    } catch {
+    } catch (_) {
+      /* expected: file does not exist at canonicalPath */
       return {
         valid: false,
         error: `File not found: ${canonicalPath}`,

package/src/src/security/path-validation/rules.ts

@@ -16,8 +16,7 @@ import { PathValidationError, type ValidationResult } from "./types.js";
  * Validate path for security issues (basic checks)
  */
 export function validatePathBasics(path: string): ValidationResult {
-  // deno-lint-ignore no-control-regex
-  if (path.includes("\0") || /\x00/.test(path)) {
+  if (path.includes("\0")) {
     return {
       valid: false,
       error: "Path contains null bytes",

package/src/src/security/secure-fs.ts

@@ -45,7 +45,7 @@ export interface SecurityEvent {
   timestamp: Date;
 }
 
-export interface ContextOptions {
+interface ContextOptions {
   allowedImportDirs?: string[];
 }
 
@@ -275,7 +275,7 @@ export class SecureFs {
     }
 
     const pathArg: string | string[] = validatedPaths.length === 1
-      ? validatedPaths[0]!
+      ? validatedPaths[0] ?? ""
       : validatedPaths;
 
     return this.config.adapter.fs.watch(pathArg, options);

package/src/src/server/bootstrap.ts

@@ -7,6 +7,7 @@ import {
   refreshEnvironmentConfig,
 } from "../config/environment-config.js";
 import { getErrorMessage } from "../errors/veryfront-error.js";
+import { INVALID_ARGUMENT } from "../errors/index.js";
 import { enhanceAdapterWithFS } from "../platform/adapters/fs/integration.js";
 import { isExtendedFSAdapter } from "../platform/adapters/fs/wrapper.js";
 import { getEnv } from "../platform/compat/process.js";
@@ -264,9 +265,9 @@ function validateProductionEnvironment(_adapter: RuntimeAdapter): void {
         "[Bootstrap:Prod] CRITICAL: NODE_ENV is not set in proxy mode. " +
           "Set NODE_ENV=production in your pod configuration.",
       );
-      throw new Error(
-        "NODE_ENV must be set to 'production' when running in proxy mode (PROXY_MODE=1)",
-      );
+      throw INVALID_ARGUMENT.create({
+        detail: "NODE_ENV must be set to 'production' when running in proxy mode (PROXY_MODE=1)",
+      });
     }
 
     if (nodeEnv !== "production") {

package/src/src/server/build-app-route-renderer.ts

@@ -16,7 +16,8 @@ async function fileExists(adapter: RuntimeAdapter, filePath: string): Promise<bo
   try {
     const st = await adapter.fs.stat(filePath);
     return st.isFile;
-  } catch {
+  } catch (_) {
+    /* expected: file may not exist */
     return false;
   }
 }
@@ -137,7 +138,7 @@ export async function renderAppRouteToHTML(args: {
     }
 
     if (document.readyState === 'loading') {
-      document.addEventListener('DOMContentLoaded', initializeApp);
+      document.addEventListener('DOMContentLoaded', initializeApp, { once: true });
     } else {
       initializeApp();
     }

package/src/src/server/build-routes.ts

@@ -117,8 +117,8 @@ async function walkAppSSG(
         segmentDirs: [...segDirs],
       });
       break;
-    } catch {
-      // continue
+    } catch (_) {
+      /* expected: file may not exist for this candidate */
     }
   }
 

package/src/src/server/build-service-worker.ts

@@ -134,7 +134,8 @@ async function handleRequest(request, strategy) {
         const response = await fetch(request);
         if (response.ok) cache.put(request, response.clone());
         return response;
-      } catch {
+      } catch (_) {
+        // expected: network unavailable, fall back to cache
         return cache.match(request);
       }
 

package/src/src/server/context/cache-invalidation.ts

@@ -10,13 +10,16 @@ import {
 } from "../../modules/react-loader/ssr-module-loader/index.js";
 import { cacheRegistry } from "../../cache/index.js";
 import { clearRendererCacheForProject } from "../../rendering/renderer.js";
-import { clearRouterDetectionCache } from "../../rendering/router-detection.js";
+import {
+  clearRouterDetectionCache,
+  clearRouterDetectionCacheForProject,
+} from "../../rendering/router-detection.js";
 import { clearSnippetCacheForProject } from "../../rendering/snippet-renderer.js";
 import { resetApiHandlerForProject } from "../handlers/request/api/pages-api-handler.js";
 
 const logger = serverLogger.component("cache-invalidation");
 
-export interface InvalidationOptions {
+interface InvalidationOptions {
   /** Environment scope: only invalidate caches for this environment */
   environment?: "production" | "preview";
   /** Branch ID for preview mode scoping */
@@ -72,8 +75,12 @@ export async function invalidateProjectCaches(
     clearSSRModuleCache();
   }
 
-  logger.debug("Clearing router detection cache", { projectSlug });
-  clearRouterDetectionCache();
+  logger.debug("Clearing router detection cache", { projectSlug, projectId });
+  if (projectId) {
+    clearRouterDetectionCacheForProject(projectId);
+  } else {
+    clearRouterDetectionCache();
+  }
 
   if (!hasRealProjectSlug) {
     logger.error(

package/src/src/server/context/enriched-context.ts

@@ -2,11 +2,12 @@ import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import type { VeryfrontConfig } from "../../config/index.js";
 import type { HandlerContext, ParsedDomain } from "../../types/index.js";
 import { buildRenderCachePrefix } from "../../cache/keys.js";
+import { INVALID_ARGUMENT } from "../../errors/index.js";
 
 export type Environment = "preview" | "production";
-export type RenderMode = "development" | "production";
+type RenderMode = "development" | "production";
 
-export interface ProjectData {
+interface ProjectData {
   id: string;
   slug: string;
   name?: string;
@@ -43,7 +44,7 @@ export interface EnrichedContext {
   createdAt: number;
 }
 
-export interface BuildEnrichedContextOptions {
+interface BuildEnrichedContextOptions {
   projectId: string;
   projectSlug: string;
   projectDir: string;
@@ -67,7 +68,7 @@ export interface BuildEnrichedContextOptions {
 
 export function buildEnrichedContext(options: BuildEnrichedContextOptions): EnrichedContext {
   if (!options.contentSourceId) {
-    throw new Error(`Missing contentSourceId for ${options.projectSlug}`);
+    throw INVALID_ARGUMENT.create({ detail: `Missing contentSourceId for ${options.projectSlug}` });
   }
 
   const releaseKey = options.environment === "production"

package/src/src/server/dev-server/error-overlay/html-template.ts

@@ -1,6 +1,15 @@
 import { type ErrorInfo, formatErrorType } from "./error-formatter.js";
 import { escapeHtml } from "../../../html/html-escape.js";
 
+/** Base delay multiplied by attempt count for WebSocket reconnection */
+const WS_RECONNECT_BASE_DELAY_MS = 1_000;
+
+/** Maximum delay between WebSocket reconnection attempts */
+const WS_RECONNECT_MAX_DELAY_MS = 5_000;
+
+/** Maximum number of WebSocket reconnection attempts before giving up */
+const WS_MAX_RECONNECT_ATTEMPTS = 10;
+
 export function generateRuntimeScript(): string {
   return `
     // Veryfront Error Overlay Runtime
@@ -279,7 +288,7 @@ export function generateErrorHTML(errorInfo: ErrorInfo, suggestion?: string): st
       const wsUrl = protocol + '//' + window.location.host + '/_ws';
       let ws = null;
       let reconnectAttempts = 0;
-      const maxReconnectAttempts = 10;
+      const maxReconnectAttempts = ${WS_MAX_RECONNECT_ATTEMPTS};
 
       function connect() {
         if (reconnectAttempts >= maxReconnectAttempts) return;
@@ -295,7 +304,7 @@ export function generateErrorHTML(errorInfo: ErrorInfo, suggestion?: string): st
         };
         ws.onclose = () => {
           reconnectAttempts++;
-          setTimeout(connect, Math.min(1000 * reconnectAttempts, 5000));
+          setTimeout(connect, Math.min(${WS_RECONNECT_BASE_DELAY_MS} * reconnectAttempts, ${WS_RECONNECT_MAX_DELAY_MS}));
         };
       }
       connect();

package/src/src/server/dev-server/file-watch-setup.ts

@@ -32,6 +32,13 @@ const IGNORED_PATH_PATTERNS = [
   ".veryfront\\",
 ];
 
+/**
+ * Project-root directory names that contain runtime data (not source code)
+ * and should be excluded from HMR. Matched by first path segment relative
+ * to projectDir to avoid false positives (e.g. "src/data/" is fine).
+ */
+const IGNORED_RUNTIME_DIRS = new Set(["data"]);
+
 /**
  * Check if a path should be ignored for HMR purposes.
  */
@@ -126,8 +133,10 @@ export class FileWatchSetup {
         if (signal.aborted) break;
 
         try {
-          // Filter out paths that shouldn't trigger HMR (cache, node_modules, etc.)
-          const relevantPaths = paths.filter((p) => !shouldIgnorePath(p));
+          // Filter out paths that shouldn't trigger HMR (cache, node_modules, runtime data, etc.)
+          const relevantPaths = paths.filter((p) =>
+            !shouldIgnorePath(p) && !this.isRuntimeDataPath(p)
+          );
           if (relevantPaths.length === 0) continue;
 
           if (this.optimizedWatcher) {
@@ -175,6 +184,16 @@ export class FileWatchSetup {
     return this.aiDirs.has(firstSegment);
   }
 
+  /**
+   * Check if a path is inside a runtime data directory (data/, etc.)
+   * that contains generated content (embedding indices) rather than source code.
+   */
+  private isRuntimeDataPath(fullPath: string): boolean {
+    const rel = relative(this.projectDir, fullPath);
+    const firstSegment = rel.split(sep)[0] ?? "";
+    return IGNORED_RUNTIME_DIRS.has(firstSegment);
+  }
+
   /** FNV-1a hash for fast content comparison */
   private hashContent(content: string): number {
     let h = 2166136261;
@@ -195,8 +214,8 @@ export class FileWatchSetup {
         if (this.contentHashes.get(path) === hash) continue;
         this.contentHashes.set(path, hash);
         changed.push(path);
-      } catch {
-        // File deleted or unreadable — treat as changed
+      } catch (_) {
+        /* expected: file may be deleted or unreadable — treat as changed */
         this.contentHashes.delete(path);
         changed.push(path);
       }

package/src/src/server/dev-server/middleware.ts

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { MiddlewarePipeline } from "../../middleware/core/pipeline/index.js";
+import { COMPILATION_ERROR } from "../../errors/index.js";
 import { isVirtualFilesystem } from "../../platform/adapters/fs/wrapper.js";
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import { createFileSystem } from "../../platform/compat/fs.js";
@@ -23,7 +24,7 @@ const baseLogger = getBaseLogger("SERVER");
 
 const logger = baseLogger.component("middleware");
 
-export function createRequestLoggerMiddleware(): MiddlewareFunction {
+function createRequestLoggerMiddleware(): MiddlewareFunction {
   return async (c, next) => {
     const start = performance.now();
     const { pathname } = new URL(c.req.url);
@@ -66,8 +67,8 @@ export function createRequestLoggerMiddleware(): MiddlewareFunction {
       try {
         await enrichSpanWithRequestInfo(method, pathname, requestId);
         reqLogger.debug(`${method} ${pathname} started`);
-      } catch {
-        /* dev only */
+      } catch (_) {
+        /* expected: OpenTelemetry may not be available in dev */
       }
 
       let response: dntShim.Response | undefined;
@@ -90,8 +91,8 @@ export function createRequestLoggerMiddleware(): MiddlewareFunction {
           status: response?.status ?? 0,
           durationMs,
         });
-      } catch {
-        /* dev only */
+      } catch (_) {
+        /* expected: logging may fail in edge cases */
       }
 
       return response;
@@ -154,7 +155,9 @@ async function loadMiddlewareFromVirtualFS(
   });
 
   const firstError = result.errors?.[0]?.text;
-  if (firstError) throw new Error(`Failed to transpile middleware: ${firstError}`);
+  if (firstError) {
+    throw COMPILATION_ERROR.create({ detail: `Failed to transpile middleware: ${firstError}` });
+  }
 
   const js = result.outputFiles?.[0]?.text ?? "export default []";
 
@@ -235,7 +238,7 @@ async function enrichSpanWithRequestInfo(
     span.setAttribute("http.route", pathname);
     span.setAttribute("veryfront.request_id", requestId);
     span.updateName(`${method} ${pathname}`);
-  } catch {
-    /* otel optional */
+  } catch (_) {
+    /* expected: OpenTelemetry is optional */
   }
 }