veryfront 0.1.49 → 0.1.51

package/src/src/server/index.ts

@@ -38,6 +38,9 @@ import {
   serverLogger,
 } from "../utils/index.js";
 
+/** Default server port when no port is specified */
+const DEFAULT_SERVER_PORT = 3_000;
+
 export { DevServer, startDevServer, startProductionServer };
 export type {
   DevServerOptions,
@@ -51,8 +54,6 @@ import { ReloadNotifier } from "./reload-notifier.js";
 export { ReloadNotifier };
 export type { BuildOptions, BuildStats } from "./build-types.js";
 
-const serverApiLog = serverLogger.component("server-api");
-
 /** Shared options for both development and production server modes. */
 interface BaseServerOptions {
   /** Project root directory. Defaults to process.cwd(). */
@@ -74,8 +75,6 @@ interface BaseServerOptions {
 
 export interface StartDevModeOptions extends BaseServerOptions {
   mode?: "development";
-  /** @deprecated Ignored: HMR now uses /_ws on the main server port. */
-  hmrPort?: number;
   moduleServerPort?: number;
   enableHMR?: boolean;
   enableFastRefresh?: boolean;
@@ -187,7 +186,7 @@ export async function createHandler(
   }
 
   // Development mode (default) — includes file watching, HMR, cache invalidation
-  const port = options.port ?? 3000;
+  const port = options.port ?? DEFAULT_SERVER_PORT;
   const devServer = new DevServer({
     port,
     projectDir,
@@ -214,7 +213,7 @@ export async function createHandler(
         if (!wsServer) wsServer = new WebSocketServer({ noServer: true });
 
         const key = request.headers["sec-websocket-key"];
-        const requestId = typeof key === "string" ? key : Array.isArray(key) ? key[0]! : "";
+        const requestId = typeof key === "string" ? key : Array.isArray(key) ? key[0] ?? "" : "";
 
         // Run request through handler pipeline so HMRHandler registers the WebSocket client
         const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
@@ -230,9 +229,10 @@ export async function createHandler(
           "../platform/adapters/runtime/node/http-server.js"
         );
 
-        wsServer.handleUpgrade(request, socket, head, (ws: import("ws").WebSocket) => {
+        const server = wsServer;
+        server.handleUpgrade(request, socket, head, (ws: import("ws").WebSocket) => {
           resolveWebSocketUpgrade(requestId, ws);
-          wsServer!.emit("connection", ws, request);
+          server.emit("connection", ws, request);
         });
       } catch (_error) {
         socket.destroy();
@@ -264,8 +264,8 @@ export async function createHandler(
       if (messageSize > HMR_MAX_MESSAGE_SIZE_BYTES) {
         try {
           ws.close(HMR_CLOSE_MESSAGE_TOO_LARGE, "Message too large");
-        } catch {
-          // Ignore close errors
+        } catch (_) {
+          /* expected: socket may already be closed */
         }
         return;
       }
@@ -273,8 +273,8 @@ export async function createHandler(
       if (!hmrRateLimiter.check(ws)) {
         try {
           ws.close(HMR_CLOSE_RATE_LIMIT, "Rate limit exceeded");
-        } catch {
-          // Ignore close errors
+        } catch (_) {
+          /* expected: socket may already be closed */
         }
         return;
       }
@@ -289,16 +289,16 @@ export async function createHandler(
         if (data?.type === "ping") {
           ws.send(JSON.stringify({ type: "pong" }));
         }
-      } catch {
-        // Ignore parse errors from client
+      } catch (_) {
+        /* expected: ignore malformed JSON from client */
       }
     });
 
     const sendConnected = () => {
       try {
         ws.send(JSON.stringify({ type: "connected" }));
-      } catch {
-        // Socket may have closed immediately
+      } catch (_) {
+        /* expected: socket may have closed immediately */
       }
     };
 
@@ -354,7 +354,8 @@ export function toNodeHandler(
         }
       }
       res.end();
-    } catch {
+    } catch (error) {
+      serverLogger.debug("toNodeHandler request failed", { error });
       res.writeHead(500);
       res.end("Internal Server Error");
     }
@@ -371,7 +372,7 @@ export async function startServer(
   options: StartServerOptions = {},
 ): Promise<VeryfrontServer> {
   const projectDir = options.projectDir ?? process.cwd();
-  const port = options.port ?? 3000;
+  const port = options.port ?? DEFAULT_SERVER_PORT;
   const bindAddress = options.bindAddress ?? "localhost";
 
   if (options?.mode === "production") {
@@ -397,13 +398,6 @@ export async function startServer(
   }
 
   // Development mode (default)
-  if ("hmrPort" in options && options.hmrPort !== undefined) {
-    serverApiLog.warn(
-      "`hmrPort` is deprecated and ignored. HMR now uses /_ws on the main server port.",
-      { hmrPort: options.hmrPort, serverPort: port },
-    );
-  }
-
   const devServer = await startDevServer({
     port,
     projectDir,
@@ -429,5 +423,5 @@ export async function startServer(
 }
 
 // Note: Wildcard re-exports removed to prevent circular dependency risks.
-// Import from "#veryfront/routing" for Route, RouteMatch, DynamicRouter, etc.
+// Import from "#veryfront/routing" for Route, RouteMatch, PageRouteMatcher, etc.
 // Import from "#veryfront/observability" for tracing and metrics utilities.

package/src/src/server/production-server.ts

@@ -29,6 +29,16 @@ import type { FileSystemAdapter } from "../platform/adapters/base.js";
 const serverLog = logger.component("server");
 const globalLog = logger.component("global");
 
+/** Default interval for periodic memory usage snapshots */
+const DEFAULT_MEMORY_MONITORING_INTERVAL_MS = 30_000;
+
+/** Default time to wait for in-flight requests to drain during shutdown.
+ *  K8s default terminationGracePeriodSeconds is 30s, so 25s leaves headroom. */
+const DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS = 25_000;
+
+/** Default port when PORT / VERYFRONT_PORT env vars are not set */
+const DEFAULT_SERVER_PORT = 3_000;
+
 /** Configuration for AI primitives discovery during server startup */
 export interface DiscoveryOptions {
   baseDir: string;
@@ -186,10 +196,11 @@ export function startProductionServer(
         resolveListenReady = resolve;
       });
 
-      const ready = Promise.all([listenReady, handler.ready ?? Promise.resolve()]).then(() => {
+      const ready = (async () => {
+        await Promise.all([listenReady, handler.ready ?? Promise.resolve()]);
         // Mark server as initialized when ready resolves
         setServerInitialized(true);
-      });
+      })();
 
       const server = await adapter.serve(handler, {
         port,
@@ -269,7 +280,8 @@ if (import.meta.main) {
     // Start memory monitoring if enabled
     const enableMemoryMonitoring = adapter.env.get("ENABLE_MEMORY_MONITORING") === "true";
     const monitoringIntervalMs = parseInt(
-      adapter.env.get("MEMORY_MONITORING_INTERVAL_MS") ?? "30000",
+      adapter.env.get("MEMORY_MONITORING_INTERVAL_MS") ??
+        String(DEFAULT_MEMORY_MONITORING_INTERVAL_MS),
       10,
     );
 
@@ -288,7 +300,9 @@ if (import.meta.main) {
 
     const shutdownController = new AbortController();
     const projectDir = cwd();
-    const port = Number(adapter.env.get("PORT") ?? adapter.env.get("VERYFRONT_PORT") ?? 3000);
+    const port = Number(
+      adapter.env.get("PORT") ?? adapter.env.get("VERYFRONT_PORT") ?? DEFAULT_SERVER_PORT,
+    );
     // BIND_ADDRESS: 0.0.0.0 = all interfaces, 127.0.0.1 = localhost only
     // Note: Don't use HOSTNAME - K8s sets it to pod name which resolves to pod IP
     const bindAddress = adapter.env.get("BIND_ADDRESS") ?? "0.0.0.0";
@@ -313,7 +327,10 @@ if (import.meta.main) {
 
     // Graceful shutdown for direct CLI execution (e.g., deno run)
     // Default drain timeout: 25 seconds (K8s default terminationGracePeriodSeconds is 30)
-    const drainTimeoutMs = parseInt(adapter.env.get("SHUTDOWN_DRAIN_TIMEOUT_MS") ?? "25000", 10);
+    const drainTimeoutMs = parseInt(
+      adapter.env.get("SHUTDOWN_DRAIN_TIMEOUT_MS") ?? String(DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS),
+      10,
+    );
 
     let shuttingDown = false;
     const shutdown = async (signal: "SIGINT" | "SIGTERM"): Promise<void> => {

package/src/src/server/project-env/cache.ts

@@ -79,8 +79,8 @@ export class EnvironmentVariableCache {
       this.cache.set(environmentId, { vars, fetchedAt: Date.now() });
       this.evictIfNeeded();
       return vars;
-    } catch {
-      // Stale-on-error: return stale data if available
+    } catch (_) {
+      /* expected: stale-on-error fallback when fetch fails */
       if (stale) return stale.vars;
       return {};
     }

package/src/src/server/project-env/fetcher.ts

@@ -7,6 +7,7 @@ import * as dntShim from "../../../_dnt.shims.js";
 
 
 import { getBaseLogger } from "../../utils/logger/logger.js";
+import { NETWORK_ERROR } from "../../errors/index.js";
 
 const baseLogger = getBaseLogger("PROJECT-ENV");
 
@@ -46,7 +47,7 @@ export async function fetchProjectEnvVars(
         environmentId,
         status: response.status,
       });
-      throw new Error(`Failed to fetch env vars: ${response.status}`);
+      throw NETWORK_ERROR.create({ detail: `Failed to fetch env vars: ${response.status}` });
     }
 
     const body = await response.json() as {

package/src/src/server/reload-notifier.ts

@@ -3,7 +3,7 @@ import { serverLogger } from "../utils/index.js";
 
 const logger = serverLogger.component("reload-notifier");
 
-export interface ReloadProjectInfo {
+interface ReloadProjectInfo {
   projectSlug?: string;
   projectId?: string;
   projectDir?: string;

package/src/src/server/runtime-handler/adapter-factory.ts

@@ -22,7 +22,7 @@ const baseLogger = getBaseLogger("SERVER");
 
 const logger = baseLogger.component("adapter-factory");
 
-export interface AdapterResolutionResult {
+interface AdapterResolutionResult {
   /** The effective project directory to use */
   projectDir: string;
   /** The adapter to use for this request */
@@ -33,7 +33,7 @@ export interface AdapterResolutionResult {
   isLocalProject: boolean;
 }
 
-export interface AdapterResolutionOptions {
+interface AdapterResolutionOptions {
   /** Base project directory */
   projectDir: string;
   /** Base adapter */

package/src/src/server/runtime-handler/environment-resolution.ts

@@ -17,7 +17,7 @@ const baseLogger = getBaseLogger("SERVER");
 
 const logger = baseLogger.component("environment-resolution");
 
-export interface EnvironmentResolutionResult {
+interface EnvironmentResolutionResult {
   /** Resolved environment (preview/production) */
   resolvedEnvironment: "preview" | "production" | undefined;
   /** Resolved release ID (may be synthetic for standalone mode) */
@@ -26,7 +26,7 @@ export interface EnvironmentResolutionResult {
   errorResponse: dntShim.Response | undefined;
 }
 
-export interface EnvironmentResolutionOptions {
+interface EnvironmentResolutionOptions {
   /** Environment from proxy headers */
   proxyEnv: ProxyEnvironment | undefined;
   /** Mode from request context */

package/src/src/server/runtime-handler/handler-context-builder.ts

@@ -12,14 +12,14 @@ import type { VeryfrontConfig } from "../../config/index.js";
 import type { SecurityConfig } from "../../types/index.js";
 
 /** CSP user header type (from SecurityConfigLoader, string or null) */
-export type CspUserHeader = string | null;
+type CspUserHeader = string | null;
 import type { ParsedDomain } from "../utils/domain-parser.js";
 import type { HandlerContext } from "../handlers/types.js";
 import type { RouteRegistry } from "../../routing/registry/index.js";
 import { buildEnrichedContext } from "../context/enriched-context.js";
 import { computeContentSourceId } from "../../cache/keys.js";
 
-export interface HandlerContextOptions {
+interface HandlerContextOptions {
   /** Project directory */
   projectDir: string;
   /** Runtime adapter */

package/src/src/server/runtime-handler/index.ts

@@ -165,23 +165,23 @@ export function createVeryfrontHandler(
   );
 
   let config: VeryfrontConfig | undefined = opts.config;
-  const configPromise =
-    (opts.config ? Promise.resolve(opts.config) : getConfig(projectDir, adapter))
-      .then((c) => {
-        config = c;
-        if (c?.security?.csrf === undefined) {
-          logger.info(
-            "CSRF protection is not configured. Add `security: { csrf: true }` to veryfront.config.ts to enable.",
-          );
-        }
-        return c;
-      })
-      .catch((error) => {
-        logger.warn("Failed to load config, using defaults", {
-          error: getErrorMessage(error),
-        });
-        return undefined;
+  const configPromise = (async () => {
+    try {
+      const c = opts.config ? opts.config : await getConfig(projectDir, adapter);
+      config = c;
+      if (c?.security?.csrf === undefined) {
+        logger.info(
+          "CSRF protection is not configured. Add `security: { csrf: true }` to veryfront.config.ts to enable.",
+        );
+      }
+      return c;
+    } catch (error) {
+      logger.warn("Failed to load config, using defaults", {
+        error: getErrorMessage(error),
       });
+      return undefined;
+    }
+  })();
 
   const registry = new RouteRegistry({
     debug: opts.debug,

package/src/src/server/runtime-handler/isolation.ts

@@ -17,7 +17,7 @@ export type { IsolationCheckResult } from "./project-isolation.js";
 /**
  * Injection interface for testing isolation dependencies
  */
-export interface IsolationDeps {
+interface IsolationDeps {
   checkRequest?: typeof projectIsolation.checkRequest;
   startRequest?: typeof projectIsolation.startRequest;
   completeRequest?: typeof projectIsolation.completeRequest;

package/src/src/server/runtime-handler/local-project-discovery.ts

@@ -54,10 +54,19 @@ async function isValidLocalProjectPath(path: string, adapter: RuntimeAdapter): P
     throw error; // Unexpected errors (permissions, I/O) propagate to caller
   }
 
+  const checkDir = async (subPath: string): Promise<boolean> => {
+    try {
+      const s = await adapter.fs.stat(subPath);
+      return s?.isDirectory ?? false;
+    } catch {
+      return false;
+    }
+  };
+
   const [hasApp, hasPages, hasComponents] = await Promise.all([
-    adapter.fs.stat(`${path}/app`).then((s) => s?.isDirectory).catch(() => false),
-    adapter.fs.stat(`${path}/pages`).then((s) => s?.isDirectory).catch(() => false),
-    adapter.fs.stat(`${path}/components`).then((s) => s?.isDirectory).catch(() => false),
+    checkDir(`${path}/app`),
+    checkDir(`${path}/pages`),
+    checkDir(`${path}/components`),
   ]);
 
   return hasApp || hasPages || hasComponents;
@@ -90,8 +99,9 @@ export async function findLocalProjectPath(
         slug,
         path: normalizedPath,
       });
-    } catch {
+    } catch (error) {
       logger.warn("Failed to validate x-project-path override", {
+        error,
         slug,
         path: headerPath,
       });

package/src/src/server/runtime-handler/project-isolation.ts

@@ -4,7 +4,7 @@ import { getEnvNumber, unrefTimer } from "../../platform/compat/process.js";
 
 const logger = serverLogger.component("project-isolation");
 
-export interface ProjectIsolationConfig {
+interface ProjectIsolationConfig {
   maxConcurrentPerProject: number;
   circuitBreakerThreshold: number;
   circuitResetTimeMs: number;

package/src/src/server/runtime-handler/project-resolution.ts

@@ -27,7 +27,7 @@ const logger = baseLogger.component("project-resolution");
 /**
  * Injection interface for testing project resolution dependencies
  */
-export interface ProjectResolutionDeps {
+interface ProjectResolutionDeps {
   lookupProjectByDomain?: typeof lookupProjectByDomain;
   parseProjectDomain?: typeof parseProjectDomain;
   getEnvironmentType?: typeof getEnvironmentType;
@@ -50,7 +50,7 @@ function getDeps(): Required<ProjectResolutionDeps> {
   };
 }
 
-export interface RequestHeaders {
+interface RequestHeaders {
   /** Project slug from x-project-slug header */
   projectSlug: string | undefined;
   /** Project ID from x-project-id header */
@@ -92,7 +92,7 @@ export function extractRequestHeaders(req: dntShim.Request, url: URL): RequestHe
   };
 }
 
-export interface ProjectResolutionResult {
+interface ProjectResolutionResult {
   /** Resolved project slug */
   projectSlug: string | undefined;
   /** Resolved project ID */
@@ -107,7 +107,7 @@ export interface ProjectResolutionResult {
   parsedDomain: ParsedDomain;
 }
 
-export interface ProjectResolutionOptions {
+interface ProjectResolutionOptions {
   /** Config from veryfront.config.ts */
   config: VeryfrontConfig | undefined;
   /** Request context from createRequestContext */

package/src/src/server/runtime-handler/request-lifecycle.ts

@@ -24,7 +24,7 @@ import {
 import { requestTracker } from "./request-tracker.js";
 import { generateRequestId } from "../../utils/request-id.js";
 
-export interface RequestLifecycleContext {
+interface RequestLifecycleContext {
   /** Request ID for tracking */
   requestId: string;
   /** Performance request ID (only set if perf tracking enabled) */

package/src/src/server/runtime-handler/request-tracker.ts

@@ -13,7 +13,7 @@ import { isWebSocketPath } from "./request-utils.js";
 
 const logger = serverLogger.component("request-tracker");
 
-export interface TrackedRequest {
+interface TrackedRequest {
   requestId: string;
   projectSlug: string | undefined;
   path: string;
@@ -33,6 +33,12 @@ const VERY_SLOW_REQUEST_THRESHOLD_MS = 25_000; // 25 seconds
 /** How often to log the current state of in-flight requests */
 const STATUS_LOG_INTERVAL_MS = 30_000; // 30 seconds
 
+/** How often to log drain progress during graceful shutdown */
+const DRAIN_PROGRESS_LOG_INTERVAL_MS = 5_000; // 5 seconds
+
+/** Only log module requests that exceed this duration (to reduce noise) */
+const MODULE_REQUEST_LOG_THRESHOLD_MS = 100;
+
 class RequestTracker {
   private inFlight = new Map<string, TrackedRequest>();
   private statusInterval: ReturnType<typeof dntShim.setInterval> | undefined;
@@ -150,7 +156,7 @@ class RequestTracker {
       tracked.path.startsWith("/_veryfront/");
 
     if (isModuleRequest) {
-      if (durationMs > 100) {
+      if (durationMs > MODULE_REQUEST_LOG_THRESHOLD_MS) {
         logger.debug(`${tracked.method} ${tracked.path} ${statusCode} ${durationMs}ms`);
       }
       return;
@@ -221,7 +227,7 @@ class RequestTracker {
         return false;
       }
 
-      if (elapsedMs > 0 && elapsedMs % 5000 < pollIntervalMs) {
+      if (elapsedMs > 0 && elapsedMs % DRAIN_PROGRESS_LOG_INTERVAL_MS < pollIntervalMs) {
         logger.info("Drain progress", {
           inFlightCount: this.inFlight.size,
           elapsedMs,

package/src/src/server/runtime-handler/request-utils.ts

@@ -32,7 +32,7 @@ export function isInternalHost(host: string): boolean {
 }
 
 /** Monitoring paths that should skip domain lookup */
-export const MONITORING_PATHS = new Set(["/healthz", "/readyz", "/_health", "/_metrics"]);
+export const MONITORING_PATHS = new Set(["/healthz", "/readyz", "/_health"]);
 
 /** Cached request timeout value (lazy-loaded to avoid module-level env access) */
 let _requestTimeoutMs: number | null = null;

package/src/src/server/runtime-handler/tracing.ts

@@ -19,7 +19,7 @@ import {
 } from "../../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../../observability/tracing/span-names.js";
 
-export interface SpanInfo {
+interface SpanInfo {
   /** The server span (unknown type from OTLP setup) */
   span: unknown;
   /** The span context (unknown type from OTLP setup) */

package/src/src/server/services/rsc/endpoints/action-handler.ts

@@ -45,7 +45,8 @@ export async function handleActionRequest(
   try {
     const st = await adapter.fs.stat(file);
     if (!st.isFile) return jsonErrorResponse(HttpStatus.NOT_FOUND, "action not found");
-  } catch {
+  } catch (_) {
+    /* expected: action file may not exist */
     return jsonErrorResponse(HttpStatus.NOT_FOUND, "action not found");
   }
 

package/src/src/server/services/rsc/endpoints/endpoint-router.ts

@@ -8,7 +8,7 @@ import * as dntShim from "../../../../../_dnt.shims.js";
 import { HTTP_SERVER_ERROR, isRSCEnabled, serverLogger } from "../../../../utils/index.js";
 import { metrics } from "../../../../observability/simple-metrics/index.js";
 import { HttpStatus, jsonErrorResponse } from "../../../../platform/compat/http/responses.js";
-import { isWithinDirectory, joinPath } from "../../../../utils/path-utils.js";
+import { isWithinDirectory, joinPath, normalizePath } from "../../../../utils/path-utils.js";
 import { escapeHtml } from "../../../../html/html-escape.js";
 import type { RuntimeAdapter } from "../../../../platform/adapters/base.js";
 import type { RSCDevServerHandler } from "../orchestrators/index.js";
@@ -26,7 +26,7 @@ const rscLog = serverLogger.component("rsc");
  * @returns Response or null if not an RSC endpoint
  */
 export async function handleRSCEndpoint(
-  { req, pathname, projectDir, adapter, config }: RSCEndpointParams,
+  { req, pathname, projectDir, projectId, adapter, config }: RSCEndpointParams,
 ): Promise<dntShim.Response | null> {
   if (!pathname.startsWith("/_veryfront/rsc/")) {
     return null;
@@ -54,7 +54,7 @@ export async function handleRSCEndpoint(
   }
 
   const url = new URL(req.url);
-  const handler = getRSCHandler(projectDir);
+  const handler = getRSCHandler(projectDir, projectId);
 
   try {
     if (sub.startsWith("render/")) {
@@ -163,6 +163,14 @@ async function handleModuleEndpoint({
   }
 
   const normalizedRel = relParam.replace(/\\+/g, "/");
+  const relSegments = normalizedRel.split("/").filter(Boolean);
+  if (relSegments.includes("..")) {
+    return new dntShim.Response("Invalid rel query parameter", {
+      status: HttpStatus.BAD_REQUEST,
+      headers: { "content-type": "text/plain" },
+    });
+  }
+
   const rel = normalizedRel.startsWith("/") ? normalizedRel : `/${normalizedRel}`;
   const candidateRoots = [
     joinPath(projectDir, "app"),
@@ -172,7 +180,7 @@ async function handleModuleEndpoint({
   ];
 
   for (const root of candidateRoots) {
-    const modulePath = joinPath(root, rel);
+    const modulePath = normalizePath(joinPath(root, rel));
     if (!isWithinDirectory(root, modulePath)) {
       continue;
     }

package/src/src/server/services/rsc/endpoints/handler-registry.ts

@@ -12,6 +12,7 @@ import { registerCache } from "../../../../utils/memory/index.js";
 
 const RSC_HANDLERS_MAX_ENTRIES = 50;
 const RSC_HANDLERS_TTL_MS = 60 * 60 * 1000; // 1 hour
+const RSC_HANDLERS_CLEANUP_INTERVAL_MS = 300_000; // 5 minutes
 
 /**
  * Handler cache interface for dependency injection.
@@ -37,7 +38,7 @@ function getHandlersCache(): HandlerCache<RSCDevServerHandler> {
   rscHandlersByProject = new LRUCache<string, RSCDevServerHandler>({
     maxEntries: RSC_HANDLERS_MAX_ENTRIES,
     ttlMs: RSC_HANDLERS_TTL_MS,
-    cleanupIntervalMs: 300000, // 5 minutes
+    cleanupIntervalMs: RSC_HANDLERS_CLEANUP_INTERVAL_MS,
   });
 
   if (!cacheRegistered) {
@@ -52,13 +53,17 @@ function getHandlersCache(): HandlerCache<RSCDevServerHandler> {
   return rscHandlersByProject;
 }
 
-export function getRSCHandler(projectDir: string): RSCDevServerHandler {
+export function getRSCHandler(
+  projectDir: string,
+  projectId?: string,
+): RSCDevServerHandler {
+  const cacheKey = projectId ?? projectDir;
   const cache = getHandlersCache();
-  const existing = cache.get(projectDir);
+  const existing = cache.get(cacheKey);
   if (existing) return existing;
 
   const handler = new RSCDevServerHandler(projectDir);
-  cache.set(projectDir, handler);
+  cache.set(cacheKey, handler);
   return handler;
 }
 

package/src/src/server/services/rsc/endpoints/script-handlers.ts

@@ -55,10 +55,10 @@ async function buildOrServeScript(
 }
 
 // Placeholder for build-time injection
-export const CLIENT_BOOT_BUNDLE = "";
+const CLIENT_BOOT_BUNDLE = "";
 
 // Placeholder for build-time injection
-export const CLIENT_DOM_BUNDLE = "";
+const CLIENT_DOM_BUNDLE = "";
 
 export async function handleClientScript(
   adapter: RuntimeAdapter,

package/src/src/server/services/rsc/endpoints/types.ts

@@ -17,6 +17,7 @@ export interface RSCEndpointParams {
   req: dntShim.Request;
   pathname: string;
   projectDir: string;
+  projectId?: string;
   adapter: RuntimeAdapter;
   config?: VeryfrontConfig;
 }

package/src/src/server/services/rsc/orchestrators/component-resolver.ts

@@ -65,7 +65,8 @@ async function fileExists(filePath: string, fsAdapter?: FileSystemAdapter): Prom
   try {
     const stat = fsAdapter ? await fsAdapter.stat(filePath) : await fs.stat(filePath);
     return stat.isFile;
-  } catch {
+  } catch (_) {
+    /* expected: file may not exist */
     return false;
   }
 }

package/src/src/server/services/rsc/orchestrators/manifest-handler.ts

@@ -48,7 +48,7 @@ export class ManifestHandler {
     }
 
     if (!this.isCacheValid()) return null;
-    return this.cache!.data;
+    return this.cache?.data ?? null;
   }
 
   private async setCachedData(data: ManifestData): Promise<void> {

package/src/src/server/services/rsc/orchestrators/page-handler.ts

@@ -30,7 +30,8 @@ export class PageHandler {
         const res = await fetch(url);
         if (!res.ok) return null;
         return await res.json();
-      } catch {
+      } catch (_) {
+        // expected: fetch may fail in browser context
         return null;
       }
     }