veryfront 0.1.746 → 0.1.749

package/esm/src/proxy/main.js

@@ -111,8 +111,7 @@ if (Object.keys(proxyHandler.localProjects).length > 0) {
  * Handle WebSocket upgrade requests.
  * Bridges browser WebSocket to server HMR WebSocket endpoint.
  */
-function handleWebSocketUpgrade(req) {
-    const url = new URL(req.url);
+function handleWebSocketUpgrade(req, url) {
     const host = req.headers.get("host") || "";
     const parsed = parseProjectDomain(host);
     const scope = parsed.environment === "preview" ? "preview" : "production";
@@ -227,16 +226,15 @@ function handleWebSocketUpgrade(req) {
     };
     return response;
 }
-function forwardToServer(req) {
+function forwardToServer(req, url) {
     const startTime = performance.now();
-    const url = new URL(req.url);
     const requestId = dntShim.crypto.randomUUID();
     const host = req.headers.get("host") || "";
     const parentContext = extractContext(req.headers);
     const spanInfo = startServerSpan(req.method, url.pathname, parentContext);
     const execute = async () => {
         try {
-            const ctx = await proxyHandler.processRequest(req);
+            const ctx = await proxyHandler.processRequest(req, { url });
             return runWithProxyRequestContext({
                 requestId,
                 projectSlug: ctx.projectSlug,
@@ -414,9 +412,8 @@ async function handleStats() {
  * Proxy API requests directly to Veryfront API (BFF pattern).
  * Routes: /_vf/api/* -> api.veryfront.com/*
  */
-async function handleApiProxy(req) {
-    const url = new URL(req.url);
-    const token = await proxyHandler.getTokenForApi(req);
+async function handleApiProxy(req, url) {
+    const token = await proxyHandler.getTokenForApi(req, { url });
     if (!token)
         return jsonErrorResponse(401, { error: "No authentication token" });
     const apiPath = url.pathname.replace(/^\/_vf\/api/, "");
@@ -460,7 +457,7 @@ async function handleApiProxy(req) {
 function router(req) {
     const url = new URL(req.url);
     if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
-        return Promise.resolve(handleWebSocketUpgrade(req));
+        return Promise.resolve(handleWebSocketUpgrade(req, url));
     }
     switch (url.pathname) {
         case "/_proxy/stats":
@@ -472,8 +469,8 @@ function router(req) {
             return Promise.resolve(Response.json({ service: "veryfront-proxy", status: "ok" }));
     }
     if (url.pathname.startsWith("/_vf/api/"))
-        return handleApiProxy(req);
-    return forwardToServer(req);
+        return handleApiProxy(req, url);
+    return forwardToServer(req, url);
 }
 // Create server before signal registration so early SIGTERM/SIGINT can close it safely.
 const server = createHttpServer();

package/esm/src/rendering/renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuBxD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,oBAAoB;IACpB,KAAK,CAAC,EAAE,wBAAwB,CAAC;CAClC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,oBAAoB,CAAgC;IAC5D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,qBAAqB,CAA8B;IAE3D;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAwC;gBAEhD,OAAO,GAAE,eAAoB;IAInC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAkF5F;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;YAwBP,YAAY;IAoF1B,eAAe,CACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAkB5B,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU5C,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5D,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,OAAO,CAAC,wBAAwB;CA0FjC;AAED,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,GACnB,CAAC;AAIF,wBAAgB,WAAW,IAAI,QAAQ,CAOtC;AAED,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMrF;AAED,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD;AAED,wBAAsB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYnF;AAED,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,aAAa,EACvB,cAAc,CAAC,EAAE,0BAA0B,GAC1C,OAAO,CAAC,YAAY,CAAC,CAIvB"}
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../src/src/rendering/renderer.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuBxD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,oBAAoB;IACpB,KAAK,CAAC,EAAE,wBAAwB,CAAC;CAClC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,oBAAoB,CAAgC;IAC5D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,qBAAqB,CAA8B;IAE3D;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAwC;gBAEhD,OAAO,GAAE,eAAoB;IAInC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAkF5F;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;YAwBP,YAAY;IAoF1B,eAAe,CACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAkB5B,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU5C,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5D,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAO9B,OAAO,CAAC,wBAAwB;CA0FjC;AAED,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,GACnB,CAAC;AAMF,wBAAgB,WAAW,IAAI,QAAQ,CAOtC;AAED,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBrF;AAED,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAQrD;AAED,wBAAsB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYnF;AAED,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,aAAa,EACvB,cAAc,CAAC,EAAE,0BAA0B,GAC1C,OAAO,CAAC,YAAY,CAAC,CAIvB"}

package/esm/src/rendering/renderer.js

@@ -102,12 +102,8 @@ export class Renderer {
                 duration: `${(performance.now() - startTime).toFixed(2)}ms`,
             });
         })();
-        try {
-            await this.initializationPromise;
-        }
-        finally {
-            this.initializationPromise = null;
-        }
+        await this.initializationPromise;
+        this.initializationPromise = null;
     }
     renderPage(slug, ctx, options) {
         return withSpan("renderer.renderPage", async () => {
@@ -318,6 +314,7 @@ export class Renderer {
     async destroy() {
         await this.cache.destroy();
         this.initialized = false;
+        this.initializationPromise = null;
         logger.debug("Destroyed");
     }
     createServicesForContext(ctx, colorScheme) {
@@ -400,6 +397,8 @@ export class Renderer {
 }
 export { createRenderContext, createRenderContextFromEnriched, };
 let renderer = null;
+let rendererInitializationPromise = null;
+let rendererGeneration = 0;
 export function getRenderer() {
     if (!renderer) {
         throw INITIALIZATION_ERROR.create({
@@ -411,18 +410,39 @@ export function getRenderer() {
 export async function initializeRenderer(options) {
     if (renderer)
         return renderer;
-    renderer = new Renderer(options);
-    await renderer.initialize(options?.shared);
-    return renderer;
+    if (rendererInitializationPromise)
+        return rendererInitializationPromise;
+    const nextRenderer = new Renderer(options);
+    const generation = rendererGeneration;
+    rendererInitializationPromise = (async () => {
+        try {
+            await nextRenderer.initialize(options?.shared);
+            if (generation !== rendererGeneration) {
+                await nextRenderer.destroy();
+                throw INITIALIZATION_ERROR.create({
+                    detail: "Renderer initialization was cancelled before it completed.",
+                });
+            }
+            renderer = nextRenderer;
+            return nextRenderer;
+        }
+        finally {
+            rendererInitializationPromise = null;
+        }
+    })();
+    return rendererInitializationPromise;
 }
 export function isRendererInitialized() {
     return renderer !== null && areSharedServicesInitialized();
 }
 export async function destroyRenderer() {
-    if (!renderer)
-        return;
-    await renderer.destroy();
+    rendererGeneration++;
+    rendererInitializationPromise = null;
+    const currentRenderer = renderer;
     renderer = null;
+    if (!currentRenderer)
+        return;
+    await currentRenderer.destroy();
 }
 export async function clearRendererCacheForProject(projectId) {
     logger.debug("clearRendererCacheForProject called", {

package/esm/src/server/context/cache-invalidation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-invalidation.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/cache-invalidation.ts"],"names":[],"mappings":"AAqBA,UAAU,mBAAmB;IAC3B,qEAAqE;IACrE,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkHf"}
+{"version":3,"file":"cache-invalidation.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/cache-invalidation.ts"],"names":[],"mappings":"AAsBA,UAAU,mBAAmB;IAC3B,qEAAqE;IACrE,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmHf"}

package/esm/src/server/context/cache-invalidation.js

@@ -7,6 +7,7 @@ import { clearRendererCacheForProject } from "../../rendering/renderer.js";
 import { clearRouterDetectionCache, clearRouterDetectionCacheForProject, } from "../../rendering/router-detection.js";
 import { clearSnippetCacheForProject } from "../../rendering/snippet-renderer.js";
 import { resetApiHandlerForProject } from "../handlers/request/api/pages-api-handler.js";
+import { clearSourceMissCache } from "../../modules/server/module-source-resolution-cache.js";
 const logger = serverLogger.component("cache-invalidation");
 /**
  * Invalidate project caches with optional environment scoping.
@@ -34,6 +35,7 @@ export async function invalidateProjectCaches(projectSlug, changedPaths, options
         logger.debug("Clearing module path cache (full)", { projectSlug });
         clearModulePathCache();
     }
+    clearSourceMissCache();
     logger.debug("Clearing SSR module cache", {
         projectSlug,
         projectId,

package/esm/src/server/handlers/dev/scripts/error-overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-overlay.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/scripts/error-overlay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CA0FxC"}
+{"version":3,"file":"error-overlay.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/scripts/error-overlay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAwGxC"}

package/esm/src/server/handlers/dev/scripts/error-overlay.js

@@ -11,6 +11,7 @@ export function getErrorOverlay() {
 // Veryfront Error Overlay
 (function() {
   let overlayElement = null;
+  let entriesElement = null;
 
   window.addEventListener('error', (event) => {
     showError({
@@ -34,20 +35,37 @@ export function getErrorOverlay() {
       createOverlay();
     }
 
-    const errorHtml = \`
-      <div style="margin-bottom: 20px;">
-        <div style="color: #ff5555; font-size: 18px; font-weight: bold; margin-bottom: 10px;">
-          \${escapeHtml(error.message)}
-        </div>
-        \${error.filename ? \`<div style="color: #8b8b8b; margin-bottom: 5px;">\${escapeHtml(error.filename)}:\${error.lineno}:\${error.colno}</div>\` : ''}
-        \${error.stack ? \`<pre style="color: #cccccc; font-size: 12px; overflow-x: auto;">\${escapeHtml(error.stack)}</pre>\` : ''}
-      </div>
-    \`;
-
-    overlayElement.innerHTML = errorHtml + overlayElement.innerHTML;
+    const errorEntry = createErrorEntry(error);
+    entriesElement.insertBefore(errorEntry, entriesElement.firstChild);
     overlayElement.style.display = 'block';
   }
 
+  function createErrorEntry(error) {
+    const entry = document.createElement('div');
+    entry.style.cssText = 'margin-bottom: 20px;';
+
+    const message = document.createElement('div');
+    message.style.cssText = 'color: #ff5555; font-size: 18px; font-weight: bold; margin-bottom: 10px;';
+    message.textContent = String(error.message || 'Unknown error');
+    entry.appendChild(message);
+
+    if (error.filename) {
+      const location = document.createElement('div');
+      location.style.cssText = 'color: #8b8b8b; margin-bottom: 5px;';
+      location.textContent = String(error.filename) + ':' + error.lineno + ':' + error.colno;
+      entry.appendChild(location);
+    }
+
+    if (error.stack) {
+      const stack = document.createElement('pre');
+      stack.style.cssText = 'color: #cccccc; font-size: 12px; overflow-x: auto;';
+      stack.textContent = String(error.stack);
+      entry.appendChild(stack);
+    }
+
+    return entry;
+  }
+
   function createOverlay() {
     overlayElement = document.createElement('div');
     overlayElement.style.cssText = \`
@@ -82,18 +100,14 @@ export function getErrorOverlay() {
     \`;
     closeButton.onclick = () => {
       overlayElement.style.display = 'none';
-      overlayElement.innerHTML = '';
+      entriesElement.replaceChildren();
     };
 
+    entriesElement = document.createElement('div');
     overlayElement.appendChild(closeButton);
+    overlayElement.appendChild(entriesElement);
     document.body.appendChild(overlayElement);
   }
-
-  function escapeHtml(text) {
-    const div = document.createElement('div');
-    div.textContent = text;
-    return div.innerHTML;
-  }
 })();
     `.trim();
 }

package/esm/src/server/handlers/monitoring/client-log.handler.d.ts

@@ -1,5 +1,6 @@
 import { BaseHandler } from "../response/base.js";
 import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
+export declare function sanitizeClientLogPreview(value: string, maxLength?: number): string;
 export declare class ClientLogHandler extends BaseHandler {
     metadata: HandlerMetadata;
     handle(req: Request, ctx: HandlerContext): Promise<HandlerResult>;

package/esm/src/server/handlers/monitoring/client-log.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-log.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/client-log.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAkBnG,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAwDvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIzB;IAEX,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,gBAAgB;CAiCzB"}
+{"version":3,"file":"client-log.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/monitoring/client-log.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AA+BnG,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,SAAS,SAAiC,GACzC,MAAM,CASR;AAED,qBAAa,gBAAiB,SAAQ,WAAW;IAC/C,QAAQ,EAAE,eAAe,CAKvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAwDvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIzB;IAEX,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,gBAAgB;CAkCzB"}

package/esm/src/server/handlers/monitoring/client-log.handler.js

@@ -11,6 +11,28 @@ const CLIENT_LOG_MAX_BODY_BYTES = 64 * 1024;
 const CLIENT_LOG_MESSAGE_MAX_LENGTH = 5_000;
 /** Max chars of raw body shown in parse-error diagnostics */
 const CLIENT_LOG_BODY_PREVIEW_LENGTH = 500;
+function escapeControlCharacter(char) {
+    switch (char) {
+        case "\n":
+            return "\\n";
+        case "\r":
+            return "\\r";
+        case "\t":
+            return "\\t";
+        default:
+            return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+    }
+}
+export function sanitizeClientLogPreview(value, maxLength = CLIENT_LOG_BODY_PREVIEW_LENGTH) {
+    let sanitized = "";
+    for (const char of value.slice(0, maxLength)) {
+        const code = char.charCodeAt(0);
+        sanitized += code <= 0x1f || (code >= 0x7f && code <= 0x9f)
+            ? escapeControlCharacter(char)
+            : char;
+    }
+    return sanitized;
+}
 export class ClientLogHandler extends BaseHandler {
     metadata = {
         name: "ClientLogHandler",
@@ -71,9 +93,14 @@ export class ClientLogHandler extends BaseHandler {
         return ClientLogHandler.LOG_PREFIXES[level] ?? ClientLogHandler.LOG_PREFIXES.info ?? "[CLIENT]";
     }
     handleParseError(e, body) {
-        serverLogger.error("[ClientLogHandler] Failed to parse client log. Error:", getErrorMessage(e));
-        serverLogger.error(`[ClientLogHandler] Raw body received (first ${CLIENT_LOG_BODY_PREVIEW_LENGTH} chars):`, body.slice(0, CLIENT_LOG_BODY_PREVIEW_LENGTH));
-        logger.error("Body length:", body.length);
+        serverLogger.error("[ClientLogHandler] Failed to parse client log", {
+            parse_error_message: getErrorMessage(e),
+        });
+        serverLogger.error("[ClientLogHandler] Sanitized body preview", {
+            body_length: body.length,
+            body_preview: sanitizeClientLogPreview(body),
+            preview_length: CLIENT_LOG_BODY_PREVIEW_LENGTH,
+        });
         // Try to identify the problematic character for SyntaxError
         if (!(e instanceof SyntaxError) || !e.message.includes("position")) {
             return;
@@ -85,7 +112,14 @@ export class ClientLogHandler extends BaseHandler {
         const pos = parseInt(posStr, 10);
         const start = Math.max(0, pos - 20);
         const end = Math.min(body.length, pos + 20);
-        logger.error("Context around error position:", body.slice(start, end));
-        serverLogger.error("[ClientLogHandler] Character at position:", body.charCodeAt(pos), "which is:", body.charAt(pos));
+        logger.error("Context around error position", {
+            body_context: sanitizeClientLogPreview(body.slice(start, end)),
+            error_position: pos,
+        });
+        serverLogger.error("[ClientLogHandler] Character at error position", {
+            char_code: body.charCodeAt(pos),
+            char_preview: sanitizeClientLogPreview(body.charAt(pos), 1),
+            error_position: pos,
+        });
     }
 }

package/esm/src/server/handlers/request/module/batch-module-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-module-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/batch-module-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAChE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,aAAa,GAC7C,OAAO,CAAC,aAAa,CAAC,CAuBxB"}
+{"version":3,"file":"batch-module-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/batch-module-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAChE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,aAAa,GAC7C,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/esm/src/server/handlers/request/module/batch-module-handler.js

@@ -13,7 +13,8 @@ export function handleBatchModuleEndpoint(req, ctx, _createResponseBuilder, resp
             adapter: ctx.adapter,
             projectSlug: ctx.projectSlug,
             projectId: ctx.projectId,
-            branch: ctx.parsedDomain?.branch ?? null,
+            branch: ctx.requestContext?.branch ?? ctx.parsedDomain?.branch ?? null,
+            releaseId: ctx.releaseId ?? null,
             dev: !!ctx.isLocalProject,
             allowedImportDirs: ctx.config?.security?.allowedImportDirs,
         });

package/esm/src/utils/logger/redact.d.ts

@@ -50,6 +50,16 @@ export declare function redactSensitive<T>(context: T): T;
  * Non-URL strings pass through unchanged.
  */
 export declare function sanitizeUrlCredentials(input: string): string;
+/**
+ * Return the URL form safe to attach to observability span attributes.
+ *
+ * Span attributes bypass the logger's structured redaction pass, so `http.url`
+ * must not include query strings, fragments, or URL userinfo. This intentionally
+ * strips every query parameter instead of selectively redacting credential-like
+ * names because cache keys and callback state can be sensitive even when the
+ * parameter name is not obviously a credential.
+ */
+export declare function sanitizeUrlForSpan(input: string): string;
 /**
  * Apply {@link sanitizeUrlCredentials} to the `message` and `stack` of a
  * serialized-error-shaped object, returning a new object. Used by the logger's

package/esm/src/utils/logger/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../../src/src/utils/logger/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,6DAA6D;AAC7D,eAAO,MAAM,QAAQ,eAAe,CAAC;AA2CrC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGnD;AA6ED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAEhD;AA2BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA4B5D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EAC5D,KAAK,EAAE,CAAC,GAAG,CAAC,CAMb"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../../src/src/utils/logger/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,6DAA6D;AAC7D,eAAO,MAAM,QAAQ,eAAe,CAAC;AA8CrC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAcnD;AA6ED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAEhD;AA2BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA4B5D;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBxD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EAC5D,KAAK,EAAE,CAAC,GAAG,CAAC,CAMb"}

package/esm/src/utils/logger/redact.js

@@ -56,6 +56,8 @@ const SENSITIVE_KEY_PATTERNS = [
     "xsrf",
     "csrf",
 ];
+const SENSITIVE_KEY_CACHE_MAX_SIZE = 512;
+const sensitiveKeyCache = new Map();
 /** Stop traversing past this depth to keep the pass cheap and stack-safe. */
 const MAX_DEPTH = 16;
 /**
@@ -67,8 +69,18 @@ const MAX_DEPTH = 16;
  * normalizes to `author`, which contains none of the patterns.
  */
 export function isSensitiveKey(key) {
+    const cached = sensitiveKeyCache.get(key);
+    if (cached !== undefined)
+        return cached;
     const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-    return SENSITIVE_KEY_PATTERNS.some((pattern) => normalized.includes(pattern));
+    const sensitive = SENSITIVE_KEY_PATTERNS.some((pattern) => normalized.includes(pattern));
+    if (sensitiveKeyCache.size >= SENSITIVE_KEY_CACHE_MAX_SIZE) {
+        const oldestKey = sensitiveKeyCache.keys().next().value;
+        if (oldestKey !== undefined)
+            sensitiveKeyCache.delete(oldestKey);
+    }
+    sensitiveKeyCache.set(key, sensitive);
+    return sensitive;
 }
 /**
  * A non-null, non-array object. {@link isRecord} covers class instances too,
@@ -216,6 +228,53 @@ export function sanitizeUrlCredentials(input) {
     });
     return out;
 }
+function firstUrlDelimiterIndex(input) {
+    const queryIndex = input.indexOf("?");
+    const hashIndex = input.indexOf("#");
+    if (queryIndex === -1)
+        return hashIndex;
+    if (hashIndex === -1)
+        return queryIndex;
+    return Math.min(queryIndex, hashIndex);
+}
+function sanitizeProtocolRelativeUrlForSpan(input) {
+    if (!input.startsWith("//"))
+        return null;
+    try {
+        const url = new URL(`https:${input}`);
+        return `//${url.host}${url.pathname}`;
+    }
+    catch (_) {
+        return null;
+    }
+}
+/**
+ * Return the URL form safe to attach to observability span attributes.
+ *
+ * Span attributes bypass the logger's structured redaction pass, so `http.url`
+ * must not include query strings, fragments, or URL userinfo. This intentionally
+ * strips every query parameter instead of selectively redacting credential-like
+ * names because cache keys and callback state can be sensitive even when the
+ * parameter name is not obviously a credential.
+ */
+export function sanitizeUrlForSpan(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return input;
+    try {
+        const url = new URL(input);
+        if (url.origin !== "null")
+            return `${url.origin}${url.pathname}`;
+    }
+    catch (_) {
+        // Relative or malformed URL-shaped strings are handled by the fallback.
+    }
+    const delimiterIndex = firstUrlDelimiterIndex(input);
+    const withoutQueryOrFragment = delimiterIndex === -1 ? input : input.slice(0, delimiterIndex);
+    const protocolRelativeUrl = sanitizeProtocolRelativeUrlForSpan(withoutQueryOrFragment);
+    if (protocolRelativeUrl)
+        return protocolRelativeUrl;
+    return sanitizeUrlCredentials(withoutQueryOrFragment);
+}
 /**
  * Apply {@link sanitizeUrlCredentials} to the `message` and `stack` of a
  * serialized-error-shaped object, returning a new object. Used by the logger's

package/esm/src/utils/redis-client.d.ts

@@ -2,6 +2,7 @@ export interface RedisClient {
     connect(): Promise<void>;
     disconnect(): Promise<void>;
     get(key: string): Promise<string | null>;
+    mGet(keys: string[]): Promise<Array<string | null>>;
     set(key: string, value: string, options?: {
         EX?: number;
     }): Promise<string | null>;

package/esm/src/utils/redis-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/src/utils/redis-client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CACF,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAsBD,wBAAsB,cAAc,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B3F;AA6DD,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}
+{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/src/utils/redis-client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CACF,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAsBD,wBAAsB,cAAc,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B3F;AA6DD,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.746";
+export declare const VERSION = "0.1.749";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.746";
+export const VERSION = "0.1.749";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.746",
+  "version": "0.1.749",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",