veryfront 0.1.764 → 0.1.766

package/esm/src/proxy/asset-handler.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Proxy handler for content-addressed release assets.
+ *
+ * Owns the `/_vf/assets/{hash}.{js|css}` prefix on the project's own domain.
+ * Validates the hash + extension, fetches bytes from the API's public
+ * `/release-assets/{hash}` endpoint, caches hot bytes in a small in-memory LRU,
+ * and serves them immutable + nosniff with an allowlisted content type.
+ *
+ * The renderer is never involved.
+ *
+ * @module proxy/asset-handler
+ */
+/** True when the path is owned by the release asset prefix. */
+export declare function isReleaseAssetPath(pathname: string): boolean;
+export interface ReleaseAssetHandlerOptions {
+    apiBaseUrl: string;
+    /** Injectable fetch for tests. Defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Serve a release asset for the given request URL.
+ *
+ * @returns a Response on the asset path, or null if the path is not an asset
+ * path (caller should continue normal forwarding). For invalid hashes/exts a
+ * 400 is returned; for upstream 404s a no-cache 404 is returned.
+ */
+export declare function handleReleaseAssetRequest(url: URL, options: ReleaseAssetHandlerOptions): Promise<Response | null>;
+/** Clear the in-memory asset cache (tests / memory pressure). */
+export declare function clearReleaseAssetProxyCache(): void;
+//# sourceMappingURL=asset-handler.d.ts.map

package/esm/src/proxy/asset-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/asset-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuBH,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAqBD,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgE1B;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/esm/src/proxy/asset-handler.js

@@ -0,0 +1,108 @@
+/**
+ * Proxy handler for content-addressed release assets.
+ *
+ * Owns the `/_vf/assets/{hash}.{js|css}` prefix on the project's own domain.
+ * Validates the hash + extension, fetches bytes from the API's public
+ * `/release-assets/{hash}` endpoint, caches hot bytes in a small in-memory LRU,
+ * and serves them immutable + nosniff with an allowlisted content type.
+ *
+ * The renderer is never involved.
+ *
+ * @module proxy/asset-handler
+ */
+import { LRUCache } from "../utils/lru-wrapper.js";
+import { contentTypeForExtension, isAllowedReleaseAssetContentType, isValidContentHash, RELEASE_ASSET_IMMUTABLE_MAX_AGE_SECONDS, } from "../release-assets/constants.js";
+const ASSET_PATH_PREFIX = "/_vf/assets/";
+const ASSET_PATH_RE = /^\/_vf\/assets\/([0-9a-f]{64})\.(js|css)$/;
+/** Bound on cached asset bodies (~100 hot entries). */
+const MAX_CACHED_ASSETS = 100;
+const assetCache = new LRUCache({ maxEntries: MAX_CACHED_ASSETS });
+/** True when the path is owned by the release asset prefix. */
+export function isReleaseAssetPath(pathname) {
+    return pathname.startsWith(ASSET_PATH_PREFIX);
+}
+const IMMUTABLE_HEADERS = {
+    "Cache-Control": `public, max-age=${RELEASE_ASSET_IMMUTABLE_MAX_AGE_SECONDS}, immutable`,
+    "X-Content-Type-Options": "nosniff",
+};
+function notFound() {
+    return new Response("Not found", {
+        status: 404,
+        headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+    });
+}
+function badRequest(message) {
+    return new Response(message, {
+        status: 400,
+        headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+    });
+}
+/**
+ * Serve a release asset for the given request URL.
+ *
+ * @returns a Response on the asset path, or null if the path is not an asset
+ * path (caller should continue normal forwarding). For invalid hashes/exts a
+ * 400 is returned; for upstream 404s a no-cache 404 is returned.
+ */
+export async function handleReleaseAssetRequest(url, options) {
+    if (!isReleaseAssetPath(url.pathname))
+        return null;
+    const match = url.pathname.match(ASSET_PATH_RE);
+    if (!match) {
+        // Path is under the asset prefix but malformed (bad hash/ext) → 400.
+        return badRequest("Invalid asset path");
+    }
+    const hash = match[1];
+    const ext = match[2];
+    // Defense in depth: the regex already constrains these.
+    if (!isValidContentHash(hash) || (ext !== "js" && ext !== "css")) {
+        return badRequest("Invalid asset path");
+    }
+    const cacheKey = `${hash}.${ext}`;
+    const cached = assetCache.get(cacheKey);
+    if (cached) {
+        return new Response(cached.bytes, {
+            status: 200,
+            headers: { ...IMMUTABLE_HEADERS, "Content-Type": cached.contentType },
+        });
+    }
+    const doFetch = options.fetchImpl ?? fetch;
+    const upstreamUrl = `${options.apiBaseUrl}/release-assets/${hash}`;
+    let response;
+    try {
+        response = await doFetch(upstreamUrl);
+    }
+    catch {
+        return new Response("Bad gateway", {
+            status: 502,
+            headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+        });
+    }
+    if (response.status === 404)
+        return notFound();
+    if (!response.ok) {
+        return new Response("Bad gateway", {
+            status: 502,
+            headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+        });
+    }
+    const upstreamContentType = response.headers.get("content-type");
+    if (!isAllowedReleaseAssetContentType(upstreamContentType)) {
+        return new Response("Bad gateway", {
+            status: 502,
+            headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+        });
+    }
+    // Serve the expected content type for the extension (allowlisted).
+    const contentType = contentTypeForExtension(ext);
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    assetCache.set(cacheKey, { bytes, contentType });
+    return new Response(bytes, {
+        status: 200,
+        headers: { ...IMMUTABLE_HEADERS, "Content-Type": contentType },
+    });
+}
+/** Clear the in-memory asset cache (tests / memory pressure). */
+export function clearReleaseAssetProxyCache() {
+    assetCache.clear();
+}

package/esm/src/proxy/main.js

@@ -34,6 +34,7 @@ import { parseProjectDomain } from "../server/utils/domain-parser.js";
 import { exit, getEnv, onSignal } from "../platform/compat/process.js";
 import { createHttpServer, upgradeWebSocket } from "../platform/compat/http/index.js";
 import { createProxyErrorResponse, jsonErrorResponse } from "./error-response.js";
+import { handleReleaseAssetRequest, isReleaseAssetPath } from "./asset-handler.js";
 function getLocalProjects() {
     const raw = getEnv("LOCAL_PROJECTS");
     return raw ? JSON.parse(raw) : {};
@@ -470,6 +471,9 @@ function router(req) {
     }
     if (url.pathname.startsWith("/_vf/api/"))
         return handleApiProxy(req, url);
+    if (isReleaseAssetPath(url.pathname)) {
+        return handleReleaseAssetRequest(url, { apiBaseUrl: config.apiBaseUrl }).then((res) => res ?? forwardToServer(req, url));
+    }
     return forwardToServer(req, url);
 }
 // Create server before signal registration so early SIGTERM/SIGINT can close it safely.

package/esm/src/release-assets/build-executor.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Release Asset Manifest — builder executor.
+ *
+ * Runs inside the project runtime as the `task:release-asset-build` handler.
+ * Materializes a release's file set, transforms every browser module through
+ * the SAME pipeline `serveModule` uses (byte parity with the JIT fallback is a
+ * hard requirement), compiles route CSS where reachable, content-addresses and
+ * uploads each asset, then assembles and PUTs the manifest (→ ready).
+ *
+ * Defensive by construction:
+ * - Any module transform failure reports `failed` and stops without PUTting.
+ * - Any other build failure (list/hash/upload/PUT) also reports `failed`.
+ * - The temp dir is always cleaned up by the caller.
+ *
+ * @module release-assets/build-executor
+ */
+export interface ReleaseAssetBuildInput {
+    /** Project reference (slug or id) used for API calls. */
+    projectReference: string;
+    /** Project UUID. */
+    projectId: string;
+    /** Release UUID. */
+    releaseId: string;
+    /** Release version (integer). */
+    releaseVersion: number;
+    /** Release version string used for API path segments. */
+    releaseVersionRef: string;
+    /** React version for transforms. */
+    reactVersion?: string;
+    /** Authenticated, project-scoped API client. */
+    client: ReleaseAssetBuildClient;
+    /** Runtime adapter used by the transform pipeline. */
+    adapter: any;
+    /**
+     * Transform function. Defaults to the same `transformToESM` pipeline
+     * `serveModule` uses (browser, non-SSR) — byte parity is a hard requirement.
+     * Injectable for tests.
+     */
+    transform?: ReleaseAssetTransform;
+}
+export type ReleaseAssetTransform = (source: string, sourceFile: string, projectDir: string, adapter: any, options: {
+    projectId: string;
+    dev: boolean;
+    ssr: boolean;
+    reactVersion?: string;
+}) => Promise<string>;
+/** Subset of the API client used by the builder (eases testing). */
+export interface ReleaseAssetBuildClient {
+    beginReleaseAssetManifestBuild(version: string): Promise<{
+        id: string;
+        manifest_version: number;
+        state: string;
+    }>;
+    listAllReleaseFiles(version: string): Promise<Array<{
+        path: string;
+        content?: string;
+    }>>;
+    uploadReleaseAsset(version: string, contentHash: string, contentType: string, bytes: Uint8Array): Promise<{
+        stored: boolean;
+        existed: boolean;
+    }>;
+    putReleaseAssetManifest(version: string, manifest: unknown): Promise<{
+        state: string;
+        manifest_version?: number;
+    }>;
+    reportReleaseAssetManifestState(version: string, state: "partial" | "failed", error?: string): Promise<unknown>;
+    /** Optional project CSS compiler; when absent, css:[] is recorded. */
+    compileProjectCss?(candidates: Set<string>): Promise<{
+        css: string;
+        styleProfileHash: string | null;
+    } | null>;
+}
+export interface ReleaseAssetBuildResult {
+    success: boolean;
+    state: "ready" | "failed";
+    moduleCount: number;
+    cssCount: number;
+    routeCount: number;
+    gaps: string[];
+    error?: string;
+}
+/** Derive a route path from a page module logical path. */
+export declare function routeForPage(logicalPath: string): string | null;
+/**
+ * Execute a release asset build. Pure orchestration over the injected client
+ * and a runtime-provided temp dir + react version.
+ */
+export declare function runReleaseAssetBuild(input: ReleaseAssetBuildInput, tempDir: string): Promise<ReleaseAssetBuildResult>;
+//# sourceMappingURL=build-executor.d.ts.map

package/esm/src/release-assets/build-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-executor.d.ts","sourceRoot":"","sources":["../../../src/src/release-assets/build-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,MAAM,EAAE,uBAAuB,CAAC;IAChC,sDAAsD;IAEtD,OAAO,EAAE,GAAG,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAElB,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9E,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACtC,8BAA8B,CAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,mBAAmB,CACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACtD,kBAAkB,CAChB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClD,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,+BAA+B,CAC7B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,sEAAsE;IACtE,iBAAiB,CAAC,CAChB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAsBD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM/D;AA0GD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC,CA2ClC"}

package/esm/src/release-assets/build-executor.js

@@ -0,0 +1,405 @@
+/**
+ * Release Asset Manifest — builder executor.
+ *
+ * Runs inside the project runtime as the `task:release-asset-build` handler.
+ * Materializes a release's file set, transforms every browser module through
+ * the SAME pipeline `serveModule` uses (byte parity with the JIT fallback is a
+ * hard requirement), compiles route CSS where reachable, content-addresses and
+ * uploads each asset, then assembles and PUTs the manifest (→ ready).
+ *
+ * Defensive by construction:
+ * - Any module transform failure reports `failed` and stops without PUTting.
+ * - Any other build failure (list/hash/upload/PUT) also reports `failed`.
+ * - The temp dir is always cleaned up by the caller.
+ *
+ * @module release-assets/build-executor
+ */
+import { serverLogger } from "../utils/index.js";
+import { VERSION } from "../utils/version.js";
+import { createFileSystem } from "../platform/compat/fs.js";
+import { dirname, join } from "../platform/compat/path/index.js";
+import { transformToESM } from "../transforms/esm-transform.js";
+import { sha256HexBytes } from "./hash.js";
+import { RELEASE_ASSET_BASE_PATH, RELEASE_ASSET_CONTENT_TYPES, RELEASE_ASSET_MANIFEST_SCHEMA_VERSION, RELEASE_ASSET_MAX_SIZE_BYTES, RELEASE_ASSET_UPLOAD_CONCURRENCY, } from "./constants.js";
+const logger = serverLogger.component("release-asset-build");
+/** Browser module source extensions eligible for transform. */
+const BROWSER_MODULE_EXTENSIONS = [".tsx", ".ts", ".jsx", ".js", ".mdx"];
+/** Directories whose modules are part of the browser closure. */
+const BROWSER_MODULE_DIRS = ["pages/", "components/", "layouts/", "lib/", "src/"];
+/** Sanitize an error for state reporting (no internal paths / stack traces). */
+function sanitizeError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replace(/\/[^\s]+/g, "<path>").slice(0, 300);
+}
+/** True when a logical path is an eligible browser module. */
+function isBrowserModule(path) {
+    if (!BROWSER_MODULE_EXTENSIONS.some((ext) => path.endsWith(ext)))
+        return false;
+    if (path.endsWith(".d.ts"))
+        return false;
+    return BROWSER_MODULE_DIRS.some((dir) => path.startsWith(dir));
+}
+/** Derive a route path from a page module logical path. */
+export function routeForPage(logicalPath) {
+    if (!logicalPath.startsWith("pages/"))
+        return null;
+    const withoutPrefix = logicalPath.slice("pages/".length);
+    const withoutExt = withoutPrefix.replace(/\.(tsx|ts|jsx|mdx|js)$/, "");
+    const route = withoutExt.replace(/\/index$/, "").replace(/^index$/, "");
+    return `/${route}`.replace(/\/+/g, "/").replace(/\/$/, "") || "/";
+}
+/**
+ * Statically resolve relative imports in a source file to logical paths.
+ *
+ * Parses `import/export ... from "..."` and bare `import "..."` statements.
+ * Only relative specifiers (`./` or `../`) are resolved; package imports and
+ * absolute URLs are skipped. Extension-less specifiers try each browser module
+ * extension in order.
+ */
+function resolveStaticImports(source, moduleLogicalPath, knownPaths) {
+    const importRe = /(?:^|;|\n)\s*(?:import|export)\s+(?:[^'"]+\s+from\s+)?['"]([^'"]+)['"]/gm;
+    const results = [];
+    let m;
+    while ((m = importRe.exec(source)) !== null) {
+        const specifier = m[1];
+        if (!specifier.startsWith("./") && !specifier.startsWith("../"))
+            continue;
+        const dir = moduleLogicalPath.includes("/")
+            ? moduleLogicalPath.slice(0, moduleLogicalPath.lastIndexOf("/"))
+            : ".";
+        // Resolve the path segments manually (no path library needed for simple cases).
+        const segments = `${dir}/${specifier}`.split("/").filter((s) => s !== "");
+        const resolved = [];
+        for (const seg of segments) {
+            if (seg === "..") {
+                resolved.pop();
+            }
+            else if (seg !== ".") {
+                resolved.push(seg);
+            }
+        }
+        const candidate = resolved.join("/");
+        // If the specifier already has a known extension and exists, use it.
+        if (knownPaths.has(candidate)) {
+            results.push(candidate);
+            continue;
+        }
+        // Try appending each browser module extension.
+        let found = false;
+        for (const ext of BROWSER_MODULE_EXTENSIONS) {
+            const withExt = `${candidate}${ext}`;
+            if (knownPaths.has(withExt)) {
+                results.push(withExt);
+                found = true;
+                break;
+            }
+        }
+        // Also try /index variants for directory imports.
+        if (!found) {
+            for (const ext of BROWSER_MODULE_EXTENSIONS) {
+                const indexPath = `${candidate}/index${ext}`;
+                if (knownPaths.has(indexPath)) {
+                    results.push(indexPath);
+                    break;
+                }
+            }
+        }
+    }
+    return results;
+}
+/**
+ * Walk the static import graph from a set of entry points using BFS.
+ * Returns all reachable logical paths (entries included).
+ * Modules not in `sourceByPath` are recorded as closure gaps.
+ */
+function collectClosure(entrypoints, sourceByPath, knownPaths) {
+    const visited = new Set();
+    const queue = [...entrypoints];
+    const gaps = [];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (visited.has(current))
+            continue;
+        visited.add(current);
+        const source = sourceByPath.get(current);
+        if (!source) {
+            // Module referenced but not in the materialized file set.
+            gaps.push(`closure-missing:${current}`);
+            continue;
+        }
+        const imports = resolveStaticImports(source, current, knownPaths);
+        for (const imp of imports) {
+            if (!visited.has(imp))
+                queue.push(imp);
+        }
+    }
+    return { modules: [...visited], gaps };
+}
+/**
+ * Execute a release asset build. Pure orchestration over the injected client
+ * and a runtime-provided temp dir + react version.
+ */
+export async function runReleaseAssetBuild(input, tempDir) {
+    const { client } = input;
+    const transform = input.transform ??
+        ((source, sourceFile, projectDir, adapter, options) => transformToESM(source, sourceFile, projectDir, adapter, {
+            projectId: options.projectId,
+            dev: options.dev,
+            ssr: options.ssr,
+            studioEmbed: false,
+            reactVersion: options.reactVersion,
+        }));
+    // H1: wrap the whole build so any non-transform failure also reports failed.
+    try {
+        return await runBuildInner(input, tempDir, client, transform);
+    }
+    catch (error) {
+        const sanitized = sanitizeError(error);
+        logger.warn("Release asset build failed (non-transform error)", {
+            releaseId: input.releaseId,
+            error: sanitized,
+        });
+        try {
+            await client.reportReleaseAssetManifestState(input.releaseVersionRef, "failed", sanitized);
+        }
+        catch (reportErr) {
+            logger.warn("Failed to report build failure state", {
+                releaseId: input.releaseId,
+                error: sanitizeError(reportErr),
+            });
+        }
+        return {
+            success: false,
+            state: "failed",
+            moduleCount: 0,
+            cssCount: 0,
+            routeCount: 0,
+            gaps: [],
+            error: sanitized,
+        };
+    }
+}
+async function runBuildInner(input, tempDir, client, transform) {
+    // 1. Begin (idempotent). H2: capture manifest_version from the API response.
+    const beginResult = await client.beginReleaseAssetManifestBuild(input.releaseVersionRef);
+    const manifestVersion = beginResult.manifest_version;
+    // 2. Materialize the release file set.
+    const files = await client.listAllReleaseFiles(input.releaseVersionRef);
+    const fs = createFileSystem();
+    const sourceByPath = new Map();
+    for (const file of files) {
+        if (typeof file.content !== "string")
+            continue;
+        sourceByPath.set(file.path, file.content);
+        const abs = join(tempDir, file.path);
+        await fs.mkdir(dirname(abs), { recursive: true });
+        await fs.writeTextFile(abs, file.content);
+    }
+    // 3 + 4. Collect the browser module closure and transform each module
+    // through the SAME pipeline serveModule uses (browser, non-SSR).
+    const modules = {};
+    const gaps = [];
+    const uploadQueue = [];
+    // Bytes are held per-hash only until uploaded, then dropped (M3).
+    const pendingBytes = new Map();
+    const knownPaths = new Set(sourceByPath.keys());
+    for (const [logicalPath, source] of sourceByPath) {
+        if (!isBrowserModule(logicalPath))
+            continue;
+        // M2: enforce client-side size limit before transform (source is a proxy;
+        // transformed output is checked after encoding below).
+        const sourceFile = join(tempDir, logicalPath);
+        let code;
+        try {
+            code = await transform(source, sourceFile, tempDir, input.adapter, {
+                projectId: input.projectId,
+                dev: false,
+                ssr: false,
+                reactVersion: input.reactVersion,
+            });
+        }
+        catch (error) {
+            // Hard requirement: any module transform failure → report failed, stop.
+            const sanitized = sanitizeError(error);
+            logger.warn("Module transform failed during release asset build", {
+                path: logicalPath,
+                error: sanitized,
+            });
+            await client.reportReleaseAssetManifestState(input.releaseVersionRef, "failed", sanitized);
+            return {
+                success: false,
+                state: "failed",
+                moduleCount: 0,
+                cssCount: 0,
+                routeCount: 0,
+                gaps,
+                error: sanitized,
+            };
+        }
+        // L2: hash the bytes, not the string.
+        const bytes = new TextEncoder().encode(code);
+        // M2: enforce 10 MB client-side limit — skip oversized modules with a gap.
+        if (bytes.byteLength > RELEASE_ASSET_MAX_SIZE_BYTES) {
+            gaps.push(`oversized:${logicalPath}`);
+            logger.warn("Module exceeds max size, skipping", {
+                path: logicalPath,
+                size: bytes.byteLength,
+                limit: RELEASE_ASSET_MAX_SIZE_BYTES,
+            });
+            continue;
+        }
+        const contentHash = await sha256HexBytes(bytes);
+        const entry = {
+            logicalPath,
+            contentHash,
+            size: bytes.byteLength,
+            contentType: RELEASE_ASSET_CONTENT_TYPES.js,
+        };
+        modules[logicalPath] = entry;
+        if (!pendingBytes.has(contentHash)) {
+            pendingBytes.set(contentHash, { bytes, contentType: RELEASE_ASSET_CONTENT_TYPES.js });
+            uploadQueue.push(entry);
+        }
+    }
+    // 5b. CSS: compile project CSS where reachable, else record css:[] and note.
+    const css = [];
+    const cssHashes = [];
+    if (client.compileProjectCss) {
+        try {
+            const candidates = collectClassCandidates(sourceByPath);
+            const compiled = await client.compileProjectCss(candidates);
+            if (compiled && compiled.css) {
+                const bytes = new TextEncoder().encode(compiled.css);
+                const contentHash = await sha256HexBytes(bytes);
+                css.push({
+                    contentHash,
+                    size: bytes.byteLength,
+                    contentType: RELEASE_ASSET_CONTENT_TYPES.css,
+                    styleProfileHash: compiled.styleProfileHash,
+                });
+                cssHashes.push(contentHash);
+                if (!pendingBytes.has(contentHash)) {
+                    pendingBytes.set(contentHash, { bytes, contentType: RELEASE_ASSET_CONTENT_TYPES.css });
+                    uploadQueue.push({
+                        logicalPath: `__css__/${contentHash}`,
+                        contentHash,
+                        size: bytes.byteLength,
+                        contentType: RELEASE_ASSET_CONTENT_TYPES.css,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            // CSS is best-effort: record a gap, keep css:[].
+            gaps.push("css:compile-failed");
+            logger.warn("Release asset CSS compile failed (recording gap)", {
+                error: sanitizeError(error),
+            });
+        }
+    }
+    else {
+        gaps.push("css:no-pipeline");
+    }
+    // 5a. Upload assets with bounded concurrency, dropping bytes after each
+    // successful upload (M3) to bound peak memory.
+    await uploadWithConcurrency(uploadQueue, RELEASE_ASSET_UPLOAD_CONCURRENCY, async (asset) => {
+        const stored = pendingBytes.get(asset.contentHash);
+        if (!stored)
+            return;
+        await client.uploadReleaseAsset(input.releaseVersionRef, asset.contentHash, stored.contentType, stored.bytes);
+        // M3: drop bytes immediately after upload.
+        pendingBytes.delete(asset.contentHash);
+    });
+    // B2. Routes: walk the full static import closure from each page entrypoint.
+    // Modules whose source is not in sourceByPath are recorded as closure gaps.
+    const routes = {};
+    const pageModules = Object.keys(modules).filter((p) => p.startsWith("pages/"));
+    for (const logicalPath of pageModules) {
+        const route = routeForPage(logicalPath);
+        if (!route)
+            continue;
+        const { modules: closureModules, gaps: closureGaps } = collectClosure([logicalPath], sourceByPath, knownPaths);
+        // Include only modules we actually have in the manifest (transformed +
+        // within size limit). Framework lib/* modules are excluded per contract
+        // (they are embedded by the runtime, not shipped as release assets).
+        const manifestedModules = closureModules.filter((m) => modules[m] !== undefined);
+        // Closure members not in the manifest (missing transforms, oversized, or
+        // framework-provided) are recorded as gaps for this route.
+        for (const missing of closureModules) {
+            if (modules[missing] === undefined && !missing.startsWith("lib/")) {
+                closureGaps.push(`route-gap:${route}:${missing}`);
+            }
+        }
+        if (closureGaps.length > 0) {
+            gaps.push(...closureGaps.filter((g) => !gaps.includes(g)));
+        }
+        routes[route] = { modules: manifestedModules, css: cssHashes };
+    }
+    // 6. Assemble and PUT the manifest.
+    const sourceContentHash = await sha256HexBytes(new TextEncoder().encode([...sourceByPath.keys()].sort().join("\n")));
+    const manifest = {
+        schemaVersion: RELEASE_ASSET_MANIFEST_SCHEMA_VERSION,
+        projectId: input.projectId,
+        releaseId: input.releaseId,
+        releaseVersion: input.releaseVersion,
+        // H2: use the manifest_version returned by begin, not a hardcoded 1.
+        manifestVersion,
+        builderVersion: VERSION,
+        sourceContentHash,
+        createdAt: new Date().toISOString(),
+        assetBasePath: RELEASE_ASSET_BASE_PATH,
+        modules: Object.fromEntries(Object.entries(modules).map(([path, entry]) => [path, {
+                contentHash: entry.contentHash,
+                size: entry.size,
+                contentType: entry.contentType,
+            }])),
+        css,
+        routes,
+        dependencies: {},
+        fallback: { mode: "jit", gaps },
+    };
+    const result = await client.putReleaseAssetManifest(input.releaseVersionRef, manifest);
+    logger.info("Release asset manifest built", {
+        releaseId: input.releaseId,
+        manifestVersion,
+        moduleCount: Object.keys(modules).length,
+        cssCount: css.length,
+        routeCount: Object.keys(routes).length,
+        state: result.state,
+    });
+    return {
+        success: true,
+        state: "ready",
+        moduleCount: Object.keys(modules).length,
+        cssCount: css.length,
+        routeCount: Object.keys(routes).length,
+        gaps,
+    };
+}
+/** Extract Tailwind class candidates from materialized source (best-effort). */
+function collectClassCandidates(sourceByPath) {
+    const candidates = new Set();
+    const re = /class(?:Name)?\s*=\s*["'`]([^"'`]+)["'`]/g;
+    for (const source of sourceByPath.values()) {
+        let m;
+        while ((m = re.exec(source)) !== null) {
+            for (const cls of m[1].split(/\s+/)) {
+                if (cls)
+                    candidates.add(cls);
+            }
+        }
+    }
+    return candidates;
+}
+/** Run an async task over items with a fixed concurrency limit. */
+async function uploadWithConcurrency(items, concurrency, task) {
+    let index = 0;
+    async function worker() {
+        while (index < items.length) {
+            const current = index++;
+            await task(items[current]);
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => worker());
+    await Promise.all(workers);
+}