veryfront 0.1.96 → 0.1.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -126,37 +126,37 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "3.0.43",
-    "@ai-sdk/google": "3.0.29",
-    "@ai-sdk/openai": "3.0.28",
-    "@babel/generator": "7.26.3",
-    "@babel/parser": "7.26.3",
-    "@babel/traverse": "7.26.3",
-    "@babel/types": "7.26.3",
-    "@kreuzberg/wasm": "4.4.2",
-    "@mdx-js/mdx": "3.0.0",
-    "@opentelemetry/api": "1",
+    "@ai-sdk/anthropic": "3.0.63",
+    "@ai-sdk/google": "3.0.52",
+    "@ai-sdk/openai": "3.0.47",
+    "@babel/generator": "7.29.1",
+    "@babel/parser": "7.29.2",
+    "@babel/traverse": "7.29.0",
+    "@babel/types": "7.29.0",
+    "@kreuzberg/wasm": "4.5.2",
+    "@mdx-js/mdx": "3.1.1",
+    "@opentelemetry/api": "1.9.0",
     "@opentelemetry/context-async-hooks": "1",
     "@opentelemetry/core": "1",
     "@opentelemetry/exporter-trace-otlp-http": "0.57",
     "@opentelemetry/resources": "1",
     "@opentelemetry/sdk-trace-base": "1",
-    "@opentelemetry/semantic-conventions": "1",
+    "@opentelemetry/semantic-conventions": "1.40.0",
     "@types/hast": "3.0.3",
     "@types/mdast": "4.0.3",
     "@types/unist": "3.0.2",
-    "ai": "6.0.33",
+    "ai": "6.0.134",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "es-module-lexer": "1.5.0",
-    "esbuild": "0.20.2",
+    "esbuild": "0.27.4",
     "github-slugger": "2.0.0",
     "gray-matter": "4.0.3",
     "jose": "5.9.6",
     "mdast-util-to-string": "4.0.0",
     "mime-types": "2.1.35",
-    "react": "19.1.1",
-    "react-dom": "19.1.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
     "redis": "4.6.13",
     "rehype-highlight": "7.0.2",
     "rehype-raw": "7.0.0",
@@ -167,12 +167,12 @@
     "remark-frontmatter": "5.0.0",
     "remark-gfm": "4.0.1",
     "remark-parse": "11.0.0",
-    "remark-rehype": "11.1.1",
+    "remark-rehype": "11.1.2",
     "tailwind-merge": "2.6.0",
-    "tailwindcss": "4.1.8",
+    "tailwindcss": "4.2.2",
     "unified": "11.0.5",
-    "unist-util-visit": "5.0.0",
-    "vfile": "6.0.1",
+    "unist-util-visit": "5.1.0",
+    "vfile": "6.0.3",
     "zod": "3.25.76",
     "@deno/shim-deno": "~0.18.0",
     "@deno/shim-crypto": "~0.3.1",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [
@@ -214,29 +214,29 @@ export default {
     "csstype": "https://esm.sh/csstype@3.2.3",
     "@types/react": "https://esm.sh/@types/react@18.3.27?deps=csstype@3.2.3",
     "@types/react-dom": "https://esm.sh/@types/react-dom@18.3.7?deps=csstype@3.2.3",
-    "react": "https://esm.sh/react@19.1.1?target=es2022&deps=csstype@3.2.3",
-    "react-dom": "https://esm.sh/react-dom@19.1.1?external=react&target=es2022&deps=csstype@3.2.3",
-    "react-dom/server": "https://esm.sh/react-dom@19.1.1/server?external=react&target=es2022&deps=csstype@3.2.3",
-    "react-dom/client": "https://esm.sh/react-dom@19.1.1/client?external=react&target=es2022&deps=csstype@3.2.3",
-    "react/jsx-runtime": "https://esm.sh/react@19.1.1/jsx-runtime?external=react&target=es2022&deps=csstype@3.2.3",
-    "react/jsx-dev-runtime": "https://esm.sh/react@19.1.1/jsx-dev-runtime?external=react&target=es2022&deps=csstype@3.2.3",
-    "@mdx-js/mdx": "npm:@mdx-js/mdx@3.0.0",
-    "@mdx-js/react": "npm:@mdx-js/react@3.0.0",
-    "unist-util-visit": "npm:unist-util-visit@5.0.0",
+    "react": "https://esm.sh/react@19.2.4?target=es2022&deps=csstype@3.2.3",
+    "react-dom": "https://esm.sh/react-dom@19.2.4?external=react&target=es2022&deps=csstype@3.2.3",
+    "react-dom/server": "https://esm.sh/react-dom@19.2.4/server?external=react&target=es2022&deps=csstype@3.2.3",
+    "react-dom/client": "https://esm.sh/react-dom@19.2.4/client?external=react&target=es2022&deps=csstype@3.2.3",
+    "react/jsx-runtime": "https://esm.sh/react@19.2.4/jsx-runtime?external=react&target=es2022&deps=csstype@3.2.3",
+    "react/jsx-dev-runtime": "https://esm.sh/react@19.2.4/jsx-dev-runtime?external=react&target=es2022&deps=csstype@3.2.3",
+    "@mdx-js/mdx": "npm:@mdx-js/mdx@3.1.1",
+    "@mdx-js/react": "npm:@mdx-js/react@3.1.1",
+    "unist-util-visit": "npm:unist-util-visit@5.1.0",
     "mdast-util-to-string": "npm:mdast-util-to-string@4.0.0",
     "github-slugger": "npm:github-slugger@2.0.0",
     "remark-parse": "npm:remark-parse@11.0.0",
     "remark-gfm": "npm:remark-gfm@4.0.1",
     "remark-frontmatter": "npm:remark-frontmatter@5.0.0",
-    "remark-rehype": "npm:remark-rehype@11.1.1",
+    "remark-rehype": "npm:remark-rehype@11.1.2",
     "rehype-highlight": "npm:rehype-highlight@7.0.2",
     "rehype-starry-night": "npm:rehype-starry-night@2.2.0",
     "rehype-slug": "npm:rehype-slug@6.0.0",
     "rehype-raw": "npm:rehype-raw@7.0.0",
     "rehype-sanitize": "npm:rehype-sanitize@6.0.0",
     "rehype-stringify": "npm:rehype-stringify@10.0.1",
-    "esbuild": "npm:esbuild@0.20.2",
-    "esbuild/mod.js": "npm:esbuild@0.20.2",
+    "esbuild": "npm:esbuild@0.27.4",
+    "esbuild/mod.js": "npm:esbuild@0.27.4",
     "es-module-lexer": "npm:es-module-lexer@1.5.0",
     "gray-matter": "npm:gray-matter@4.0.3",
     "zod": "npm:zod@3.25.76",
@@ -245,39 +245,39 @@ export default {
     "hast": "npm:@types/hast@3.0.3",
     "unist": "npm:@types/unist@3.0.2",
     "unified": "npm:unified@11.0.5",
-    "vfile": "npm:vfile@6.0.1",
-    "ai": "npm:ai@6.0.33",
-    "ai/react": "npm:@ai-sdk/react@3.0.35",
-    "@ai-sdk/react": "npm:@ai-sdk/react@3.0.35",
-    "@ai-sdk/openai": "npm:@ai-sdk/openai@3.0.28",
-    "@ai-sdk/anthropic": "npm:@ai-sdk/anthropic@3.0.43",
-    "@ai-sdk/google": "npm:@ai-sdk/google@3.0.29",
+    "vfile": "npm:vfile@6.0.3",
+    "ai": "npm:ai@6.0.134",
+    "ai/react": "npm:@ai-sdk/react@3.0.136",
+    "@ai-sdk/react": "npm:@ai-sdk/react@3.0.136",
+    "@ai-sdk/openai": "npm:@ai-sdk/openai@3.0.47",
+    "@ai-sdk/anthropic": "npm:@ai-sdk/anthropic@3.0.63",
+    "@ai-sdk/google": "npm:@ai-sdk/google@3.0.52",
     "@ai-sdk/mistral": "npm:@ai-sdk/mistral@3.0.14",
     "@ai-sdk/provider": "npm:@ai-sdk/provider@3.0.2",
     "@ai-sdk/provider-utils": "npm:@ai-sdk/provider-utils@4.0.5",
-    "tailwindcss": "https://esm.sh/tailwindcss@4.1.8",
-    "tailwindcss/plugin": "https://esm.sh/tailwindcss@4.1.8/plugin",
-    "tailwindcss/defaultTheme": "https://esm.sh/tailwindcss@4.1.8/defaultTheme",
-    "tailwindcss/colors": "https://esm.sh/tailwindcss@4.1.8/colors",
+    "tailwindcss": "https://esm.sh/tailwindcss@4.2.2",
+    "tailwindcss/plugin": "https://esm.sh/tailwindcss@4.2.2/plugin",
+    "tailwindcss/defaultTheme": "https://esm.sh/tailwindcss@4.2.2/defaultTheme",
+    "tailwindcss/colors": "https://esm.sh/tailwindcss@4.2.2/colors",
     "redis": "npm:redis@4.6.13",
     "pg": "npm:pg@8.13.1",
     "jose": "npm:jose@5.9.6",
-    "@opentelemetry/api": "npm:@opentelemetry/api@1",
+    "@opentelemetry/api": "npm:@opentelemetry/api@1.9.0",
     "@opentelemetry/core": "npm:@opentelemetry/core@1",
     "@opentelemetry/context-async-hooks": "npm:@opentelemetry/context-async-hooks@1",
     "@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@1",
     "@opentelemetry/exporter-trace-otlp-http": "npm:@opentelemetry/exporter-trace-otlp-http@0.57",
     "@opentelemetry/resources": "npm:@opentelemetry/resources@1",
-    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@1",
-    "@babel/parser": "npm:@babel/parser@7.26.3",
-    "@babel/traverse": "npm:@babel/traverse@7.26.3",
-    "@babel/generator": "npm:@babel/generator@7.26.3",
-    "@babel/types": "npm:@babel/types@7.26.3",
+    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@1.40.0",
+    "@babel/parser": "npm:@babel/parser@7.29.2",
+    "@babel/traverse": "npm:@babel/traverse@7.29.0",
+    "@babel/generator": "npm:@babel/generator@7.29.1",
+    "@babel/types": "npm:@babel/types@7.29.0",
     "class-variance-authority": "npm:class-variance-authority@0.7.1",
     "clsx": "npm:clsx@2.1.1",
     "tailwind-merge": "npm:tailwind-merge@2.6.0",
-    "@kreuzberg/wasm": "npm:@kreuzberg/wasm@4.4.2",
-    "#kreuzberg-wasm-glue": "npm:@kreuzberg/wasm@4.4.2/dist/pkg/kreuzberg_wasm.js"
+    "@kreuzberg/wasm": "npm:@kreuzberg/wasm@4.5.2",
+    "#kreuzberg-wasm-glue": "npm:@kreuzberg/wasm@4.5.2/dist/pkg/kreuzberg_wasm.js"
   },
   "compilerOptions": {
     "jsx": "react-jsx",
@@ -342,6 +342,7 @@ export default {
     "dupes": "deno run --allow-read scripts/lint/find-duplicate-functions.ts",
     "lint:platform": "deno run --allow-read scripts/lint/lint-platform-agnostic.ts",
     "lint:wildcard-exports": "deno run --allow-read scripts/lint/ban-wildcard-exports.ts",
+    "lint:deps": "deno run --allow-read scripts/lint/audit-deps.ts",
     "lint:barrel-jsdoc": "deno run --allow-read scripts/lint/check-barrel-jsdoc.ts",
     "test:cross-runtime": "deno run --allow-all src/platform/compat/cross-runtime.test.ts",
     "test:node": "node ./tests/node/run-tests.mjs 'src/**/*.test.ts'",
@@ -364,7 +365,8 @@ export default {
     "rlm:explore": "deno run -A scripts/rlm-ts/apps/explore.ts",
     "rlm:audit": "deno run -A scripts/rlm-ts/apps/audit.ts",
     "start-split": "deno task generate && deno run --allow-all cli/main.ts serve --split",
-    "start-split:binary": "deno task generate && deno run --allow-all cli/main.ts serve --split --binary"
+    "start-split:binary": "deno task generate && deno run --allow-all cli/main.ts serve --split --binary",
+    "sbom": "deno run --allow-read --allow-write scripts/build/generate-sbom.ts"
   },
   "lint": {
     "include": [
@@ -417,7 +419,7 @@ export default {
       "npm:onnxruntime-node@1.21.0"
     ],
     "deny": [
-      "npm:esbuild@0.20.2",
+      "npm:esbuild@0.27.4",
       "npm:protobufjs@7.5.4"
     ]
   }

package/src/src/build/production-build/templates.ts

@@ -11,7 +11,7 @@ export const CLIENT_STYLES =
   ".error-container {\n  max-width: 600px;\n  margin: 2rem auto;\n  padding: 2rem;\n  background: #fee;\n  border: 1px solid #fcc;\n  border-radius: 8px;\n  color: #c00;\n}";
 
 export const CLIENT_ROUTER_BUNDLE: string | undefined =
-  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => {\n  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n  return value;\n};\n\n// src/rendering/client/router.ts\nimport { rendererLogger } from "#veryfront/utils";\nimport ReactDOM from "react-dom/client";\nimport {\n  extractPageDataFromScript,\n  NavigationHandlers,\n  PageLoader,\n  PageTransition,\n  ViewportPrefetch\n} from "#veryfront/routing";\nvar logger = rendererLogger.component("veryfront");\nvar VeryfrontRouter = class {\n  constructor(options = {}) {\n    __publicField(this, "baseUrl");\n    __publicField(this, "currentPath");\n    __publicField(this, "root", null);\n    __publicField(this, "options");\n    __publicField(this, "spaMode");\n    __publicField(this, "spaNavigationHandler", null);\n    __publicField(this, "pageLoader");\n    __publicField(this, "navigationHandlers");\n    __publicField(this, "pageTransition");\n    __publicField(this, "viewportPrefetch");\n    __publicField(this, "handleClick");\n    __publicField(this, "handlePopState");\n    __publicField(this, "handleMouseOver");\n    const globalOptions = this.loadGlobalOptions();\n    this.options = { ...globalOptions, ...options };\n    this.baseUrl = this.options.baseUrl || globalThis.location.origin;\n    this.currentPath = globalThis.location.pathname;\n    this.spaMode = this.options.spaMode ?? globalThis.__VERYFRONT_SPA_MODE__ ?? false;\n    this.pageLoader = new PageLoader();\n    this.navigationHandlers = new NavigationHandlers(\n      this.options.prefetchDelay,\n      this.options.prefetch\n    );\n    this.pageTransition = new PageTransition((root) => this.viewportPrefetch.setup(root));\n    this.viewportPrefetch = new ViewportPrefetch(\n      (path) => this.prefetch(path),\n      this.options.prefetch\n    );\n    this.handleClick = this.navigationHandlers.createClickHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handlePopState = this.navigationHandlers.createPopStateHandler({\n      onNavigate: (url) => this.navigate(url, false),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handleMouseOver = this.navigationHandlers.createMouseOverHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n  }\n  registerNavigationHandler(handler) {\n    logger.debug("Registering SPA navigation handler");\n    this.spaNavigationHandler = handler;\n    this.spaMode = true;\n  }\n  loadGlobalOptions() {\n    try {\n      const options = globalThis.__VERYFRONT_ROUTER_OPTS__;\n      if (!options) {\n        logger.debug("No global options configured");\n        return {};\n      }\n      return options;\n    } catch (error) {\n      logger.error("Failed to read global options:", error);\n      return {};\n    }\n  }\n  init() {\n    logger.debug("Initializing client-side router");\n    const rootElement = document.getElementById("root");\n    if (!rootElement) {\n      logger.error("Root element not found");\n      return;\n    }\n    const ReactDOMToUse = globalThis.ReactDOM ?? ReactDOM;\n    this.root = ReactDOMToUse.createRoot(rootElement);\n    document.addEventListener("click", this.handleClick);\n    globalThis.addEventListener("popstate", this.handlePopState);\n    document.addEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.setup(document);\n    this.cacheCurrentPage();\n  }\n  cacheCurrentPage() {\n    const pageData = extractPageDataFromScript();\n    if (pageData)\n      this.pageLoader.setCache(this.currentPath, pageData);\n  }\n  async navigate(url, pushState = true) {\n    logger.debug(`Navigating to ${url} (SPA mode: ${this.spaMode})`);\n    this.navigationHandlers.saveScrollPosition(this.currentPath);\n    this.options.onStart?.(url);\n    if (pushState)\n      globalThis.history.pushState({}, "", url);\n    if (this.spaMode && this.spaNavigationHandler) {\n      await this.loadSpaPage(url);\n    } else {\n      await this.loadPage(url);\n    }\n    this.options.onNavigate?.(url);\n  }\n  async loadSpaPage(path) {\n    logger.debug(`Loading SPA page: ${path}`);\n    try {\n      const spaData = await this.pageLoader.loadSpaPageData(path);\n      await this.spaNavigationHandler?.(spaData);\n      this.currentPath = path;\n      this.handleScrollAfterNavigation();\n      this.options.onComplete?.(path);\n    } catch (error) {\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger.error(`Failed to load SPA page ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    }\n  }\n  handleScrollAfterNavigation() {\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger.warn("scroll handling failed", error);\n    }\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  async loadPage(path, updateUI = true) {\n    if (this.pageLoader.isCached(path)) {\n      logger.debug(`Loading ${path} from cache`);\n      const data = this.pageLoader.getCached(path);\n      if (data) {\n        if (updateUI)\n          this.updatePage(data);\n        return;\n      }\n      logger.warn(`Cache entry for ${path} was unexpectedly null, fetching fresh data`);\n    }\n    this.pageTransition.setLoadingState(true);\n    try {\n      const data = await this.pageLoader.loadPage(path);\n      if (updateUI)\n        this.updatePage(data);\n      this.currentPath = path;\n      this.options.onComplete?.(path);\n    } catch (error) {\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger.error(`Failed to load ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    } finally {\n      this.pageTransition.setLoadingState(false);\n    }\n  }\n  async prefetch(path) {\n    if (this.spaMode) {\n      await this.pageLoader.prefetchSpaPageData(path);\n      return;\n    }\n    await this.pageLoader.prefetch(path);\n  }\n  updatePage(data) {\n    if (!this.root)\n      return;\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    this.pageTransition.updatePage(data, isPopState, scrollY);\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  destroy() {\n    document.removeEventListener("click", this.handleClick);\n    globalThis.removeEventListener("popstate", this.handlePopState);\n    document.removeEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.disconnect();\n    this.pageLoader.clearCache();\n    this.navigationHandlers.clear();\n    this.pageTransition.destroy();\n  }\n};\nif (typeof window !== "undefined" && globalThis.document) {\n  const router = new VeryfrontRouter();\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => router.init(), { once: true });\n  } else {\n    router.init();\n  }\n  globalThis.veryFrontRouter = router;\n}\nexport {\n  VeryfrontRouter\n};\n';
+  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n\n// src/rendering/client/router.ts\nimport { rendererLogger } from "#veryfront/utils";\nimport ReactDOM from "react-dom/client";\nimport {\n  extractPageDataFromScript,\n  NavigationHandlers,\n  PageLoader,\n  PageTransition,\n  ViewportPrefetch\n} from "#veryfront/routing";\nvar logger = rendererLogger.component("veryfront");\nvar VeryfrontRouter = class {\n  constructor(options = {}) {\n    __publicField(this, "baseUrl");\n    __publicField(this, "currentPath");\n    __publicField(this, "root", null);\n    __publicField(this, "options");\n    __publicField(this, "spaMode");\n    __publicField(this, "spaNavigationHandler", null);\n    __publicField(this, "pageLoader");\n    __publicField(this, "navigationHandlers");\n    __publicField(this, "pageTransition");\n    __publicField(this, "viewportPrefetch");\n    __publicField(this, "handleClick");\n    __publicField(this, "handlePopState");\n    __publicField(this, "handleMouseOver");\n    const globalOptions = this.loadGlobalOptions();\n    this.options = { ...globalOptions, ...options };\n    this.baseUrl = this.options.baseUrl || globalThis.location.origin;\n    this.currentPath = globalThis.location.pathname;\n    this.spaMode = this.options.spaMode ?? globalThis.__VERYFRONT_SPA_MODE__ ?? false;\n    this.pageLoader = new PageLoader();\n    this.navigationHandlers = new NavigationHandlers(\n      this.options.prefetchDelay,\n      this.options.prefetch\n    );\n    this.pageTransition = new PageTransition((root) => this.viewportPrefetch.setup(root));\n    this.viewportPrefetch = new ViewportPrefetch(\n      (path) => this.prefetch(path),\n      this.options.prefetch\n    );\n    this.handleClick = this.navigationHandlers.createClickHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handlePopState = this.navigationHandlers.createPopStateHandler({\n      onNavigate: (url) => this.navigate(url, false),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n    this.handleMouseOver = this.navigationHandlers.createMouseOverHandler({\n      onNavigate: (url) => this.navigate(url),\n      onPrefetch: (url) => this.prefetch(url)\n    });\n  }\n  registerNavigationHandler(handler) {\n    logger.debug("Registering SPA navigation handler");\n    this.spaNavigationHandler = handler;\n    this.spaMode = true;\n  }\n  loadGlobalOptions() {\n    try {\n      const options = globalThis.__VERYFRONT_ROUTER_OPTS__;\n      if (!options) {\n        logger.debug("No global options configured");\n        return {};\n      }\n      return options;\n    } catch (error) {\n      logger.error("Failed to read global options:", error);\n      return {};\n    }\n  }\n  init() {\n    logger.debug("Initializing client-side router");\n    const rootElement = document.getElementById("root");\n    if (!rootElement) {\n      logger.error("Root element not found");\n      return;\n    }\n    const ReactDOMToUse = globalThis.ReactDOM ?? ReactDOM;\n    this.root = ReactDOMToUse.createRoot(rootElement);\n    document.addEventListener("click", this.handleClick);\n    globalThis.addEventListener("popstate", this.handlePopState);\n    document.addEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.setup(document);\n    this.cacheCurrentPage();\n  }\n  cacheCurrentPage() {\n    const pageData = extractPageDataFromScript();\n    if (pageData) this.pageLoader.setCache(this.currentPath, pageData);\n  }\n  async navigate(url, pushState = true) {\n    logger.debug(`Navigating to ${url} (SPA mode: ${this.spaMode})`);\n    this.navigationHandlers.saveScrollPosition(this.currentPath);\n    this.options.onStart?.(url);\n    if (pushState) globalThis.history.pushState({}, "", url);\n    if (this.spaMode && this.spaNavigationHandler) {\n      await this.loadSpaPage(url);\n    } else {\n      await this.loadPage(url);\n    }\n    this.options.onNavigate?.(url);\n  }\n  async loadSpaPage(path) {\n    logger.debug(`Loading SPA page: ${path}`);\n    try {\n      const spaData = await this.pageLoader.loadSpaPageData(path);\n      await this.spaNavigationHandler?.(spaData);\n      this.currentPath = path;\n      this.handleScrollAfterNavigation();\n      this.options.onComplete?.(path);\n    } catch (error) {\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger.error(`Failed to load SPA page ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    }\n  }\n  handleScrollAfterNavigation() {\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    try {\n      globalThis.scrollTo(0, isPopState ? scrollY : 0);\n    } catch (error) {\n      logger.warn("scroll handling failed", error);\n    }\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  async loadPage(path, updateUI = true) {\n    if (this.pageLoader.isCached(path)) {\n      logger.debug(`Loading ${path} from cache`);\n      const data = this.pageLoader.getCached(path);\n      if (data) {\n        if (updateUI) this.updatePage(data);\n        return;\n      }\n      logger.warn(`Cache entry for ${path} was unexpectedly null, fetching fresh data`);\n    }\n    this.pageTransition.setLoadingState(true);\n    try {\n      const data = await this.pageLoader.loadPage(path);\n      if (updateUI) this.updatePage(data);\n      this.currentPath = path;\n      this.options.onComplete?.(path);\n    } catch (error) {\n      const normalizedError = error instanceof Error ? error : new Error(String(error));\n      logger.error(`Failed to load ${path}`, normalizedError);\n      this.options.onError?.(normalizedError);\n      this.pageTransition.showError(normalizedError);\n    } finally {\n      this.pageTransition.setLoadingState(false);\n    }\n  }\n  async prefetch(path) {\n    if (this.spaMode) {\n      await this.pageLoader.prefetchSpaPageData(path);\n      return;\n    }\n    await this.pageLoader.prefetch(path);\n  }\n  updatePage(data) {\n    if (!this.root) return;\n    const isPopState = this.navigationHandlers.isPopState();\n    const scrollY = this.navigationHandlers.getScrollPosition(this.currentPath);\n    this.pageTransition.updatePage(data, isPopState, scrollY);\n    this.navigationHandlers.clearPopStateFlag();\n  }\n  destroy() {\n    document.removeEventListener("click", this.handleClick);\n    globalThis.removeEventListener("popstate", this.handlePopState);\n    document.removeEventListener("mouseover", this.handleMouseOver);\n    this.viewportPrefetch.disconnect();\n    this.pageLoader.clearCache();\n    this.navigationHandlers.clear();\n    this.pageTransition.destroy();\n  }\n};\nif (typeof window !== "undefined" && globalThis.document) {\n  const router = new VeryfrontRouter();\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => router.init(), { once: true });\n  } else {\n    router.init();\n  }\n  globalThis.veryFrontRouter = router;\n}\nexport {\n  VeryfrontRouter\n};\n';
 
 export const CLIENT_PREFETCH_BUNDLE: string | undefined =
-  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => {\n  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n  return value;\n};\n\n// src/rendering/client/browser-logger.ts\nvar ConditionalBrowserLogger = class {\n  constructor(prefix, level) {\n    this.prefix = prefix;\n    this.level = level;\n  }\n  log(minLevel, fn, message, ...args) {\n    if (this.level > minLevel)\n      return;\n    fn?.(message, ...args);\n  }\n  debug(message, ...args) {\n    this.log(\n      0 /* DEBUG */,\n      console.debug,\n      `[${this.prefix}] DEBUG: ${message}`,\n      ...args\n    );\n  }\n  info(message, ...args) {\n    this.log(1 /* INFO */, console.log, `[${this.prefix}] ${message}`, ...args);\n  }\n  warn(message, ...args) {\n    this.log(\n      2 /* WARN */,\n      console.warn,\n      `[${this.prefix}] WARN: ${message}`,\n      ...args\n    );\n  }\n  error(message, ...args) {\n    this.log(\n      3 /* ERROR */,\n      console.error,\n      `[${this.prefix}] ERROR: ${message}`,\n      ...args\n    );\n  }\n};\nfunction getBrowserLogLevel() {\n  if (typeof window === "undefined")\n    return 2 /* WARN */;\n  const g = globalThis;\n  const isDevelopment = g.__VERYFRONT_DEV__ || g.__RSC_DEV__;\n  if (!isDevelopment)\n    return 2 /* WARN */;\n  const isDebugEnabled = g.__VERYFRONT_DEBUG__ || g.__RSC_DEBUG__;\n  return isDebugEnabled ? 0 /* DEBUG */ : 1 /* INFO */;\n}\nvar defaultLevel = getBrowserLogLevel();\nvar rscLogger = new ConditionalBrowserLogger("RSC", defaultLevel);\nvar prefetchLogger = new ConditionalBrowserLogger("PREFETCH", defaultLevel);\nvar hydrateLogger = new ConditionalBrowserLogger("HYDRATE", defaultLevel);\nvar browserLogger = new ConditionalBrowserLogger("VERYFRONT", defaultLevel);\n\n// src/rendering/client/prefetch/link-observer.ts\nfunction isAnchorElement(element) {\n  return typeof HTMLAnchorElement !== "undefined" ? element instanceof HTMLAnchorElement : element.tagName === "A";\n}\nvar LinkObserver = class {\n  constructor(options, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "intersectionObserver", null);\n    __publicField(this, "mutationObserver", null);\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "pendingTimeouts", /* @__PURE__ */ new Map());\n    __publicField(this, "elementTimeoutMap", /* @__PURE__ */ new WeakMap());\n    __publicField(this, "timeoutCounter", 0);\n    this.options = options;\n    this.prefetchedUrls = prefetchedUrls;\n  }\n  init() {\n    this.createIntersectionObserver();\n    this.observeLinks();\n    this.setupMutationObserver();\n  }\n  createIntersectionObserver() {\n    this.intersectionObserver = new IntersectionObserver(\n      (entries) => this.handleIntersection(entries),\n      { rootMargin: this.options.rootMargin }\n    );\n  }\n  handleIntersection(entries) {\n    for (const entry of entries) {\n      if (!entry.isIntersecting)\n        continue;\n      if (!isAnchorElement(entry.target))\n        continue;\n      const link = entry.target;\n      if (this.timeoutCounter > 1e6)\n        this.timeoutCounter = 0;\n      const timeoutKey = this.timeoutCounter++;\n      const timeoutId = setTimeout(() => {\n        this.pendingTimeouts.delete(timeoutKey);\n        this.elementTimeoutMap.delete(link);\n        this.options.onLinkVisible(link);\n      }, this.options.delay);\n      this.pendingTimeouts.set(timeoutKey, timeoutId);\n      this.elementTimeoutMap.set(link, timeoutKey);\n    }\n  }\n  observeLinks() {\n    this.observeAnchors(document.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  setupMutationObserver() {\n    this.mutationObserver = new MutationObserver((mutations) => {\n      for (const mutation of mutations) {\n        if (mutation.type !== "childList")\n          continue;\n        for (const node of mutation.addedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE)\n            continue;\n          this.observeElement(node);\n        }\n        for (const node of mutation.removedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE)\n            continue;\n          this.clearElementTimeouts(node);\n        }\n      }\n    });\n    this.mutationObserver.observe(document.body, { childList: true, subtree: true });\n  }\n  clearTimeoutForElement(element) {\n    const timeoutKey = this.elementTimeoutMap.get(element);\n    if (timeoutKey === void 0)\n      return;\n    const timeoutId = this.pendingTimeouts.get(timeoutKey);\n    if (timeoutId !== void 0) {\n      clearTimeout(timeoutId);\n      this.pendingTimeouts.delete(timeoutKey);\n    }\n    this.elementTimeoutMap.delete(element);\n  }\n  clearElementTimeouts(element) {\n    if (isAnchorElement(element))\n      this.clearTimeoutForElement(element);\n    for (const link of element.querySelectorAll("a")) {\n      this.clearTimeoutForElement(link);\n    }\n  }\n  observeElement(element) {\n    if (isAnchorElement(element) && this.isValidLink(element)) {\n      this.intersectionObserver?.observe(element);\n    }\n    this.observeAnchors(element.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  observeAnchors(links) {\n    for (const link of links) {\n      if (!isAnchorElement(link))\n        continue;\n      if (!this.isValidLink(link))\n        continue;\n      this.intersectionObserver?.observe(link);\n    }\n  }\n  isValidLink(link) {\n    if (link.hostname !== globalThis.location.hostname)\n      return false;\n    if (link.hasAttribute("download"))\n      return false;\n    if (link.target === "_blank")\n      return false;\n    const url = link.href;\n    if (this.prefetchedUrls.has(url))\n      return false;\n    if (url === globalThis.location.href)\n      return false;\n    if (link.hash && link.pathname === globalThis.location.pathname)\n      return false;\n    if (link.dataset.noPrefetch)\n      return false;\n    return true;\n  }\n  destroy() {\n    for (const timeoutId of this.pendingTimeouts.values()) {\n      clearTimeout(timeoutId);\n    }\n    this.pendingTimeouts.clear();\n    this.timeoutCounter = 0;\n    this.intersectionObserver?.disconnect();\n    this.intersectionObserver = null;\n    this.mutationObserver?.disconnect();\n    this.mutationObserver = null;\n  }\n};\n\n// src/rendering/client/prefetch/network-utils.ts\nvar NetworkUtils = class {\n  constructor(allowedNetworks = ["4g", "wifi", "ethernet"]) {\n    __publicField(this, "networkInfo");\n    __publicField(this, "allowedNetworks");\n    this.allowedNetworks = allowedNetworks;\n    this.networkInfo = this.getNetworkConnection();\n  }\n  getNavigatorWithConnection() {\n    if (typeof globalThis.navigator === "undefined")\n      return null;\n    return globalThis.navigator;\n  }\n  getNetworkConnection() {\n    const nav = this.getNavigatorWithConnection();\n    return nav?.connection ?? nav?.mozConnection ?? nav?.webkitConnection ?? null;\n  }\n  shouldPrefetch() {\n    if (this.networkInfo?.saveData)\n      return false;\n    const effectiveType = this.networkInfo?.effectiveType;\n    if (effectiveType != null && !this.allowedNetworks.includes(effectiveType))\n      return false;\n    return true;\n  }\n  onNetworkChange(callback) {\n    this.networkInfo?.addEventListener?.("change", callback);\n  }\n  getNetworkInfo() {\n    return this.networkInfo;\n  }\n};\n\n// src/rendering/client/prefetch/prefetch-queue.ts\nimport { PREFETCH_QUEUE_MAX_SIZE_BYTES } from "#veryfront/utils/constants/index.ts";\nvar DEFAULT_OPTIONS = {\n  maxConcurrent: 4,\n  maxSize: PREFETCH_QUEUE_MAX_SIZE_BYTES,\n  timeout: 5e3\n};\nfunction isAbortError(error) {\n  if (typeof error !== "object" || error === null)\n    return false;\n  if (!("name" in error))\n    return false;\n  return error.name === "AbortError";\n}\nvar PrefetchQueue = class {\n  constructor(options = {}, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "controllers", /* @__PURE__ */ new Map());\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "concurrent", 0);\n    __publicField(this, "stopped", false);\n    __publicField(this, "onResourcesFetched");\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n    this.prefetchedUrls = prefetchedUrls ?? /* @__PURE__ */ new Set();\n  }\n  setResourceCallback(callback) {\n    this.onResourcesFetched = callback;\n  }\n  enqueue(url) {\n    void this.prefetch(url);\n  }\n  has(url) {\n    return this.prefetchedUrls.has(url) || this.controllers.has(url);\n  }\n  get size() {\n    return this.controllers.size;\n  }\n  clear() {\n    this.stopAll();\n    this.prefetchedUrls.clear();\n  }\n  start() {\n    this.stopped = false;\n  }\n  stop() {\n    this.stopped = true;\n    this.stopAll();\n  }\n  getQueueSize() {\n    return this.controllers.size;\n  }\n  getConcurrentCount() {\n    return this.concurrent;\n  }\n  async prefetchLink(link) {\n    if (this.stopped)\n      return;\n    const url = link.href;\n    if (!url || this.controllers.has(url) || this.prefetchedUrls.has(url))\n      return;\n    if (this.concurrent >= this.options.maxConcurrent) {\n      prefetchLogger.debug?.(`Prefetch queue full, skipping ${url}`);\n      return;\n    }\n    let parsedUrl;\n    try {\n      parsedUrl = new URL(url);\n    } catch (_) {\n      prefetchLogger.debug?.(`Invalid prefetch URL ${url}`);\n      return;\n    }\n    const controller = new AbortController();\n    this.controllers.set(url, controller);\n    this.concurrent += 1;\n    const timeoutId = this.options.timeout > 0 ? setTimeout(() => controller.abort(), this.options.timeout) : void 0;\n    try {\n      const response = await fetch(parsedUrl.toString(), {\n        method: "GET",\n        signal: controller.signal,\n        headers: { "X-Veryfront-Prefetch": "1" }\n      });\n      if (!response.ok)\n        return;\n      if (this.isResponseTooLarge(response)) {\n        prefetchLogger.debug?.(`Prefetch too large, skipping ${url}`);\n        return;\n      }\n      this.prefetchedUrls.add(url);\n      if (!this.onResourcesFetched)\n        return;\n      try {\n        await this.onResourcesFetched(response, url);\n      } catch (callbackError) {\n        prefetchLogger.error?.(`Prefetch callback failed for ${url}`, callbackError);\n      }\n    } catch (error) {\n      if (!isAbortError(error)) {\n        prefetchLogger.error?.(`Failed to prefetch ${url}`, error);\n      }\n    } finally {\n      if (timeoutId !== void 0)\n        clearTimeout(timeoutId);\n      this.controllers.delete(url);\n      this.concurrent = Math.max(0, this.concurrent - 1);\n    }\n  }\n  async prefetch(url) {\n    const link = typeof document !== "undefined" ? document.createElement("a") : { href: url };\n    link.href = url;\n    await this.prefetchLink(link);\n  }\n  stopAll() {\n    for (const controller of this.controllers.values()) {\n      controller.abort();\n    }\n    this.controllers.clear();\n    this.concurrent = 0;\n  }\n  isResponseTooLarge(response) {\n    const rawLength = response.headers.get("content-length");\n    if (rawLength === null)\n      return false;\n    const size = Number.parseInt(rawLength, 10);\n    if (!Number.isFinite(size))\n      return false;\n    return size > this.options.maxSize;\n  }\n};\nvar prefetchQueue = new PrefetchQueue();\n\n// src/rendering/client/prefetch/resource-hints.ts\nvar ResourceHintsManager = class {\n  constructor() {\n    __publicField(this, "appliedHints", /* @__PURE__ */ new Set());\n  }\n  applyResourceHints(hints) {\n    for (const hint of hints) {\n      const key = `${hint.type}:${hint.href}`;\n      if (this.appliedHints.has(key))\n        continue;\n      const existing = document.querySelector(\n        `link[rel="${hint.type}"][href="${hint.href}"]`\n      );\n      if (existing) {\n        this.appliedHints.add(key);\n        continue;\n      }\n      this.createAndAppendHint(hint);\n      this.appliedHints.add(key);\n      prefetchLogger.debug(`Added resource hint: ${hint.type} ${hint.href}`);\n    }\n  }\n  createAndAppendHint(hint) {\n    if (!document.head) {\n      prefetchLogger.warn("document.head is not available, skipping resource hint");\n      return;\n    }\n    const link = document.createElement("link");\n    link.rel = hint.type;\n    link.href = hint.href;\n    if (hint.as)\n      link.setAttribute("as", hint.as);\n    if (hint.crossOrigin)\n      link.setAttribute("crossorigin", hint.crossOrigin);\n    if (hint.media)\n      link.setAttribute("media", hint.media);\n    document.head.appendChild(link);\n  }\n  extractResourceHints(html, prefetchedUrls) {\n    try {\n      const doc = new DOMParser().parseFromString(html, "text/html");\n      const hints = [];\n      this.extractPreloadLinks(doc, prefetchedUrls, hints);\n      this.extractScripts(doc, prefetchedUrls, hints);\n      this.extractStylesheets(doc, prefetchedUrls, hints);\n      return hints;\n    } catch (error) {\n      prefetchLogger.error("Failed to parse prefetched page", error);\n      return [];\n    }\n  }\n  isValidResourceHintType(rel) {\n    switch (rel) {\n      case "prefetch":\n      case "preload":\n      case "preconnect":\n      case "dns-prefetch":\n        return true;\n      default:\n        return false;\n    }\n  }\n  extractPreloadLinks(doc, prefetchedUrls, hints) {\n    const links = doc.querySelectorAll(\n      \'link[rel="preload"], link[rel="prefetch"]\'\n    );\n    for (const link of links) {\n      const href = link.href;\n      if (!href)\n        continue;\n      if (prefetchedUrls.has(href))\n        continue;\n      if (!this.isValidResourceHintType(link.rel))\n        continue;\n      hints.push({\n        type: link.rel,\n        href,\n        as: link.getAttribute("as") ?? void 0\n      });\n    }\n  }\n  extractScripts(doc, prefetchedUrls, hints) {\n    for (const script of doc.querySelectorAll("script[src]")) {\n      const src = script.src;\n      if (!src || prefetchedUrls.has(src))\n        continue;\n      hints.push({ type: "prefetch", href: src, as: "script" });\n    }\n  }\n  extractStylesheets(doc, prefetchedUrls, hints) {\n    for (const link of doc.querySelectorAll(\'link[rel="stylesheet"]\')) {\n      const href = link.href;\n      if (!href || prefetchedUrls.has(href))\n        continue;\n      hints.push({ type: "prefetch", href, as: "style" });\n    }\n  }\n  static generateResourceHints(_route, assets) {\n    const hints = [\n      \'<link rel="dns-prefetch" href="https://cdn.jsdelivr.net">\',\n      \'<link rel="dns-prefetch" href="https://esm.sh">\',\n      \'<link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>\'\n    ];\n    for (const asset of assets) {\n      if (asset.endsWith(".js")) {\n        hints.push(`<link rel="modulepreload" href="${asset}">`);\n        continue;\n      }\n      if (asset.endsWith(".css")) {\n        hints.push(`<link rel="preload" as="style" href="${asset}">`);\n        continue;\n      }\n      if (/\\.(woff2?|ttf|otf)$/.test(asset)) {\n        hints.push(`<link rel="preload" as="font" href="${asset}" crossorigin>`);\n      }\n    }\n    return hints.join("\\n");\n  }\n};\n\n// src/rendering/client/prefetch.ts\nimport {\n  PREFETCH_DEFAULT_DELAY_MS,\n  PREFETCH_DEFAULT_TIMEOUT_MS,\n  PREFETCH_MAX_SIZE_BYTES\n} from "#veryfront/utils";\nvar PrefetchManager = class {\n  constructor(options = {}) {\n    __publicField(this, "options");\n    __publicField(this, "prefetchedUrls", /* @__PURE__ */ new Set());\n    __publicField(this, "networkUtils");\n    __publicField(this, "linkObserver", null);\n    __publicField(this, "resourceHintsManager");\n    __publicField(this, "prefetchQueue");\n    this.options = {\n      rootMargin: options.rootMargin ?? "50px",\n      delay: options.delay ?? PREFETCH_DEFAULT_DELAY_MS,\n      maxConcurrent: options.maxConcurrent ?? 2,\n      allowedNetworks: options.allowedNetworks ?? ["4g", "wifi", "ethernet"],\n      maxSize: options.maxSize ?? PREFETCH_MAX_SIZE_BYTES,\n      timeout: options.timeout ?? PREFETCH_DEFAULT_TIMEOUT_MS\n    };\n    this.networkUtils = new NetworkUtils(this.options.allowedNetworks);\n    this.resourceHintsManager = new ResourceHintsManager();\n    this.prefetchQueue = new PrefetchQueue(\n      {\n        maxConcurrent: this.options.maxConcurrent,\n        maxSize: this.options.maxSize,\n        timeout: this.options.timeout\n      },\n      this.prefetchedUrls\n    );\n    this.prefetchQueue.setResourceCallback(\n      (response, url) => this.prefetchPageResources(response, url)\n    );\n  }\n  init() {\n    prefetchLogger.info("Initializing prefetch manager");\n    if (!this.networkUtils.shouldPrefetch()) {\n      prefetchLogger.info("Prefetching disabled due to network conditions");\n      return;\n    }\n    this.linkObserver = new LinkObserver(\n      {\n        rootMargin: this.options.rootMargin,\n        delay: this.options.delay,\n        onLinkVisible: (link) => this.prefetchQueue.prefetchLink(link)\n      },\n      this.prefetchedUrls\n    );\n    this.linkObserver.init();\n    this.networkUtils.onNetworkChange(() => {\n      if (!this.networkUtils.shouldPrefetch())\n        this.prefetchQueue.stopAll();\n    });\n  }\n  async prefetchPageResources(response, _pageUrl) {\n    const html = await response.text();\n    const hints = this.resourceHintsManager.extractResourceHints(html, this.prefetchedUrls);\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  applyResourceHints(hints) {\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  async prefetch(url) {\n    await this.prefetchQueue.prefetch(url);\n  }\n  static generateResourceHints(route, assets) {\n    return ResourceHintsManager.generateResourceHints(route, assets);\n  }\n  destroy() {\n    this.linkObserver?.destroy();\n    this.prefetchQueue.stopAll();\n    this.prefetchedUrls.clear();\n  }\n};\nfunction initPrefetch(options) {\n  const prefetchManager = new PrefetchManager(options);\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => prefetchManager.init(), { once: true });\n  } else {\n    prefetchManager.init();\n  }\n  globalThis.veryFrontPrefetch = prefetchManager;\n  return prefetchManager;\n}\nfunction resolveAutoInitOptions() {\n  const setting = globalThis.__VERYFRONT_PREFETCH__;\n  if (!setting)\n    return null;\n  if (setting === true)\n    return {};\n  if (typeof setting === "object")\n    return setting;\n  return null;\n}\nfunction shouldAutoInitPrefetch(options) {\n  if (!options)\n    return false;\n  if (typeof window === "undefined" || typeof document === "undefined")\n    return false;\n  const win = window;\n  const doc = document;\n  if (win.__veryfrontSSRStub || doc.__veryfrontSSRStub)\n    return false;\n  if (typeof IntersectionObserver === "undefined")\n    return false;\n  if (typeof MutationObserver === "undefined")\n    return false;\n  return true;\n}\nvar autoInitOptions = resolveAutoInitOptions();\nif (shouldAutoInitPrefetch(autoInitOptions))\n  initPrefetch(autoInitOptions);\nexport {\n  PrefetchManager,\n  initPrefetch\n};\n';
+  'var __defProp = Object.defineProperty;\nvar __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;\nvar __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);\n\n// src/rendering/client/browser-logger.ts\nvar ConditionalBrowserLogger = class {\n  constructor(prefix, level) {\n    this.prefix = prefix;\n    this.level = level;\n  }\n  log(minLevel, fn, message, ...args) {\n    if (this.level > minLevel) return;\n    fn?.(message, ...args);\n  }\n  debug(message, ...args) {\n    this.log(\n      0 /* DEBUG */,\n      console.debug,\n      `[${this.prefix}] DEBUG: ${message}`,\n      ...args\n    );\n  }\n  info(message, ...args) {\n    this.log(1 /* INFO */, console.log, `[${this.prefix}] ${message}`, ...args);\n  }\n  warn(message, ...args) {\n    this.log(\n      2 /* WARN */,\n      console.warn,\n      `[${this.prefix}] WARN: ${message}`,\n      ...args\n    );\n  }\n  error(message, ...args) {\n    this.log(\n      3 /* ERROR */,\n      console.error,\n      `[${this.prefix}] ERROR: ${message}`,\n      ...args\n    );\n  }\n};\nfunction getBrowserLogLevel() {\n  if (typeof window === "undefined") return 2 /* WARN */;\n  const g = globalThis;\n  const isDevelopment = g.__VERYFRONT_DEV__ || g.__RSC_DEV__;\n  if (!isDevelopment) return 2 /* WARN */;\n  const isDebugEnabled = g.__VERYFRONT_DEBUG__ || g.__RSC_DEBUG__;\n  return isDebugEnabled ? 0 /* DEBUG */ : 1 /* INFO */;\n}\nvar defaultLevel = getBrowserLogLevel();\nvar rscLogger = new ConditionalBrowserLogger("RSC", defaultLevel);\nvar prefetchLogger = new ConditionalBrowserLogger("PREFETCH", defaultLevel);\nvar hydrateLogger = new ConditionalBrowserLogger("HYDRATE", defaultLevel);\nvar browserLogger = new ConditionalBrowserLogger("VERYFRONT", defaultLevel);\n\n// src/rendering/client/prefetch/link-observer.ts\nfunction isAnchorElement(element) {\n  return typeof HTMLAnchorElement !== "undefined" ? element instanceof HTMLAnchorElement : element.tagName === "A";\n}\nvar LinkObserver = class {\n  constructor(options, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "intersectionObserver", null);\n    __publicField(this, "mutationObserver", null);\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "pendingTimeouts", /* @__PURE__ */ new Map());\n    __publicField(this, "elementTimeoutMap", /* @__PURE__ */ new WeakMap());\n    __publicField(this, "timeoutCounter", 0);\n    this.options = options;\n    this.prefetchedUrls = prefetchedUrls;\n  }\n  init() {\n    this.createIntersectionObserver();\n    this.observeLinks();\n    this.setupMutationObserver();\n  }\n  createIntersectionObserver() {\n    this.intersectionObserver = new IntersectionObserver(\n      (entries) => this.handleIntersection(entries),\n      { rootMargin: this.options.rootMargin }\n    );\n  }\n  handleIntersection(entries) {\n    for (const entry of entries) {\n      if (!entry.isIntersecting) continue;\n      if (!isAnchorElement(entry.target)) continue;\n      const link = entry.target;\n      if (this.timeoutCounter > 1e6) this.timeoutCounter = 0;\n      const timeoutKey = this.timeoutCounter++;\n      const timeoutId = setTimeout(() => {\n        this.pendingTimeouts.delete(timeoutKey);\n        this.elementTimeoutMap.delete(link);\n        this.options.onLinkVisible(link);\n      }, this.options.delay);\n      this.pendingTimeouts.set(timeoutKey, timeoutId);\n      this.elementTimeoutMap.set(link, timeoutKey);\n    }\n  }\n  observeLinks() {\n    this.observeAnchors(document.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  setupMutationObserver() {\n    this.mutationObserver = new MutationObserver((mutations) => {\n      for (const mutation of mutations) {\n        if (mutation.type !== "childList") continue;\n        for (const node of mutation.addedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE) continue;\n          this.observeElement(node);\n        }\n        for (const node of mutation.removedNodes) {\n          if (node.nodeType !== Node.ELEMENT_NODE) continue;\n          this.clearElementTimeouts(node);\n        }\n      }\n    });\n    this.mutationObserver.observe(document.body, { childList: true, subtree: true });\n  }\n  clearTimeoutForElement(element) {\n    const timeoutKey = this.elementTimeoutMap.get(element);\n    if (timeoutKey === void 0) return;\n    const timeoutId = this.pendingTimeouts.get(timeoutKey);\n    if (timeoutId !== void 0) {\n      clearTimeout(timeoutId);\n      this.pendingTimeouts.delete(timeoutKey);\n    }\n    this.elementTimeoutMap.delete(element);\n  }\n  clearElementTimeouts(element) {\n    if (isAnchorElement(element)) this.clearTimeoutForElement(element);\n    for (const link of element.querySelectorAll("a")) {\n      this.clearTimeoutForElement(link);\n    }\n  }\n  observeElement(element) {\n    if (isAnchorElement(element) && this.isValidLink(element)) {\n      this.intersectionObserver?.observe(element);\n    }\n    this.observeAnchors(element.querySelectorAll(\'a[href^="/"], a[href^="./"]\'));\n  }\n  observeAnchors(links) {\n    for (const link of links) {\n      if (!isAnchorElement(link)) continue;\n      if (!this.isValidLink(link)) continue;\n      this.intersectionObserver?.observe(link);\n    }\n  }\n  isValidLink(link) {\n    if (link.hostname !== globalThis.location.hostname) return false;\n    if (link.hasAttribute("download")) return false;\n    if (link.target === "_blank") return false;\n    const url = link.href;\n    if (this.prefetchedUrls.has(url)) return false;\n    if (url === globalThis.location.href) return false;\n    if (link.hash && link.pathname === globalThis.location.pathname) return false;\n    if (link.dataset.noPrefetch) return false;\n    return true;\n  }\n  destroy() {\n    for (const timeoutId of this.pendingTimeouts.values()) {\n      clearTimeout(timeoutId);\n    }\n    this.pendingTimeouts.clear();\n    this.timeoutCounter = 0;\n    this.intersectionObserver?.disconnect();\n    this.intersectionObserver = null;\n    this.mutationObserver?.disconnect();\n    this.mutationObserver = null;\n  }\n};\n\n// src/rendering/client/prefetch/network-utils.ts\nvar NetworkUtils = class {\n  constructor(allowedNetworks = ["4g", "wifi", "ethernet"]) {\n    __publicField(this, "networkInfo");\n    __publicField(this, "allowedNetworks");\n    this.allowedNetworks = allowedNetworks;\n    this.networkInfo = this.getNetworkConnection();\n  }\n  getNavigatorWithConnection() {\n    if (typeof globalThis.navigator === "undefined") return null;\n    return globalThis.navigator;\n  }\n  getNetworkConnection() {\n    const nav = this.getNavigatorWithConnection();\n    return nav?.connection ?? nav?.mozConnection ?? nav?.webkitConnection ?? null;\n  }\n  shouldPrefetch() {\n    if (this.networkInfo?.saveData) return false;\n    const effectiveType = this.networkInfo?.effectiveType;\n    if (effectiveType != null && !this.allowedNetworks.includes(effectiveType)) return false;\n    return true;\n  }\n  onNetworkChange(callback) {\n    this.networkInfo?.addEventListener?.("change", callback);\n  }\n  getNetworkInfo() {\n    return this.networkInfo;\n  }\n};\n\n// src/rendering/client/prefetch/prefetch-queue.ts\nimport { PREFETCH_QUEUE_MAX_SIZE_BYTES } from "#veryfront/utils/constants/index.ts";\nvar DEFAULT_OPTIONS = {\n  maxConcurrent: 4,\n  maxSize: PREFETCH_QUEUE_MAX_SIZE_BYTES,\n  timeout: 5e3\n};\nfunction isAbortError(error) {\n  if (typeof error !== "object" || error === null) return false;\n  if (!("name" in error)) return false;\n  return error.name === "AbortError";\n}\nvar PrefetchQueue = class {\n  constructor(options = {}, prefetchedUrls) {\n    __publicField(this, "options");\n    __publicField(this, "controllers", /* @__PURE__ */ new Map());\n    __publicField(this, "prefetchedUrls");\n    __publicField(this, "concurrent", 0);\n    __publicField(this, "stopped", false);\n    __publicField(this, "onResourcesFetched");\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n    this.prefetchedUrls = prefetchedUrls ?? /* @__PURE__ */ new Set();\n  }\n  setResourceCallback(callback) {\n    this.onResourcesFetched = callback;\n  }\n  enqueue(url) {\n    void this.prefetch(url);\n  }\n  has(url) {\n    return this.prefetchedUrls.has(url) || this.controllers.has(url);\n  }\n  get size() {\n    return this.controllers.size;\n  }\n  clear() {\n    this.stopAll();\n    this.prefetchedUrls.clear();\n  }\n  start() {\n    this.stopped = false;\n  }\n  stop() {\n    this.stopped = true;\n    this.stopAll();\n  }\n  getQueueSize() {\n    return this.controllers.size;\n  }\n  getConcurrentCount() {\n    return this.concurrent;\n  }\n  async prefetchLink(link) {\n    if (this.stopped) return;\n    const url = link.href;\n    if (!url || this.controllers.has(url) || this.prefetchedUrls.has(url)) return;\n    if (this.concurrent >= this.options.maxConcurrent) {\n      prefetchLogger.debug?.(`Prefetch queue full, skipping ${url}`);\n      return;\n    }\n    let parsedUrl;\n    try {\n      parsedUrl = new URL(url);\n    } catch (_) {\n      prefetchLogger.debug?.(`Invalid prefetch URL ${url}`);\n      return;\n    }\n    const controller = new AbortController();\n    this.controllers.set(url, controller);\n    this.concurrent += 1;\n    const timeoutId = this.options.timeout > 0 ? setTimeout(() => controller.abort(), this.options.timeout) : void 0;\n    try {\n      const response = await fetch(parsedUrl.toString(), {\n        method: "GET",\n        signal: controller.signal,\n        headers: { "X-Veryfront-Prefetch": "1" }\n      });\n      if (!response.ok) return;\n      if (this.isResponseTooLarge(response)) {\n        prefetchLogger.debug?.(`Prefetch too large, skipping ${url}`);\n        return;\n      }\n      this.prefetchedUrls.add(url);\n      if (!this.onResourcesFetched) return;\n      try {\n        await this.onResourcesFetched(response, url);\n      } catch (callbackError) {\n        prefetchLogger.error?.(`Prefetch callback failed for ${url}`, callbackError);\n      }\n    } catch (error) {\n      if (!isAbortError(error)) {\n        prefetchLogger.error?.(`Failed to prefetch ${url}`, error);\n      }\n    } finally {\n      if (timeoutId !== void 0) clearTimeout(timeoutId);\n      this.controllers.delete(url);\n      this.concurrent = Math.max(0, this.concurrent - 1);\n    }\n  }\n  async prefetch(url) {\n    const link = typeof document !== "undefined" ? document.createElement("a") : { href: url };\n    link.href = url;\n    await this.prefetchLink(link);\n  }\n  stopAll() {\n    for (const controller of this.controllers.values()) {\n      controller.abort();\n    }\n    this.controllers.clear();\n    this.concurrent = 0;\n  }\n  isResponseTooLarge(response) {\n    const rawLength = response.headers.get("content-length");\n    if (rawLength === null) return false;\n    const size = Number.parseInt(rawLength, 10);\n    if (!Number.isFinite(size)) return false;\n    return size > this.options.maxSize;\n  }\n};\nvar prefetchQueue = new PrefetchQueue();\n\n// src/rendering/client/prefetch/resource-hints.ts\nvar ResourceHintsManager = class {\n  constructor() {\n    __publicField(this, "appliedHints", /* @__PURE__ */ new Set());\n  }\n  applyResourceHints(hints) {\n    for (const hint of hints) {\n      const key = `${hint.type}:${hint.href}`;\n      if (this.appliedHints.has(key)) continue;\n      const existing = document.querySelector(\n        `link[rel="${hint.type}"][href="${hint.href}"]`\n      );\n      if (existing) {\n        this.appliedHints.add(key);\n        continue;\n      }\n      this.createAndAppendHint(hint);\n      this.appliedHints.add(key);\n      prefetchLogger.debug(`Added resource hint: ${hint.type} ${hint.href}`);\n    }\n  }\n  createAndAppendHint(hint) {\n    if (!document.head) {\n      prefetchLogger.warn("document.head is not available, skipping resource hint");\n      return;\n    }\n    const link = document.createElement("link");\n    link.rel = hint.type;\n    link.href = hint.href;\n    if (hint.as) link.setAttribute("as", hint.as);\n    if (hint.crossOrigin) link.setAttribute("crossorigin", hint.crossOrigin);\n    if (hint.media) link.setAttribute("media", hint.media);\n    document.head.appendChild(link);\n  }\n  extractResourceHints(html, prefetchedUrls) {\n    try {\n      const doc = new DOMParser().parseFromString(html, "text/html");\n      const hints = [];\n      this.extractPreloadLinks(doc, prefetchedUrls, hints);\n      this.extractScripts(doc, prefetchedUrls, hints);\n      this.extractStylesheets(doc, prefetchedUrls, hints);\n      return hints;\n    } catch (error) {\n      prefetchLogger.error("Failed to parse prefetched page", error);\n      return [];\n    }\n  }\n  isValidResourceHintType(rel) {\n    switch (rel) {\n      case "prefetch":\n      case "preload":\n      case "preconnect":\n      case "dns-prefetch":\n        return true;\n      default:\n        return false;\n    }\n  }\n  extractPreloadLinks(doc, prefetchedUrls, hints) {\n    const links = doc.querySelectorAll(\n      \'link[rel="preload"], link[rel="prefetch"]\'\n    );\n    for (const link of links) {\n      const href = link.href;\n      if (!href) continue;\n      if (prefetchedUrls.has(href)) continue;\n      if (!this.isValidResourceHintType(link.rel)) continue;\n      hints.push({\n        type: link.rel,\n        href,\n        as: link.getAttribute("as") ?? void 0\n      });\n    }\n  }\n  extractScripts(doc, prefetchedUrls, hints) {\n    for (const script of doc.querySelectorAll("script[src]")) {\n      const src = script.src;\n      if (!src || prefetchedUrls.has(src)) continue;\n      hints.push({ type: "prefetch", href: src, as: "script" });\n    }\n  }\n  extractStylesheets(doc, prefetchedUrls, hints) {\n    for (const link of doc.querySelectorAll(\'link[rel="stylesheet"]\')) {\n      const href = link.href;\n      if (!href || prefetchedUrls.has(href)) continue;\n      hints.push({ type: "prefetch", href, as: "style" });\n    }\n  }\n  static generateResourceHints(_route, assets) {\n    const hints = [\n      \'<link rel="dns-prefetch" href="https://cdn.jsdelivr.net">\',\n      \'<link rel="dns-prefetch" href="https://esm.sh">\',\n      \'<link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>\'\n    ];\n    for (const asset of assets) {\n      if (asset.endsWith(".js")) {\n        hints.push(`<link rel="modulepreload" href="${asset}">`);\n        continue;\n      }\n      if (asset.endsWith(".css")) {\n        hints.push(`<link rel="preload" as="style" href="${asset}">`);\n        continue;\n      }\n      if (/\\.(woff2?|ttf|otf)$/.test(asset)) {\n        hints.push(`<link rel="preload" as="font" href="${asset}" crossorigin>`);\n      }\n    }\n    return hints.join("\\n");\n  }\n};\n\n// src/rendering/client/prefetch.ts\nimport {\n  PREFETCH_DEFAULT_DELAY_MS,\n  PREFETCH_DEFAULT_TIMEOUT_MS,\n  PREFETCH_MAX_SIZE_BYTES\n} from "#veryfront/utils";\nvar PrefetchManager = class {\n  constructor(options = {}) {\n    __publicField(this, "options");\n    __publicField(this, "prefetchedUrls", /* @__PURE__ */ new Set());\n    __publicField(this, "networkUtils");\n    __publicField(this, "linkObserver", null);\n    __publicField(this, "resourceHintsManager");\n    __publicField(this, "prefetchQueue");\n    this.options = {\n      rootMargin: options.rootMargin ?? "50px",\n      delay: options.delay ?? PREFETCH_DEFAULT_DELAY_MS,\n      maxConcurrent: options.maxConcurrent ?? 2,\n      allowedNetworks: options.allowedNetworks ?? ["4g", "wifi", "ethernet"],\n      maxSize: options.maxSize ?? PREFETCH_MAX_SIZE_BYTES,\n      timeout: options.timeout ?? PREFETCH_DEFAULT_TIMEOUT_MS\n    };\n    this.networkUtils = new NetworkUtils(this.options.allowedNetworks);\n    this.resourceHintsManager = new ResourceHintsManager();\n    this.prefetchQueue = new PrefetchQueue(\n      {\n        maxConcurrent: this.options.maxConcurrent,\n        maxSize: this.options.maxSize,\n        timeout: this.options.timeout\n      },\n      this.prefetchedUrls\n    );\n    this.prefetchQueue.setResourceCallback(\n      (response, url) => this.prefetchPageResources(response, url)\n    );\n  }\n  init() {\n    prefetchLogger.info("Initializing prefetch manager");\n    if (!this.networkUtils.shouldPrefetch()) {\n      prefetchLogger.info("Prefetching disabled due to network conditions");\n      return;\n    }\n    this.linkObserver = new LinkObserver(\n      {\n        rootMargin: this.options.rootMargin,\n        delay: this.options.delay,\n        onLinkVisible: (link) => this.prefetchQueue.prefetchLink(link)\n      },\n      this.prefetchedUrls\n    );\n    this.linkObserver.init();\n    this.networkUtils.onNetworkChange(() => {\n      if (!this.networkUtils.shouldPrefetch()) this.prefetchQueue.stopAll();\n    });\n  }\n  async prefetchPageResources(response, _pageUrl) {\n    const html = await response.text();\n    const hints = this.resourceHintsManager.extractResourceHints(html, this.prefetchedUrls);\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  applyResourceHints(hints) {\n    this.resourceHintsManager.applyResourceHints(hints);\n  }\n  async prefetch(url) {\n    await this.prefetchQueue.prefetch(url);\n  }\n  static generateResourceHints(route, assets) {\n    return ResourceHintsManager.generateResourceHints(route, assets);\n  }\n  destroy() {\n    this.linkObserver?.destroy();\n    this.prefetchQueue.stopAll();\n    this.prefetchedUrls.clear();\n  }\n};\nfunction initPrefetch(options) {\n  const prefetchManager = new PrefetchManager(options);\n  if (document.readyState === "loading") {\n    document.addEventListener("DOMContentLoaded", () => prefetchManager.init(), { once: true });\n  } else {\n    prefetchManager.init();\n  }\n  globalThis.veryFrontPrefetch = prefetchManager;\n  return prefetchManager;\n}\nfunction resolveAutoInitOptions() {\n  const setting = globalThis.__VERYFRONT_PREFETCH__;\n  if (!setting) return null;\n  if (setting === true) return {};\n  if (typeof setting === "object") return setting;\n  return null;\n}\nfunction shouldAutoInitPrefetch(options) {\n  if (!options) return false;\n  if (typeof window === "undefined" || typeof document === "undefined") return false;\n  const win = window;\n  const doc = document;\n  if (win.__veryfrontSSRStub || doc.__veryfrontSSRStub) return false;\n  if (typeof IntersectionObserver === "undefined") return false;\n  if (typeof MutationObserver === "undefined") return false;\n  return true;\n}\nvar autoInitOptions = resolveAutoInitOptions();\nif (shouldAutoInitPrefetch(autoInitOptions)) initPrefetch(autoInitOptions);\nexport {\n  PrefetchManager,\n  initPrefetch\n};\n';

package/src/src/jobs/runtime-env.ts

@@ -0,0 +1,132 @@
+import { logger as baseLogger } from "../utils/index.js";
+
+const logger = baseLogger.component("job-runtime-env");
+
+export const INJECTED_TASK_ENV_JSON = "VERYFRONT_TASK_ENV_JSON";
+
+const UNSAFE_INJECTED_ENV_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+const HIDDEN_TASK_CONTEXT_ENV_KEYS = new Set([
+  "VERYFRONT_API_TOKEN",
+  "VERYFRONT_API_URL",
+  "VERYFRONT_PROJECT_API_URL",
+  "VERYFRONT_API_BASE_URL",
+  "VERYFRONT_PROJECT_ID",
+  "VERYFRONT_PROJECT_SLUG",
+  "VERYFRONT_BRANCH_REF",
+  "VERYFRONT_API_USER",
+  "VERYFRONT_API_PASS",
+  "VERYFRONT_JOB_RESULT_PATH",
+  INJECTED_TASK_ENV_JSON,
+]);
+
+const DISALLOWED_INJECTED_ENV_KEYS = new Set([
+  "VERYFRONT_API_TOKEN",
+  "VERYFRONT_API_URL",
+  "VERYFRONT_PROJECT_API_URL",
+  "VERYFRONT_API_BASE_URL",
+  "VERYFRONT_PROJECT_ID",
+  "VERYFRONT_PROJECT_SLUG",
+  "VERYFRONT_BRANCH_REF",
+  "VERYFRONT_API_USER",
+  "VERYFRONT_API_PASS",
+  "VERYFRONT_JOB_RESULT_PATH",
+  INJECTED_TASK_ENV_JSON,
+]);
+
+function isHiddenTaskContextEnvKey(key: string): boolean {
+  return key.startsWith("TENANT_") || HIDDEN_TASK_CONTEXT_ENV_KEYS.has(key);
+}
+
+function isDisallowedInjectedEnvKey(key: string): boolean {
+  return key.startsWith("TENANT_") || DISALLOWED_INJECTED_ENV_KEYS.has(key);
+}
+
+function filterExistingProjectEnv(
+  env: Record<string, string> | undefined,
+): Record<string, string> {
+  const filtered: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env ?? {})) {
+    if (
+      UNSAFE_INJECTED_ENV_KEYS.has(key) ||
+      isDisallowedInjectedEnvKey(key) ||
+      typeof value !== "string"
+    ) {
+      continue;
+    }
+    filtered[key] = value;
+  }
+  return filtered;
+}
+
+export function readInjectedProjectEnv(
+  allEnv: Record<string, string>,
+): Record<string, string> {
+  const raw = allEnv[INJECTED_TASK_ENV_JSON];
+  if (!raw) {
+    return {};
+  }
+
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+
+    const injectedEnv = Object.create(null) as Record<string, string>;
+    for (const [key, value] of Object.entries(parsed)) {
+      if (
+        UNSAFE_INJECTED_ENV_KEYS.has(key) ||
+        isDisallowedInjectedEnvKey(key) ||
+        typeof value !== "string"
+      ) {
+        continue;
+      }
+      injectedEnv[key] = value;
+    }
+
+    return injectedEnv;
+  } catch {
+    logger.warn(`Ignoring invalid ${INJECTED_TASK_ENV_JSON}`);
+    return {};
+  }
+}
+
+export function buildTaskContextEnv(
+  allEnv: Record<string, string>,
+  envAllowlist?: string[],
+): Record<string, string> {
+  const allowlistedEnvKeys = envAllowlist ? new Set(envAllowlist) : null;
+  const env: Record<string, string> = {};
+
+  for (const [key, value] of Object.entries(allEnv)) {
+    if (isHiddenTaskContextEnvKey(key)) {
+      continue;
+    }
+    if (allowlistedEnvKeys && !allowlistedEnvKeys.has(key)) {
+      continue;
+    }
+    env[key] = value;
+  }
+
+  for (const [key, value] of Object.entries(readInjectedProjectEnv(allEnv))) {
+    if (allowlistedEnvKeys && !allowlistedEnvKeys.has(key)) {
+      continue;
+    }
+    env[key] = value;
+  }
+
+  return env;
+}
+
+export function mergeInjectedWorkflowEnv(
+  existingEnv: Record<string, string> | undefined,
+  allEnv: Record<string, string>,
+): Record<string, string> | undefined {
+  const mergedEnv = {
+    ...filterExistingProjectEnv(existingEnv),
+    ...readInjectedProjectEnv(allEnv),
+  };
+
+  return Object.keys(mergedEnv).length > 0 ? mergedEnv : undefined;
+}

package/src/src/platform/compat/esbuild-shared.ts

@@ -1,5 +1,5 @@
 import * as dntShim from "../../../_dnt.shims.js";
-export const ESBUILD_VERSION = "0.20.2";
+export const ESBUILD_VERSION = "0.27.4";
 
 export function getEsbuildBinaryName(): string {
   const archMap: Record<string, string> = {

package/src/src/platform/compat/std/front-matter-yaml.ts

@@ -14,13 +14,28 @@ export interface Extract<T> {
 }
 
 type GrayMatterResult<T> = { data: T; content: string; matter?: string };
-type GrayMatterFn = <T = Record<string, unknown>>(content: string) => GrayMatterResult<T>;
+type GrayMatterEngine = { parse: () => never };
+type GrayMatterOptions = { engines?: Record<string, GrayMatterEngine> };
+type GrayMatterFn = <T = Record<string, unknown>>(
+  content: string,
+  options?: GrayMatterOptions,
+) => GrayMatterResult<T>;
 
 const grayMatter: GrayMatterFn = (grayMatterImport as { default?: GrayMatterFn }).default ??
   (grayMatterImport as GrayMatterFn);
 
+/** Security: override both "js" and "javascript" engine aliases to block eval on untrusted frontmatter */
+const DISABLED_ENGINE: GrayMatterEngine = {
+  parse: () => {
+    throw new Error("JavaScript frontmatter is disabled for security");
+  },
+};
+const SAFE_OPTIONS: GrayMatterOptions = {
+  engines: { js: DISABLED_ENGINE, javascript: DISABLED_ENGINE },
+};
+
 export function extract<T = Record<string, unknown>>(text: string): Extract<T> {
-  const result = grayMatter<T>(text);
+  const result = grayMatter<T>(text, SAFE_OPTIONS);
   return {
     attrs: result.data,
     body: result.content,

package/src/src/proxy/cache/redis-cache.ts

@@ -16,6 +16,9 @@ export class RedisCache implements TokenCache {
   private readonly prefix: string;
   private readonly url: string;
   private readonly connectTimeout: number;
+  private readonly tls: boolean;
+  private readonly password?: string;
+  private readonly username?: string;
   private hits = 0;
   private misses = 0;
   private connected = false;
@@ -24,6 +27,9 @@ export class RedisCache implements TokenCache {
     this.url = options.url;
     this.prefix = options.prefix ?? DEFAULT_PREFIX;
     this.connectTimeout = options.connectTimeout ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    this.tls = options.tls ?? options.url.startsWith("rediss://");
+    this.password = options.password;
+    this.username = options.username;
   }
 
   private key(k: string): string {
@@ -212,18 +218,24 @@ export class RedisCache implements TokenCache {
     return withSpan("cache.redis.connect", async () => {
       if (this.connected && this.client) return;
 
-      const client = createClient({
+      // deno-lint-ignore no-explicit-any
+      const clientOpts: Record<string, any> = {
         url: this.url,
         socket: {
           connectTimeout: this.connectTimeout,
-          reconnectStrategy: (retries) => {
+          tls: this.tls || undefined,
+          reconnectStrategy: (retries: number) => {
             if (retries > MAX_RECONNECT_RETRIES) {
               return new Error("Max reconnection attempts reached");
             }
             return Math.min(retries * RECONNECT_BACKOFF_BASE_MS, RECONNECT_BACKOFF_MAX_MS);
           },
         },
-      });
+      };
+      if (this.password) clientOpts.password = this.password;
+      if (this.username) clientOpts.username = this.username;
+
+      const client = createClient(clientOpts);
 
       client.on("error", (err) => {
         logger.error("[RedisCache] Client error", {

package/src/src/proxy/cache/types.ts

@@ -38,6 +38,9 @@ export interface RedisCacheOptions {
   url: string;
   prefix?: string;
   connectTimeout?: number;
+  tls?: boolean;
+  password?: string;
+  username?: string;
 }
 
 export type CacheOptions =