WEBJS_PUBLIC_* env vars accessible as process.env.* in the browser

[vivek7405]

Summary

End-user webjs apps can now read process.env.WEBJS_PUBLIC_* directly in browser-bound code, the no-build equivalent of Next.js's NEXT_PUBLIC_ convention.

How it works

SSR injects an inline <script> in the HTML head before the importmap and any module code:

<script>
  window.process = window.process || {};
  window.process.env = Object.assign(window.process.env || {}, {
    "WEBJS_PUBLIC_API_URL": "https://api.example.com",
    "WEBJS_PUBLIC_STRIPE_KEY": "pk_live_abc",
    "NODE_ENV": "production"
  });
</script>

After that, process.env.WEBJS_PUBLIC_API_URL is a real property read on a real object in the browser. No transform step. No build.

What's exposed and what isn't

• Exposed: every env var whose name starts with WEBJS_PUBLIC_.
• Server-only: everything else. DATABASE_URL, AUTH_SECRET, OAuth secrets, third-party API keys never reach the browser, even if a component naively writes process.env.DATABASE_URL (reads as undefined).
• NODE_ENV: always defined, 'development' in webjs dev, 'production' in webjs start. Side benefit: fixes vendor bundles that probe process.env.NODE_ENV (lit, react, etc.) and previously threw ReferenceError in the browser.

Safety

• Prefix is fail-closed. Typos read as undefined.
• JSON-encoded values with </ escaped to <\/ so a malicious env value containing </script> cannot terminate the inline script tag.
• CSP nonce, when present on the request, propagates to the shim's script tag (matches the existing inline scripts).

Commits

Three:

• feat(server): the shim in ssr.js, with a publicEnvShim() helper exported for tests
• test: 10 unit tests in test/public-env-shim.test.js plus 1 integration test in test/ssr.test.js
• docs(site): replaces the old "never reference process.env in components" warning with a real explanation on the Configuration page

Test plan

• npm test passes, 907 of 907 (11 new shim tests)
• Unit tests cover filter, NODE_ENV, undefined handling, value coercion, script-tag-injection escaping, nonce propagation, and that the emitted script body parses and executes correctly
• Integration test confirms a real SSR render injects the shim with the right values and that unprefixed secrets do not leak