The tests for the `init` package were failing with a `PermissionDenied`error in Jules container environment when creating temporarydirectories. This was because the tests were attempting to create thetemporary directories in the root of the project, where permissions areoften restricted.This change corrects the issue by removing the local `withTmpDir` helperfunction in `packages/init/src/init_test.ts` and instead using the onefrom `../../fresh/src/test_utils.ts`. The shared helper functioncorrectly creates temporary directories in the operating system'sdefault temporary directory, which resolves the permission issue.Sample error message from Jules before this fix:``` ERRORS init - new project => ./packages/init/src/init_test.ts:99:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);                         ^    at Object.makeTempDir (ext:deno_fs/30_fs.js:168:10)    at withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:26)    at withTmpDir (file:///app/packages/init/src/init_test.ts:41:10)    at file:///app/packages/init/src/init_test.ts:100:27init - create project dir => ./packages/init/src/init_test.ts:107:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async file:///app/packages/init/src/init_test.ts:108:21init - with tailwind => ./packages/init/src/init_test.ts:122:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);                         ^    at Object.makeTempDir (ext:deno_fs/30_fs.js:168:10)    at withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:26)    at withTmpDir (file:///app/packages/init/src/init_test.ts:41:10)    at file:///app/packages/init/src/init_test.ts:123:27init - with vscode => ./packages/init/src/init_test.ts:140:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async file:///app/packages/init/src/init_test.ts:141:21init - fmt, lint, and type check project => ./packages/init/src/init_test.ts:153:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async fn (file:///app/packages/init/src/init_test.ts:159:23)init with tailwind - fmt, lint, and type check project => ./packages/init/src/init_test.ts:179:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async file:///app/packages/init/src/init_test.ts:182:23init - can start dev server => ./packages/init/src/init_test.ts:205:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async fn (file:///app/packages/init/src/init_test.ts:211:23)init - can start built project => ./packages/init/src/init_test.ts:233:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);              ^    at async withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:15)    at async file:///app/packages/init/src/init_test.ts:234:21init - errors on missing build cache in prod => ./packages/init/src/init_test.ts:265:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);                         ^    at Object.makeTempDir (ext:deno_fs/30_fs.js:168:10)    at withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:26)    at withTmpDir (file:///app/packages/init/src/init_test.ts:41:10)    at file:///app/packages/init/src/init_test.ts:266:27init - with vite => ./packages/init/src/init_test.ts:348:6error: PermissionDenied: Permission denied (os error 13): tmpdir  const dir = await Deno.makeTempDir(options);                         ^    at Object.makeTempDir (ext:deno_fs/30_fs.js:168:10)    at withTmpDir (file:///app/packages/fresh/src/test_utils.ts:136:26)    at withTmpDir (file:///app/packages/init/src/init_test.ts:41:10)    at file:///app/packages/init/src/init_test.ts:349:27 FAILURES init - new project => ./packages/init/src/init_test.ts:99:6init - create project dir => ./packages/init/src/init_test.ts:107:6init - with tailwind => ./packages/init/src/init_test.ts:122:6init - with vscode => ./packages/init/src/init_test.ts:140:6init - fmt, lint, and type check project => ./packages/init/src/init_test.ts:153:6init with tailwind - fmt, lint, and type check project => ./packages/init/src/init_test.ts:179:6init - can start dev server => ./packages/init/src/init_test.ts:205:6init - can start built project => ./packages/init/src/init_test.ts:233:6init - errors on missing build cache in prod => ./packages/init/src/init_test.ts:265:6init - with vite => ./packages/init/src/init_test.ts:348:6FAILED | 449 passed (14 steps) | 10 failed | 17 ignored (2m38s)```---------Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Detect if a file is ESM based on file extension or finding ESM-onlystatements. When we know that it's an ESM file we should keep`require()` calls as is, because some libraries use it as a conditionalcheck like `npm:motion`.Fixes#3429

Our validation didn't account for `_middleware` files exporting an Arrayof middlewares.Fixes#3400

Added a CSP and header middleware to simplify the HTTP Security ResponseHeader creation.Fixes:-#1705Example:```ts// main.tsexport const app = new App<State>()    .use(csp({        reportTo: '/api/csp-reports',    }))    .use(headers({        'Cross-Origin-Resource-Policy': 'same-site',        'Cross-Origin-Embedder-Policy': 'require-corp',        'Cross-Origin-Opener-Policy': 'same-origin',        'Permissions-Policy':            'geolocation=(), camera=(), microphone=(), payment=(), usb=(), bluetooth=(), magnetometer=(), gyroscope=(), accelerometer=()',        'Referrer-Policy': 'strict-origin-when-cross-origin',        'X-Content-Type-Options': 'nosniff',        'X-Frame-Options': 'DENY',        'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',    }))```Endpoint example:```ts// routes/api/csp-handler.tsimport { Context } from 'fresh';import { State } from '../../main.ts';export const handler = {    async POST(ctx: Context<State>) {        try {            const text = await ctx.req.text();            const body = JSON.parse(text);            const logEntry = {                timestamp: new Date().toISOString(),                report: body,                userAgent: ctx.req.headers.get('user-agent') || 'unknown',            };            await Deno.writeFile('csp-reports.log', new TextEncoder().encode(JSON.stringify(logEntry) + '\n'), { append: true });            return new Response(JSON.stringify({ status: "ok" }), { status: 200 });        } catch (error) {            console.error("Error handling CSP report:", error);            return new Response(JSON.stringify({ status: "error", error: String(error) }), { status: 500 });        }    },};```Implementing these headers improved the security report at [SecurityHeaders](securityheaders.com) from F to A and helps to prevent securityvulnerabilities like Cross-Site Scripting and Clickjacking.**Before**<img width="1200" height="308" alt="image"src="https://github.com/user-attachments/assets/01adfff4-5bb4-4cc6-bd8f-5e74b471301b"/>**After**<img width="1200" height="335" alt="image"src="https://github.com/user-attachments/assets/c5a9b07e-babf-4797-b47d-4368de70cbc3"/>---------Co-authored-by: Marvin Hagemeister <marvin@deno.com>

Fixes#3426

This PR makes nested islands work. Problem was that only entry fileshave the `src` property in the vite manifest. For that we need to ensurethat every island is an entry point.Fixes#3439

This fixes the testing page in the docs for real this time.Every test is hand checked now. Thanks to a certain button, whichappeared recently.Optionally I can also split this page up in separate pages:- Middlewars- AppWrappers and Layouts- Routing and Handlers- SSR and Islands

Hoping that this helps folks who ignore the migration guide and keep theentry pointed to `main.ts`.

- @fresh/core@2.1.0- @fresh/plugin-vite@1.0.3- @fresh/update@2.1.0- @fresh/init@2.0.9