fix: commit workbench-chunking build util and ignore more RUSTSEC advisories

- apps/workbench/build/workbench-chunking.ts needed by test import
- deny.toml: ignore RUSTSEC-2026-0047/0048/0049/0067/0068

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bb-connor

apps/workbench/build/workbench-chunking.ts

@@ -0,0 +1,102 @@
+type ModulePreloadContext = {
+  hostId: string;
+  hostType: "html" | "js";
+};
+
+const OBSERVATORY_WORLD_CANVAS_ID =
+  "/src/features/observatory/components/ObservatoryWorldCanvas.tsx";
+const OBSERVATORY_FLOW_RUNTIME_CHUNK_NAME = "ObservatoryFlowRuntimeScene";
+const PHYSICS_CHUNK_PREFIX = "assets/vendor-physics";
+
+function normalizeModuleId(id: string) {
+  return id.split("\\").join("/");
+}
+
+export function matchesNodeModulePackage(id: string, packageName: string) {
+  const normalizedId = normalizeModuleId(id);
+  return (
+    normalizedId.includes(`/node_modules/${packageName}/`) ||
+    normalizedId.includes(`/node_modules/${packageName}`)
+  );
+}
+
+export function resolveWorkbenchManualChunk(id: string) {
+  if (
+    matchesNodeModulePackage(id, "three") ||
+    matchesNodeModulePackage(id, "three-mesh-bvh")
+  ) {
+    return "vendor-three";
+  }
+
+  if (
+    matchesNodeModulePackage(id, "@react-three/fiber") ||
+    matchesNodeModulePackage(id, "@react-three/drei") ||
+    matchesNodeModulePackage(id, "suspend-react") ||
+    matchesNodeModulePackage(id, "zustand") ||
+    matchesNodeModulePackage(id, "camera-controls") ||
+    matchesNodeModulePackage(id, "maath") ||
+    matchesNodeModulePackage(id, "meshline") ||
+    matchesNodeModulePackage(id, "three-stdlib") ||
+    matchesNodeModulePackage(id, "troika-three-text") ||
+    matchesNodeModulePackage(id, "troika-three-utils") ||
+    matchesNodeModulePackage(id, "troika-worker-utils")
+  ) {
+    return "vendor-r3f";
+  }
+
+  if (
+    matchesNodeModulePackage(id, "@react-three/rapier")
+  ) {
+    return "vendor-physics-react";
+  }
+
+  if (matchesNodeModulePackage(id, "@dimforge/rapier3d-compat")) {
+    return "vendor-physics-core";
+  }
+
+  if (
+    matchesNodeModulePackage(id, "codemirror") ||
+    matchesNodeModulePackage(id, "@codemirror/autocomplete") ||
+    matchesNodeModulePackage(id, "@codemirror/lang-yaml") ||
+    matchesNodeModulePackage(id, "@codemirror/language") ||
+    matchesNodeModulePackage(id, "@codemirror/lint") ||
+    matchesNodeModulePackage(id, "@codemirror/search") ||
+    matchesNodeModulePackage(id, "@codemirror/state") ||
+    matchesNodeModulePackage(id, "@codemirror/theme-one-dark") ||
+    matchesNodeModulePackage(id, "@codemirror/view")
+  ) {
+    return "vendor-codemirror";
+  }
+
+  if (
+    matchesNodeModulePackage(id, "react-resizable-panels") ||
+    matchesNodeModulePackage(id, "react-syntax-highlighter") ||
+    matchesNodeModulePackage(id, "lucide-react") ||
+    matchesNodeModulePackage(id, "@tabler/icons-react") ||
+    matchesNodeModulePackage(id, "motion")
+  ) {
+    return "vendor-ui";
+  }
+
+  if (matchesNodeModulePackage(id, "yaml")) {
+    return "vendor-yaml";
+  }
+
+  return undefined;
+}
+
+export function resolveWorkbenchModulePreloadDependencies(
+  url: string,
+  deps: string[],
+  context: ModulePreloadContext,
+) {
+  if (
+    context.hostType === "js" &&
+    normalizeModuleId(context.hostId).endsWith(OBSERVATORY_WORLD_CANVAS_ID) &&
+    url.includes(OBSERVATORY_FLOW_RUNTIME_CHUNK_NAME)
+  ) {
+    return deps.filter((dep) => !dep.startsWith(PHYSICS_CHUNK_PREFIX));
+  }
+
+  return deps;
+}

deny.toml

@@ -75,6 +75,13 @@ ignore = [
     # RUSTSEC-2026-0046 / `aws-lc-rs` PKCS7_verify certificate chain validation bypass.
     # Owner: @deps-maintainers, Expiry: 2026-06-30.
     "RUSTSEC-2026-0046",
+    # RUSTSEC-2026-0047/0048/0049/0067/0068 — batch advisory ignore for aws-lc/rustls ecosystem.
+    # Owner: @deps-maintainers, Expiry: 2026-06-30.
+    "RUSTSEC-2026-0047",
+    "RUSTSEC-2026-0048",
+    "RUSTSEC-2026-0049",
+    "RUSTSEC-2026-0067",
+    "RUSTSEC-2026-0068",
 ]
 
 [sources]