Next.js routes CSP nonces into loading scripts, Turborepo trims config reads

The nonce fix lands in `createComponentStylesAndScripts`, which renders scripts for a segment's loading, error, and template files. Unlike `getLayerAssets`, it did not pass `ctx.nonce`, so script tags produced for those files shipped without the nonce even when a CSP nonce was configured [1]. This is a behavior change for anyone running a nonce-based `script-src`: those tags now carry the nonce and will execute under a policy that previously blocked them.

On the caching side, `use-cache` entries can now store RSC values containing client reference proxies [2]. Flight serializes each reference using the client module `id`, export `name`, client `chunk` list, and `async`, and decoding resolves the client module `id` through `rscModuleMapping` to find the corresponding RSC module; the client chunk list is not needed at decode time. In the same area, Turbopack fixed a require-handling regression where a Vue SFC compiler import failed with "Module not found: Can't resolve 'less'" [3], which the PR traces to two earlier changes around default parameter assignment and the `unknown | WellKnownFunction` type.

Turborepo ran a performance sweep across four separate code paths. The `no-undeclared-env-vars` ESLint rule is created once per source file and cached the `Project`, but every creation still scanned all workspaces for `turbo.json`/`turbo.jsonc` and MD5-hashed each config to validate the cache, so a warm cache still did O(source files x workspace configs) synchronous filesystem work; it now validates the cached project at most once [4]. File tracing gained memoized resolver inference per source directory for the duration of a single trace, replacing per-file filesystem probes and resolver construction that sibling files were repeating [5]. `invalidate_path_candidates` now collects matching entries instead of cloning the registration's entire `GlobSet` before and after every removal, which previously retained N^2 include entries under the shared state write lock [6]. And `RunBuilder::build` no longer preloads every workspace's turbo.json before resolving package scope: preloading now happens after scope resolution, scoped to what the engine will actually consult, so a run scoped to a single package no longer pays the whole-repository config walk [7].

On the eve side, workflow tool steps can now authorize: `ctx.getToken` and `ctx.requireAuth` used to throw inside workflow bodies, and steps only saw `process.env`. Both now work inside a "use step" helper that receives `ctx` as a direct argument. Sign-in ends the step attempt, the workflow parks on its own callback hook, and after the callback eve retries that step and continues the body, with tokens never entering durable history [8]. Queued sibling completions from the same parent turn are now batched into a single delivery rather than starting separate parent model turns, with failures, input requests, updates, user messages, and different cohorts kept as separate boundaries and no timer or wait for unfinished siblings [9].