@jant/core 0.6.16 → 0.7.1

package/dist/index.js

@@ -1,6 +1,3 @@
-import { b as url_exports } from "./url-CbLAtlZe.js";
-import { C as toPostView, S as toNavItemViews, T as toSearchResultView, _ as createMediaContext, b as toMediaView, d as defaultFeedRenderer, t as createApp, v as toArchiveGroups, w as toPostViews, x as toNavItemView, y as toArchiveGroupsWithMedia } from "./app-C7_4oab9.js";
-import { B as NAV_ITEM_TYPES, E as time_exports, F as MAX_MEDIA_ATTACHMENTS, H as STATUSES, I as MAX_PINNED_POSTS, K as TEXT_ATTACHMENT_CONTENT_FORMATS, N as FORMATS, V as SORT_ORDERS, s as markdown_exports, z as MEDIA_KINDS } from "./export-Dl5KCiEs.js";
-import "./env-BPYViDJJ.js";
-import "./github-sync-HdK2EgvJ.js";
+import { At as MAX_PINNED_POSTS, Ft as NAV_ITEM_TYPES, Ht as SORT_ORDERS, Ln as url_exports, Nt as MEDIA_KINDS, Tt as FORMATS, Ut as STATUSES, kt as MAX_MEDIA_ATTACHMENTS, qt as TEXT_ATTACHMENT_CONTENT_FORMATS, v as markdown_exports, z as time_exports } from "./github-sync-Gw4orAHk.js";
+import { C as toNavItemView, D as toSearchResultView, E as toPostViews, S as toMediaView, T as toPostView, b as toArchiveGroups, n as createApp, v as defaultFeedRenderer, w as toNavItemViews, x as toArchiveGroupsWithMedia, y as createMediaContext } from "./app-ZcaI1kPN.js";
 export { FORMATS, MAX_MEDIA_ATTACHMENTS, MAX_PINNED_POSTS, MEDIA_KINDS, NAV_ITEM_TYPES, SORT_ORDERS, STATUSES, TEXT_ATTACHMENT_CONTENT_FORMATS, createApp, createMediaContext, defaultFeedRenderer, markdown_exports as markdown, time_exports as time, toArchiveGroups, toArchiveGroupsWithMedia, toMediaView, toNavItemView, toNavItemViews, toPostView, toPostViews, toSearchResultView, url_exports as url };

package/dist/node.js

@@ -1,8 +1,5 @@
-import "./url-CbLAtlZe.js";
-import { A as buildThemeStyle, D as getCjkFontCssVariables, E as BUILTIN_FONT_THEMES, M as getPublicAssetBasePath, N as isAssetPath, O as getFontThemeCssVariables, a as getHostBasedStartupConfigurationIssues, c as getWebhookUrl, f as createStorageDriver, g as schema_exports, h as createNodeDatabase, i as createSiteService, j as BUILTIN_COLOR_THEMES, k as resolveCjkFontProfile, l as setMyCommands, m as sqliteSchemaBundle, n as createNodeCliRuntime, o as resolveDatabaseDialect, p as pgSchemaBundle, r as createNodeRequestRuntime, s as resolveConfig, t as createApp, u as setWebhook } from "./app-C7_4oab9.js";
-import { t as createExportService } from "./export-Dl5KCiEs.js";
-import { C as shouldTrustProxy, S as getTelegramWebhookSecret, b as getSiteResolutionMode, d as getHostedControlPlaneBaseUrl, i as getConfiguredSingleSitePathPrefix, l as getEnvString, r as getConfiguredSingleSiteOrigin, x as getTelegramBotPool, y as getPort } from "./env-BPYViDJJ.js";
-import "./github-sync-HdK2EgvJ.js";
+import { K as getConfiguredStorageDriver, Q as getEnvString, R as now, U as getConfiguredSingleSiteOrigin, W as getConfiguredSingleSitePathPrefix, ct as getPort, dt as getTelegramWebhookSecret, et as getHostedControlPlaneBaseUrl, ft as shouldTrustProxy, lt as getSiteResolutionMode, s as createExportService, ut as getTelegramBotPool } from "./github-sync-Gw4orAHk.js";
+import { A as getFontThemeCssVariables, F as isAssetPath, M as buildThemeStyle, N as BUILTIN_COLOR_THEMES, O as BUILTIN_FONT_THEMES, P as getPublicAssetBasePath, _ as schema_exports, a as setUpNodeInstance, c as resolveDatabaseDialect, d as setMyCommands, f as setWebhook, g as createNodeDatabase, h as sqliteSchemaBundle, i as createNodeRequestRuntime, j as resolveCjkFontProfile, k as getCjkFontCssVariables, l as resolveConfig, m as pgSchemaBundle, n as createApp, o as createSiteService, p as createStorageDriver, r as createNodeCliRuntime, s as getHostBasedStartupConfigurationIssues, u as getWebhookUrl } from "./app-ZcaI1kPN.js";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { serve } from "@hono/node-server";
 import Database from "better-sqlite3";
@@ -422,7 +419,8 @@ async function migrate(env = getProcessBindings()) {
 	}
 	const sqlite = createNodeSqlite(env, { createParentDir: true });
 	try {
-		migrate$1(drizzle(sqlite, { schema: schema_exports }), { migrationsFolder: resolveNodeMigrationsDir(import.meta.url, "sqlite") });
+		const db = drizzle(sqlite, { schema: schema_exports });
+		migrate$1(db, { migrationsFolder: resolveNodeMigrationsDir(import.meta.url, "sqlite") });
 	} finally {
 		sqlite.close();
 	}
@@ -442,7 +440,11 @@ async function createNodeRequestHandler(options) {
 	const env = options?.env ?? getProcessBindings();
 	const hostBasedStartupIssues = getHostBasedStartupConfigurationIssues(env);
 	if (hostBasedStartupIssues.length > 0) throw new Error(`Host-based startup configuration is invalid:\n- ${hostBasedStartupIssues.map((issue) => issue.message).join("\n- ")}`);
-	const { bindings, close } = await createNodeBindings(env);
+	const { bindings: databaseBindings, close } = await createNodeBindings(env);
+	const bindings = {
+		...databaseBindings,
+		NODE_STARTED_AT: now()
+	};
 	try {
 		await assertNodeSiteResolutionReady(bindings);
 		const assetRoot = options?.assetRoot === void 0 ? resolveNodeAssetRoot() : options.assetRoot;
@@ -529,7 +531,7 @@ async function createNodeRequestHandler(options) {
 async function start(env = process.env, app) {
 	const handler = await createNodeRequestHandler({
 		env,
-		app: async () => app ?? (await import("./app-C75Zc8dD.js")).createApp()
+		app: async () => app ?? (await import("./app-ZcaI1kPN.js").then((n) => n.t)).createApp()
 	});
 	const hostname = resolveHost(env);
 	const port = resolvePort(env);
@@ -574,4 +576,4 @@ async function start(env = process.env, app) {
 	});
 }
 //#endregion
-export { BUILTIN_COLOR_THEMES, BUILTIN_FONT_THEMES, buildThemeStyle, createApp, createExportService, createNodeBindings, createNodeCliRuntime, createNodeRequestHandler, createNodeRequestRuntime, createStorageDriver, getCjkFontCssVariables, getFontThemeCssVariables, migrate, resolveCjkFontProfile, resolveConfig, start };
+export { BUILTIN_COLOR_THEMES, BUILTIN_FONT_THEMES, buildThemeStyle, createApp, createExportService, createNodeBindings, createNodeCliRuntime, createNodeRequestHandler, createNodeRequestRuntime, createStorageDriver, getCjkFontCssVariables, getConfiguredStorageDriver, getFontThemeCssVariables, migrate, resolveCjkFontProfile, resolveConfig, setUpNodeInstance, start };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jant/core",
-  "version": "0.6.16",
+  "version": "0.7.1",
   "description": "A modern, open-source microblogging platform built on Cloudflare Workers",
   "type": "module",
   "exports": {
@@ -38,19 +38,26 @@
     "@lingui/react": "^5.9.3",
     "@tailwindcss/typography": "^0.5.19",
     "@tiptap/core": "^3.27.3",
+    "@tiptap/extension-bold": "^3.31.3",
     "@tiptap/extension-code-block": "^3.27.3",
+    "@tiptap/extension-hard-break": "^3.31.3",
     "@tiptap/extension-image": "^3.27.3",
+    "@tiptap/extension-italic": "^3.31.3",
     "@tiptap/extension-link": "^3.27.3",
+    "@tiptap/extension-list": "^3.31.3",
+    "@tiptap/extension-paragraph": "^3.31.3",
     "@tiptap/extension-placeholder": "^3.27.3",
+    "@tiptap/extension-strike": "^3.31.3",
     "@tiptap/extension-table": "^3.27.3",
     "@tiptap/markdown": "^3.27.3",
     "@tiptap/pm": "^3.27.3",
     "@tiptap/starter-kit": "^3.27.3",
     "@tiptap/suggestion": "^3.27.3",
     "basecoat-css": "^0.3.11",
-    "better-auth": "^1.5.5",
+    "better-auth": "1.6.27",
     "better-sqlite3": "^12.8.0",
     "blurhash": "^2.0.5",
+    "client-zip": "^2.5.1",
     "drizzle-orm": "^0.45.1",
     "emoji-mart": "^5.6.0",
     "fflate": "^0.8.2",
@@ -73,6 +80,8 @@
     "unist-util-visit": "^5.1.0",
     "uqr": "^0.1.3",
     "yaml": "^2.8.2",
+    "yauzl": "^3.4.0",
+    "yazl": "^3.3.1",
     "zod": "^4.3.6"
   },
   "peerDependencies": {
@@ -90,18 +99,19 @@
     "@lingui/conf": "^5.9.3",
     "@lingui/format-po": "^5.9.3",
     "@lingui/swc-plugin": "^5.11.0",
-    "@swc/core": "^1.15.18",
+    "@swc/core": "1.15.47",
     "@tailwindcss/vite": "^4.2.2",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.5.0",
     "@types/pg": "^8.20.0",
+    "@types/yauzl": "^3.4.0",
+    "@types/yazl": "^3.3.1",
     "cn-font-split": "^7.4.1",
     "drizzle-kit": "^0.31.10",
     "glob": "^13.0.6",
     "happy-dom": "^20.8.4",
     "sharp": "^0.34.5",
     "tailwindcss": "^4.2.2",
-    "tsx": "^4.21.0",
     "typescript": "^6.0.2",
     "unplugin-swc": "^1.5.9",
     "vite": "^8.0.0",
@@ -136,7 +146,7 @@
     "build:client": "vite build --config vite.config.client.ts",
     "build:site": "vite build --config vite.config.site.ts",
     "build:lib": "node -e \"const{rmSync,readdirSync,existsSync}=require('fs');if(existsSync('dist'))readdirSync('dist').filter(f=>f!=='client').forEach(f=>rmSync('dist/'+f,{recursive:true,force:true}))\" && vite build --config vite.config.worker.ts",
-    "brand:generate": "tsx dev/scripts/generate-brand-assets.ts",
+    "brand:generate": "node dev/run-script.mjs dev/scripts/generate-brand-assets.ts",
     "typecheck": "tsc -b --noEmit",
     "db:generate": "drizzle-kit generate",
     "db:generate:pg": "drizzle-kit generate --config drizzle.config.pg.ts",

package/src/__tests__/auth-session-freshness.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from "vitest";
+import { eq } from "drizzle-orm";
+import { createAuth } from "../auth.js";
+import { createTestDatabase } from "./helpers/db.js";
+import { session as sessionTable } from "../db/schema.js";
+
+/**
+ * better-auth gates `list-sessions` behind a "fresh session" check whose
+ * default window is 24 hours, measured from `session.createdAt` — a value
+ * renewal never moves. Jant deliberately runs 90-day rolling sessions, so
+ * without `freshAge: 0` the Sessions page answers "Session is not fresh"
+ * forever from the second day of a sign-in onwards.
+ */
+async function signUpAndGetCookie(auth: ReturnType<typeof createAuth>) {
+  const signUp = await auth.api.signUpEmail({
+    body: {
+      name: "Owner",
+      email: "owner@example.com",
+      password: "correct-horse-battery",
+    },
+    returnHeaders: true,
+  });
+  const token = signUp.headers
+    .getSetCookie()
+    .find((cookie) => cookie.includes(".session_token="));
+  expect(token).toBeDefined();
+  // Send only the session token, not the `session_data` cache cookie: a cache
+  // hit short-circuits before the database read this test is about.
+  return token!.split(";")[0]!;
+}
+
+describe("session freshness", () => {
+  it("lists sessions that are older than better-auth's default fresh window", async () => {
+    const { db } = createTestDatabase();
+    const auth = createAuth(db, {
+      secret: "test-secret-with-enough-entropy-for-session-cookies",
+      baseURL: "https://example.com",
+      useSecureCookies: true,
+    });
+    const cookie = await signUpAndGetCookie(auth);
+
+    const [row] = await db.select().from(sessionTable);
+    expect(row).toBeDefined();
+    // Two days old: past the 24-hour default, well inside the 90-day window.
+    await db
+      .update(sessionTable)
+      .set({ createdAt: new Date(Date.now() - 2 * 24 * 60 * 60 * 1000) })
+      .where(eq(sessionTable.id, row!.id));
+
+    const sessions = await auth.api.listSessions({
+      headers: new Headers({ cookie }),
+    });
+
+    expect(sessions).toHaveLength(1);
+    expect(sessions[0]!.token).toBe(row!.token);
+  });
+});

package/src/__tests__/basecoat-variants.test.ts

@@ -0,0 +1,121 @@
+/**
+ * BaseCoat variant classes are self-contained, and this is what says so out
+ * loud.
+ *
+ * AGENTS.md has carried the rule under Hard Constraints all along and it was
+ * broken anyway, more than once, because nothing failed when it was: the markup
+ * compiles, every other test passes, and the damage is visible only to an eye
+ * looking at the right pixel.
+ *
+ * What `class="btn btn-outline"` does, exactly: both are single-class
+ * selectors, so specificity ties and source order decides. `.btn-outline` is
+ * declared later, so its `bg-background` wins the background — but it sets no
+ * text colour, so `.btn`'s `text-primary-foreground` survives. A light label on
+ * a light fill: the button reads as empty until `:hover`, where
+ * `.btn-outline:hover` sets `text-accent-foreground` and the words appear. Each
+ * pairing fails for its own reason, which is why the rule is "never combine"
+ * rather than a list of bad pairs.
+ */
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const SRC_DIR = fileURLToPath(new URL("..", import.meta.url));
+
+/**
+ * The BaseCoat families whose variants replace the base class rather than
+ * modify it. Anything of the form `<base>-<x>` is one of `<base>`'s variants.
+ */
+const FAMILIES = ["btn", "badge", "alert"];
+
+/** Class attributes as authored — JSX `className="…"` and Lit `class="…"` alike. */
+const CLASS_ATTR = /\bclass(?:Name)?="([^"]*)"/g;
+
+/**
+ * Walk the source tree for authored markup.
+ *
+ * @param dir - Directory to descend into
+ * @returns Absolute paths of every `.ts`/`.tsx` file outside tests
+ */
+function collectSourceFiles(dir: string): string[] {
+  const found: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) {
+      if (entry === "__tests__" || entry === "node_modules") continue;
+      found.push(...collectSourceFiles(path));
+    } else if (entry.endsWith(".ts") || entry.endsWith(".tsx")) {
+      found.push(path);
+    }
+  }
+  return found;
+}
+
+/**
+ * Every class attribute in the repo's own markup, with the file it came from.
+ *
+ * A `class` built by interpolation is read for its literal words only. That is
+ * the point rather than a limitation: the pairing this guards against is
+ * written literally, and a regex should not try to evaluate a template.
+ *
+ * @returns One entry per class attribute found
+ */
+function readClassAttributes(): Array<{ file: string; classes: string[] }> {
+  const found: Array<{ file: string; classes: string[] }> = [];
+
+  for (const file of collectSourceFiles(SRC_DIR)) {
+    const source = readFileSync(file, "utf8");
+    for (const match of source.matchAll(CLASS_ATTR)) {
+      found.push({
+        file: file.slice(SRC_DIR.length),
+        classes: (match[1] ?? "").split(/\s+/).filter(Boolean),
+      });
+    }
+  }
+
+  return found;
+}
+
+describe("BaseCoat variant classes", () => {
+  it("are never combined with their base class", () => {
+    const offenders: string[] = [];
+
+    for (const { file, classes } of readClassAttributes()) {
+      for (const base of FAMILIES) {
+        if (!classes.includes(base)) continue;
+        const variant = classes.find(
+          (name) => name !== base && name.startsWith(`${base}-`),
+        );
+        if (variant) {
+          offenders.push(`${file}: class="… ${base} ${variant} …"`);
+        }
+      }
+    }
+
+    expect(
+      offenders,
+      [
+        "A BaseCoat variant replaces the base class, it does not modify it.",
+        "Drop the bare base and keep the variant alone:",
+        ...offenders,
+      ].join("\n"),
+    ).toEqual([]);
+  });
+
+  // A guard is worth nothing if the shape it looks for is not the shape the
+  // markup writes, so this pins the reader against real files rather than
+  // trusting the regex.
+  it("reads class attributes out of the real markup", () => {
+    const attributes = readClassAttributes();
+
+    expect(attributes.length).toBeGreaterThan(100);
+    expect(attributes.some(({ classes }) => classes.includes("btn"))).toBe(
+      true,
+    );
+    expect(
+      attributes.some(({ classes }) => classes.includes("btn-outline")),
+    ).toBe(true);
+  });
+});

package/src/__tests__/bin/assets-upload.test.ts

@@ -0,0 +1,68 @@
+import { brotliDecompressSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+import { compressForUpload } from "../../../bin/commands/assets/upload.js";
+
+describe("compressForUpload", () => {
+  it("compresses text assets and round-trips them unchanged", () => {
+    // Repetitive like real CSS, so brotli has something to work with.
+    const body = Buffer.from(
+      ".a{color:var(--site-text-primary)}".repeat(200),
+      "utf8",
+    );
+
+    const packed = compressForUpload("client.css", body);
+
+    expect(packed).not.toBeNull();
+    expect(packed!.length).toBeLessThan(body.length);
+    expect(brotliDecompressSync(packed!).equals(body)).toBe(true);
+  });
+
+  it("leaves already-compressed types alone", () => {
+    // Running brotli over a woff2 or a png costs build time and usually grows
+    // the file; the CDN would then serve a needless encoding header too.
+    const body = Buffer.from("x".repeat(5000), "utf8");
+
+    for (const name of ["font.woff2", "logo.png", "icon.ico", "photo.jpg"]) {
+      expect(compressForUpload(name, body)).toBeNull();
+    }
+  });
+
+  it("falls back to the raw body when compression does not shrink it", () => {
+    // A few random bytes come back larger once the brotli header is added.
+    const body = Buffer.from([0x1f, 0x2e, 0x3d, 0x4c]);
+
+    expect(compressForUpload("tiny.json", body)).toBeNull();
+  });
+
+  it("matches on the extension case-insensitively", () => {
+    const body = Buffer.from("body{margin:0}".repeat(200), "utf8");
+
+    expect(compressForUpload("STYLE.CSS", body)).not.toBeNull();
+  });
+});
+
+describe("stale encoding detection", () => {
+  // `findStaleEncodingKeys` is not exported — it needs a live S3 client — so
+  // these pin the decision it is built on: which files we expect to find
+  // stored as brotli, and which correctly have no `Content-Encoding`.
+  it("expects compression for the types that carry the reader payload", () => {
+    const body = Buffer.from(".x{color:red}".repeat(400), "utf8");
+
+    // A CJK stylesheet is the case that motivated this: its key never changes,
+    // so it was skipped forever and kept being compressed at the CDN's own low
+    // quality on every request.
+    for (const name of ["client-cjk-B7Z0snDu.css", "client-CDPZMBLo.js"]) {
+      expect(compressForUpload(name, body)).not.toBeNull();
+    }
+  });
+
+  it("expects no compression where storing raw is the right answer", () => {
+    // Anything here would be re-uploaded on every run if a missing
+    // `Content-Encoding` counted as stale.
+    const dense = Buffer.from("y".repeat(4000), "utf8");
+    expect(compressForUpload("subset.woff2", dense)).toBeNull();
+
+    const tiny = Buffer.from([0x7a, 0x1b, 0x4f, 0x22]);
+    expect(compressForUpload("meta.json", tiny)).toBeNull();
+  });
+});

package/src/__tests__/dev-scripts.test.ts

@@ -0,0 +1,203 @@
+/**
+ * Every TypeScript dev script loads, and loads the way its task runs it.
+ *
+ * `db-node-rebuild-demo` and `db-node-load-demo` ran their scripts with tsx,
+ * which hands Node `src/` untransformed. When `lib/filter-dimensions.ts` began
+ * declaring its names with the Lingui macro (539cd1bf), both scripts died on
+ * their import lines — and stayed broken for a month, because nothing in CI
+ * ever loaded a dev script. The scripts now run through `dev/run-script.mjs`,
+ * which compiles `src/` the way the builds do. This file holds both halves:
+ * no task goes around the runner, and every script loads through it.
+ *
+ * Loading is not running. A dev script's work sits behind its default export,
+ * so importing one evaluates every module it reaches — where a missing file, an
+ * untransformed macro, or an undefined `define` global fails — without
+ * resetting a database. That contract is checked here too, before anything is
+ * loaded, because a script that broke it would do its work inside this test.
+ *
+ * What loading cannot see: a named import the module no longer exports. Vite's
+ * runner leaves it `undefined` until the script calls it, so a renamed export
+ * is a type error, and `tsconfig.dev.json` is what catches it.
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { parse } from "smol-toml";
+import ts from "typescript";
+import { describe, expect, it } from "vitest";
+
+const CORE_DIR = resolve(import.meta.dirname, "../..");
+const REPO_ROOT = resolve(CORE_DIR, "../..");
+const RUNNER = "dev/run-script.mjs";
+
+/** Every TypeScript dev script, relative to the core package. */
+const SCRIPTS = readdirSync(resolve(CORE_DIR, "dev/scripts"))
+  .filter((name) => name.endsWith(".ts"))
+  .sort()
+  .map((name) => `dev/scripts/${name}`);
+
+/** A dev script path as a command names it, with the word before it. */
+const SCRIPT_INVOCATION = /(\S+)\s+(\S*dev\/scripts\/[\w.-]+\.ts)\b/g;
+
+interface MiseConfig {
+  tasks?: Record<string, { run?: string | string[] }>;
+}
+
+/**
+ * Every shell command the repo defines: mise tasks and core's package scripts.
+ *
+ * @returns Each command with the name of the task or script that runs it
+ */
+function collectCommands(): { name: string; command: string }[] {
+  const mise = parse(
+    readFileSync(resolve(REPO_ROOT, "mise.toml"), "utf8"),
+  ) as MiseConfig;
+  const pkg = JSON.parse(
+    readFileSync(resolve(CORE_DIR, "package.json"), "utf8"),
+  ) as { scripts?: Record<string, string> };
+
+  return [
+    ...Object.entries(mise.tasks ?? {}).flatMap(([name, task]) =>
+      [task.run ?? []].flat().map((command) => ({
+        name: `mise task ${name}`,
+        command,
+      })),
+    ),
+    ...Object.entries(pkg.scripts ?? {}).map(([name, command]) => ({
+      name: `package script ${name}`,
+      command,
+    })),
+  ];
+}
+
+/**
+ * Top-level statements in a dev script that do work when it is imported.
+ *
+ * Declarations are allowed, initializers included — resolving a path at module
+ * scope is fine. A statement of its own at the top level is not: that is where
+ * `await main();` lives.
+ *
+ * @param script - Script path relative to the core package
+ * @returns `path:line` and source text for each offending statement
+ */
+function findTopLevelWork(script: string): string[] {
+  const source = ts.createSourceFile(
+    script,
+    readFileSync(resolve(CORE_DIR, script), "utf8"),
+    ts.ScriptTarget.Latest,
+    true,
+  );
+
+  return source.statements
+    .filter(
+      (statement) =>
+        !ts.isImportDeclaration(statement) &&
+        !ts.isExportDeclaration(statement) &&
+        !ts.isExportAssignment(statement) &&
+        !ts.isFunctionDeclaration(statement) &&
+        !ts.isClassDeclaration(statement) &&
+        !ts.isVariableStatement(statement) &&
+        !ts.isTypeAliasDeclaration(statement) &&
+        !ts.isInterfaceDeclaration(statement) &&
+        !ts.isEnumDeclaration(statement),
+    )
+    .map((statement) => {
+      const { line } = source.getLineAndCharacterOfPosition(
+        statement.getStart(),
+      );
+      return `${script}:${line + 1}: ${statement.getText()}`;
+    });
+}
+
+describe("dev scripts", () => {
+  it("runs every TypeScript dev script through the runner", () => {
+    const invocations = collectCommands().flatMap(({ name, command }) =>
+      [...command.matchAll(SCRIPT_INVOCATION)].map(([, runner, script]) => ({
+        name,
+        runner,
+        script,
+      })),
+    );
+
+    expect(invocations.map(({ script }) => script)).toEqual(
+      expect.arrayContaining([
+        "dev/scripts/bootstrap-node-dev.ts",
+        "dev/scripts/clean-node-dev.ts",
+        "dev/scripts/reset-node-dev.ts",
+        "dev/scripts/import-node-demo-site-export.ts",
+      ]),
+    );
+    expect(
+      invocations.filter(({ runner }) => !runner.endsWith(RUNNER)),
+    ).toEqual([]);
+  });
+
+  it("keeps each script's work behind its default export", () => {
+    expect(SCRIPTS.flatMap(findTopLevelWork)).toEqual([]);
+  });
+
+  it(
+    "loads every script and everything it imports",
+    { timeout: 150_000 },
+    () => {
+      // Loading evaluates each script. One that works at its top level would
+      // do that work here, so it is refused before anything runs.
+      expect(SCRIPTS.flatMap(findTopLevelWork)).toEqual([]);
+
+      // From the repo root, where `brand-export` runs: SWC once resolved its
+      // Lingui plugin against the working directory and failed from there.
+      const fromRoot = (path: string) => `packages/core/${path}`;
+      const result = spawnSync(
+        process.execPath,
+        [fromRoot(RUNNER), "--check", ...SCRIPTS.map(fromRoot)],
+        { cwd: REPO_ROOT, encoding: "utf8", timeout: 120_000 },
+      );
+
+      expect(result.error).toBeUndefined();
+      expect(result.status, result.stderr).toBe(0);
+      expect(result.stdout.trim().split("\n")).toEqual(
+        SCRIPTS.map((script) => `Loaded ${fromRoot(script)}`),
+      );
+    },
+  );
+
+  it(
+    "gives a script the NODE_ENV it was started with",
+    { timeout: 150_000 },
+    () => {
+      // Vite sets NODE_ENV=development when it starts, and a script's child
+      // processes inherit it: `db-node-load-demo`'s build produced Lit's
+      // development bundle that way.
+      const dir = mkdtempSync(join(tmpdir(), "jant-dev-script-"));
+      try {
+        const script = join(dir, "print-node-env.ts");
+        writeFileSync(
+          script,
+          "export default function main(): void {\n  console.log(String(process.env.NODE_ENV));\n}\n",
+        );
+        const env = { ...process.env };
+        delete env.NODE_ENV;
+
+        const result = spawnSync(process.execPath, [RUNNER, script], {
+          cwd: CORE_DIR,
+          encoding: "utf8",
+          env,
+          timeout: 120_000,
+        });
+
+        expect(result.status, result.stderr).toBe(0);
+        expect(result.stdout.trim()).toBe("undefined");
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    },
+  );
+});