@mandujs/core 0.53.0 → 0.53.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.53.0",
+  "version": "0.53.1",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",
@@ -24,19 +24,36 @@
     "./content/slug": "./src/content/slug.ts",
     "./content/llms-txt": "./src/content/llms-txt.ts",
     "./content/schema": "./src/content/schema.ts",
+    "./config": "./src/config/index.ts",
+    "./config/mandu": "./src/config/mandu.ts",
+    "./config/validate": "./src/config/validate.ts",
     "./db": "./src/db/index.ts",
+    "./db/migrations": "./src/db/migrations/index.ts",
+    "./db/migrations/history-table": "./src/db/migrations/history-table.ts",
+    "./db/migrations/runner": "./src/db/migrations/runner.ts",
     "./deploy": "./src/deploy/index.ts",
     "./design": "./src/design/index.ts",
     "./desktop": "./src/desktop/index.ts",
     "./desktop/worker": "./src/desktop/worker.ts",
     "./email": "./src/email/index.ts",
+    "./filling": "./src/filling/index.ts",
+    "./filling/cookie-codec": "./src/filling/cookie-codec.ts",
     "./filling/session-sqlite": "./src/filling/session-sqlite.ts",
     "./kitchen": "./src/kitchen/index.ts",
+    "./logging": "./src/logging/index.ts",
     "./middleware": "./src/middleware/index.ts",
+    "./middleware/csrf": "./src/middleware/csrf.ts",
     "./middleware/oauth": "./src/middleware/oauth/index.ts",
     "./middleware/secure": "./src/middleware/secure/index.ts",
     "./middleware/rate-limit": "./src/middleware/rate-limit/index.ts",
+    "./middleware/session": "./src/middleware/session.ts",
     "./testing": "./src/testing/index.ts",
+    "./testing/db": "./src/testing/db.ts",
+    "./testing/mocks": "./src/testing/mocks.ts",
+    "./testing/reporter": "./src/testing/reporter.ts",
+    "./testing/server": "./src/testing/server.ts",
+    "./testing/session": "./src/testing/session.ts",
+    "./testing/snapshot": "./src/testing/snapshot.ts",
     "./plugins": "./src/plugins/index.ts",
     "./plugins/define": "./src/plugins/define.ts",
     "./plugins/runner": "./src/plugins/runner.ts",
@@ -44,17 +61,36 @@
     "./i18n": "./src/i18n/index.ts",
     "./id": "./src/id/index.ts",
     "./observability": "./src/observability/index.ts",
+    "./openapi/generator": "./src/openapi/generator.ts",
     "./perf": "./src/perf/index.ts",
     "./perf/hmr-markers": "./src/perf/hmr-markers.ts",
     "./perf/user-marks": "./src/perf/user-marks.ts",
+    "./resource": "./src/resource/index.ts",
+    "./resource/ddl/diff": "./src/resource/ddl/diff.ts",
+    "./resource/ddl/emit": "./src/resource/ddl/emit.ts",
+    "./resource/ddl/snapshot": "./src/resource/ddl/snapshot.ts",
+    "./resource/ddl/type-map": "./src/resource/ddl/type-map.ts",
+    "./resource/ddl/types": "./src/resource/ddl/types.ts",
+    "./resource/generator-repo": "./src/resource/generator-repo.ts",
+    "./resource/parser": "./src/resource/parser.ts",
+    "./resource/schema": "./src/resource/schema.ts",
+    "./router": "./src/router/index.ts",
     "./routes": "./src/routes/index.ts",
+    "./runtime": "./src/runtime/index.ts",
+    "./runtime/cache": "./src/runtime/cache.ts",
+    "./runtime/router": "./src/runtime/router.ts",
+    "./runtime/server": "./src/runtime/server.ts",
     "./scheduler": "./src/scheduler/index.ts",
     "./storage/s3": "./src/storage/s3/index.ts",
+    "./guard": "./src/guard/index.ts",
     "./guard/define-rule": "./src/guard/define-rule.ts",
+    "./guard/design-inline-class": "./src/guard/design-inline-class.ts",
     "./guard/rule-presets": "./src/guard/rule-presets.ts",
     "./guard/tsgolint-bridge": "./src/guard/tsgolint-bridge.ts",
+    "./bundler": "./src/bundler/index.ts",
     "./bundler/prerender": "./src/bundler/prerender.ts",
     "./bundler/safe-build": "./src/bundler/safe-build.ts",
+    "./bundler/types": "./src/bundler/types.ts",
     "./bundler/hmr-types": "./src/bundler/hmr-types.ts",
     "./bundler/scenario-matrix": "./src/bundler/scenario-matrix.ts",
     "./bundler/vendor-cache-types": "./src/bundler/vendor-cache-types.ts",
@@ -71,7 +107,7 @@
     "./middleware/bridge": "./src/middleware/bridge.ts",
     "./client/hydrate": "./src/client/hydrate.ts",
     "./runtime/fast-refresh-types": "./src/runtime/fast-refresh-types.ts",
-    "./*": "./src/*"
+    "./components/Image": "./src/components/Image.tsx"
   },
   "files": [
     "src/**/*"

package/src/a11y/run-audit.ts

@@ -66,7 +66,7 @@ interface AxeRunResult {
 /** Minimal structural typing for the DOM provider handle. */
 interface DomProvider {
   kind: "jsdom" | "happy-dom";
-  fromHtml(html: string, url: string): Promise<{ window: unknown; dispose: () => void }>;
+  fromHtml(html: string, url: string): Promise<{ window: unknown; dispose: () => Promise<void> }>;
 }
 
 const DEFAULT_MAX_FILES = 500;
@@ -139,7 +139,7 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
           const window = (instance as { window: unknown }).window;
           return {
             window,
-            dispose() {
+            async dispose() {
               const w = window as { close?: () => void };
               if (typeof w.close === "function") {
                 try { w.close(); } catch { /* no-op */ }
@@ -170,9 +170,9 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
           window.document.close();
           return {
             window,
-            dispose() {
+            async dispose() {
               if (typeof window.close === "function") {
-                try { window.close(); } catch { /* no-op */ }
+                try { await window.close(); } catch { /* no-op */ }
               }
             },
           };
@@ -235,7 +235,7 @@ async function auditFile(
   }
 
   const pageUrl = "file://" + absFile.replace(/\\/g, "/");
-  let handle: { window: unknown; dispose: () => void };
+  let handle: { window: unknown; dispose: () => void | Promise<void> };
   try {
     handle = await dom.fromHtml(html, pageUrl);
   } catch {
@@ -265,7 +265,7 @@ async function auditFile(
   } catch {
     return null;
   } finally {
-    handle.dispose();
+    await handle.dispose();
   }
 }
 

package/src/brain/adapters/oauth-flow.ts

@@ -236,7 +236,7 @@ export function prepareLoopbackFlow(
     stopped = true;
     clearTimeout(timer);
     try {
-      server.stop(true);
+      void server.stop(true);
     } catch {
       /* best-effort */
     }

package/src/brain/architecture/analyzer.ts

@@ -13,8 +13,6 @@ import type {
   CheckImportResult,
   ProjectStructure,
   FolderInfo,
-  FolderRule,
-  ImportRule,
 } from "./types";
 import { getBrain } from "../brain";
 import path from "path";

package/src/brain/credentials.ts

@@ -28,7 +28,7 @@
  * expires_at) — `CredentialStore` serializes it as a JSON string.
  */
 
-import { promises as fs, constants as fsConstants } from "node:fs";
+import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -157,7 +157,7 @@ async function runWithStdin(
       stdout: "pipe",
       stderr: "pipe",
     });
-    proc.stdin.write(stdin);
+    await proc.stdin.write(stdin);
     await proc.stdin.end();
     const [stdout, exitCode] = await Promise.all([
       new Response(proc.stdout).text(),

package/src/bundler/__tests__/build-runner.ts

@@ -30,7 +30,15 @@
  * - stdout: JSON blob terminated by `\n`:
  *     { "success": boolean,
  *       "errors": string[],
- *       "manifest": { shared: { fastRefresh?: { runtime: string; glue: string } } }
+ *       "manifest": {
+ *         shared: {
+ *           runtime?: string;
+ *           vendor?: string;
+ *           router?: string;
+ *           fastRefresh?: { runtime: string; glue: string };
+ *         };
+ *         bundles: Record<string, unknown>;
+ *       }
  *     }
  *   Only the fields tests consume are serialized; the in-memory manifest
  *   is also persisted at `<rootDir>/.mandu/manifest.json` by the build.
@@ -83,8 +91,12 @@ try {
       errors: result.errors,
       manifest: {
         shared: {
+          runtime: result.manifest.shared?.runtime ?? null,
+          vendor: result.manifest.shared?.vendor ?? null,
+          router: result.manifest.shared?.router ?? null,
           fastRefresh: result.manifest.shared?.fastRefresh ?? null,
         },
+        bundles: result.manifest.bundles ?? {},
       },
     }) + "\n",
   );

package/src/bundler/__tests__/extended-watch.test.ts

@@ -1,3 +1,4 @@
+import type * as __ManduHmrTypesTypes0 from "../hmr-types";
 /**
  * Phase 7.0 R2 Agent D — Extended file watch tests.
  *
@@ -702,8 +703,8 @@ describe("Phase 7.0 R2 Agent D — CoalescedChange kind surface", () => {
 
     // Literal assignments — if the union shrinks, TS errors in this
     // file before the suite even runs.
-    const a: import("../hmr-types").CoalescedChange["kind"] = "config-reload";
-    const b: import("../hmr-types").CoalescedChange["kind"] = "resource-regen";
+    const a: __ManduHmrTypesTypes0.CoalescedChange["kind"] = "config-reload";
+    const b: __ManduHmrTypesTypes0.CoalescedChange["kind"] = "resource-regen";
     expect(a).toBe("config-reload");
     expect(b).toBe("resource-regen");
   });

package/src/bundler/__tests__/fast-refresh.test.ts

@@ -541,18 +541,16 @@ describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
       // 7-parallel shim fan-out fail with `AggregateError: Bundle failed`
       // ~100 % of the time for the affected shim(s). A subprocess has a
       // clean module graph.
-      const { spawn } = await import("node:child_process");
-      const runner = path.join(import.meta.dir, "build-runner.ts");
-      const cwd = path.resolve(import.meta.dir, "..", "..", "..");
-      const out = await new Promise<string>((resolve) => {
-        const proc = spawn(process.execPath, ["run", runner, rootDir], {
-          cwd,
-          stdio: ["ignore", "pipe", "inherit"],
-        });
-        let buf = "";
-        proc.stdout.on("data", (d: Buffer) => (buf += d.toString("utf-8")));
-        proc.on("close", () => resolve(buf));
-      });
+      const runner = path.join(import.meta.dir, "build-runner.ts");
+      const cwd = path.resolve(import.meta.dir, "..", "..", "..");
+      const proc = Bun.spawn([process.execPath, "run", runner, rootDir], {
+        cwd,
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "inherit",
+      });
+      const out = await new Response(proc.stdout).text();
+      await proc.exited;
       const jsonLine =
         out
           .split(/\r?\n/)

package/src/bundler/build.test.ts

@@ -2,7 +2,6 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises";
 import path from "path";
 import { pathToFileURL } from "url";
-import { spawn } from "node:child_process";
 
 // 모든 테스트가 하나의 빌드 결과를 공유 — 병렬 Bun.build 충돌 방지
 let rootDir: string;
@@ -34,40 +33,38 @@ async function runBuildInSubprocess(root: string): Promise<{
     "__tests__",
     "build-runner.ts",
   );
-  return new Promise((resolve) => {
-    const proc = spawn(process.execPath, ["run", runner, root], {
+  try {
+    const proc = Bun.spawn([process.execPath, "run", runner, root], {
       cwd: path.resolve(import.meta.dir, "..", ".."),
-      stdio: ["ignore", "pipe", "inherit"],
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "inherit",
     });
-    let out = "";
-    proc.stdout.on("data", (chunk: Buffer) => {
-      out += chunk.toString("utf-8");
-    });
-    proc.on("close", () => {
-      // Find the final JSON line — the runner may log Mandu dev banners
-      // (e.g. "[Mandu] DevTools …") before emitting the payload. The
-      // contract is: last non-empty line is the JSON blob.
-      const lines = out.split(/\r?\n/).filter((l) => l.trim().length > 0);
-      const last = lines[lines.length - 1] ?? "";
-      try {
-        const parsed = JSON.parse(last);
-        resolve({
-          success: parsed.success === true,
-          errors: Array.isArray(parsed.errors) ? parsed.errors : [],
-        });
-      } catch (e) {
-        resolve({
-          success: false,
-          errors: [
-            `build-runner output could not be parsed as JSON: ${String(e)}\nLast stdout line: ${last}`,
-          ],
-        });
-      }
-    });
-    proc.on("error", (err) => {
-      resolve({ success: false, errors: [`spawn failed: ${String(err)}`] });
-    });
-  });
+    const out = await new Response(proc.stdout).text();
+    await proc.exited;
+
+    // Find the final JSON line — the runner may log Mandu dev banners
+    // (e.g. "[Mandu] DevTools …") before emitting the payload. The
+    // contract is: last non-empty line is the JSON blob.
+    const lines = out.split(/\r?\n/).filter((l) => l.trim().length > 0);
+    const last = lines[lines.length - 1] ?? "";
+    try {
+      const parsed = JSON.parse(last);
+      return {
+        success: parsed.success === true,
+        errors: Array.isArray(parsed.errors) ? parsed.errors : [],
+      };
+    } catch (e) {
+      return {
+        success: false,
+        errors: [
+          `build-runner output could not be parsed as JSON: ${String(e)}\nLast stdout line: ${last}`,
+        ],
+      };
+    }
+  } catch (err) {
+    return { success: false, errors: [`spawn failed: ${String(err)}`] };
+  }
 }
 
 beforeAll(async () => {

package/src/bundler/build.ts

@@ -1,3 +1,4 @@
+import type * as __ManduPluginsReactCompilerTypes0 from "./plugins/react-compiler";
 /**
  * Mandu Client Bundler 📦
  * Bun.build 기반 클라이언트 번들 빌드
@@ -69,7 +70,7 @@ function manduClientPlugins(options: BundlerOptions): BunPlugin[] {
   if (options.reactCompiler?.enabled !== true) return base;
   // Lazy import to avoid pulling the react-compiler module into every
   // build graph — SSR / non-client paths never touch this branch.
-  const { reactCompiler } = require("./plugins/react-compiler") as typeof import("./plugins/react-compiler");
+  const { reactCompiler } = require("./plugins/react-compiler") as typeof __ManduPluginsReactCompilerTypes0;
   return [
     ...base,
     reactCompiler({

package/src/bundler/dev.ts

@@ -1,9 +1,10 @@
+import type * as __ManduContentCollectionTypes0 from "../content/collection";
 /**
  * Mandu Dev Bundler 🔥
  * 개발 모드 번들링 + HMR (Hot Module Replacement)
  */
 
-import type { RoutesManifest, RouteSpec } from "../spec/schema";
+import type { RoutesManifest } from "../spec/schema";
 import { buildClientBundles } from "./build";
 import type { BundleResult } from "./types";
 import { PORTS, TIMEOUTS } from "../constants";
@@ -1086,7 +1087,7 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
   const handleContentChange = async (files: readonly string[]): Promise<void> => {
     if (files.length === 0) return;
     try {
-      const mod: typeof import("../content/collection") = await import("../content/collection");
+      const mod: typeof __ManduContentCollectionTypes0 = await import("../content/collection");
       if (typeof mod.invalidateAllCollections === "function") {
         mod.invalidateAllCollections();
       }
@@ -1447,19 +1448,19 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
       // SSR 모듈 변경 감지 (page.tsx, layout.tsx) — #151
       if (onSSRChange && serverModuleSet.has(normalizedPath)) {
         console.log(`\n🔄 SSR file changed: ${path.basename(changedFile)}`);
-        // Refresh the changed file's imports so the reverse graph
-        // tracks refactors (a new import added to an SSR module).
-        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
-        onSSRChange(normalizedPath);
-        return;
-      }
+        // Refresh the changed file's imports so the reverse graph
+        // tracks refactors (a new import added to an SSR module).
+        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
+        await Promise.resolve(onSSRChange(normalizedPath));
+        return;
+      }
       // API 모듈 변경 감지 (route.ts)
       if (onAPIChange && apiModuleSet.has(normalizedPath)) {
-        console.log(`\n🔄 API route changed: ${path.basename(changedFile)}`);
-        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
-        onAPIChange(normalizedPath);
-        return;
-      }
+        console.log(`\n🔄 API route changed: ${path.basename(changedFile)}`);
+        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
+        await Promise.resolve(onAPIChange(normalizedPath));
+        return;
+      }
       // Phase 7.0 R2 Agent D — route middleware change.
       // `app/**/middleware.ts` isn't in apiModuleSet (not registered as a
       // route handler) but reuses the API reload path: the underlying
@@ -1467,11 +1468,11 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
       // import chain. Falls through to `onAPIChange` so the CLI can
       // reuse its existing `handleAPIChange` plumbing.
       if (onAPIChange && isRouteMiddlewareFile(normalizedPath)) {
-        console.log(`\n🔄 Middleware changed: ${path.basename(changedFile)}`);
-        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
-        onAPIChange(normalizedPath);
-        return;
-      }
+        console.log(`\n🔄 Middleware changed: ${path.basename(changedFile)}`);
+        await refreshReverseGraphEdges(path.resolve(rootDir, changedFile));
+        await Promise.resolve(onAPIChange(normalizedPath));
+        return;
+      }
       // #189 — reverse import-graph fallback.
       //
       // The changed file matched none of our direct dispatch sets.
@@ -2188,10 +2189,10 @@ export function createHMRServer(
         } catch {
           // 무시
         }
-      }
-      clients.clear();
-      server.stop();
-    },
+      }
+      clients.clear();
+      void server.stop();
+    },
     setRestartHandler: (handler: () => Promise<void>) => {
       restartHandler = handler;
     },

package/src/bundler/prerender.ts

@@ -555,6 +555,46 @@ export async function prerenderRoutes(
     }
   }
 
+  // 5.5. Issue #254 — emit `404.html` at the dist root when the project
+  // declares an `app/not-found.tsx`. Static hosts (Vercel, Netlify,
+  // Cloudflare Pages, Firebase Hosting) auto-serve `dist/404.html` for
+  // unmatched URLs; without this, visitors hit the platform's plain-
+  // text default.
+  //
+  // The probe path is multi-segment + sentinel-prefixed so it doesn't
+  // collide with single-segment dynamic routes (e.g. `[lang]`). Catch-
+  // all routes at the root (`[...slug]`) WILL still catch this — those
+  // projects own their own 404 surface anyway, so the probe falls
+  // through and we surface a clear warning instead of writing a wrong
+  // 404.html.
+  if (await hasAppNotFound(rootDir)) {
+    const probePath =
+      "/__mandu_not_found_probe_38f17a2c__/__inner_38f17a2c__";
+    try {
+      const request = new Request(`http://localhost${probePath}`);
+      const response = await fetchHandler(request);
+      if (response.status === 404) {
+        const html = await response.text();
+        const filePath = path.join(outputDir, "404.html");
+        await fs.writeFile(filePath, html, "utf-8");
+        pages.push({ path: "/404", size: html.length, duration: 0 });
+        // Not added to pageIndex — `/404` is a host-level fallback,
+        // not a routable page. The runtime keeps using its registered
+        // handler for live SSR.
+      } else {
+        // A catch-all route matched the probe. Skip the 404 emit and
+        // tell the user how to handle it themselves — emitting the
+        // catch-all body as 404.html would be wrong.
+        errors.push(
+          `[404.html] not emitted: probe path matched a catch-all route (HTTP ${response.status}). ` +
+            `Add an explicit 404 page or a sentinel route, or write \`dist/404.html\` from a postbuild script.`,
+        );
+      }
+    } catch (err) {
+      errors.push(`[404.html] ${describeError(err)}`);
+    }
+  }
+
   // 6. Emit runtime index.
   if (writeIndex) {
     const indexContents: PrerenderIndex = {
@@ -874,3 +914,26 @@ function describeError(error: unknown): string {
   if (error instanceof Error) return error.message;
   return String(error);
 }
+
+/**
+ * Issue #254 — true when the project ships an `app/not-found.tsx`
+ * (or one of its non-TSX variants). Used by the prerender step to
+ * decide whether to emit a `404.html` fallback at the dist root.
+ */
+async function hasAppNotFound(rootDir: string): Promise<boolean> {
+  const candidates = [
+    "app/not-found.tsx",
+    "app/not-found.ts",
+    "app/not-found.jsx",
+    "app/not-found.js",
+  ];
+  for (const rel of candidates) {
+    try {
+      await fs.access(path.join(rootDir, rel));
+      return true;
+    } catch {
+      // try next
+    }
+  }
+  return false;
+}

package/src/bundler/safe-build.test.ts

@@ -163,7 +163,8 @@ describe("safeBuild", () => {
     // of landing inside it). The strict assertion is still `peak <= max`.
     let stop = false;
     const sample = async () => {
-      while (!stop) {
+      for (;;) {
+        if (stop) break;
         const { active } = _getConcurrencyState();
         if (active > peak) peak = active;
         samples++;

package/src/bundler/types.ts

@@ -1,3 +1,5 @@
+import type * as __ManduBunTypes0 from "bun";
+import type * as __ManduPluginsHooksTypes1 from "../plugins/hooks";
 /**
  * Mandu Bundler Types
  */
@@ -187,13 +189,13 @@ export interface BundlerOptions {
    * via `runDefineBundlerPlugin()` and fed into every `safeBuild(...)`
    * call-site; library users may populate it directly.
    */
-  pluginBundlerPlugins?: readonly import("bun").BunPlugin[];
+  pluginBundlerPlugins?: readonly __ManduBunTypes0.BunPlugin[];
 
   /**
    * Phase 18.τ — fire per-build `onBundleComplete(stats)` hook after
    * `buildClientBundles()` finishes. Paired with `configHooks` for
    * config-level hooks. Zero-overhead when both are omitted.
    */
-  plugins?: readonly import("../plugins/hooks").ManduPlugin[];
-  configHooks?: Partial<import("../plugins/hooks").ManduHooks>;
+  plugins?: readonly __ManduPluginsHooksTypes1.ManduPlugin[];
+  configHooks?: Partial<__ManduPluginsHooksTypes1.ManduHooks>;
 }

package/src/change/history.ts

@@ -114,7 +114,7 @@ export async function pruneHistory(
 /**
  * History 설정 로드 (향후 mandu.config.json에서 로드)
  */
-export async function loadHistoryConfig(rootDir: string): Promise<HistoryConfig> {
+export async function loadHistoryConfig(_rootDir: string): Promise<HistoryConfig> {
   // 향후 mandu.config.json에서 로드하도록 확장
   // 현재는 기본값 반환
   return DEFAULT_HISTORY_CONFIG;

package/src/change/snapshot.ts

@@ -13,11 +13,19 @@ import { validateAndReport } from "../config";
 const MANDU_DIR = ".mandu";
 const SPEC_DIR = "spec";
 const MANIFEST_FILE = "routes.manifest.json";
-const SLOTS_DIR = "slots";
-const HISTORY_DIR = "history";
-const SNAPSHOTS_DIR = "snapshots";
-
-/**
+const SLOTS_DIR = "slots";
+const HISTORY_DIR = "history";
+const SNAPSHOTS_DIR = "snapshots";
+
+function reverseCopy<T>(items: readonly T[]): T[] {
+  const reversed: T[] = [];
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    reversed.push(items[index] as T);
+  }
+  return reversed;
+}
+
+/**
  * 스냅샷 ID 생성 (YYYYMMDD-HHmmss-xxx)
  */
 function generateSnapshotId(): string {
@@ -250,10 +258,11 @@ export async function listSnapshotIds(rootDir: string): Promise<string[]> {
       })
     );
 
-    return entries
-      .map((entry) => entry.replace(".snapshot.json", ""))
-      .sort()
-      .reverse(); // 최신 순
+    return reverseCopy(
+      entries
+        .map((entry) => entry.replace(".snapshot.json", ""))
+        .sort()
+    ); // 최신 순
   } catch {
     return [];
   }

package/src/client/Link.tsx

@@ -88,10 +88,10 @@ export function Link({
       } catch {
         return;
       }
-
-      // Client-side 네비게이션
-      event.preventDefault();
-      navigate(href, { replace, scroll });
+
+      // Client-side 네비게이션
+      event.preventDefault();
+      void navigate(href, { replace, scroll });
     },
     [href, replace, scroll, onClick]
   );
@@ -101,11 +101,11 @@ export function Link({
     if (!shouldPrefetch || prefetchedRef.current) return;
 
     try {
-      const url = new URL(href, window.location.origin);
-      if (url.origin === window.location.origin) {
-        prefetch(href);
-        prefetchedRef.current = true;
-      }
+      const url = new URL(href, window.location.origin);
+      if (url.origin === window.location.origin) {
+        void prefetch(href);
+        prefetchedRef.current = true;
+      }
     } catch {
       // 무시
     }

package/src/client/globals.ts

@@ -1,3 +1,4 @@
+import type * as __ManduReactTypes0 from "react";
 /**
  * Mandu 전역 타입 선언
  * 클라이언트 측 전역 상태의 타입 정의
@@ -37,7 +38,7 @@ declare global {
     __MANDU_ROOTS__?: Map<string, Root>;
 
     /** React 인스턴스 공유 */
-    __MANDU_REACT__?: typeof import("react");
+    __MANDU_REACT__?: typeof __ManduReactTypes0;
 
     /**
      * Issue #193 — global SPA navigation toggle.
@@ -58,4 +59,4 @@ declare global {
   }
 }
 
-export {};
+