@mandujs/core 0.53.0 → 0.53.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.53.0",
+  "version": "0.53.2",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",
@@ -24,19 +24,36 @@
     "./content/slug": "./src/content/slug.ts",
     "./content/llms-txt": "./src/content/llms-txt.ts",
     "./content/schema": "./src/content/schema.ts",
+    "./config": "./src/config/index.ts",
+    "./config/mandu": "./src/config/mandu.ts",
+    "./config/validate": "./src/config/validate.ts",
     "./db": "./src/db/index.ts",
+    "./db/migrations": "./src/db/migrations/index.ts",
+    "./db/migrations/history-table": "./src/db/migrations/history-table.ts",
+    "./db/migrations/runner": "./src/db/migrations/runner.ts",
     "./deploy": "./src/deploy/index.ts",
     "./design": "./src/design/index.ts",
     "./desktop": "./src/desktop/index.ts",
     "./desktop/worker": "./src/desktop/worker.ts",
     "./email": "./src/email/index.ts",
+    "./filling": "./src/filling/index.ts",
+    "./filling/cookie-codec": "./src/filling/cookie-codec.ts",
     "./filling/session-sqlite": "./src/filling/session-sqlite.ts",
     "./kitchen": "./src/kitchen/index.ts",
+    "./logging": "./src/logging/index.ts",
     "./middleware": "./src/middleware/index.ts",
+    "./middleware/csrf": "./src/middleware/csrf.ts",
     "./middleware/oauth": "./src/middleware/oauth/index.ts",
     "./middleware/secure": "./src/middleware/secure/index.ts",
     "./middleware/rate-limit": "./src/middleware/rate-limit/index.ts",
+    "./middleware/session": "./src/middleware/session.ts",
     "./testing": "./src/testing/index.ts",
+    "./testing/db": "./src/testing/db.ts",
+    "./testing/mocks": "./src/testing/mocks.ts",
+    "./testing/reporter": "./src/testing/reporter.ts",
+    "./testing/server": "./src/testing/server.ts",
+    "./testing/session": "./src/testing/session.ts",
+    "./testing/snapshot": "./src/testing/snapshot.ts",
     "./plugins": "./src/plugins/index.ts",
     "./plugins/define": "./src/plugins/define.ts",
     "./plugins/runner": "./src/plugins/runner.ts",
@@ -44,17 +61,36 @@
     "./i18n": "./src/i18n/index.ts",
     "./id": "./src/id/index.ts",
     "./observability": "./src/observability/index.ts",
+    "./openapi/generator": "./src/openapi/generator.ts",
     "./perf": "./src/perf/index.ts",
     "./perf/hmr-markers": "./src/perf/hmr-markers.ts",
     "./perf/user-marks": "./src/perf/user-marks.ts",
+    "./resource": "./src/resource/index.ts",
+    "./resource/ddl/diff": "./src/resource/ddl/diff.ts",
+    "./resource/ddl/emit": "./src/resource/ddl/emit.ts",
+    "./resource/ddl/snapshot": "./src/resource/ddl/snapshot.ts",
+    "./resource/ddl/type-map": "./src/resource/ddl/type-map.ts",
+    "./resource/ddl/types": "./src/resource/ddl/types.ts",
+    "./resource/generator-repo": "./src/resource/generator-repo.ts",
+    "./resource/parser": "./src/resource/parser.ts",
+    "./resource/schema": "./src/resource/schema.ts",
+    "./router": "./src/router/index.ts",
     "./routes": "./src/routes/index.ts",
+    "./runtime": "./src/runtime/index.ts",
+    "./runtime/cache": "./src/runtime/cache.ts",
+    "./runtime/router": "./src/runtime/router.ts",
+    "./runtime/server": "./src/runtime/server.ts",
     "./scheduler": "./src/scheduler/index.ts",
     "./storage/s3": "./src/storage/s3/index.ts",
+    "./guard": "./src/guard/index.ts",
     "./guard/define-rule": "./src/guard/define-rule.ts",
+    "./guard/design-inline-class": "./src/guard/design-inline-class.ts",
     "./guard/rule-presets": "./src/guard/rule-presets.ts",
     "./guard/tsgolint-bridge": "./src/guard/tsgolint-bridge.ts",
+    "./bundler": "./src/bundler/index.ts",
     "./bundler/prerender": "./src/bundler/prerender.ts",
     "./bundler/safe-build": "./src/bundler/safe-build.ts",
+    "./bundler/types": "./src/bundler/types.ts",
     "./bundler/hmr-types": "./src/bundler/hmr-types.ts",
     "./bundler/scenario-matrix": "./src/bundler/scenario-matrix.ts",
     "./bundler/vendor-cache-types": "./src/bundler/vendor-cache-types.ts",
@@ -71,7 +107,7 @@
     "./middleware/bridge": "./src/middleware/bridge.ts",
     "./client/hydrate": "./src/client/hydrate.ts",
     "./runtime/fast-refresh-types": "./src/runtime/fast-refresh-types.ts",
-    "./*": "./src/*"
+    "./components/Image": "./src/components/Image.tsx"
   },
   "files": [
     "src/**/*"

package/src/a11y/run-audit.ts

@@ -66,7 +66,7 @@ interface AxeRunResult {
 /** Minimal structural typing for the DOM provider handle. */
 interface DomProvider {
   kind: "jsdom" | "happy-dom";
-  fromHtml(html: string, url: string): Promise<{ window: unknown; dispose: () => void }>;
+  fromHtml(html: string, url: string): Promise<{ window: unknown; dispose: () => Promise<void> }>;
 }
 
 const DEFAULT_MAX_FILES = 500;
@@ -139,7 +139,7 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
           const window = (instance as { window: unknown }).window;
           return {
             window,
-            dispose() {
+            async dispose() {
               const w = window as { close?: () => void };
               if (typeof w.close === "function") {
                 try { w.close(); } catch { /* no-op */ }
@@ -170,9 +170,9 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
           window.document.close();
           return {
             window,
-            dispose() {
+            async dispose() {
               if (typeof window.close === "function") {
-                try { window.close(); } catch { /* no-op */ }
+                try { await window.close(); } catch { /* no-op */ }
               }
             },
           };
@@ -235,7 +235,7 @@ async function auditFile(
   }
 
   const pageUrl = "file://" + absFile.replace(/\\/g, "/");
-  let handle: { window: unknown; dispose: () => void };
+  let handle: { window: unknown; dispose: () => void | Promise<void> };
   try {
     handle = await dom.fromHtml(html, pageUrl);
   } catch {
@@ -265,7 +265,7 @@ async function auditFile(
   } catch {
     return null;
   } finally {
-    handle.dispose();
+    await handle.dispose();
   }
 }
 

package/src/brain/adapters/oauth-flow.ts

@@ -236,7 +236,7 @@ export function prepareLoopbackFlow(
     stopped = true;
     clearTimeout(timer);
     try {
-      server.stop(true);
+      void server.stop(true);
     } catch {
       /* best-effort */
     }

package/src/brain/architecture/analyzer.ts

@@ -13,8 +13,6 @@ import type {
   CheckImportResult,
   ProjectStructure,
   FolderInfo,
-  FolderRule,
-  ImportRule,
 } from "./types";
 import { getBrain } from "../brain";
 import path from "path";

package/src/brain/credentials.ts

@@ -28,7 +28,7 @@
  * expires_at) — `CredentialStore` serializes it as a JSON string.
  */
 
-import { promises as fs, constants as fsConstants } from "node:fs";
+import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -157,7 +157,7 @@ async function runWithStdin(
       stdout: "pipe",
       stderr: "pipe",
     });
-    proc.stdin.write(stdin);
+    await proc.stdin.write(stdin);
     await proc.stdin.end();
     const [stdout, exitCode] = await Promise.all([
       new Response(proc.stdout).text(),

package/src/bundler/__tests__/build-runner.ts

@@ -30,7 +30,15 @@
  * - stdout: JSON blob terminated by `\n`:
  *     { "success": boolean,
  *       "errors": string[],
- *       "manifest": { shared: { fastRefresh?: { runtime: string; glue: string } } }
+ *       "manifest": {
+ *         shared: {
+ *           runtime?: string;
+ *           vendor?: string;
+ *           router?: string;
+ *           fastRefresh?: { runtime: string; glue: string };
+ *         };
+ *         bundles: Record<string, unknown>;
+ *       }
  *     }
  *   Only the fields tests consume are serialized; the in-memory manifest
  *   is also persisted at `<rootDir>/.mandu/manifest.json` by the build.
@@ -83,8 +91,12 @@ try {
       errors: result.errors,
       manifest: {
         shared: {
+          runtime: result.manifest.shared?.runtime ?? null,
+          vendor: result.manifest.shared?.vendor ?? null,
+          router: result.manifest.shared?.router ?? null,
           fastRefresh: result.manifest.shared?.fastRefresh ?? null,
         },
+        bundles: result.manifest.bundles ?? {},
       },
     }) + "\n",
   );

package/src/bundler/__tests__/extended-watch.test.ts

@@ -1,3 +1,4 @@
+import type * as __ManduHmrTypesTypes0 from "../hmr-types";
 /**
  * Phase 7.0 R2 Agent D — Extended file watch tests.
  *
@@ -702,8 +703,8 @@ describe("Phase 7.0 R2 Agent D — CoalescedChange kind surface", () => {
 
     // Literal assignments — if the union shrinks, TS errors in this
     // file before the suite even runs.
-    const a: import("../hmr-types").CoalescedChange["kind"] = "config-reload";
-    const b: import("../hmr-types").CoalescedChange["kind"] = "resource-regen";
+    const a: __ManduHmrTypesTypes0.CoalescedChange["kind"] = "config-reload";
+    const b: __ManduHmrTypesTypes0.CoalescedChange["kind"] = "resource-regen";
     expect(a).toBe("config-reload");
     expect(b).toBe("resource-regen");
   });

package/src/bundler/__tests__/fast-refresh.test.ts

@@ -541,18 +541,16 @@ describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
       // 7-parallel shim fan-out fail with `AggregateError: Bundle failed`
       // ~100 % of the time for the affected shim(s). A subprocess has a
       // clean module graph.
-      const { spawn } = await import("node:child_process");
-      const runner = path.join(import.meta.dir, "build-runner.ts");
-      const cwd = path.resolve(import.meta.dir, "..", "..", "..");
-      const out = await new Promise<string>((resolve) => {
-        const proc = spawn(process.execPath, ["run", runner, rootDir], {
-          cwd,
-          stdio: ["ignore", "pipe", "inherit"],
-        });
-        let buf = "";
-        proc.stdout.on("data", (d: Buffer) => (buf += d.toString("utf-8")));
-        proc.on("close", () => resolve(buf));
-      });
+      const runner = path.join(import.meta.dir, "build-runner.ts");
+      const cwd = path.resolve(import.meta.dir, "..", "..", "..");
+      const proc = Bun.spawn([process.execPath, "run", runner, rootDir], {
+        cwd,
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "inherit",
+      });
+      const out = await new Response(proc.stdout).text();
+      await proc.exited;
       const jsonLine =
         out
           .split(/\r?\n/)

package/src/bundler/build.test.ts

@@ -2,7 +2,6 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises";
 import path from "path";
 import { pathToFileURL } from "url";
-import { spawn } from "node:child_process";
 
 // 모든 테스트가 하나의 빌드 결과를 공유 — 병렬 Bun.build 충돌 방지
 let rootDir: string;
@@ -34,40 +33,38 @@ async function runBuildInSubprocess(root: string): Promise<{
     "__tests__",
     "build-runner.ts",
   );
-  return new Promise((resolve) => {
-    const proc = spawn(process.execPath, ["run", runner, root], {
+  try {
+    const proc = Bun.spawn([process.execPath, "run", runner, root], {
       cwd: path.resolve(import.meta.dir, "..", ".."),
-      stdio: ["ignore", "pipe", "inherit"],
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "inherit",
     });
-    let out = "";
-    proc.stdout.on("data", (chunk: Buffer) => {
-      out += chunk.toString("utf-8");
-    });
-    proc.on("close", () => {
-      // Find the final JSON line — the runner may log Mandu dev banners
-      // (e.g. "[Mandu] DevTools …") before emitting the payload. The
-      // contract is: last non-empty line is the JSON blob.
-      const lines = out.split(/\r?\n/).filter((l) => l.trim().length > 0);
-      const last = lines[lines.length - 1] ?? "";
-      try {
-        const parsed = JSON.parse(last);
-        resolve({
-          success: parsed.success === true,
-          errors: Array.isArray(parsed.errors) ? parsed.errors : [],
-        });
-      } catch (e) {
-        resolve({
-          success: false,
-          errors: [
-            `build-runner output could not be parsed as JSON: ${String(e)}\nLast stdout line: ${last}`,
-          ],
-        });
-      }
-    });
-    proc.on("error", (err) => {
-      resolve({ success: false, errors: [`spawn failed: ${String(err)}`] });
-    });
-  });
+    const out = await new Response(proc.stdout).text();
+    await proc.exited;
+
+    // Find the final JSON line — the runner may log Mandu dev banners
+    // (e.g. "[Mandu] DevTools …") before emitting the payload. The
+    // contract is: last non-empty line is the JSON blob.
+    const lines = out.split(/\r?\n/).filter((l) => l.trim().length > 0);
+    const last = lines[lines.length - 1] ?? "";
+    try {
+      const parsed = JSON.parse(last);
+      return {
+        success: parsed.success === true,
+        errors: Array.isArray(parsed.errors) ? parsed.errors : [],
+      };
+    } catch (e) {
+      return {
+        success: false,
+        errors: [
+          `build-runner output could not be parsed as JSON: ${String(e)}\nLast stdout line: ${last}`,
+        ],
+      };
+    }
+  } catch (err) {
+    return { success: false, errors: [`spawn failed: ${String(err)}`] };
+  }
 }
 
 beforeAll(async () => {

package/src/bundler/build.ts

@@ -1,3 +1,4 @@
+import type * as __ManduPluginsReactCompilerTypes0 from "./plugins/react-compiler";
 /**
  * Mandu Client Bundler 📦
  * Bun.build 기반 클라이언트 번들 빌드
@@ -64,19 +65,51 @@ function manduDefaultPlugins(options: BundlerOptions): BunPlugin[] {
  * this; SSR builds use `manduDefaultPlugins()` directly because React
  * Compiler offers zero benefit for one-shot HTML rendering.
  */
-function manduClientPlugins(options: BundlerOptions): BunPlugin[] {
-  const base = manduDefaultPlugins(options);
-  if (options.reactCompiler?.enabled !== true) return base;
+function manduClientPlugins(options: BundlerOptions): BunPlugin[] {
+  const base = manduDefaultPlugins(options);
+  if (options.reactCompiler?.enabled !== true) return base;
   // Lazy import to avoid pulling the react-compiler module into every
   // build graph — SSR / non-client paths never touch this branch.
-  const { reactCompiler } = require("./plugins/react-compiler") as typeof import("./plugins/react-compiler");
+  const { reactCompiler } = require("./plugins/react-compiler") as typeof __ManduPluginsReactCompilerTypes0;
   return [
     ...base,
     reactCompiler({
       reactCompilerConfig: options.reactCompiler.compilerConfig,
-    }),
-  ];
-}
+    }),
+  ];
+}
+
+function resolveBundlerMode(options: BundlerOptions): "development" | "production" {
+  return options.mode ?? (process.env.NODE_ENV === "production" ? "production" : "development");
+}
+
+function isDevelopmentBuild(options: BundlerOptions): boolean {
+  return resolveBundlerMode(options) === "development";
+}
+
+function shouldMinify(options: BundlerOptions): boolean {
+  return options.minify ?? (resolveBundlerMode(options) === "production");
+}
+
+function shouldSplitChunks(options: BundlerOptions): boolean {
+  return options.splitting ?? (resolveBundlerMode(options) === "production");
+}
+
+function nodeEnvDefine(options: BundlerOptions): string {
+  return JSON.stringify(resolveBundlerMode(options));
+}
+
+function resolveClientOutDir(rootDir: string, outDir?: string): string {
+  const defaultOutDir = path.join(rootDir, ".mandu/client");
+  if (!outDir) return defaultOutDir;
+
+  const resolvedOutDir = path.isAbsolute(outDir) ? outDir : path.resolve(rootDir, outDir);
+  if (path.normalize(resolvedOutDir) === path.normalize(path.join(rootDir, ".mandu"))) {
+    return defaultOutDir;
+  }
+
+  return resolvedOutDir;
+}
 
 /**
  * Scan for *.island.tsx / *.island.ts files across hydrated route directories.
@@ -229,20 +262,20 @@ async function buildPerIslandBundle(
   // Phase 7.1 B-1/B-4: wire Bun's native React Fast Refresh transform +
   // Mandu's boundary injection plugin — but only in dev. Production
   // bundles stay clean of `$RefreshReg$` / `$RefreshSig$` stubs.
-  const isDev = (options.minify ?? process.env.NODE_ENV === "production") === false;
+  const isDev = isDevelopmentBuild(options);
   try {
     await Bun.write(entryPath, generateIslandEntry(entry.name, entry.filePath));
     const result = await safeBuild({
       entrypoints: [entryPath],
       outdir: outDir,
       naming: outputName,
-      minify: options.minify ?? process.env.NODE_ENV === "production",
+      minify: shouldMinify(options),
       sourcemap: options.sourcemap ? "external" : "none",
       target: "browser",
       ...(isDev ? { reactFastRefresh: true } : {}),
       plugins: [...manduClientPlugins(options), ...(isDev ? [fastRefreshPlugin()] : [])],
       external: ["react", "react-dom", "react-dom/client", ...(options.external || [])],
-      define: { "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "development"), ...options.define },
+      define: { "process.env.NODE_ENV": nodeEnvDefine(options), ...options.define },
     });
     await fs.unlink(entryPath).catch(() => {});
     if (!result.success) {
@@ -1234,12 +1267,12 @@ async function buildRouterRuntime(
       entrypoints: [routerPath],
       outdir: outDir,
       naming: outputName,
-      minify: options.minify ?? process.env.NODE_ENV === "production",
+      minify: shouldMinify(options),
       sourcemap: options.sourcemap ? "external" : "none",
       target: "browser",
       plugins: manduDefaultPlugins(options),
       define: {
-        "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "development"),
+        "process.env.NODE_ENV": nodeEnvDefine(options),
         ...options.define,
       },
     });
@@ -1310,13 +1343,13 @@ async function buildRuntime(
       entrypoints: [runtimePath],
       outdir: outDir,
       naming: outputName,
-      minify: options.minify ?? process.env.NODE_ENV === "production",
+      minify: shouldMinify(options),
       sourcemap: options.sourcemap ? "external" : "none",
       target: "browser",
       external: ["react", "react-dom", "react-dom/client"],
       plugins: manduDefaultPlugins(options),
       define: {
-        "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "development"),
+        "process.env.NODE_ENV": nodeEnvDefine(options),
         ...options.define,
       },
     });
@@ -1471,8 +1504,7 @@ async function buildVendorShims(
   // Phase 7.1 B-2: dev-only Fast Refresh shims. In production we skip
   // them entirely so `react-refresh/runtime` is never bundled and the
   // attack surface / bundle size regressions stay zero for deploys.
-  const isDev =
-    (options.minify ?? process.env.NODE_ENV === "production") === false;
+  const isDev = isDevelopmentBuild(options);
 
   const shims: Array<{ name: string; source: string; key: VendorShimKey; cacheId: string }> = [
     { name: "_react", source: generateReactShimSource(), key: "react", cacheId: "react" },
@@ -1600,13 +1632,13 @@ async function buildVendorShims(
         entrypoints: [srcPath],
         outdir: outDir,
         naming: outputName,
-        minify: options.minify ?? process.env.NODE_ENV === "production",
+        minify: shouldMinify(options),
         sourcemap: options.sourcemap ? "external" : "none",
         target: "browser",
         external: shimExternal,
         plugins: manduDefaultPlugins(options),
         define: {
-          "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "development"),
+          "process.env.NODE_ENV": nodeEnvDefine(options),
           ...options.define,
         },
       });
@@ -1696,8 +1728,7 @@ async function buildIsland(
 
   // Phase 7.1 B-1/B-4: wire native Fast Refresh transform + Mandu's
   // boundary injection plugin. Dev-only; prod bundles remain clean.
-  const isDev =
-    (options.minify ?? process.env.NODE_ENV === "production") === false;
+  const isDev = isDevelopmentBuild(options);
   try {
     // 엔트리 래퍼 생성
     await Bun.write(entryPath, generateIslandEntry(route.id, clientModulePath));
@@ -1708,15 +1739,15 @@ async function buildIsland(
       entrypoints: [entryPath],
       outdir: outDir,
       naming: options.splitting ? "[name]-[hash].js" : outputName,
-      minify: options.minify ?? process.env.NODE_ENV === "production",
+      minify: shouldMinify(options),
       sourcemap: options.sourcemap ? "external" : "none",
       target: "browser",
-      splitting: options.splitting ?? (process.env.NODE_ENV === "production"),
+      splitting: shouldSplitChunks(options),
       ...(isDev ? { reactFastRefresh: true } : {}),
       plugins: [...manduClientPlugins(options), ...(isDev ? [fastRefreshPlugin()] : [])],
       external: ["react", "react-dom", "react-dom/client", ...(options.external || [])],
       define: {
-        "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "development"),
+        "process.env.NODE_ENV": nodeEnvDefine(options),
         ...options.define,
       },
     });
@@ -1910,15 +1941,13 @@ export async function buildClientBundles(
       errors.push(`onBundleComplete[${e.source}]: ${e.error.message}`);
     }
   };
-  const env = (process.env.NODE_ENV === "production" ? "production" : "development") as
-    | "development"
-    | "production";
+  const env = resolveBundlerMode(options);
 
   // 1. Hydration이 필요한 라우트 필터링
   const hydratedRoutes = getHydratedRoutes(manifest);
 
   // 2. 출력 디렉토리 생성 (항상 필요 - 매니페스트 저장용)
-  const outDir = options.outDir || path.join(rootDir, ".mandu/client");
+  const outDir = resolveClientOutDir(rootDir, options.outDir);
   await fs.mkdir(outDir, { recursive: true });
 
   // Hydration 라우트가 없어도 빈 매니페스트를 저장해야 함