@mandujs/core 0.53.0 → 0.53.2

package/src/db/migrations/runner.ts

@@ -69,7 +69,7 @@ import type {
   PendingMigration,
   SqlProvider,
 } from "../../resource/ddl/types";
-import type { Db } from "../index";
+import { withPinnedDbHandle, type Db } from "../index";
 import {
   DEFAULT_HISTORY_TABLE,
   SAFE_HISTORY_TABLE_RE,
@@ -128,6 +128,24 @@ export class MigrationTimeoutError extends Error {
   }
 }
 
+function assertNoTamperedHistory(
+  history: HistoryRow[],
+  diskByVersion: Map<string, PendingMigration>,
+): void {
+  for (const row of history) {
+    if (row.success !== 1) continue;
+    const disk = diskByVersion.get(row.version);
+    if (!disk) continue; // orphan on the history side — surfaced via status(), not apply()
+    if (disk.checksum !== row.checksum) {
+      throw new MigrationTamperedError(
+        disk.filename,
+        row.checksum,
+        disk.checksum,
+      );
+    }
+  }
+}
+
 // ─── Public API ─────────────────────────────────────────────────────────────
 
 /** Options for {@link createMigrationRunner}. */
@@ -246,34 +264,18 @@ export function createMigrationRunner(
   async function apply(
     opts: { dryRun?: boolean } = {},
   ): Promise<AppliedMigration[]> {
-    await ensureReady();
-
-    // Tamper check BEFORE acquiring the lock so the fast-fail path
-    // doesn't hold the advisory lock longer than necessary.
-    const history = await readAllHistory(db, historyTable);
     const diskFiles = await readMigrationsFromDisk(migrationsDir);
     const diskByVersion = new Map(diskFiles.map((f) => [f.version, f]));
-    for (const row of history) {
-      if (row.success !== 1) continue;
-      const disk = diskByVersion.get(row.version);
-      if (!disk) continue; // orphan on the history side — surfaced via status(), not apply()
-      if (disk.checksum !== row.checksum) {
-        throw new MigrationTamperedError(
-          disk.filename,
-          row.checksum,
-          disk.checksum,
-        );
-      }
-    }
 
-    const appliedVersions = new Set(
-      history.filter((h) => h.success === 1).map((h) => h.version),
-    );
-    const pending = diskFiles.filter((f) => !appliedVersions.has(f.version));
-    if (pending.length === 0) return [];
-
-    // Dry-run: report what we WOULD apply, no IO, no history.
     if (opts.dryRun === true) {
+      await ensureReady();
+      const history = await readAllHistory(db, historyTable);
+      assertNoTamperedHistory(history, diskByVersion);
+
+      const appliedVersions = new Set(
+        history.filter((h) => h.success === 1).map((h) => h.version),
+      );
+      const pending = diskFiles.filter((f) => !appliedVersions.has(f.version));
       return pending.map<AppliedMigration>((p) => ({
         version: p.version,
         filename: p.filename,
@@ -290,100 +292,115 @@ export function createMigrationRunner(
 
     const applied: AppliedMigration[] = [];
 
-    heldLock = await acquireMigrationLock(db, lockStrategy);
-    try {
-      for (const migration of pending) {
-        const start = Date.now();
-
-        const statements = splitStatements(migration.sql);
-        if (statements.length === 0) {
-          // Empty migration — still record a history row so we don't
-          // re-run it. execution_ms = 0 reflects reality.
+    const runLockedApply = async (): Promise<AppliedMigration[]> => {
+      heldLock = await acquireMigrationLock(db, lockStrategy);
+      try {
+        await ensureReady();
+        const lockedHistory = await readAllHistory(db, historyTable);
+        assertNoTamperedHistory(lockedHistory, diskByVersion);
+        const lockedAppliedVersions = new Set(
+          lockedHistory.filter((h) => h.success === 1).map((h) => h.version),
+        );
+        const lockedPending = diskFiles.filter((f) => !lockedAppliedVersions.has(f.version));
+
+        for (const migration of lockedPending) {
+          const start = Date.now();
+
+          const statements = splitStatements(migration.sql);
+          if (statements.length === 0) {
+            // Empty migration — still record a history row so we don't
+            // re-run it. execution_ms = 0 reflects reality.
+            await insertHistory(db, historyTable, {
+              version: migration.version,
+              filename: migration.filename,
+              checksum: migration.checksum,
+              applied_at: new Date(),
+              execution_ms: 0,
+              success: 1,
+              installed_by: installedBy,
+            });
+            applied.push({
+              version: migration.version,
+              filename: migration.filename,
+              checksum: migration.checksum,
+              appliedAt: new Date(),
+              executionMs: 0,
+              success: true,
+            });
+            continue;
+          }
+
+          try {
+            await db.transaction(async (tx) => {
+              for (const stmt of statements) {
+                await execRaw(tx, stmt);
+                const elapsed = Date.now() - start;
+                if (elapsed > applyTimeoutMs) {
+                  throw new MigrationTimeoutError(
+                    migration.filename,
+                    elapsed,
+                    applyTimeoutMs,
+                  );
+                }
+              }
+            });
+          } catch (err) {
+            if (err instanceof MigrationTimeoutError) throw err;
+            // Wrap with migration context so downstream callers know
+            // which file blew up. Preserve the original stack where
+            // possible via `cause`.
+            const msg = err instanceof Error ? err.message : String(err);
+            const wrapped = new Error(
+              `[@mandujs/core/db/migrations] Failed to apply ${migration.filename}: ${msg}`,
+            );
+            // Preserve the original as a `cause` chain for diagnostics.
+            (wrapped as { cause?: unknown }).cause = err;
+            throw wrapped;
+          }
+
+          const executionMs = Date.now() - start;
+          const appliedAt = new Date();
+
+          // History row is written AFTER the SQL transaction commits.
+          // If this INSERT itself fails, the migration has run but we
+          // have no record — the user will see it as pending again.
+          // Mitigation: the insert is a single tiny statement; in
+          // practice it either succeeds or the whole connection is
+          // dead (in which case subsequent apply() calls will also fail
+          // and the user will debug from the DB side).
           await insertHistory(db, historyTable, {
             version: migration.version,
             filename: migration.filename,
             checksum: migration.checksum,
-            applied_at: new Date(),
-            execution_ms: 0,
+            applied_at: appliedAt,
+            execution_ms: executionMs,
             success: 1,
             installed_by: installedBy,
           });
+
           applied.push({
             version: migration.version,
             filename: migration.filename,
             checksum: migration.checksum,
-            appliedAt: new Date(),
-            executionMs: 0,
+            appliedAt,
+            executionMs,
             success: true,
           });
-          continue;
         }
-
-        try {
-          await db.transaction(async (tx) => {
-            for (const stmt of statements) {
-              await execRaw(tx, stmt);
-              const elapsed = Date.now() - start;
-              if (elapsed > applyTimeoutMs) {
-                throw new MigrationTimeoutError(
-                  migration.filename,
-                  elapsed,
-                  applyTimeoutMs,
-                );
-              }
-            }
-          });
-        } catch (err) {
-          if (err instanceof MigrationTimeoutError) throw err;
-          // Wrap with migration context so downstream callers know
-          // which file blew up. Preserve the original stack where
-          // possible via `cause`.
-          const msg = err instanceof Error ? err.message : String(err);
-          const wrapped = new Error(
-            `[@mandujs/core/db/migrations] Failed to apply ${migration.filename}: ${msg}`,
-          );
-          // Preserve the original as a `cause` chain for diagnostics.
-          (wrapped as { cause?: unknown }).cause = err;
-          throw wrapped;
+      } finally {
+        if (heldLock) {
+          await heldLock.release();
+          heldLock = null;
         }
+      }
 
-        const executionMs = Date.now() - start;
-        const appliedAt = new Date();
-
-        // History row is written AFTER the SQL transaction commits.
-        // If this INSERT itself fails, the migration has run but we
-        // have no record — the user will see it as pending again.
-        // Mitigation: the insert is a single tiny statement; in
-        // practice it either succeeds or the whole connection is
-        // dead (in which case subsequent apply() calls will also fail
-        // and the user will debug from the DB side).
-        await insertHistory(db, historyTable, {
-          version: migration.version,
-          filename: migration.filename,
-          checksum: migration.checksum,
-          applied_at: appliedAt,
-          execution_ms: executionMs,
-          success: 1,
-          installed_by: installedBy,
-        });
+      return applied;
+    };
 
-        applied.push({
-          version: migration.version,
-          filename: migration.filename,
-          checksum: migration.checksum,
-          appliedAt,
-          executionMs,
-          success: true,
-        });
-      }
-    } finally {
-      if (heldLock) {
-        await heldLock.release();
-        heldLock = null;
-      }
+    if (lockStrategy === "mysql_get_lock") {
+      return await withPinnedDbHandle(db, runLockedApply);
     }
-
-    return applied;
+    return await runLockedApply();
   }
 
   async function status(): Promise<MigrationStatus> {

package/src/deploy/cache.ts

@@ -107,6 +107,7 @@ export async function loadDeployIntentCache(
   } catch (err) {
     throw new Error(
       `Deploy intent cache is not valid JSON (${file}): ${(err as Error).message}`,
+      { cause: err },
     );
   }
   return DeployIntentCache.parse(parsed);

package/src/design/extract.ts

@@ -1,3 +1,4 @@
+import type * as __ManduNodeFsTypes0 from "node:fs";
 /**
  * DESIGN.md token extractor — scan project source for tokens that
  * should be promoted into DESIGN.md (Issue #245 M4 §3.5 internal loop).
@@ -155,7 +156,7 @@ const SOURCE_RX = /\.(?:tsx?|jsx?|mdx?|css)$/;
 async function collectFiles(root: string): Promise<string[]> {
   const out: string[] = [];
   async function walk(dir: string): Promise<void> {
-    let entries: import("node:fs").Dirent[];
+    let entries: __ManduNodeFsTypes0.Dirent[];
     try {
       entries = await fs.readdir(dir, { withFileTypes: true });
     } catch {

package/src/design/patch.ts

@@ -23,7 +23,6 @@
  * limitation or fall back to a hand-edit.
  */
 
-import { parseDesignMd } from "./parser";
 
 export type PatchableSection =
   | "color-palette"

package/src/devtools/ai/mcp-connector.ts

@@ -165,26 +165,26 @@ export class MCPConnector {
       try {
         this.ws = new WebSocket(url);
 
-        this.ws.onopen = () => {
-          clearTimeout(timeout);
-          this.setStatus('connected');
-          this.reconnectAttempts = 0;
-          resolve();
-        };
-
-        this.ws.onclose = () => {
-          this.handleDisconnect();
-        };
-
-        this.ws.onerror = (event) => {
-          clearTimeout(timeout);
-          this.handleConnectionError(new Error('WebSocket error'));
-          reject(new Error('WebSocket connection failed'));
-        };
-
-        this.ws.onmessage = (event) => {
-          this.handleMessage(event.data);
-        };
+        this.ws.addEventListener('open', () => {
+          clearTimeout(timeout);
+          this.setStatus('connected');
+          this.reconnectAttempts = 0;
+          resolve();
+        });
+
+        this.ws.addEventListener('close', () => {
+          this.handleDisconnect();
+        });
+
+        this.ws.addEventListener('error', () => {
+          clearTimeout(timeout);
+          this.handleConnectionError(new Error('WebSocket error'));
+          reject(new Error('WebSocket connection failed'));
+        });
+
+        this.ws.addEventListener('message', (event) => {
+          this.handleMessage(event.data);
+        });
       } catch (error) {
         clearTimeout(timeout);
         this.handleConnectionError(
@@ -210,10 +210,10 @@ export class MCPConnector {
     }
 
     // 대기 중인 요청 모두 reject
-    for (const [id, pending] of this.pendingRequests) {
-      clearTimeout(pending.timeout);
-      pending.reject(new Error('Connection closed'));
-    }
+    for (const [, pending] of this.pendingRequests) {
+      clearTimeout(pending.timeout);
+      pending.reject(new Error('Connection closed'));
+    }
     this.pendingRequests.clear();
 
     this.setStatus('disconnected');

package/src/devtools/client/components/kitchen-root.tsx

@@ -7,7 +7,7 @@
 
 import React, { useEffect, useState, useCallback, useMemo } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
-import type { NormalizedError, DevToolsConfig, IslandSnapshot, NetworkRequest, DevToolsGuardViolation } from '../../types';
+import type { NormalizedError, DevToolsConfig } from '../../types';
 import { generateCSSVariables, testIds, zIndex } from '../../design-tokens';
 import { getStateManager, type KitchenState } from '../state-manager';
 import { getOrCreateHook } from '../../hook';

package/src/devtools/client/components/panel/errors-panel.tsx

@@ -159,7 +159,7 @@ export interface ErrorsPanelProps {
 export function ErrorsPanel({
   errors,
   onErrorClick,
-  onErrorIgnore,
+  onErrorIgnore: _onErrorIgnore,
   onClearAll,
 }: ErrorsPanelProps): React.ReactElement {
   const formatTime = useCallback((timestamp: number): string => {

package/src/devtools/client/state-manager.ts

@@ -257,7 +257,7 @@ export class KitchenStateManager {
     }
   }
 
-  setIslandHydrated(id: string, time: number): void {
+  setIslandHydrated(id: string, _time: number): void {
     this.updateIsland(id, {
       status: 'hydrated',
       hydrateEndTime: Date.now(),

package/src/devtools/init.ts

@@ -17,10 +17,9 @@ import {
   initializePersistence,
   destroyPersistence,
   getStateManager,
-  getPersistenceManager,
 } from './client';
 import { initializeWorkerManager, destroyWorkerManager } from './worker';
-import { getContextBuilder, resetContextBuilder, getMCPConnector, destroyMCPConnector } from './ai';
+import { getContextBuilder, resetContextBuilder, destroyMCPConnector } from './ai';
 
 // ============================================================================
 // Types
@@ -134,7 +133,7 @@ export function initManduKitchen(config: DevToolsConfig = {}): KitchenInstance {
     });
 
     // 6. v1.1: AI Context Builder 초기화
-    const contextBuilder = getContextBuilder({ config });
+    const _contextBuilder = getContextBuilder({ config });
 
     // 7. UI 마운트
     mountKitchen(config);

package/src/devtools/server/source-context.ts

@@ -424,7 +424,7 @@ export function createViteMiddleware(projectRoot: string) {
       res.setHeader('Cache-Control', 'no-store');
       res.statusCode = result.success ? 200 : 400;
       res.end(JSON.stringify(result));
-    } catch (error) {
+    } catch  {
       res.statusCode = 500;
       res.end(JSON.stringify({
         success: false,

package/src/devtools/worker/redaction-worker.ts

@@ -6,7 +6,7 @@
  * Prevents main thread blocking during large payload processing
  */
 
-import type { RedactPattern, WorkerTask } from '../types';
+import type { RedactPattern } from '../types';
 
 // ============================================================================
 // Worker Message Types
@@ -206,14 +206,18 @@ function handleMessage(request: WorkerRequest): WorkerResponse {
 // Worker 컨텍스트에서만 실행
 interface WorkerSelf {
   postMessage: (message: WorkerResponse) => void;
-  onmessage: ((event: MessageEvent<WorkerRequest>) => void) | null;
+  addEventListener: (
+    type: 'message',
+    listener: (event: MessageEvent<WorkerRequest>) => void
+  ) => void;
 }
 const workerSelf = typeof self !== 'undefined' ? (self as unknown as WorkerSelf) : undefined;
 if (workerSelf && typeof workerSelf.postMessage === 'function') {
-  workerSelf.onmessage = (event: MessageEvent<WorkerRequest>) => {
+  workerSelf.addEventListener('message', (event: MessageEvent<WorkerRequest>) => {
     const response = handleMessage(event.data);
+    // oxlint-disable-next-line require-post-message-target-origin -- Worker.postMessage has no targetOrigin parameter.
     workerSelf.postMessage(response);
-  };
+  });
 }
 
 // ============================================================================

package/src/devtools/worker/worker-manager.ts

@@ -88,8 +88,8 @@ export class WorkerManager {
       }
 
       // 메시지 핸들러 설정
-      this.worker.onmessage = this.handleWorkerMessage.bind(this);
-      this.worker.onerror = this.handleWorkerError.bind(this);
+      this.worker.addEventListener('message', this.handleWorkerMessage.bind(this));
+      this.worker.addEventListener('error', this.handleWorkerError.bind(this));
 
       // Ping 테스트
       const pingResult = await this.sendRequest({ type: 'ping', data: {} });
@@ -117,7 +117,7 @@ export class WorkerManager {
     }
 
     // 대기 중인 요청 모두 reject
-    for (const [id, pending] of this.pendingRequests) {
+    for (const [, pending] of this.pendingRequests) {
       clearTimeout(pending.timeout);
       pending.reject(new Error('Worker terminated'));
     }
@@ -323,6 +323,7 @@ export class WorkerManager {
 
       this.pendingRequests.set(id, { resolve, reject, timeout });
 
+      // oxlint-disable-next-line require-post-message-target-origin -- Worker.postMessage has no targetOrigin parameter.
       this.worker!.postMessage({ id, ...request });
     });
   }

package/src/error/classifier.ts

@@ -54,7 +54,7 @@ export class ErrorClassifier {
   /**
    * ValidationError 처리
    */
-  private createValidationError(error: { errors: unknown[] }): ManduError {
+  private createValidationError(_error: { errors: unknown[] }): ManduError {
     const slotFile = this.findSlotFile();
 
     return {

package/src/error/domains.ts

@@ -5,7 +5,7 @@
  * try-catch에서 instanceof 체크 가능.
  */
 
-import { ErrorCode, ERROR_MESSAGES, ERROR_SUMMARIES } from "./types";
+import { ErrorCode, ERROR_SUMMARIES } from "./types";
 import type { ManduError, RouteContext, ErrorType } from "./types";
 
 /**

package/src/filling/sse.ts

@@ -45,11 +45,11 @@ export class SSEConnection {
           controller.enqueue(this.encoder.encode(chunk));
         }
         this.pending = [];
-      },
-      cancel: () => {
-        this.close();
-      },
-    });
+      },
+      cancel: () => {
+        void this.close();
+      },
+    });
 
     const headers = new Headers(DEFAULT_SSE_HEADERS);
     if (options.headers) {

package/src/generator/generate.ts

@@ -1,4 +1,4 @@
-import type { RoutesManifest, RouteSpec } from "../spec/schema";
+import type { RoutesManifest } from "../spec/schema";
 import { generateApiHandler, generatePageComponent, generateSlotLogic } from "./templates";
 import { generateContractTypeGlue, generateContractTemplate, generateContractTypesIndex } from "./contract-glue";
 import { createHash } from "crypto";
@@ -102,7 +102,7 @@ export interface GeneratedMap {
 async function ensureDir(dirPath: string): Promise<void> {
   try {
     await fs.mkdir(dirPath, { recursive: true });
-  } catch (error) {
+  } catch  {
     // ignore if exists
   }
 }

package/src/guard/analyzer.ts

@@ -63,7 +63,7 @@ const DEFAULT_IMPORT_PATTERN = /^import\s+(\w+)/;
  */
 export function extractImports(content: string): ImportInfo[] {
   const imports: ImportInfo[] = [];
-  const lines = content.split("\n");
+  const _lines = content.split("\n");
 
   // Static imports
   let match: RegExpExecArray | null;

package/src/guard/ast-analyzer.ts

@@ -382,14 +382,14 @@ export function extractImportsAST(content: string): ImportInfo[] {
 
       let namedImports: string[] | undefined;
       let defaultImport: string | undefined;
-      let namespaceImport: string | undefined;
-      let isTypeOnly = false;
+      let _namespaceImport: string | undefined;
+      let _isTypeOnly = false;
 
       // Check for type-only import
       if (is("keyword", "type")) {
         consume("keyword", "type");
         skip();
-        isTypeOnly = true;
+        _isTypeOnly = true;
       }
 
       // Side-effect import: import '...'
@@ -427,7 +427,7 @@ export function extractImportsAST(content: string): ImportInfo[] {
           consume("keyword", "as");
           skip();
           if (is("identifier")) {
-            namespaceImport = consume("identifier")!.value;
+            _namespaceImport = consume("identifier")!.value;
             skip();
           }
         }
@@ -777,7 +777,7 @@ export interface ModuleAnalysis {
   /** Public API 여부 (index 파일) */
   isPublicAPI: boolean;
   /** 순수 타입 모듈 여부 */
-  isTypeOnly: boolean;
+  _isTypeOnly: boolean;
 }
 
 /**
@@ -795,12 +795,12 @@ export function analyzeModuleAST(content: string, filePath: string): ModuleAnaly
   // 타입만 있는 모듈인지 확인
   const hasRuntimeExport = exports.some((e) => e.type !== "type");
   const hasRuntimeImport = imports.some((i) => !i.statement.includes("import type"));
-  const isTypeOnly = !hasRuntimeExport && !hasRuntimeImport && exports.length > 0;
+  const _isTypeOnly = !hasRuntimeExport && !hasRuntimeImport && exports.length > 0;
 
   return {
     imports,
     exports,
     isPublicAPI,
-    isTypeOnly,
+    _isTypeOnly,
   };
 }

package/src/guard/auto-correct.ts

@@ -4,7 +4,7 @@ import { GUARD_RULES } from "./rules";
 import { runGuardCheck } from "./check";
 import { generateRoutes } from "../generator/generate";
 import { beginChange, commitChange, rollbackChange } from "../change";
-import path from "path";
+
 
 export interface AutoCorrectStep {
   ruleId: string;
@@ -51,7 +51,7 @@ export async function runAutoCorrect(
       message: `Auto-correct: ${violations.length} violations`,
       autoGenerated: true,
     });
-  } catch (error) {
+  } catch  {
     // 이미 활성 트랜잭션이 있는 경우 그대로 진행 (사용자가 수동으로 시작한 경우)
     // 다른 오류는 트랜잭션 없이 진행
   }

package/src/guard/config-guard.ts

@@ -12,8 +12,6 @@ import {
   validateLockfile,
   validateWithPolicy,
   detectMode,
-  type ManduLockfile,
-  type LockfileValidationResult,
   type LockfileMode,
 } from "../lockfile";
 import type { ConfigDiff } from "../utils/differ";

package/src/guard/contract-guard.ts

@@ -79,7 +79,7 @@ export interface ContractViolation extends GuardViolation {
  */
 export async function checkMissingContract(
   manifest: RoutesManifest,
-  rootDir: string
+  _rootDir: string
 ): Promise<ContractViolation[]> {
   const violations: ContractViolation[] = [];
 

package/src/guard/decision-memory.ts

@@ -25,8 +25,8 @@
  * ```
  */
 
-import { join, basename, extname } from "path";
-import { mkdir, readdir, readFile, writeFile, stat } from "fs/promises";
+import { join, extname } from "path";
+import { mkdir, readdir, readFile, writeFile } from "fs/promises";
 
 // ═══════════════════════════════════════════════════════════════════════════
 // Types

package/src/guard/design-inline-class.ts

@@ -1,3 +1,4 @@
+import type * as __ManduNodeFsTypes0 from "node:fs";
 /**
  * Guard rule — `DESIGN_INLINE_CLASS` (Issue #245).
  *
@@ -92,7 +93,7 @@ async function pathExists(p: string): Promise<boolean> {
 }
 
 async function* walk(rootDir: string): AsyncIterable<string> {
-  let entries: import("node:fs").Dirent[];
+  let entries: __ManduNodeFsTypes0.Dirent[];
   try {
     entries = await fs.readdir(rootDir, { withFileTypes: true });
   } catch {