@mandujs/core 0.54.17 → 0.54.18

package/src/bundler/dev.ts

@@ -21,12 +21,13 @@ import {
   scanFileImports,
   DEFAULT_MAX_CLOSURE_DEPTH,
 } from "./reverse-import-graph";
-import path from "path";
-import fs from "fs";
-import { LRUCache } from "../utils/lru-cache";
-import { registerCacheSize, unregisterCacheSize } from "../observability/metrics";
-
-/**
+import path from "path";
+import fs from "fs";
+import { LRUCache } from "../utils/lru-cache";
+import { registerCacheSize, unregisterCacheSize } from "../observability/metrics";
+export { generateFastRefreshPreamble } from "./fast-refresh-preamble";
+
+/**
  * #184: 공통 디렉토리 변경 시 사용하는 sentinel.
  * `onSSRChange`에 특정 파일 경로 대신 이 상수를 전달하면 "전체 SSR 레지스트리 invalidate" 의미.
  */
@@ -135,12 +136,14 @@ export interface RebuildResult {
   error?: string;
 }
 
-export interface DevBundler {
-  /** 초기 빌드 결과 */
-  initialBuild: BundleResult;
-  /** 파일 감시 중지 */
-  close: () => void;
-}
+export interface DevBundler {
+  /** 초기 빌드 결과 */
+  initialBuild: BundleResult;
+  /** Reverse import graph initial seed completion for deterministic tests. */
+  reverseGraphReady: Promise<void>;
+  /** 파일 감시 중지 */
+  close: () => void;
+}
 
 /**
  * #180: 파일 경로 비교를 위한 정규화.
@@ -647,7 +650,8 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
   // surface typed-only stubs that have no source yet); misses simply
   // keep the legacy "silent drop" behavior so no project is made
   // worse by turning this on.
-  const reverseGraph = new ReverseImportGraph();
+  const reverseGraph = new ReverseImportGraph();
+  let reverseGraphSeedPromise: Promise<void> | null = null;
 
   /**
    * Re-scan a single file's imports and update its row in the
@@ -1239,11 +1243,15 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
    * stay silent. Dispatch is idempotent — each root is touched at
    * most once per change via the `dispatched` set.
    */
-  const dispatchByTransitiveImporters = async (
-    changedFile: string,
-  ): Promise<number> => {
-    const absChanged = path.resolve(rootDir, changedFile);
-    // Refresh the changed file's OWN imports first. A leaf edit can
+  const dispatchByTransitiveImporters = async (
+    changedFile: string,
+  ): Promise<number> => {
+    const absChanged = path.resolve(rootDir, changedFile);
+    if (reverseGraphSeedPromise) {
+      await reverseGraphSeedPromise;
+    }
+
+    // Refresh the changed file's OWN imports first. A leaf edit can
     // legitimately add or remove imports (e.g. switching a barrel
     // from `./en` to `./ko`); the reverse graph must track that so
     // the NEXT unknown-file change uses the correct set.
@@ -1655,16 +1663,17 @@ export async function startDevBundler(options: DevBundlerOptions): Promise<DevBu
   // and the first user edit can't race the seed (first event goes
   // through the 100 ms debounce, by which point the scan has finished
   // for any realistic project size).
-  seedReverseGraph().catch((err) => {
-    console.warn(
-      "[Mandu HMR] reverse import-graph seed skipped:",
-      err instanceof Error ? err.message : String(err),
-    );
-  });
-
-  return {
-    initialBuild,
-    close: () => {
+  reverseGraphSeedPromise = seedReverseGraph().catch((err) => {
+    console.warn(
+      "[Mandu HMR] reverse import-graph seed skipped:",
+      err instanceof Error ? err.message : String(err),
+    );
+  });
+
+  return {
+    initialBuild,
+    reverseGraphReady: reverseGraphSeedPromise,
+    close: () => {
       // B6: clear all per-file timers to release event-loop refs.
       // Phase 17 — `LRUCache.clear()` fires the registered `onEvict`
       // (`clearTimeout(timer)`) for every entry before dropping them,
@@ -2208,90 +2217,8 @@ export function createHMRServer(
   };
 }
 
-/**
- * Phase 7.1 B-3 — HTML preamble for React Fast Refresh.
- *
- * Emitted by the SSR renderer in dev mode, **before** any island JS
- * evaluates. Two concerns, one <script>:
- *
- *   1. Install inert stubs for `$RefreshReg$` / `$RefreshSig$` on
- *      `window`. Bun's `reactFastRefresh: true` transform inserts calls
- *      to these at the top of every transformed module; if they are
- *      undefined when the module body runs, we get a runtime error and
- *      the island never hydrates. Vite's preamble does the same inline
- *      stub install for the same reason.
- *
- *   2. Fire a dynamic `import()` of the bundled glue (`_fast-refresh-
- *      runtime.js`), which in turn `await`s the real `react-refresh/
- *      runtime`, installs `window.__MANDU_HMR__`, and upgrades the
- *      stubs to live wrappers that forward to the refresh runtime. The
- *      race between "module evaluates and calls `$RefreshReg$`" and
- *      "glue has upgraded the stubs" is benign — registrations that
- *      land on the stub are simply no-ops, which at worst means the
- *      very first mount isn't tracked. Subsequent hot swaps land on
- *      the live wrappers and work normally.
- *
- * The emitted script is **inline** (no `type="module"`, no external
- * src). This is deliberate: the stubs must exist before *any* module
- * script runs, and inline execution blocks the parser. The dynamic
- * import inside the inline script is non-blocking so we don't stall
- * First Contentful Paint.
- *
- * CSP note: the inline <script> uses no `eval` or `new Function`; it
- * only calls `Object.assign`, defines functions, and initiates an
- * `import()`. All of these are permitted under `script-src 'self'
- * 'unsafe-inline'` which is Mandu's default dev CSP (production CSP
- * forbids `unsafe-inline`, but this preamble is dev-only).
- *
- * `glueUrl` and `runtimeUrl` come from the build manifest's
- * `shared.fastRefresh` block (populated only in dev). Both must be
- * absolute URLs served from the same origin as the HTML, which our
- * bundler always guarantees (`/.mandu/client/...`).
- */
-export function generateFastRefreshPreamble(
-  glueUrl: string,
-  runtimeUrl: string,
-): string {
-  // Both URLs must be non-empty. If either is missing (e.g. vendor
-  // shim build failed), the caller (ssr.ts) should skip this preamble
-  // entirely — defensive guard here keeps the output valid regardless.
-  if (!glueUrl || !runtimeUrl) {
-    return `<script>/* Mandu Fast Refresh: missing runtime assets, preamble skipped */</script>`;
-  }
-  // JSON.stringify escapes the URLs safely for inline `<script>`:
-  //   - quotes produce a valid JS string literal
-  //   - forward-slashes / backslashes are handled
-  // We also `split('</')` to avoid a stray `</script>` sequence in the
-  // URL bytes breaking the enclosing tag. This is the same defense
-  // Vite uses in its own preamble emitter.
-  const glueLit = JSON.stringify(glueUrl).split("</").join('<"+"/');
-  const runtimeLit = JSON.stringify(runtimeUrl).split("</").join('<"+"/');
-  return `<script>
-// Phase 7.1 B-3 React Fast Refresh preamble (Mandu dev-only)
-(function () {
-  if (typeof window === "undefined") return;
-  // Install inert stubs so transformed modules that run BEFORE the
-  // async runtime upgrade don't hit ReferenceError on $RefreshReg$.
-  if (!window.$RefreshReg$) window.$RefreshReg$ = function () {};
-  if (!window.$RefreshSig$) window.$RefreshSig$ = function () { return function (t) { return t; }; };
-  // Async-load the glue; failures are reported but never throw out of
-  // the preamble — a missing runtime degrades to full-reload HMR.
-  import(${glueLit})
-    .then(function (mod) {
-      var runtimeImport = function () { return import(${runtimeLit}); };
-      if (mod && typeof mod.installGlobal === "function") {
-        return mod.installGlobal({ runtimeImport: runtimeImport });
-      }
-    })
-    .catch(function (err) {
-      console.error("[Mandu Fast Refresh] preamble failed:", err);
-    });
-})();
-</script>`;
-}
-
-/**
- * HMR 클라이언트 스크립트 생성
+/**
+ * HMR 클라이언트 스크립트 생성
  * 브라우저에서 실행되어 HMR 서버와 연결.
  *
  * Phase 7.0 R1 Agent C additions:

package/src/bundler/fast-refresh-preamble.ts

@@ -0,0 +1,47 @@
+/**
+ * Small runtime-safe Fast Refresh preamble helper.
+ *
+ * Keep this separate from `bundler/dev.ts`: SSR runtimes import the helper
+ * while edge bundles must not pull the dev bundler, build graph, or TypeScript
+ * compiler into production worker output.
+ */
+export function generateFastRefreshPreamble(
+  glueUrl: string,
+  runtimeUrl: string,
+): string {
+  // Both URLs must be non-empty. If either is missing (e.g. vendor
+  // shim build failed), the caller should skip this preamble entirely.
+  if (!glueUrl || !runtimeUrl) {
+    return `<script>/* Mandu Fast Refresh: missing runtime assets, preamble skipped */</script>`;
+  }
+  // JSON.stringify escapes the URLs safely for inline `<script>`:
+  //   - quotes produce a valid JS string literal
+  //   - forward-slashes / backslashes are handled
+  // We also `split('</')` to avoid a stray `</script>` sequence in the
+  // URL bytes breaking the enclosing tag. This is the same defense
+  // Vite uses in its own preamble emitter.
+  const glueLit = JSON.stringify(glueUrl).split("</").join('<"+"/');
+  const runtimeLit = JSON.stringify(runtimeUrl).split("</").join('<"+"/');
+  return `<script>
+// Phase 7.1 B-3 React Fast Refresh preamble (Mandu dev-only)
+(function () {
+  if (typeof window === "undefined") return;
+  // Install inert stubs so transformed modules that run BEFORE the
+  // async runtime upgrade don't hit ReferenceError on $RefreshReg$.
+  if (!window.$RefreshReg$) window.$RefreshReg$ = function () {};
+  if (!window.$RefreshSig$) window.$RefreshSig$ = function () { return function (t) { return t; }; };
+  // Async-load the glue; failures are reported but never throw out of
+  // the preamble — a missing runtime degrades to full-reload HMR.
+  import(${glueLit})
+    .then(function (mod) {
+      var runtimeImport = function () { return import(${runtimeLit}); };
+      if (mod && typeof mod.installGlobal === "function") {
+        return mod.installGlobal({ runtimeImport: runtimeImport });
+      }
+    })
+    .catch(function (err) {
+      console.error("[Mandu Fast Refresh] preamble failed:", err);
+    });
+})();
+</script>`;
+}

package/src/bundler/index.ts

@@ -4,7 +4,8 @@
  */
 
 export * from "./types";
-export * from "./build";
-export * from "./dev";
+export * from "./build";
+export * from "./client-boundary-transform";
+export * from "./dev";
 export * from "./css";
 export * from "./plugins";

package/src/bundler/manifest-schema.ts

@@ -173,6 +173,15 @@ const PartialEntrySchema = z.object({
   priority: PrioritySchema,
 });
 
+const BoundaryEntrySchema = z.object({
+  route: z.string().min(1),
+  js: safeManduUrl("boundaries[].js"),
+  module: z.string().min(1),
+  exportName: z.string().min(1),
+  priority: PrioritySchema,
+  hydrate: z.string().min(1),
+});
+
 const FastRefreshSchema = z.object({
   runtime: safeManduUrl("shared.fastRefresh.runtime"),
   glue: safeManduUrl("shared.fastRefresh.glue"),
@@ -229,6 +238,7 @@ export const BundleManifestSchema = z
     bundles: z.record(z.string(), BundleEntrySchema),
     islands: z.record(z.string(), IslandEntrySchema).optional(),
     partials: z.record(z.string(), PartialEntrySchema).optional(),
+    boundaries: z.record(z.string(), BoundaryEntrySchema).optional(),
     shared: SharedSchema,
     importMap: ImportMapSchema.optional(),
   })

package/src/bundler/types.ts

@@ -77,8 +77,26 @@ export interface BundleManifest {
       priority: "immediate" | "visible" | "idle" | "interaction";
     }
   >;
-  /** 공유 청크 */
-  shared: {
+  /** Compiler-owned client boundary bundles keyed by boundary id. */
+  boundaries?: Record<
+    string,
+    {
+      /** Owning route id */
+      route: string;
+      /** JavaScript bundle path */
+      js: string;
+      /** Source client module */
+      module: string;
+      /** Client export name */
+      exportName: string;
+      /** Hydration priority */
+      priority: "immediate" | "visible" | "idle" | "interaction";
+      /** Hydration mode emitted into data-hydrate */
+      hydrate: string;
+    }
+  >;
+  /** 공유 청크 */
+  shared: {
     /** Hydration 런타임 */
     runtime: string;
     /** React 번들 경로 */

package/src/diagnose/__tests__/checks.test.ts

@@ -16,9 +16,10 @@ import {
   checkPrerenderPollution,
   checkCloneElementWarnings,
   checkDevArtifactsInProd,
-  checkPackageExportGaps,
-  checkNestedInternalCore,
-} from "../checks";
+  checkPackageExportGaps,
+  checkNestedInternalCore,
+  checkClientBoundaryManifests,
+} from "../checks";
 import { runExtendedDiagnose, buildReport } from "../run";
 
 async function mkTmpRoot(): Promise<string> {
@@ -324,7 +325,7 @@ describe("checkPackageExportGaps", () => {
 // nested_internal_core (#261)
 // ──────────────────────────────────────────────────────────────────
 
-describe("checkNestedInternalCore", () => {
+describe("checkNestedInternalCore", () => {
   let rootDir: string;
   beforeEach(async () => { rootDir = await mkTmpRoot(); });
   afterEach(async () => { await fs.rm(rootDir, { recursive: true, force: true }); });
@@ -387,21 +388,119 @@ describe("checkNestedInternalCore", () => {
     expect(result.ok).toBe(false);
     expect(result.details?.mismatchCount).toBe(2);
   });
-});
-
-// ──────────────────────────────────────────────────────────────────
-// aggregator
-// ──────────────────────────────────────────────────────────────────
+});
+
+// ──────────────────────────────────────────────────────────────────
+// client_boundary_manifests
+// ──────────────────────────────────────────────────────────────────
+
+describe("checkClientBoundaryManifests", () => {
+  let rootDir: string;
+  beforeEach(async () => { rootDir = await mkTmpRoot(); });
+  afterEach(async () => { await fs.rm(rootDir, { recursive: true, force: true }); });
+
+  it("skips gracefully when routes manifest is missing", async () => {
+    const result = await checkClientBoundaryManifests(rootDir);
+    expect(result.ok).toBe(true);
+    expect(result.details?.skipped).toBe(true);
+  });
+
+  it("passes when the routes manifest has no compiler-owned boundaries", async () => {
+    await writeFile(rootDir, ".mandu/routes.manifest.json", JSON.stringify({
+      routes: [{ id: "home", kind: "page" }],
+    }));
+    const result = await checkClientBoundaryManifests(rootDir);
+    expect(result.ok).toBe(true);
+    expect(result.details?.boundaryCount).toBe(0);
+  });
+
+  it("flags duplicate client boundary ids in the routes manifest", async () => {
+    await writeFile(rootDir, ".mandu/routes.manifest.json", JSON.stringify({
+      routes: [
+        {
+          id: "a",
+          boundaries: [{ id: "dup--0", routeId: "a", module: "src/client/A.client.tsx", exportName: "A" }],
+        },
+        {
+          id: "b",
+          boundaries: [{ id: "dup--0", routeId: "b", module: "src/client/B.client.tsx", exportName: "B" }],
+        },
+      ],
+    }));
+    const result = await checkClientBoundaryManifests(rootDir);
+    expect(result.ok).toBe(false);
+    expect(result.severity).toBe("error");
+    expect(result.message).toMatch(/duplicate/);
+  });
+
+  it("flags missing boundary bundle manifest entries", async () => {
+    await writeFile(rootDir, ".mandu/routes.manifest.json", JSON.stringify({
+      routes: [
+        {
+          id: "home",
+          boundaries: [{ id: "home--0", routeId: "home", module: "src/client/Home.client.tsx", exportName: "Home" }],
+        },
+      ],
+    }));
+    await writeFile(rootDir, ".mandu/manifest.json", JSON.stringify({
+      version: 1,
+      buildTime: "x",
+      env: "production",
+      bundles: {},
+      boundaries: {},
+      shared: { runtime: "/.mandu/client/_runtime.js", vendor: "/.mandu/client/_react.js" },
+    }));
+    const result = await checkClientBoundaryManifests(rootDir);
+    expect(result.ok).toBe(false);
+    expect(result.severity).toBe("error");
+    expect(result.message).toMatch(/incomplete/);
+    expect(result.details?.missingEntries).toEqual(["home--0"]);
+  });
+
+  it("passes when route and bundle boundary manifests line up", async () => {
+    await writeFile(rootDir, ".mandu/routes.manifest.json", JSON.stringify({
+      routes: [
+        {
+          id: "home",
+          boundaries: [{ id: "home--0", routeId: "home", module: "src/client/Home.client.tsx", exportName: "Home" }],
+        },
+      ],
+    }));
+    await writeFile(rootDir, ".mandu/client/home--0.boundary.js", "export default function Home() {}\n");
+    await writeFile(rootDir, ".mandu/manifest.json", JSON.stringify({
+      version: 1,
+      buildTime: "x",
+      env: "production",
+      bundles: {},
+      boundaries: {
+        "home--0": {
+          route: "home",
+          js: "/.mandu/client/home--0.boundary.js",
+          module: "src/client/Home.client.tsx",
+          exportName: "Home",
+        },
+      },
+      shared: { runtime: "/.mandu/client/_runtime.js", vendor: "/.mandu/client/_react.js" },
+    }));
+    const result = await checkClientBoundaryManifests(rootDir);
+    expect(result.ok).toBe(true);
+    expect(result.details?.boundaryCount).toBe(1);
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────
+// aggregator
+// ──────────────────────────────────────────────────────────────────
 
 describe("runExtendedDiagnose", () => {
   let rootDir: string;
   beforeEach(async () => { rootDir = await mkTmpRoot(); });
   afterEach(async () => { await fs.rm(rootDir, { recursive: true, force: true }); });
 
-  it("runs all 7 extended checks and returns a structured report", async () => {
-    const report = await runExtendedDiagnose(rootDir);
-    // #261 added `nested_internal_core` — total is now 7.
-    expect(report.summary.total).toBe(7);
+  it("runs all 8 extended checks and returns a structured report", async () => {
+    const report = await runExtendedDiagnose(rootDir);
+    // F42/F45 added `client_boundary_manifests` — total is now 8.
+    expect(report.summary.total).toBe(8);
     // manifest is missing → at least one error
     expect(report.healthy).toBe(false);
     expect(report.errorCount).toBeGreaterThanOrEqual(1);
@@ -410,10 +509,11 @@ describe("runExtendedDiagnose", () => {
     expect(rules).toContain("prerender_pollution");
     expect(rules).toContain("cloneelement_warnings");
     expect(rules).toContain("dev_artifacts_in_prod");
-    expect(rules).toContain("package_export_gaps");
-    expect(rules).toContain("nested_internal_core");
-    expect(rules).toContain("a11y_hints");
-  });
+    expect(rules).toContain("package_export_gaps");
+    expect(rules).toContain("nested_internal_core");
+    expect(rules).toContain("client_boundary_manifests");
+    expect(rules).toContain("a11y_hints");
+  });
 
   it("returns healthy=true when all checks pass (production manifest, no gaps)", async () => {
     await writeFile(rootDir, ".mandu/manifest.json", JSON.stringify({

package/src/diagnose/checks.ts

@@ -767,7 +767,7 @@ async function listMandujsSiblings(rootDir: string): Promise<string[]> {
  * version to the hoisted core. A mismatch is reported as `error`
  * (boot-breaking on the user's machine) with a copy-pastable fix.
  */
-export async function checkNestedInternalCore(rootDir: string): Promise<DiagnoseCheckResult> {
+export async function checkNestedInternalCore(rootDir: string): Promise<DiagnoseCheckResult> {
   const hoistedPath = path.join(rootDir, "node_modules", "@mandujs", "core", "package.json");
   const hoistedVersion = await readPackageVersion(hoistedPath);
 
@@ -828,5 +828,186 @@ export async function checkNestedInternalCore(rootDir: string): Promise<Diagnose
       mismatchCount: mismatches.length,
       mismatches,
     },
-  };
-}
+  };
+}
+
+// ────────────────────────────────────────────────────────────────────────
+// 8. client_boundary_manifests (F42/F45)
+// ────────────────────────────────────────────────────────────────────────
+
+interface DiagnoseRouteBoundary {
+  id?: unknown;
+  routeId?: unknown;
+  module?: unknown;
+  exportName?: unknown;
+  source?: unknown;
+}
+
+interface DiagnoseRouteRecord {
+  id?: unknown;
+  boundaries?: unknown;
+}
+
+async function readJsonObject(filePath: string): Promise<Record<string, unknown> | null> {
+  try {
+    const raw = await fs.readFile(filePath, "utf-8");
+    const parsed = JSON.parse(raw) as unknown;
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function toRouteRecords(value: unknown): DiagnoseRouteRecord[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry): entry is DiagnoseRouteRecord =>
+    !!entry && typeof entry === "object" && !Array.isArray(entry)
+  );
+}
+
+function toRouteBoundaries(route: DiagnoseRouteRecord): DiagnoseRouteBoundary[] {
+  if (!Array.isArray(route.boundaries)) return [];
+  return route.boundaries.filter((entry): entry is DiagnoseRouteBoundary =>
+    !!entry && typeof entry === "object" && !Array.isArray(entry)
+  );
+}
+
+function bundleAssetExists(rootDir: string, jsPath: unknown): Promise<boolean> {
+  if (typeof jsPath !== "string" || jsPath.length === 0) return Promise.resolve(false);
+  const relativePath = jsPath.startsWith("/")
+    ? jsPath.slice(1)
+    : jsPath;
+  return fs.access(path.join(rootDir, relativePath)).then(
+    () => true,
+    () => false,
+  );
+}
+
+/**
+ * F42/F45 check: validate compiler-owned client boundary records.
+ *
+ * This does not rebuild the app. It inspects generated route and bundle
+ * manifests and reports:
+ *   - duplicate boundary ids in `.mandu/routes.manifest.json`
+ *   - malformed boundary records missing id/module/exportName
+ *   - missing boundary bundle entries in `.mandu/manifest.json`
+ *   - boundary bundle entries whose JS asset is absent on disk
+ */
+export async function checkClientBoundaryManifests(rootDir: string): Promise<DiagnoseCheckResult> {
+  const routesManifestPath = path.join(rootDir, ".mandu", "routes.manifest.json");
+  const routesManifest = await readJsonObject(routesManifestPath);
+
+  if (!routesManifest) {
+    return {
+      ok: true,
+      rule: "client_boundary_manifests",
+      message: "Routes manifest is missing or unreadable — boundary manifest check skipped.",
+      details: { skipped: true, routesManifestPath: path.relative(rootDir, routesManifestPath) },
+    };
+  }
+
+  const boundaries: Array<{ routeId: string; id: string; module: string; exportName: string }> = [];
+  const malformed: Array<{ routeId: string; reason: string }> = [];
+  const seen = new Map<string, string>();
+  const duplicates: Array<{ id: string; firstRouteId: string; duplicateRouteId: string }> = [];
+
+  for (const route of toRouteRecords(routesManifest.routes)) {
+    const routeId = typeof route.id === "string" ? route.id : "(unknown-route)";
+    for (const boundary of toRouteBoundaries(route)) {
+      const id = typeof boundary.id === "string" ? boundary.id : "";
+      const module = typeof boundary.module === "string" ? boundary.module : "";
+      const exportName = typeof boundary.exportName === "string" ? boundary.exportName : "";
+      if (!id || !module || !exportName) {
+        malformed.push({ routeId, reason: "Boundary record must include id, module, and exportName." });
+        continue;
+      }
+
+      const firstRouteId = seen.get(id);
+      if (firstRouteId) {
+        duplicates.push({ id, firstRouteId, duplicateRouteId: routeId });
+      } else {
+        seen.set(id, routeId);
+      }
+      boundaries.push({ routeId, id, module, exportName });
+    }
+  }
+
+  if (malformed.length > 0 || duplicates.length > 0) {
+    return {
+      ok: false,
+      rule: "client_boundary_manifests",
+      severity: "error",
+      message: `Client boundary route manifest has ${malformed.length} malformed record(s) and ${duplicates.length} duplicate id(s).`,
+      suggestion: "Regenerate routes with `mandu generate` or rerun the build; boundary ids must be unique and include id/module/exportName.",
+      details: {
+        boundaryCount: boundaries.length,
+        malformed: malformed.slice(0, 10),
+        duplicates: duplicates.slice(0, 10),
+      },
+    };
+  }
+
+  if (boundaries.length === 0) {
+    return {
+      ok: true,
+      rule: "client_boundary_manifests",
+      message: "No compiler-owned client boundaries recorded in the routes manifest.",
+      details: { boundaryCount: 0 },
+    };
+  }
+
+  const bundleManifestPath = path.join(rootDir, ".mandu", "manifest.json");
+  const bundleManifest = await readJsonObject(bundleManifestPath);
+  if (!bundleManifest) {
+    return {
+      ok: false,
+      rule: "client_boundary_manifests",
+      severity: "warning",
+      message: `Routes manifest declares ${boundaries.length} client boundary record(s), but bundle manifest is missing.`,
+      suggestion: "Run `mandu build` before deploy so boundary bundles are emitted and can be checked.",
+      details: { boundaryCount: boundaries.length, bundleManifestPath: path.relative(rootDir, bundleManifestPath) },
+    };
+  }
+
+  const bundleBoundaries = bundleManifest.boundaries && typeof bundleManifest.boundaries === "object" && !Array.isArray(bundleManifest.boundaries)
+    ? bundleManifest.boundaries as Record<string, unknown>
+    : {};
+  const missingEntries: string[] = [];
+  const missingAssets: string[] = [];
+
+  for (const boundary of boundaries) {
+    const entry = bundleBoundaries[boundary.id];
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      missingEntries.push(boundary.id);
+      continue;
+    }
+    const jsPath = (entry as { js?: unknown }).js;
+    if (!(await bundleAssetExists(rootDir, jsPath))) {
+      missingAssets.push(boundary.id);
+    }
+  }
+
+  if (missingEntries.length > 0 || missingAssets.length > 0) {
+    return {
+      ok: false,
+      rule: "client_boundary_manifests",
+      severity: "error",
+      message: `Client boundary bundle manifest is incomplete: ${missingEntries.length} missing entr${missingEntries.length === 1 ? "y" : "ies"}, ${missingAssets.length} missing asset(s).`,
+      suggestion: "Run `mandu clean && mandu build`; if the issue persists, inspect `mandu.route.boundaries` with `includeBundle: true`.",
+      details: {
+        boundaryCount: boundaries.length,
+        missingEntries: missingEntries.slice(0, 10),
+        missingAssets: missingAssets.slice(0, 10),
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    rule: "client_boundary_manifests",
+    message: `Client boundary manifests are consistent for ${boundaries.length} boundary record(s).`,
+    details: { boundaryCount: boundaries.length },
+  };
+}