@mandujs/core 0.54.31 → 0.55.0-beta.1

package/src/bundler/__tests__/prod-smoke.test.ts

@@ -1,138 +1,138 @@
-/**
- * Phase 7.2 R1 Agent C (H4) — production bundle smoke tests.
- *
- * Confirms the Phase 7.1 audit finding L-02 regression is closed: a
- * production build (`minify: true`, no Fast Refresh plugin) must NEVER
- * leak the dev-only symbols that would otherwise install Fast Refresh
- * stubs on `window` (`$RefreshReg$` / `$RefreshSig$` / `__MANDU_HMR__`)
- * or pull in the vendor runtime (`_vendor-react-refresh`).
- *
- * We assert at two layers:
- *   (A) the generated output JS bundle is free of the dev symbols
- *   (B) the returned manifest has `shared.fastRefresh === undefined`
- *
- * Both layers matter because (A) can drift independently of (B) if a
- * future refactor inlines a symbol name into a comment or data literal.
- *
- * References:
- *   docs/security/phase-7-1-audit.md §3 L-02
- *   docs/bun/phase-7-2-team-plan.md §3 Agent C H4
- */
-
-import { describe, expect, test, beforeAll, afterAll } from "bun:test";
-import { mkdtemp, mkdir, rm, writeFile } from "fs/promises";
-import fs from "fs/promises";
-import { tmpdir } from "os";
-import path from "path";
-import { fastRefreshPlugin } from "../fast-refresh-plugin";
-
-/**
- * Strings we treat as dev-only Fast Refresh fingerprints. Any of them
- * appearing in a prod bundle is a leak. We keep the list small and
- * precise so we don't false-flag legitimate unrelated code.
- */
-const DEV_LEAK_FINGERPRINTS = [
-  "$RefreshReg$",
-  "$RefreshSig$",
-  "__MANDU_HMR__",
-  "_vendor-react-refresh",
-  "_fast-refresh-runtime",
-] as const;
-
-// Integration tests that spin up Bun.build are gated on CI flaky-matrix
-// environments. See `fast-refresh.test.ts` for the same pattern.
-describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
-  "prod-smoke — no Fast Refresh leak in production bundles",
-  () => {
-    let rootDir = "";
-
-    beforeAll(async () => {
-      rootDir = await mkdtemp(path.join(tmpdir(), "mandu-prod-smoke-"));
-      // Minimal island source — no JSX runtime, no imports, small AST
-      await writeFile(
-        path.join(rootDir, "counter.client.tsx"),
-        `import { useState } from 'react';
-export default function Counter() {
-  const [count, setCount] = useState(0);
-  return <button onClick={() => setCount(c => c + 1)}>{count}</button>;
-}
-`,
-        "utf-8",
-      );
-    });
-
-    afterAll(async () => {
-      if (rootDir) await rm(rootDir, { recursive: true, force: true });
-    });
-
-    test("[S1] production build output contains no dev-only Fast Refresh symbols", async () => {
-      // Prod path: `reactFastRefresh` off, plugin `disabled: true`,
-      // minify on. Matches the config `buildClientBundles` uses when
-      // `options.minify === true`.
-      const result = await Bun.build({
-        entrypoints: [path.join(rootDir, "counter.client.tsx")],
-        target: "browser",
-        minify: true,
-        plugins: [fastRefreshPlugin({ disabled: true })],
-        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
-      });
-      expect(result.success).toBe(true);
-
-      const src = await result.outputs[0]!.text();
-      for (const fingerprint of DEV_LEAK_FINGERPRINTS) {
-        expect(src.includes(fingerprint)).toBe(false);
-      }
-    });
-
-    test("[S2] prod build with reactFastRefresh=true explicitly disabled does not emit stubs", async () => {
-      // Defense-in-depth: even if a future config accident leaves
-      // `reactFastRefresh: false` off-by-default, the disabled plugin
-      // MUST still prevent injection. We pass reactFastRefresh: false
-      // here to represent the guaranteed-prod config.
-      const result = await Bun.build({
-        entrypoints: [path.join(rootDir, "counter.client.tsx")],
-        target: "browser",
-        minify: true,
-        reactFastRefresh: false,
-        plugins: [fastRefreshPlugin({ disabled: true })],
-        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
-      });
-      expect(result.success).toBe(true);
-
-      const src = await result.outputs[0]!.text();
-      expect(src).not.toContain("$RefreshReg$");
-      expect(src).not.toContain("$RefreshSig$");
-      expect(src).not.toContain("__MANDU_HMR__");
-    });
-  },
-);
-
-// Pure manifest-shape tests run regardless of the bundler skip flag —
-// they don't invoke Bun.build and are safe everywhere.
-describe("prod-smoke — manifest shape invariants (no Bun.build)", () => {
-  test("[M1] buildClientBundles prod path would omit shared.fastRefresh", async () => {
-    // We cannot easily invoke `buildClientBundles` here without a
-    // full Mandu project scaffold, so we assert the contract
-    // semantically via the static build.ts source: the `fastRefresh`
-    // field is populated only when the vendor shim result has both
-    // `reactRefreshRuntime` and `fastRefreshRuntime`. In prod mode
-    // `buildVendorShims` is called with `isDev: false` which returns
-    // empty strings for those — unwinding to `undefined` in the
-    // ternary at `build.ts:1548-1554`.
-    //
-    // This test documents the invariant textually; the bundler-level
-    // integration tests (S1/S2 above) prove the output side.
-    const buildSource = await fs.readFile(
-      path.join(
-        import.meta.dir,
-        "..",
-        "build.ts",
-      ),
-      "utf-8",
-    );
-    // The precise construction MUST be guarded by runtime presence.
-    expect(buildSource).toContain("vendorResult.reactRefreshRuntime && vendorResult.fastRefreshRuntime");
-    // And MUST spread-conditionally include the field.
-    expect(buildSource).toContain("...(fastRefresh ? { fastRefresh } : {})");
-  });
-});
+/**
+ * Phase 7.2 R1 Agent C (H4) — production bundle smoke tests.
+ *
+ * Confirms the Phase 7.1 audit finding L-02 regression is closed: a
+ * production build (`minify: true`, no Fast Refresh plugin) must NEVER
+ * leak the dev-only symbols that would otherwise install Fast Refresh
+ * stubs on `window` (`$RefreshReg$` / `$RefreshSig$` / `__MANDU_HMR__`)
+ * or pull in the vendor runtime (`_vendor-react-refresh`).
+ *
+ * We assert at two layers:
+ *   (A) the generated output JS bundle is free of the dev symbols
+ *   (B) the returned manifest has `shared.fastRefresh === undefined`
+ *
+ * Both layers matter because (A) can drift independently of (B) if a
+ * future refactor inlines a symbol name into a comment or data literal.
+ *
+ * References:
+ *   docs/security/phase-7-1-audit.md §3 L-02
+ *   docs/bun/phase-7-2-team-plan.md §3 Agent C H4
+ */
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "fs/promises";
+import fs from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+import { fastRefreshPlugin } from "../fast-refresh-plugin";
+
+/**
+ * Strings we treat as dev-only Fast Refresh fingerprints. Any of them
+ * appearing in a prod bundle is a leak. We keep the list small and
+ * precise so we don't false-flag legitimate unrelated code.
+ */
+const DEV_LEAK_FINGERPRINTS = [
+  "$RefreshReg$",
+  "$RefreshSig$",
+  "__MANDU_HMR__",
+  "_vendor-react-refresh",
+  "_fast-refresh-runtime",
+] as const;
+
+// Integration tests that spin up Bun.build are gated on CI flaky-matrix
+// environments. See `fast-refresh.test.ts` for the same pattern.
+describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
+  "prod-smoke — no Fast Refresh leak in production bundles",
+  () => {
+    let rootDir = "";
+
+    beforeAll(async () => {
+      rootDir = await mkdtemp(path.join(tmpdir(), "mandu-prod-smoke-"));
+      // Minimal island source — no JSX runtime, no imports, small AST
+      await writeFile(
+        path.join(rootDir, "counter.client.tsx"),
+        `import { useState } from 'react';
+export default function Counter() {
+  const [count, setCount] = useState(0);
+  return <button onClick={() => setCount(c => c + 1)}>{count}</button>;
+}
+`,
+        "utf-8",
+      );
+    });
+
+    afterAll(async () => {
+      if (rootDir) await rm(rootDir, { recursive: true, force: true });
+    });
+
+    test("[S1] production build output contains no dev-only Fast Refresh symbols", async () => {
+      // Prod path: `reactFastRefresh` off, plugin `disabled: true`,
+      // minify on. Matches the config `buildClientBundles` uses when
+      // `options.minify === true`.
+      const result = await Bun.build({
+        entrypoints: [path.join(rootDir, "counter.client.tsx")],
+        target: "browser",
+        minify: true,
+        plugins: [fastRefreshPlugin({ disabled: true })],
+        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
+      });
+      expect(result.success).toBe(true);
+
+      const src = await result.outputs[0]!.text();
+      for (const fingerprint of DEV_LEAK_FINGERPRINTS) {
+        expect(src.includes(fingerprint)).toBe(false);
+      }
+    });
+
+    test("[S2] prod build with reactFastRefresh=true explicitly disabled does not emit stubs", async () => {
+      // Defense-in-depth: even if a future config accident leaves
+      // `reactFastRefresh: false` off-by-default, the disabled plugin
+      // MUST still prevent injection. We pass reactFastRefresh: false
+      // here to represent the guaranteed-prod config.
+      const result = await Bun.build({
+        entrypoints: [path.join(rootDir, "counter.client.tsx")],
+        target: "browser",
+        minify: true,
+        reactFastRefresh: false,
+        plugins: [fastRefreshPlugin({ disabled: true })],
+        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
+      });
+      expect(result.success).toBe(true);
+
+      const src = await result.outputs[0]!.text();
+      expect(src).not.toContain("$RefreshReg$");
+      expect(src).not.toContain("$RefreshSig$");
+      expect(src).not.toContain("__MANDU_HMR__");
+    });
+  },
+);
+
+// Pure manifest-shape tests run regardless of the bundler skip flag —
+// they don't invoke Bun.build and are safe everywhere.
+describe("prod-smoke — manifest shape invariants (no Bun.build)", () => {
+  test("[M1] buildClientBundles prod path would omit shared.fastRefresh", async () => {
+    // We cannot easily invoke `buildClientBundles` here without a
+    // full Mandu project scaffold, so we assert the contract
+    // semantically via the static build.ts source: the `fastRefresh`
+    // field is populated only when the vendor shim result has both
+    // `reactRefreshRuntime` and `fastRefreshRuntime`. In prod mode
+    // `buildVendorShims` is called with `isDev: false` which returns
+    // empty strings for those — unwinding to `undefined` in the
+    // ternary at `build.ts:1548-1554`.
+    //
+    // This test documents the invariant textually; the bundler-level
+    // integration tests (S1/S2 above) prove the output side.
+    const buildSource = await fs.readFile(
+      path.join(
+        import.meta.dir,
+        "..",
+        "build.ts",
+      ),
+      "utf-8",
+    );
+    // The precise construction MUST be guarded by runtime presence.
+    expect(buildSource).toContain("vendorResult.reactRefreshRuntime && vendorResult.fastRefreshRuntime");
+    // And MUST spread-conditionally include the field.
+    expect(buildSource).toContain("...(fastRefresh ? { fastRefresh } : {})");
+  });
+});

package/src/bundler/__tests__/reverse-import-graph.test.ts

@@ -343,18 +343,18 @@ describe("scanFileImports — end-to-end", () => {
  */
 const WATCH_SETTLE_MS = 400;
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function waitFor(predicate: () => boolean, timeoutMs = 5_000): Promise<boolean> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (predicate()) return true;
-    await sleep(50);
-  }
-  return predicate();
-}
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitFor(predicate: () => boolean, timeoutMs = 5_000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (predicate()) return true;
+    await sleep(50);
+  }
+  return predicate();
+}
 
 function createTempProject(): string {
   const root = mkdtempSync(path.join(tmpdir(), "mandu-189-"));
@@ -443,37 +443,37 @@ describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
         onSSRChange: (filePath) => {
           ssrCalls.push(filePath);
         },
-      });
-      close = bundler.close;
-      await bundler.reverseGraphReady;
-
-      // The leaf change should reach onSSRChange via the
-      // barrel -> page.tsx transitive chain. The callback is
-      // invoked with the normalized absolute path of page.tsx
+      });
+      close = bundler.close;
+      await bundler.reverseGraphReady;
+
+      // The leaf change should reach onSSRChange via the
+      // barrel -> page.tsx transitive chain. The callback is
+      // invoked with the normalized absolute path of page.tsx
       // (the SSR root that imports the barrel).
       const normalizedPage =
         process.platform === "win32"
           ? path
               .resolve(rootDir, "app/page.tsx")
               .replace(/\\/g, "/")
-              .toLowerCase()
-          : path.resolve(rootDir, "app/page.tsx").replace(/\\/g, "/");
-
-      // Deep leaf edit — NOT in any known root set, NOT in a default
-      // common dir (`app/` isn't a common dir by default). During the
-      // full suite, reverse-graph seeding and Windows watcher arming can
-      // race the first write, so retry with distinct contents until the
-      // observable SSR root dispatch appears.
-      for (let attempt = 0; attempt < 5 && !ssrCalls.includes(normalizedPage); attempt++) {
-        writeFileSync(
-          path.join(rootDir, "app/_utils/translations/ko.ts"),
-          `export const greeting = "안녕하세요-${attempt}";\n`,
-        );
-        await waitFor(() => ssrCalls.includes(normalizedPage), WATCH_SETTLE_MS);
-      }
-
-      expect(ssrCalls.length).toBeGreaterThanOrEqual(1);
-      // Exact path match — defensive so a future refactor that loses
+              .toLowerCase()
+          : path.resolve(rootDir, "app/page.tsx").replace(/\\/g, "/");
+
+      // Deep leaf edit — NOT in any known root set, NOT in a default
+      // common dir (`app/` isn't a common dir by default). During the
+      // full suite, reverse-graph seeding and Windows watcher arming can
+      // race the first write, so retry with distinct contents until the
+      // observable SSR root dispatch appears.
+      for (let attempt = 0; attempt < 5 && !ssrCalls.includes(normalizedPage); attempt++) {
+        writeFileSync(
+          path.join(rootDir, "app/_utils/translations/ko.ts"),
+          `export const greeting = "안녕하세요-${attempt}";\n`,
+        );
+        await waitFor(() => ssrCalls.includes(normalizedPage), WATCH_SETTLE_MS);
+      }
+
+      expect(ssrCalls.length).toBeGreaterThanOrEqual(1);
+      // Exact path match — defensive so a future refactor that loses
       // the normalization surfaces here, not in production.
       expect(ssrCalls).toContain(normalizedPage);
     });
@@ -502,11 +502,11 @@ describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
           // specific-path dispatch here.
           if (filePath !== SSR_CHANGE_WILDCARD) ssrCalls.push(filePath);
         },
-      });
-      close = bundler.close;
-      await bundler.reverseGraphReady;
-
-      // Write a brand-new file that nothing imports. Has to live
+      });
+      close = bundler.close;
+      await bundler.reverseGraphReady;
+
+      // Write a brand-new file that nothing imports. Has to live
       // UNDER a watched directory for the watcher to see it at all;
       // `app/` is covered because `page.tsx` itself is there.
       const orphan = path.join(rootDir, "app/orphan.ts");