@mandujs/core 0.54.31 → 0.55.0-beta.1

package/src/bundler/manifest-schema.ts

@@ -28,8 +28,8 @@
  *
  * URL safety model (applies to `shared.runtime`, `shared.vendor`,
  * `shared.router`, `shared.fastRefresh.glue`, `shared.fastRefresh.runtime`,
- * `bundles[].js`, `bundles[].css`, `islands[].js`, `partials[].js`,
- * `importMap.imports[*]`):
+ * `bundles[].js`, `bundles[].css`, `islands[].js`, `partials[].js`,
+ * `importMap.imports[*]`):
  *
  *   ALLOW:  absolute paths rooted at `/.mandu/client/` ending in `.js` or `.css`.
  *           The bundler itself only ever emits this shape.
@@ -126,7 +126,7 @@ export class ManifestValidationError extends Error {
  * check at preamble emit time — defense in depth against a manifest that
  * slipped past validation (e.g. skipFrameworkBundles fallback path).
  */
-export function isSafeManduUrl(url: unknown): url is string {
+export function isSafeManduUrl(url: unknown): url is string {
   if (typeof url !== "string") return false;
   if (url.length === 0 || url.length > MAX_MANIFEST_URL_LEN) return false;
   if (FORBIDDEN_URL_CHARS.test(url)) return false;
@@ -134,7 +134,19 @@ export function isSafeManduUrl(url: unknown): url is string {
     if (url.includes(s)) return false;
   }
   return SAFE_MANDU_URL_REGEX.test(url);
-}
+}
+
+/**
+ * Response-time variant of `isSafeManduUrl`. Published HTML may add one
+ * framework-owned `g=<generationId>` query parameter so an older document
+ * keeps loading assets from its own immutable build generation. Raw manifests
+ * remain query-free and continue to use the stricter predicate above.
+ */
+export function isSafePublishedManduUrl(url: unknown): url is string {
+  if (typeof url !== "string") return false;
+  const match = /^(.*)\?g=([a-z0-9][a-z0-9-]{5,127})$/.exec(url);
+  return match ? isSafeManduUrl(match[1]) : isSafeManduUrl(url);
+}
 
 /**
  * Zod refinement that runs `isSafeManduUrl` with a helpful error message.
@@ -162,34 +174,36 @@ const BundleEntrySchema = z.object({
   priority: PrioritySchema,
 });
 
-const IslandEntrySchema = z.object({
-  js: safeManduUrl("islands[].js"),
-  route: z.string().min(1),
-  priority: PrioritySchema,
-});
-
-const PartialEntrySchema = z.object({
-  js: safeManduUrl("partials[].js"),
-  priority: PrioritySchema,
-});
-
-const BoundaryEntrySchema = z.object({
-  route: z.string().min(1),
-  js: safeManduUrl("boundaries[].js"),
-  module: z.string().min(1),
-  exportName: z.string().min(1),
-  priority: PrioritySchema,
-  hydrate: z.string().min(1),
-});
-
-const FastRefreshSchema = z.object({
-  runtime: safeManduUrl("shared.fastRefresh.runtime"),
-  glue: safeManduUrl("shared.fastRefresh.glue"),
+const IslandEntrySchema = z.object({
+  js: safeManduUrl("islands[].js"),
+  route: z.string().min(1),
+  priority: PrioritySchema,
+});
+
+const PartialEntrySchema = z.object({
+  js: safeManduUrl("partials[].js"),
+  priority: PrioritySchema,
+});
+
+const BoundaryEntrySchema = z.object({
+  route: z.string().min(1),
+  js: safeManduUrl("boundaries[].js"),
+  module: z.string().min(1),
+  exportName: z.string().min(1),
+  priority: PrioritySchema,
+  hydrate: z.string().min(1),
+});
+
+const FastRefreshSchema = z.object({
+  runtime: safeManduUrl("shared.fastRefresh.runtime"),
+  glue: safeManduUrl("shared.fastRefresh.glue"),
 });
 
-const SharedSchema = z.object({
-  runtime: safeManduUrl("shared.runtime"),
-  vendor: safeManduUrl("shared.vendor"),
+const SharedSchema = z.object({
+  // A successful zero-JS build has no client runtime/vendor artifacts.
+  // Empty strings are inert and are the canonical empty-manifest shape.
+  runtime: safeManduUrl("shared.runtime").or(z.literal("")),
+  vendor: safeManduUrl("shared.vendor").or(z.literal("")),
   router: safeManduUrl("shared.router").optional(),
   fastRefresh: FastRefreshSchema.optional(),
 });
@@ -230,16 +244,17 @@ const ImportMapSchema = z.object({
  * are allowed to be absent, matching the production manifest shape that
  * `build.ts` emits when dev-only assets are not generated.
  */
-export const BundleManifestSchema = z
-  .object({
-    version: z.number().int().min(1),
-    buildTime: z.string().min(1),
-    env: z.enum(["development", "production"]),
-    bundles: z.record(z.string(), BundleEntrySchema),
-    islands: z.record(z.string(), IslandEntrySchema).optional(),
-    partials: z.record(z.string(), PartialEntrySchema).optional(),
-    boundaries: z.record(z.string(), BoundaryEntrySchema).optional(),
-    shared: SharedSchema,
+export const BundleManifestSchema = z
+  .object({
+    version: z.number().int().min(1),
+    generationId: z.string().regex(/^[a-z0-9][a-z0-9-]{5,127}$/).optional(),
+    buildTime: z.string().min(1),
+    env: z.enum(["development", "production"]),
+    bundles: z.record(z.string(), BundleEntrySchema),
+    islands: z.record(z.string(), IslandEntrySchema).optional(),
+    partials: z.record(z.string(), PartialEntrySchema).optional(),
+    boundaries: z.record(z.string(), BoundaryEntrySchema).optional(),
+    shared: SharedSchema,
     importMap: ImportMapSchema.optional(),
   })
   .strict();

package/src/bundler/plugins/__tests__/block-generated-imports.test.ts

@@ -80,19 +80,19 @@ describe("defaultAllowImporter", () => {
 });
 
 describe("DEFAULT_BLOCK_FILTER", () => {
-  test("matches __generated__ specifiers", () => {
-    expect("./__generated__/foo").toMatch(DEFAULT_BLOCK_FILTER);
-    expect("../../src/__generated__/routes").toMatch(DEFAULT_BLOCK_FILTER);
-  });
-  test("matches direct .mandu/generated relative specifiers", () => {
-    expect("../.mandu/generated/routes").toMatch(DEFAULT_BLOCK_FILTER);
-    expect("../../../.mandu/generated/server/repos/party.repo").toMatch(DEFAULT_BLOCK_FILTER);
-  });
-  test("does NOT match look-alikes without double underscores", () => {
-    expect("./generated/foo".match(DEFAULT_BLOCK_FILTER)).toBeNull();
-    expect("./src/generate/foo".match(DEFAULT_BLOCK_FILTER)).toBeNull();
-  });
-});
+  test("matches __generated__ specifiers", () => {
+    expect("./__generated__/foo").toMatch(DEFAULT_BLOCK_FILTER);
+    expect("../../src/__generated__/routes").toMatch(DEFAULT_BLOCK_FILTER);
+  });
+  test("matches direct .mandu/generated relative specifiers", () => {
+    expect("../.mandu/generated/routes").toMatch(DEFAULT_BLOCK_FILTER);
+    expect("../../../.mandu/generated/server/repos/party.repo").toMatch(DEFAULT_BLOCK_FILTER);
+  });
+  test("does NOT match look-alikes without double underscores", () => {
+    expect("./generated/foo".match(DEFAULT_BLOCK_FILTER)).toBeNull();
+    expect("./src/generate/foo".match(DEFAULT_BLOCK_FILTER)).toBeNull();
+  });
+});
 
 describe("defaultBundlerPlugins", () => {
   test("installs block-generated-imports by default", () => {

package/src/bundler/plugins/__tests__/react-compiler-config.test.ts

@@ -1,83 +1,83 @@
-/**
- * `resolveReactCompilerConfig` — #240 Phase 2 auto-detect tests.
- *
- * The probe only fires when `enabled` is undefined. Explicit `true` /
- * `false` veto the probe so user intent always wins.
- *
- * Cache lifetime is per-process; we reset it between cases so a probe
- * from one fixture doesn't leak to the next.
- */
-import { describe, it, expect, beforeEach } from "bun:test";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-
-import {
-  resolveReactCompilerConfig,
-  _resetReactCompilerConfigCache,
-} from "../react-compiler-config";
-
-async function makeRoot(prefix: string): Promise<string> {
-  return fs.mkdtemp(path.join(os.tmpdir(), `mandu-rc-${prefix}-`));
-}
-
-beforeEach(() => {
-  _resetReactCompilerConfigCache();
-});
-
-describe("resolveReactCompilerConfig", () => {
-  it("explicit enabled:true honours the user even when peers are missing", async () => {
-    const root = await makeRoot("explicit-on");
-    const result = resolveReactCompilerConfig({ enabled: true }, root);
-    expect(result.enabled).toBe(true);
-    expect(result.autoDetected).toBe(false);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it("explicit enabled:false vetos the probe", async () => {
-    const root = await makeRoot("explicit-off");
-    const result = resolveReactCompilerConfig({ enabled: false }, root);
-    expect(result.enabled).toBe(false);
-    expect(result.autoDetected).toBe(false);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it("undefined enabled + missing peers → disabled silently", async () => {
-    const root = await makeRoot("auto-no-peers");
-    // Empty rootDir — no node_modules, no package.json, no peer deps.
-    const result = resolveReactCompilerConfig(undefined, root);
-    expect(result.enabled).toBe(false);
-    expect(result.autoDetected).toBe(false);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it("forwards compilerConfig regardless of enabled state", async () => {
-    const root = await makeRoot("compiler-config");
-    const cfg = { compilationMode: "annotation" };
-    const result = resolveReactCompilerConfig(
-      { enabled: true, compilerConfig: cfg },
-      root,
-    );
-    expect(result.compilerConfig).toBe(cfg);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it("caches by (rootDir, explicit-enabled) — second call hits cache", async () => {
-    const root = await makeRoot("cache");
-    const a = resolveReactCompilerConfig(undefined, root);
-    const b = resolveReactCompilerConfig(undefined, root);
-    // Same identity — cache hit returns the stored object.
-    expect(a).toBe(b);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it("treats explicit-true vs auto as separate cache keys", async () => {
-    const root = await makeRoot("cache-key");
-    const auto = resolveReactCompilerConfig(undefined, root);
-    const explicit = resolveReactCompilerConfig({ enabled: true }, root);
-    expect(auto).not.toBe(explicit);
-    expect(auto.enabled).toBe(false);
-    expect(explicit.enabled).toBe(true);
-    await fs.rm(root, { recursive: true, force: true });
-  });
-});
+/**
+ * `resolveReactCompilerConfig` — #240 Phase 2 auto-detect tests.
+ *
+ * The probe only fires when `enabled` is undefined. Explicit `true` /
+ * `false` veto the probe so user intent always wins.
+ *
+ * Cache lifetime is per-process; we reset it between cases so a probe
+ * from one fixture doesn't leak to the next.
+ */
+import { describe, it, expect, beforeEach } from "bun:test";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  resolveReactCompilerConfig,
+  _resetReactCompilerConfigCache,
+} from "../react-compiler-config";
+
+async function makeRoot(prefix: string): Promise<string> {
+  return fs.mkdtemp(path.join(os.tmpdir(), `mandu-rc-${prefix}-`));
+}
+
+beforeEach(() => {
+  _resetReactCompilerConfigCache();
+});
+
+describe("resolveReactCompilerConfig", () => {
+  it("explicit enabled:true honours the user even when peers are missing", async () => {
+    const root = await makeRoot("explicit-on");
+    const result = resolveReactCompilerConfig({ enabled: true }, root);
+    expect(result.enabled).toBe(true);
+    expect(result.autoDetected).toBe(false);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it("explicit enabled:false vetos the probe", async () => {
+    const root = await makeRoot("explicit-off");
+    const result = resolveReactCompilerConfig({ enabled: false }, root);
+    expect(result.enabled).toBe(false);
+    expect(result.autoDetected).toBe(false);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it("undefined enabled + missing peers → disabled silently", async () => {
+    const root = await makeRoot("auto-no-peers");
+    // Empty rootDir — no node_modules, no package.json, no peer deps.
+    const result = resolveReactCompilerConfig(undefined, root);
+    expect(result.enabled).toBe(false);
+    expect(result.autoDetected).toBe(false);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it("forwards compilerConfig regardless of enabled state", async () => {
+    const root = await makeRoot("compiler-config");
+    const cfg = { compilationMode: "annotation" };
+    const result = resolveReactCompilerConfig(
+      { enabled: true, compilerConfig: cfg },
+      root,
+    );
+    expect(result.compilerConfig).toBe(cfg);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it("caches by (rootDir, explicit-enabled) — second call hits cache", async () => {
+    const root = await makeRoot("cache");
+    const a = resolveReactCompilerConfig(undefined, root);
+    const b = resolveReactCompilerConfig(undefined, root);
+    // Same identity — cache hit returns the stored object.
+    expect(a).toBe(b);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it("treats explicit-true vs auto as separate cache keys", async () => {
+    const root = await makeRoot("cache-key");
+    const auto = resolveReactCompilerConfig(undefined, root);
+    const explicit = resolveReactCompilerConfig({ enabled: true }, root);
+    expect(auto).not.toBe(explicit);
+    expect(auto.enabled).toBe(false);
+    expect(explicit.enabled).toBe(true);
+    await fs.rm(root, { recursive: true, force: true });
+  });
+});

package/src/bundler/plugins/__tests__/react-compiler-lint.test.ts

@@ -1,110 +1,110 @@
-import { describe, expect, test } from "bun:test";
-import path from "node:path";
-import {
-  runReactCompilerLint,
-  formatCompilerReport,
-  type ReactCompilerDiagnostic,
-} from "../react-compiler-lint";
-
-describe("runReactCompilerLint", () => {
-  test("returns empty result with no targets without invoking ESLint", async () => {
-    const result = await runReactCompilerLint({
-      projectRoot: process.cwd(),
-      targetFiles: [],
-    });
-    expect(result.diagnostics).toEqual([]);
-    expect(result.skipped).toBe(false);
-  });
-
-  test("degrades gracefully when ESLint peer dep is missing", async () => {
-    // In a clean Mandu checkout `eslint` and
-    // `eslint-plugin-react-compiler` are not installed. The runner
-    // must report `skipped: true` + empty diagnostics + a skipReason.
-    const result = await runReactCompilerLint({
-      projectRoot: process.cwd(),
-      targetFiles: [path.resolve(__filename)],
-    });
-    // If ESLint happens to be installed in this env, diagnostics is
-    // either empty (this file has no bailouts) or the runner ran
-    // successfully. Either shape is valid — the contract we care
-    // about is "no throw + typed result."
-    expect(Array.isArray(result.diagnostics)).toBe(true);
-    expect(typeof result.skipped).toBe("boolean");
-    if (result.skipped) {
-      expect(typeof result.skipReason).toBe("string");
-    }
-  });
-});
-
-describe("formatCompilerReport", () => {
-  test("returns the no-bailouts sentinel for empty input", () => {
-    expect(formatCompilerReport([])).toContain("no bailouts detected");
-  });
-
-  test("summarises bailouts with file counts + bullet list", () => {
-    const diagnostics: ReactCompilerDiagnostic[] = [
-      {
-        file: "/app/todos/todo.island.tsx",
-        line: 42,
-        column: 5,
-        message: "Cannot memoize: ref escape in closure.",
-        ruleId: "react-compiler/react-compiler",
-        severity: "warning",
-      },
-      {
-        file: "/app/todos/todo.island.tsx",
-        line: 87,
-        column: 3,
-        message: "Cannot memoize: conditional hook call.",
-        ruleId: "react-compiler/react-compiler",
-        severity: "warning",
-      },
-      {
-        file: "/app/dashboard/chart.client.tsx",
-        line: 14,
-        column: 9,
-        message: "Cannot memoize: mutation of a shared value.",
-        ruleId: "react-compiler/react-compiler",
-        severity: "warning",
-      },
-    ];
-    const out = formatCompilerReport(diagnostics);
-    expect(out).toContain("3 bailout(s) in 2 file(s)");
-    expect(out).toContain("todo.island.tsx:42:5");
-    expect(out).toContain("chart.client.tsx:14:9");
-    expect(out).toContain("https://react.dev");
-  });
-
-  test("truncates past the limit with a '... N more' tail", () => {
-    const diagnostics: ReactCompilerDiagnostic[] = Array.from(
-      { length: 30 },
-      (_, i) => ({
-        file: `/app/x/c${i}.island.tsx`,
-        line: i + 1,
-        column: 1,
-        message: "bailout",
-        ruleId: "react-compiler/react-compiler",
-        severity: "warning" as const,
-      }),
-    );
-    const out = formatCompilerReport(diagnostics, { limit: 5 });
-    expect(out).toContain("30 bailout(s)");
-    expect(out).toContain("… and 25 more");
-  });
-
-  test("uses relative paths when projectRoot is provided", () => {
-    const diagnostic: ReactCompilerDiagnostic = {
-      file: path.resolve("/project/app/todo.island.tsx"),
-      line: 1,
-      column: 1,
-      message: "bailout",
-      ruleId: "react-compiler/react-compiler",
-      severity: "warning",
-    };
-    const out = formatCompilerReport([diagnostic], {
-      projectRoot: path.resolve("/project"),
-    });
-    expect(out).toContain(path.join("app", "todo.island.tsx"));
-    expect(out).not.toContain(path.resolve("/project/app"));
-  });
-});
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import {
+  runReactCompilerLint,
+  formatCompilerReport,
+  type ReactCompilerDiagnostic,
+} from "../react-compiler-lint";
+
+describe("runReactCompilerLint", () => {
+  test("returns empty result with no targets without invoking ESLint", async () => {
+    const result = await runReactCompilerLint({
+      projectRoot: process.cwd(),
+      targetFiles: [],
+    });
+    expect(result.diagnostics).toEqual([]);
+    expect(result.skipped).toBe(false);
+  });
+
+  test("degrades gracefully when ESLint peer dep is missing", async () => {
+    // In a clean Mandu checkout `eslint` and
+    // `eslint-plugin-react-compiler` are not installed. The runner
+    // must report `skipped: true` + empty diagnostics + a skipReason.
+    const result = await runReactCompilerLint({
+      projectRoot: process.cwd(),
+      targetFiles: [path.resolve(__filename)],
+    });
+    // If ESLint happens to be installed in this env, diagnostics is
+    // either empty (this file has no bailouts) or the runner ran
+    // successfully. Either shape is valid — the contract we care
+    // about is "no throw + typed result."
+    expect(Array.isArray(result.diagnostics)).toBe(true);
+    expect(typeof result.skipped).toBe("boolean");
+    if (result.skipped) {
+      expect(typeof result.skipReason).toBe("string");
+    }
+  });
+});
+
+describe("formatCompilerReport", () => {
+  test("returns the no-bailouts sentinel for empty input", () => {
+    expect(formatCompilerReport([])).toContain("no bailouts detected");
+  });
+
+  test("summarises bailouts with file counts + bullet list", () => {
+    const diagnostics: ReactCompilerDiagnostic[] = [
+      {
+        file: "/app/todos/todo.island.tsx",
+        line: 42,
+        column: 5,
+        message: "Cannot memoize: ref escape in closure.",
+        ruleId: "react-compiler/react-compiler",
+        severity: "warning",
+      },
+      {
+        file: "/app/todos/todo.island.tsx",
+        line: 87,
+        column: 3,
+        message: "Cannot memoize: conditional hook call.",
+        ruleId: "react-compiler/react-compiler",
+        severity: "warning",
+      },
+      {
+        file: "/app/dashboard/chart.client.tsx",
+        line: 14,
+        column: 9,
+        message: "Cannot memoize: mutation of a shared value.",
+        ruleId: "react-compiler/react-compiler",
+        severity: "warning",
+      },
+    ];
+    const out = formatCompilerReport(diagnostics);
+    expect(out).toContain("3 bailout(s) in 2 file(s)");
+    expect(out).toContain("todo.island.tsx:42:5");
+    expect(out).toContain("chart.client.tsx:14:9");
+    expect(out).toContain("https://react.dev");
+  });
+
+  test("truncates past the limit with a '... N more' tail", () => {
+    const diagnostics: ReactCompilerDiagnostic[] = Array.from(
+      { length: 30 },
+      (_, i) => ({
+        file: `/app/x/c${i}.island.tsx`,
+        line: i + 1,
+        column: 1,
+        message: "bailout",
+        ruleId: "react-compiler/react-compiler",
+        severity: "warning" as const,
+      }),
+    );
+    const out = formatCompilerReport(diagnostics, { limit: 5 });
+    expect(out).toContain("30 bailout(s)");
+    expect(out).toContain("… and 25 more");
+  });
+
+  test("uses relative paths when projectRoot is provided", () => {
+    const diagnostic: ReactCompilerDiagnostic = {
+      file: path.resolve("/project/app/todo.island.tsx"),
+      line: 1,
+      column: 1,
+      message: "bailout",
+      ruleId: "react-compiler/react-compiler",
+      severity: "warning",
+    };
+    const out = formatCompilerReport([diagnostic], {
+      projectRoot: path.resolve("/project"),
+    });
+    expect(out).toContain(path.join("app", "todo.island.tsx"));
+    expect(out).not.toContain(path.resolve("/project/app"));
+  });
+});

package/src/bundler/plugins/block-generated-imports.ts

@@ -1,5 +1,5 @@
 /**
- * Bun bundler plugin — hard-fail on direct generated-artifact imports.
+ * Bun bundler plugin — hard-fail on direct generated-artifact imports.
  *
  * Background
  * ──────────
@@ -8,15 +8,15 @@
  * but it only runs when the user (or CI) invokes `mandu guard check`.
  * Autonomous coding agents routinely bypass that step. This plugin closes
  * the gap at the bundler level: every `mandu dev` / `mandu build` pass
- * installs it by default, and any import whose specifier targets
- * `__generated__` or `.mandu/generated` fails the build with a structured,
- * actionable error.
+ * installs it by default, and any import whose specifier targets
+ * `__generated__` or `.mandu/generated` fails the build with a structured,
+ * actionable error.
  *
  * Design
  * ──────
- * - `onResolve({ filter: DEFAULT_BLOCK_FILTER })` — Bun hands us every
- *   import whose *specifier* matches the regex, along with the importer's
- *   path (`args.importer`). We never return a result; we always throw.
+ * - `onResolve({ filter: DEFAULT_BLOCK_FILTER })` — Bun hands us every
+ *   import whose *specifier* matches the regex, along with the importer's
+ *   path (`args.importer`). We never return a result; we always throw.
  * - The error is `ForbiddenGeneratedImportError`, a named subclass of
  *   `Error`. Tests can `instanceof`-check; Bun surfaces `error.message` in
  *   its `result.logs` output for CLI display.
@@ -45,8 +45,9 @@
 
 import type { BunPlugin } from "bun";
 import {
-  buildForbiddenGeneratedImportMessage,
-  FORBIDDEN_GENERATED_IMPORT_SUGGESTION,
+  buildForbiddenGeneratedImportMessage,
+  FORBIDDEN_GENERATED_IMPORT_PATTERN,
+  FORBIDDEN_GENERATED_IMPORT_SUGGESTION,
   GENERATED_IMPORT_DOCS_URL,
 } from "../../guard/check";
 
@@ -91,8 +92,8 @@ export interface BlockGeneratedImportsOptions {
   allowImporter?: (importerPath: string) => boolean;
   /**
    * Custom filter regex applied to the import specifier. Defaults to
-   * generated-artifact paths. Mandu ships a single default — exposing this
-   * for test harnesses that want to narrow or broaden the filter.
+   * generated-artifact paths. Mandu ships a single default — exposing this
+   * for test harnesses that want to narrow or broaden the filter.
    */
   filter?: RegExp;
 }
@@ -115,7 +116,7 @@ export function defaultAllowImporter(importerPath: string): boolean {
 }
 
 /**
- * Build a `BunPlugin` that blocks direct generated-artifact imports.
+ * Build a `BunPlugin` that blocks direct generated-artifact imports.
  *
  * Usage — call from `defaultBundlerPlugins(config)` (see `./index.ts`).
  * Every `safeBuild` / `Bun.build` invocation in Mandu funnels through
@@ -124,7 +125,7 @@ export function defaultAllowImporter(importerPath: string): boolean {
 export function blockGeneratedImports(
   options: BlockGeneratedImportsOptions = {},
 ): BunPlugin {
-  const filter = options.filter ?? DEFAULT_BLOCK_FILTER;
+  const filter = options.filter ?? DEFAULT_BLOCK_FILTER;
   const allowImporter = options.allowImporter ?? defaultAllowImporter;
 
   return {
@@ -152,5 +153,5 @@ export function blockGeneratedImports(
   };
 }
 
-/** Exported for unit-test convenience — keep the filter text assertable. */
-export const DEFAULT_BLOCK_FILTER = /__generated__|(?:^|[\/\\])\.mandu[\/\\]generated(?:[\/\\]|$)/;
+/** Exported for unit-test convenience — keep the filter text assertable. */
+export const DEFAULT_BLOCK_FILTER = FORBIDDEN_GENERATED_IMPORT_PATTERN;