@somewhere-tech/cli 0.29.0 → 0.30.0

package/runtime/browser-probes.mjs

@@ -0,0 +1,6 @@
+// VENDORED from worker/src/utils/browser-test.ts (DOM_OUTLINE_SCRIPT) @ 1bf981dd
+// — the exact runtime deployed functions run against. Do not edit by hand;
+// re-sync with: node scripts/extract-runtime.mjs <monorepo>
+export const MAX_OUTLINE_NODES = 200;
+
+export const DOM_OUTLINE_SCRIPT = "(() => {\n  const cssPath = (el) => {\n    const parts = [];\n    let node = el;\n    let depth = 0;\n    while (node && node.nodeType === 1 && depth < 4 && node.tagName.toLowerCase() !== 'body') {\n      let sel = node.tagName.toLowerCase();\n      if (node.id) { parts.unshift(sel + '#' + CSS.escape(node.id)); break; }\n      const parent = node.parentNode;\n      if (parent) {\n        const sameTag = Array.from(parent.children).filter((c) => c.tagName === node.tagName);\n        if (sameTag.length > 1) sel += ':nth-of-type(' + (sameTag.indexOf(node) + 1) + ')';\n      }\n      parts.unshift(sel);\n      node = node.parentNode;\n      depth++;\n    }\n    return parts.join(' > ');\n  };\n  const interactive = 'a,button,input,select,textarea,[role=button],[role=link],[role=tab],[onclick],[data-testid]';\n  const seen = new Set();\n  const outline = [];\n  for (const el of Array.from(document.querySelectorAll(interactive))) {\n    if (outline.length >= 200) break;\n    if (seen.has(el)) continue;\n    seen.add(el);\n    const testid = el.getAttribute('data-testid') || '';\n    const id = el.id || '';\n    const name = el.getAttribute('name') || '';\n    const aria = el.getAttribute('aria-label') || '';\n    const text = ((el.innerText || el.value || el.getAttribute('placeholder') || '') + '').trim().slice(0, 80);\n    let selector;\n    if (testid) selector = '[data-testid=\"' + testid + '\"]';\n    else if (id) selector = '#' + CSS.escape(id);\n    else if (name) selector = el.tagName.toLowerCase() + '[name=\"' + name + '\"]';\n    else selector = cssPath(el);\n    outline.push({ tag: el.tagName.toLowerCase(), id, testid, name, aria, text, selector });\n  }\n  const testid_map = {};\n  for (const el of Array.from(document.querySelectorAll('[data-testid]'))) {\n    const t = el.getAttribute('data-testid');\n    if (t && !(t in testid_map)) testid_map[t] = '[data-testid=\"' + t + '\"]';\n  }\n  return { outline, testid_map };\n})()";

package/runtime/compiler/VENDOR.json

@@ -1,5 +1,5 @@
 {
-  "commit": "ea29ab73",
+  "commit": "1bf981dd",
   "esbuild": "0.24.0",
   "toolchain": {
     "base": {
@@ -13,11 +13,15 @@
     "tw4": {
       "tailwindcss": "^4.0.0",
       "@tailwindcss/postcss": "^4.0.0"
+    },
+    "react19": {
+      "react": "19.2.7",
+      "react-dom": "19.2.7"
     }
   },
   "files": {
-    "compile-core.cjs": "96468eac244fc2f176b1222babb15391d104710e19a6ac3a8ca9f761e8bfc54c",
+    "compile-core.cjs": "06a7c02dacc5fc41ab602ec60eac14d988307b8a7019c62b49be72fafe664f65",
     "graph-contract.cjs": "aaeebc34f486ee5f639444de5757accfc283de641e631908ccd8d8c688bfb5c0",
-    "typed-functions.cjs": "3e96aff7daad4ccbb67907f79e7cbac42cef2397a18431776495c377b604ab8a"
+    "typed-functions.cjs": "5c0b499015dcdf755ca72dab04a80afce0891e782f835547592faec802c63be6"
   }
 }

package/runtime/compiler/compile-core.cjs

@@ -465,6 +465,8 @@ const TOOLCHAIN_DEPS = new Set(['react-scripts', 'react-app-rewired', 'craco', '
  * GRANDFATHER: the full resolvability chain (build root → IMAGE_NODE_MODULES →
  * REACT19_NODE_MODULES → NODE_POLYFILLS → node: prefix → relative/URL paths)
  * mirrors exactly what esbuild can resolve, so a working import NEVER warns.
+ * Platform-provided specifiers (PLATFORM_MODULE_ROOTS) are exempt on top of
+ * that: they are not npm packages, so no resolution chain would ever find them.
  */
 
 /**
@@ -497,6 +499,18 @@ function specRootPkg(spec) {
     : spec.split('/')[0];
 }
 
+/**
+ * Root packages the PLATFORM provides — derived from typed-functions'
+ * PLATFORM_MODULES, which is also what builds the virtual-module resolver, so
+ * this can never drift into a stale hand list.
+ *
+ * These are not npm packages. Reporting one as "not in your package.json" told
+ * a developer that the `somewhere/db` import our own managed-schema docs handed
+ * them would fail to load in production, and the remediation it offered —
+ * `npm install somewhere` — installs an unrelated package (tsk_53badecfb7).
+ */
+const PLATFORM_MODULE_ROOTS = new Set(typedFunctions.PLATFORM_MODULES.map(specRootPkg));
+
 /* ─── Dependency review (PR1, tsk_35befef9 / npm supply-chain) ────────────────
  * After deps are installed (with --ignore-scripts), walk the customer's RESOLVED
  * dependency tree and report what actually shipped: package count, lifecycle
@@ -979,6 +993,10 @@ function isBuildConfigFile(filePath) {
         // (aliases like `@/App` have no npm-style root package).
         if (isAliased(spec)) continue;
         const rootPkg = specRootPkg(spec);
+        // PROVIDED BY THE PLATFORM (`somewhere/db`, `somewhere:api`, …). Not npm
+        // packages, so "add it to your package.json" is wrong advice on code our
+        // own docs hand the developer (tsk_53badecfb7).
+        if (PLATFORM_MODULE_ROOTS.has(rootPkg)) continue;
         // DECLARED in devDependencies. ensureDeps deliberately installs only
         // `dependencies` (the build toolchain is the platform's job, not the
         // app's), so a devDependency is never resolvable here — but it IS

package/runtime/compiler/typed-functions.cjs

@@ -6,7 +6,32 @@ const path = require('path');
 
 const SENTINEL = 'somewhere:v1';
 const MODULE_NAME = 'somewhere:api';
+// Managed-schema helper surface, imported by db/schema.ts. That file is DATA
+// the deploy reads statically — never executed, never bundled — so no resolver
+// ever claims this specifier and, to anything that only asks "can esbuild
+// resolve it", it can only ever look like a missing npm package.
+const SCHEMA_MODULE_NAME = 'somewhere/db';
 const MANIFEST_PATH = '_internal/typed-functions.json';
+
+/**
+ * PLATFORM_MODULES — the ONE enumeration of module specifiers the PLATFORM
+ * provides. These are not npm packages and must never be added to a customer's
+ * package.json: `npm install somewhere` installs an unrelated package off the
+ * public registry, or fails.
+ *
+ * Everything that needs to know "is this specifier ours?" reads THIS list, so
+ * there is no second hand-maintained copy to drift:
+ *   - virtualApiPlugin below builds its esbuild onResolve filter from
+ *     MODULE_NAME, so the resolver and this list cannot disagree;
+ *   - the compiler's phantom-import scanner (compile-core.cjs) treats the root
+ *     package of every entry here as provided, which is what stops the CLI
+ *     telling a developer that our own documented `somewhere/db` import is a
+ *     missing dependency (tsk_53badecfb7).
+ *
+ * Matching downstream is on the ROOT package, so `somewhere/<anything>` — every
+ * present and future subpath surface — is covered by the `somewhere/db` entry.
+ */
+const PLATFORM_MODULES = Object.freeze([MODULE_NAME, SCHEMA_MODULE_NAME]);
 const AMBIENT_FILE = '__somewhere_typed_functions.d.ts';
 const CLIENT_FILE = '__somewhere_api.d.ts';
 
@@ -524,7 +549,10 @@ function virtualApiPlugin(esbuild) {
   return {
     name: 'somewhere-typed-api',
     setup(build) {
-      build.onResolve({ filter: /^somewhere:api$/ }, () => ({ path: MODULE_NAME, namespace: 'somewhere-typed-api' }));
+      // Filter derived from MODULE_NAME so the resolver and PLATFORM_MODULES
+      // cannot drift apart.
+      const filter = new RegExp(`^${MODULE_NAME.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
+      build.onResolve({ filter }, () => ({ path: MODULE_NAME, namespace: 'somewhere-typed-api' }));
       build.onLoad({ filter: /.*/, namespace: 'somewhere-typed-api' }, () => ({ contents: RUNTIME_SOURCE, loader: 'js' }));
     },
   };
@@ -535,7 +563,9 @@ module.exports = {
   CLIENT_FILE,
   MANIFEST_PATH,
   MODULE_NAME,
+  PLATFORM_MODULES,
   RUNTIME_SOURCE,
+  SCHEMA_MODULE_NAME,
   SENTINEL,
   analyzeTypedFunctions,
   buildDeclaration,