2 Commits

Include renames

Author	SHA1	Message	Date
ClintchizandClaude Opus 5	949cf78636	feat(ui): add DataTable and Toaster, drop the legacy Table, fix overlay dialogs ... DataTable replaces the 20-line Table scaffold entirely: columns, sorting, filtering, pagination, selection, bulk actions, comparison layout, sticky first column, custom HTML cells, and a remote source driven by a `request` output rather than a function prop (props travel as HTML attributes, so a function arrives as its own source text). Toaster replaces the hand-rolled status div: tone icons, actions, hover pause/resume and a progress bar. Overlays audit -- Modal and Drawer declared aria-modal="true" but nothing ever moved focus into the panel, so the @keydown handler on their root never ran and closeOnEscape did nothing. Focus, focus restore, a Tab trap and a body scroll lock now live in the reactive runtime, shared by both. ContextMenu placed pointer menus by subtracting a guessed 340x420 from the viewport, which pushed every menu that was not that size away from the pointer; it now positions at the pointer and lets the anchored clamp pull it back once it can be measured. The reactive runtime size budget moves 150k -> 175k to cover anchored overlays, dialog behaviour, the toaster and the DataTable client half. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-07 14:59:58 +05:30
Clintchiz	57097c8204	fix(authz): fix prod boot-order (C1), dev HMR staleness (I2), add prod coverage (I4) ... Fix round 2 for Task 14, addressing a critical review finding reproduced on a real built server. C1 (critical): the generated production entry set the authz catalog inside createProductionServer's BODY, but ES modules evaluate every static import (including app middleware, emitted as a static import) before the importing module's body runs. Middleware reading getAuthzCatalog() at module scope — the same eager shape authzMiddleware({ catalog, ... }) itself requires, and the pattern app/middleware/logger.ts's `export default requestLogger({...})` already uses — saw an unset catalog and crashed the whole process at import time, after every other gate (typecheck/lint/tests/a plain `bun run build`) stayed green. Fix: packages/cli/src/build.ts now emits a small side-effecting `.authz-setup.ts` module containing the static imports of every app/authz/*.ts declaration plus a call to the new applyAuthzManifestEarly(entries) (packages/dev-server/src/prod.ts), and imports THAT MODULE FIRST in the generated entry — before pages, api, realtime, middleware, components, and layouts. applyAuthzManifestEarly is deliberately silent (no missing-default-export warnings, though a genuine conflict still throws and fails the boot at import time); createProductionHandlers keeps its own unconditional merge+set as an idempotent, always-warning second pass, so an adapter that bypasses the generated entry and calls it directly still gets a correctly merged, validated catalog, and so the function stays independently testable. I3: corrected packages/authz/src/client.ts's WRN-AUTHZ-SETUP message, which claimed prod always sets the catalog before middleware runs — true again for the generated entry after the C1 fix, but not for a custom entry that calls createProductionHandlers directly. I2: dev HMR editing app/authz/*.ts reloaded the page while the OLD catalog stayed authoritative (watch.ts classifies any non-CSS change as "server"; hotUpdate had no authz/ branch) — a false security signal, since tightening or removing a permission looked like it took effect but didn't until a restart. Added the branch (packages/dev-server/src/index.ts), and gave loadAppAuthzCatalog (authz-boot.ts) an injectable importer: a raw import() would have silently no-op'd on the re-import (Bun caches local TS/JS modules by filesystem path and ignores query strings), so the hot path routes through loadModule (pipeline.ts) instead, which copies the edited file to a versioned sibling specifically to defeat that cache. I4: added direct createProductionHandlers/applyAuthzManifestEarly tests (packages/dev-server/test/authz-prod.test.ts: conflict throws naming both files, missing default export warns and skips, empty array yields an empty catalog, a second call re-validates rather than trusting a stale singleton) and the regression test that matters most (packages/cli/test/authz-prod-coldstart.test.ts): a real `runBuild` + a real `bun dist/server.js` boot, with a middleware module reading getAuthzCatalog() at module scope, asserting it actually serves a request. M5: startServer built its own router once, then loadAppAuthzCatalog built a second one from scratch on every dev boot and every authz/ hot reload. loadAppAuthzCatalog now accepts either an appDir (still used standalone, e.g. by the test suite) or an already-built Router, and both call sites in index.ts now pass the router they already have. Every fix in this round was verified non-vacuous by sabotaging it and confirming the corresponding test fails, then reverting.	2026-08-04 23:16:41 +05:30