Skip to content

fix(core): stop bundling vitest into public entry points#17

Merged
leonardocustodio merged 5 commits into
mainfrom
fix/core-vitest-leak-public-entry
Jun 22, 2026
Merged

fix(core): stop bundling vitest into public entry points#17
leonardocustodio merged 5 commits into
mainfrom
fix/core-vitest-leak-public-entry

Conversation

@leonardocustodio

Copy link
Copy Markdown
Owner

The test helpers are now published under a dedicated @frosts/core/tests subpath instead of the main entry. The build uses code splitting so the subpath shares the same core runtime chunks as the main entry, preserving the instanceof checks in the helpers (avoiding a dual-package hazard). IIFE, which cannot be split, is built separately for the public entry only.

`src/index.ts` re-exported the generic test helpers via
`export * as tests from "./tests/index.js"`. A re-exported namespace cannot be
tree-shaken, so the helpers and their top-level `import { expect } from "vitest"`
were bundled into every public entry (dist/index.js, dist/index.cjs,
dist/index.iife.js). Because vitest is only a devDependency, importing
`@frosts/core` — or any `@frosts/<curve>` that depends on it — crashed at module
load with ERR_MODULE_NOT_FOUND for consumers without vitest installed.

The test helpers are now published under a dedicated `@frosts/core/tests`
subpath instead of the main entry. The build uses code splitting so the subpath
shares the same core runtime chunks as the main entry, preserving the
`instanceof` checks in the helpers (avoiding a dual-package hazard). IIFE, which
cannot be split, is built separately for the public entry only.

Consumers of the generic test functions update their imports:

  -import { tests } from "@frosts/core";
  +import * as tests from "@frosts/core/tests";

Verified: public entries and shared chunks contain no vitest import; importing
`@frosts/core` and `@frosts/ed25519` succeeds in a sandbox without vitest; full
test suite and typecheck pass across all packages.

Fixes the published 0.2.2-alpha.1 / 0.2.2-alpha.3 crash reported on GitHub.
Bump dev tooling and runtime dependencies across the workspace:
- typescript 5.9 -> 6.0
- eslint 9 -> 10, @eslint/js 9 -> 10
- @types/node 25 -> 26
- tsdown 0.20 -> 0.22, typedoc 0.28.5 -> 0.28.19, vitest 4.0 -> 4.1
- @typescript-eslint/* 8.53 -> 8.61, eslint-config-turbo 2.7 -> 2.9
- @noble/curves & @noble/hashes 2.0 -> 2.2
- prettier, turbo and @changesets/cli to latest

Adjustments required by the upgrades:
- tsconfig: add the DOM lib (TextEncoder / Web Crypto globals are no longer
  provided as Node globals by @types/node 26); widen core's rootDir so
  TypeScript 6 accepts the interop test's cross-package source imports (TS6059).
- tsdown: migrate the deprecated `external` option to `deps.neverBundle`, and
  disable the ineffective-dynamic-import check in core (intentional pattern
  under code splitting).
- source: cast getRandomValues buffers to Uint8Array<ArrayBuffer> for the
  stricter lib.dom signature, attach `cause` to a re-thrown error, and drop
  type assertions now flagged as unnecessary by TS 6's improved inference.

format, lint, typecheck, build and tests all pass with no warnings.
- Bump all packages and the workspace root to 0.2.2-alpha.4 via
  scripts/bump-version.ts.
- Add a CHANGELOG.md to every published package documenting alpha.4 (the
  @frosts/core vitest-at-import fix and the dependency refresh), and include
  CHANGELOG.md in each package's published `files`.
- Remove changesets, which the project does not use for versioning (versions
  are managed by scripts/bump-version.ts): delete the .changeset directory and
  the @changesets/cli devDependency, and replace the `changeset publish` step
  in the release workflow with a direct `npm publish --provenance` over the
  public packages.
- Update the README version and TypeScript badges (0.2.2-alpha.4, TS 6.0).
The npm package pages (npmjs.com) and IACR ePrint archive (eprint.iacr.org)
return HTTP 403 to the link checker's automated requests even though the links
are valid. Add a markdown-link-check config that ignores those two hosts and
wire it into the Link Checker workflow via `config-file`.
@leonardocustodio leonardocustodio merged commit 268e0c6 into main Jun 22, 2026
7 checks passed
@leonardocustodio leonardocustodio deleted the fix/core-vitest-leak-public-entry branch June 22, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant