feat: integration gaps — mail transports, OAuth exchange, image pipeline - #20
Merged
Conversation
- SMTP over Bun.connect: greeting/EHLO/STARTTLS/AUTH PLAIN+LOGIN/envelope/DATA, reply framing, dot-stuffing, backpressure, poolSize ceiling - Resend over one POST /emails with Idempotency-Key on every request - mime.ts renders RFC 5322 + multipart/alternative + quoted-printable; Bcc stays in the envelope, CR/LF in a header is X_MAIL_HEADER_INVALID - transports fail as X_MAIL_SEND_FAILED naming stage, status and retryability; X_NOT_IMPLEMENTED and transportNotImplemented are gone - mailIdempotencyKey moves to its own module so both transports dedupe a job retry Co-Authored-By: Claude <noreply@anthropic.com>
- exchangeOAuthCode posts code + PKCE verifier to the token endpoint and verifies the id token before returning, so no caller can forget to - id-token.ts: iss/aud/exp checked, nonce matched against the handshake — the code flow carries it in the token, not on the redirect, which is why an OIDC login could not finish - oauth-profile.ts: claims when the provider issues an id token, userinfo when it does not; GitHub's verified-emails call for a private address - oauth-login.ts: signInWithOAuth links the account, applies MFA and mints the same session a password login does; completeOAuthLogin is one call - a provider HTTP 200 carrying an `error` field no longer mints a session - link by address only when provider and local account both verified it - new codes X_OAUTH_EXCHANGE_FAILED, X_OAUTH_TOKEN_INVALID, registered in the wiki alongside the auth codes that were never documented Co-Authored-By: Claude <noreply@anthropic.com>
- packages/core/src/image/: zero-dependency PNG + JPEG codecs, one RGBA
raster, one scaler, header-only probe for webp/avif/gif/svg so intrinsic
dimensions still inline and CLS stays 0. No sharp, no native binary.
- 64MP ceiling checked from the header before allocation; malformed bytes
are X_IMAGE_DECODE_FAILED, an unencodable format X_IMAGE_UNSUPPORTED --
never a silently black or unoptimised image.
- storage transformImage/blurPlaceholder, seo builtinImageDriver({ read })
and pwa BuiltinImagePipeline all call it; the three X_NOT_IMPLEMENTED
stubs are gone and none of them owns a second scaler.
- Renamed bunImageDriver/BunImagePipeline: the backing is ours, not Bun's
unshipped image API. seo's byte path split into image-driver.ts.
- Fixtures are byte-exact Pillow/ffmpeg output -- a codec that only round
trips against itself proves nothing.
Co-Authored-By: Claude <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis change adds OAuth authentication flows, a dependency-free image pipeline, SMTP and Resend mail drivers, and integrations for PWA, SEO, and storage. It also updates public exports, structured errors, tests, package guidance, and documentation. ChangesOAuth authentication
Core image pipeline
Mail transport and serialization
Image consumer integrations
Estimated code review effort: 5 (Critical) | ~120 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 37
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/idea/01-stack.md`:
- Line 37: Correct the classification of `@ultimat3/core` in the “What Bun natives
replace” table: either rename the table/column to include framework primitives
or move the image-processing row to a separate framework-pipeline table,
consistent with its pure-TypeScript classification in 15-risks.md.
In `@docs/idea/07-rendering-seo.md`:
- Around line 131-132: Make the image capability contract canonical in
docs/idea/07-rendering-seo.md around lines 131-132, preserving the
`@ultimat3/core` and ImageTransformDriver details. Replace the duplicated prose in
wiki/Routes-And-Render-Modes.md around lines 191-192 with a generated or direct
reference to that canonical section, so the contract is defined only once.
In `@packages/auth/src/errors.ts`:
- Around line 149-155: Update oauthAccountNotLinked so its cause message no
longer interpolates the email address, while keeping the remediation actionable
and preserving the address in the structured meta field for the caller. Ensure
logs and custom error text contain no recipient address.
In `@packages/auth/src/id-token.ts`:
- Around line 72-75: Update the audience validation in decodeIdToken so the
filtered aud array must be non-empty; reject [] and arrays containing no string
values with the existing oauthTokenInvalid message, while continuing to accept a
valid string or non-empty string array.
In `@packages/auth/src/oauth-exchange.test.ts`:
- Around line 10-15: Extract the duplicated string-input base64Url helper from
oauth-exchange.test.ts and oauth-login.test.ts into one shared test utility,
then update both test files to reuse it; preserve its current UTF-8 encoding and
URL-safe Base64 behavior, and do not replace it with the Uint8Array-based helper
in tokens.ts.
- Around line 72-81: Replace the bare Error sentinel in the synchronous
oauthCredentials test with a direct throw assertion, avoiding the existing
try/catch pattern so assertion failures are not intercepted. Apply the same rule
to the asynchronous test by awaiting expect(...).rejects, and remove all throw
new Error sentinels in both test sites.
In `@packages/auth/src/oauth-exchange.ts`:
- Around line 65-71: The EnvMissingError construction in the
missing-environment-variable path must provide an executable fix. Update the fix
field to use the supported `x env check --fix` command (or an exact shell
command that sets the missing variables), while preserving the existing provider
and missing-variable context.
In `@packages/auth/src/oauth-login.test.ts`:
- Around line 139-152: Add a test covering the disabled existing-user-by-email
path in the OAuth login tests: create an email-verified, disabled user without a
linked OAuth account, then attempt sign-in with the matching profile and tokens
and assert the result is X_UNAUTHENTICATED. Keep the existing linked-user test
for userForAccount unchanged.
- Around line 237-243: Update the GitHub OAuth test’s fetch double to record
requested URLs and throw or otherwise fail on any URL outside the explicitly
supported token, user, and email endpoints instead of returning the email
response by default. After the OAuth call, assert that the recorded URLs exactly
match the expected request sequence, following the Google test’s existing
URL-list assertion pattern.
In `@packages/auth/src/oauth-login.ts`:
- Around line 61-64: Update the OAuth user-creation flow around
auth.adapter.updateUser so a null result throws the established AuthError rather
than falling back to created. Preserve the early return for unverified profiles,
and ensure signInWithOAuth cannot continue to link the provider or create a
session when setting emailVerifiedAt fails.
In `@packages/auth/src/oauth-profile.test.ts`:
- Around line 120-155: Replace the try/catch and throw-new-Error guards in the
three tests around oauthProfile with Bun rejection matchers, asserting the
promise rejects and validating the resulting error code, metadata, and cause.
Ensure each rejection assertion also verifies isUltimateError(error) is true so
a resolved call reports a clear failure rather than a misleading boolean
mismatch.
In `@packages/auth/src/oauth-profile.ts`:
- Around line 185-190: Validate the userinfo subject before spreading the
profile in packages/auth/src/oauth-profile.ts lines 185-190: compare
profile.providerAccountId with claims.sub and throw oauthExchangeFailed at the
userinfo stage on mismatch; otherwise preserve the existing return behavior. In
packages/auth/src/oauth-profile.test.ts lines 67-78, change the fallback fixture
subject to google-sub and add coverage asserting mismatched subjects produce
X_OAUTH_EXCHANGE_FAILED.
- Line 153: Widen the parameter type of idTokenEmailVerified in id-token.ts to
accept a raw value while preserving its true-or-"true" behavior, then replace
the inline predicate assigned to emailVerified in oauth-profile.ts with a call
to that helper. Keep both call sites using the shared predicate so
provider-specific boolean handling has one implementation.
In `@packages/core/CLAUDE.md`:
- Around line 50-56: Reduce packages/core/CLAUDE.md to fewer than 40 lines by
moving the detailed image API, codec, format-dispatch, and fixture guidance to
packages/core/README.md. Keep only concise package boundaries and
command-focused guidance in CLAUDE.md, preserving the moved details in the
README.
In `@packages/core/src/image/jpeg-decode.ts`:
- Around line 33-35: Centralize the duplicated AAN constants by exporting
AAN_SCALE from jpeg-tables.ts. In packages/core/src/image/jpeg-decode.ts lines
33-35, remove the local AAN constants, import AAN_SCALE from ./jpeg-tables, and
retain any local Float32Array conversion needed by the hot path. In
packages/core/src/image/jpeg-encode.ts lines 76-78, remove the local AAN_SCALE
declaration and import the shared export from ./jpeg-tables.
- Around line 300-338: Validate the three SOS parameter bytes in decodeScan
after the scan header length check: require Ss = 0, Se = 63, Ah = 0, and Al = 0
for SOF0/SOF1 baseline decoding. If any value differs, throw imageDecodeFailed
with an explicit message naming the unsupported spectral-selection or
successive-approximation condition instead of decoding the scan.
In `@packages/core/src/image/pipeline.ts`:
- Around line 82-86: Update transformImageBytes to validate an explicitly
provided spec.format with canEncode before calling decodeImage or resizeRaster,
throwing through the existing unsupported-format path when it cannot be encoded;
preserve defaultFormatFor behavior when no format is specified. Also rename the
affected pipeline test case from “fails before any work is wasted” to reflect
the validated behavior.
In `@packages/core/src/image/png.ts`:
- Around line 104-132: Update inflateIdat to call Bun.inflateSync with explicit
raw-deflate options (windowBits: -15) after stripping the zlib envelope, and
update the PNG encoder’s Bun.deflateSync call to use the same raw mode before
adding the PNG zlib header/trailer. Apply the equivalent raw-deflate
configuration to the test helpers that encode or decode PNG streams.
In `@packages/core/src/image/probe.ts`:
- Around line 263-337: Extract the SVG parsing section into a new probe-svg
module, moving SVG_WHITESPACE, SVG_PIXELS, svgHead, SVG_PROLOGUE, svgRootIndex,
svgAttribute, svgPixels, svgViewBox, and probeSvg while exporting probeSvg.
Update probeSize in probe.ts to import and use the extracted probeSvg,
preserving the existing single dispatch path and behavior.
In `@packages/core/src/image/raster.ts`:
- Around line 50-59: Update rasterFrom’s buffer-length mismatch error
classification from X_IMAGE_TOO_LARGE to the registered X_IMAGE_DECODE_FAILED
error, preserving the existing message and metadata. Adjust the rasterFrom test
to expect X_IMAGE_DECODE_FAILED and retain validation for the mismatch case.
In `@packages/core/src/image/resize.ts`:
- Around line 66-88: Move the self-contained color grammar symbols HEX,
HEX_LENGTHS, COLOR_FIX, and parseColor out of resize.ts into a new color.ts
module, preserving their validation and RGBA behavior. Update resize.ts to
import the parser or required exported symbols without retaining duplicate
color-parsing logic, and re-export parseColor from src/index.ts so the existing
public API remains unchanged.
- Around line 256-270: Update resample to prevent full-size Float32 premultiply
allocations from exceeding the intended memory ceiling: either fuse
premultiplication into the horizontal scaleX pass, avoiding the standalone
premultiply(raster) buffer, or enforce a separate lower input pixel budget
before allocation and reject oversized resize requests with the established
coded error mechanism. Preserve the existing resize behavior for inputs within
the allowed budget.
In `@packages/mail/CLAUDE.md`:
- Around line 36-37: Update the transport-failure rule in the documentation
around sendFailed to list the complete retryable HTTP status set used by
driver-resend, including 408, 409, 425, 429, and 5xx, so the stated guidance
matches the implementation.
In `@packages/mail/src/driver-resend.test.ts`:
- Around line 66-77: Update fetchStub so each invocation returns a fresh clone
of the configured response rather than reusing response directly. Preserve the
existing request-recording behavior while ensuring repeated driver.send calls
receive independently readable response bodies.
In `@packages/mail/src/driver-smtp.ts`:
- Around line 90-110: Validate poolSize before constructing or invoking
createLimiter, rejecting values less than one with the existing X_CONFIG_INVALID
error convention. Include the original configuration error as the cause and an
exact command for correcting poolSize, while preserving normal limiter behavior
for positive values.
In `@packages/mail/src/errors.ts`:
- Around line 128-138: Update the SendFailure interface’s driver and stage
fields to use literal unions covering the supported driver values and all nine
documented stage values, removing the stage comment as the source of the
contract. Reuse these union types wherever FIXES or metadata stage values are
defined so invalid keys fail at compile time.
In `@packages/mail/src/idempotency.ts`:
- Around line 16-27: Update the digest input in the idempotency-key generation
flow to include message.replyTo, preserving the existing normalization used for
optional message fields. Ensure messages differing only in replyTo produce
distinct keys while leaving the other digest fields unchanged.
- Around line 45-53: Replace the 32-bit fnv1a32 digest used for the derived
transport-retry key with a wider, explicitly stable digest and encoding. Prefer
a stable implementation whose output remains consistent across supported Bun
versions; if using Bun.hash.rapidhash(), add the required upgrade-stability
test. Update the key-generation flow to use the replacement while preserving the
existing derived-key contract.
In `@packages/mail/src/mime.test.ts`:
- Around line 277-330: Add a test in the existing header injection suite
covering a CR/LF payload in baseMessage’s replyTo, passed through
buildMimeMessage with baseOptions. Assert via thrown and codeOf that the result
is X_MAIL_HEADER_INVALID, pinning validation for the messageHeaders() path.
In `@packages/mail/src/smtp-protocol.test.ts`:
- Around line 169-174: Remove the redundant Number.isNaN assertion from the
SIZE-without-number test; the existing maxSizeBytes.toBeUndefined() assertion
already verifies the intended behavior. Keep the test focused on the real
property exposed by parseCapabilities.
In `@packages/mail/src/smtp-protocol.ts`:
- Around line 42-82: Update createReplyParser and its push method to cap
accumulated buffer data before or during buffer += chunk, enforcing a generous
maximum based on RFC 5321’s 512-octet reply-line limit. When the limit is
exceeded without a newline, fail in a way smtp-client.ts can classify as a
protocol error instead of continuing to allocate unbounded memory; preserve
normal parsing for data within the cap.
In `@packages/mail/src/smtp-socket.ts`:
- Line 102: Update the socket write error handling around the error callback and
flush pending-write flow so a failed socket write immediately rejects with
sendFailed instead of waiting for an unreachable drain event. Ensure the socket
error path both fails the queue and releases any pending drain waiter,
preserving normal drain handling for successful writes.
- Around line 150-170: Preserve STARTTLS failure classification across the SMTP
delivery flow: update the error handling used by startTls and handlers.error so
handshake failures reach createSmtpDriver as a sendFailed error with stage
starttls, retryable false, and a runtime-upgrade fix message instead of being
labeled as data failures. Add TLS coverage for immediate EHLO and raw close/end
events during the upgrade handoff.
In `@packages/seo/src/errors.ts`:
- Around line 126-132: Update notImplementedDriver so its fix field is an
executable instruction derived from the user-supplied driver source location or
exact fix command, rather than prose or the display-only driver name. Preserve
driver as display metadata in cause, and ensure the returned SeoError retains
stable code, cause, and runnable fix fields.
In `@packages/storage/src/image.test.ts`:
- Around line 1-14: Add a concise 1–4 line header comment explaining why this
test module protects image consumers, and import the test lifecycle hook plus
resetStorage from the existing storage utilities. Register a beforeEach hook
that calls resetStorage() so every test starts with isolated storage state.
In `@wiki/Error-Codes.md`:
- Around line 44-52: Update every Fix entry in Error-Codes.md, including the
Images section, the sections around lines 98–109 and 236–246, to use an exact
supported API or CLI command; include --json on every CLI command. Ensure
X_MAIL_HEADER_INVALID instructs rejecting or correcting the value rather than
silently stripping line breaks, and make every documented error provide a stable
code, cause, and runnable fix command.
In `@wiki/Installation.md`:
- Line 96: Update the Bun-native table in Installation.md so it no longer
classifies `@ultimat3/core` as a Bun primitive: either broaden the section title
and first-column heading to include framework primitives, or move the
`@ultimat3/core` row into a separate table.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 65abc0bb-0980-4b21-afc8-66f962ad6362
📒 Files selected for processing (85)
docs/architecture/01-package-map.mddocs/idea/01-stack.mddocs/idea/07-rendering-seo.mddocs/idea/15-risks.mdpackages/auth/CLAUDE.mdpackages/auth/README.mdpackages/auth/src/errors.tspackages/auth/src/id-token.test.tspackages/auth/src/id-token.tspackages/auth/src/index.tspackages/auth/src/oauth-exchange.test.tspackages/auth/src/oauth-exchange.tspackages/auth/src/oauth-login.test.tspackages/auth/src/oauth-login.tspackages/auth/src/oauth-profile.test.tspackages/auth/src/oauth-profile.tspackages/auth/src/oauth.test.tspackages/auth/src/oauth.tspackages/core/CLAUDE.mdpackages/core/README.mdpackages/core/src/error-codes.tspackages/core/src/image/errors.test.tspackages/core/src/image/errors.tspackages/core/src/image/fixtures.tspackages/core/src/image/jpeg-decode.test.tspackages/core/src/image/jpeg-decode.tspackages/core/src/image/jpeg-encode.test.tspackages/core/src/image/jpeg-encode.tspackages/core/src/image/jpeg-huffman.tspackages/core/src/image/jpeg-tables.tspackages/core/src/image/pipeline.test.tspackages/core/src/image/pipeline.tspackages/core/src/image/png-bytes.tspackages/core/src/image/png.test.tspackages/core/src/image/png.tspackages/core/src/image/probe.test.tspackages/core/src/image/probe.tspackages/core/src/image/raster.test.tspackages/core/src/image/raster.tspackages/core/src/image/resize.test.tspackages/core/src/image/resize.tspackages/core/src/index.tspackages/mail/CLAUDE.mdpackages/mail/README.mdpackages/mail/src/base64.tspackages/mail/src/driver-resend.test.tspackages/mail/src/driver-resend.tspackages/mail/src/driver-smtp.test.tspackages/mail/src/driver-smtp.tspackages/mail/src/driver.tspackages/mail/src/errors.tspackages/mail/src/idempotency.tspackages/mail/src/index.tspackages/mail/src/job.test.tspackages/mail/src/job.tspackages/mail/src/mail.tspackages/mail/src/mime.test.tspackages/mail/src/mime.tspackages/mail/src/smtp-client.test.tspackages/mail/src/smtp-client.tspackages/mail/src/smtp-protocol.test.tspackages/mail/src/smtp-protocol.tspackages/mail/src/smtp-socket.test.tspackages/mail/src/smtp-socket.tspackages/pwa/CLAUDE.mdpackages/pwa/README.mdpackages/pwa/src/icons.test.tspackages/pwa/src/icons.tspackages/pwa/src/index.tspackages/seo/CLAUDE.mdpackages/seo/README.mdpackages/seo/src/errors.tspackages/seo/src/image-driver.test.tspackages/seo/src/image-driver.tspackages/seo/src/images.test.tspackages/seo/src/images.tspackages/seo/src/index.tspackages/storage/CLAUDE.mdpackages/storage/README.mdpackages/storage/src/image.test.tspackages/storage/src/image.tswiki/Configuration.mdwiki/Error-Codes.mdwiki/Installation.mdwiki/Routes-And-Render-Modes.md
Security and correctness - oauth-profile: refuse a userinfo `sub` that disagrees with the verified id-token `sub`; it fed the address `signInWithOAuth` links accounts on - oauth-login: fail closed when `updateUser` loses the verified-email stamp, instead of linking the provider and minting a session anyway - id-token: `aud: []` no longer decodes as a valid audience - auth errors: the address moved out of `cause` into redactable `meta` - jpeg-decode: refuse a spectral-selection or successive-approximation scan rather than decoding it into a plausible but wrong image - png: state raw deflate explicitly (`windowBits: -15`) on both ends; today's Bun default is raw, Bun 1.4 honours the option and would double-wrap - resize: premultiply inside the first separable pass — the standalone float copy was ~1GB at the 64MP ceiling. Output bytes verified identical - smtp-socket: a refused write fails now instead of parking until the deadline; errors release the drain waiter; implicit-TLS and STARTTLS handshake failures carry their own stage and a non-retryable verdict, not `data`/retryable - smtp-protocol: cap the reply buffer — the timeout measured gaps, so a peer streaming bytes with no newline grew it unbounded - driver-smtp: `poolSize < 1` deadlocked every send silently; now X_CONFIG_INVALID - idempotency: hash `replyTo` (two mails collided on one key) and widen the digest from 32-bit fnv1a to SHA-256/128-bit - raster: a buffer-length mismatch is X_IMAGE_DECODE_FAILED, not TOO_LARGE Enforced, not documented - mail: `SendStage` and `driver` are literal unions; a typo is a build error - seo: `notImplementedDriver` takes the driver's source path and ends in a runnable command - pipeline: reject an unencodable format from the spec, before the decode Shape - jpeg-decode 506 -> 283 (+ jpeg-headers), probe -> probe-svg, resize -> color, core/CLAUDE.md 56 -> 39; no file over the 500-line ceiling - one shared JWT fixture for the three OAuth test files - tests: no bare `Error` sentinels, no assertion that cannot fail, no fetch double that silently answers an unexpected endpoint Docs - `@ultimat3/core` image is a framework primitive, not a Bun native - the image capability contract lives in docs/idea; the wiki references it - every flagged `Fix` entry in wiki/Error-Codes.md is now runnable bun run verify 15/15. Full suite 2362 pass / 27 fail — failure set byte-identical to pre-change, all pre-existing examples/dummy drift. Co-Authored-By: Claude <noreply@anthropic.com>
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three
X_NOT_IMPLEMENTEDstubs on v1 paths, replaced with working code. Ships 3 commits.bee9fb2) — real ESMTP overBun.connect(greeting → EHLO → STARTTLS → AUTH → dot-stuffed DATA, backpressure-aware) and a Resend transport with a content-derivedIdempotency-Key. Newmime.tsrenders RFC 5322 multipart/alternative, keepsBccout of headers, refuses CR/LF asX_MAIL_HEADER_INVALID. Failures name the stage, the provider status and whether a retry is worth it.08bdc1a) — token-endpoint POST with PKCE verifier, id-token verified before a session exists. Fixed a nonce check gated on the redirect step, which the code flow never reaches — it brokeproviders: ['github','google']outright. Closed GitHub's HTTP-200-with-error-body path that could mint a session, and restricted address-based account linking to both-sides-verified emails.a7bd96f) —packages/core/src/image/: zero-dependency PNG + JPEG codecs, one RGBA raster, one scaler.storage,seoandpwaall call it, so responsive variants, blur placeholders and PWA icons are the same three steps and none of them owns a second copy. PWA icon generation worked in no form at all before this. WebP/AVIF/GIF/SVG are probed from the header — intrinsic dimensions still inline, CLS stays 0 — but never synthesised; asking for those bytes isX_IMAGE_UNSUPPORTEDnaming the driver route, not a silent unoptimised original. 64MP ceiling checked before allocation.bunImageDriver/BunImagePipelinerenamed: the backing is ours, not Bun's unshipped image API.Test fixtures are byte-exact Pillow/ffmpeg output, not our own encoder's — a codec that only round-trips against itself proves nothing.
bun run verify15/15 green. Frameworkbun test2273 pass / 1 fail — that one is the pre-existingpackages/cli/src/cmd-dev.test.ts.dev-fixtureflake, reproduced identically on a clean tree.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by CodeRabbit