Both from Qodo review on #632.
`Parser.getBrandVersion()` called `Array.prototype.find` directly. That is
ES6, and `es5.js` ships no polyfills, so a documented public API threw
`TypeError: this._hints.brands.find is not a function` on exactly the
browsers that bundle exists to serve. `bundled.js` was unaffected because
core-js polyfills it. Every other lookup in parser.js already goes through
`Utils.find`, which guards on `Array.prototype.find` and falls back to a
loop; this one call site had missed it. `hasBrand()` next to it uses
`Array.prototype.some`, which is ES5, and is fine.
The ES5 runtime guard added alongside it did not catch this because nothing
exercised the Client Hints path. It now does, for both bundles.
That test builds its hints object from a script evaluated *inside* the vm
context rather than assigning one onto it. A first attempt assigned a
host-realm object and passed against the live bug: an array created in the
host realm keeps the host's `Array.prototype`, so its `find` survives the
sandbox's delete. A real browser hands the parser a same-realm array.
`pnpm test:types` passed no tarball, and check.mjs exited 1 when the argument
was absent, so the advertised command could never run — CI only passed
because it packs and invokes the file directly. The argument is now optional:
without one the package is assembled from the `files` allowlist in the
working tree. `npm pack` cannot be used for this, as package.json carries no
`version` until release time and npm refuses to pack without one. Missing
build output is reported as such rather than as a type error.
Verified by reverting the parser fix: the es5.js Client Hints test fails with
the original TypeError while the bundled.js one still passes, which is the
correct split. Parse output is unchanged — all four artifacts still agree
across the 270-UA corpus, and Client Hints still resolve on modern runtimes.
Follow-up to the ES5 syntax fix, closing the gaps that investigation left.
An ES5-only runtime sandbox. The acorn check catches syntax, but syntax is
only half the contract: preset-env lowers syntax and never polyfills library
calls, so one `Array.prototype.includes` in the parser source compiles
cleanly, passes every test on modern Node, and throws on the browsers es5.js
exists for. The new test runs both legacy bundles in a vm context with the
post-ES5.1 globals, statics and prototype methods deleted, and asserts
bundled.js additionally installs the polyfills its README entry promises.
Includes a test that the sandbox really strips, so it cannot quietly pass
against a modern global.
A consumer type-check across every module resolution mode, run in CI against
the packed tarball. attw already checks that types *resolve* per condition;
it compiles nothing, so it cannot catch a declaration that resolves correctly
and then misdescribes the runtime. Negative cases are asserted too — the maps
must stay non-importable as named exports, which is the line index.d.mts
draws deliberately and only a failing compile can hold.
Also documents two findings that were investigated and deliberately left
alone: the bundled.js size increase is the core-js 2 -> 3 upgrade rather than
waste, and `useBuiltIns: 'usage'` would shrink it by breaking the documented
"all needed polyfills" contract; and the src/*.js ESM-in-CJS wart (publint
warnings, Yarn PnP, Node < 20.19) is longstanding and identical on 2.14.1,
with the nested-package.json fix blocked on @babel/register.
Verified by breaking each guard in turn: an ES6 API call injected into es5.js
fails the sandbox test, and an index.d.mts with its `parse` export removed
fails all three ESM resolution modes while the CJS modes correctly still pass.
`bundled.js` stopped being ES5 when the webpack build was replaced by tsdown
in #628. It parses at ecmaVersion 2015 but not 5:
var t=(t,e)=>()=>(e||(t((e={exports:{}}).exports,e),t=null),e.exports)
That is rolldown's `__commonJS` interop helper. `@rolldown/plugin-babel` only
transforms input modules, and rolldown appends the helper afterwards; terser
with `ecma: 5` avoids introducing newer syntax but does not transpile, so the
arrow functions reached the published file. `es5.js` has no CommonJS
dependencies and never gets the helper, which is why only `bundled.js` broke.
The effect is total rather than partial: in an ES5 engine the whole script is
a SyntaxError, so `bundled.js` — the bundle that exists specifically to serve
those engines, polyfills included — does not load at all there.
Lower the emitted chunk with a babel renderChunk pass that runs after bundling
and before terser, so rolldown's own helpers are covered too. Costs 2.8 kB
(+1.6%) on bundled.js; es5.js is unchanged at 34 kB.
The existing guard was a grep for backticks, which this syntax slips straight
past. Replace it with an acorn parse at ecmaVersion 5 over both legacy
bundles, plus a tokeniser check for real template literals (backticks inside
core-js string literals are fine, and 2.14.1 shipped three of them).
Verified by reverting the build fix: `bundled.js parses as ES5` fails, and
passes again once restored. Also confirmed bundled.js loads and parses the
live navigator.userAgent in a real browser.
