Both from Qodo review on #632.
`Parser.getBrandVersion()` called `Array.prototype.find` directly. That is
ES6, and `es5.js` ships no polyfills, so a documented public API threw
`TypeError: this._hints.brands.find is not a function` on exactly the
browsers that bundle exists to serve. `bundled.js` was unaffected because
core-js polyfills it. Every other lookup in parser.js already goes through
`Utils.find`, which guards on `Array.prototype.find` and falls back to a
loop; this one call site had missed it. `hasBrand()` next to it uses
`Array.prototype.some`, which is ES5, and is fine.
The ES5 runtime guard added alongside it did not catch this because nothing
exercised the Client Hints path. It now does, for both bundles.
That test builds its hints object from a script evaluated *inside* the vm
context rather than assigning one onto it. A first attempt assigned a
host-realm object and passed against the live bug: an array created in the
host realm keeps the host's `Array.prototype`, so its `find` survives the
sandbox's delete. A real browser hands the parser a same-realm array.
`pnpm test:types` passed no tarball, and check.mjs exited 1 when the argument
was absent, so the advertised command could never run — CI only passed
because it packs and invokes the file directly. The argument is now optional:
without one the package is assembled from the `files` allowlist in the
working tree. `npm pack` cannot be used for this, as package.json carries no
`version` until release time and npm refuses to pack without one. Missing
build output is reported as such rather than as a type error.
Verified by reverting the parser fix: the es5.js Client Hints test fails with
the original TypeError while the bundled.js one still passes, which is the
correct split. Parse output is unchanged — all four artifacts still agree
across the 270-UA corpus, and Client Hints still resolve on modern runtimes.
Follow-up to the ES5 syntax fix, closing the gaps that investigation left.
An ES5-only runtime sandbox. The acorn check catches syntax, but syntax is
only half the contract: preset-env lowers syntax and never polyfills library
calls, so one `Array.prototype.includes` in the parser source compiles
cleanly, passes every test on modern Node, and throws on the browsers es5.js
exists for. The new test runs both legacy bundles in a vm context with the
post-ES5.1 globals, statics and prototype methods deleted, and asserts
bundled.js additionally installs the polyfills its README entry promises.
Includes a test that the sandbox really strips, so it cannot quietly pass
against a modern global.
A consumer type-check across every module resolution mode, run in CI against
the packed tarball. attw already checks that types *resolve* per condition;
it compiles nothing, so it cannot catch a declaration that resolves correctly
and then misdescribes the runtime. Negative cases are asserted too — the maps
must stay non-importable as named exports, which is the line index.d.mts
draws deliberately and only a failing compile can hold.
Also documents two findings that were investigated and deliberately left
alone: the bundled.js size increase is the core-js 2 -> 3 upgrade rather than
waste, and `useBuiltIns: 'usage'` would shrink it by breaking the documented
"all needed polyfills" contract; and the src/*.js ESM-in-CJS wart (publint
warnings, Yarn PnP, Node < 20.19) is longstanding and identical on 2.14.1,
with the nested-package.json fix blocked on @babel/register.
Verified by breaking each guard in turn: an ES6 API call injected into es5.js
fails the sandbox test, and an index.d.mts with its `parse` export removed
fails all three ESM resolution modes while the CJS modes correctly still pass.
