Jakob Wennberg
1a41119682
* perf(bundle): drop the BAS chart and the Node crypto polyfill from the shared client baseline
Two chunks rode along in the first-load JS of almost every dashboard route:
the full BAS 2026 chart (315 KB uncompressed, in 81 route manifests) and
the browser polyfill for Node's crypto/vm/Buffer (327 KB, in 26 routes
incl. login and register). Neither was needed on first paint; both got
there through static imports of helpers that happen to live next to code
that needs the data or the builtin.
Node polyfill (4 pure splits, behaviour unchanged, re-exported from the
original modules for server callers):
- lib/auth/bankid-flags.ts: isBankIdEnabled (login, register, security
settings imported it from bankid.ts, which imports crypto).
- lib/import/bank-file/formats.ts: the format registry + detection (the
import history imported getFormat from parser.ts, which hashes).
- lib/salary/personnummer-format.ts: parsing/validation/formatting (the
employee forms reached the encrypting personnummer.ts via tax-column).
- lib/auth/api-key-scopes.ts: scope catalogue, groups, tool map, helpers
(the API key panel imported STAGING_SCOPES from the key generator).
BAS chart:
- lib/bookkeeping/bas-lazy.ts + use-bas-reference.ts: the chart becomes a
dynamic import, fetched once per session after first paint; components
that show BAS names/descriptions call useBasReference() and re-render
when it lands. Until then (and on the server) only the hardcoded
account-descriptions answer, so SSR and hydration agree.
- lib/bookkeeping/bas-labels.ts: class/group labels out of bas-reference.ts
(account-descriptions needed a label and paid for the whole chart).
- lib/bookkeeping/bas-account-numbers.ts (generated, ~11 KB) +
scripts/generate-bas-account-numbers.ts (--check) + parity test:
isStandardBASAccountNumber for AddAccountDialog/ChartOfAccountsManager.
- lib/bookkeeping/account-classifier-{heuristic,client}.ts: the BAS-aligned
heuristic shared by the server classifier and a client variant that uses
the lazy chart.
- lib/bookkeeping/invoice-accounts.ts: INVOICE_FX_RATE_MISSING,
InvoiceFxRateMissingError, getRevenueAccount, getOutputVatAccount out of
invoice-entries.ts, whose engine import pulled account-backfill and the
chart into SendInvoiceDialog/PaymentBookingDialog.
- CorrectOpeningBalanceDialog re-seeds names when the chart lands;
OpeningBalanceRowEditor builds its Fuse indexes lazily; the
ChartOfAccountsManager BAS-katalog tab awaits the chunk.
Tooling:
- scripts/perf/client-import-closure.mjs: static import closure of every
'use client' module with the shortest chain to a target (file or bare
specifier); found every path above without a build.
- scripts/checks/client-node-builtin.mjs wired into check:guards: a client
module reaching a Node builtin is a hard failure (0 today).
Left as is: invoices/[id], its credit page and SendInvoiceDialog still
reach the chart through lib/invoices/issue-credit-note -> invoice-entries
-> engine -> account-backfill; splitting the engine is out of scope here.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(perf): unambiguous import-edge regex in the closure walker (CodeQL js/redos)
One quantifier per span: a greedy [^'"]* up to the specifier quote, which it
cannot cross, so a run of whitespace has a single parse. Same edges as
before (multi-line named imports, re-exports, side-effect imports; type-only
imports still skipped).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
48 lines
2.3 KiB
JavaScript
48 lines
2.3 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* Guard: a 'use client' module whose static import closure reaches a Node
|
|
* builtin (crypto, buffer, vm, stream, fs, ...).
|
|
*
|
|
* Turbopack polyfills those for the browser (crypto-browserify, vm-browserify,
|
|
* Buffer: ~327 KB uncompressed) the moment ANY client module can reach them,
|
|
* and the polyfill chunk then ships with every route that renders the
|
|
* component. Before the 2026-08-26 split, lib/auth/bankid.ts (login,
|
|
* register, security settings), lib/import/bank-file/parser.ts (bank import
|
|
* history), lib/salary/personnummer.ts (via tax-column, the employee forms)
|
|
* and lib/auth/api-keys.ts (the API key panel) each did this for a function
|
|
* that never touched crypto. The fix is always the same: move the pure part
|
|
* into a sibling module without the Node import and import that from the
|
|
* client (see bankid-flags.ts, bank-file/formats.ts, personnummer-format.ts,
|
|
* api-key-scopes.ts).
|
|
*
|
|
* No baseline: the count is 0, any new reacher is a hard failure. The walk
|
|
* is the same static closure scripts/perf/client-import-closure.mjs prints.
|
|
*/
|
|
|
|
import path from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { buildGraph, clientReachers } from '../perf/client-import-closure.mjs'
|
|
|
|
export const NODE_BUILTINS = ['crypto', 'node:crypto', 'buffer', 'node:buffer', 'vm', 'node:vm', 'stream', 'node:stream', 'fs', 'node:fs', 'path', 'node:path', 'child_process', 'node:child_process']
|
|
|
|
/** [{ file, builtin, chain }] for every client file reaching a builtin. */
|
|
export function findClientNodeBuiltins(root) {
|
|
const graph = buildGraph(root)
|
|
const findings = []
|
|
for (const builtin of NODE_BUILTINS) {
|
|
for (const [file, chain] of clientReachers(graph, `bare:${builtin}`, root)) {
|
|
findings.push({ file, builtin, chain })
|
|
}
|
|
}
|
|
return findings.sort((a, b) => a.file.localeCompare(b.file) || a.builtin.localeCompare(b.builtin))
|
|
}
|
|
|
|
const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
|
|
if (isMain) {
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
|
|
const findings = findClientNodeBuiltins(root)
|
|
for (const f of findings) console.log(`${f.file} -> ${f.builtin}\n ${f.chain.join('\n > ')}`)
|
|
console.log(`${findings.length} client file(s) reach a Node builtin`)
|
|
process.exit(findings.length ? 1 : 0)
|
|
}
|