chore: establish vNext quality foundation (#170)

Establishes the next-major engineering foundation before production
architecture changes. Adds the research and implementation plans, split
unit/browser configs, honest aggregate coverage ratchets, 95%
changed-code coverage, governed known failures, strict vNext typing,
clean builds, deterministic packed-consumer validation, Node floor
coverage, and release-gate parity.\n\nValidated locally: lint,
integrity, all TypeScript scopes, 587 unit tests plus one governed
expected failure, aggregate and changed coverage, Chromium browser
smoke, packed consumer/runtime parse, demo build, actionlint, and two
independent adversarial review loops.

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Sets up the vNext quality foundation with strict typing, split
unit/browser tests, honest coverage gates (aggregate + changed-code),
governed known failures, and deterministic package smoke tests that
preserve the `pnpm` version. Hardens CI/release and unblocks the next
major architecture work.

- **New Features**
- CI: pin Node 20.19.0 and `pnpm` 10.28.2 with version checks; disable
Node-managed PM version enforcement; add concurrency with
cancel-in-progress; fetch full git history; add lint and test integrity
gates; split unit and headless browser runs; enforce aggregate and
changed-code coverage.
- Release: add a compatibility job that runs `pnpm pack` and a consumer
smoke test; preserve and verify `pnpm` 10.28.2 across the smoke path;
`autofix.yml` also runs on `dev-refactor`.
- Known failures governed via `test/known-failures.json` with owner and
expiry.
  - Added vNext docs: `SQL_EDITOR_RESEARCH.md` and `implementation.md`.

- **Refactors**
- Split TS configs and typecheck scripts for source, legacy tests, vNext
tests, and demo; vNext tests use stricter rules.
- Extracted `vitest` configs; `vite.config.ts` now only builds the demo.
- Minor ESM/typing fixes in demo and tests; export test now uses `pnpm
pack`.

<sup>Written for commit ebbeb2f.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/marimo-team/codemirror-sql/pull/170?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

Author: Light2Dark

.github/workflows/autofix.yml

@@ -2,7 +2,7 @@ name: autofix.ci # needed to securely identify the workflow
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev-refactor]
   pull_request:
 
 permissions:

.github/workflows/release.yml

@@ -8,6 +8,39 @@ on:
       - 'v*'
 
 jobs:
+  compatibility:
+    env:
+      EXPECTED_PNPM_VERSION: "10.28.2"
+      npm_config_manage_package_manager_versions: "false"
+      npm_config_package_manager_strict_version: "false"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
+        with:
+          package_json_file: test/package-smoke/package.json
+          version: 10.28.2
+
+      - name: ⎔ Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 20.19.0
+          cache: pnpm
+
+      - name: 🔒 Verify pnpm version
+        shell: bash
+        run: test "$(pnpm --version)" = "10.28.2"
+
+      - name: 📥 Install dependencies
+        run: pnpm install --ignore-scripts --frozen-lockfile
+
+      - name: 📦 Packed Package Smoke Test
+        run: pnpm run test:package
+
   build:
     runs-on: ubuntu-latest
     steps:
@@ -27,11 +60,26 @@ jobs:
       - name: 📥 Install dependencies
         run: pnpm install --ignore-scripts --frozen-lockfile
 
+      - name: 🧹 Lint
+        run: pnpm exec oxlint
+
+      - name: 🧪 Test Integrity
+        run: pnpm run test:integrity
+
       - name: 🔍 Type Check
         run: pnpm run typecheck
 
-      - name: 🧪 Test
-        run: pnpm run test
+      - name: 🧪 Unit Tests and Coverage
+        run: pnpm run test:coverage
+
+      - name: 🎭 Install Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: 🧪 Browser Tests
+        run: pnpm run test:browser
+
+      - name: 📦 Packed Package Smoke Test
+        run: pnpm run test:package
 
       - name: 🏗️ Build
         run: pnpm run build
@@ -76,7 +124,7 @@ jobs:
       contents: read
 
   publish:
-    needs: build
+    needs: [build, compatibility]
     runs-on: ubuntu-latest
     permissions:
       id-token: write

.github/workflows/test.yml

@@ -4,10 +4,16 @@ on:
   push:
     branches:
       - main
+      - dev-refactor
 
   pull_request:
     branches:
       - main
+      - dev-refactor
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CLICOLOR: 1
@@ -22,6 +28,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
 
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
@@ -38,18 +46,104 @@ jobs:
       - name: 🧹 Lint
         run: pnpm exec oxlint
 
+      - name: 🧪 Test Integrity
+        run: pnpm run test:integrity
+
       - name: 🔍 Type Check
         run: pnpm run typecheck
 
-      - name: 🧪 Test
-        run: pnpm run test
+      - name: 🧪 Unit Tests and Coverage
+        run: pnpm run test:coverage
+
+      - name: 📈 Changed-Code Coverage
+        if: github.event_name == 'pull_request' || github.event_name == 'push'
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: >-
+          pnpm run test:coverage:changed
+          "${{ github.event.pull_request.base.sha || github.event.before }}"
 
       - name: 📊 Report Coverage
-        if: always()
+        if: >-
+          always() &&
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.head.repo.full_name == github.repository
         uses: davelosert/vitest-coverage-report-action@3c50566c523e04813df28de8f7c48dd97d663f1c # v2
         with:
           pr-number: auto
 
+  browser:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
+
+      - name: ⎔ Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: 📥 Install dependencies
+        run: pnpm install --ignore-scripts --frozen-lockfile
+
+      - name: 🎭 Install Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: 🧪 Browser Tests
+        run: pnpm run test:browser
+
+  package:
+    env:
+      EXPECTED_PNPM_VERSION: ${{ matrix.pnpm-version }}
+      npm_config_manage_package_manager_versions: "false"
+      npm_config_package_manager_strict_version: "false"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - node-version: "20.19.0"
+            pnpm-manifest: "test/package-smoke/package.json"
+            pnpm-version: "10.28.2"
+          - node-version: "24"
+            pnpm-manifest: "package.json"
+            pnpm-version: "11.4.0"
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
+        with:
+          package_json_file: ${{ matrix.pnpm-manifest }}
+          version: ${{ matrix.pnpm-version }}
+
+      - name: ⎔ Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      - name: 🔒 Verify pnpm version
+        shell: bash
+        run: test "$(pnpm --version)" = "${{ matrix.pnpm-version }}"
+
+      - name: 📥 Install dependencies
+        run: pnpm install --ignore-scripts --frozen-lockfile
+
+      - name: 📦 Packed Package Smoke Test
+        run: pnpm run test:package
+
   security:
     runs-on: ubuntu-latest
     steps: