ci(superdoc): close 3 known declaration leaks and flip audit to strict (SD-2859)#3033
Merged
caio-pizzol merged 1 commit intomainfrom Apr 30, 2026
Merged
Conversation
…t (SD-2859)
The audit gate was running in informational mode because the published surface had three pre-existing leaks the narrowed audit (SD-2832 follow-up) had surfaced. Closing all three so strict mode can be the default.
Leak 1: an unused ambient declaration file `super-editor/src/editors/v1/types/converter-internal.d.ts` was getting copied into superdoc's published dist by the SD-2842 hand-written-d.ts copy step. The file declares two `@superdoc/super-editor/converter/internal/v3/handlers/w/{pPr,rpr}/index.js` modules that no shipped code imports. Adds a `HANDWRITTEN_DTS_BLOCKLIST` to the copy step so internal-only ambient files like this one stay in source for super-editor's own typecheck but do not ship in superdoc's published surface.
Leak 2: `@superdoc/common` (root specifier) leaked from three files (`commentsExporter.d.ts`, `node-translator.d.ts`, `CommentsLayer/types.d.ts`). The existing strip-and-inline logic only handled `superdoc/src/index.d.ts`. Removed the `@superdoc/common` special-cases from the shim-skip predicates so the bare specifier in those files routes through the standard shim generator. The internal types it carries (Comment, CommentContent, CommentJSON) are not on the public surface, so collapsing them to `any` via the shim is safe; the strip-and-inline still runs for the main entry where the real DOCX/PDF/HTML constants etc. are needed.
Leak 3 (uncovered while fixing leak 2): once `@superdoc/common/components/BasicUpload.vue` started flowing through the shim generator's named-import path, the file's `import { default as BasicUpload }` triggered the generator to emit `export type default = any;` which is invalid TypeScript (`default` is a reserved word). Updated the generator to emit a proper `export default` declaration when `default` appears in the names set.
With all three fixed, the audit reports zero FAIL findings and the script now defaults to strict mode. `--informational` (or `SUPERDOC_AUDIT_INFORMATIONAL=1`) is the explicit opt-out for local iteration on a known leak. The redundant `audit:declarations:strict` npm script is replaced with `audit:declarations:informational` so the inverted default is reachable.
Verified: build green, audit clean in strict mode, consumer matrix 17/17, repo type-check green, superdoc unit tests 60/60 (943 tests), template-builder build green, react type-check green.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
|
🎉 This PR is included in @superdoc-dev/mcp v0.3.0-next.24 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in vscode-ext v2.3.0-next.69 |
Contributor
|
🎉 This PR is included in @superdoc-dev/react v1.2.0-next.67 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in superdoc-cli v0.8.0-next.42 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in superdoc v1.30.0-next.26 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in superdoc-sdk v1.8.0-next.28 |
Contributor
|
🎉 This PR is included in superdoc-cli v0.8.0 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in superdoc-sdk v1.8.0 |
Contributor
|
🎉 This PR is included in @superdoc-dev/mcp v0.3.0 The release is available on GitHub release |
Contributor
|
🎉 This PR is included in superdoc v1.31.0 The release is available on GitHub release |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The declaration audit (SD-2832, merged into main via #3017) was running in informational mode because three pre-existing leaks the narrowed audit had surfaced were still open. Closes all three so strict mode is the default; from this PR forward, a new private-specifier leak in published declarations fails CI rather than warns.
Leak 1 (closed): Unused ambient declaration file
super-editor/src/editors/v1/types/converter-internal.d.tsshipped to superdoc's dist via the SD-2842 hand-written-d.ts copy step. The file declares two@superdoc/super-editor/converter/internal/v3/handlers/w/{pPr,rpr}/index.jsmodules that no shipped code imports. Added aHANDWRITTEN_DTS_BLOCKLISTso internal-only ambient files like this stay in source for super-editor's own typecheck but do not ship.Leak 2 (closed):
@superdoc/common(root) leaked from three reachable d.ts files (commentsExporter.d.ts,node-translator.d.ts,CommentsLayer/types.d.ts). The existing strip-and-inline logic only handledsuperdoc/src/index.d.ts. Removed the@superdoc/commonspecial-cases from the shim-skip predicates so the bare specifier in those files routes through the standard shim generator. The internal types it carries (Comment,CommentContent,CommentJSON) are not on the public surface, so collapsing them toanyvia the shim is safe; the strip-and-inline still runs for the main entry where the realDOCX/PDF/HTMLconstants are needed.Leak 3 (uncovered while fixing leak 2): once
@superdoc/common/components/BasicUpload.vuestarted flowing through the shim generator's named-import path, the file'simport { default as BasicUpload }triggered the generator to emitexport type default = any;, which is invalid TypeScript becausedefaultis a reserved word. Updated the generator to emit a properexport defaultdeclaration whendefaultappears in the collected names.Default flipped to strict: the audit script's default is now non-zero exit on FAIL findings.
--informational(orSUPERDOC_AUDIT_INFORMATIONAL=1) is the explicit opt-out for local iteration on a known leak before the fix is ready. Replaced the redundantaudit:declarations:strictnpm script withaudit:declarations:informational.Verified locally:
_internal-shims.d.ts(informational), all internal-only types not on the public surface.