fix: harden hydration and release checks

Author: konamgil

.gitignore

@@ -38,6 +38,7 @@ bun.lockb
 # Temporary files
 *.log
 *.tmp
+.tmp-*/
 nul
 
 # Claude Code session state (local per-user)

bun.lock

@@ -1,5 +1,26 @@
 # mandu-auth-starter
 
+## 0.1.67
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.16
+
+## 0.1.66
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.15
+
+## 0.1.65
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.14
+
 ## 0.1.64
 
 ### Patch Changes

demo/auth-starter/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "mandu-auth-starter",
-  "version": "0.1.64",
+  "version": "0.1.67",
   "private": true,
   "type": "module",
   "scripts": {

demo/auth-starter/package.json

@@ -1,5 +1,26 @@
 # mandu-desktop-starter
 
+## 0.1.66
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.16
+
+## 0.1.65
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.15
+
+## 0.1.64
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.14
+
 ## 0.1.63
 
 ### Patch Changes

demo/desktop-starter/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "mandu-desktop-starter",
-  "version": "0.1.63",
+  "version": "0.1.66",
   "private": true,
   "type": "module",
   "description": "Minimal Mandu desktop app (Phase 9c). Opens a native WebView pointing at a local Bun.serve() instance.",

demo/desktop-starter/package.json

@@ -1,5 +1,29 @@
 # mandu-edge-workers-starter
 
+## 0.1.67
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.16
+  - @mandujs/edge@0.4.64
+
+## 0.1.66
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.15
+  - @mandujs/edge@0.4.63
+
+## 0.1.65
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @mandujs/core@0.54.14
+  - @mandujs/edge@0.4.62
+
 ## 0.1.64
 
 ### Patch Changes

demo/edge-workers-starter/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "mandu-edge-workers-starter",
-  "version": "0.1.64",
+  "version": "0.1.67",
   "private": true,
   "type": "module",
   "scripts": {

demo/edge-workers-starter/package.json

@@ -31,6 +31,8 @@ these is how we assert the stream shape.
 - Consume the stream with `await res.text()` and then assert on the
   full string. That defeats the "streaming" semantic — the ordering
   guarantee you care about is chunk-by-chunk.
+- Use `localhost` in transport URLs. Use `http://127.0.0.1:<port>` so
+  Windows CI does not hit an IPv6/IPv4 localhost mismatch.
 - Assume a specific `boundaryCount` without reading the page's Suspense
   boundaries — if the page adds one, the spec breaks. Pull the count
   from the route context (`mandu_ate_context({ scope: "route" })`).
@@ -60,7 +62,7 @@ import { test, expect } from "bun:test";
 import { assertStreamBoundary } from "@mandujs/core/testing";
 
 test("GET /dashboard streams shell → 2 boundaries → scripts", async () => {
-  const res = await fetch("http://localhost:3333/dashboard");
+  const res = await fetch("http://127.0.0.1:3333/dashboard");
   await assertStreamBoundary(res, {
     shellChunkContains: ["<!DOCTYPE", "<html"],
     boundaryCount: 2,
@@ -70,12 +72,12 @@ test("GET /dashboard streams shell → 2 boundaries → scripts", async () => {
 });
 
 test("shell fits under 20KB budget", async () => {
-  const res = await fetch("http://localhost:3333/dashboard");
+  const res = await fetch("http://127.0.0.1:3333/dashboard");
   await assertStreamBoundary(res, { firstChunkMaxSizeBytes: 20_480 });
 });
 
 test("no Suspense boundaries on a static page", async () => {
-  const res = await fetch("http://localhost:3333/about");
+  const res = await fetch("http://127.0.0.1:3333/about");
   await assertStreamBoundary(res, { boundaryCount: 0 });
 });
 ```

packages/ate/prompts/streaming_ssr.v1.md

@@ -16,12 +16,14 @@ import {
   writeFileSync,
   existsSync,
   mkdirSync,
+  readdirSync,
 } from "node:fs";
 import { join } from "node:path";
 import { composePrompt } from "../../src/prompt-composer";
 import type { Exemplar } from "../../src/exemplar-scanner";
 
 const GOLDEN_DIR = join(__dirname);
+const PROMPT_DIR = join(__dirname, "..", "..", "prompts");
 const UPDATE = process.env.UPDATE_GOLDEN === "1";
 
 interface GoldenCase {
@@ -255,6 +257,17 @@ const CASES: GoldenCase[] = [
 ];
 
 describe("prompt goldens", () => {
+  test("prompt catalog does not teach localhost transport fetches", () => {
+    const bannedFetch = /\bfetch\(\s*[`'"]http:\/\/localhost:/;
+    for (const file of readdirSync(PROMPT_DIR)) {
+      if (!file.endsWith(".md")) continue;
+      const content = readFileSync(join(PROMPT_DIR, file), "utf8");
+      if (bannedFetch.test(content)) {
+        throw new Error(`${file} contains a localhost fetch example; use 127.0.0.1`);
+      }
+    }
+  });
+
   for (const c of CASES) {
     test(`${c.kind} composed prompt matches golden`, async () => {
       const composed = await composePrompt({