fix(toolbox): resolve Vite 8 build warnings in conformance and workbench

[MFA-G]

Fix Vite 8 build warnings in fdc3-conformance and fdc3-workbench

Closes #2115 (warnings 1, 4, 5 and 7).

After this change toolbox/fdc3-conformance builds completely warning-free, and the configLoader: 'native' warning is gone from toolbox/fdc3-workbench too.

Changes

1. configLoader: 'native' compatibility (warning #1)

fdc3-conformance used __dirname in vite.config.ts, which the native config loader does not provide:

+const __dirname = import.meta.dirname;

import.meta.dirname is available from Node 20.11, and the package already requires >=22.

fdc3-workbench loaded its ESM vite.config.ts as CommonJS. Added "type": "module" to its package.json, as suggested in the issue. The workbench has no .js/.cjs source files that could be affected — all sources are .ts/.tsx compiled by Vite, and eslint.config.mjs is already explicit.

2. PREFER_BUILTIN_FEATURE — @rollup/plugin-inject (warning #5)

Replaced the plugin with Rolldown's native inject, which lives under transform in build.rollupOptions:

-      plugins: [
-        inject({
-          process: 'process/browser.js',
-          Buffer: ['buffer', 'Buffer'],
-        }),
-      ],
+      transform: {
+        inject: {
+          process: 'process/browser.js',
+          Buffer: ['buffer', 'Buffer'],
+        },
+      },

The API is aligned with @rollup/plugin-inject, so the mapping is unchanged. @rollup/plugin-inject is dropped from devDependencies.

3. SOURCEMAP_BROKEN — fix-source-map-support-global (warning #4)

The build sets sourcemap: true, so suppressing the warning would have been the wrong trade-off — the plugin really was invalidating the sourcemap for browser-source-map-support. It now performs the same single replacement through magic-string and returns the generated map:

const s = new MagicString(code);
s.overwrite(index, index + SOURCE_MAP_SUPPORT_GLOBAL.length, SOURCE_MAP_SUPPORT_GLOBAL_FIXED);
return { code: s.toString(), map: s.generateMap({ hires: true }) };

It also returns early when the pattern is absent instead of silently producing identical output, so a future upstream change to source-map-support fails loudly rather than shipping a broken global shim. magic-string is added as an explicit devDependency (it was previously only reachable transitively via @rollup/plugin-inject).

4. CSS injection entry selection (warning #7)

Only src/test/index.ts (the fdc3-compliance entry) imports CSS — import 'mocha/mocha.css'. With ~20 entries the plugin was picking open-a.js arbitrarily, meaning the mocha stylesheet was injected by a mock app rather than by the test runner. Now pinned explicitly:

cssInjectedByJsPlugin({
  jsAssetsFilterFunction: outputChunk => outputChunk.fileName === 'fdc3-compliance.js',
})

Verified in dist/lib: after the change the mocha CSS and its document.head.appendChild call appear in fdc3-compliance.js only, and no longer in open-a.js.

Not addressed

Deliberately left out of this PR, since they are judgement calls rather than fixes:

• Small readme updates #2 COMMONJS_VARIABLE_IN_ESM (@jsdevtools/ono) — comes from a transitive dependency's published ESM build (@apidevtools/json-schema-ref-parser → @jsdevtools/ono), not from repo code. Fixing it means patching or replacing a dependency.
• Consolidate documentation and content #3 chunk size > 500 kB and 1.0 documentation completion task list #6 PLUGIN_TIMINGS (legacy plugin) — both informational, and the issue itself notes 1.0 documentation completion task list #6 is a browser-support policy decision (dropping @vitejs/plugin-legacy) rather than a bug.

Happy to follow up on any of those in a separate PR if maintainers have a preference on the direction.

Validation

Run locally on Node 22.23.2 / npm 12.0.2:

Check	Result
npm run build (all workspaces)	pass
npm test (all workspaces)	pass
npm run lint (all workspaces)	pass
npx prettier --check on changed files	pass
npx depcheck --skip-missing in both toolbox workspaces	pass
vite build warnings in fdc3-conformance	5 → 0
vite build warnings in fdc3-workbench	configLoader warning gone; remaining are #2/#3/#6 above

CHANGELOG.md updated under [Unreleased] → Fixed.

[linux-foundation-easycla]

• ✅ login: julianna-ciq / name: Julianna Langston (7809841)
• ❌ - login: @MFA-G / name: Fadhlan. The commit (b3fb788, bfc94ff) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[netlify]

❌ Deploy Preview for fdc3 failed. Why did it fail? →

Name	Link
🔨 Latest commit	7809841
🔍 Latest deploy log	https://app.netlify.com/projects/fdc3/deploys/6a9055d394faae0007aacde0

[kriswest]

Hi @MFA-G thanks for having a crack at this. Could you take a look at teh Easy CLA comment and hit the Please click here to be authorized link to and complete a CAL so we can merge this?

[kriswest]

We could lose magic-string from this and a CLA needs completing before it can be merged.

@julianna-ciq could you review and merge if/when this gets updated?

[kriswest]

THis is an old verison, current is 1.2.0.

The library is also not wonderfully well maintained (OpenSSF scorecard result is 3.8). Any chance we can eliminate it and use conventional string manipulation without a dependency?

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.11%. Comparing base (4a363e3) to head (bfc94ff).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2117   +/-   ##
=======================================
  Coverage   95.11%   95.11%           
=======================================
  Files          73       73           
  Lines        4196     4196           
  Branches      584      589    +5     
=======================================
  Hits         3991     3991           
  Misses        205      205           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[MFA-G]

Thanks @kriswest — good call, magic-string is gone in b3fb788.

It was only there to hand back a sourcemap for the fix-source-map-support-global transform (returning { code } with no map is what Vite 8 warns about). Since that transform rewrites one expression on a single line and changes no line numbers, the map is a plain identity map, which is a few lines of plumbing rather than a dependency:

function identitySourceMap(code: string, id: string) {
  const lineCount = code.split('\n').length;
  // VLQ segments: `AAAA` = [col 0, source 0, line 0, col 0]; `AACA` advances the source line by 1.
  const mappings = ['AAAA', ...Array(Math.max(lineCount - 1, 0)).fill('AACA')].join(';');
  return { version: 3 as const, sources: [id], sourcesContent: [code], names: [], mappings };
}

and the transform is back to a simple code.replace(...).

Net effect on toolbox/fdc3-conformance: no devDependency is added at all — @rollup/plugin-inject (which was itself the thing dragging in magic-string, plus estree-walker and @rollup/pluginutils) is removed and replaced by Rolldown's built-in transform.inject, and nothing takes its place. The lockfile shrinks accordingly.

Validation on the updated branch:

• npm run build in toolbox/fdc3-conformance — clean, zero warnings, 332 modules, all 22 entries emitted with maps.
• Verified the transform still lands: the bundled fdc3-compliance.js contains globalThis.define||function and zero occurrences of the old this.sourceMapSupport form.
• npm run build in toolbox/fdc3-workbench — clean apart from the pre-existing chunk-size notice, which is unrelated to this PR.

The EasyCLA is being sorted out. @julianna-ciq ready for another look whenever convenient.

[kriswest]

@MFA-G We'd be happy to move this PR along towards being merged, but can't do so unless you complete the CLA check. See comment #2117 (comment)