|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#18607] Every `client.packages.install(<manifest>)` example in THIS |
| 5 | + * package's PUBLISHED README is parsed against the contract that door |
| 6 | + * declares — `PackageInstallRequestSchema`, whose `manifest` key is |
| 7 | + * `ManifestSchema`. |
| 8 | + * |
| 9 | + * ## The defect it exists to prevent |
| 10 | + * |
| 11 | + * The README shipped this manifest in the npm tarball: |
| 12 | + * |
| 13 | + * await client.packages.install({ |
| 14 | + * name: 'vendor_plugin', |
| 15 | + * label: 'Vendor Plugin', |
| 16 | + * version: '1.0.0', |
| 17 | + * }); |
| 18 | + * |
| 19 | + * Parsed against the declared contract it is refused on THREE counts: |
| 20 | + * `invalid_type` at `[manifest, id]`, `invalid_value` at `[manifest, type]` |
| 21 | + * (both keys are required and absent), and `unrecognized_keys` at |
| 22 | + * `[manifest]` for `label` — a key `ManifestSchema`'s `strictObject` close |
| 23 | + * refuses BY NAME. `label` is not a root manifest key and never was: the |
| 24 | + * root shape declares `name` for the human-readable string, and the only |
| 25 | + * `label` anywhere near this surface belonged to the nested, since-RETIRED |
| 26 | + * `contributes.themes` `{ id, label, path }` entry — a sibling shape, not |
| 27 | + * this one. |
| 28 | + * |
| 29 | + * Nothing parses the contract at that door today, so the example "worked": |
| 30 | + * the SDK posts whatever literal it is handed, and `install(manifest: any)` |
| 31 | + * type-checks it away. That is what made this a timed charge rather than a |
| 32 | + * live outage — closing the door turns a silently-wrong published example |
| 33 | + * into a loudly-broken one for every reader who copied it. |
| 34 | + * |
| 35 | + * ## Why a pin, and why this one CAN fail |
| 36 | + * |
| 37 | + * Nothing else reads these literals. `check:published-readme-exports` has |
| 38 | + * the right population but reads fenced blocks for IMPORTED SYMBOLS and has |
| 39 | + * no notion of a schema; no gate parses an example payload against the |
| 40 | + * schema its own call site declares. Restore any of the three original |
| 41 | + * defects and this test reds on that specific issue code. |
| 42 | + * |
| 43 | + * Two shapes deliberately fail rather than pass quietly, because a pin that |
| 44 | + * measures nothing is worse than none (Route & surface ownership §3): |
| 45 | + * the corpus going EMPTY (the anchor renamed, the fence relabelled) and a |
| 46 | + * literal carrying a node kind the reader does not model. |
| 47 | + */ |
| 48 | + |
| 49 | +import { readFileSync } from 'node:fs'; |
| 50 | +import { fileURLToPath } from 'node:url'; |
| 51 | + |
| 52 | +import { PackageInstallRequestSchema } from '@objectstack/spec/api'; |
| 53 | +import ts from 'typescript'; |
| 54 | +import { describe, expect, it } from 'vitest'; |
| 55 | + |
| 56 | +/** This package's own published README — inside the package, no escape. */ |
| 57 | +const README = fileURLToPath(new URL('../README.md', import.meta.url)); |
| 58 | + |
| 59 | +/** The call whose first argument IS the manifest. */ |
| 60 | +const INSTALL_CALL = 'packages.install'; |
| 61 | + |
| 62 | +/** ```ts / ```typescript fences — the only regions read as code. */ |
| 63 | +const TS_FENCE = /^```(?:ts|typescript)\s*$\n([\s\S]*?)^```\s*$/gm; |
| 64 | + |
| 65 | +/** |
| 66 | + * An object literal, as a value. ⛔ Never a partial read: an unmodelled node |
| 67 | + * kind throws, because a manifest quietly missing the key that carried the |
| 68 | + * defect would parse green and pin nothing. |
| 69 | + */ |
| 70 | +function literalToValue(node: ts.Expression): unknown { |
| 71 | + if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text; |
| 72 | + if (ts.isNumericLiteral(node)) return Number(node.text); |
| 73 | + if (node.kind === ts.SyntaxKind.TrueKeyword) return true; |
| 74 | + if (node.kind === ts.SyntaxKind.FalseKeyword) return false; |
| 75 | + if (node.kind === ts.SyntaxKind.NullKeyword) return null; |
| 76 | + if (ts.isArrayLiteralExpression(node)) return node.elements.map(literalToValue); |
| 77 | + if (ts.isObjectLiteralExpression(node)) { |
| 78 | + const out: Record<string, unknown> = {}; |
| 79 | + for (const prop of node.properties) { |
| 80 | + if (!ts.isPropertyAssignment(prop)) { |
| 81 | + throw new Error(`Unmodelled object member in a README manifest: ${ts.SyntaxKind[prop.kind]}`); |
| 82 | + } |
| 83 | + const key = ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name) |
| 84 | + ? prop.name.text |
| 85 | + : undefined; |
| 86 | + if (key === undefined) { |
| 87 | + throw new Error(`Unmodelled property name in a README manifest: ${ts.SyntaxKind[prop.name.kind]}`); |
| 88 | + } |
| 89 | + out[key] = literalToValue(prop.initializer); |
| 90 | + } |
| 91 | + return out; |
| 92 | + } |
| 93 | + throw new Error(`Unmodelled expression in a README manifest: ${ts.SyntaxKind[node.kind]}`); |
| 94 | +} |
| 95 | + |
| 96 | +interface InstallExample { |
| 97 | + /** 1-based line of the call inside the README, for the failure message. */ |
| 98 | + readonly line: number; |
| 99 | + readonly manifest: unknown; |
| 100 | + readonly source: string; |
| 101 | +} |
| 102 | + |
| 103 | +function collectInstallExamples(readme: string): InstallExample[] { |
| 104 | + const found: InstallExample[] = []; |
| 105 | + for (const fence of readme.matchAll(TS_FENCE)) { |
| 106 | + const code = fence[1] ?? ''; |
| 107 | + const fenceLine = readme.slice(0, fence.index ?? 0).split('\n').length; |
| 108 | + const sourceFile = ts.createSourceFile('readme-fence.ts', code, ts.ScriptTarget.Latest, true); |
| 109 | + const visit = (node: ts.Node): void => { |
| 110 | + if ( |
| 111 | + ts.isCallExpression(node) |
| 112 | + && node.expression.getText(sourceFile).endsWith(INSTALL_CALL) |
| 113 | + && node.arguments.length > 0 |
| 114 | + ) { |
| 115 | + const [first] = node.arguments; |
| 116 | + if (first !== undefined && ts.isObjectLiteralExpression(first)) { |
| 117 | + found.push({ |
| 118 | + line: fenceLine + sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line, |
| 119 | + manifest: literalToValue(first), |
| 120 | + source: first.getText(sourceFile), |
| 121 | + }); |
| 122 | + } |
| 123 | + } |
| 124 | + ts.forEachChild(node, visit); |
| 125 | + }; |
| 126 | + visit(sourceFile); |
| 127 | + } |
| 128 | + return found; |
| 129 | +} |
| 130 | + |
| 131 | +const EXAMPLES = collectInstallExamples(readFileSync(README, 'utf8')); |
| 132 | + |
| 133 | +describe('published README — packages.install examples parse as manifests', () => { |
| 134 | + it('finds at least one `packages.install` manifest literal to judge', () => { |
| 135 | + // Anti-vacuity floor. An empty corpus means the anchor moved, not that |
| 136 | + // every example is correct. |
| 137 | + expect(EXAMPLES.length).toBeGreaterThan(0); |
| 138 | + }); |
| 139 | + |
| 140 | + it.each(EXAMPLES.map((e) => [e.line, e] as const))( |
| 141 | + 'README line %i is accepted by PackageInstallRequestSchema', |
| 142 | + (_line, example) => { |
| 143 | + const result = PackageInstallRequestSchema.safeParse({ manifest: example.manifest }); |
| 144 | + const refusals = result.success |
| 145 | + ? [] |
| 146 | + : result.error.issues.map((issue) => `${issue.code} at [${issue.path.join(', ')}]`); |
| 147 | + expect(refusals, `${example.source}\n→ ${refusals.join('; ')}`).toEqual([]); |
| 148 | + }, |
| 149 | + ); |
| 150 | +}); |
0 commit comments