@alumbwe/anvil 1.0.20 → 1.0.22

package/vendor/@anvil/common/src/util/__tests__/client-user-agent.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  UNRECOGNIZED_CLIENT,
+  clientUserAgentFields,
+  normalizeClientUserAgent,
+} from '../client-user-agent'
+
+describe('normalizeClientUserAgent', () => {
+  it('parses the official CLI agent', () => {
+    // What getCliAdRequestUserAgent() emits.
+    expect(normalizeClientUserAgent('Anvil-CLI/0.0.138')).toEqual({
+      product: 'anvil-cli',
+      version: '0.0.138',
+    })
+    expect(normalizeClientUserAgent('Anvil-CLI/1.0.685')).toEqual({
+      product: 'anvil-cli',
+      version: '1.0.685',
+    })
+  })
+
+  it('parses runtime and SDK agents a non-official client would send', () => {
+    expect(normalizeClientUserAgent('Go-http-client/2.0')).toEqual({
+      product: 'go-http-client',
+      version: '2.0',
+    })
+    expect(normalizeClientUserAgent('Bun/1.3.11')).toEqual({
+      product: 'bun',
+      version: '1.3.11',
+    })
+    // The UA a published Anvil proxy sends. The second segment is not a
+    // version, so it is dropped — `ai-sdk` alone still separates it from
+    // `anvil-cli`, which is the whole point.
+    expect(
+      normalizeClientUserAgent('ai-sdk/openai-compatible/1.0.25/anvil'),
+    ).toEqual({ product: 'ai-sdk' })
+  })
+
+  it('keeps only the leading product token, dropping platform detail', () => {
+    // The PII guard: everything after the first whitespace is never read, so
+    // OS/device strings cannot reach an event payload.
+    const browser =
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'
+    expect(normalizeClientUserAgent(browser)).toEqual({
+      product: 'mozilla',
+      version: '5.0',
+    })
+  })
+
+  it('returns undefined for an absent or blank header', () => {
+    expect(normalizeClientUserAgent(undefined)).toBeUndefined()
+    expect(normalizeClientUserAgent(null)).toBeUndefined()
+    expect(normalizeClientUserAgent('   ')).toBeUndefined()
+    expect(clientUserAgentFields(null)).toEqual({})
+  })
+
+  it('collapses an over-long product instead of truncating it', () => {
+    // Truncating would both fabricate a name and leave long random strings as
+    // a cheap way to mint new values.
+    expect(normalizeClientUserAgent('A'.repeat(200) + '/1.0')).toEqual({
+      product: UNRECOGNIZED_CLIENT,
+    })
+    // Exactly at the cap is still kept.
+    const atCap = 'a'.repeat(32)
+    expect(normalizeClientUserAgent(`${atCap}/1.0`)).toEqual({
+      product: atCap,
+      version: '1.0',
+    })
+    // One past it collapses.
+    expect(normalizeClientUserAgent(`${'a'.repeat(33)}/1.0`)).toEqual({
+      product: UNRECOGNIZED_CLIENT,
+    })
+  })
+
+  it('collapses junk to a single constant rather than minting a value', () => {
+    // The cardinality guard: a caller varying unparseable bytes cannot create
+    // new distinct values.
+    expect(normalizeClientUserAgent('!!!@@@###')).toEqual({
+      product: UNRECOGNIZED_CLIENT,
+    })
+    expect(normalizeClientUserAgent('***/1.0')).toEqual({
+      product: UNRECOGNIZED_CLIENT,
+    })
+  })
+
+  it('rejects an address-shaped product rather than mangling it', () => {
+    // Stripping `@` would record `userexample.com`, which is still identifying.
+    expect(normalizeClientUserAgent('user@example.com/1.0')).toEqual({
+      product: UNRECOGNIZED_CLIENT,
+    })
+    // A contact address in the conventional comment position is already gone:
+    // everything after the first whitespace is never read.
+    expect(
+      normalizeClientUserAgent('MyBot/1.0 (+contact@example.com)'),
+    ).toEqual({ product: 'mybot', version: '1.0' })
+  })
+
+  it('cannot inject fields into a log line', () => {
+    // Newlines and CR terminate the token before any charset stripping.
+    expect(normalizeClientUserAgent('evil\nFAKE-FIELD: 1/1.0')).toEqual({
+      product: 'evil',
+    })
+    expect(normalizeClientUserAgent('evil\r\ninjected/1.0')).toEqual({
+      product: 'evil',
+    })
+    expect(normalizeClientUserAgent('{"json":"inject"}/1.0')).toEqual({
+      product: 'jsoninject',
+      version: '1.0',
+    })
+  })
+
+  it('drops a version that does not look like a version', () => {
+    // Keeps free-form text (a plausible PII carrier) out of the version field.
+    expect(normalizeClientUserAgent('curl/not-a-version')).toEqual({
+      product: 'curl',
+    })
+    expect(normalizeClientUserAgent('someclient')).toEqual({
+      product: 'someclient',
+    })
+  })
+
+  it('drops an over-long version rather than fabricating a truncated one', () => {
+    expect(normalizeClientUserAgent('x/1' + '2'.repeat(100))).toEqual({
+      product: 'x',
+    })
+    // The case that makes truncation actively wrong: a real, legitimate semver
+    // longer than the cap. Reporting `1.0.0-beta+build` would name a version
+    // that does not exist and would collide with `...build.2`.
+    expect(normalizeClientUserAgent('x/1.0.0-beta+build.1')).toEqual({
+      product: 'x',
+    })
+    // Exactly at the cap is kept.
+    expect(normalizeClientUserAgent('x/1234567890123456')).toEqual({
+      product: 'x',
+      version: '1234567890123456',
+    })
+  })
+
+  it('omits the version key entirely when absent', () => {
+    expect(clientUserAgentFields('someclient')).toEqual({
+      client_ua_product: 'someclient',
+    })
+    expect(clientUserAgentFields('Anvil-CLI/0.0.138')).toEqual({
+      client_ua_product: 'anvil-cli',
+      client_ua_version: '0.0.138',
+    })
+  })
+})

package/vendor/@anvil/common/src/util/__tests__/engagement-tracker.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  EngagementTracker,
+  ENGAGEMENT_INTERVAL_MS,
+  ENGAGEMENT_IDLE_THRESHOLD_MS,
+  type EngagementScheduler,
+} from '../engagement-tracker'
+
+/** A scheduler whose registered tick can be fired manually, with a movable clock. */
+function harness(opts?: { idleThresholdMs?: number }) {
+  let now = 1_000_000
+  let registered: (() => void) | undefined
+  let cleared = false
+  let emits = 0
+
+  const scheduler: EngagementScheduler = {
+    setInterval: (fn) => {
+      registered = fn
+      return 'handle'
+    },
+    clearInterval: () => {
+      cleared = true
+    },
+  }
+
+  const tracker = new EngagementTracker({
+    emit: () => emits++,
+    now: () => now,
+    scheduler,
+    idleThresholdMs: opts?.idleThresholdMs,
+  })
+
+  return {
+    tracker,
+    advance: (ms: number) => {
+      now += ms
+    },
+    fireTick: () => registered?.(),
+    get emits() {
+      return emits
+    },
+    get cleared() {
+      return cleared
+    },
+    get started() {
+      return registered !== undefined
+    },
+  }
+}
+
+describe('EngagementTracker', () => {
+  it('emits one event per tick while visible and recently active', () => {
+    const h = harness()
+    h.tracker.start()
+
+    h.fireTick()
+    h.fireTick()
+    expect(h.emits).toBe(2)
+  })
+
+  it('does not emit when the surface is not visible', () => {
+    const h = harness()
+    h.tracker.start()
+    h.tracker.setVisible(false)
+
+    h.fireTick()
+    expect(h.emits).toBe(0)
+  })
+
+  it('stops emitting once the user is idle past the threshold', () => {
+    const h = harness()
+    h.tracker.start()
+
+    h.advance(ENGAGEMENT_IDLE_THRESHOLD_MS - 1)
+    h.fireTick()
+    expect(h.emits).toBe(1)
+
+    // Cross the idle threshold with no activity → no more counting.
+    h.advance(2)
+    h.fireTick()
+    expect(h.emits).toBe(1)
+
+    // Activity revives engagement.
+    h.tracker.recordActivity()
+    h.fireTick()
+    expect(h.emits).toBe(2)
+  })
+
+  it('treats re-becoming visible as activity', () => {
+    const h = harness()
+    h.tracker.start()
+
+    h.tracker.setVisible(false)
+    h.advance(ENGAGEMENT_IDLE_THRESHOLD_MS + 10)
+    // Returning to the surface counts as fresh activity, so the next tick counts.
+    h.tracker.setVisible(true)
+    h.fireTick()
+    expect(h.emits).toBe(1)
+  })
+
+  it('start is idempotent and stop clears the timer', () => {
+    const h = harness()
+    h.tracker.start()
+    h.tracker.start()
+    expect(h.started).toBe(true)
+
+    h.tracker.stop()
+    expect(h.cleared).toBe(true)
+  })
+
+  it('defaults to a one-minute cadence', () => {
+    expect(ENGAGEMENT_INTERVAL_MS).toBe(60_000)
+  })
+})

package/vendor/@anvil/common/src/util/__tests__/env-file-path.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test'
+
+import {
+  isEnvFilePath,
+  isEnvTemplateFilePath,
+  isSensitiveEnvFilePath,
+} from '../env-file-path'
+
+describe('env file paths', () => {
+  test.each([
+    ['.env', true],
+    ['.ENV.LOCAL', true],
+    ['config/.Env.Template', true],
+    ['app.env', false],
+  ])('%s env family → %s', (filePath, expected) => {
+    expect(isEnvFilePath(filePath)).toBe(expected)
+  })
+
+  test.each([
+    ['.env', true],
+    ['.ENV', true],
+    ['config/.env.local', true],
+    ['config\\.Env.Production', true],
+    ['.ENV/', true],
+    ['config/.env.local/.', true],
+    ['safe/../.env', true],
+    ['.env ', true],
+    ['.env:$DATA', true],
+    ['config/.env.local:backup', true],
+    ['C:.ENV', true],
+    ['.env.example ', true],
+    ['.env.example:$DATA', true],
+    ['/tmp/.env.example', false],
+    ['.ENV.SAMPLE', false],
+    ['config\\.env.Template', false],
+    ['.envrc', false],
+    ['app.env', false],
+    ['.env/..', false],
+  ])('%s sensitive → %s', (filePath, expected) => {
+    expect(isSensitiveEnvFilePath(filePath)).toBe(expected)
+  })
+
+  test.each([
+    ['.env.example', true],
+    ['.ENV.SAMPLE', true],
+    ['config/.Env.Template', true],
+    ['config/.Env.Template/./', true],
+    ['C:.Env.Example', true],
+    ['.env', false],
+    ['.env.local', false],
+    ['.env.example ', false],
+    ['.env.example:$DATA', false],
+    ['app.env.example', false],
+  ])('%s template → %s', (filePath, expected) => {
+    expect(isEnvTemplateFilePath(filePath)).toBe(expected)
+  })
+})