@aphrody/m3-showcase 3.3.4

package/test/contracts.test.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { adaptiveFor, parseOverride } from "../src/adaptive/window.ts";
+import { pickNext } from "../src/adaptive/dpad.ts";
+import { parseRoute } from "../src/router.ts";
+import { collect } from "../scripts/inventory.ts";
+import { plan } from "../scripts/shots.ts";
+
+const root = mkdtempSync(join(tmpdir(), "m3-showcase-contract-"));
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+describe("adaptive showcase contracts", () => {
+  test("viewport and explicit TV preferences are independent", () => {
+    const mobile = adaptiveFor({
+      width: 390,
+      height: 844,
+      userAgent: "",
+      override: null,
+      touch: true,
+    });
+    expect(mobile.mode).toBe("mobile");
+    expect(mobile.width).toBe("compact");
+    const tv = adaptiveFor({
+      width: 390,
+      height: 844,
+      userAgent: "",
+      override: "tv",
+      touch: false,
+    });
+    expect(tv.mode).toBe("tv");
+    const desktop = adaptiveFor({
+      width: 1280,
+      height: 800,
+      userAgent: "SMART-TV",
+      override: "desktop",
+      touch: false,
+    });
+    expect(desktop.tv).toBe(false);
+    expect(desktop.source).toBe("override");
+    expect(parseOverride("?layout=mobile", "tv")).toBe("mobile");
+    expect(parseOverride("?tv", null)).toBe("tv");
+    expect(parseOverride("?layout=invalid", null)).toBeNull();
+  });
+  test("D-pad selects an aligned target and never moves backwards", () => {
+    const from = { left: 0, top: 0, right: 100, bottom: 100 };
+    expect(
+      pickNext(
+        from,
+        [
+          { item: "aligned", box: { left: 0, top: 150, right: 100, bottom: 250 } },
+          { item: "side", box: { left: 200, top: 110, right: 300, bottom: 210 } },
+          { item: "behind", box: { left: 0, top: -150, right: 100, bottom: -50 } },
+        ],
+        "down",
+      ),
+    ).toBe("aligned");
+    expect(pickNext(from, [], "left")).toBeUndefined();
+  });
+  test("hash destinations preserve direct links", () => {
+    expect(parseRoute("#/theme")).toBe("theme");
+    expect(parseRoute("#/reader/?page=2")).toBe("reader");
+    expect(parseRoute("")).toBe("overview");
+  });
+  test("inventory uses the selected workspace's exclusions", () => {
+    mkdirSync(join(root, "packages/private"), { recursive: true });
+    mkdirSync(join(root, "packages/public"), { recursive: true });
+    writeFileSync(
+      join(root, "package.json"),
+      JSON.stringify({ workspaces: { packages: ["packages/*", "!packages/private"] } }),
+    );
+    for (const name of ["private", "public"])
+      writeFileSync(
+        join(root, "packages", name, "package.json"),
+        JSON.stringify({ name: `@fixture/${name}`, version: "1.0.0" }),
+      );
+    const entries = collect(root);
+    expect(entries.find((entry) => entry.name === "@fixture/private")!.workspace).toBe(false);
+    expect(entries.find((entry) => entry.name === "@fixture/public")!.workspace).toBe(true);
+  });
+  test("capture planning rejects output traversal and invalid layout input", () => {
+    expect(() => plan(["../../outside"])).toThrow("Unknown showcase route");
+    expect(() => plan(["overview"], ["bad" as "tv"])).toThrow("Unknown layout");
+    expect(plan(["overview", "adaptive"], ["mobile", "tv"], ["light", "dark"])).toHaveLength(8);
+  });
+});

package/test/host-contract.test.ts

@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: Apache-2.0
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import {
+  generateIcons,
+  ICON_SOURCE,
+  iconCommand,
+  TAURI_ROOT,
+  SHOWCASE_ROOT,
+} from "../scripts/icons";
+import {
+  assertFactoryHost,
+  CARGO_RUNNER,
+  prepareShowcaseHost,
+  serializedTauriCommand,
+  runTauri,
+  showcaseShellFiles,
+  sidecarCommand,
+  tauriHostPlan,
+} from "../scripts/tauri";
+
+const installed = (name: string) =>
+  ["tauri", "cargo", "rustc", "java"].includes(name) ? "/installed/" + name : null;
+
+let temporary: string | undefined;
+afterEach(async () => {
+  if (temporary) await rm(temporary, { recursive: true, force: true });
+  temporary = undefined;
+});
+
+describe("showcase host delivery contract", () => {
+  test("uses canonical artwork and the installed owner without downloading replacements", async () => {
+    expect(await Bun.file(ICON_SOURCE).exists()).toBe(true);
+    expect(iconCommand("/consumer", "/installed/tauri")).toEqual([
+      "/installed/tauri",
+      "icon",
+      ICON_SOURCE,
+      "--output",
+      "/consumer/icons",
+      "--ios-color",
+      "#6750a4",
+    ]);
+    expect(() => iconCommand("/consumer", null)).toThrow("installed Tauri CLI");
+  });
+  test("the icon plan defaults to the canonical Rust owner's packaging directory", async () => {
+    const which = spyOn(Bun, "which").mockReturnValue("/installed/tauri");
+    const output = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await generateIcons(["--plan"]);
+      expect(output).toHaveBeenCalledTimes(1);
+      const plan = JSON.parse(String(output.mock.calls[0]?.[0]));
+      expect(plan.source).toBe(ICON_SOURCE);
+      expect(plan.output).toBe(resolve(TAURI_ROOT, "icons"));
+      expect(plan.command).toEqual(iconCommand(TAURI_ROOT, "/installed/tauri"));
+      const config = await Bun.file(resolve(TAURI_ROOT, "tauri.conf.json")).json();
+      for (const icon of config.bundle.icon)
+        expect(resolve(TAURI_ROOT, icon).startsWith(plan.output + "/")).toBe(true);
+    } finally {
+      output.mockRestore();
+      which.mockRestore();
+    }
+  });
+  test("the host has a real mobile entry and no ambient privileged namespace", () => {
+    const files = showcaseShellFiles();
+    const config = JSON.parse(String(files["tauri.conf.json"]));
+    expect(config.build.frontendDist).toBe("../../../m3/apps/showcase/dist");
+    expect(config.app.windows).toEqual([]);
+    expect(config.bundle.externalBin).toEqual(["binaries/m3-showcase"]);
+    const wrap = JSON.parse(String(files["wrap.json"]));
+    expect(wrap.mode).toBe("sidecar");
+    expect(wrap.sidecar).toEqual({
+      program: "m3-showcase",
+      args: [],
+      port: 0,
+      readyPath: "/healthz",
+      readyTimeoutSecs: 30,
+      env: {},
+    });
+    expect(files["Cargo.toml"]).toContain("aphrody-tauri-wrap.workspace = true");
+    expect(files["Cargo.toml"]).toContain("tauri-runtime-wry.workspace = true");
+    expect(files["Cargo.toml"]).not.toContain("[workspace]");
+    expect(files["src/lib.rs"]).toContain('aphrody_tauri_wrap::init(include_str!("../wrap.json"))');
+    expect(config.build.beforeBuildCommand).toContain("scripts/tauri.ts sidecar");
+    expect(config.app.withGlobalTauri).toBeUndefined();
+    expect(config.app.security.csp).toContain("object-src 'none'");
+    expect(config.app.security.csp).toContain("script-src 'self'");
+    expect(files["src/lib.rs"]).toContain("tauri::mobile_entry_point");
+    expect(JSON.parse(String(files["capabilities/default.json"])).permissions).toEqual([]);
+    expect(files[".gitignore"]).toContain("/icons/");
+  });
+  test("the concrete native owner inherits workspace identities and resolves the canonical frontend", async () => {
+    const manifest = Bun.TOML.parse(await Bun.file(resolve(TAURI_ROOT, "Cargo.toml")).text()) as {
+      dependencies: Record<string, { workspace?: boolean }>;
+      "build-dependencies": Record<string, { workspace?: boolean }>;
+    };
+    for (const name of ["tauri", "tauri-runtime-wry", "aphrody-tauri-wrap"])
+      expect(manifest.dependencies[name]?.workspace).toBe(true);
+    expect(manifest["build-dependencies"]["tauri-build"]?.workspace).toBe(true);
+    const config = await Bun.file(resolve(TAURI_ROOT, "tauri.conf.json")).json();
+    expect(resolve(TAURI_ROOT, config.build.frontendDist)).toBe(resolve(SHOWCASE_ROOT, "dist"));
+    const plan = tauriHostPlan(["build"], {}, "linux", installed);
+    expect(plan.hostOwner).toBe(TAURI_ROOT);
+    expect(plan.apiOwner).toBe(SHOWCASE_ROOT);
+    expect(() =>
+      serializedTauriCommand(["build", "--", "--manifest-path", "/other/Cargo.toml"], "/tauri"),
+    ).toThrow("manifest");
+  });
+  test("Android and iOS diagnostics require their actual platform toolchains", () => {
+    expect(
+      tauriHostPlan(["android", "build"], {}, "linux", installed).missing.join("; "),
+    ).toContain("Android SDK");
+    expect(
+      tauriHostPlan(["android", "build"], {}, "linux", installed).missing.join("; "),
+    ).toContain("Android NDK");
+    expect(tauriHostPlan(["ios", "build"], {}, "linux", installed).missing.join("; ")).toContain(
+      "macOS/Xcode",
+    );
+    expect(tauriHostPlan(["build"], {}, "linux", () => null).missing).toHaveLength(3);
+  });
+  test("desktop compilation keeps factory admission and the canonical Cargo lock", () => {
+    const local = {
+      configured: true,
+      enabled: true,
+      target: "vps",
+      host: null,
+      localCargo: true,
+      route: "local" as const,
+      reason: "diagnostic",
+    };
+    expect(() => assertFactoryHost(local)).toThrow("Workspace build factory");
+    expect(() => assertFactoryHost({ ...local, configured: false, host: "vps" })).toThrow(
+      "Workspace build factory",
+    );
+    expect(() => assertFactoryHost({ ...local, host: "vps", route: "factory" })).toThrow(
+      "Workspace build factory",
+    );
+    expect(() => assertFactoryHost({ ...local, host: "vps", localCargo: false })).not.toThrow();
+    expect(serializedTauriCommand(["build", "--", "--release"], "/installed/tauri")).toEqual([
+      "/installed/tauri",
+      "build",
+      "--runner",
+      CARGO_RUNNER,
+      "--",
+      "--release",
+      "--manifest-path",
+      resolve(TAURI_ROOT, "Cargo.toml"),
+      "--package",
+      "aphrody-m3-showcase",
+    ]);
+    expect(() => serializedTauriCommand(["build", "--runner=unlocked-cargo"], "/tauri")).toThrow(
+      "Cargo runner",
+    );
+    expect(tauriHostPlan(["build"], {}, "linux", () => "/installed").execution).toBe(
+      "workspace-build-factory",
+    );
+    expect(() => serializedTauriCommand(["android", "build"], "/tauri")).toThrow(
+      "API host adapter",
+    );
+  });
+  test("global options cannot turn a local inspection into an unguarded heavy command", async () => {
+    await expect(runTauri(["-v", "build"])).rejects.toThrow("global options cannot bypass");
+    expect(() => serializedTauriCommand(["build", "-rcargo"], "/tauri")).toThrow("Cargo runner");
+  });
+  test("sidecar target names match Tauri packaging and unsupported mobile hosts fail clearly", () => {
+    const linux = sidecarCommand("x86_64-unknown-linux-gnu", "/consumer");
+    expect(linux).toContain("linux-x64");
+    expect(linux.at(-1)).toBe("/consumer/binaries/m3-showcase-x86_64-unknown-linux-gnu");
+    const windows = sidecarCommand("x86_64-pc-windows-msvc", "/consumer");
+    expect(windows).toContain("windows-x64");
+    expect(windows.at(-1)).toEndWith("m3-showcase-x86_64-pc-windows-msvc.exe");
+    expect(() => sidecarCommand("aarch64-linux-android")).toThrow("canonical API host adapter");
+  });
+  test("preparation fills missing shell files and preserves existing host configuration", async () => {
+    temporary = await mkdtemp(join(tmpdir(), "m3-showcase-host-"));
+    const path = join(temporary, "tauri.conf.json");
+    await writeFile(path, '{"owner":"preserved"}');
+    await prepareShowcaseHost(temporary);
+    expect(await Bun.file(path).text()).toBe('{"owner":"preserved"}');
+    expect(await Bun.file(join(temporary, "src/lib.rs")).exists()).toBe(true);
+  });
+});

package/test/runtime-api.test.ts

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: Apache-2.0
+import { describe, expect, test } from "bun:test";
+import { routesToFetch } from "@aphrody/m3-bun/api";
+import routes from "../src/api/index.ts";
+
+const handler = routesToFetch(routes);
+async function request(path: string, init?: RequestInit): Promise<Response> {
+  const response = await handler(new Request("http://m3.test" + path, init));
+  if (!response) throw new Error("Missing showcase endpoint: " + path);
+  return response;
+}
+function post(path: string, body: unknown): Promise<Response> {
+  return request(path, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("showcase package computations", () => {
+  test("design compiles a brief and migration applies the actual transform", async () => {
+    const design = await post("/api/design", {
+      brief: "A minimal dashboard for developers with a list-detail layout.",
+      seed: "#123456",
+    });
+    expect(design.status).toBe(200);
+    const output = await design.json();
+    expect(output.files.some((file: { path: string }) => file.path === "src/theme.css")).toBe(true);
+    expect(output.theme.palettes.primary.tones[40]).toMatch(/^#[a-f\d]{6}$/i);
+    const migrated = await post("/api/migrate", {
+      source:
+        'import { Button } from "@mui/material"; export default () => <Button variant="contained">Save</Button>;',
+    });
+    expect(migrated.status).toBe(200);
+    const migration = await migrated.json();
+    expect(migration.source).toContain("@aphrody/m3-react");
+    expect(migration.source).toContain("<MdFilledButton>Save</MdFilledButton>");
+    expect(migration.diagnostics).toEqual([]);
+  });
+
+  test("system discovers the real MCP server, lint rules and generated files", async () => {
+    const response = await request("/api/system?target=cosmic&seed=%236750a4");
+    expect(response.status).toBe(200);
+    const data = await response.json();
+    expect(data.mcpTools.map((tool: { name: string }) => tool.name)).toContain("m3_symbol_search");
+    expect(data.lintRules.length).toBeGreaterThan(0);
+    expect(data.themeFiles.length).toBeGreaterThan(0);
+    expect(data.themeFiles.every((file: { target: string }) => file.target === "cosmic")).toBe(
+      true,
+    );
+    expect(data.scaffold["m3.config.ts"]).toContain("@aphrody/m3/config");
+    const file = data.themeFiles.find((entry: { binary: boolean }) => !entry.binary);
+    const theme = await request(
+      "/api/os-theme?target=cosmic&path=" + encodeURIComponent(file.path),
+    );
+    expect(theme.status).toBe(200);
+    expect((await theme.json()).content.length).toBeGreaterThan(0);
+  });
+
+  test("Next outputs use the requested origin and canonical theme roles", async () => {
+    const response = await request("/api/next?seed=%236750a4");
+    expect(response.status).toBe(200);
+    const data = await response.json();
+    expect(data.schemeCss).toContain("--md-sys-color-primary");
+    expect(data.robots).toContain("http://m3.test/sitemap.xml");
+    expect(data.sitemap).toContain("http://m3.test/components");
+    expect(data.jsonLd).toContain("Aphrody M3 Showcase");
+  });
+});
+
+describe("showcase request boundaries", () => {
+  test("rejects malformed, missing, oversized and non-object JSON", async () => {
+    for (const body of ["{", "null", "[]", JSON.stringify({ prompt: "x".repeat(70_000) })]) {
+      // eslint-disable-next-line no-await-in-loop -- Exercise each independent malformed body against the bounded request reader.
+      expect((await request("/api/ai/stream", { method: "POST", body })).status).toBe(400);
+    }
+    expect((await request("/api/ai/stream", { method: "POST" })).status).toBe(400);
+  });
+
+  test("rejects invalid themes, migration syntax and files outside generated output", async () => {
+    expect((await post("/api/design", { brief: "Dashboard", seed: "oops" })).status).toBe(400);
+    expect((await request("/api/next?seed=invalid")).status).toBe(400);
+    expect((await request("/api/system?target=unknown")).status).toBe(400);
+    expect((await request("/api/os-theme?path=../../secrets")).status).toBe(404);
+    expect((await post("/api/migrate", { source: "export default <" })).status).toBe(400);
+    expect((await post("/api/migrate", { source: "const x = 1;", kind: "unknown" })).status).toBe(
+      400,
+    );
+  });
+
+  test("fonts are allowlisted, immutable per ETag, and HEAD has no body", async () => {
+    const path = "/api/m3/fonts/GoogleSansCode-latin.woff2";
+    const response = await request(path);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("font/woff2");
+    expect(response.headers.get("cache-control")).toContain("max-age");
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    expect(new TextDecoder().decode(bytes.slice(0, 4))).toBe("wOF2");
+    const tag = response.headers.get("etag")!;
+    expect((await request(path, { headers: { "If-None-Match": tag } })).status).toBe(304);
+    const head = await request(path, { method: "HEAD" });
+    expect(head.status).toBe(200);
+    expect(head.headers.get("etag")).toBe(tag);
+    expect(await head.text()).toBe("");
+    const mono = await request("/api/m3/fonts/RobotoMono-latin.woff2");
+    expect(mono.status).toBe(200);
+    await mono.body?.cancel();
+    expect((await request("/api/m3/fonts/unknown.woff2")).status).toBe(404);
+    expect((await request("/api/m3/fonts/%2e%2e%2fRobotoMono-latin.woff2")).status).toBe(404);
+  });
+
+  test("AG-UI fixture completes and abort closes its producer", async () => {
+    const response = await post("/api/ai/stream", { prompt: "Inspect the package inventory." });
+    expect(response.headers.get("x-m3-fixture")).toBe("true");
+    const events = (await response.text())
+      .split("\n\n")
+      .filter(Boolean)
+      .map((frame) => JSON.parse(frame.replace(/^data:\s*/, "")));
+    expect(events[0].type).toBe("RUN_STARTED");
+    expect(events.at(-1).type).toBe("RUN_FINISHED");
+    expect(events.find((event) => event.type === "TOOL_CALL_RESULT").content).toContain(
+      "build inventory",
+    );
+    const controller = new AbortController();
+    const interrupted = await request("/api/ai/stream", {
+      method: "POST",
+      body: JSON.stringify({ prompt: "Interrupt this fixture." }),
+      signal: controller.signal,
+    });
+    const reader = interrupted.body!.getReader();
+    expect((await reader.read()).done).toBe(false);
+    controller.abort(new Error("fixture stopped"));
+    await expect(reader.read()).rejects.toThrow("fixture stopped");
+    reader.releaseLock();
+    const cancelled = await post("/api/ai/stream", { prompt: "Cancel without abort." });
+    await cancelled.body!.cancel();
+  });
+});

package/test-dom/dpad.test.ts

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: Apache-2.0
+import { afterEach, expect, test } from "bun:test";
+import { activeModal, attachDpad, focusables } from "../src/adaptive/dpad.ts";
+afterEach(() => {
+  document.body.innerHTML = "";
+});
+function button(parent: HTMLElement, label: string): HTMLButtonElement {
+  const node = document.createElement("button");
+  node.textContent = label;
+  node.getBoundingClientRect = () => ({
+    x: 0,
+    y: 0,
+    left: 0,
+    top: 0,
+    right: 20,
+    bottom: 20,
+    width: 20,
+    height: 20,
+    toJSON() {},
+  });
+  parent.append(node);
+  return node;
+}
+test("D-pad ignores controls hidden or disabled by ancestors", () => {
+  const visible = button(document.body, "Visible");
+  const hidden = document.createElement("div");
+  hidden.setAttribute("aria-hidden", "true");
+  document.body.append(hidden);
+  button(hidden, "Hidden");
+  const inert = document.createElement("div");
+  inert.setAttribute("inert", "");
+  document.body.append(inert);
+  button(inert, "Inert");
+  const disabled = document.createElement("fieldset");
+  disabled.disabled = true;
+  document.body.append(disabled);
+  button(disabled, "Disabled fieldset");
+  expect(focusables(document).map((element) => element.textContent)).toEqual([visible.textContent]);
+});
+test("hidden modal containers do not steal the D-pad focus scope", () => {
+  const live = document.createElement("section");
+  live.setAttribute("aria-modal", "true");
+  document.body.append(live);
+  const stale = document.createElement("section");
+  stale.setAttribute("aria-modal", "true");
+  stale.hidden = true;
+  document.body.append(stale);
+  expect(activeModal(document) === live).toBe(true);
+});
+test("Back calls a custom dialog's close method and disposal removes the handler", () => {
+  const dialog = document.createElement("md-dialog") as HTMLElement & { close(): void };
+  dialog.setAttribute("open", "");
+  let closes = 0;
+  dialog.close = () => {
+    closes++;
+    dialog.removeAttribute("open");
+  };
+  document.body.append(dialog);
+  let backs = 0;
+  const dispose = attachDpad({
+    onBack: () => {
+      backs++;
+    },
+  });
+  document.dispatchEvent(
+    new KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }),
+  );
+  expect(closes).toBe(1);
+  document.dispatchEvent(
+    new KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }),
+  );
+  expect(backs).toBe(1);
+  dispose();
+  document.dispatchEvent(
+    new KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }),
+  );
+  expect(backs).toBe(1);
+});

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "@aphrody/m3-config/tsconfig.json",
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "types": ["bun", "node"],
+    "noUnusedLocals": true,
+    "noUnusedParameters": true
+  },
+  "include": ["src/**/*", "scripts/**/*", "test/**/*", "m3.config.ts"]
+}