@bongos/core 1.17.0

package/tests/package_core.mjs

@@ -0,0 +1,435 @@
+// tests/package_core.mjs
+//
+// GDS-V4 R84 (task 1688) — locks the pure logic of the Cloud Bongos core packager
+// (scripts/gds/package-core.js, ADR 0100 §1). Hermetic: no git, DB, or network —
+// so the #856 pr-unit-tests gate auto-includes it. Guards four things:
+//   1. canonicalTreeHash is the stable, order-independent, content-sensitive PIN,
+//   2. the manifest carries the right pin coordinates + normalized file modes,
+//   3. the hand-rolled ustar+gzip writer produces a REAL, readable archive that
+//      round-trips (incl. the GNU long-name path for >100-byte paths) with valid
+//      checksums, and is byte-deterministic,
+//   4. the ustar name/prefix split falls back to a longlink exactly when needed.
+//
+// Run:  node tests/package_core.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import zlib from 'node:zlib';
+import crypto from 'node:crypto';
+
+const require = createRequire(import.meta.url);
+const m = require('../scripts/gds/package-core.js');
+const {
+  canonicalTreeHash, normalizeMode, buildCoreManifest, withTarballInfo,
+  tarballName, manifestName, stageDirName, splitUstarName, buildTar, sha256hex,
+  ARTIFACT_NAME, MANIFEST_SCHEMA, TAR_ROOT,
+  // task 1824 — the consumer-core file-classification layer
+  isDocPath, functionalSecretLeaks, processCoreFile,
+  // task 1882 (ADR 0108 §2) — the real installable npm package
+  CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
+  // task 2089 (ADR 0134) — private-by-default npm publish
+  publishArgs,
+} = m;
+const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/gds/mirror-redact.js');
+
+// A synthetic instance brand for the classification tests (never the real OTB literals).
+const TEST_BRANDING = {
+  domains: { publicOrigin: 'https://acme.example' },
+  repo: { owner: 'zoltan', name: 'acme' },
+  identity: { worldName: 'Xanadu' },
+};
+const TEST_RULES = buildRedactionRules(TEST_BRANDING, {});
+const TEST_LITERALS = collectSensitiveLiterals(TEST_BRANDING, {});
+const proc = (pathRel, raw, envSecrets = []) =>
+  processCoreFile({ pathRel, raw: Buffer.from(raw), rules: TEST_RULES, sensitiveLiterals: TEST_LITERALS, envSecrets });
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── a tiny ustar reader — proves the writer emits a REAL, standard archive ──────────
+// Returns Map<name, { content:Buffer, mode:number }>. Handles GNU 'L' longlink.
+function readTar(gzBuf) {
+  const buf = zlib.gunzipSync(gzBuf);
+  const files = new Map();
+  let off = 0;
+  let pendingLongName = null;
+  const cstr = (b, s, e) => { const z = b.indexOf(0, s); return b.toString('utf8', s, z >= 0 && z < e ? z : e); };
+  const readOct = (b, s, len) => parseInt((b.toString('ascii', s, s + len).replace(/\0/g, ' ').trim() || '0'), 8);
+  while (off + 512 <= buf.length) {
+    const hdr = buf.subarray(off, off + 512);
+    if (hdr.every((x) => x === 0)) break; // terminator
+    // verify checksum
+    const stored = readOct(hdr, 148, 8);
+    let sum = 0;
+    for (let i = 0; i < 512; i++) sum += (i >= 148 && i < 156) ? 0x20 : hdr[i];
+    assert.equal(sum, stored, 'header checksum mismatch');
+    const typeflag = String.fromCharCode(hdr[156]);
+    const size = readOct(hdr, 124, 12);
+    const dataBlocks = Math.ceil(size / 512) * 512;
+    const body = buf.subarray(off + 512, off + 512 + size);
+    off += 512 + dataBlocks;
+    if (typeflag === 'L') { pendingLongName = cstr(body, 0, body.length); continue; }
+    const prefix = cstr(hdr, 345, 500);
+    const rawName = cstr(hdr, 0, 100);
+    const name = pendingLongName != null ? pendingLongName : (prefix ? `${prefix}/${rawName}` : rawName);
+    pendingLongName = null;
+    if (typeflag === '0' || typeflag === '\0' || hdr[156] === 0) {
+      files.set(name, { content: Buffer.from(body), mode: readOct(hdr, 100, 8) });
+    }
+  }
+  return files;
+}
+
+// ── canonicalTreeHash — the PIN ─────────────────────────────────────────────────────
+t('tree hash is order-independent (sorts internally)', () => {
+  const a = [{ path: 'b.js', mode: '100644', sha256: 'ff' }, { path: 'a.js', mode: '100644', sha256: 'ee' }];
+  const b = [{ path: 'a.js', mode: '100644', sha256: 'ee' }, { path: 'b.js', mode: '100644', sha256: 'ff' }];
+  assert.equal(canonicalTreeHash(a), canonicalTreeHash(b));
+});
+
+t('tree hash changes when a file content hash changes', () => {
+  const base = [{ path: 'a.js', mode: '100644', sha256: 'ee' }];
+  const changed = [{ path: 'a.js', mode: '100644', sha256: 'ef' }];
+  assert.notEqual(canonicalTreeHash(base), canonicalTreeHash(changed));
+});
+
+t('tree hash changes when a file is added', () => {
+  const one = [{ path: 'a.js', mode: '100644', sha256: 'ee' }];
+  const two = [...one, { path: 'b.js', mode: '100644', sha256: 'ff' }];
+  assert.notEqual(canonicalTreeHash(one), canonicalTreeHash(two));
+});
+
+t('tree hash is mode-normalized (git 100644/100755 collapse to canonical)', () => {
+  const raw = [{ path: 'a.js', mode: '100644', sha256: 'ee' }];
+  const norm = [{ path: 'a.js', mode: '0000644', sha256: 'ee' }];
+  assert.equal(canonicalTreeHash(raw), canonicalTreeHash(norm));
+});
+
+// ── normalizeMode ─────────────────────────────────────────────────────────────────
+t('normalizeMode: executable vs regular', () => {
+  assert.equal(normalizeMode('100755'), '0000755');
+  assert.equal(normalizeMode('100644'), '0000644');
+  assert.equal(normalizeMode('040000'), '0000644'); // anything non-exec → regular
+});
+
+// ── manifest ────────────────────────────────────────────────────────────────────────
+t('buildCoreManifest carries the pin coordinates + normalized files', () => {
+  const man = buildCoreManifest({
+    version: '1.13.0', coreContract: '1.13.0', sourceCommit: 'abc123', sourceRef: 'HEAD',
+    builtAtIso: '2026-07-01T00:00:00.000Z',
+    files: [{ path: 'a.js', mode: '100755', sha256: 'aa' }, { path: 'b.js', mode: '100644', sha256: 'bb' }],
+    treeHash: 'deadbeef', redaction: { rules: 3, gate: 'passed' },
+  });
+  assert.equal(man.artifact, ARTIFACT_NAME);
+  assert.equal(man.manifest_schema, MANIFEST_SCHEMA);
+  assert.equal(man.core_version, '1.13.0');
+  assert.equal(man.core_contract, '1.13.0');
+  assert.equal(man.source_commit, 'abc123');
+  assert.equal(man.tree_sha256, 'deadbeef');
+  assert.equal(man.file_count, 2);
+  assert.equal(man.files[0].mode, '0000755'); // normalized
+  assert.equal(man.files[1].mode, '0000644');
+  assert.equal(man.tarball, undefined); // the inner manifest has no self-hash
+});
+
+t('withTarballInfo adds the exact-bytes coordinate for the side-car pin', () => {
+  const inner = buildCoreManifest({
+    version: '1.13.0', coreContract: '1.13.0', sourceCommit: 'abc', sourceRef: 'HEAD',
+    builtAtIso: '2026-07-01T00:00:00.000Z', files: [], treeHash: 'x', redaction: null,
+  });
+  const side = withTarballInfo(inner, { name: 'cloudbongos-core-1.13.0.tgz', sha256: 'cafe', bytes: 42 });
+  assert.equal(side.tarball.sha256, 'cafe');
+  assert.equal(side.tarball.bytes, 42);
+  assert.equal(inner.tarball, undefined); // withTarballInfo does not mutate the inner
+});
+
+t('artifact filenames', () => {
+  assert.equal(tarballName('1.13.0'), 'cloudbongos-core-1.13.0.tgz');
+  assert.equal(manifestName('1.13.0'), 'cloudbongos-core-1.13.0.manifest.json');
+  assert.equal(stageDirName('1.13.0'), 'cloudbongos-core-1.13.0');
+});
+
+// ── ustar name/prefix split ──────────────────────────────────────────────────────────
+t('splitUstarName: short path → name only', () => {
+  const r = splitUstarName('cloudbongos-core/a.js');
+  assert.equal(r.prefix, '');
+  assert.equal(r.name, 'cloudbongos-core/a.js');
+});
+
+t('splitUstarName: long path splits at a / into name<=100 + prefix<=155', () => {
+  const long = 'cloudbongos-core/' + 'dir/'.repeat(20) + 'file.js'; // > 100 bytes
+  const r = splitUstarName(long);
+  assert.ok(r, 'expected a split');
+  assert.ok(Buffer.byteLength(r.name) <= 100);
+  assert.ok(Buffer.byteLength(r.prefix) <= 155);
+  assert.equal(`${r.prefix}/${r.name}`, long);
+});
+
+t('splitUstarName: unsplittable (>100-byte tail) → null (longlink fallback)', () => {
+  const noSlash = 'x'.repeat(120); // single 120-char component, no '/'
+  assert.equal(splitUstarName(noSlash), null);
+});
+
+// ── buildTar — produces a real, readable, deterministic archive ──────────────────────
+t('buildTar round-trips a small set (content + mode preserved)', () => {
+  const entries = [
+    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('hello\n') },
+    { name: 'cloudbongos-core/bin/run.sh', mode: 0o755, buf: Buffer.from('#!/bin/sh\necho hi\n') },
+  ];
+  const files = readTar(buildTar(entries));
+  assert.equal(files.get('cloudbongos-core/a.txt').content.toString(), 'hello\n');
+  assert.equal(files.get('cloudbongos-core/bin/run.sh').content.toString(), '#!/bin/sh\necho hi\n');
+  assert.equal(files.get('cloudbongos-core/bin/run.sh').mode & 0o777, 0o755);
+  assert.equal(files.get('cloudbongos-core/a.txt').mode & 0o777, 0o644);
+});
+
+t('buildTar round-trips a >100-byte path via the GNU longlink path', () => {
+  const longName = 'cloudbongos-core/' + 'deep/'.repeat(25) + 'leaf.js'; // ~150 bytes, but splittable
+  const unsplittable = 'z'.repeat(130); // forces the longlink branch (no valid split)
+  const entries = [
+    { name: longName, mode: 0o644, buf: Buffer.from('deep\n') },
+    { name: unsplittable, mode: 0o644, buf: Buffer.from('flat\n') },
+  ];
+  const files = readTar(buildTar(entries));
+  assert.equal(files.get(longName).content.toString(), 'deep\n');
+  assert.equal(files.get(unsplittable).content.toString(), 'flat\n');
+});
+
+t('buildTar is byte-deterministic (same input → identical bytes; entry order irrelevant)', () => {
+  const e1 = [
+    { name: 'cloudbongos-core/b.txt', mode: 0o644, buf: Buffer.from('B') },
+    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('A') },
+  ];
+  const e2 = [...e1].reverse();
+  assert.equal(sha256hex(buildTar(e1)), sha256hex(buildTar(e2)));
+});
+
+t('buildTar output gunzips and ends with two zero blocks', () => {
+  const gz = buildTar([{ name: 'cloudbongos-core/a', mode: 0o644, buf: Buffer.from('x') }]);
+  const tar = zlib.gunzipSync(gz);
+  assert.equal(tar.length % 512, 0);
+  const tail = tar.subarray(tar.length - 1024);
+  assert.ok(tail.every((b) => b === 0), 'archive must end with two 512-byte zero blocks');
+});
+
+// ── normalizeMode idempotency + pin reproducibility (task 1688) ─────────────────────
+// The pin (tree_sha256) is worthless if a consumer can't recompute it. The original
+// normalizeMode only mapped git's 100755, so re-running it over the manifest's
+// already-canonical modes silently demoted executables → the pin didn't reproduce.
+t('normalizeMode is idempotent + exec-aware across mode forms', () => {
+  assert.equal(normalizeMode('100755'), '0000755'); // git executable
+  assert.equal(normalizeMode('0000755'), '0000755'); // idempotent (was the pin bug)
+  assert.equal(normalizeMode('755'), '0000755');      // raw octal
+  assert.equal(normalizeMode('100644'), '0000644'); // git regular
+  assert.equal(normalizeMode('0000644'), '0000644'); // idempotent
+  assert.equal(normalizeMode('644'), '0000644');
+});
+t('tree hash reproduces from an already-normalized (manifest-shaped) files list', () => {
+  const gitFiles = [{ path: 'bin/x', mode: '100755', sha256: 'aa' }, { path: 'a.js', mode: '100644', sha256: 'bb' }];
+  const pin = canonicalTreeHash(gitFiles);
+  // simulate manifest.files (modes already normalized) — the exact recompute a consumer runs
+  const manifestFiles = gitFiles.map((f) => ({ path: f.path, mode: normalizeMode(f.mode), sha256: f.sha256 }));
+  assert.equal(canonicalTreeHash(manifestFiles), pin);
+});
+
+// ── task 1824 — consumer-core file classification (docs redacted, functional verbatim) ──
+t('isDocPath: only .md/.markdown are docs', () => {
+  assert.equal(isDocPath('README.md'), true);
+  assert.equal(isDocPath('docs/adr/0100.markdown'), true);
+  assert.equal(isDocPath('migrations/003.sql'), false);
+  assert.equal(isDocPath('package-lock.json'), false);
+  assert.equal(isDocPath('src/bongos/serve-internal.js'), false);
+});
+
+t('functional SQL ships VERBATIM — a Postgres identifier is NOT blanked (the 63-migration bug)', () => {
+  const sql = 'CREATE FUNCTION pms_touch_updated_at() RETURNS trigger AS $$ BEGIN NEW.updated_at = now(); END; $$;';
+  const r = proc('migrations/007_trigger.sql', sql);
+  assert.equal(r.kind, 'functional');
+  assert.equal(r.buf.toString(), sql);          // byte-for-byte
+  assert.ok(!r.buf.toString().includes('<redacted>')); // never corrupted
+  assert.equal(r.leaks.length, 0);              // not a real leak → no abort
+});
+
+t('functional package-lock ships VERBATIM — base64 integrity hashes intact (the npm-ci bug)', () => {
+  const lock = '{"node_modules/x":{"integrity":"sha512-abcDEF123+/456ghiJKLmnopQRStuv7890wxyz=="}}';
+  const r = proc('package-lock.json', lock);
+  assert.equal(r.kind, 'functional');
+  assert.equal(r.buf.toString(), lock);
+  assert.ok(!r.buf.toString().includes('<redacted>'));
+  assert.equal(r.leaks.length, 0);
+});
+
+t('functional brand/topology strings are a NON-FATAL advisory (ship verbatim, never abort)', () => {
+  const code = '// hall link: https://acme.example/builders#/task/9 — owner zoltan';
+  const r = proc('modules/lifecycle/routes/tasks.js', code);
+  assert.equal(r.kind, 'functional');
+  assert.equal(r.buf.toString(), code);   // verbatim — NOT redacted
+  assert.equal(r.leaks.length, 0);        // brand is not a leak → does not abort
+  assert.ok(r.advisories.length > 0);     // but IS surfaced for human awareness
+});
+
+t('functional file with a live credential verbatim IS a fatal leak', () => {
+  const secret = 'ghp_' + 'A'.repeat(36); // a github-token-shaped live value
+  const r = proc('scripts/gds/x.js', `const T = "${secret}";`, [secret]);
+  assert.equal(r.kind, 'functional');
+  assert.ok(r.leaks.some((l) => l.label === 'live-credential'));
+  assert.equal(r.leaks[0].sample, undefined); // never echoes the secret value
+});
+
+t('functionalSecretLeaks: exact env-secret value match only (short values ignored)', () => {
+  const view = 'x = "supersecretvalue1234"; y = "abc";';
+  assert.equal(functionalSecretLeaks(view, ['supersecretvalue1234']).length, 1);
+  assert.equal(functionalSecretLeaks(view, ['abc']).length, 0);       // < 8 chars → skipped
+  assert.equal(functionalSecretLeaks(view, ['notpresent12345']).length, 0);
+});
+
+t('DOCS are genericized: instance brand/owner redacted, output is clean', () => {
+  const doc = '# Guide\nVisit https://acme.example (world Xanadu), maintained by zoltan.\n';
+  const r = proc('docs/recipes/guide.md', doc);
+  assert.equal(r.kind, 'doc');
+  const out = r.buf.toString();
+  assert.notEqual(out, doc);              // it WAS redacted
+  assert.ok(!/acme/i.test(out), 'domain token gone');
+  assert.ok(!/zoltan/i.test(out), 'owner gone');
+  assert.equal(r.leaks.length, 0);        // clean after redaction → no abort
+});
+
+// ── task 1882 (ADR 0108 §2) — the real installable npm package ─────────────────────
+t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
+  assert.equal(TAR_ROOT, 'package/');
+});
+
+t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici override', () => {
+  const pkg = buildPackageJson({
+    version: '1.14.0',
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceOverrides: { undici: '^6.27.0' },
+  });
+  assert.equal(pkg.name, '@cloudbongos/core');
+  assert.equal(pkg.version, '1.14.0');
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
+  assert.equal(pkg.dependencies.phaser, undefined);
+  assert.equal(pkg.dependencies['discord.js'], undefined);
+  assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
+  assert.equal(pkg.main, 'src/platform-server.js');
+  assert.equal(pkg.bin.bongos, 'bin/bongos.js');
+  assert.equal(pkg.exports['.'], './src/platform-server.js');
+  assert.equal(pkg.exports['./serve-internal'], './src/bongos/serve-internal.js');
+  assert.equal(pkg.exports['./module-api'], './src/module-api.js');
+  // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
+  assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
+});
+
+t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / ADR 0134)', () => {
+  const tgz = 'dist/cloudbongos-core-1.14.0.tgz';
+  // Default: dry-run, restricted (never public, never a real upload).
+  assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'restricted', '--dry-run']);
+  // Live: still restricted (private) — the permanent publish is never public here.
+  assert.deepEqual(publishArgs(tgz, true), ['publish', tgz, '--access', 'restricted']);
+  // Belt-and-suspenders: `--access public` must never appear on the pre-launch path.
+  assert.ok(!publishArgs(tgz, true).includes('public'));
+});
+
+t('buildPackageJson: omits `overrides` when the source has none', () => {
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  assert.equal(pkg.overrides, undefined);
+});
+
+t('buildPackageJson: throws when a required core dep is missing from the source', () => {
+  assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
+});
+
+t('CORE_DEP_NAMES is exactly [express, pg]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg']);
+});
+
+// A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and
+// a version-conflict nesting (root -> a, but a's OWN "c" is a different version
+// than root's direct "c") — proves resolveLockDep walks up node_modules
+// boundaries instead of assuming everything hoists to top-level.
+const FIXTURE_LOCK = {
+  lockfileVersion: 3,
+  packages: {
+    '': { name: 'fixture', version: '0.0.0', dependencies: { a: '^1.0.0', c: '^2.0.0' } },
+    'node_modules/a': { version: '1.0.0', dependencies: { b: '^1.0.0', c: '^1.0.0' } },
+    'node_modules/b': { version: '1.0.0', dependencies: {} },
+    'node_modules/c': { version: '2.0.0', dependencies: {} }, // root's c
+    'node_modules/a/node_modules/c': { version: '1.0.0', dependencies: {} }, // a's OWN c (conflict)
+    'node_modules/unrelated': { version: '9.9.9', dependencies: {} }, // never reached from a/c
+  },
+};
+
+t('resolveLockDep: root dependency resolves to the top-level node_modules entry', () => {
+  assert.equal(resolveLockDep(FIXTURE_LOCK.packages, '', 'a'), 'node_modules/a');
+});
+
+t('resolveLockDep: a nested version-conflict entry wins over the top-level one', () => {
+  assert.equal(resolveLockDep(FIXTURE_LOCK.packages, 'node_modules/a', 'c'), 'node_modules/a/node_modules/c');
+});
+
+t('resolveLockDep: falls back to the top-level entry when no nested override exists', () => {
+  assert.equal(resolveLockDep(FIXTURE_LOCK.packages, 'node_modules/a', 'b'), 'node_modules/b');
+});
+
+t('resolveLockDep: returns undefined for a dep with no matching entry anywhere', () => {
+  assert.equal(resolveLockDep(FIXTURE_LOCK.packages, 'node_modules/a', 'nope'), undefined);
+});
+
+t('lockfileClosure: walks the full transitive graph, keeping the conflict-nested entry distinct from the top-level one', () => {
+  const keep = lockfileClosure(FIXTURE_LOCK.packages, ['a']);
+  assert.ok(keep.has('node_modules/a'));
+  assert.ok(keep.has('node_modules/b'));
+  assert.ok(keep.has('node_modules/a/node_modules/c')); // a's OWN c, not root's
+  assert.ok(!keep.has('node_modules/c'));                // root's c never pulled in by 'a' alone
+  assert.ok(!keep.has('node_modules/unrelated'));
+});
+
+t('lockfileClosure: throws on an unresolvable root dependency', () => {
+  assert.throws(() => lockfileClosure(FIXTURE_LOCK.packages, ['missing']), /no resolved entry for root dependency "missing"/);
+});
+
+t('lockfileClosure: throws on an unresolvable transitive dependency (a real lockfile inconsistency)', () => {
+  const broken = { packages: { '': { dependencies: { a: '^1.0.0' } }, 'node_modules/a': { dependencies: { ghost: '^1.0.0' } } } };
+  assert.throws(() => lockfileClosure(broken.packages, ['a']), /no resolved entry for "ghost"/);
+});
+
+t('lockfileClosure: matches the real repo lockfile — express+pg close over the game deps (no colyseus/phaser/sharp/discord.js)', () => {
+  const realLock = require('../package-lock.json');
+  const keep = lockfileClosure(realLock.packages, CORE_DEP_NAMES);
+  assert.ok(keep.has('node_modules/express'));
+  assert.ok(keep.has('node_modules/pg'));
+  for (const gameDep of ['node_modules/colyseus', 'node_modules/phaser', 'node_modules/sharp', 'node_modules/discord.js']) {
+    assert.ok(!keep.has(gameDep), `${gameDep} must not be in the express+pg closure`);
+  }
+});
+
+t('prunePackageLock: emits a self-consistent pruned lockfile (root ranges + only the kept packages)', () => {
+  const pruned = prunePackageLock(FIXTURE_LOCK, { name: '@cloudbongos/core', version: '1.14.0', rootRanges: { a: '^1.0.0' }, rootDepNames: ['a'] });
+  assert.equal(pruned.name, '@cloudbongos/core');
+  assert.equal(pruned.version, '1.14.0');
+  assert.equal(pruned.lockfileVersion, 3);
+  assert.equal(pruned.requires, true);
+  assert.deepEqual(pruned.packages[''].dependencies, { a: '^1.0.0' });
+  assert.ok(pruned.packages['node_modules/a']);
+  assert.ok(pruned.packages['node_modules/a/node_modules/c']);
+  assert.equal(pruned.packages['node_modules/c'], undefined);       // root's unrelated c dropped
+  assert.equal(pruned.packages['node_modules/unrelated'], undefined);
+});
+
+t('prunePackageLock: on the real repo lockfile, drops the vast majority of packages', () => {
+  const realLock = require('../package-lock.json');
+  const pruned = prunePackageLock(realLock, {
+    name: '@cloudbongos/core', version: '1.14.0', rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+  });
+  const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
+  const sourceCount = Object.keys(realLock.packages).length - 1;
+  assert.ok(keptCount < sourceCount / 2, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
+  assert.ok(keptCount > 0);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);