@danypops/pi-packed 0.21.6 → 0.21.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/registry/registry.ts

@@ -15,6 +15,7 @@ import {
 import { createLogger } from "../shared/log.ts";
 
 const log = createLogger("registry");
+const README_MAX_CHARS = 50_000;
 
 /** Upstream etiquette: honor Retry-After on 429, exponential backoff
  * otherwise, give up after RETRY_MAX_ATTEMPTS. */
@@ -125,9 +126,11 @@ export class HttpRegistry implements Registry {
 			pi?: Record<string, unknown>;
 			peerDependencies?: Record<string, string>;
 			scripts?: Record<string, string>;
+			readme?: unknown;
 			dist?: { unpackedSize?: number; integrity?: string; attestations?: { url?: string; provenance?: unknown } };
 		};
 		const manifestFields = v.pi ? Object.keys(v.pi).filter((key) => ["extensions", "skills", "prompts", "themes"].includes(key)) : [];
+		const readme = boundedString(v.readme, README_MAX_CHARS);
 		return {
 			name: boundedString(v.name, 214) ?? boundedString(name, 214)!,
 			version: boundedString(v.version, 128) ?? "",
@@ -144,7 +147,8 @@ export class HttpRegistry implements Registry {
 			pi: boundedPiManifest(v.pi),
 			peerDependencies: boundedDependencies(v.peerDependencies),
 			scripts: boundedDependencies(v.scripts),
-			readmeAvailable: false,
+			readme,
+			readmeAvailable: readme !== undefined && readme.trim().length > 0,
 			unpackedSize: v.dist?.unpackedSize,
 			packageEvidence:
 				manifestFields.length > 0

package/service/test/core.test.ts

@@ -69,6 +69,7 @@ describe("HttpRegistry", () => {
 						license: "MIT",
 						keywords: ["pi-package", "lsp"],
 						pi: { extensions: ["./src/index.ts"] },
+						readme: `# pi-lsp\n\n${"r".repeat(60_000)}`,
 						dist: {
 							unpackedSize: 12345,
 							integrity: "sha512-test",
@@ -103,8 +104,10 @@ describe("HttpRegistry", () => {
 			repository: "git+https://github.com/x/pi-lsp.git",
 			license: "MIT",
 			unpackedSize: 12345,
-			readmeAvailable: false,
+			readmeAvailable: true,
 		});
+		expect(info.readme).toHaveLength(50_000);
+		expect(info.readme).toStartWith("# pi-lsp");
 		expect(info.pi?.extensions).toBeDefined();
 		expect(info.packageEvidence).toMatchObject({ shape: "manifest", verified: false });
 		expect(info.publication).toEqual({

package/service/test/npm-metadata-e2e.test.ts

@@ -0,0 +1,90 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Server } from "bun";
+import type { Installer, UpdateOutcome } from "../src/packages/package.ts";
+import { PackedClient } from "../src/public/client.ts";
+import { HttpRegistry } from "../src/registry/registry.ts";
+import { createApp } from "../src/daemon/service.ts";
+
+const TOKEN = "e".repeat(64);
+const PUBLISHED_README = `# @danypops/enigma
+
+Encrypted credential vault and supervisor daemon. Holds delegated OAuth/API
+credentials for other daemons and injects them as environment variables into
+spawned child processes.
+
+## Why this exists
+
+Consumers receive only their scoped credentials.`;
+
+class NoopInstaller implements Installer {
+	async install(): Promise<string> {
+		throw new Error("not exercised");
+	}
+	async remove(): Promise<string> {
+		throw new Error("not exercised");
+	}
+	async update(): Promise<UpdateOutcome> {
+		throw new Error("not exercised");
+	}
+}
+
+describe("published npm metadata E2E", () => {
+	let npmServer: Server<undefined>;
+	let daemonServer: Server<undefined>;
+	let stateDir: string;
+	const npmRequests: Array<{ path: string; accept: string | null }> = [];
+
+	beforeAll(() => {
+		stateDir = mkdtempSync(join(tmpdir(), "packed-npm-metadata-"));
+		npmServer = Bun.serve({
+			hostname: "127.0.0.1",
+			port: 0,
+			fetch(request) {
+				const url = new URL(request.url);
+				npmRequests.push({ path: url.pathname, accept: request.headers.get("accept") });
+				if (url.pathname.endsWith("/latest")) {
+					return Response.json({
+						name: "@danypops/enigma",
+						version: "0.22.1",
+						description: "Encrypted credential vault daemon",
+						license: "MIT",
+						repository: { type: "git", url: "git+https://github.com/DanyPops/enigma.git" },
+						readme: PUBLISHED_README,
+						dist: { integrity: "sha512-published-fixture" },
+					});
+				}
+				return new Response("not found", { status: 404 });
+			},
+		});
+		const app = createApp({
+			reg: new HttpRegistry(`http://127.0.0.1:${npmServer.port}`, 20, 0, 1),
+			inst: new NoopInstaller(),
+			token: TOKEN,
+			stateDir,
+		});
+		daemonServer = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: app.fetch });
+	});
+
+	afterAll(() => {
+		daemonServer.stop(true);
+		npmServer.stop(true);
+		rmSync(stateDir, { recursive: true, force: true });
+	});
+
+	it("preserves an npm-published README through HttpRegistry, daemon RPC, and PackedClient", async () => {
+		const client = new PackedClient(`http://127.0.0.1:${daemonServer.port}`, TOKEN);
+		const info = await client.info("@danypops/enigma");
+
+		expect(npmRequests).toEqual([{ path: "/%40danypops/enigma/latest", accept: "application/json" }]);
+		expect(info).toMatchObject({
+			name: "@danypops/enigma",
+			version: "0.22.1",
+			license: "MIT",
+			readmeAvailable: true,
+			readme: PUBLISHED_README,
+		});
+	});
+});