@danypops/pi-packed 0.21.6 → 0.21.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.21.6",
+  "version": "0.21.8",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {

package/service/src/registry/registry.ts

@@ -15,6 +15,8 @@ import {
 import { createLogger } from "../shared/log.ts";
 
 const log = createLogger("registry");
+const README_MAX_CHARS = 50_000;
+const README_DOCUMENT_MAX_BYTES = 1024 * 1024;
 
 /** Upstream etiquette: honor Retry-After on 429, exponential backoff
  * otherwise, give up after RETRY_MAX_ATTEMPTS. */
@@ -128,6 +130,7 @@ export class HttpRegistry implements Registry {
 			dist?: { unpackedSize?: number; integrity?: string; attestations?: { url?: string; provenance?: unknown } };
 		};
 		const manifestFields = v.pi ? Object.keys(v.pi).filter((key) => ["extensions", "skills", "prompts", "themes"].includes(key)) : [];
+		const readme = await this.publishedReadme(encoded);
 		return {
 			name: boundedString(v.name, 214) ?? boundedString(name, 214)!,
 			version: boundedString(v.version, 128) ?? "",
@@ -144,7 +147,8 @@ export class HttpRegistry implements Registry {
 			pi: boundedPiManifest(v.pi),
 			peerDependencies: boundedDependencies(v.peerDependencies),
 			scripts: boundedDependencies(v.scripts),
-			readmeAvailable: false,
+			readme,
+			readmeAvailable: readme !== undefined && readme.trim().length > 0,
 			unpackedSize: v.dist?.unpackedSize,
 			packageEvidence:
 				manifestFields.length > 0
@@ -162,6 +166,22 @@ export class HttpRegistry implements Registry {
 		};
 	}
 
+	private async publishedReadme(encodedName: string): Promise<string | undefined> {
+		try {
+			const response = await fetchWithRetry(
+				`${this.base}/${encodedName}`,
+				{ headers: { accept: "application/json" } },
+				this.retryBaseDelayMs,
+			);
+			if (!response.ok) return undefined;
+			const document = (await boundedJson(response, README_DOCUMENT_MAX_BYTES)) as { readme?: unknown };
+			return boundedString(document.readme, README_MAX_CHARS);
+		} catch (error) {
+			log.debug("published README unavailable", { error: error instanceof Error ? error.message : String(error) });
+			return undefined;
+		}
+	}
+
 	/** Uses npm's abbreviated multi-version doc, not `/latest` (which carries
 	 * no `time`/`modified` field at all -- confirmed against the live
 	 * registry). Still bounded well under the full unabbreviated document's

package/service/test/core.test.ts

@@ -76,6 +76,7 @@ describe("HttpRegistry", () => {
 						},
 					});
 				}
+				if (url.pathname === "/pi-lsp") return Response.json({ readme: `# pi-lsp\n\n${"r".repeat(60_000)}` });
 				return new Response("nf", { status: 404 });
 			},
 		});
@@ -103,8 +104,10 @@ describe("HttpRegistry", () => {
 			repository: "git+https://github.com/x/pi-lsp.git",
 			license: "MIT",
 			unpackedSize: 12345,
-			readmeAvailable: false,
+			readmeAvailable: true,
 		});
+		expect(info.readme).toHaveLength(50_000);
+		expect(info.readme).toStartWith("# pi-lsp");
 		expect(info.pi?.extensions).toBeDefined();
 		expect(info.packageEvidence).toMatchObject({ shape: "manifest", verified: false });
 		expect(info.publication).toEqual({

package/service/test/npm-metadata-e2e.test.ts

@@ -0,0 +1,102 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Server } from "bun";
+import type { Installer, UpdateOutcome } from "../src/packages/package.ts";
+import { PackedClient } from "../src/public/client.ts";
+import { HttpRegistry } from "../src/registry/registry.ts";
+import { createApp } from "../src/daemon/service.ts";
+
+const TOKEN = "e".repeat(64);
+const PUBLISHED_README = `# @danypops/enigma
+
+Encrypted credential vault and supervisor daemon. Holds delegated OAuth/API
+credentials for other daemons and injects them as environment variables into
+spawned child processes.
+
+## Why this exists
+
+Consumers receive only their scoped credentials.`;
+
+class NoopInstaller implements Installer {
+	async install(): Promise<string> {
+		throw new Error("not exercised");
+	}
+	async remove(): Promise<string> {
+		throw new Error("not exercised");
+	}
+	async update(): Promise<UpdateOutcome> {
+		throw new Error("not exercised");
+	}
+}
+
+describe("published npm metadata E2E", () => {
+	let npmServer: Server<undefined>;
+	let daemonServer: Server<undefined>;
+	let stateDir: string;
+	const npmRequests: Array<{ path: string; accept: string | null }> = [];
+
+	beforeAll(() => {
+		stateDir = mkdtempSync(join(tmpdir(), "packed-npm-metadata-"));
+		npmServer = Bun.serve({
+			hostname: "127.0.0.1",
+			port: 0,
+			fetch(request) {
+				const url = new URL(request.url);
+				npmRequests.push({ path: url.pathname, accept: request.headers.get("accept") });
+				if (url.pathname.endsWith("/latest")) {
+					return Response.json({
+						name: "@danypops/enigma",
+						version: "0.22.1",
+						description: "Encrypted credential vault daemon",
+						license: "MIT",
+						repository: { type: "git", url: "git+https://github.com/DanyPops/enigma.git" },
+						dist: { integrity: "sha512-published-fixture" },
+					});
+				}
+				if (url.pathname === "/%40danypops/enigma") {
+					return Response.json({
+						name: "@danypops/enigma",
+						"dist-tags": { latest: "0.22.1" },
+						readme: PUBLISHED_README,
+					});
+				}
+				return new Response("not found", { status: 404 });
+			},
+		});
+		const app = createApp({
+			reg: new HttpRegistry(`http://127.0.0.1:${npmServer.port}`, 20, 0, 1),
+			inst: new NoopInstaller(),
+			token: TOKEN,
+			stateDir,
+		});
+		daemonServer = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: app.fetch });
+	});
+
+	afterAll(() => {
+		daemonServer.stop(true);
+		npmServer.stop(true);
+		rmSync(stateDir, { recursive: true, force: true });
+	});
+
+	it("preserves an npm-published README through HttpRegistry, daemon RPC, and PackedClient", async () => {
+		const client = new PackedClient(`http://127.0.0.1:${daemonServer.port}`, TOKEN);
+		const info = await client.info("@danypops/enigma");
+
+		expect(npmRequests).toHaveLength(2);
+		expect(npmRequests).toEqual(
+			expect.arrayContaining([
+				{ path: "/%40danypops/enigma/latest", accept: "application/json" },
+				{ path: "/%40danypops/enigma", accept: "application/json" },
+			]),
+		);
+		expect(info).toMatchObject({
+			name: "@danypops/enigma",
+			version: "0.22.1",
+			license: "MIT",
+			readmeAvailable: true,
+			readme: PUBLISHED_README,
+		});
+	});
+});