@decohere/ci-tools 0.0.1-dev.20 → 0.0.1-dev.20261105.54

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -0,0 +1,89 @@
+import { describe, expect, it } from "vitest";
+import {
+	buildDescription,
+	extractGitHubReviewerLogins,
+	firstPublishCommands,
+	issueTitle,
+	needsPrereleaseTag,
+	parseUnpublished,
+	runNudge,
+} from "../../src/github/oidc-bootstrap-nudge.mjs";
+
+describe("oidc-bootstrap-nudge", () => {
+	it("parses unpublished names", () => {
+		expect(parseUnpublished(" @decohere/scaffold  @decohere/cli ")).toEqual([
+			"@decohere/scaffold",
+			"@decohere/cli",
+		]);
+		expect(issueTitle()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
+	});
+
+	it("extracts GitHub user reviewers and skips teams", () => {
+		expect(
+			extractGitHubReviewerLogins({
+				protection_rules: [
+					{ type: "branch_policy", reviewers: [] },
+					{
+						type: "required_reviewers",
+						reviewers: [
+							{ type: "User", reviewer: { login: "das974" } },
+							{ type: "Team", reviewer: { slug: "publishers", login: "should-skip" } },
+						],
+					},
+				],
+			}),
+		).toEqual(["das974"]);
+	});
+
+	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
+		const pkg = { name: "@decohere/scaffold", dir: "scaffold", version: "0.0.1-dev.18" };
+		const body = buildDescription({
+			unpublished: ["@decohere/scaffold"],
+			packages: [pkg],
+			repo: "typesmiths/decohere",
+			runUrl: "https://github.com/typesmiths/decohere/actions/runs/9",
+			channel: "dev",
+		});
+		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
+		expect(needsPrereleaseTag("1.2.3")).toBe(false);
+		expect(firstPublishCommands([pkg], "dev")).toEqual([
+			"npm publish ./projects/scaffold --access public --tag dev",
+		]);
+		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
+			"npm publish ./projects/scaffold --access public",
+		]);
+		expect(body).toContain("npm publish ./projects/scaffold --access public --tag dev");
+		expect(body).toContain("pnpm npm:bootstrap --otp <code> @decohere/scaffold");
+		expect(body).not.toMatch(/# @decohere\/scaffold/);
+		expect(body).toContain("First-publish each name **public**");
+		expect(body).toContain("Workflow filename: `publish.yml`");
+		expect(body).toContain("Environment: `npm-publish`");
+		expect(body).toContain("gh run rerun --failed");
+		expect(body).toContain("https://github.com/typesmiths/decohere/actions/runs/9");
+	});
+
+	it("assigns the bootstrap environment's reviewers to the issue", async () => {
+		/** @type {object[]} */
+		const upserts = [];
+		const code = await runNudge(
+			{ UNPUBLISHED: "@decohere/scaffold", GITHUB_REPOSITORY: "typesmiths/decohere" },
+			{
+				listPackages: () => [{ name: "@decohere/scaffold", dir: "scaffold" }],
+				githubReviewers: async () => ["das974"],
+				upsert: (options) => {
+					upserts.push(options);
+					return {
+						number: 5,
+						url: "https://github.com/typesmiths/decohere/issues/5",
+						created: true,
+					};
+				},
+				runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+			},
+		);
+		expect(code).toBe(0);
+		expect(upserts[0].title).toBe(issueTitle());
+		expect(upserts[0].assignees).toEqual(["das974"]);
+		expect(upserts[0].body).toContain("`@decohere/scaffold`");
+	});
+});

package/tests/github/package-metadata.test.mjs

@@ -0,0 +1,69 @@
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { vol } from "memfs";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { listPublishablePackages } from "../../src/github/publish-verify.mjs";
+
+const fs = await vi.importActual("node:fs");
+const REPO_ROOT = fileURLToPath(new URL("../../../../", import.meta.url));
+const REPO = "https://github.com/typesmiths/decohere";
+
+/** The repo's real package.json files, loaded into the in-memory fs the tests run on. */
+function loadRealManifests() {
+	/** @type {Record<string, string>} */
+	const files = {};
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const path = join(dir, entry.name);
+			if (entry.isDirectory() && !["node_modules", "dist"].includes(entry.name)) {
+				walk(path);
+			} else if (entry.name === "package.json") {
+				files[join("/repo", relative(REPO_ROOT, path))] = fs.readFileSync(path, "utf8");
+			}
+		}
+	};
+	walk(join(REPO_ROOT, "projects"));
+	return files;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+// npm shows these on each package's page, and Trusted Publishing's provenance is
+// checked against `repository.url`, so a package without it fails to publish.
+describe("published package metadata", () => {
+	vol.fromJSON(loadRealManifests());
+	const packages = listPublishablePackages("/repo").map((pkg) => ({
+		...pkg,
+		json: JSON.parse(String(vol.readFileSync(`/repo/projects/${pkg.dir}/package.json`))),
+	}));
+	vol.reset();
+
+	it("finds the publishable packages", () => {
+		expect(packages.length).toBeGreaterThan(0);
+	});
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s links back to the repo",
+		(_name, pkg) => {
+			expect(pkg.json.repository).toEqual({
+				type: "git",
+				url: `git+${REPO}.git`,
+				directory: `projects/${pkg.dir}`,
+			});
+			expect(pkg.json.homepage).toBe(`${REPO}/tree/main/projects/${pkg.dir}#readme`);
+			expect(pkg.json.bugs).toEqual({ url: `${REPO}/issues` });
+		},
+	);
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s has a description, keywords, license and author",
+		(_name, pkg) => {
+			expect(pkg.json.description).toBeTruthy();
+			expect(pkg.json.keywords?.length).toBeGreaterThan(0);
+			expect(pkg.json.license).toBe("ISC");
+			expect(pkg.json.author).toBeTruthy();
+		},
+	);
+});

package/tests/github/publish-verify.test.mjs

@@ -0,0 +1,115 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	collectPublishVerify,
+	formatGithubOutput,
+	listPublishablePackages,
+	parseGhcrRepository,
+} from "../../src/github/publish-verify.mjs";
+
+function seedWorkspace() {
+	const root = "/workspace";
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.79" }),
+		[`${root}/projects/cli/package.json`]: JSON.stringify({
+			name: "@decohere/cli",
+			version: "0.0.1-dev.79",
+		}),
+		[`${root}/projects/scaffold/package.json`]: JSON.stringify({
+			name: "@decohere/scaffold",
+			version: "0.0.1-dev.79",
+			private: true,
+		}),
+		[`${root}/projects/create/package.json`]: JSON.stringify({
+			name: "@decohere/create",
+			version: "0.0.1-dev.79",
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/create" },
+		}),
+		[`${root}/projects/devcontainer/package.json`]: JSON.stringify({
+			name: "@decohere/devcontainer",
+			private: true,
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/devcontainer" },
+		}),
+	});
+	return root;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("publish-verify", () => {
+	it("lists non-private workspace packages", () => {
+		const root = seedWorkspace();
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+		]);
+	});
+
+	it("lists grouped packages (projects/<group>/<name>) and skips nested and build folders", () => {
+		const root = seedWorkspace();
+		vol.fromJSON({
+			[`${root}/projects/data/data/package.json`]: JSON.stringify({ name: "@decohere/data" }),
+			[`${root}/projects/data/data-typeorm/package.json`]: JSON.stringify({
+				name: "@decohere/data-typeorm",
+			}),
+			[`${root}/projects/cli/examples/demo/package.json`]: JSON.stringify({ name: "nested" }),
+			[`${root}/projects/__fixtures__/app/package.json`]: JSON.stringify({ name: "fixture" }),
+			[`${root}/projects/node_modules/dep/package.json`]: JSON.stringify({ name: "dep" }),
+			[`${root}/projects/dist/out/package.json`]: JSON.stringify({ name: "built" }),
+		});
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+			"@decohere/data",
+			"@decohere/data-typeorm",
+		]);
+	});
+
+	it("parses GHCR repository coordinates", () => {
+		expect(parseGhcrRepository("ghcr.io/typesmiths/decohere/create")).toEqual({
+			org: "typesmiths",
+			packageName: "decohere/create",
+		});
+	});
+
+	it("marks names missing from npm as unpublished and skip_npm when every version exists", async () => {
+		const root = seedWorkspace();
+		const views = [];
+		const spawnSync = (_cmd, args) => {
+			views.push(args[1]);
+			if (args[1] === "@decohere/cli") {
+				return { status: 1 };
+			}
+			return { status: 0 };
+		};
+		const result = await collectPublishVerify({
+			root,
+			spawnSync,
+			githubToken: "",
+		});
+		expect(result.unpublished).toEqual(["@decohere/cli"]);
+		expect(result.skipNpm).toBe(false);
+		expect(views).toContain("@decohere/cli");
+		expect(views).toContain("@decohere/create");
+		expect(views).toContain("@decohere/create@0.0.1-dev.79");
+	});
+
+	it("sets skip_docker when both GHCR tags exist", async () => {
+		const root = seedWorkspace();
+		const fetch = async () => ({
+			ok: true,
+			status: 200,
+			json: async () => [{ metadata: { container: { tags: ["0.0.1-dev.79"] } } }],
+		});
+		const result = await collectPublishVerify({
+			root,
+			spawnSync: () => ({ status: 0 }),
+			githubToken: "ghs_test",
+			fetch,
+		});
+		expect(result.skipDocker).toBe(true);
+		expect(formatGithubOutput(result)).toContain("skip_docker=true");
+	});
+});

package/tests/github/smoke-create-launcher.test.mjs

@@ -0,0 +1,132 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
+
+const fs = await vi.importActual("node:fs");
+const PUBLISH_YML = fileURLToPath(
+	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
+);
+
+describe("runCreateLauncherSmoke", () => {
+	it("execs npx from a temp directory, not the repo root", () => {
+		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
+		const calls = [];
+		const written = [];
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.80",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: (path, body) => {
+				written.push({ path, body });
+			},
+			spawnSync: (cmd, args, opts) => {
+				calls.push({ cmd, args, opts });
+				return { status: 0 };
+			},
+			stdio: "pipe",
+		});
+
+		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
+		expect(result.workDir).not.toBe(process.cwd());
+		const npx = calls.at(-1);
+		expect(npx.cmd).toBe("npx");
+		expect(npx.args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
+		expect(npx.opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
+		expect(npx.opts.cwd).not.toBe(process.cwd());
+		expect(written).toEqual([
+			{
+				path: "/tmp/decohere-create-smoke-abc/.npmrc",
+				body: "@decohere:registry=https://registry.npmjs.org/\n",
+			},
+		]);
+		// The packages are public: the smoke installs them the way a user does, with no token.
+		expect(npx.opts.env.NODE_AUTH_TOKEN).toBeUndefined();
+	});
+
+	// npm's public cache can lag minutes behind a publish: the first token-free Publish ran npx
+	// 90 seconds after publishing and got ETARGET for a version the registry already had.
+	it("waits until npm serves the new version before running npx", () => {
+		/** @type {{ cmd: string, args: string[] }[]} */
+		const calls = [];
+		const sleeps = [];
+		let views = 0;
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.127",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: () => {},
+			spawnSync: (cmd, args) => {
+				calls.push({ cmd, args });
+				if (cmd === "npm") return { status: ++views < 3 ? 1 : 0 };
+				return { status: 0 };
+			},
+			sleep: (ms) => sleeps.push(ms),
+			stdio: "pipe",
+		});
+
+		expect(result.status).toBe(0);
+		expect(calls.map((call) => call.cmd)).toEqual(["npm", "npm", "npm", "npx"]);
+		expect(calls[0].args).toEqual(["view", "@decohere/create@0.0.1-dev.127", "version"]);
+		expect(sleeps).toHaveLength(2);
+	});
+
+	it("fails without running npx when npm never serves the version", () => {
+		/** @type {string[]} */
+		const commands = [];
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.127",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: () => {},
+			spawnSync: (cmd) => {
+				commands.push(cmd);
+				return { status: 1 };
+			},
+			sleep: () => {},
+			attempts: 3,
+			stdio: "pipe",
+		});
+
+		expect(result.status).toBe(1);
+		expect(commands).toEqual(["npm", "npm", "npm"]);
+	});
+
+	it("fails closed without a version", () => {
+		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
+			"CREATE_VERSION is required",
+		);
+	});
+});
+
+describe("publish.yml create smoke + tag", () => {
+	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
+
+	it("wires create smoke through the isolated launcher", () => {
+		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
+		expect(yml).toContain("CREATE_VERSION:");
+		expect(yml).not.toContain("npx --yes");
+	});
+
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
+	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
+		expect(perms).toMatch(/contents:\s*write/);
+		expect(perms).toMatch(/actions:\s*read/);
+	});
+});

package/tests/lib/github-issue.test.mjs

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { pickIssue, upsertIssue } from "../../src/lib/github-issue.mjs";
+
+const TITLE = "security(ci): high or critical npm audit findings";
+
+/** A fake `gh` that answers `issue list` with `issues` and records every call. */
+function fakeGh(issues) {
+	/** @type {{ args: string[], input?: string }[]} */
+	const calls = [];
+	const run = (args, input) => {
+		calls.push({ args, input });
+		if (args[1] === "list") return JSON.stringify(issues);
+		if (args[1] === "create") return "https://github.com/typesmiths/decohere/issues/42\n";
+		return "";
+	};
+	return { run, calls };
+}
+
+describe("github-issue", () => {
+	it("matches the exact title only and prefers an open issue", () => {
+		const issues = [
+			{ number: 1, title: TITLE, state: "CLOSED", url: "u1" },
+			{ number: 2, title: `${TITLE} (old)`, state: "OPEN", url: "u2" },
+			{ number: 3, title: TITLE, state: "OPEN", url: "u3" },
+		];
+		expect(pickIssue(issues, TITLE)?.number).toBe(3);
+		expect(pickIssue(issues.slice(0, 2), TITLE)?.number).toBe(1);
+		expect(pickIssue([], TITLE)).toBeNull();
+	});
+
+	// GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
+	// and a new issue was opened on every run.
+	it("searches for the title as a quoted phrase", () => {
+		const { run, calls } = fakeGh([]);
+		upsertIssue({ title: "security(ci): npm audit vulnerabilities detected", body: "b" }, run);
+		const args = calls[0].args;
+		expect(args[args.indexOf("--search") + 1]).toBe(
+			'"security(ci): npm audit vulnerabilities detected" in:title',
+		);
+	});
+
+	it("opens an issue with assignees when none has the title", () => {
+		const { run, calls } = fakeGh([]);
+		const result = upsertIssue({ title: TITLE, body: "body", assignees: ["das974"] }, run);
+		expect(result).toEqual({
+			number: 42,
+			url: "https://github.com/typesmiths/decohere/issues/42",
+			created: true,
+		});
+		expect(calls[1]).toEqual({
+			args: [
+				"issue",
+				"create",
+				"--title",
+				TITLE,
+				"--body-file",
+				"-",
+				"--add-assignee",
+				"das974",
+			],
+			input: "body",
+		});
+	});
+
+	it("updates an open issue's body in place", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "OPEN", url: "u7" }]);
+		const result = upsertIssue({ title: TITLE, body: "new body" }, run);
+		expect(result).toEqual({ number: 7, url: "u7", created: false });
+		expect(calls.map((call) => call.args[1])).toEqual(["list", "edit"]);
+		expect(calls[1]).toEqual({
+			args: ["issue", "edit", "7", "--body-file", "-"],
+			input: "new body",
+		});
+	});
+
+	it("reopens a closed issue before updating it", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "CLOSED", url: "u7" }]);
+		upsertIssue({ title: TITLE, body: "b", repo: "typesmiths/decohere" }, run);
+		expect(calls.map((call) => call.args.slice(0, 3))).toEqual([
+			["issue", "list", "--repo"],
+			["issue", "reopen", "7"],
+			["issue", "edit", "7"],
+		]);
+	});
+});

package/tests/lib/lcov.test.mjs

@@ -13,13 +13,13 @@ SF:projects/forge/src/build/index.ts
 LF:20
 LH:15
 end_of_record
-SF:projects/nexus/src/index.ts
+SF:projects/core/src/index.ts
 LF:5
 LH:5
 end_of_record
 `;
 
-const sampleLcovWithLines = `SF:projects/anvil/src/index.ts
+const sampleLcovWithLines = `SF:projects/http/src/index.ts
 DA:1,1
 DA:2,1
 DA:3,0
@@ -46,9 +46,9 @@ describe("parseLcovByProject", () => {
 		expect(result.get("forge")).toBeDefined();
 		expect(result.get("forge").totalLines).toBe(30);
 		expect(result.get("forge").coveredLines).toBe(24);
-		expect(result.get("nexus")).toBeDefined();
-		expect(result.get("nexus").totalLines).toBe(5);
-		expect(result.get("nexus").coveredLines).toBe(5);
+		expect(result.get("core")).toBeDefined();
+		expect(result.get("core").totalLines).toBe(5);
+		expect(result.get("core").coveredLines).toBe(5);
 	});
 
 	it("ignores records with LF:0", () => {
@@ -61,7 +61,7 @@ describe("parseLcovByProject", () => {
 describe("parseLcovFiles", () => {
 	it("returns per-file coverage with uncovered line numbers", () => {
 		const result = parseLcovFiles(sampleLcovWithLines);
-		const file = result.find((f) => f.sourcePath === "projects/anvil/src/index.ts");
+		const file = result.find((f) => f.sourcePath === "projects/http/src/index.ts");
 		expect(file).toBeDefined();
 		expect(file.totalLines).toBe(5);
 		expect(file.coveredLines).toBe(3);
@@ -70,14 +70,14 @@ describe("parseLcovFiles", () => {
 	});
 
 	it("includes files with 100% coverage", () => {
-		const lcov = `SF:projects/anvil/src/full.ts\nDA:1,1\nDA:2,1\nLF:2\nLH:2\nend_of_record\n`;
+		const lcov = `SF:projects/http/src/full.ts\nDA:1,1\nDA:2,1\nLF:2\nLH:2\nend_of_record\n`;
 		const result = parseLcovFiles(lcov);
 		expect(result).toHaveLength(1);
 		expect(result[0].uncoveredLineNumbers).toEqual([]);
 	});
 
 	it("excludes files with LF:0", () => {
-		const lcov = `SF:projects/anvil/src/empty.ts\nLF:0\nLH:0\nend_of_record\n`;
+		const lcov = `SF:projects/http/src/empty.ts\nLF:0\nLH:0\nend_of_record\n`;
 		const result = parseLcovFiles(lcov);
 		expect(result).toHaveLength(0);
 	});

package/tests/pages/bench-page.test.mjs

@@ -0,0 +1,123 @@
+import { describe, expect, it } from "vitest";
+import { buildBenchmarkHtml, trendSvg } from "../../src/pages/bench-page.mjs";
+
+const context = (benchEnv, cores) => ({
+	benchEnv,
+	os: { platform: "linux", arch: "x64" },
+	cpu: { model: "Test CPU", count: cores },
+	memoryGb: 16,
+	node: "v24.1.0",
+});
+
+const run = (date, sha, results) => ({ date, sha, results });
+const result = (id, median, label = id) => ({
+	id,
+	label,
+	unit: "ms",
+	median,
+	p90: median * 1.2,
+	min: median,
+	max: median,
+	samples: 5,
+});
+
+const history = {
+	version: 2,
+	contexts: {
+		ci: {
+			context: context("gh-actions-node24", 4),
+			runs: [
+				run("2026-10-20T03:17:00Z", "bbbbbbbbbbbb", [
+					result("flux.serve.start", 90, "spawn <to> ready"),
+					result("forge.build.debug", 9),
+				]),
+				run("2026-10-19T03:17:00Z", "aaaaaaaaaaaa", [
+					result("flux.serve.start", 100, "spawn <to> ready"),
+				]),
+			],
+		},
+		laptop: {
+			context: context("(local)", 24),
+			runs: [run("2026-10-01T10:00:00Z", "cccccccccccc", [result("flux.serve.start", 40)])],
+		},
+	},
+};
+
+describe("buildBenchmarkHtml", () => {
+	it("explains an empty history instead of rendering empty charts", () => {
+		const html = buildBenchmarkHtml({ version: 2, contexts: {} });
+		expect(html).toContain("No benchmark history yet");
+		expect(html).not.toContain("<svg");
+	});
+
+	it("draws one card per benchmark, grouped, with a line per machine that ran it", () => {
+		const html = buildBenchmarkHtml(history, { branch: "main", sha: "0123456789abcdef" });
+
+		expect(html.match(/<article class="card">/g)).toHaveLength(2);
+		expect(html.indexOf("flux serve (real process)")).toBeLessThan(
+			html.indexOf("<h2>forge build</h2>"),
+		);
+		const serveCard = html.slice(
+			html.indexOf("<code>flux.serve.start</code>"),
+			html.indexOf("<code>forge.build.debug</code>"),
+		);
+		expect(serveCard.match(/<polyline/g)).toHaveLength(2);
+		expect(html).toContain("built from main @ <code>0123456789ab</code>");
+	});
+
+	it("shows the latest median and the change from the previous run on the newest machine", () => {
+		const html = buildBenchmarkHtml(history);
+		expect(html).toContain("<strong>90.0 ms</strong> median · p90 108 ms");
+		expect(html).toContain('<span class="change better">10.0% faster</span>');
+	});
+
+	it("dates each result and links its commit, in the latest table and on each card", () => {
+		const html = buildBenchmarkHtml(history);
+		expect(html).toContain("<th>Run</th><th>Commit</th>");
+		expect(html).toContain("<td>2026-10-20 03:17 UTC</td>");
+		expect(html).toContain(
+			'<a href="https://github.com/typesmiths/decohere/commit/bbbbbbbbbbbb"><code>bbbbbbb</code></a>',
+		);
+		expect(html).toContain('<p class="when">Last run 2026-10-20 03:17 UTC</p>');
+	});
+
+	it("leaves out machine types with no run in the 30 days before the newest run", () => {
+		const html = buildBenchmarkHtml({
+			version: 2,
+			contexts: {
+				...history.contexts,
+				gone: {
+					context: context("gh-actions-node24-retired", 2),
+					runs: [
+						run("2026-08-01T03:17:00Z", "dddddddddddd", [result("flux.serve.start", 70)]),
+					],
+				},
+			},
+		});
+		expect(html).not.toContain("gh-actions-node24-retired");
+		expect(html).toContain("(local)");
+	});
+
+	it("escapes labels from the history", () => {
+		const html = buildBenchmarkHtml(history);
+		expect(html).toContain("spawn &lt;to&gt; ready");
+		expect(html).not.toContain("spawn <to> ready");
+	});
+});
+
+describe("trendSvg", () => {
+	it("places a single point without dividing by a zero time range", () => {
+		const svg = trendSvg([
+			{
+				color: "red",
+				points: [{ time: 1, date: "2026-10-20", sha: "abc", median: 5, p90: 6 }],
+			},
+		]);
+		expect(svg).toContain("<circle");
+		expect(svg).not.toContain("NaN");
+	});
+
+	it("draws nothing when no machine has a point", () => {
+		expect(trendSvg([])).toBe("");
+	});
+});