@openvcs/sdk 0.2.0 → 0.2.2

package/test/dist.test.js

@@ -0,0 +1,456 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const test = require("node:test");
+
+const { bundlePlugin, parseDistArgs, __private } = require("../lib/dist");
+const {
+  cleanupTempDir,
+  makeTempDir,
+  readBundleEntries,
+  writeJson,
+  writeText,
+} = require("./helpers");
+
+test("parseDistArgs uses defaults", () => {
+  const parsed = parseDistArgs([]);
+  assert.equal(parsed.pluginDir, process.cwd());
+  assert.equal(parsed.outDir, path.resolve("dist"));
+  assert.equal(parsed.verbose, false);
+  assert.equal(parsed.noNpmDeps, false);
+});
+
+test("parseDistArgs parses known flags", () => {
+  const parsed = parseDistArgs([
+    "--plugin-dir",
+    "some/plugin",
+    "--out",
+    "some/out",
+    "--no-npm-deps",
+    "--verbose",
+  ]);
+  assert.equal(parsed.pluginDir, path.resolve("some/plugin"));
+  assert.equal(parsed.outDir, path.resolve("some/out"));
+  assert.equal(parsed.noNpmDeps, true);
+  assert.equal(parsed.verbose, true);
+});
+
+test("parseDistArgs rejects unknown flag", () => {
+  assert.throws(() => parseDistArgs(["--nope"]), /unknown flag: --nope/);
+});
+
+test("parseDistArgs requires plugin-dir value", () => {
+  assert.throws(() => parseDistArgs(["--plugin-dir"]), /missing value for --plugin-dir/);
+});
+
+test("parseDistArgs requires out value", () => {
+  assert.throws(() => parseDistArgs(["--out"]), /missing value for --out/);
+});
+
+test("parseDistArgs help returns usage error", () => {
+  assert.throws(() => parseDistArgs(["--help"]), /openvcs dist \[args\]/);
+});
+
+test("readManifest parses and trims fields", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(
+    path.join(pluginDir, "openvcs.plugin.json"),
+    '{\n  "id": "  my.plugin  ",\n  "module": { "exec": "  module.mjs  " }\n}\n'
+  );
+
+  const parsed = __private.readManifest(pluginDir);
+  assert.equal(parsed.pluginId, "my.plugin");
+  assert.equal(parsed.moduleExec, "module.mjs");
+
+  cleanupTempDir(root);
+});
+
+test("readManifest errors for missing manifest", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  fs.mkdirSync(pluginDir, { recursive: true });
+  assert.throws(() => __private.readManifest(pluginDir), /missing openvcs\.plugin\.json/);
+  cleanupTempDir(root);
+});
+
+test("readManifest errors for malformed JSON with path", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "openvcs.plugin.json"), "{");
+
+  assert.throws(
+    () => __private.readManifest(pluginDir),
+    new RegExp(`parse ${pluginDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`)
+  );
+
+  cleanupTempDir(root);
+});
+
+test("readManifest errors for empty id", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), { id: "   " });
+  assert.throws(() => __private.readManifest(pluginDir), /missing a string 'id'/);
+  cleanupTempDir(root);
+});
+
+test("readManifest rejects id with path separators", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), { id: "bad/id" });
+  assert.throws(() => __private.readManifest(pluginDir), /must not contain path separators/);
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec accepts .js/.mjs/.cjs", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  writeText(path.join(pluginDir, "bin", "plugin.mjs"), "export {};\n");
+  writeText(path.join(pluginDir, "bin", "plugin.cjs"), "module.exports = {};\n");
+
+  assert.doesNotThrow(() => __private.validateDeclaredModuleExec(pluginDir, "plugin.js"));
+  assert.doesNotThrow(() => __private.validateDeclaredModuleExec(pluginDir, "plugin.mjs"));
+  assert.doesNotThrow(() => __private.validateDeclaredModuleExec(pluginDir, "plugin.cjs"));
+
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec rejects non-node extension", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "bin", "plugin.ts"), "export {};\n");
+  assert.throws(
+    () => __private.validateDeclaredModuleExec(pluginDir, "plugin.ts"),
+    /must end with .js\/.mjs\/.cjs/
+  );
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec rejects absolute path", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  assert.throws(
+    () => __private.validateDeclaredModuleExec(pluginDir, path.resolve(pluginDir, "bin", "plugin.js")),
+    /must be a relative path under bin/
+  );
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec rejects path traversal", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  writeText(path.join(pluginDir, "secret.js"), "export {};\n");
+  assert.throws(
+    () => __private.validateDeclaredModuleExec(pluginDir, "../secret.js"),
+    /must point to a file under bin/
+  );
+  cleanupTempDir(root);
+});
+
+test("validateDeclaredModuleExec errors when file missing", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  fs.mkdirSync(path.join(pluginDir, "bin"), { recursive: true });
+  assert.throws(
+    () => __private.validateDeclaredModuleExec(pluginDir, "missing.mjs"),
+    /module entrypoint not found/
+  );
+  cleanupTempDir(root);
+});
+
+test("copyIcon prefers png over jpg", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const bundleDir = path.join(root, "bundle");
+  fs.mkdirSync(bundleDir, { recursive: true });
+  writeText(path.join(pluginDir, "icon.jpg"), "jpg");
+  writeText(path.join(pluginDir, "icon.png"), "png");
+
+  __private.copyIcon(pluginDir, bundleDir);
+
+  assert.equal(fs.readFileSync(path.join(bundleDir, "icon.png"), "utf8"), "png");
+  assert.equal(fs.existsSync(path.join(bundleDir, "icon.jpg")), false);
+  cleanupTempDir(root);
+});
+
+test("copyIcon is no-op when icon is absent", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const bundleDir = path.join(root, "bundle");
+  fs.mkdirSync(pluginDir, { recursive: true });
+  fs.mkdirSync(bundleDir, { recursive: true });
+
+  __private.copyIcon(pluginDir, bundleDir);
+
+  for (const ext of __private.ICON_EXTENSIONS) {
+    assert.equal(fs.existsSync(path.join(bundleDir, `icon.${ext}`)), false);
+  }
+
+  cleanupTempDir(root);
+});
+
+test("uniqueStagingDir uses expected prefix", () => {
+  const staging = __private.uniqueStagingDir("/tmp/output");
+  assert.match(path.basename(staging), /^\.openvcs-plugin-staging-/);
+});
+
+test("writeTarGz creates a valid gzip tar", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const baseDir = path.join(root, "base");
+  const outPath = path.join(root, "bundle.ovcsp");
+  writeText(path.join(baseDir, "myplugin", "file.txt"), "content");
+  writeText(path.join(baseDir, "myplugin", "sub", "nested.txt"), "nested");
+
+  await __private.writeTarGz(outPath, baseDir, "myplugin");
+  const entries = await readBundleEntries(outPath);
+
+  assert.equal(entries.has("myplugin/file.txt"), true);
+  assert.equal(entries.has("myplugin/sub/nested.txt"), true);
+  cleanupTempDir(root);
+});
+
+test("rejectNativeAddonsRecursive rejects .node files", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const modulesDir = path.join(root, "node_modules");
+  writeText(path.join(modulesDir, "pkg", "addon.node"), "binary");
+  assert.throws(() => __private.rejectNativeAddonsRecursive(modulesDir), /native Node addon/);
+  cleanupTempDir(root);
+});
+
+test("rejectNativeAddonsRecursive allows normal files", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const modulesDir = path.join(root, "node_modules");
+  writeText(path.join(modulesDir, "pkg", "index.js"), "module.exports = {};\n");
+  assert.doesNotThrow(() => __private.rejectNativeAddonsRecursive(modulesDir));
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin writes a gzip .ovcsp for themes-only plugin", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), { id: "ui-only" });
+  writeText(path.join(pluginDir, "themes", "default", "theme.json"), '{"name":"test"}\n');
+  writeText(path.join(pluginDir, "icon.png"), "icon-bytes");
+
+  const outPath = await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true });
+  const entries = await readBundleEntries(outPath);
+
+  assert.equal(path.basename(outPath), "ui-only.ovcsp");
+  assert.equal(entries.has("ui-only/openvcs.plugin.json"), true);
+  assert.equal(entries.has("ui-only/themes/default/theme.json"), true);
+  assert.equal(entries.has("ui-only/icon.png"), true);
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin rejects manifest with no module and no themes", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), { id: "x" });
+
+  await assert.rejects(
+    () => bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true }),
+    /manifest has no module\.exec or themes\//
+  );
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin trims module.exec and includes extra bin files", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "x",
+    module: { exec: "  module.mjs  " },
+  });
+  writeText(path.join(pluginDir, "bin", "module.mjs"), "export {};\n");
+  writeText(path.join(pluginDir, "bin", "helpers", "util.mjs"), "export const x = 1;\n");
+
+  const outPath = await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true });
+  const entries = await readBundleEntries(outPath);
+
+  assert.equal(entries.has("x/bin/module.mjs"), true);
+  assert.equal(entries.has("x/bin/helpers/util.mjs"), true);
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin rejects module.exec path traversal", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "bad",
+    module: { exec: "../secret.js" },
+  });
+  writeText(path.join(pluginDir, "secret.js"), "console.log('secret')\n");
+
+  await assert.rejects(
+    () => bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true }),
+    /module\.exec/
+  );
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin rejects non-node module.exec extension", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "bad",
+    module: { exec: "plugin.ts" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.ts"), "export {};\n");
+
+  await assert.rejects(
+    () => bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true }),
+    /must end with .js\/.mjs\/.cjs/
+  );
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin rejects plugin id with path separators", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "bad/id",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+
+  await assert.rejects(
+    () => bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true }),
+    /must not contain path separators/
+  );
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin rejects symlink in bin", async () => {
+  if (process.platform === "win32") {
+    return;
+  }
+
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "x",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  writeText(path.join(pluginDir, "bin", "target.js"), "export {};\n");
+  fs.symlinkSync(path.join(pluginDir, "bin", "target.js"), path.join(pluginDir, "bin", "link.js"));
+
+  await assert.rejects(
+    () => bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true }),
+    /symlink/
+  );
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin output archive keeps plugin-id root directory", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "root-check",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+
+  const outPath = await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true });
+  const entries = await readBundleEntries(outPath);
+  for (const key of entries.keys()) {
+    assert.equal(key.startsWith("root-check/"), true);
+  }
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin overwrites existing bundle file", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+  fs.mkdirSync(outDir, { recursive: true });
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "replace",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+
+  const existingPath = path.join(outDir, "replace.ovcsp");
+  writeText(existingPath, "not-a-tar");
+
+  const outPath = await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true });
+  const entries = await readBundleEntries(outPath);
+  assert.equal(entries.has("replace/openvcs.plugin.json"), true);
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin generates package-lock when package.json exists", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "npm-plugin",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  writeJson(path.join(pluginDir, "package.json"), {
+    name: "npm-plugin",
+    version: "0.1.0",
+    private: true,
+  });
+
+  const outPath = await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: false });
+  const entries = await readBundleEntries(outPath);
+
+  assert.equal(fs.existsSync(path.join(pluginDir, "package-lock.json")), true);
+  assert.equal(entries.has("npm-plugin/package.json"), true);
+  assert.equal(entries.has("npm-plugin/package-lock.json"), true);
+
+  cleanupTempDir(root);
+});
+
+test("bundlePlugin with --no-npm-deps does not generate lockfile", async () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const pluginDir = path.join(root, "plugin");
+  const outDir = path.join(root, "out");
+
+  writeJson(path.join(pluginDir, "openvcs.plugin.json"), {
+    id: "no-npm",
+    module: { exec: "plugin.js" },
+  });
+  writeText(path.join(pluginDir, "bin", "plugin.js"), "export {};\n");
+  writeJson(path.join(pluginDir, "package.json"), {
+    name: "no-npm",
+    version: "0.1.0",
+    private: true,
+  });
+
+  await bundlePlugin({ pluginDir, outDir, verbose: false, noNpmDeps: true });
+
+  assert.equal(fs.existsSync(path.join(pluginDir, "package-lock.json")), false);
+
+  cleanupTempDir(root);
+});

package/test/fs-utils.test.js

@@ -0,0 +1,124 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const test = require("node:test");
+
+const {
+  copyDirectoryRecursiveStrict,
+  copyFileStrict,
+  ensureDirectory,
+  isPathInside,
+  rejectSymlinksRecursive,
+} = require("../lib/fs-utils");
+const { cleanupTempDir, makeTempDir, writeText } = require("./helpers");
+
+test("isPathInside returns true for descendants", () => {
+  const root = "/tmp/root";
+  assert.equal(isPathInside(root, "/tmp/root/a/b"), true);
+});
+
+test("isPathInside returns true for root itself", () => {
+  const root = "/tmp/root";
+  assert.equal(isPathInside(root, "/tmp/root"), true);
+});
+
+test("isPathInside returns false for parent escape", () => {
+  const root = "/tmp/root";
+  assert.equal(isPathInside(root, "/tmp/other/file"), false);
+});
+
+test("ensureDirectory creates nested directories", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const target = path.join(root, "a", "b", "c");
+  ensureDirectory(target);
+  assert.equal(fs.existsSync(target), true);
+  assert.equal(fs.lstatSync(target).isDirectory(), true);
+  cleanupTempDir(root);
+});
+
+test("copyFileStrict copies regular files", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const src = path.join(root, "src.txt");
+  const dst = path.join(root, "nested", "dst.txt");
+  writeText(src, "hello");
+  copyFileStrict(src, dst);
+  assert.equal(fs.readFileSync(dst, "utf8"), "hello");
+  cleanupTempDir(root);
+});
+
+test("copyFileStrict rejects non-files", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const src = path.join(root, "src-dir");
+  fs.mkdirSync(src, { recursive: true });
+  const dst = path.join(root, "dst.txt");
+  assert.throws(() => copyFileStrict(src, dst), /expected file/);
+  cleanupTempDir(root);
+});
+
+test("copyDirectoryRecursiveStrict copies nested trees", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const src = path.join(root, "src");
+  const dst = path.join(root, "dst");
+  writeText(path.join(src, "a.txt"), "a");
+  writeText(path.join(src, "nested", "b.txt"), "b");
+
+  copyDirectoryRecursiveStrict(src, dst);
+
+  assert.equal(fs.readFileSync(path.join(dst, "a.txt"), "utf8"), "a");
+  assert.equal(fs.readFileSync(path.join(dst, "nested", "b.txt"), "utf8"), "b");
+  cleanupTempDir(root);
+});
+
+test("copyDirectoryRecursiveStrict is no-op for missing source", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const src = path.join(root, "missing");
+  const dst = path.join(root, "dst");
+  copyDirectoryRecursiveStrict(src, dst);
+  assert.equal(fs.existsSync(dst), false);
+  cleanupTempDir(root);
+});
+
+test("copyDirectoryRecursiveStrict errors when source is file", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  const src = path.join(root, "file.txt");
+  writeText(src, "x");
+  const dst = path.join(root, "dst");
+  assert.throws(() => copyDirectoryRecursiveStrict(src, dst), /expected directory/);
+  cleanupTempDir(root);
+});
+
+test("rejectSymlinksRecursive allows regular trees", () => {
+  const root = makeTempDir("openvcs-sdk-test");
+  writeText(path.join(root, "a.txt"), "a");
+  writeText(path.join(root, "nested", "b.txt"), "b");
+  assert.doesNotThrow(() => rejectSymlinksRecursive(root));
+  cleanupTempDir(root);
+});
+
+test("rejectSymlinksRecursive rejects file symlink", () => {
+  if (process.platform === "win32") {
+    return;
+  }
+  const root = makeTempDir("openvcs-sdk-test");
+  const target = path.join(root, "target.txt");
+  const link = path.join(root, "link.txt");
+  writeText(target, "target");
+  fs.symlinkSync(target, link);
+
+  assert.throws(() => rejectSymlinksRecursive(root), /symlink/);
+  cleanupTempDir(root);
+});
+
+test("rejectSymlinksRecursive rejects directory symlink", () => {
+  if (process.platform === "win32") {
+    return;
+  }
+  const root = makeTempDir("openvcs-sdk-test");
+  const targetDir = path.join(root, "target-dir");
+  const link = path.join(root, "link-dir");
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.symlinkSync(targetDir, link);
+
+  assert.throws(() => rejectSymlinksRecursive(root), /symlink/);
+  cleanupTempDir(root);
+});

package/test/helpers.js

@@ -0,0 +1,49 @@
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const tar = require("tar");
+
+function makeTempDir(prefix = "openvcs-sdk-test") {
+  return fs.mkdtempSync(path.join(os.tmpdir(), `${prefix}-`));
+}
+
+function cleanupTempDir(rootDir) {
+  fs.rmSync(rootDir, { recursive: true, force: true });
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function writeText(filePath, text) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, text, "utf8");
+}
+
+async function readBundleEntries(bundlePath) {
+  const entries = new Map();
+  await tar.t({
+    file: bundlePath,
+    gzip: true,
+    onentry(entry) {
+      if (entry.type !== "File") {
+        return;
+      }
+      const chunks = [];
+      entry.on("data", (chunk) => chunks.push(chunk));
+      entry.on("end", () => {
+        entries.set(entry.path, Buffer.concat(chunks));
+      });
+    },
+  });
+  return entries;
+}
+
+module.exports = {
+  cleanupTempDir,
+  makeTempDir,
+  readBundleEntries,
+  writeJson,
+  writeText,
+};

package/test/init.test.js

@@ -0,0 +1,65 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const path = require("node:path");
+
+const { __private } = require("../lib/init");
+
+test("validatePluginId accepts regular ids", () => {
+  assert.equal(__private.validatePluginId("my.plugin"), undefined);
+  assert.equal(__private.validatePluginId("my-plugin_1"), undefined);
+});
+
+test("validatePluginId rejects empty id", () => {
+  assert.match(__private.validatePluginId(""), /required/);
+});
+
+test("validatePluginId rejects dot segments", () => {
+  assert.match(__private.validatePluginId("."), /must not be/);
+  assert.match(__private.validatePluginId(".."), /must not be/);
+});
+
+test("validatePluginId rejects path separators", () => {
+  assert.match(__private.validatePluginId("bad/id"), /path separators/);
+  assert.match(__private.validatePluginId("bad\\id"), /path separators/);
+});
+
+test("collectAnswers re-prompts invalid plugin id", async () => {
+  const prompts = [
+    "plugin-dir",
+    "module",
+    "bad/id",
+    "good-id",
+    "Good Plugin",
+    "0.2.0",
+  ];
+  const booleans = [true, false];
+  const messages = [];
+
+  const promptDriver = {
+    async promptText() {
+      return prompts.shift() || "";
+    },
+    async promptBoolean() {
+      return booleans.shift() || false;
+    },
+    close() {},
+  };
+
+  const output = {
+    write(message) {
+      messages.push(message);
+    },
+  };
+
+  const answers = await __private.collectAnswers(
+    { forceTheme: false, targetHint: "plugin-dir" },
+    promptDriver,
+    output
+  );
+
+  assert.equal(answers.pluginId, "good-id");
+  assert.equal(answers.targetDir, path.resolve("plugin-dir"));
+  assert.equal(answers.defaultEnabled, true);
+  assert.equal(answers.runNpmInstall, false);
+  assert.equal(messages.some((message) => message.includes("must not contain path separators")), true);
+});