@peers-app/peers-sdk 0.27.3 → 0.27.4

package/dist/package-build/freeze-contracts.test.js

@@ -1,355 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const promises_1 = require("node:fs/promises");
-const node_os_1 = require("node:os");
-const path = require("node:path");
-const peer_id_1 = require("../peer-id");
-const build_package_1 = require("./build-package");
-const cli_1 = require("./cli");
-const freeze_contracts_1 = require("./freeze-contracts");
-const sdkRoot = path.resolve(__dirname, "../..");
-const packageId = (0, peer_id_1.newid)();
-const contractId = (0, peer_id_1.newid)();
-let root;
-/** A `/define` package providing Probe v1 (and v2 when asked), its tool shaped by `input`. */
-function declaration(version, input, description = "Probe.", withV2 = false) {
-    const contract = (contractVersion) => `defineContract({
-    contractId: ${JSON.stringify(contractId)}, version: ${contractVersion}, name: "Probe",
-    tools: [defineTool({
-      name: "probe", usageDescription: ${JSON.stringify(description)}, accessLevel: 0,
-      inputSchema: z.object(${input}), outputSchema: z.object({}),
-      handler: () => ({}),
-    })],
-  })`;
-    return `
-    import { defineContract, definePackage, defineTool, z } from "@peers-app/peers-sdk/define";
-    export default definePackage((pkg) => {
-      pkg.packageId = ${JSON.stringify(packageId)};
-      pkg.version = ${JSON.stringify(version)};
-      pkg.provides(${contract(1)});
-      ${withV2 ? `pkg.provides(${contract(2)});` : ""}
-    });
-  `;
-}
-const frozen = async () => JSON.parse(await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8"));
-beforeEach(async () => {
-    root = await (0, promises_1.mkdtemp)(path.join((0, node_os_1.tmpdir)(), "peers-package-freeze-"));
-    await (0, promises_1.mkdir)(path.join(root, "src"));
-    await (0, promises_1.mkdir)(path.join(root, "node_modules/@peers-app"), { recursive: true });
-    await (0, promises_1.symlink)(sdkRoot, path.join(root, "node_modules/@peers-app/peers-sdk"), "dir");
-    await (0, promises_1.symlink)(path.dirname(require.resolve("esbuild/package.json")), path.join(root, "node_modules/esbuild"), "dir");
-    await (0, promises_1.writeFile)(path.join(root, "package.json"), '{"name":"freeze-probe","version":"1.0.0"}');
-    await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), declaration("1.0.0", "{ name: z.string() }"));
-});
-afterEach(async () => {
-    await (0, promises_1.rm)(root, { recursive: true, force: true });
-});
-test("freezes a release's contracts, then the build refuses a shape change but not a new description", async () => {
-    const log = jest.spyOn(console, "log").mockImplementation(() => undefined);
-    const error = jest.spyOn(console, "error").mockImplementation(() => undefined);
-    try {
-        // Nothing frozen yet: the check passes, saying so, and the build runs.
-        await expect((0, cli_1.main)(["contract", "freeze", "--check", "--root", root])).resolves.toBe(0);
-        expect(log).toHaveBeenCalledWith(expect.stringContaining("nothing is frozen yet"));
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root })).resolves.toMatchObject({
-            packageVersion: "1.0.0",
-            added: [expect.objectContaining({ contractId, version: 1, frozenBy: "1.0.0" })],
-            written: true,
-        });
-        expect((await frozen()).contracts.map(({ version, frozenBy }) => [version, frozenBy])).toEqual([
-            [1, "1.0.0"],
-        ]);
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root })).resolves.toMatchObject({
-            added: [],
-            written: false,
-        });
-        // A new description is allowed; a changed input isn't, in the build or the check.
-        await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), declaration("1.1.0", "{ name: z.string() }", "Probe, described again."));
-        await expect((0, build_package_1.buildPackage)({ root })).resolves.toMatchObject({});
-        await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), declaration("1.1.0", "{ name: z.string(), count: z.number() }"));
-        await expect((0, build_package_1.buildPackage)({ root })).rejects.toThrow(`This build changes a frozen contract:\nProbe (${contractId}@1), frozen by 1.0.0: tool probe changed.`);
-        await expect((0, build_package_1.generatePackageManifest)({ root })).rejects.toThrow("tool probe changed");
-        const beforeFailure = await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8");
-        await expect((0, cli_1.main)(["contract", "freeze", "--check", "--root", root])).resolves.toBe(1);
-        await expect((0, cli_1.main)(["contract", "freeze", "--root", root])).resolves.toBe(1);
-        expect(error).toHaveBeenCalledWith(expect.stringContaining("tool probe changed"));
-        expect((await frozen()).contracts).toHaveLength(1);
-        expect(await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8")).toBe(beforeFailure);
-        // The change goes in a new version, which the next stable release freezes.
-        await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), declaration("2.0.0", "{ name: z.string() }", "Probe.", true));
-        await expect((0, cli_1.main)(["contract", "freeze", "--root", root])).resolves.toBe(0);
-        expect((await frozen()).contracts.map(({ version, frozenBy }) => [version, frozenBy])).toEqual([
-            [1, "1.0.0"],
-            [2, "2.0.0"],
-        ]);
-    }
-    finally {
-        log.mockRestore();
-        error.mockRestore();
-    }
-});
-test("doesn't note a frozen version the package still serves through alsoImplements", async () => {
-    const log = jest.spyOn(console, "log").mockImplementation(() => undefined);
-    const v2 = (alsoImplements) => `
-    import { defineContract, definePackage, defineTool, z } from "@peers-app/peers-sdk/define";
-    export default definePackage((pkg) => {
-      pkg.packageId = ${JSON.stringify(packageId)};
-      pkg.version = "2.0.0";
-      pkg.provides(defineContract({
-        contractId: ${JSON.stringify(contractId)}, version: 2, name: "Probe",
-        tools: [defineTool({
-          name: "probe", usageDescription: "Probe.", accessLevel: 0,
-          inputSchema: z.object({ name: z.string(), tag: z.string().optional() }),
-          outputSchema: z.object({}), handler: () => ({}),
-        })],
-        ${alsoImplements}
-      }));
-    });
-  `;
-    try {
-        await (0, freeze_contracts_1.freezePackageContracts)({ root });
-        await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), v2("alsoImplements: [1],"));
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, check: true })).resolves.toMatchObject({
-            check: { changed: [], notProvided: [] },
-        });
-        await expect((0, cli_1.main)(["contract", "freeze", "--root", root])).resolves.toBe(0);
-        expect(log).not.toHaveBeenCalledWith(expect.stringContaining("is no longer provided"));
-        expect((await frozen()).contracts.map(({ version, frozenBy }) => [version, frozenBy])).toEqual([
-            [1, "1.0.0"],
-            [2, "2.0.0"],
-        ]);
-        // Without the alias, v1's consumers lose this provider, and the check says so.
-        await (0, promises_1.writeFile)(path.join(root, "src/package.ts"), v2(""));
-        const checked = await (0, freeze_contracts_1.freezePackageContracts)({ root, check: true });
-        expect(checked.check.notProvided.map(({ version }) => version)).toEqual([1]);
-    }
-    finally {
-        log.mockRestore();
-    }
-});
-test("reads an isolated artifact with a cwd-relative bundle and a separate root", async () => {
-    const built = await (0, build_package_1.buildPackage)({ root });
-    await expect((0, freeze_contracts_1.freezePackageContracts)({
-        root,
-        bundle: path.relative(process.cwd(), built.artifactPath),
-    })).resolves.toMatchObject({ written: true, packageVersion: "1.0.0" });
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle: built.artifactPath, check: true })).resolves.toMatchObject({ written: false, check: { changed: [] } });
-});
-test("checks a bundle's carried shapes against frozen versions before writing", async () => {
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const file = path.join(root, "frozen-contracts.json");
-    const before = await (0, promises_1.readFile)(file, "utf8");
-    const built = await (0, build_package_1.buildPackage)({ root });
-    const { frozenBy: _frozenBy, ...original } = (await frozen()).contracts[0];
-    const carried = {
-        ...original,
-        tools: [{ ...original.tools[0], inputFields: [] }],
-    };
-    const manifest = structuredClone(built.manifest);
-    manifest.provides[0].version = 2;
-    manifest.provides[0].tools[0].inputFields = [];
-    manifest.provides[0].alsoImplements = [{ contractId, version: 1, definition: carried }];
-    await (0, promises_1.writeFile)(built.artifactPath, `PEERS_ISOLATED_PACKAGE_V1\n${JSON.stringify({ manifest, providerSource: "void 0;" })}\n`);
-    for (const check of [true, false]) {
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle: built.artifactPath, check })).resolves.toMatchObject({
-            added: [],
-            written: false,
-            check: {
-                changed: [{ contract: { contractId, version: 1 }, changes: ["tool probe changed"] }],
-            },
-        });
-        expect(await (0, promises_1.readFile)(file, "utf8")).toBe(before);
-    }
-    await expect((0, freeze_contracts_1.assertFrozenContracts)(root, manifest)).rejects.toThrow("tool probe changed");
-});
-test("only a provided host contract's aliases quiet retirement notes, with inclusive ranges", async () => {
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const { frozenBy: _frozenBy, ...original } = (await frozen()).contracts[0];
-    const otherId = (0, peer_id_1.newid)();
-    const provided = { ...original, contractId: otherId, version: 3 };
-    const bundle = path.join(root, "aliases.bundle.js");
-    const target = { contractId, version: { from: 1, to: 2 } };
-    const cases = [
-        { key: `${otherId}@3`, target, notProvided: [] },
-        { key: `${otherId}@2`, target, notProvided: [expect.objectContaining({ contractId })] },
-        {
-            key: `${otherId}@3`,
-            target: { contractId: otherId, version: { from: 1, to: 2 } },
-            notProvided: [expect.objectContaining({ contractId })],
-        },
-    ];
-    for (const { key, target, notProvided } of cases) {
-        await (0, promises_1.writeFile)(bundle, `exports.packageDefinition = {
-        version: "2.0.0", contracts: [${JSON.stringify(provided)}],
-        alsoImplements: new Map([[${JSON.stringify(key)}, [${JSON.stringify(target)}]]]),
-      };`);
-        for (const check of [true, false]) {
-            await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check })).resolves.toMatchObject({
-                check: { changed: [], notProvided },
-            });
-        }
-    }
-});
-test.each([
-    "{}",
-    `new Map([[${JSON.stringify(`${contractId}@2`)}, {}]])`,
-    `new Map([[${JSON.stringify(`${contractId}@2`)}, [null]]])`,
-    `new Map([[${JSON.stringify(`${contractId}@2`)}, [{ contractId: ${JSON.stringify(contractId)}, version: 1.5 }]]])`,
-    `new Map([[${JSON.stringify(`${contractId}@2`)}, [{ contractId: ${JSON.stringify(contractId)}, version: { from: 2, to: 1 } }]]])`,
-])("rejects malformed host alsoImplements without changing the snapshot: %s", async (aliases) => {
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const file = path.join(root, "frozen-contracts.json");
-    const before = await (0, promises_1.readFile)(file, "utf8");
-    const { frozenBy: _frozenBy, ...original } = (await frozen()).contracts[0];
-    const bundle = path.join(root, "invalid-alias.bundle.js");
-    await (0, promises_1.writeFile)(bundle, `exports.packageDefinition = {
-      version: "2.0.0", contracts: [${JSON.stringify({ ...original, version: 2 })}],
-      alsoImplements: ${aliases},
-    };`);
-    for (const check of [true, false]) {
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check })).rejects.toThrow("Invalid alsoImplements");
-        expect(await (0, promises_1.readFile)(file, "utf8")).toBe(before);
-    }
-});
-test.each([
-    "",
-    "{",
-    "null",
-    "{}",
-    '{"contracts":[{}]}',
-    '{"contracts":null}',
-])("rejects a malformed snapshot without overwriting it: %s", async (content) => {
-    const file = path.join(root, "frozen-contracts.json");
-    await (0, promises_1.writeFile)(file, content);
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root })).rejects.toThrow();
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, check: true })).rejects.toThrow();
-    await expect((0, build_package_1.buildPackage)({ root })).rejects.toThrow();
-    expect(await (0, promises_1.readFile)(file, "utf8")).toBe(content);
-});
-test("rejects incomplete shapes and duplicate frozen identities", async () => {
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const snapshot = await frozen();
-    const invalid = [
-        { contracts: snapshot.contracts.map(({ version: _version, ...entry }) => entry) },
-        { contracts: snapshot.contracts.map(({ tools: _tools, ...entry }) => entry) },
-        { contracts: snapshot.contracts.map((entry) => ({ ...entry, tools: [{ name: "broken" }] })) },
-        { contracts: [...snapshot.contracts, ...snapshot.contracts] },
-    ];
-    for (const content of invalid) {
-        await (0, promises_1.writeFile)(path.join(root, "frozen-contracts.json"), JSON.stringify(content));
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, check: true })).rejects.toThrow("Invalid");
-    }
-});
-test("accepts an empty contracts list and refuses to freeze a missing package version", async () => {
-    await (0, promises_1.writeFile)(path.join(root, "frozen-contracts.json"), '{"contracts":[]}');
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root })).resolves.toMatchObject({ written: true });
-    const snapshot = await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8");
-    const bundle = path.join(root, "missing-version.js");
-    await (0, promises_1.writeFile)(bundle, "exports.packageDefinition = { contracts: [] };");
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle })).rejects.toThrow("no version");
-    expect(await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8")).toBe(snapshot);
-});
-test("reports a newly written empty snapshot", async () => {
-    const bundle = path.join(root, "empty.js");
-    await (0, promises_1.writeFile)(bundle, 'exports.packageDefinition = { version: "1.0.0", contracts: [] };');
-    const log = jest.spyOn(console, "log").mockImplementation(() => undefined);
-    try {
-        await expect((0, cli_1.main)(["contract", "freeze", "--root", root, "--bundle", bundle])).resolves.toBe(0);
-        expect(log).toHaveBeenCalledWith(expect.stringContaining("Wrote "));
-        expect((await frozen()).contracts).toEqual([]);
-    }
-    finally {
-        log.mockRestore();
-    }
-});
-test("rejects malformed host definitions without creating or replacing a snapshot", async () => {
-    const bundle = path.join(root, "malformed.bundle.js");
-    await (0, promises_1.writeFile)(bundle, 'exports.packageDefinition = { version: "1.0.0", contracts: [{}] };');
-    for (const check of [true, false]) {
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check })).rejects.toThrow("Invalid contracts");
-    }
-    await expect((0, promises_1.readFile)(path.join(root, "frozen-contracts.json"))).rejects.toMatchObject({
-        code: "ENOENT",
-    });
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const before = await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8");
-    for (const check of [true, false]) {
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check })).rejects.toThrow("Invalid contracts");
-    }
-    expect(await (0, promises_1.readFile)(path.join(root, "frozen-contracts.json"), "utf8")).toBe(before);
-});
-test("rejects duplicate host contracts without writing and preserves unknown shape keys", async () => {
-    await (0, freeze_contracts_1.freezePackageContracts)({ root });
-    const file = path.join(root, "frozen-contracts.json");
-    const before = await (0, promises_1.readFile)(file, "utf8");
-    const { frozenBy: _frozenBy, ...original } = (await frozen()).contracts[0];
-    const changed = { ...original, tools: [] };
-    const bundle = path.join(root, "duplicate.bundle.js");
-    const writeBundle = (contracts) => (0, promises_1.writeFile)(bundle, `exports.packageDefinition = ${JSON.stringify({ version: "1.1.0", contracts })};`);
-    await writeBundle([changed, original]);
-    for (const check of [true, false]) {
-        await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check })).rejects.toThrow("Duplicate provided contract");
-    }
-    expect(await (0, promises_1.readFile)(file, "utf8")).toBe(before);
-    await (0, promises_1.rm)(file);
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle })).rejects.toThrow("Duplicate provided contract");
-    await expect((0, promises_1.readFile)(file)).rejects.toMatchObject({ code: "ENOENT" });
-    const extended = {
-        ...original,
-        tools: [{ ...original.tools[0], futureShape: { enabled: true } }],
-    };
-    await writeBundle([extended]);
-    await (0, freeze_contracts_1.freezePackageContracts)({ root, bundle });
-    expect((await frozen()).contracts[0].tools[0]).toMatchObject({ futureShape: { enabled: true } });
-    await writeBundle([
-        { ...extended, tools: [{ ...extended.tools[0], futureShape: { enabled: false } }] },
-    ]);
-    expect((await (0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check: true })).check.changed).toHaveLength(1);
-});
-test("reads a host-backed package's CommonJS bundle, with the SDK and zod as externals", async () => {
-    const bundle = path.join(root, "legacy.bundle.js");
-    const tool = (fields) => `{
-    tool: {
-      toolId: ${JSON.stringify((0, peer_id_1.newid)())}, name: "act", code: "", usageDescription: "Act.",
-      inputSchema: { type: "complex", fields: ${fields} },
-      outputSchema: { type: "complex", fields: [] },
-    },
-  }`;
-    const legacy = (version, fields) => `
-    const { definePackage } = require("PeersSDK");
-    require("zod");
-    exports.packageDefinition = definePackage((pkg) => {
-      pkg.packageId = ${JSON.stringify(packageId)};
-      pkg.version = ${JSON.stringify(version)};
-      const contract = pkg.contract(${JSON.stringify(contractId)}, 1, "Legacy", "A legacy contract.");
-      contract.tools = [${tool(fields)}];
-    });
-  `;
-    await (0, promises_1.writeFile)(bundle, legacy("0.5.0", '[{ name: "value", type: "string" }]'));
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle })).resolves.toMatchObject({
-        packageVersion: "0.5.0",
-        added: [expect.objectContaining({ name: "Legacy", version: 1, frozenBy: "0.5.0" })],
-    });
-    expect((await frozen()).contracts[0]).not.toHaveProperty("devTag");
-    await (0, promises_1.writeFile)(bundle, legacy("0.6.0", '[{ name: "value", type: "number" }]'));
-    const checked = await (0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check: true });
-    expect(checked.check.changed.map(({ changes }) => changes)).toEqual([["tool act changed"]]);
-    // v2 also implementing v1 still serves it; without that, v1 is no longer provided.
-    const upgraded = (alsoImplements) => `
-    const { definePackage } = require("PeersSDK");
-    exports.packageDefinition = definePackage((pkg) => {
-      pkg.packageId = ${JSON.stringify(packageId)};
-      pkg.version = "1.0.0";
-      const contract = pkg.contract(${JSON.stringify(contractId)}, 2, "Legacy", "A legacy contract.");
-      contract.tools = [${tool('[{ name: "value", type: "string" }]')}];
-      ${alsoImplements}
-    });
-  `;
-    await (0, promises_1.writeFile)(bundle, upgraded(`contract.alsoImplements(${JSON.stringify(contractId)}, 1);`));
-    await expect((0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check: true })).resolves.toMatchObject({
-        check: { changed: [], notProvided: [] },
-    });
-    await (0, promises_1.writeFile)(bundle, upgraded(""));
-    const dropped = await (0, freeze_contracts_1.freezePackageContracts)({ root, bundle, check: true });
-    expect(dropped.check.notProvided.map(({ version }) => version)).toEqual([1]);
-});

package/dist/package-installer/package-author-signing.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/package-installer/package-author-signing.test.js

@@ -1,200 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const keys_1 = require("../keys");
-const utils_1 = require("../utils");
-const package_author_signing_1 = require("./package-author-signing");
-function makePV(overrides) {
-    return {
-        packageId: (0, utils_1.newid)(),
-        packageVersionId: (0, utils_1.newid)(),
-        version: "1.2.3",
-        versionTag: "stable",
-        packageBundleFileHash: "abc123hash",
-        routesBundleFileHash: "routes456hash",
-        uiBundleFileHash: "ui789hash",
-        ...overrides,
-    };
-}
-describe("package-author-signing", () => {
-    const keys = (0, keys_1.newKeys)();
-    describe("PACKAGE_SIGNING_KEY_PREFIX", () => {
-        it("has the expected value", () => {
-            expect(package_author_signing_1.PACKAGE_SIGNING_KEY_PREFIX).toBe("packageSigningKey_");
-        });
-    });
-    describe("buildAuthorSignedPayload", () => {
-        it("extracts the correct fields from a PV", () => {
-            const pv = makePV();
-            const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pv, keys.publicKey);
-            expect(payload).toEqual({
-                packageId: pv.packageId,
-                packageVersionId: pv.packageVersionId,
-                version: "1.2.3",
-                versionTag: "stable",
-                packageBundleFileHash: "abc123hash",
-                routesBundleFileHash: "routes456hash",
-                uiBundleFileHash: "ui789hash",
-                publicKey: keys.publicKey,
-            });
-        });
-        it("omits optional hash fields when undefined", () => {
-            const pv = makePV({ routesBundleFileHash: undefined, uiBundleFileHash: undefined });
-            const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pv, keys.publicKey);
-            expect(payload).not.toHaveProperty("routesBundleFileHash");
-            expect(payload).not.toHaveProperty("uiBundleFileHash");
-            expect(payload.packageBundleFileHash).toBe("abc123hash");
-        });
-        it("omits uiBundleFileHash but includes routesBundleFileHash when only ui is undefined", () => {
-            const pv = makePV({ uiBundleFileHash: undefined });
-            const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pv, keys.publicKey);
-            expect(payload.routesBundleFileHash).toBe("routes456hash");
-            expect(payload).not.toHaveProperty("uiBundleFileHash");
-        });
-        it("treats empty string versionTag the same as undefined", () => {
-            const pv = makePV({ versionTag: undefined });
-            const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pv, keys.publicKey);
-            expect(payload.versionTag).toBe("");
-        });
-    });
-    describe("signPackageAuthor + verifyPackageAuthorSignature round-trip", () => {
-        it("produces a valid signature that verifies", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            expect(typeof signature).toBe("string");
-            expect(signature.length).toBeGreaterThan(0);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, keys.publicKey);
-            expect(result.valid).toBe(true);
-            expect(result.publicKey).toBe(keys.publicKey);
-        });
-        it("works with only the required bundle hash (no routes or ui)", () => {
-            const pv = makePV({ routesBundleFileHash: undefined, uiBundleFileHash: undefined });
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, keys.publicKey);
-            expect(result.valid).toBe(true);
-        });
-        it("works with undefined versionTag", () => {
-            const pv = makePV({ versionTag: undefined });
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, keys.publicKey);
-            expect(result.valid).toBe(true);
-        });
-    });
-    describe("verification fails on tampered fields", () => {
-        const pv = makePV();
-        let signature;
-        beforeAll(() => {
-            signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-        });
-        it("fails when packageBundleFileHash is changed", () => {
-            const tampered = {
-                ...pv,
-                packageBundleFileHash: "tampered",
-                packageAuthorSignature: signature,
-            };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when version is changed", () => {
-            const tampered = { ...pv, version: "9.9.9", packageAuthorSignature: signature };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when versionTag is changed", () => {
-            const tampered = { ...pv, versionTag: "beta", packageAuthorSignature: signature };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when packageId is changed", () => {
-            const tampered = { ...pv, packageId: (0, utils_1.newid)(), packageAuthorSignature: signature };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when packageVersionId is changed", () => {
-            const tampered = { ...pv, packageVersionId: (0, utils_1.newid)(), packageAuthorSignature: signature };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when routesBundleFileHash is changed", () => {
-            const tampered = {
-                ...pv,
-                routesBundleFileHash: "tampered",
-                packageAuthorSignature: signature,
-            };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when uiBundleFileHash is changed", () => {
-            const tampered = { ...pv, uiBundleFileHash: "tampered", packageAuthorSignature: signature };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("fails when a signed createdBy is changed", () => {
-            const signed = makePV({ createdBy: "00author0000000000000000a" });
-            const signedSignature = (0, package_author_signing_1.signPackageAuthor)(signed, keys.secretKey);
-            const tampered = {
-                ...signed,
-                createdBy: "00attacker000000000000000a",
-                packageAuthorSignature: signedSignature,
-            };
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-    });
-    describe("verification fails with wrong key", () => {
-        it("rejects when verified against a different key", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const otherKeys = (0, keys_1.newKeys)();
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, otherKeys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-    });
-    describe("TOFU enforcement via expectedPublicKey", () => {
-        it("succeeds when expectedPublicKey matches the signer", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, keys.publicKey);
-            expect(result.valid).toBe(true);
-            expect(result.publicKey).toBe(keys.publicKey);
-        });
-        it("fails when expectedPublicKey does not match the signer", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const differentKey = (0, keys_1.newKeys)().publicKey;
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, differentKey);
-            expect(result.valid).toBe(false);
-        });
-    });
-    describe("edge cases", () => {
-        it("returns invalid when packageAuthorSignature is undefined", () => {
-            const pv = makePV();
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: undefined }, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("returns invalid when packageAuthorSignature is malformed", () => {
-            const pv = makePV();
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: "not-a-valid-signature!!!" }, keys.publicKey);
-            expect(result.valid).toBe(false);
-        });
-        it("returns invalid when expectedPublicKey is malformed", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, "not-a-valid-key");
-            expect(result.valid).toBe(false);
-        });
-        it("signature is deterministic for same inputs", () => {
-            const pv = makePV();
-            const sig1 = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const sig2 = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            expect(sig1).toBe(sig2);
-        });
-        it("derives the correct public key from the secret key", () => {
-            const pv = makePV();
-            const signature = (0, package_author_signing_1.signPackageAuthor)(pv, keys.secretKey);
-            const derived = (0, keys_1.hydrateKeys)(keys.secretKey);
-            expect(derived.publicKey).toBe(keys.publicKey);
-            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)({ ...pv, packageAuthorSignature: signature }, derived.publicKey);
-            expect(result.valid).toBe(true);
-        });
-    });
-});

package/dist/package-installer/package-cloner.test.d.ts

@@ -1 +0,0 @@
-export {};