@specverse/engines 6.33.1 → 6.35.0

package/libs/instance-factories/services/templates/prisma/__tests__/behavior-generator.test.ts

@@ -0,0 +1,85 @@
+/**
+ * behavior-generator.ts — postcondition emission tests (#53D).
+ *
+ * The generator emits one `console.assert(true, '<text>');` line per
+ * postcondition string in the dev-mode block. Pre-#53D the wrapper was
+ * single-quoted; postcondition text containing apostrophes — common in
+ * natural prose like "no other nodes' cache entries are affected" —
+ * terminated the JS string and esbuild rejected the file.
+ *
+ * #53D fix: emit with backticks + escape any backticks / `${` markers
+ * in the source. These tests pin the new shape so a future change
+ * can't silently regress to single-quoted strings.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { generatePostconditionVerification } from '../behavior-generator.js';
+
+describe('generatePostconditionVerification — 53D apostrophe handling', () => {
+  it('returns empty string for empty input', () => {
+    expect(generatePostconditionVerification([])).toBe('');
+  });
+
+  it('emits backtick-wrapped strings (not single-quoted)', () => {
+    const out = generatePostconditionVerification(['simple postcondition']);
+    expect(out).toContain('`POSTCONDITION: simple postcondition`');
+    expect(out).not.toContain("'POSTCONDITION:");
+  });
+
+  it('preserves apostrophes verbatim in postcondition text', () => {
+    const out = generatePostconditionVerification([
+      "no other nodes' cache entries are affected",
+    ]);
+    expect(out).toContain("nodes' cache entries");
+    // Must not have escaped the apostrophe — backticks accept it natively.
+    expect(out).not.toContain("nodes\\'");
+  });
+
+  it('escapes embedded backticks to prevent string termination', () => {
+    const out = generatePostconditionVerification([
+      'value matches `expected` shape',
+    ]);
+    expect(out).toContain('value matches \\`expected\\` shape');
+  });
+
+  it('escapes ${...} interpolation markers to prevent template execution', () => {
+    const out = generatePostconditionVerification([
+      'rejects ${malicious} payloads',
+    ]);
+    expect(out).toContain('rejects \\${malicious} payloads');
+    // The marker must NOT appear unescaped — that would let the spec
+    // author smuggle template-literal interpolation into realized code.
+    expect(out).not.toMatch(/[^\\]\$\{malicious\}/);
+  });
+
+  it('escapes backslashes before other escapes (stable round-trip)', () => {
+    const out = generatePostconditionVerification(['regex \\d+ matches']);
+    expect(out).toContain('regex \\\\d+ matches');
+  });
+
+  it('emits one console.assert line per postcondition', () => {
+    const out = generatePostconditionVerification(['p1', 'p2', 'p3']);
+    const matches = out.match(/console\.assert\(true,/g);
+    expect(matches?.length).toBe(3);
+  });
+
+  it('wraps the assertion block in NODE_ENV development guard', () => {
+    const out = generatePostconditionVerification(['p1']);
+    expect(out).toContain("process.env.NODE_ENV === 'development'");
+    expect(out).toContain('// === POSTCONDITIONS (dev-mode) ===');
+  });
+
+  it('produces output that parses as valid JavaScript', async () => {
+    // The whole point of #53D — the emitted code must actually parse.
+    // Use Function() as a lightweight syntax-check (rejects malformed
+    // template literals just as esbuild would).
+    const realistic = generatePostconditionVerification([
+      "no other nodes' cache entries are affected",
+      'response includes a `Last-Modified` header',
+      'rejects ${oversized} payloads with 413',
+    ]);
+    // Wrap in a function body to give it a syntactic context.
+    const wrap = `(function() {\n${realistic}\n})`;
+    expect(() => new Function(`return ${wrap}`)).not.toThrow();
+  });
+});

package/libs/instance-factories/services/templates/prisma/behavior-generator.ts

@@ -323,8 +323,28 @@ function inferLogicFromOperationName(context: BehaviorContext): string {
     return { success: true };`;
 }
 
+/**
+ * Escape a postcondition string for safe inclusion in a JS template
+ * literal (backtick) — the only chars that can break a backtick string
+ * are unescaped backticks and `${` interpolation markers.
+ *
+ * Postcondition text comes verbatim from the spec author and frequently
+ * contains apostrophes (e.g. "no other nodes' cache entries are
+ * affected"). Pre-53D the emitter wrapped these in single quotes, so
+ * the apostrophe terminated the JS string and esbuild rejected the
+ * file. Switching to backticks + this escape closes that class.
+ */
+function escapeForBacktick(text: string): string {
+  return text.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+}
+
 /**
  * Generate postcondition verification (dev-mode assertions).
+ *
+ * 53D fix: emit with backtick template literals (not single quotes) so
+ * postconditions containing apostrophes — which the spec format
+ * encourages for natural prose — survive realize without breaking
+ * esbuild's parse.
  */
 export function generatePostconditionVerification(
   postconditions: string[]
@@ -332,7 +352,7 @@ export function generatePostconditionVerification(
   if (postconditions.length === 0) return '';
 
   const checks = postconditions.map(pc =>
-    `      console.assert(true, 'POSTCONDITION: ${pc}');`
+    `      console.assert(true, \`POSTCONDITION: ${escapeForBacktick(pc)}\`);`
   );
 
   return `    // === POSTCONDITIONS (dev-mode) ===

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specverse/engines",
-  "version": "6.33.1",
+  "version": "6.35.0",
   "description": "SpecVerse toolchain — parser, inference, realize, generators, AI, registry, bundles",
   "type": "module",
   "main": "dist/index.js",
@@ -65,7 +65,7 @@
     "@specverse/engines": "^6.29.3",
     "@specverse/entities": "^5.4.0",
     "@specverse/runtime": "^5.0.1",
-    "@specverse/types": "^5.1.0",
+    "@specverse/types": "^5.2.0",
     "ai": "^6.0.168",
     "ajv": "^8.17.0",
     "ajv-formats": "^2.1.0",