@underpostnet/cyberia 3.3.76 → 3.4.0

package/test/unit/package.test.js

@@ -4,6 +4,7 @@ import shell from 'shelljs';
 import { program } from '../../src/cli/index.js';
 import {
   STAGED_CLI_PACKAGE,
+  auditRuntimeDependencies,
   deployDependencySpecsFactory,
   packageRepositoryFactory,
   renamePackage,
@@ -12,9 +13,11 @@ import {
   buildProductPackageJson,
   deployPackageNameFactory,
   deployPackagePathFactory,
+  importPackageNameFactory,
   productDevDependenciesFactory,
   productPackageOptionsFactory,
   publishedProductPackageJson,
+  runtimeImportGraphFactory,
   stagePackageArchive,
   syncDeployPackages,
 } from '../../src/server/build/package.js';
@@ -328,6 +331,15 @@ describe('the manifest a product publishes to npm', () => {
     ).to.deep.equal({ underpost: '^4.0.0' });
   });
 
+  it('lets a GitHub Packages publish pin the engine under its scoped package name', () => {
+    expect(
+      publishedProductPackageJson({
+        packageJson: { version: '3.3.73' },
+        underpostPackageName: '@underpost/underpost',
+      }).dependencies,
+    ).to.deep.equal({ '@underpost/underpost': '^3.3.73' });
+  });
+
   it('refuses a manifest it cannot pin the engine CLI from', () => {
     expect(() => publishedProductPackageJson()).to.throw('packageJson');
     expect(() => publishedProductPackageJson({ packageJson: { name: 'cyberia' } })).to.throw('version');
@@ -455,3 +467,109 @@ describe('package identity is written in one place', () => {
     expect(() => setPackageRepository({})).to.throw('slug');
   });
 });
+
+describe('runtime dependency audit', () => {
+  const tree = () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'underpost-runtime-graph-'));
+    fs.outputJsonSync(path.join(root, 'package.json'), {
+      dependencies: { express: '^5.0.0', 'fs-extra': '^11.0.0' },
+      devDependencies: { vitest: '5.0.0', bumpp: '^12.0.0' },
+    });
+    fs.outputFileSync(path.join(root, 'bin/index.js'), "import '../src/cli.js';\n");
+    fs.outputFileSync(
+      path.join(root, 'src/cli.js'),
+      [
+        "import express from 'express';",
+        "import { helper } from './lib';",
+        "/** @type {import('typedoc').Options} */",
+        "// import legacy from 'legacy-tool';",
+        "export const bump = () => import('bumpp');",
+        "export * from './lib/index.js';",
+        // A module chosen at runtime from a directory this tree does not ship.
+        'export const grpc = (name) => import(`./grpc/${name}/grpc-server.js`);',
+        // Source text a command writes to disk and runs elsewhere; not an import of this module.
+        'export const script = `',
+        "  import hre from 'hardhat';",
+        '`;',
+      ].join('\n'),
+    );
+    fs.outputFileSync(
+      path.join(root, 'src/lib/index.js'),
+      "import fs from 'fs-extra';\nimport nodePath from 'node:path';\nimport { readFileSync } from 'fs';\nexport const helper = 1;\n",
+    );
+    fs.outputFileSync(
+      path.join(root, 'src/api/user/user.router.js'),
+      "import { run } from 'vitest';\nimport sharp from 'sharp';\n",
+    );
+    return root;
+  };
+
+  it('names the package a specifier imports', () => {
+    expect(importPackageNameFactory('express')).to.equal('express');
+    expect(importPackageNameFactory('@grpc/grpc-js/build/x.js')).to.equal('@grpc/grpc-js');
+    expect(importPackageNameFactory('socket.io/client-dist/socket.io.esm.min.js')).to.equal('socket.io');
+    for (const specifier of [
+      './x.js',
+      '../y.js',
+      '/abs.js',
+      'node:fs',
+      'fs',
+      'path',
+      'data:text/javascript,1',
+      'https://cdn/x.js',
+    ])
+      expect(importPackageNameFactory(specifier), specifier).to.equal('');
+  });
+
+  it('walks the static graph from the entry points and records dynamic imports as lazy', async () => {
+    const root = tree();
+    try {
+      const graph = await runtimeImportGraphFactory({ root });
+      expect(graph.files).to.deep.equal([
+        'bin/index.js',
+        'src/api/user/user.router.js',
+        'src/cli.js',
+        'src/lib/index.js',
+      ]);
+      expect(graph.packages).to.deep.equal({
+        express: ['src/cli.js'],
+        'fs-extra': ['src/lib/index.js'],
+        sharp: ['src/api/user/user.router.js'],
+        vitest: ['src/api/user/user.router.js'],
+      });
+      expect(graph.lazyPackages).to.deep.equal({ bumpp: ['src/cli.js'] });
+    } finally {
+      fs.removeSync(root);
+    }
+  });
+
+  it('flags a runtime import declared outside dependencies and accepts a catalog pin', async () => {
+    const root = tree();
+    try {
+      const audit = await auditRuntimeDependencies({ root, catalogs: [{ packageDependencies: { sharp: '^0.35.0' } }] });
+      expect(audit).to.include({ dependencies: 2, devDependencies: 2 });
+      expect(audit.runtime).to.deep.equal(['express', 'fs-extra', 'sharp', 'vitest']);
+      expect(audit.lazy).to.deep.equal(['bumpp (devDependencies)']);
+      expect(audit.misplaced).to.deep.equal([
+        { name: 'vitest', declaredIn: 'devDependencies', importers: ['src/api/user/user.router.js'] },
+      ]);
+      const unpinned = await auditRuntimeDependencies({ root, catalogs: [] });
+      expect(unpinned.misplaced.map(({ name, declaredIn }) => `${name}:${declaredIn}`)).to.deep.equal([
+        'sharp:none',
+        'vitest:devDependencies',
+      ]);
+    } finally {
+      fs.removeSync(root);
+    }
+  });
+
+  it('keeps every package this engine imports at runtime in dependencies', async () => {
+    // A production install omits devDependencies, so a runtime import from there breaks the
+    // published CLI at load time. This bundles the whole engine from its real entry points
+    // with esbuild, which comfortably clears the 5s default on a slower CI runner.
+    const audit = await auditRuntimeDependencies();
+    expect(audit.misplaced).to.deep.equal([]);
+    expect(audit.runtime).to.include.members(['commander', 'esbuild', 'express', 'mongoose']);
+    expect(audit.runtime).to.not.include.members(['vitest', 'chai', 'nodemon', 'bumpp']);
+  }, 30000);
+});

package/test/unit/release-bump.test.js

@@ -307,7 +307,9 @@ describe('release pipeline commands', () => {
         commands = [];
         const { triggerCmd } = await UnderpostRelease.API.ci(deployId, 'fixture message');
         expect(triggerCmd, deployId).to.include('/engine-cyberia');
-        expect(commands, deployId).to.include('node bin/build dd-cyberia');
+        // `--coverage`: the published source must carry the reports the deploy declares, or
+        // every pod started from it serves the unavailable page.
+        expect(commands, deployId).to.include('node bin/build dd-cyberia --coverage');
       }
     });
 

package/test/unit/start-options.test.js

@@ -37,6 +37,18 @@ describe('start receives every flag its command registers', () => {
     expect(buildContract).to.include('{ force: Underpost.state.isInsideContainer() }');
   });
 
+  it('withdraws the ephemeral engine-private clone once a production container is serving', () => {
+    // Regression: the domain-split withdraw passed `force: false` to every domain, and only
+    // `host clean --force` removes `engine-private` — the clone outlived the boot in the pod.
+    const runStart = source.indexOf('async run(');
+    const withdraw = source.slice(
+      source.indexOf('for (const domain of', runStart),
+      source.indexOf('setTimeout', runStart),
+    );
+    expect(withdraw).to.include('[Underpost.secret, Underpost.host, Underpost.app]');
+    expect(withdraw).to.include('force: domain === Underpost.host');
+  });
+
   it('runs the container in one phase, with no re-entry through the global CLI', () => {
     // The pod's own bootstrap replaces the checkout and links the CLI before `start` is
     // invoked, so re-execing `underpost start` here only pulled and installed a second time.