@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-staging.2

package/src/__tests__/service-account-token.test.ts

@@ -1,247 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-// ── Mutable state for injected vault ────────────────────────────────────────
-
-const vaultStore = new Map<string, string>();
-const writtenKeys = new Map<string, string>();
-
-// ── Import under test ────────────────────────────────────────────────────────
-//
-// No mock.module — prevents all bun worker contamination. Vault access is
-// injected through _injectVaultAccessors / _resetVaultAccessors instead.
-
-const {
-  getValidServiceAccountToken,
-  parseServiceAccountKey,
-  _resetServiceAccountMutex,
-  _injectVaultAccessors,
-  _resetVaultAccessors,
-} = await import("../providers/inference/service-account-token.js");
-
-// ── Hooks ────────────────────────────────────────────────────────────────────
-
-beforeEach(() => {
-  vaultStore.clear();
-  writtenKeys.clear();
-  _resetServiceAccountMutex();
-  _injectVaultAccessors(
-    async (key: string) => vaultStore.get(key),
-    async (key: string, value: string) => {
-      vaultStore.set(key, value);
-      writtenKeys.set(key, value);
-      return true;
-    },
-  );
-});
-
-afterEach(() => {
-  _resetVaultAccessors();
-});
-
-// ── Real 2048-bit RSA PKCS#8 key generated offline for unit tests only ───────
-
-const TEST_PRIVATE_KEY =
-  "-----BEGIN PRIVATE KEY-----\n" +
-  "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDFnEC0wI/cNKyO\n" +
-  "XzkqOGAvsTTx4Q+DPjDBPVoy3yHVk7cGYIf5sg3nsrQlE4ARMEQ9MXKUvw+VY59c\n" +
-  "zzpy9/JnCN9v5ymZUrowF/87Xn0muklHOhYPFz+73BunncH0Dk0mgCRWEfd/xoGB\n" +
-  "bMI40mI2hPMN5aGU4moTmVzTsgvatp0tAk90oaUQBZ/Y3PVjoR+SHbKhQtZW8eiO\n" +
-  "zUGyBhzmlmMZcquWxHui8QbO//kEKg7jv2+7npkdW/S0meoDeKZzqRNACKci1CQB\n" +
-  "N/skFqy6B8qYekhVYtAaIQOLtuD+VdLL7azMBqIHZSVQQXD6KisN8XSj95k/Fyeb\n" +
-  "UEmhvlwrAgMBAAECggEALKr7PWBhpGcLskr4AwEnTOCDlUFIXmRKZQPXRbSGU17G\n" +
-  "elyLn/eNiRgt/EuCIWCFrEdnHRRrE1unhDUbgy1kz8GDsCnSj2PRzlk+Sk87fuuQ\n" +
-  "8NbCcbrRn0dLwQG5+87XxaIllIcPKQTX9Ud+R5XWuXgn8LY9Zggf7jo2b2vJnjBO\n" +
-  "2SIS4M24a8x/1hHLjrTKtyO1yF3TI/9z72z4+yYiXAHxBugCcg6kv27pMEtOl5hv\n" +
-  "HW6ogBIDKVIVp3DmjaWxPawy1ytxpI1mR1lfGKoNI3iutLNfuHl3MwinYL7oCiL/\n" +
-  "rejuz37rXicFZ40YTKHDqKy+brLS6Ahg0R7XxSNtcQKBgQD7i4oh4stD+geFoPoJ\n" +
-  "o/grtOazn2GKuMOrcbBSaTfs4PZfcSRT8Egzhl3Vf/3Z30T3ChugFKkpN9naDEL3\n" +
-  "0SEH5sR5oMhGzzE3ncwTPR4fClpiX61JIY6iVL5AQukXIK+v+hCuhRu9YepMbGWq\n" +
-  "ndl/uH4LofuEctJYaovnghKedwKBgQDJHC7NiqNhGB6YzwgvYK2GVrFLdPpcfLbl\n" +
-  "y5DZKaVYCs3cLFCH7qHEdsmVEWkQ9UkRhxNPGpgQadvYNAd9Bbf2au2lfNuCt0Kn\n" +
-  "dYDgkxHAo4PByEznOBgQYoG5IjF8bdubQJbJHQh/bj5EkzeKDggD37ED0fTdWIiJ\n" +
-  "Nhh0/q2Y7QKBgGlLMsoWbjGJMqbcCG4KpfJdqghcWe9Agh982mrUwmU0kczHxoYg\n" +
-  "WYi/4P1iszcE/5BNOd0baOfpChb89PdZIfN1xJ6JD+ycBCUct3UCK16g7c6p8BZh\n" +
-  "ppwKzwyFNZ7JvuDx0xPKgh8XIoVVBoWRx55v8ssZxffePHBoQSHqT7LnAoGAB1vO\n" +
-  "opq2C7F0PScmJ4WkE8xMRHSNTKELmDDwpeGOOUB789hzQeYLaULncVrnu0UeXVPR\n" +
-  "8w0ID2GwN6L/uyVga9XRyEJfTdMizznPc2guOBxDj+2iUruMtdzE3l9P7Dug03dz\n" +
-  "jPxQ+UixYpT4bUbCKFIhCgC+svKwXETsdCt1cqkCgYBVSSabJNSvFfqYz/VJbRK7\n" +
-  "cvxEr3mcV/I/+5BoyTmTKQGkIRl6xCMhqZk019hXbdN66jMQ9zg6wni4UKA43cXI\n" +
-  "/3NHY86IvdpLORlYqKVHycZsqSVQE6Z3V1G4C2wVKUZtWsoT6Wr+Ind+V+VzbDD2\n" +
-  "wHbW4FhxHN9iwdHfmJyq+g==\n" +
-  "-----END PRIVATE KEY-----\n";
-
-const TEST_SERVICE_ACCOUNT = JSON.stringify({
-  type: "service_account",
-  client_email: "test@example.com",
-  private_key: TEST_PRIVATE_KEY,
-  token_uri: "https://oauth2.googleapis.com/token",
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe("service-account-token", () => {
-  // -- parseServiceAccountKey ------------------------------------------------
-
-  describe("parseServiceAccountKey", () => {
-    test("returns null for empty string", () => {
-      expect(parseServiceAccountKey("")).toBeNull();
-    });
-
-    test("returns null for invalid JSON", () => {
-      expect(parseServiceAccountKey("not-json")).toBeNull();
-    });
-
-    test("returns null when required fields are missing", () => {
-      expect(
-        parseServiceAccountKey(
-          JSON.stringify({ client_email: "test@example.com" }),
-        ),
-      ).toBeNull();
-    });
-
-    test("returns the key when all required fields are present", () => {
-      const key = parseServiceAccountKey(TEST_SERVICE_ACCOUNT);
-      expect(key).not.toBeNull();
-      expect(key?.client_email).toBe("test@example.com");
-    });
-  });
-
-  // -- getValidServiceAccountToken -------------------------------------------
-
-  test("returns not_found when no credential is stored", async () => {
-    const result = await getValidServiceAccountToken("credential/vertex-ai");
-    expect(result).toEqual({ ok: false, reason: "not_found" });
-  });
-
-  test("returns invalid_config when credential is not valid JSON", async () => {
-    vaultStore.set("credential/vertex-ai", "not-json");
-    const result = await getValidServiceAccountToken("credential/vertex-ai");
-    expect(result).toEqual({ ok: false, reason: "invalid_config" });
-  });
-
-  test("returns invalid_config when credential JSON is missing required fields", async () => {
-    vaultStore.set(
-      "credential/vertex-ai",
-      JSON.stringify({ client_email: "missing-other-fields@example.com" }),
-    );
-    const result = await getValidServiceAccountToken("credential/vertex-ai");
-    expect(result).toEqual({ ok: false, reason: "invalid_config" });
-  });
-
-  test("returns cached token when the cache blob is still fresh", async () => {
-    const futureExpiry = Math.floor(Date.now() / 1000) + 7200;
-    vaultStore.set("credential/vertex-ai", TEST_SERVICE_ACCOUNT);
-    vaultStore.set(
-      "credential/vertex-ai/token_cache",
-      JSON.stringify({
-        access_token: "cached-token",
-        expires_at: futureExpiry,
-      }),
-    );
-
-    const result = await getValidServiceAccountToken("credential/vertex-ai");
-    expect(result).toEqual({ ok: true, token: "cached-token" });
-    // Nothing new should have been written (no exchange performed).
-    expect(writtenKeys.size).toBe(0);
-  });
-
-  test("returns cached token when cache blob has no expiry", async () => {
-    vaultStore.set("credential/vertex-ai", TEST_SERVICE_ACCOUNT);
-    vaultStore.set(
-      "credential/vertex-ai/token_cache",
-      JSON.stringify({ access_token: "no-expiry-token" }),
-    );
-
-    const result = await getValidServiceAccountToken("credential/vertex-ai");
-    expect(result).toEqual({ ok: true, token: "no-expiry-token" });
-  });
-
-  test("coalesces concurrent callers for the same credential onto one exchange", async () => {
-    const pastExpiry = Math.floor(Date.now() / 1000) - 600;
-    vaultStore.set("credential/vertex-ai", TEST_SERVICE_ACCOUNT);
-    vaultStore.set(
-      "credential/vertex-ai/token_cache",
-      JSON.stringify({ access_token: "stale-token", expires_at: pastExpiry }),
-    );
-
-    let fetchCallCount = 0;
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async () => {
-      fetchCallCount += 1;
-      return {
-        ok: true,
-        json: async () => ({ access_token: "new-token", expires_in: 3600 }),
-      } as Response;
-    }) as unknown as typeof fetch;
-
-    try {
-      const [r1, r2] = await Promise.all([
-        getValidServiceAccountToken("credential/vertex-ai"),
-        getValidServiceAccountToken("credential/vertex-ai"),
-      ]);
-
-      expect(r1).toEqual({ ok: true, token: "new-token" });
-      expect(r2).toEqual({ ok: true, token: "new-token" });
-      expect(fetchCallCount).toBe(1);
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-
-  test("concurrent callers for different credentials exchange independently", async () => {
-    vaultStore.set("credential/vertex-a", TEST_SERVICE_ACCOUNT);
-    vaultStore.set("credential/vertex-b", TEST_SERVICE_ACCOUNT);
-
-    let fetchCallCount = 0;
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async () => {
-      fetchCallCount += 1;
-      return {
-        ok: true,
-        json: async () => ({
-          access_token: `token-${fetchCallCount}`,
-          expires_in: 3600,
-        }),
-      } as Response;
-    }) as unknown as typeof fetch;
-
-    try {
-      const [r1, r2] = await Promise.all([
-        getValidServiceAccountToken("credential/vertex-a"),
-        getValidServiceAccountToken("credential/vertex-b"),
-      ]);
-
-      expect(r1.ok).toBe(true);
-      expect(r2.ok).toBe(true);
-      // Each credential triggers its own exchange.
-      expect(fetchCallCount).toBe(2);
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-
-  test("caches token+expiry as a single JSON blob", async () => {
-    vaultStore.set("credential/vertex-ai", TEST_SERVICE_ACCOUNT);
-
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async () => ({
-      ok: true,
-      json: async () => ({ access_token: "fresh-token", expires_in: 3600 }),
-    })) as unknown as typeof fetch;
-
-    try {
-      await getValidServiceAccountToken("credential/vertex-ai");
-
-      const blob = vaultStore.get("credential/vertex-ai/token_cache");
-      expect(blob).toBeDefined();
-      const parsed = JSON.parse(blob!) as {
-        access_token: string;
-        expires_at: number;
-      };
-      expect(parsed.access_token).toBe("fresh-token");
-      expect(typeof parsed.expires_at).toBe("number");
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-});

package/src/__tests__/source-fingerprint.test.ts

@@ -1,184 +0,0 @@
-/**
- * Tests for app source fingerprinting: walk exclusions, comparison, inspect
- * statuses, and the compile-time sidecar format.
- */
-
-import {
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-import {
-  compareAppSourceFingerprint,
-  computeAppSourceFingerprint,
-  inspectAppSource,
-  parseAppSourceFingerprint,
-  SOURCE_FINGERPRINT_FILENAME,
-  writeAppSourceFingerprint,
-} from "../apps/source-fingerprint.js";
-
-let root: string;
-
-beforeEach(() => {
-  root = mkdtempSync(join(tmpdir(), "app-source-fingerprint-"));
-});
-
-afterEach(() => {
-  rmSync(root, { recursive: true, force: true });
-});
-
-function write(rel: string, contents: string): void {
-  const abs = join(root, rel);
-  mkdirSync(join(abs, ".."), { recursive: true });
-  writeFileSync(abs, contents);
-}
-
-describe("computeAppSourceFingerprint", () => {
-  test("digests source files with POSIX-relative keys", () => {
-    write("src/main.tsx", "export const x = 1;");
-    write("src/index.html", "<html></html>");
-
-    const fp = computeAppSourceFingerprint(root);
-
-    expect(Object.keys(fp.files).sort()).toEqual([
-      "src/index.html",
-      "src/main.tsx",
-    ]);
-    expect(fp.algorithm).toBe("sha256");
-    expect(fp.files["src/main.tsx"]).toMatch(/^[0-9a-f]{64}$/);
-  });
-
-  test("skips dist, records, node_modules, and .git", () => {
-    write("src/main.tsx", "src");
-    write("dist/main.js", "compiled");
-    write("records/rec-1.json", "{}");
-    write("node_modules/pkg/index.js", "dep");
-    write("src/node_modules/nested/index.js", "nested");
-    write(".git/HEAD", "ref");
-    write("src/.git/config", "nope");
-
-    const fp = computeAppSourceFingerprint(root);
-
-    expect(Object.keys(fp.files)).toEqual(["src/main.tsx"]);
-  });
-
-  test("skips symlinks", () => {
-    write("src/real.tsx", "hello");
-    mkdirSync(join(root, "src"), { recursive: true });
-    symlinkSync(join(root, "src/real.tsx"), join(root, "src/link.tsx"));
-
-    const fp = computeAppSourceFingerprint(root);
-
-    expect(Object.keys(fp.files)).toEqual(["src/real.tsx"]);
-  });
-});
-
-describe("compareAppSourceFingerprint", () => {
-  test("reports modified, added, and removed paths", () => {
-    write("src/main.tsx", "one");
-    write("src/keep.tsx", "keep");
-    const baseline = computeAppSourceFingerprint(root);
-
-    write("src/main.tsx", "two");
-    write("src/new.tsx", "new");
-    rmSync(join(root, "src/keep.tsx"));
-
-    const diff = compareAppSourceFingerprint(root, baseline);
-    expect(diff.clean).toBe(false);
-    expect(diff.modified).toEqual(["src/main.tsx"]);
-    expect(diff.added).toEqual(["src/new.tsx"]);
-    expect(diff.removed).toEqual(["src/keep.tsx"]);
-  });
-
-  test("is clean when source matches the baseline", () => {
-    write("src/main.tsx", "same");
-    const baseline = computeAppSourceFingerprint(root);
-    const diff = compareAppSourceFingerprint(root, baseline);
-    expect(diff.clean).toBe(true);
-    expect(diff.modified).toEqual([]);
-    expect(diff.added).toEqual([]);
-    expect(diff.removed).toEqual([]);
-  });
-});
-
-describe("inspectAppSource", () => {
-  test("reports never_compiled when dist index is missing even if a fingerprint exists", () => {
-    write("src/main.tsx", "src");
-    mkdirSync(join(root, "dist"), { recursive: true });
-    writeAppSourceFingerprint(root, join(root, "dist"));
-
-    const result = inspectAppSource(root);
-    expect(result.status).toBe("never_compiled");
-  });
-
-  test("reports unknown_baseline when dist exists without a fingerprint", () => {
-    write("src/main.tsx", "src");
-    write("dist/index.html", "<html></html>");
-    const result = inspectAppSource(root);
-    expect(result.status).toBe("unknown_baseline");
-  });
-
-  test("reports clean after writing a fingerprint that matches source", () => {
-    write("src/main.tsx", "src");
-    mkdirSync(join(root, "dist"), { recursive: true });
-    writeFileSync(join(root, "dist", "index.html"), "<html></html>");
-    writeAppSourceFingerprint(root, join(root, "dist"));
-
-    const result = inspectAppSource(root);
-    expect(result.status).toBe("clean");
-    expect(result.compiledAt).toMatch(/^\d{4}-\d{2}-\d{2}T/);
-  });
-
-  test("reports stale after a source edit", () => {
-    write("src/main.tsx", "before");
-    mkdirSync(join(root, "dist"), { recursive: true });
-    writeFileSync(join(root, "dist", "index.html"), "<html></html>");
-    writeAppSourceFingerprint(root, join(root, "dist"));
-    write("src/main.tsx", "after");
-
-    const result = inspectAppSource(root);
-    expect(result.status).toBe("stale");
-    expect(result.modified).toEqual(["src/main.tsx"]);
-  });
-});
-
-describe("parseAppSourceFingerprint", () => {
-  test("accepts a compile sidecar with compiledAt", () => {
-    const parsed = parseAppSourceFingerprint({
-      algorithm: "sha256",
-      compiledAt: "2026-09-09T00:00:00.000Z",
-      files: { "src/main.tsx": "abc" },
-    });
-    expect(parsed).toEqual({
-      algorithm: "sha256",
-      compiledAt: "2026-09-09T00:00:00.000Z",
-      files: { "src/main.tsx": "abc" },
-    });
-  });
-
-  test("returns null for an invalid sidecar", () => {
-    expect(parseAppSourceFingerprint({ algorithm: "md5", files: {} })).toBe(
-      null,
-    );
-    expect(parseAppSourceFingerprint(null)).toBeNull();
-  });
-
-  test("writeAppSourceFingerprint records a sidecar the parser accepts", () => {
-    write("src/main.tsx", "src");
-    mkdirSync(join(root, "dist"), { recursive: true });
-    writeAppSourceFingerprint(root, join(root, "dist"));
-    const raw = JSON.parse(
-      readFileSync(join(root, "dist", SOURCE_FINGERPRINT_FILENAME), "utf-8"),
-    );
-    expect(parseAppSourceFingerprint(raw)?.files["src/main.tsx"]).toMatch(
-      /^[0-9a-f]{64}$/,
-    );
-  });
-});