npm - @vellumai/assistant - Versions diffs - 0.4.37 → 0.4.41 - Mend

@vellumai/assistant 0.4.37 → 0.4.41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (169) hide show

package/ARCHITECTURE.md +3 -3
package/README.md +13 -13
package/bun.lock +80 -24
package/docs/architecture/integrations.md +126 -128
package/docs/runbook-trusted-contacts.md +1 -1
package/docs/trusted-contact-access.md +12 -12
package/package.json +3 -1
package/src/__tests__/__snapshots__/ipc-snapshot.test.ts.snap +0 -14
package/src/__tests__/app-bundler.test.ts +209 -0
package/src/__tests__/app-compiler.test.ts +279 -0
package/src/__tests__/app-executors.test.ts +293 -483
package/src/__tests__/app-migration.test.ts +148 -0
package/src/__tests__/app-routes-csp.test.ts +202 -0
package/src/__tests__/avatar-e2e.test.ts +452 -0
package/src/__tests__/avatar-generator.test.ts +193 -0
package/src/__tests__/avatar-router.test.ts +186 -0
package/src/__tests__/browser-download-timeout.test.ts +28 -0
package/src/__tests__/bundled-skill-retrieval-guard.test.ts +9 -9
package/src/__tests__/call-domain.test.ts +3 -7
package/src/__tests__/credential-security-e2e.test.ts +19 -12
package/src/__tests__/credentials-cli.test.ts +30 -4
package/src/__tests__/guardian-verify-setup-skill-regression.test.ts +1 -1
package/src/__tests__/handlers-slack-config.test.ts +0 -72
package/src/__tests__/handlers-telegram-config.test.ts +19 -12
package/src/__tests__/handlers-twitter-config.test.ts +105 -48
package/src/__tests__/inbound-invite-redemption.test.ts +4 -4
package/src/__tests__/integration-status.test.ts +15 -5
package/src/__tests__/integrations-cli.test.ts +1 -1
package/src/__tests__/invite-redemption-service.test.ts +62 -7
package/src/__tests__/ipc-snapshot.test.ts +0 -8
package/src/__tests__/managed-avatar-client.test.ts +280 -0
package/src/__tests__/mcp-cli.test.ts +3 -3
package/src/__tests__/oauth-cli.test.ts +203 -0
package/src/__tests__/relay-server.test.ts +3 -3
package/src/__tests__/secret-onetime-send.test.ts +19 -12
package/src/__tests__/secure-keys.test.ts +78 -0
package/src/__tests__/session-messaging-secret-redirect.test.ts +3 -0
package/src/__tests__/slack-channel-config.test.ts +23 -16
package/src/__tests__/slack-share-routes.test.ts +263 -0
package/src/__tests__/sms-messaging-provider.test.ts +3 -1
package/src/__tests__/trusted-contact-lifecycle-notifications.test.ts +7 -7
package/src/__tests__/trusted-contact-multichannel.test.ts +3 -3
package/src/__tests__/trusted-contact-verification.test.ts +10 -10
package/src/__tests__/twilio-config.test.ts +15 -36
package/src/__tests__/twilio-provider.test.ts +4 -0
package/src/__tests__/twitter-auth-handler.test.ts +27 -14
package/src/__tests__/twitter-cli-error-shaping.test.ts +1 -1
package/src/__tests__/twitter-cli-routing.test.ts +38 -53
package/src/__tests__/twitter-oauth-client.test.ts +18 -47
package/src/__tests__/voice-invite-redemption.test.ts +27 -3
package/src/amazon/cart.ts +1 -1
package/src/amazon/client.ts +89 -7
package/src/approvals/guardian-request-resolvers.ts +2 -2
package/src/bundler/app-bundler.ts +77 -32
package/src/bundler/app-compiler.ts +195 -0
package/src/bundler/manifest.ts +1 -1
package/src/bundler/package-resolver.ts +185 -0
package/src/calls/call-domain.ts +4 -14
package/src/calls/relay-server.ts +2 -2
package/src/calls/twilio-config.ts +5 -24
package/src/calls/twilio-rest.ts +19 -5
package/src/cli/amazon.ts +74 -249
package/src/cli/audit.ts +2 -2
package/src/cli/autonomy.ts +9 -9
package/src/cli/channels.ts +5 -5
package/src/cli/completions.ts +27 -27
package/src/cli/config.ts +14 -14
package/src/cli/contacts.ts +27 -27
package/src/cli/credentials.ts +28 -28
package/src/cli/dev.ts +2 -2
package/src/cli/doctor.ts +2 -2
package/src/cli/email.ts +82 -82
package/src/cli/influencer.ts +13 -13
package/src/cli/integrations.ts +19 -144
package/src/cli/keys.ts +10 -10
package/src/cli/map.ts +4 -4
package/src/cli/mcp.ts +17 -17
package/src/cli/memory.ts +18 -18
package/src/cli/notifications.ts +13 -13
package/src/cli/oauth.ts +77 -0
package/src/cli/program.ts +2 -0
package/src/cli/sequence.ts +27 -27
package/src/cli/sessions.ts +12 -12
package/src/cli/trust.ts +8 -8
package/src/cli/twitter.ts +124 -70
package/src/config/bundled-skills/_shared/CLI_RETRIEVAL_PATTERN.md +1 -1
package/src/config/bundled-skills/agentmail/SKILL.md +34 -34
package/src/config/bundled-skills/amazon/SKILL.md +54 -54
package/src/config/bundled-skills/app-builder/SKILL.md +137 -3
package/src/config/bundled-skills/app-builder/tools/app-create.ts +10 -4
package/src/config/bundled-skills/configure-settings/SKILL.md +18 -18
package/src/config/bundled-skills/contacts/SKILL.md +12 -12
package/src/config/bundled-skills/doordash/lib/client.ts +7 -9
package/src/config/bundled-skills/email-setup/SKILL.md +4 -4
package/src/config/bundled-skills/frontend-design/icon.svg +16 -0
package/src/config/bundled-skills/google-oauth-setup/SKILL.md +143 -162
package/src/config/bundled-skills/guardian-verify-setup/SKILL.md +4 -4
package/src/config/bundled-skills/influencer/SKILL.md +13 -13
package/src/config/bundled-skills/mcp-setup/SKILL.md +11 -11
package/src/config/bundled-skills/phone-calls/SKILL.md +48 -54
package/src/config/bundled-skills/public-ingress/SKILL.md +6 -6
package/src/config/bundled-skills/slack-app-setup/SKILL.md +1 -1
package/src/config/bundled-skills/sms-setup/SKILL.md +3 -3
package/src/config/bundled-skills/telegram-setup/SKILL.md +2 -2
package/src/config/bundled-skills/twilio-setup/SKILL.md +136 -225
package/src/config/bundled-skills/twitter/SKILL.md +68 -44
package/src/config/bundled-skills/voice-setup/SKILL.md +2 -2
package/src/config/core-schema.ts +26 -0
package/src/config/env.ts +4 -0
package/src/config/feature-flag-registry.json +9 -1
package/src/config/schema.ts +8 -0
package/src/config/system-prompt.ts +6 -3
package/src/config/templates/BOOTSTRAP.md +7 -5
package/src/contacts/contacts-write.ts +5 -1
package/src/daemon/handlers/apps.ts +31 -4
package/src/daemon/handlers/config-ingress.ts +3 -3
package/src/daemon/handlers/config-integrations.ts +120 -49
package/src/daemon/handlers/config-slack-channel.ts +26 -7
package/src/daemon/handlers/config-slack.ts +1 -54
package/src/daemon/handlers/config-telegram.ts +28 -10
package/src/daemon/handlers/config.ts +1 -4
package/src/daemon/handlers/twitter-auth.ts +11 -4
package/src/daemon/ipc-contract/apps.ts +0 -13
package/src/daemon/ipc-contract-inventory.json +0 -2
package/src/daemon/lifecycle.ts +8 -1
package/src/daemon/session-messaging.ts +2 -2
package/src/daemon/tool-side-effects.ts +30 -0
package/src/email/providers/agentmail.ts +1 -1
package/src/email/providers/index.ts +1 -1
package/src/email/service.ts +1 -1
package/src/gallery/default-gallery.ts +538 -0
package/src/gallery/gallery-manifest.ts +5 -1
package/src/influencer/client.ts +8 -6
package/src/mcp/client.ts +1 -1
package/src/media/avatar-router.ts +99 -0
package/src/media/avatar-types.ts +60 -0
package/src/media/managed-avatar-client.ts +189 -0
package/src/memory/app-migration.ts +114 -0
package/src/memory/app-store.ts +11 -0
package/src/memory/qdrant-client.ts +1 -1
package/src/messaging/providers/slack/client.ts +12 -2
package/src/messaging/providers/sms/adapter.ts +6 -10
package/src/migrations/data-layout.ts +8 -1
package/src/oauth/token-persistence.ts +9 -6
package/src/runtime/assistant-scope.ts +5 -0
package/src/runtime/auth/route-policy.ts +4 -0
package/src/runtime/channel-readiness-service.ts +9 -4
package/src/runtime/gateway-internal-client.ts +11 -3
package/src/runtime/http-server.ts +2 -0
package/src/runtime/invite-redemption-service.ts +23 -13
package/src/runtime/middleware/twilio-validation.ts +2 -2
package/src/runtime/routes/app-routes.ts +131 -3
package/src/runtime/routes/inbound-stages/verification-intercept.ts +3 -3
package/src/runtime/routes/integration-routes.ts +2 -2
package/src/runtime/routes/slack-share-routes.ts +235 -0
package/src/runtime/routes/twilio-routes.ts +47 -34
package/src/schedule/integration-status.ts +2 -3
package/src/security/token-manager.ts +11 -3
package/src/tools/apps/executors.ts +116 -8
package/src/tools/browser/browser-manager.ts +30 -2
package/src/tools/browser/chrome-cdp.ts +31 -3
package/src/tools/credentials/vault.ts +9 -7
package/src/tools/executor.ts +4 -0
package/src/tools/system/avatar-generator.ts +55 -34
package/src/twitter/client.ts +1 -1
package/src/twitter/oauth-client.ts +31 -43
package/src/twitter/router.ts +25 -23
package/src/util/platform.ts +5 -0
package/src/slack/slack-webhook.ts +0 -66

package/src/__tests__/app-bundler.test.ts CHANGED Viewed

@@ -1,5 +1,11 @@
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import JSZip from "jszip";
 // Mock the logger before importing the module under test
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -8,10 +14,33 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
+// Temp directory for fake app data used in packageApp tests
+const testAppsDir = join(tmpdir(), `app-bundler-test-${Date.now()}`);
+// Mock app-store so packageApp can find our test apps
+const mockApps = new Map<string, Record<string, unknown>>();
+mock.module("../memory/app-store.js", () => ({
+  getApp: (id: string) => mockApps.get(id) ?? null,
+  getAppsDir: () => testAppsDir,
+  isMultifileApp: (app: Record<string, unknown>) => app.formatVersion === 2,
+}));
+// Mock content-id to avoid pulling in crypto internals
+mock.module("../util/content-id.js", () => ({
+  computeContentId: () => "abcd1234abcd1234",
+}));
+// Mock bundle-signer (not exercised in these tests)
+mock.module("./bundle-signer.js", () => ({
+  signBundle: async () => ({}),
+}));
 import {
   extractRemoteUrls,
   materializeAssets,
+  packageApp,
 } from "../bundler/app-bundler.js";
+import type { AppManifest } from "../bundler/manifest.js";
 // ---------------------------------------------------------------------------
 // extractRemoteUrls
@@ -323,3 +352,183 @@ describe("materializeAssets", () => {
     expect(result.rewrittenHtml).not.toContain(cssUrl);
   });
 });
+// ---------------------------------------------------------------------------
+// packageApp — multifile apps
+// ---------------------------------------------------------------------------
+describe("packageApp", () => {
+  afterEach(() => {
+    mockApps.clear();
+    try {
+      rmSync(testAppsDir, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup errors
+    }
+  });
+  /**
+   * Helper: set up a fake multifile app on disk with src/ and dist/ dirs
+   * so that compileApp (which we mock below) can pretend to succeed.
+   */
+  function setupMultifileApp(appId: string, opts?: { withCss?: boolean }) {
+    const appDir = join(testAppsDir, appId);
+    const srcDir = join(appDir, "src");
+    mkdirSync(srcDir, { recursive: true });
+    // Write minimal src/ so the app directory looks valid
+    if (opts?.withCss) {
+      writeFileSync(join(srcDir, "styles.css"), "body { margin: 0; }");
+      writeFileSync(
+        join(srcDir, "main.tsx"),
+        'import "./styles.css";\nexport default () => "hi";',
+      );
+    } else {
+      writeFileSync(join(srcDir, "main.tsx"), 'export default () => "hi";');
+    }
+    writeFileSync(
+      join(srcDir, "index.html"),
+      "<!DOCTYPE html><html><head></head><body></body></html>",
+    );
+    // Write the app JSON (getApp reads from {appsDir}/{id}.json)
+    const appDef = {
+      id: appId,
+      name: "Test Multifile App",
+      description: "A test app",
+      schemaJson: "{}",
+      htmlDefinition: "<unused>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      formatVersion: 2,
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+    return appDef;
+  }
+  function setupLegacyApp(appId: string) {
+    const appDir = join(testAppsDir, appId);
+    mkdirSync(appDir, { recursive: true });
+    const appDef = {
+      id: appId,
+      name: "Test Legacy App",
+      schemaJson: "{}",
+      htmlDefinition: "<html><body>Hello legacy</body></html>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+    return appDef;
+  }
+  test("packages a multifile app with compiled dist/ files in the zip", async () => {
+    const appId = "multi-test-1";
+    setupMultifileApp(appId, { withCss: true });
+    const result = await packageApp(appId);
+    const zipData = await readFile(result.bundlePath);
+    const zip = await JSZip.loadAsync(zipData);
+    // Verify compiled files are present
+    expect(zip.file("index.html")).not.toBeNull();
+    expect(zip.file("main.js")).not.toBeNull();
+    expect(zip.file("main.css")).not.toBeNull();
+    expect(zip.file("manifest.json")).not.toBeNull();
+    // Verify content matches what we wrote to dist/
+    const indexContent = await zip.file("index.html")!.async("string");
+    expect(indexContent).toContain('src="main.js"');
+    // main.js should contain compiled output (esbuild minifies the source)
+    const jsContent = await zip.file("main.js")!.async("string");
+    expect(jsContent.length).toBeGreaterThan(0);
+    // CSS was imported, so main.css should be present
+    const cssContent = await zip.file("main.css")!.async("string");
+    expect(cssContent).toContain("margin");
+  });
+  test("sets format_version to 2 in manifest for multifile apps", async () => {
+    const appId = "multi-test-2";
+    setupMultifileApp(appId);
+    const result = await packageApp(appId);
+    const zipData = await readFile(result.bundlePath);
+    const zip = await JSZip.loadAsync(zipData);
+    const manifestJson = await zip.file("manifest.json")!.async("string");
+    const manifest: AppManifest = JSON.parse(manifestJson);
+    expect(manifest.format_version).toBe(2);
+    expect(manifest.entry).toBe("index.html");
+    expect(manifest.name).toBe("Test Multifile App");
+  });
+  test("compile failure produces a clear error", async () => {
+    const appId = "multi-fail-1";
+    const appDir = join(testAppsDir, appId);
+    const srcDir = join(appDir, "src");
+    mkdirSync(srcDir, { recursive: true });
+    // Write intentionally broken source so esbuild fails
+    writeFileSync(join(srcDir, "main.tsx"), "const x: number = {{{BROKEN");
+    writeFileSync(
+      join(srcDir, "index.html"),
+      "<!DOCTYPE html><html><head></head><body></body></html>",
+    );
+    const appDef = {
+      id: appId,
+      name: "Broken App",
+      schemaJson: "{}",
+      htmlDefinition: "<unused>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      formatVersion: 2,
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+    await expect(packageApp(appId)).rejects.toThrow(
+      /Compilation failed for app "Broken App"/,
+    );
+  });
+  test("legacy app packaging remains unchanged (format_version 1)", async () => {
+    const appId = "legacy-test-1";
+    setupLegacyApp(appId);
+    const result = await packageApp(appId);
+    const zipData = await readFile(result.bundlePath);
+    const zip = await JSZip.loadAsync(zipData);
+    const manifestJson = await zip.file("manifest.json")!.async("string");
+    const manifest: AppManifest = JSON.parse(manifestJson);
+    expect(manifest.format_version).toBe(1);
+    // Legacy app should have index.html with the original content
+    const indexContent = await zip.file("index.html")!.async("string");
+    expect(indexContent).toContain("Hello legacy");
+    // Should NOT have main.js (not a compiled app)
+    expect(zip.file("main.js")).toBeNull();
+  });
+  test("multifile app without CSS omits main.css from zip", async () => {
+    const appId = "multi-no-css";
+    setupMultifileApp(appId, { withCss: false });
+    const result = await packageApp(appId);
+    const zipData = await readFile(result.bundlePath);
+    const zip = await JSZip.loadAsync(zipData);
+    expect(zip.file("index.html")).not.toBeNull();
+    expect(zip.file("main.js")).not.toBeNull();
+    expect(zip.file("main.css")).toBeNull();
+  });
+});

package/src/__tests__/app-compiler.test.ts ADDED Viewed

@@ -0,0 +1,279 @@
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { compileApp } from "../bundler/app-compiler.js";
+import {
+  ALLOWED_PACKAGES,
+  getCacheDir,
+  isBareImport,
+  packageName,
+  resolvePackage,
+} from "../bundler/package-resolver.js";
+// ---------------------------------------------------------------------------
+// Shared temp directory
+// ---------------------------------------------------------------------------
+let tempDir: string;
+beforeAll(async () => {
+  tempDir = await mkdtemp(join(tmpdir(), "app-compiler-test-"));
+});
+afterAll(async () => {
+  await rm(tempDir, { recursive: true, force: true });
+});
+/** Scaffold a minimal app directory with src/main.tsx and src/index.html. */
+async function scaffold(
+  name: string,
+  files: Record<string, string>,
+): Promise<string> {
+  const appDir = join(tempDir, name);
+  const srcDir = join(appDir, "src");
+  await mkdir(srcDir, { recursive: true });
+  for (const [filename, content] of Object.entries(files)) {
+    const filePath = join(srcDir, filename);
+    await writeFile(filePath, content);
+  }
+  return appDir;
+}
+const MINIMAL_HTML = `<!DOCTYPE html>
+<html>
+<head><title>Test</title></head>
+<body>
+</body>
+</html>`;
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe("compileApp", () => {
+  test("compiles minimal TSX app and produces dist/main.js + dist/index.html", async () => {
+    const appDir = await scaffold("basic", {
+      "main.tsx": `const App = () => { const el = document.createElement("div"); el.textContent = "hello"; return el; }; App();`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    expect(result.errors).toHaveLength(0);
+    expect(result.durationMs).toBeLessThan(5000);
+    // dist/main.js should exist and contain bundled code
+    const js = await readFile(join(appDir, "dist", "main.js"), "utf-8");
+    expect(js.length).toBeGreaterThan(0);
+    // dist/index.html should exist and have the script tag injected
+    const html = await readFile(join(appDir, "dist", "index.html"), "utf-8");
+    expect(html).toContain('src="main.js"');
+    expect(html).toContain('type="module"');
+  });
+  test("compiles preact JSX correctly", async () => {
+    const appDir = await scaffold("preact-jsx", {
+      "main.tsx": `import { render } from "preact";
+const App = () => <div>Hello</div>;
+render(<App />, document.body);`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    expect(result.errors).toHaveLength(0);
+    const js = await readFile(join(appDir, "dist", "main.js"), "utf-8");
+    // The output should contain preact's runtime code (bundled)
+    expect(js.length).toBeGreaterThan(100);
+  });
+  test("strips TypeScript types", async () => {
+    const appDir = await scaffold("ts-types", {
+      "main.tsx": `interface Greeting { name: string; }
+const greet = (g: Greeting): string => g.name;
+console.log(greet({ name: "world" }));`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    const js = await readFile(join(appDir, "dist", "main.js"), "utf-8");
+    // Interface declarations should be stripped
+    expect(js).not.toContain("interface");
+    expect(js).toContain("world");
+  });
+  test("CSS imports produce dist/main.css and inject link tag", async () => {
+    const appDir = await scaffold("css-import", {
+      "main.tsx": `import "./style.css";
+console.log("styled");`,
+      "style.css": `body { background: red; }`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    const css = await readFile(join(appDir, "dist", "main.css"), "utf-8");
+    expect(css).toContain("background");
+    const html = await readFile(join(appDir, "dist", "index.html"), "utf-8");
+    expect(html).toContain('href="main.css"');
+    expect(html).toContain("stylesheet");
+  });
+  test("returns ok: false with diagnostics on syntax error", async () => {
+    const appDir = await scaffold("syntax-error", {
+      "main.tsx": `const x: number = <<<INVALID>>>;`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toBeTruthy();
+  });
+  test("dist/index.html has script tag injected", async () => {
+    const appDir = await scaffold("script-injection", {
+      "main.tsx": `console.log("hi");`,
+      "index.html": `<!DOCTYPE html>
+<html>
+<head><title>Inject Test</title></head>
+<body>
+<div id="app"></div>
+</body>
+</html>`,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    const html = await readFile(join(appDir, "dist", "index.html"), "utf-8");
+    expect(html).toContain('<script type="module" src="main.js"></script>');
+    // Original content should be preserved
+    expect(html).toContain('<div id="app"></div>');
+  });
+  test("does not duplicate script tag if already present", async () => {
+    const appDir = await scaffold("no-dup-script", {
+      "main.tsx": `console.log("hi");`,
+      "index.html": `<!DOCTYPE html>
+<html>
+<head><title>Test</title></head>
+<body>
+<script type="module" src="main.js"></script>
+</body>
+</html>`,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    const html = await readFile(join(appDir, "dist", "index.html"), "utf-8");
+    const matches = html.match(/src="main\.js"/g);
+    expect(matches).toHaveLength(1);
+  });
+  test("disallowed package import produces a clear error", async () => {
+    const appDir = await scaffold("disallowed-pkg", {
+      "main.tsx": `import leftpad from "left-pad";\nconsole.log(leftpad("hi", 5));`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain("not in the allowed list");
+    expect(result.errors[0].text).toContain("left-pad");
+  });
+  test("allowed package (zod) compiles successfully", async () => {
+    const appDir = await scaffold("allowed-pkg-zod", {
+      "main.tsx": `import { z } from "zod";\nconst schema = z.string();\nconsole.log(schema.parse("hello"));`,
+      "index.html": MINIMAL_HTML,
+    });
+    const result = await compileApp(appDir);
+    expect(result.ok).toBe(true);
+    expect(result.errors).toHaveLength(0);
+    const js = await readFile(join(appDir, "dist", "main.js"), "utf-8");
+    expect(js.length).toBeGreaterThan(100);
+  }, 30_000);
+  test("allowed package uses shared cache on second build", async () => {
+    // First build installs the package
+    const appDir1 = await scaffold("cache-test-1", {
+      "main.tsx": `import { z } from "zod";\nconsole.log(z.string());`,
+      "index.html": MINIMAL_HTML,
+    });
+    const r1 = await compileApp(appDir1);
+    expect(r1.ok).toBe(true);
+    // The cache dir should now have zod
+    const cacheDir = getCacheDir();
+    expect(existsSync(join(cacheDir, "node_modules", "zod"))).toBe(true);
+    // Second build should reuse the cache (no install needed)
+    const appDir2 = await scaffold("cache-test-2", {
+      "main.tsx": `import { z } from "zod";\nconst s = z.number();\nconsole.log(s.parse(42));`,
+      "index.html": MINIMAL_HTML,
+    });
+    const r2 = await compileApp(appDir2);
+    expect(r2.ok).toBe(true);
+  }, 30_000);
+});
+// ---------------------------------------------------------------------------
+// Package resolver unit tests
+// ---------------------------------------------------------------------------
+describe("package-resolver", () => {
+  test("isBareImport identifies bare specifiers", () => {
+    expect(isBareImport("date-fns")).toBe(true);
+    expect(isBareImport("zod")).toBe(true);
+    expect(isBareImport("@scope/pkg")).toBe(true);
+    expect(isBareImport("./local")).toBe(false);
+    expect(isBareImport("../parent")).toBe(false);
+    expect(isBareImport("/absolute")).toBe(false);
+    expect(isBareImport("preact")).toBe(false);
+    expect(isBareImport("preact/hooks")).toBe(false);
+    expect(isBareImport("react")).toBe(false);
+    expect(isBareImport("react-dom")).toBe(false);
+  });
+  test("packageName extracts top-level name", () => {
+    expect(packageName("date-fns")).toBe("date-fns");
+    expect(packageName("date-fns/format")).toBe("date-fns");
+    expect(packageName("@scope/pkg")).toBe("@scope/pkg");
+    expect(packageName("@scope/pkg/sub")).toBe("@scope/pkg");
+  });
+  test("resolvePackage returns null for disallowed packages", async () => {
+    const result = await resolvePackage("left-pad");
+    expect(result).toBeNull();
+  });
+  test("ALLOWED_PACKAGES contains expected entries", () => {
+    expect(ALLOWED_PACKAGES).toContain("date-fns");
+    expect(ALLOWED_PACKAGES).toContain("chart.js");
+    expect(ALLOWED_PACKAGES).toContain("lodash-es");
+    expect(ALLOWED_PACKAGES).toContain("zod");
+    expect(ALLOWED_PACKAGES).toContain("clsx");
+    expect(ALLOWED_PACKAGES).toContain("lucide");
+  });
+});