@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/manifest.test.ts

@@ -0,0 +1,226 @@
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { describe, expect, it } from "vitest";
+
+describe("extension manifest", () => {
+  it("keeps privileged browser capabilities optional and out of the default package", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      manifest_version: number;
+      version: string;
+      key?: string;
+      permissions: string[];
+      optional_permissions?: string[];
+      host_permissions?: string[];
+      content_scripts?: unknown[];
+      sandbox?: { pages?: string[] };
+      offscreen?: { document?: string; reasons?: string[]; justification?: string };
+    };
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    expect(manifest.manifest_version).toBe(3);
+    expect(manifest.version).toBe(packagejson.version);
+    expect(manifest.permissions).toEqual(["activeTab", "storage", "scripting", "sidePanel"]);
+    expect(manifest.optional_permissions ?? []).toEqual([
+      "tabs",
+      "downloads",
+      "clipboardRead",
+      "clipboardWrite",
+      "offscreen",
+      "nativeMessaging",
+    ]);
+    expect(manifest.host_permissions ?? []).toEqual([]);
+    expect(manifest.content_scripts ?? []).toEqual([]);
+    expect(manifest.sandbox).toEqual({ pages: ["sandbox.html"] });
+    expect(manifest.offscreen).toMatchObject({ document: "offscreen.html", reasons: ["DOM_PARSER", "WORKERS"] });
+    expect((manifest.offscreen as { justification?: string }).justification ?? "").toMatch(
+      /offscreen document worker pool/,
+    );
+  });
+
+  it("keeps the native messaging permission optional only so the native bridge stays a per install user choice", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      permissions: string[];
+      optional_permissions?: string[];
+    };
+    expect(manifest.permissions).not.toContain("nativeMessaging");
+    expect(manifest.optional_permissions ?? []).toContain("nativeMessaging");
+  });
+
+  it("keeps a stable, strictly decodable identity key", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as { key?: string };
+    const key = manifest.key ?? "";
+    expect(key.length % 4).toBe(0);
+    expect(key).toMatch(/^[A-Za-z0-9+/]+={0,2}$/);
+    const der = Buffer.from(key, "base64");
+    expect(der.length).toBe(294);
+    expect(der.subarray(0, 2).equals(Buffer.from([0x30, 0x82]))).toBe(true);
+    expect(der.readUInt16BE(2)).toBe(der.length - 4);
+    const digest = createHash("sha256").update(der).digest("hex");
+    expect(digest).toMatch(/^[0-9a-f]{64}$/);
+    /* the identity pin rides the generated build artifact: the recorded digest never stays hard coded in a source file, the build writes it into dist/checksums.txt on every run and this pass verifies the manifest key against that artifact whenever the build ran */
+    if (existsSync("dist/checksums.txt")) {
+      const recorded = (await readFile("dist/checksums.txt", "utf8"))
+        .split("\n")
+        .find((line) => line.trim().endsWith("  manifest.json key"));
+      expect(recorded?.split("  ")[0]).toBe(digest);
+    }
+  });
+
+  it("declares the optionspage as the options surface and the dashboardpage chrome url without new permissions", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      options_ui?: { page?: string; open_in_tab?: boolean };
+      chrome_url_overrides?: Record<string, string>;
+    };
+    expect(manifest.options_ui).toMatchObject({ page: "optionspage.html", open_in_tab: true });
+    expect(manifest.chrome_url_overrides).toEqual({ newtab: "dashboardpage.html" });
+  });
+
+  it("declares the icon family of the final polish at every required size with payloads that decode to the declared pixels", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      icons?: Record<string, string>;
+      action?: { default_icon?: Record<string, string> };
+    };
+    const expected = {
+      "16": "icons/16.png",
+      "19": "icons/19.png",
+      "32": "icons/32.png",
+      "38": "icons/38.png",
+      "48": "icons/48.png",
+      "128": "icons/128.png",
+    };
+    expect(manifest.icons).toEqual(expected);
+    expect(manifest.action?.default_icon).toEqual(expected);
+    const iconssource = await readFile("web/icons.ts", "utf8");
+    const iconblock =
+      /export const iconpayloads: Record<string, string> = \{([\s\S]*?)\};/.exec(iconssource)?.[1] ?? "";
+    const iconentries = [...iconblock.matchAll(/"(\d+)": "([A-Za-z0-9+/=]+)"/g)].map((match) => ({
+      size: Number(match[1]),
+      base64: match[2] ?? "",
+    }));
+    expect(iconentries.map((entry) => entry.size).sort((a, b) => a - b)).toEqual([16, 19, 32, 38, 48, 128]);
+    const signature = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    for (const entry of iconentries) {
+      const bytes = Buffer.from(entry.base64, "base64");
+      expect(bytes.subarray(0, 8).equals(signature)).toBe(true);
+      expect(bytes.readUInt32BE(16)).toBe(entry.size);
+      expect(bytes.readUInt32BE(20)).toBe(entry.size);
+    }
+  });
+});
+
+/* ── The frozen capability manifest declarations of the 1.1.91 api freeze. ── */
+import { capmanifestof } from "../apifreeze.js";
+
+describe("the frozen capability manifest declarations", () => {
+  it("matches the manifest permissions with the capmanifest declarations of every surface", async () => {
+    if (!existsSync("dist/caps"))
+      return; /* the capmanifest artifacts ride the build: the pass runs after pnpm build in the validate chain and the ci lanes */
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      version: string;
+      permissions: string[];
+      optional_permissions?: string[];
+      optional_host_permissions?: string[];
+    };
+    const declared = new Set<string>();
+    for (const surface of ["background", "sidepanel", "popup", "mcp"] as const) {
+      const stored = JSON.parse(await readFile(`dist/caps/${surface}.json`, "utf8")) as {
+        surface: string;
+        release: string;
+        protocolmajor: number;
+        permissions: string[];
+      };
+      expect(stored.surface).toBe(surface);
+      expect(stored.release).toBe(manifest.version);
+      expect(stored.protocolmajor).toBe(2);
+      expect(capmanifestof(surface).permissions).toEqual(stored.permissions);
+      for (const permission of stored.permissions) declared.add(permission);
+    }
+    const requested = [
+      ...manifest.permissions,
+      ...(manifest.optional_permissions ?? []),
+      ...(manifest.optional_host_permissions ?? []),
+    ];
+    for (const permission of requested) expect(declared.has(permission)).toBe(true);
+    for (const permission of declared) expect(requested.includes(permission)).toBe(true);
+    expect(capmanifestof("pagebridge").permissions).toEqual([]);
+    expect(capmanifestof("cli").permissions).toEqual([]);
+    expect(capmanifestof("library").permissions).toEqual([]);
+  });
+});
+
+/* ── The 1.1.95 strict content security policy of the security hardening release. ── */
+
+describe("the strict content security policy", () => {
+  it("pins the extension pages of the root manifest and both overlays to local scripts and own framing", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      content_security_policy?: { extension_pages?: string };
+      browsers?: Record<string, { content_security_policy?: { extension_pages?: string } }>;
+    };
+    const policy = manifest.content_security_policy?.extension_pages ?? "";
+    expect(policy).toBe("script-src 'self'; object-src 'self'; frame-ancestors 'self'");
+    expect(manifest.browsers?.firefox?.content_security_policy?.extension_pages).toBe(policy);
+    expect(manifest.browsers?.safari?.content_security_policy?.extension_pages).toBe(policy);
+  });
+
+  it("keeps every declared source free of wildcards, remote hosts, eval and inline", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      content_security_policy?: { extension_pages?: string };
+      browsers?: Record<string, { content_security_policy?: { extension_pages?: string } }>;
+    };
+    const policies = [
+      manifest.content_security_policy?.extension_pages,
+      manifest.browsers?.firefox?.content_security_policy?.extension_pages,
+      manifest.browsers?.safari?.content_security_policy?.extension_pages,
+    ].filter((entry): entry is string => typeof entry === "string");
+    expect(policies).toHaveLength(3);
+    for (const policy of policies)
+      for (const source of policy.split(";").flatMap((directive) => directive.trim().split(/\s+/).slice(1))) {
+        expect(source.includes("*")).toBe(false);
+        expect(/^(https?|wss?|data):/i.test(source)).toBe(false);
+        expect(source.includes("unsafe-eval")).toBe(false);
+        expect(source.includes("unsafe-inline")).toBe(false);
+      }
+  });
+});
+
+/* ── The 1.1.96 multi agent certification: the dashboard surface permissions of the dashdone completion. ── */
+
+describe("the multi agent dashboard surface", () => {
+  it("carries every multi agent panel of the dashdone completion inside the declared dashboardpage surface without new permissions", async () => {
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as {
+      permissions: string[];
+      optional_permissions?: string[];
+      chrome_url_overrides?: Record<string, string>;
+    };
+    const webdesign = await readFile("web/design.html", "utf8");
+    const dashboardmatch = /<template data-surface="dashboardpage">([\s\S]*?)<\/template>/.exec(webdesign);
+    expect(dashboardmatch).not.toBeNull();
+    const surface = dashboardmatch?.[1] ?? "";
+    /* every multi agent panel the dashdone completion ships rides the dashboardpage surface the manifest already declares as the newtab override */
+    for (const panel of [
+      "multiagentoverview",
+      "agentstatuscards",
+      "sharedqueueview",
+      "queuelanefilter",
+      "messageflow",
+      "conflictlog",
+      "agentcostpanel",
+      "escalationinbox",
+      "timelinescrubber",
+      "aggregatetimeline",
+      "killswitch",
+      "reportdownload",
+    ]) {
+      expect(surface.includes(`id="${panel}"`)).toBe(true);
+    }
+    /* the multi agent panels add no permission: the surface renders from the storage, the scripting and the active tab grants the dashboardpage already held */
+    expect(manifest.chrome_url_overrides).toEqual({ newtab: "dashboardpage.html" });
+    expect(manifest.permissions).toEqual(["activeTab", "storage", "scripting", "sidePanel"]);
+    expect((manifest.optional_permissions ?? []).includes("tabs")).toBe(true);
+    for (const reference of [...surface.matchAll(/(?:src|href)\s*=\s*["']([^"']+)["']/g)].map(
+      (match) => match[1] ?? "",
+    )) {
+      expect(/^(https?|wss?|data):/i.test(reference)).toBe(false);
+    }
+  });
+});

package/tests/maskinputs.test.ts

@@ -0,0 +1,150 @@
+import { describe, expect, it } from "vitest";
+import {
+  defaultmaskshapes,
+  fieldshapekind,
+  maskexport,
+  maskfield,
+  maskformstate,
+  maskmarker,
+  maskobservation,
+  maskrecord,
+  maskstoredvalues,
+  masktypedvalues,
+  maskvalue,
+  maskingfield,
+  shapesof,
+} from "../security.js";
+import type { maskrule, observation, runsettings, toolstep } from "../types.js";
+
+const shapes = [...defaultmaskshapes];
+
+function observationfixture(): observation {
+  return {
+    schemaversion: 3,
+    url: "https://example.com/login",
+    title: "Login",
+    textpreview: "Login",
+    textlength: 5,
+    forms: [
+      { label: "User", type: "text", name: "username" },
+      { label: "Password", type: "password", name: "password", options: ["hunter2"] },
+    ],
+    interactive: [],
+    capturedat: 1_000,
+  };
+}
+
+describe("maskinputs field shapes", () => {
+  it("recognizes the documented password, token, card and secret field shapes", () => {
+    expect(defaultmaskshapes).toEqual(["password", "token", "card", "secret"]);
+    expect(fieldshapekind("userpassword")).toBe("password");
+    expect(fieldshapekind("passwd")).toBe("password");
+    expect(fieldshapekind("pwdconfirm")).toBe("password");
+    expect(fieldshapekind("apitoken")).toBe("token");
+    expect(fieldshapekind("apikey")).toBe("token");
+    expect(fieldshapekind("authorization")).toBe("token");
+    expect(fieldshapekind("cardnumber")).toBe("card");
+    expect(fieldshapekind("cvv")).toBe("card");
+    expect(fieldshapekind("clientsecret")).toBe("secret");
+    expect(fieldshapekind("username")).toBeUndefined();
+    expect(maskingfield("password", [])).toBe(true);
+    expect(maskingfield("accountnumber", ["accountnumber"])).toBe(true);
+    expect(maskingfield("accountnumber", [])).toBe(false);
+  });
+
+  it("masks one value behind the redaction marker while an empty value stays empty", () => {
+    expect(maskmarker).toBe("[redacted]");
+    expect(maskvalue("hunter2")).toBe("[redacted]");
+    expect(maskvalue("")).toBe("");
+    expect(maskfield({ name: "password", value: "hunter2", shapes })).toBe("[redacted]");
+    expect(maskfield({ name: "username", value: "ada", shapes })).toBe("ada");
+  });
+
+  it("joins the documented families with the user shapes and the per origin mask rules", () => {
+    const settings: runsettings = { maskshapes: ["AccountNumber"] };
+    const rules: maskrule[] = [
+      { id: "r1", shapes: ["iban"], createdat: 1 },
+      { id: "r2", origin: "https://other.example", shapes: ["routing"], createdat: 1 },
+    ];
+    const effective = shapesof({ settings, rules, origin: "https://example.com" });
+    expect(effective).toContain("password");
+    expect(effective).toContain("accountnumber");
+    expect(effective).toContain("iban");
+    expect(effective).not.toContain("routing");
+    const scoped = shapesof({ settings, rules, origin: "https://other.example" });
+    expect(scoped).toContain("routing");
+    expect(shapesof({ rules: [] })).toEqual([...defaultmaskshapes]);
+  });
+});
+
+describe("maskinputs across record paths", () => {
+  it("masks typed values and option payloads of steps before they reach the log writer", () => {
+    const secret: toolstep = {
+      id: "s1",
+      kind: "type",
+      target: "input[name=password]",
+      value: "hunter2",
+      summary: "Type the password.",
+      risk: "sensitive",
+      options: JSON.stringify({ password: "hunter2", note: "plain" }),
+    };
+    const masked = masktypedvalues({ step: secret, shapes });
+    expect(masked.value).toBe("[redacted]");
+    expect(JSON.parse(masked.options ?? "{}")).toEqual({ password: "[redacted]", note: "plain" });
+    const plain: toolstep = {
+      id: "s2",
+      kind: "type",
+      target: "input[name=nickname]",
+      value: "ada",
+      summary: "Type the nickname.",
+      risk: "interaction",
+    };
+    const kept = masktypedvalues({ step: plain, shapes });
+    expect(kept.value).toBe("ada");
+    const malformed: toolstep = { ...plain, options: "{not json" };
+    expect(masktypedvalues({ step: malformed, shapes }).options).toBe("{not json");
+  });
+
+  it("masks form state while keeping the field shapes in observation payloads", () => {
+    const fields = [
+      { name: "username", value: "ada", type: "text" },
+      { name: "password", value: "hunter2", type: "password" },
+    ];
+    const masked = maskformstate(fields, shapes);
+    expect(masked[0]).toEqual({ name: "username", value: "ada", type: "text" });
+    expect(masked[1]?.value).toBe("[redacted]");
+    expect(masked[1]?.name).toBe("password");
+    const shot = maskobservation(observationfixture(), shapes);
+    expect(shot.forms[0]?.options).toBeUndefined();
+    expect(shot.forms[1]?.options).toEqual(["[redacted]"]);
+    expect(shot.forms[1]?.name).toBe("password");
+    expect(shot.forms[1]?.label).toBe("Password");
+  });
+
+  it("masks stored values and deep record payloads", () => {
+    const stored = maskstoredvalues({ sessiontoken: "tok", theme: "dark" }, shapes);
+    expect(stored.sessiontoken).toBe("[redacted]");
+    expect(stored.theme).toBe("dark");
+    const record = maskrecord(
+      { password: "hunter2", nested: { cardnumber: "4242", note: "plain" }, count: 3, flags: [1, 2] },
+      shapes,
+    );
+    expect(record.password).toBe("[redacted]");
+    expect((record.nested as Record<string, unknown>).cardnumber).toBe("[redacted]");
+    expect((record.nested as Record<string, unknown>).note).toBe("plain");
+    expect(record.count).toBe(3);
+  });
+
+  it("excludes masked values from every export of the run record", () => {
+    const runrecord = {
+      stepid: "s1",
+      summary: "The fill ran.",
+      details: { password: "hunter2", username: "ada", fields: [{ name: "card", value: "4242424242424242" }] },
+    };
+    const exported = maskexport(runrecord, shapes) as typeof runrecord;
+    expect(exported.details.password).toBe("[redacted]");
+    expect(exported.details.username).toBe("ada");
+    expect(exported.details.fields[0]?.name).toBe("card");
+    expect(exported.details.fields[0]?.value).toBe("[redacted]");
+  });
+});

package/tests/matrixverify.test.ts

@@ -0,0 +1,111 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { describe, expect, it } from "vitest";
+
+const execute = promisify(execFile);
+
+/* ── The release candidate verification matrix coverage. ── */
+
+describe("the release candidate verification matrix artifact", () => {
+  it("declares every cell family the gate enumerates over the candidate surface", async () => {
+    const source = await readFile("tests/matrixverify.mjs", "utf8");
+    for (const family of ["kinds", "surfaces", "cli", "mcp", "migration", "importers", "gates"])
+      expect(source).toContain(`family: "${family}"`);
+    /* the gate covers the fake tab provider of every browser kind, the full kind catalog and the standing gates */
+    expect(source).toContain('["chromium", "firefox", "safari"]');
+    expect(source).toContain("actionkindcatalog");
+    expect(source).toContain("tests/artifacts/matrixverify.json");
+    expect(source).toContain("process.exitCode = 1");
+  });
+
+  it("covers every matrix cell with a passing outcome once the gate has run", async () => {
+    const artifactpath = "tests/artifacts/matrixverify.json";
+    const built = existsSync("dist/index.js");
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    /* the matrix joins the recorded artifacts of the agent, cost, documentation and sweep gates beside its self contained subprocess cells, so the lane independence holds only where those artifacts exist: a built tree with its inputs present runs the gate itself, while a lane that skipped the earlier gates asserts the source declarations only and leaves the matrix verification to the gate chain that joins the matrix in order */
+    const inputs = [
+      "tests/artifacts/agentcert.json",
+      "tests/artifacts/costcert.json",
+      "tests/artifacts/doccheck.json",
+      "tests/artifacts/sweep.json",
+    ];
+    const inputsready = inputs.every((input) => existsSync(input));
+    if (built && inputsready && !existsSync(artifactpath)) await execute("node", ["tests/matrixverify.mjs"]);
+    if (built && inputsready && existsSync(artifactpath)) {
+      const stored = JSON.parse(await readFile(artifactpath, "utf8")) as { release: string };
+      if (stored.release !== packagejson.version) await execute("node", ["tests/matrixverify.mjs"]);
+    }
+    const stored = existsSync(artifactpath);
+    if (built && inputsready) expect(stored).toBe(true);
+    if (!stored) return;
+    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
+      release: string;
+      matrix: { browsers: string[]; kinds: number; cells: number };
+      cells: Array<{ family: string; name: string; outcome: string }>;
+      coverage: number;
+      summary: { total: number; passed: number; failed: number };
+    };
+    expect(report.release).toBe(packagejson.version);
+    expect(report.summary.failed).toBe(0);
+    expect(report.summary.passed).toBe(report.summary.total);
+    expect(report.coverage).toBe(100);
+    expect(report.matrix.browsers).toEqual(["chromium", "firefox", "safari"]);
+    expect(report.matrix.kinds).toBeGreaterThan(300);
+    expect(report.matrix.cells).toBe(report.summary.total);
+    /* the kind cells cover every browser kind of the fake tab provider */
+    for (const browser of report.matrix.browsers) {
+      expect(report.cells.some((cell) => cell.family === "kinds" && cell.name.includes(browser))).toBe(true);
+    }
+    /* the gate cells cover the poolaudit, the api freeze, the csp audit and the permission diff as subprocess runs, and the agentcert, costcert, doccheck and sweep artifacts as recorded evidence */
+    const gates = report.cells.filter((cell) => cell.family === "gates").map((cell) => cell.name);
+    for (const name of [
+      "the pool audit gate runs green over the 626 item pool",
+      "the api freeze gate runs green over the frozen contract",
+      "the csp audit gate runs green over the content security policy",
+      "the permission diff gate runs green over the versioned baseline",
+      "the agentcert artifact records a green run",
+      "the costcert artifact records a green run",
+      "the doccheck artifact records a green run",
+      "the sweep artifact records a green run",
+    ])
+      expect(gates).toContain(name);
+    /* the migration cell covers the version one window and the importer cells cover the fixture formats */
+    expect(report.cells.some((cell) => cell.family === "migration" && cell.name.includes("version one"))).toBe(true);
+    expect(report.cells.filter((cell) => cell.family === "importers").length).toBeGreaterThanOrEqual(3);
+  });
+});
+
+describe("the release candidate pool audit artifact", () => {
+  it("records the full pool disposition with no unknown item", async () => {
+    const artifactpath = "tests/artifacts/poolcoverage.json";
+    const built = existsSync("dist/index.js");
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    if (built && !existsSync(artifactpath)) await execute("node", ["tests/poolaudit.mjs"]);
+    if (built && existsSync(artifactpath)) {
+      const stored = JSON.parse(await readFile(artifactpath, "utf8")) as { release: string };
+      if (stored.release !== packagejson.version) await execute("node", ["tests/poolaudit.mjs"]);
+    }
+    const stored = existsSync(artifactpath);
+    if (built) expect(stored).toBe(true);
+    if (!stored) return;
+    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
+      release: string;
+      corpus: number;
+      pool: { total: number; implemented: number; planned: number; unknown: number };
+      groups: Record<string, { total: number; implemented: number; planned: number; unknown: number }>;
+      summary: { failed: number };
+    };
+    expect(report.release).toBe(packagejson.version);
+    expect(report.summary.failed).toBe(0);
+    expect(report.pool.total).toBe(626);
+    expect(report.pool.unknown).toBe(0);
+    expect(report.pool.implemented).toBeGreaterThan(590);
+    expect(report.pool.implemented + report.pool.planned).toBe(report.pool.total);
+    const groupcount = Object.keys(report.groups).length;
+    expect(groupcount).toBeGreaterThan(10);
+    for (const group of Object.values(report.groups))
+      expect(group.total).toBe(group.implemented + group.planned + group.unknown);
+  });
+});

package/tests/mavenpack.test.ts

@@ -0,0 +1,75 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+import { mavenattachedartifacts, mavenjarresources } from "../pack.js";
+
+describe("mavenpack", () => {
+  it("embeds every consumption mode as flat root resources inside the single distribution jar", () => {
+    expect(mavenjarresources()).toEqual([
+      "index.js",
+      "index.cjs",
+      "devthink.umd.js",
+      "checksums.txt",
+      "cli.js",
+      "headless.js",
+      "mcp.js",
+      "server.js",
+      "http.js",
+    ]);
+  });
+
+  it("attaches the declarations as classifier artifacts beside the extension zip", () => {
+    const attached = mavenattachedartifacts("1.1.99");
+    expect(attached).toEqual([
+      { classifier: "extension", type: "zip", path: "dist/devthink1.1.99.zip" },
+      { classifier: "declarations", type: "zip", path: "dist/devthink-declarations-1.1.99.zip" },
+    ]);
+    expect(() => mavenattachedartifacts("not-a-version")).toThrow();
+  });
+
+  it("records the devthink coordinates and the license the pom carries", async () => {
+    const rootpom = await readFile("pom.xml", "utf8");
+    expect(rootpom).toContain("<groupId>io.github.wenathlan</groupId>");
+    expect(rootpom).toContain("<artifactId>devthink</artifactId>");
+    expect(rootpom).toContain("<packaging>jar</packaging>");
+    expect(rootpom).toContain("<url>https://github.com/wenathlan/devthink</url>");
+    expect(rootpom).toContain("scm:git:https://github.com/wenathlan/devthink.git");
+    expect(rootpom).toContain("<name>GPL-3.0-only</name>");
+    expect(rootpom).toContain("<url>https://www.gnu.org/licenses/gpl-3.0.html</url>");
+    expect(rootpom).not.toContain("wenathlan/extension");
+  });
+
+  it("keeps the release version under the revision property so the resolver stamps one source", async () => {
+    const rootpom = await readFile("pom.xml", "utf8");
+    const packageversion = String(JSON.parse(await readFile("package.json", "utf8")).version);
+    expect(rootpom).toContain("<version>${revision}</version>");
+    expect(rootpom).toContain(`<revision>${packageversion}</revision>`);
+  });
+
+  it("publishes the single distribution to the GitHub Packages repository the pom declares", async () => {
+    const rootpom = await readFile("pom.xml", "utf8");
+    expect(rootpom).toContain("<distributionManagement>");
+    expect(rootpom).toContain("<id>github</id>");
+    expect(rootpom).toContain("https://maven.pkg.github.com/wenathlan/devthink");
+  });
+
+  it("renders the pom with the single jar packaging and the flat root resource includes of every mode", async () => {
+    const rootpom = await readFile("pom.xml", "utf8");
+    for (const resource of mavenjarresources()) expect(rootpom).toContain(`<include>${resource}</include>`);
+    expect(rootpom).not.toContain("<targetPath>");
+    expect(rootpom).not.toMatch(/[0-9a-f]{40,}/);
+  });
+
+  it("keeps the checked-in pom mirroring the maven layout so the descriptor never drifts", async () => {
+    const rootpom = await readFile("pom.xml", "utf8");
+    /* every attached classifier artifact of the pack module lands in the build helper the pom pins, resolved through the project properties so the attachment stays version driven */
+    for (const artifact of mavenattachedartifacts("1.1.99")) {
+      const attachedfile = "${project.basedir}/" + artifact.path.replace("1.1.99", "${project.version}");
+      expect(rootpom).toContain(`<file>${attachedfile}</file>`);
+      expect(rootpom).toContain(`<classifier>${artifact.classifier}</classifier>`);
+    }
+    expect(rootpom).toContain("<artifactId>build-helper-maven-plugin</artifactId>");
+    expect(rootpom).toContain("<version>3.6.1</version>");
+    expect(rootpom).toContain("<id>attach-extension-zip</id>");
+    expect(rootpom).toContain("<goal>attach-artifact</goal>");
+  });
+});