create-yss-spec 2.1.5 → 2.1.7

package/template/.hermes/skills/drawio/scripts/adapters/code-imports.test.js

@@ -1,80 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { applyAutoLayout } from '../dsl/auto-layout.js'
-import { specToDrawioXml, validateSpec, validateXml } from '../dsl/spec-to-drawio.js'
-import { createCodeClassIdentity, createCodeIdentity } from './identity.js'
-import { projectGraphToSpec } from './projection-to-spec.js'
-import { loadOptionalParser, MAX_CODE_FILE_BYTES, scanCodeProject } from './code-common.js'
-import { parseJavaScriptImportsProject } from './js-code.js'
-
-function projectFixture() {
-  const root = mkdtempSync(join(tmpdir(), 'drawio-code-'))
-  writeFileSync(join(root, 'a.js'), "import './b.js'\n")
-  writeFileSync(join(root, 'b.js'), 'export const b = 1\n')
-  return root
-}
-
-test('code class identity extends the canonical module identity', () => {
-  const moduleIdentity = createCodeIdentity({ language: 'python', modulePath: 'pkg/model.py' })
-  assert.deepEqual(createCodeClassIdentity({ moduleIdentity, qualifiedClassName: 'Order' }), {
-    scheme: 'code-class',
-    key: '["code-module\\u0000python/pkg/model.py","Order"]'
-  })
-  assert.throws(
-    () => createCodeClassIdentity({ moduleIdentity, qualifiedClassName: '../Order' }),
-    (error) => error.code === 'IDENTITY_INVALID'
-  )
-})
-
-test('code project scanning is sorted, bounded, and rejects non-directories', () => {
-  const root = projectFixture()
-  try {
-    mkdirSync(join(root, 'node_modules'))
-    writeFileSync(join(root, 'node_modules', 'ignored.js'), 'export {}\n')
-    const scan = scanCodeProject(root, { extensions: ['.js'] })
-    assert.deepEqual(scan.files.map((file) => file.path), ['a.js', 'b.js'])
-    assert.throws(() => scanCodeProject(join(root, 'a.js'), { extensions: ['.js'] }), /directory/)
-  } finally {
-    rmSync(root, { recursive: true, force: true })
-  }
-})
-
-test('code project scanning enforces the per-file capacity bound', () => {
-  const root = mkdtempSync(join(tmpdir(), 'drawio-code-'))
-  try {
-    writeFileSync(join(root, 'large.js'), Buffer.alloc(MAX_CODE_FILE_BYTES + 1, 0x61))
-    assert.throws(
-      () => scanCodeProject(root, { extensions: ['.js'] }),
-      (error) => error.code === 'ADAPTER_PARSE' && /file limit/.test(error.message)
-    )
-  } finally {
-    rmSync(root, { recursive: true, force: true })
-  }
-})
-
-test('optional parser loading maps a missing package without affecting adapter imports', async () => {
-  await assert.rejects(
-    () => loadOptionalParser('drawio-parser-that-does-not-exist', 'missing parser'),
-    (error) => error.code === 'OPTIONAL_DEPENDENCY_MISSING'
-  )
-})
-
-test('code projection crosses validation, JavaScript ELK, renderer, and XML validation', async () => {
-  const root = projectFixture()
-  try {
-    const projection = await parseJavaScriptImportsProject(root, {
-      parseModule: (source) => (source.includes("'./b.js'") ? ['./b.js'] : [])
-    })
-    const spec = projectGraphToSpec(projection)
-    validateSpec(spec)
-    const layout = await applyAutoLayout(spec)
-    const xml = specToDrawioXml(layout.spec)
-    assert.deepEqual(validateXml(xml), { valid: true, errors: [], warnings: [] })
-  } finally {
-    rmSync(root, { recursive: true, force: true })
-  }
-})

package/template/.hermes/skills/drawio/scripts/adapters/code-parsers.integration.test.js

@@ -1,71 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { parseGoImportsProject } from './go-code.js'
-import { parseJavaScriptImportsProject } from './js-code.js'
-import { parsePythonImportsProject } from './python-code.js'
-import { parseRustImportsProject } from './rust-code.js'
-
-const integrationTest = process.env.DRAWIO_TEST_CODE_PARSERS === '1' ? test : test.skip
-
-function project(prefix, setup) {
-  const root = mkdtempSync(join(tmpdir(), prefix))
-  setup(root)
-  return root
-}
-
-integrationTest('real optional code parsers enforce their approved syntax subsets', async () => {
-  const roots = []
-  try {
-    const pythonRoot = project('drawio-parser-python-', (root) => {
-      writeFileSync(join(root, 'a.py'), 'import b\n')
-      writeFileSync(join(root, 'b.py'), 'VALUE = 1\n')
-    })
-    roots.push(pythonRoot)
-    assert.equal((await parsePythonImportsProject(pythonRoot)).edges.length, 1)
-    writeFileSync(join(pythonRoot, 'a.py'), 'def broken(:\n')
-    await assert.rejects(() => parsePythonImportsProject(pythonRoot), (error) => error.code === 'ADAPTER_PARSE')
-
-    const jsRoot = project('drawio-parser-js-', (root) => {
-      writeFileSync(join(root, 'a.ts'), "export { value } from './b.js'\nimport('./b.js')\n")
-      writeFileSync(join(root, 'b.js'), 'export const value = 1\n')
-    })
-    roots.push(jsRoot)
-    assert.equal((await parseJavaScriptImportsProject(jsRoot)).edges.length, 1)
-    writeFileSync(join(jsRoot, 'a.ts'), 'import(`./${name}.js`)\n')
-    await assert.rejects(
-      () => parseJavaScriptImportsProject(jsRoot),
-      (error) => error.code === 'ADAPTER_UNSUPPORTED'
-    )
-
-    const goRoot = project('drawio-parser-go-', (root) => {
-      writeFileSync(join(root, 'go.mod'), 'module example.com/parser\n')
-      mkdirSync(join(root, 'a'))
-      mkdirSync(join(root, 'b'))
-      writeFileSync(join(root, 'a', 'a.go'), 'package a\nimport "example.com/parser/b"\n')
-      writeFileSync(join(root, 'b', 'b.go'), 'package b\n')
-    })
-    roots.push(goRoot)
-    assert.equal((await parseGoImportsProject(goRoot)).edges.length, 1)
-    writeFileSync(join(goRoot, 'a', 'a.go'), 'package a\nimport (\n')
-    await assert.rejects(() => parseGoImportsProject(goRoot), (error) => error.code === 'ADAPTER_PARSE')
-
-    const rustRoot = project('drawio-parser-rust-', (root) => {
-      mkdirSync(join(root, 'src'))
-      writeFileSync(join(root, 'src', 'a.rs'), 'use crate::b;\n')
-      writeFileSync(join(root, 'src', 'b.rs'), 'pub fn value() {}\n')
-    })
-    roots.push(rustRoot)
-    assert.equal((await parseRustImportsProject(rustRoot)).edges.length, 1)
-    writeFileSync(join(rustRoot, 'src', 'a.rs'), '#[cfg(unix)]\nuse crate::b;\n')
-    await assert.rejects(
-      () => parseRustImportsProject(rustRoot),
-      (error) => error.code === 'ADAPTER_UNSUPPORTED'
-    )
-  } finally {
-    for (const root of roots) rmSync(root, { recursive: true, force: true })
-  }
-})

package/template/.hermes/skills/drawio/scripts/adapters/compose.js

@@ -1,134 +0,0 @@
-import {
-  ERROR_CODES,
-  createComposeIdentity,
-  createComposeResourceIdentity
-} from './identity.js'
-import {
-  adapterError,
-  diagnostic,
-  finalizeConfigProjection,
-  isRecord,
-  parseStructuredDocuments,
-  pushUniqueEdge,
-  requireRecord,
-  stringArray
-} from './config-common.js'
-
-const ADAPTER = 'compose-config'
-
-export const COMPOSE_ATTRIBUTE_ALLOWLIST = Object.freeze({
-  node: ['image', 'kind', 'project', 'replicas', 'service'],
-  edge: [],
-  module: []
-})
-
-export function buildComposeIdentityInput(service, { project } = {}) {
-  return { project, service }
-}
-
-function composeReplicas(service) {
-  const replicas = service?.deploy?.replicas
-  if (replicas == null) return 1
-  if (!Number.isInteger(replicas) || replicas < 1 || replicas > 10000) {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, 'Compose deploy.replicas must be an integer from 1 to 10000', {
-      adapter: ADAPTER
-    })
-  }
-  return replicas
-}
-
-function resourceReferences(service, key) {
-  const value = service?.[key]
-  if (Array.isArray(value)) return value
-  if (isRecord(value)) return Object.keys(value)
-  return []
-}
-
-function namedVolumeSource(mount) {
-  if (/^[A-Za-z]:[\\/]/.test(mount) || /^[./~]/.test(mount)) return null
-  const source = mount.split(':', 1)[0]
-  return source || null
-}
-
-export function parseComposeConfig(source, { project, locator = 'compose.yaml' } = {}) {
-  const documents = parseStructuredDocuments(source, { adapter: ADAPTER })
-  if (documents.length !== 1) adapterError(ERROR_CODES.ADAPTER_PARSE, 'Compose input must contain one document', { adapter: ADAPTER })
-  const document = requireRecord(documents[0], 'Compose document', ADAPTER)
-  const resolvedProject = project || document.name
-  if (typeof resolvedProject !== 'string' || resolvedProject.trim() === '') {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, 'Compose project must be provided by top-level name or project option', { adapter: ADAPTER })
-  }
-  const services = requireRecord(document.services, 'Compose services', ADAPTER)
-  const networks = isRecord(document.networks) ? document.networks : {}
-  const volumes = isRecord(document.volumes) ? document.volumes : {}
-
-  const nodes = []
-  const identities = new Map()
-  for (const [name, value] of Object.entries(services)) {
-    const service = requireRecord(value, `Compose service ${name}`, ADAPTER)
-    const identity = createComposeIdentity(buildComposeIdentityInput(name, { project: resolvedProject }))
-    identities.set(`service:${name}`, identity)
-    nodes.push({
-      identity,
-      label: name,
-      semanticType: 'service',
-      attributes: {
-        kind: 'service',
-        project: resolvedProject,
-        replicas: composeReplicas(service),
-        service: name,
-        ...(typeof service.image === 'string' ? { image: service.image } : {})
-      }
-    })
-  }
-  for (const name of Object.keys(networks)) {
-    const identity = createComposeResourceIdentity({ project: resolvedProject, kind: 'network', name })
-    identities.set(`network:${name}`, identity)
-    nodes.push({ identity, label: name, semanticType: 'subnet', attributes: { kind: 'network', project: resolvedProject } })
-  }
-  for (const name of Object.keys(volumes)) {
-    const identity = createComposeResourceIdentity({ project: resolvedProject, kind: 'volume', name })
-    identities.set(`volume:${name}`, identity)
-    nodes.push({ identity, label: name, semanticType: 'database', attributes: { kind: 'volume', project: resolvedProject } })
-  }
-
-  const edges = []
-  const edgeKeys = new Set()
-  const diagnostics = []
-  const add = (from, kind, name, relation, discriminator) => {
-    const target = identities.get(`${kind}:${name}`)
-    if (!target) {
-      diagnostics.push(diagnostic('COMPOSE_EXTERNAL_REF', `Compose service references undeclared ${kind} "${name}".`, from))
-      return
-    }
-    pushUniqueEdge(edges, edgeKeys, { from, to: target, relation, discriminator, attributes: {} })
-  }
-
-  for (const [name, service] of Object.entries(services)) {
-    const from = identities.get(`service:${name}`)
-    for (const dependency of resourceReferences(service, 'depends_on')) {
-      add(from, 'service', String(dependency), 'depends-on', `depends_on:${dependency}`)
-    }
-    for (const link of stringArray(service.links)) {
-      const target = link.split(':', 1)[0]
-      add(from, 'service', target, 'links', `link:${link}`)
-    }
-    for (const dependency of stringArray(service.volumes_from)) {
-      const target = dependency.split(':', 1)[0]
-      add(from, 'service', target, 'volumes-from', `volumes_from:${dependency}`)
-    }
-    for (const network of resourceReferences(service, 'networks')) {
-      add(from, 'network', String(network), 'uses-network', `network:${network}`)
-    }
-    for (const mount of stringArray(service.volumes)) {
-      const sourceName = namedVolumeSource(mount)
-      if (!sourceName) continue
-      add(from, 'volume', sourceName, 'mounts', `volume:${sourceName}`)
-    }
-  }
-
-  return finalizeConfigProjection(
-    { adapter: ADAPTER, domain: 'compose', locator, nodes, edges, diagnostics },
-    COMPOSE_ATTRIBUTE_ALLOWLIST
-  )
-}

package/template/.hermes/skills/drawio/scripts/adapters/compose.test.js

@@ -1,54 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-
-import { ERROR_CODES } from './identity.js'
-import { COMPOSE_ATTRIBUTE_ALLOWLIST, parseComposeConfig } from './compose.js'
-
-const source = `
-name: shop
-services:
-  api:
-    image: example/api:1
-    depends_on: [db]
-    networks: [backend]
-  db:
-    image: postgres:16
-    volumes: [data:/var/lib/postgresql/data]
-networks: { backend: {} }
-volumes: { data: {} }
-`
-
-test('parseComposeConfig emits services, named resources, and stable relations', () => {
-  const projection = parseComposeConfig(source, { locator: 'compose.yaml' })
-
-  assert.equal(projection.nodes.length, 4)
-  assert.ok(projection.nodes.some((node) => node.identity.scheme === 'compose-volume'))
-  assert.ok(projection.nodes.some((node) => node.identity.scheme === 'compose-network'))
-  assert.deepEqual(new Set(projection.edges.map((edge) => edge.relation)), new Set(['depends-on', 'uses-network', 'mounts']))
-  assert.equal(projection.nodes.find((node) => node.label === 'api').attributes.image, 'example/api:1')
-  assert.deepEqual(COMPOSE_ATTRIBUTE_ALLOWLIST.node, ['image', 'kind', 'project', 'replicas', 'service'])
-  assert.equal(projection.nodes.find((node) => node.label === 'api').attributes.replicas, 1)
-})
-
-test('parseComposeConfig requires an explicit or top-level project identity', () => {
-  assert.throws(
-    () => parseComposeConfig('services: { api: { image: app:1 } }', { locator: 'compose.yaml' }),
-    (error) => error.code === ERROR_CODES.ADAPTER_PARSE && /project/.test(error.message)
-  )
-})
-
-test('parseComposeConfig never projects environment or build args', () => {
-  const projection = parseComposeConfig(
-    'name: shop\nservices:\n  api:\n    image: app:1\n    environment: { TOKEN: secret }\n    build: { args: { PASSWORD: secret } }',
-    { locator: 'compose.yaml' }
-  )
-  assert.deepEqual(Object.keys(projection.nodes[0].attributes).sort(), ['image', 'kind', 'project', 'replicas', 'service'])
-})
-
-test('parseComposeConfig does not treat bind mounts as named volumes', () => {
-  const projection = parseComposeConfig(
-    'name: shop\nservices:\n  api:\n    volumes: ["C:\\\\work:/app", "./src:/src"]',
-    { locator: 'compose.yaml' }
-  )
-  assert.equal(projection.edges.length, 0)
-})

package/template/.hermes/skills/drawio/scripts/adapters/config-adapters.integration.test.js

@@ -1,58 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-
-import { applyAutoLayout } from '../dsl/auto-layout.js'
-import { specToDrawioXml, validateSpec, validateXml } from '../dsl/spec-to-drawio.js'
-import { parseCiWorkflow } from './ci.js'
-import { parseComposeConfig } from './compose.js'
-import { parseKubernetesManifests } from './kubernetes.js'
-import { parseOpenApiDocument } from './openapi.js'
-import { projectGraphToSpec } from './projection-to-spec.js'
-import { parseSqlDdl } from './sql-ddl.js'
-import { parseTerraformConfig } from './terraform-config.js'
-
-const projections = [
-  parseTerraformConfig('x', {
-    locator: 'infra/main.tf',
-    runParser: () => ({
-      resources: [
-        { address: 'aws_instance.api', resourceType: 'aws_instance', provider: 'aws', references: ['aws_security_group.web'], dependsOn: [] },
-        { address: 'aws_security_group.web', resourceType: 'aws_security_group', provider: 'aws', references: [], dependsOn: [] }
-      ],
-      diagnostics: []
-    })
-  }),
-  parseKubernetesManifests(
-    'apiVersion: apps/v1\nkind: Deployment\nmetadata: { name: api }\n---\napiVersion: v1\nkind: Service\nmetadata: { name: api }\nspec: { selector: { app: api } }',
-    { scope: 'test', locator: 'k8s/app.yaml' }
-  ),
-  parseComposeConfig('name: shop\nservices: { api: { depends_on: [db] }, db: { image: postgres:16 } }', {
-    locator: 'compose.yaml'
-  }),
-  parseSqlDdl('x', {
-    dialect: 'postgres',
-    locator: 'db/schema.sql',
-    runParser: () => ({
-      tables: [{ schema: 'public', name: 'users', columns: [{ name: 'id', type: 'INT', primaryKey: true, nullable: false }], foreignKeys: [] }],
-      diagnostics: []
-    })
-  }),
-  parseOpenApiDocument('openapi: 3.1.0\npaths:\n  /health:\n    get: { responses: { "200": { description: ok } } }', {
-    locator: 'api/openapi.yaml'
-  }),
-  parseCiWorkflow('jobs: { build: { runs-on: ubuntu-latest }, test: { needs: build, runs-on: ubuntu-latest } }', {
-    provider: 'github-actions',
-    workflow: '.github/workflows/ci.yml'
-  })
-]
-
-test('all config adapters use the canonical spec, JavaScript ELK, and renderer pipeline', async () => {
-  for (const projection of projections) {
-    const spec = projectGraphToSpec(projection)
-    validateSpec(spec)
-    const layout = await applyAutoLayout(spec)
-    assert.equal(layout.applied, true, projection.source.adapter)
-    const xml = specToDrawioXml(layout.spec)
-    assert.deepEqual(validateXml(xml), { valid: true, errors: [], warnings: [] })
-  }
-})

package/template/.hermes/skills/drawio/scripts/adapters/config-common.js

@@ -1,131 +0,0 @@
-import { loadAll, JSON_SCHEMA } from 'js-yaml'
-
-import { AdapterContractError, ERROR_CODES, serializeIdentity } from './identity.js'
-import { finalizeGraphProjection } from './graph-projection.js'
-
-export const MAX_SOURCE_BYTES = 1024 * 1024
-const MAX_DATA_DEPTH = 40
-const MAX_DATA_ENTRIES = 10000
-const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
-
-export function adapterError(code, message, context = {}, cause) {
-  throw new AdapterContractError(code, message, context, { cause })
-}
-
-export function assertSourceText(source, adapter) {
-  if (typeof source !== 'string' || source.trim() === '') {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, `${adapter} input must be a non-empty string`, { adapter })
-  }
-  if (Buffer.byteLength(source, 'utf8') > MAX_SOURCE_BYTES) {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, `${adapter} input exceeds the ${MAX_SOURCE_BYTES} byte limit`, { adapter })
-  }
-  return source
-}
-
-export function isRecord(value) {
-  return typeof value === 'object' && value != null && !Array.isArray(value)
-}
-
-export function requireRecord(value, context, adapter) {
-  if (!isRecord(value)) adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} must be an object`, { adapter })
-  return value
-}
-
-function validateStructuredValue(value, context, state, depth = 0) {
-  if (depth > MAX_DATA_DEPTH) adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} exceeds maximum nesting depth`)
-  if (value == null || ['string', 'number', 'boolean'].includes(typeof value)) return
-  if (typeof value !== 'object') adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} contains an unsupported value`)
-  if (state.seen.has(value)) adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} contains a recursive alias`)
-  state.seen.add(value)
-  state.entries++
-  if (state.entries > MAX_DATA_ENTRIES) adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} is too large`)
-
-  if (Array.isArray(value)) {
-    for (let index = 0; index < value.length; index++) {
-      validateStructuredValue(value[index], `${context}[${index}]`, state, depth + 1)
-    }
-  } else {
-    for (const [key, entry] of Object.entries(value)) {
-      if (FORBIDDEN_KEYS.has(key)) adapterError(ERROR_CODES.ADAPTER_PARSE, `${context} contains forbidden key "${key}"`)
-      validateStructuredValue(entry, `${context}.${key}`, state, depth + 1)
-    }
-  }
-  state.seen.delete(value)
-}
-
-export function parseStructuredDocuments(source, { adapter }) {
-  assertSourceText(source, adapter)
-  let documents
-  try {
-    const trimmed = source.trimStart()
-    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
-      documents = [JSON.parse(source)]
-    } else {
-      documents = []
-      loadAll(source, (document) => {
-        if (document != null) documents.push(document)
-      }, { schema: JSON_SCHEMA })
-    }
-  } catch (error) {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, `${adapter} input could not be parsed`, { adapter }, error)
-  }
-  for (let index = 0; index < documents.length; index++) {
-    validateStructuredValue(documents[index], `${adapter} document ${index + 1}`, { seen: new WeakSet(), entries: 0 })
-  }
-  return documents
-}
-
-export function parseJsonDocument(source, { adapter }) {
-  assertSourceText(source, adapter)
-  let document
-  try {
-    document = JSON.parse(source)
-  } catch (error) {
-    adapterError(ERROR_CODES.ADAPTER_PARSE, `${adapter} input could not be parsed as JSON`, { adapter }, error)
-  }
-  validateStructuredValue(document, `${adapter} document`, { seen: new WeakSet(), entries: 0 })
-  return document
-}
-
-export function stringArray(value) {
-  if (value == null) return []
-  if (typeof value === 'string') return [value]
-  if (!Array.isArray(value)) return []
-  return value.filter((entry) => typeof entry === 'string')
-}
-
-export function pushUniqueEdge(edges, seen, edge) {
-  const discriminator = edge.discriminator || ''
-  const key = JSON.stringify([
-    serializeIdentity(edge.from),
-    edge.relation,
-    serializeIdentity(edge.to),
-    discriminator
-  ])
-  if (seen.has(key)) return
-  seen.add(key)
-  edges.push(edge)
-}
-
-export function diagnostic(code, message, identity) {
-  const result = { level: 'warning', code, message }
-  if (identity) result.identity = identity
-  return result
-}
-
-export function finalizeConfigProjection(
-  { adapter, domain, mode = 'declared', locator, nodes, edges, modules = [], diagnostics = [] },
-  attributeAllowlist
-) {
-  return finalizeGraphProjection(
-    {
-      version: 1,
-      source: { adapter, domain, mode, locator },
-      nodes,
-      edges,
-      modules,
-      diagnostics
-    },
-    { attributeAllowlist }
-  )
-}

package/template/.hermes/skills/drawio/scripts/adapters/config-common.test.js

@@ -1,32 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-
-import { ERROR_CODES } from './identity.js'
-import { MAX_SOURCE_BYTES, parseStructuredDocuments } from './config-common.js'
-
-test('structured config decoder rejects unsafe YAML tags', () => {
-  assert.throws(
-    () => parseStructuredDocuments('value: !!js/function "function () {}"', { adapter: 'test-config' }),
-    (error) => error.code === ERROR_CODES.ADAPTER_PARSE
-  )
-})
-
-test('structured config decoder rejects prototype keys and recursive aliases', () => {
-  assert.throws(
-    () => parseStructuredDocuments('{"__proto__":{"polluted":true}}', { adapter: 'test-config' }),
-    (error) => error.code === ERROR_CODES.ADAPTER_PARSE && /forbidden key/.test(error.message)
-  )
-  assert.equal(Object.prototype.polluted, undefined)
-
-  assert.throws(
-    () => parseStructuredDocuments('value: &loop [*loop]', { adapter: 'test-config' }),
-    (error) => error.code === ERROR_CODES.ADAPTER_PARSE && /recursive alias/.test(error.message)
-  )
-})
-
-test('structured config decoder enforces the source-size limit', () => {
-  assert.throws(
-    () => parseStructuredDocuments(`value: ${'x'.repeat(MAX_SOURCE_BYTES)}`, { adapter: 'test-config' }),
-    (error) => error.code === ERROR_CODES.ADAPTER_PARSE && /byte limit/.test(error.message)
-  )
-})