cursedbelt 5.0.0 → 5.1.0

package/src/unpeeredStaysOffTheBarrel.spec.ts

@@ -0,0 +1,99 @@
+/**
+ * 🔴 Nothing the `cursedbelt/react` barrel reaches may import an `unpeered` package — not
+ * statically, and not through a literal `import()` either.
+ *
+ * `unpeered` (task 2087) lists packages some subpaths use that are kept out of
+ * `peerDependencies` because npm cannot resolve their own peer ranges beside ours. That keeps
+ * `npm install cursedbelt` clean, and it has a price that `barrelsReachNoOptionalPeer.spec.ts`
+ * could not see: **a bundler resolves a literal `import()` at BUILD time, and Vite stubs a
+ * missing import only when it is a DECLARED optional peer.** 5.0.0 listed `@hookform/resolvers`
+ * and `@emoji-mart/react` there while `react/lib/form.ts` and `react/emoji/EmojiPicker.tsx`
+ * lazily imported them — lazy, so the static-only check above passed — and every app's
+ * clean-install `vite build` failed: `Rollup failed to resolve import "@hookform/resolvers/zod"`.
+ * Primary checkouts hid it for a day, because their `node_modules` still held the 4.x copies.
+ *
+ * 5.0.1 depends on neither (its own zod resolver; emoji-mart's `Picker` mounted directly). This
+ * spec is what keeps a third from arriving. The barrel is the subject because it is what every
+ * app imports; an opt-in subpath that needs glide (`./react/spreadsheet` and its two siblings) is
+ * named in `docs/API-REFERENCE.md`'s install table, and its consumer installs it on purpose.
+ * `tools/proveInstall.ts`'s consumer-bundle step is the same rule, proved against the PUBLISHED
+ * tarball in an empty directory.
+ */
+import { describe, expect, it } from 'bun:test';
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import pkg from '../package.json';
+
+const REPO = fileURLToPath(new URL('..', import.meta.url));
+const UNPEERED = Object.keys((pkg as { unpeered?: { packages?: Record<string, string> } }).unpeered?.packages ?? {});
+
+/** `import x from "p"`, `export … from "p"`, `import "p"`, and — the 5.0.0 shape — `import("p")`. */
+const ANY_SPECIFIER = /\bfrom\s*["']([^"'\n]+)["']|^\s*import\s*["']([^"'\n]+)["']|\bimport\(\s*["']([^"'\n]+)["']\s*\)/gm;
+
+const packageOf = (specifier: string): string => {
+  const parts = specifier.split('/');
+  return (specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]) ?? specifier;
+};
+
+/** Every package an entry's bundle names, static or dynamic, with all packages left external. */
+function packagesReachedBy(entry: string, label: string): Set<string> {
+  const outdir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-unpeered-scan-${process.pid}/${label}`;
+  rmSync(outdir, { recursive: true, force: true });
+  const build = Bun.spawnSync(['bun', 'build', entry, '--target=browser', '--packages=external', '--outdir', outdir], {
+    cwd: REPO,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const emitted = [...new Bun.Glob('**/*.js').scanSync({ cwd: outdir, onlyFiles: true })];
+  const bundle = emitted.map((f) => readFileSync(`${outdir}/${f}`, 'utf8')).join('\n');
+  if (build.exitCode !== 0 || bundle.trim() === '') {
+    throw new Error(`could not bundle ${entry} (exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`);
+  }
+  const found = new Set<string>();
+  for (const m of bundle.matchAll(ANY_SPECIFIER)) {
+    const specifier = m[1] ?? m[2] ?? m[3];
+    if (specifier && !specifier.startsWith('.') && !specifier.startsWith('/')) found.add(packageOf(specifier));
+  }
+  return found;
+}
+
+describe('unpeered packages stay off the cursedbelt/react barrel', () => {
+  it('🔴 the barrel names no unpeered package, even lazily', () => {
+    const source = (pkg.exports as Record<string, { source?: string }>)['./react']?.source;
+    expect(source, 'package.json has no ./react source entry').toBeString();
+    const reached = packagesReachedBy(`${REPO}${(source as string).slice(2)}`, 'barrel');
+    expect(reached.size, 'the scan found no packages at all — it is not measuring').toBeGreaterThan(0);
+    expect(
+      UNPEERED.filter((name) => reached.has(name)),
+      'the barrel imports an `unpeered` package. A consumer who did not install it cannot even BUILD: ' +
+        'Vite stubs only declared optional peers. Make it a declared optional peer, own the code, or ' +
+        'move the component to an opt-in subpath named in docs/API-REFERENCE.md.',
+    ).toEqual([]);
+  });
+
+  it('`unpeered.subpaths` names only real opt-in subpaths, never the barrel, and only unpeered packages', () => {
+    // `tools/proveInstall.ts` excuses a fresh-install bundle failure ONLY for these pairs.
+    const subpaths = (pkg as { unpeered?: { subpaths?: Record<string, string[]> } }).unpeered?.subpaths ?? {};
+    expect(Object.keys(subpaths)).not.toContain('./react');
+    for (const [subpath, names] of Object.entries(subpaths)) {
+      expect(Object.keys(pkg.exports), `${subpath} is not an export`).toContain(subpath);
+      expect(names.filter((n) => !UNPEERED.includes(n)), `${subpath} names a package that is not unpeered`).toEqual([]);
+    }
+    // And every unpeered package is needed by at least one named subpath — or it is not needed.
+    const named = new Set(Object.values(subpaths).flat());
+    expect(UNPEERED.filter((n) => !named.has(n))).toEqual([]);
+  });
+
+  it('the scan sees a lazy import — 5.0.0 reproduced, so this check can go red', () => {
+    const dir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-unpeered-fixture-${process.pid}`;
+    mkdirSync(dir, { recursive: true });
+    const entry = `${dir}/lazy.ts`;
+    writeFileSync(entry, "export const Picker = () => import('@emoji-mart/react');\nexport const zod = () => import('@hookform/resolvers/zod');\n");
+    try {
+      const reached = packagesReachedBy(entry, 'fixture');
+      expect([...reached].sort()).toEqual(['@emoji-mart/react', '@hookform/resolvers']);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});