pgh-sidecar / test / runtime-dedupe.test.js

import test from 'brittle'
import { readdirSync, readFileSync, existsSync, statSync } from '#node:fs'
import { join, dirname } from '#node:path'
import { fileURLToPath } from '#node:url'

// Drift guard for the duplicated-runtime bug.
//
// `pgh publish` builds .pgh-lock.json by WALKING the physically installed
// node_modules (lib/publish.js: "Walks node_modules/ of an app dir, computes a
// tree hash per top-level dep") -- it does not re-resolve version ranges. So the
// tarball contains whatever is on disk at publish time.
//
// node_modules/pgh is a SYMLINK to the sibling ../../pgh repo, which has its own
// separately-installed node_modules. Both repos declared bare-runtime@^1.28.5 and
// were installed at different times, so they drifted apart:
//
//   pgh-sidecar/node_modules  → bare-runtime@1.28.7
//   pgh/node_modules          → bare-runtime@1.28.6
//
// The publish walk followed the symlink and picked up BOTH, putting two ~90MB
// runtimes in one bootstrap tarball. Measured cost: 90.0 MiB of a 786.1 MiB tree,
// 53% of all reclaimable duplication across 47 duplicated packages.
//
// Both repos now pin bare-runtime EXACTLY. An exact pin only holds if BOTH are
// repinned together on an upgrade -- repin one and the duplicate silently returns.
// This test is what makes that failure loud instead of silent.

const here = dirname(fileURLToPath(import.meta.url))
const root = join(here, '..')

// Collect name@version for every bare-runtime* package reachable from a tree,
// following the file:-dep symlinks that the publish walk also follows.
function collectRuntimes (nmDir, found = new Map(), depth = 0) {
  if (depth > 2 || !existsSync(nmDir)) return found
  let entries = []
  try { entries = readdirSync(nmDir) } catch { return found }
  for (const entry of entries) {
    if (entry.startsWith('.')) continue
    const dir = join(nmDir, entry)
    const pkgPath = join(dir, 'package.json')
    if (existsSync(pkgPath)) {
      try {
        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
        if (pkg && /^bare-runtime/.test(pkg.name || '') && pkg.version) {
          if (!found.has(pkg.name)) found.set(pkg.name, new Set())
          found.get(pkg.name).add(pkg.version)
        }
      } catch {}
    }
    // Recurse into nested node_modules AND through symlinked file: deps —
    // the publish walk resolves both, so the guard must too.
    let isDir = false
    try { isDir = statSync(dir).isDirectory() } catch {}
    if (isDir) collectRuntimes(join(dir, 'node_modules'), found, depth + 1)
  }
  return found
}

test('bare-runtime is pinned to an exact version (not a floating range)', (t) => {
  const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
  const direct = (pkg.dependencies || {})['bare-runtime']
  const override = (pkg.overrides || {})['bare-runtime']
  t.ok(direct, 'declared as a direct dependency')
  t.absent(/[\^~*x]|\s-\s/.test(direct || ''), `direct dep "${direct}" is exact, not a range`)
  t.is(override, direct, 'overrides entry agrees with the direct dep (npm EOVERRIDEs if they conflict)')
})

test('the installed tree resolves bare-runtime to exactly ONE version', (t) => {
  const found = collectRuntimes(join(root, 'node_modules'))
  t.ok(found.size > 0, 'found bare-runtime packages in the installed tree')
  const dupes = [...found].filter(([, versions]) => versions.size > 1)
  for (const [name, versions] of dupes) {
    t.fail(`${name} resolved to ${versions.size} versions: ${[...versions].sort().join(', ')} — ` +
      'the publish walk will put all of them in the bootstrap tarball (~90MB each). ' +
      'Repin bare-runtime to the SAME exact version in BOTH pgh and pgh-sidecar, then npm install in each.')
  }
  t.is(dupes.length, 0, 'no bare-runtime package is duplicated across the tree')
})

test('the sibling pgh repo pins the same exact version', (t) => {
  // The sidecar symlinks node_modules/pgh -> ../../pgh, so a mismatch here is
  // precisely how the duplicate gets reintroduced on the next upgrade.
  const siblingPkg = join(root, '..', 'pgh', 'package.json')
  if (!existsSync(siblingPkg)) {
    t.pass('sibling pgh checkout not present — skipped')
    return
  }
  const mine = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
  const theirs = JSON.parse(readFileSync(siblingPkg, 'utf8'))
  const a = (mine.dependencies || {})['bare-runtime']
  const b = (theirs.dependencies || {})['bare-runtime']
  t.is(b, a, `pgh pins "${b}", pgh-sidecar pins "${a}" — they MUST match or publish ships both`)
})