#!/usr/bin/env bun/** * Pack-and-import smoke test for the public `@executor-js/*` packages. * * Reproduces what an external npm consumer experiences: * *   1. Pack each publishable workspace via `publish-packages.ts *      --dry-run`, so `publishConfig.exports` and `workspace:*` rewrites *      are applied to the tarball. *   2. For each package, install the tarball into a fresh temp dir *      with npm `overrides` pointing every other `@executor-js/*` *      transitive dep at its local tarball — otherwise npm pulls the *      currently-published version from the registry, which masks any *      internal-API mismatch this branch introduced. *   3. Read the installed package.json (the post-`publishConfig` view) *      and dynamically `import()` every subpath in its `exports` map. * * Failures for `@executor-js/*` package not-found are hard failures — * that's the regression class where private workspace packages leak * into a public bundle. Failures for other peers (`react`, `effect`, * `@tanstack/*`, etc.) are downgraded to warnings, since they reflect * a missing peer in the smoke environment, not a bug in the bundle. * * Invoke via `bun run release:smoke:packages`. */import { $ } from "bun";import { existsSync, readdirSync } from "node:fs";import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";import { tmpdir } from "node:os";import { dirname, join, resolve } from "node:path";import { fileURLToPath } from "node:url"; const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), ".."); const PUBLIC_PACKAGE_DIRS = [  "packages/core/fumadb",  "packages/kernel/core",  "packages/kernel/runtime-quickjs",  "packages/core/sdk",  "packages/core/config",  "packages/core/execution",  "packages/core/cli",  "packages/plugins/example",  "packages/plugins/file-secrets",  "packages/plugins/graphql",  "packages/plugins/keychain",  "packages/plugins/mcp",  "packages/plugins/onepassword",  "packages/plugins/openapi",] as const; type PackageJson = {  name: string;  version: string;  exports?: Record<string, unknown>;}; const readPackageJson = async (pkgDir: string): Promise<PackageJson> => {  const raw = await readFile(join(pkgDir, "package.json"), "utf8");  return JSON.parse(raw) as PackageJson;}; const findTarball = (pkgDir: string): string | null => {  const tgz = readdirSync(pkgDir).find((entry) => entry.endsWith(".tgz"));  return tgz ? join(pkgDir, tgz) : null;}; const subpathsToTest = (pkg: PackageJson): readonly string[] => Object.keys(pkg.exports ?? {}); const importSpecifier = (pkgName: string, subpath: string): string =>  subpath === "." ? pkgName : `${pkgName}${subpath.slice(1)}`; type SmokeFailure = {  readonly pkg: string;  readonly subpath: string;  readonly reason: string;}; const PRIVATE_PACKAGE_RE = /Cannot find package '(@executor-js\/[^']+)'/; const firstMeaningfulLine = (stderr: string): string => {  const lines = stderr    .split("\n")    .map((line) => line.trim())    .filter(Boolean);  const errorLine = lines.find((line) => /^(\w*Error|Cannot find)/i.test(line));  if (errorLine) return errorLine;  for (const line of lines) {    if (line.startsWith("node:")) continue;    if (line.startsWith("file://")) continue;    if (line.startsWith("at ")) continue;    if (line.startsWith("import ")) continue;    if (line.startsWith("throw ")) continue;    if (line === "^" || /^\^+$/.test(line)) continue;    return line;  }  return lines[0] ?? "(no stderr)";}; type Tarballs = ReadonlyMap<string, string>; const smokeTestPackage = async (  pkgDir: string,  tarballs: Tarballs,  failures: SmokeFailure[],): Promise<void> => {  const pkg = await readPackageJson(pkgDir);  const tarballPath = tarballs.get(pkg.name);  if (!tarballPath) {    failures.push({ pkg: pkg.name, subpath: "", reason: "no tarball produced" });    return;  }   const tmp = await mkdtemp(join(tmpdir(), "executor-smoke-"));  try {    // npm `overrides` forces transitive `@executor-js/*` deps to resolve    // to their local tarball instead of whatever's published on npm.    // Without this, a plugin built against an unreleased symbol in    // `@executor-js/sdk` would silently install the published `sdk`    // and fail at import — a real bug, but not the bundle bug we're    // here to catch.    const overrides: Record<string, string> = {};    for (const [name, path] of tarballs) {      overrides[name] = `file:${path}`;    }    const fixture = {      name: "executor-smoke-fixture",      version: "0.0.0",      private: true,      type: "module",      dependencies: { [pkg.name]: `file:${tarballPath}` },      overrides,    };    await writeFile(join(tmp, "package.json"), `${JSON.stringify(fixture, null, 2)}\n`);     const install = await $`npm install --no-audit --no-fund --legacy-peer-deps`      .cwd(tmp)      .quiet()      .nothrow();    if (install.exitCode !== 0) {      failures.push({        pkg: pkg.name,        subpath: "<install>",        reason: install.stderr.toString().trim().split("\n").slice(-3).join("\n"),      });      return;    }     // Read the installed manifest — that's the real published view    // (publishConfig.exports applied, workspace specifiers resolved).    const installedPkg = await readPackageJson(join(tmp, "node_modules", ...pkg.name.split("/")));    const subpaths = subpathsToTest(installedPkg);    if (subpaths.length === 0) {      failures.push({        pkg: pkg.name,        subpath: "",        reason: "no exports declared in published manifest",      });      return;    }     for (const subpath of subpaths) {      const spec = importSpecifier(pkg.name, subpath);      const probe =        await $`node --input-type=module --eval ${`await import(${JSON.stringify(spec)});`}`          .cwd(tmp)          .quiet()          .nothrow();      if (probe.exitCode === 0) {        console.log(`  ok  ${spec}`);        continue;      }      const stderr = probe.stderr.toString();      const privateMatch = stderr.match(PRIVATE_PACKAGE_RE);      if (privateMatch) {        const offending = privateMatch[1];        failures.push({          pkg: pkg.name,          subpath,          reason: `published bundle imports private workspace package '${offending}'`,        });        console.log(`  FAIL ${spec} — references private '${offending}'`);        continue;      }      const peerMatch =        stderr.match(/Cannot find package '([^']+)'/) ??        stderr.match(/Cannot find module '([^']+)'/);      const detail = peerMatch ? `missing peer '${peerMatch[1]}'` : firstMeaningfulLine(stderr);      console.log(`  skip ${spec} — ${detail}`);    }  } finally {    await rm(tmp, { recursive: true, force: true });  }}; const main = async () => {  console.log("[smoke] packing public packages via publish-packages.ts --dry-run");  await $`bun run scripts/publish-packages.ts --dry-run`.cwd(repoRoot);   const tarballs = new Map<string, string>();  for (const relDir of PUBLIC_PACKAGE_DIRS) {    const pkgDir = join(repoRoot, relDir);    if (!existsSync(pkgDir)) continue;    const pkg = await readPackageJson(pkgDir);    const tarball = findTarball(pkgDir);    if (tarball) tarballs.set(pkg.name, tarball);  }   const failures: SmokeFailure[] = [];  for (const relDir of PUBLIC_PACKAGE_DIRS) {    const pkgDir = join(repoRoot, relDir);    if (!existsSync(pkgDir)) {      failures.push({ pkg: relDir, subpath: "", reason: "missing dir" });      continue;    }    const pkg = await readPackageJson(pkgDir);    console.log(`[smoke] ${pkg.name}`);    await smokeTestPackage(pkgDir, tarballs, failures);  }   if (failures.length === 0) {    console.log("[smoke] all packages OK");    return;  }   console.error(`\n[smoke] ${failures.length} failure(s):`);  for (const f of failures) {    console.error(`  - ${f.pkg}${f.subpath ? ` (${f.subpath})` : ""}: ${f.reason}`);  }  process.exit(1);}; await main();