check.ts

/**
 * Package checks — one script, run once, in CI and before a release.
 *
 * Verifies that the packed artifact installs cleanly for a consumer, that the
 * host plugin and client bundle initialize, that peer ranges are resolvable by
 * plain npm, that release workflows are wired correctly, and that no credentials
 * or stale builds ship.
 *
 *   node --experimental-strip-types scripts/check.ts
 */

import assert from "node:assert/strict";
import { execFileSync } from "node:child_process";
import {
  existsSync,
  mkdtempSync,
  readFileSync,
  readdirSync,
  rmSync,
  statSync,
} from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { fileURLToPath } from "node:url";

import { en as cardCopy } from "../src/settings-copy.ts";
import {
  exportsOutsideFiles,
  publishListMismatch,
  releasePendingTargets,
} from "./package-checks.ts";
import { SCOPED_TARGETS } from "./scoped-targets.ts";

const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
const failures: string[] = [];
const notes: string[] = [];

const fail = (message: string): void => {
  failures.push(message);
};
const ok = (message: string): void => {
  notes.push(message);
};

const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));

/* ------------------------------------------------------- 1. lib/ is current */

function newestMtime(dir: string): number {
  let newest = 0;
  for (const name of readdirSync(dir, { recursive: true })) {
    const full = join(dir, String(name));
    try {
      if (statSync(full).isFile())
        newest = Math.max(newest, statSync(full).mtimeMs);
    } catch {
      // Racing a build is not a failure; skip it.
    }
  }
  return newest;
}

const lib = join(ROOT, "lib");
if (!existsSync(lib)) {
  fail("lib/ is missing — run `pnpm run build`");
} else if (newestMtime(join(ROOT, "src")) > newestMtime(lib)) {
  fail(
    "src/ is newer than lib/ — run `pnpm run build`, or DSH will load the old one"
  );
} else {
  ok("lib/ is newer than src/");
}

/* ------------------------------------------- 2. peers npm must be able to read */

for (const [name, range] of Object.entries(
  (pkg.peerDependencies ?? {}) as Record<string, unknown>
)) {
  if (typeof range !== "string" || range.trim() === "") {
    fail(`peer ${name} has no usable range`);
    continue;
  }
  if (/^(workspace|link|file|catalog):/.test(range)) {
    fail(
      `peer ${name} uses "${range.split(":")[0]}:" — npm cannot parse it, so install fails`
    );
    continue;
  }
  if (!/^[\^~><=|*]/.test(range.trim())) {
    fail(
      `peer ${name} is pinned to "${range}" — a DSH patch release would orphan the plugin`
    );
  }
}
if (!failures.length) {
  ok(
    `${Object.keys(pkg.peerDependencies ?? {}).length} peer ranges npm can resolve`
  );
}

/* ------------------------------------------- 3. it is a bundle, and it loads */

const patch = pkg.dsh?.bundle?.patch;
if (!patch) {
  fail("no dsh.bundle.patch — DSH would install this and then ignore it");
} else if (existsSync(join(ROOT, patch))) {
  ok(`dsh.bundle.patch -> ${patch}`);
} else {
  fail(`dsh.bundle.patch points at "${patch}", which does not exist`);
}
for (const field of ["main", "types"]) {
  if (!pkg[field]) fail(`no ${field} declared`);
}

/* --------------------------------------- 4. the harness surfaces are still there */

const SURFACES = ["@deepseek-ai/dsh-typert-protocol"];

const REQUIRED: Record<string, [RegExp, string][] | undefined> = {
  "@deepseek-ai/dsh-typert-protocol": [
    [
      /(?:export declare class RemoteError|export \{[^}]*\bRemoteError\b)/,
      "RemoteError",
    ],
    [
      /export declare (?:abstract )?class TypertRemoteService/,
      "TypertRemoteService",
    ],
    [/interface TypertRemoteContribution\b/, "TypertRemoteContribution"],
  ],
};

for (const name of SURFACES) {
  let dir;
  try {
    dir = dirname(
      execFileSync(
        process.execPath,
        [
          "-e",
          `process.stdout.write(require.resolve(${JSON.stringify(`${name}/package.json`)}))`,
        ],
        { cwd: ROOT, encoding: "utf8" }
      )
    );
  } catch {
    notes.push(
      `skip  ${name} is not installed, so its surfaces were not checked`
    );
    continue;
  }

  const typesDir = join(dir, "lib/types");
  const files = existsSync(typesDir)
    ? readdirSync(typesDir)
        .filter((f) => f.endsWith(".d.ts"))
        .map((f) => join(typesDir, f))
    : [join(dir, "lib/index.d.ts")].filter(existsSync);

  if (files.length === 0) {
    fail(`${name} ships no readable type declarations — the contract moved`);
    continue;
  }

  const dts = files.map((f) => readFileSync(f, "utf8")).join("\n");
  const required = REQUIRED[name];
  assert.ok(required, `no surface contract for ${name}`);
  for (const [pattern, what] of required) {
    if (!pattern.test(dts)) fail(`${name} no longer exposes ${what}`);
  }
}
if (!failures.some((f) => f.includes("no longer exposes"))) {
  ok("every harness surface this package depends on is present");
}

/* --------------------------------- 5. the lint and format configs are actually loaded */

try {
  const printed = execFileSync(
    "pnpm",
    ["exec", "vp", "lint", "--print-config"],
    {
      cwd: ROOT,
      encoding: "utf8",
      stdio: ["ignore", "pipe", "pipe"],
    }
  );
  const effective = JSON.parse(printed.slice(printed.indexOf("{")));
  const ruleCount = Object.keys(effective.rules ?? {}).length;

  if (ruleCount < 300) {
    fail(
      `the effective lint config has ${ruleCount} rules — the \`lint\` block in vite.config.ts is not being loaded`
    );
  } else if (effective.options?.typeAware !== true) {
    fail("typeAware is off, so every typescript/* gate is listed but inert");
  } else if (effective.rules["typescript/no-floating-promises"] === undefined) {
    fail("the effective config is missing this package's own gates");
  } else {
    ok(`lint config is live (${ruleCount} rules, typeAware on)`);
  }
} catch (error) {
  const detail =
    error instanceof Error ? error.message.split("\n")[0] : String(error);
  fail(`could not read the effective lint config: ${detail}`);
}

/* --------------------------------------------------- 6. no credentials in the tree */

const SECRETS: [RegExp, string][] = [
  [/\bmonid_live_[A-Za-z0-9]{10,}/, "a Monid platform key"],
  [/\bsk-tinyfish-[A-Za-z0-9_-]{10,}/, "a TinyFish key"],
  [/\bgh[pousr]_[A-Za-z0-9]{20,}/, "a GitHub token"],
  [/sk-ant-[A-Za-z0-9_-]{10,}/, "an Anthropic key"],
];

const parts = { m: "monid_live_", t: "sk-tinyfish-", g: "ghp_", a: "sk-ant-" };
const CANARIES = [
  [`${parts.m}AbCdEf1234567890`, true],
  [`${parts.t}Pm-QkiaUloPEyNN`, true],
  [`${parts.g}abcdefghijklmnopqrstuvwxyz0123456789`, true],
  [`${parts.a}api03-AbCdEf1234567890`, true],
  [parts.m, false],
  [parts.t, false],
  ["$OPENCODE_GO_API_KEY", false],
  ["Authorization: Bearer <key>", false],
];
for (const [sample, shouldMatch] of CANARIES as [string, boolean][]) {
  if (SECRETS.some(([re]) => re.test(sample)) !== shouldMatch) {
    fail(
      `the secret scanner is ${shouldMatch ? "missing" : "over-matching"} on a sample`
    );
  }
}

const SKIP = new Set(["node_modules", ".git", "lib"]);
let scanned = 0;
const walk = (dir: string): void => {
  for (const name of readdirSync(dir)) {
    if (
      SKIP.has(name) ||
      name.startsWith(".build-check") ||
      name.endsWith(".tgz")
    )
      continue;
    const full = join(dir, name);
    if (statSync(full).isDirectory()) {
      walk(full);
      continue;
    }
    if (!/\.(mjs|js|ts|json|yml|yaml|md)$/.test(name)) continue;
    scanned += 1;
    const text = readFileSync(full, "utf8");
    for (const [re, what] of SECRETS) {
      if (re.test(text))
        fail(`${full.replace(`${ROOT}/`, "")} contains ${what}`);
    }
  }
};
walk(ROOT);
ok(`scanned ${scanned} files for credentials`);

/* ------------------------------ 7. install it the way a consumer will, and load it */

const scratch = mkdtempSync(join(tmpdir(), "dsh-opencode-"));

const CHILD_ENV = Object.fromEntries(
  Object.entries(process.env).filter(([name]) => !/^npm_config_/i.test(name))
);

try {
  // `npm pack --json` answers with an array of results through npm 11 and with
  // a name-keyed object from npm 12 on, which is what Node 26 ships and what CI
  // runs. Both shapes are read rather than pinning the toolchain: the value
  // wanted is one pack result either way.
  const packReport = JSON.parse(
    execFileSync(
      "npm",
      ["pack", "--json", "--ignore-scripts", "--pack-destination", scratch],
      { cwd: ROOT, encoding: "utf8", env: CHILD_ENV }
    )
  ) as
    | { filename: string; entryCount: number }[]
    | Record<string, { filename: string; entryCount: number }>;
  const packed = Array.isArray(packReport)
    ? packReport[0]
    : Object.values(packReport)[0];
  if (packed === undefined) {
    throw new Error("npm pack --json answered with no result");
  }

  const project = join(scratch, "consumer");
  execFileSync("mkdir", ["-p", project]);
  const peers = Object.entries(
    (pkg.peerDependencies ?? {}) as Record<string, unknown>
  ).map(([n, r]) => `${n}@${String(r)}`);
  execFileSync(
    "npm",
    [
      "install",
      join(scratch, packed.filename),
      ...peers,
      "--no-audit",
      "--no-fund",
      "--ignore-scripts",
    ],
    {
      cwd: project,
      encoding: "utf8",
      env: CHILD_ENV,
      stdio: ["ignore", "pipe", "pipe"],
    }
  );

  const installed = join(project, "node_modules/dsh-opencode-patch");
  const installedManifest = JSON.parse(
    readFileSync(join(installed, "package.json"), "utf8")
  );
  if (installedManifest.dsh?.bundle?.patch === undefined) {
    fail(
      "the published manifest lost dsh.bundle.patch — DSH would ignore the package"
    );
  }

  // Loaded from the installed copy, verifying the host entrypoint and Config schema
  const probe = `
    const m = await import(${JSON.stringify(join(installed, pkg.main))});
    if (typeof m.apply !== "function") throw new Error("no apply()");
    if (typeof m.Config !== "function") throw new Error("no Config");
    const calls = [];
    const ctx = {
      plugin: (p) => calls.push(p?.name || "plugin"),
      effect: (fn) => fn(),
      on: (ev) => calls.push(ev),
      get: () => undefined,
      logger: { info: () => {}, warn: () => {} },
    };
    m.apply(ctx, m.Config({}));
    if (!calls.includes("GoUsageService")) throw new Error("GoUsageService was not registered");
    if (!calls.includes("llm/stream")) throw new Error("llm/stream was not registered");
    process.stdout.write("ok");
  `;
  execFileSync(process.execPath, ["--input-type=module", "-e", probe], {
    cwd: project,
    encoding: "utf8",
    env: CHILD_ENV,
    stdio: ["ignore", "pipe", "pipe"],
  });

  ok(
    `installed the packed tarball with plain npm (${packed.entryCount} entries) and loaded the host + client halves`
  );
} catch (error: unknown) {
  const err = error as { stderr?: string; message?: string };
  const detail = [err.stderr, err.message]
    .filter(Boolean)
    .join("\n")
    .split("\n")
    .filter((l) => /Error|Cannot find|ENOENT|EEXIST|npm error|code /.test(l))
    .slice(0, 3)
    .join(" | ");
  fail(`a consumer install or load failed: ${detail}`);
} finally {
  rmSync(scratch, { recursive: true, force: true });
}

/* ------------------------------------------------- 8. the release can fire */

const workflows = join(ROOT, ".github/workflows");
const release = readFileSync(join(workflows, "release.yml"), "utf8");
const ci = readFileSync(join(workflows, "ci.yml"), "utf8");

if (/^\s*tags:\s*\[?\s*"?v\*\.\*\.\*"?/m.test(release)) {
  ok("release.yml is triggered by a version tag");
} else {
  fail("release.yml does not trigger on v*.*.* tags — nothing would publish");
}

if (/^\s*tags-ignore:\s*\[?\s*"?v\*\.\*\.\*"?/m.test(ci)) {
  ok("ci.yml ignores version tags, leaving them to release.yml");
} else {
  fail(
    "ci.yml does not ignore version tags; a tag push matches no branch, so " +
      "ci.yml never runs on one and anything gated on it is unreachable"
  );
}

/* The nightly refresh must arrive with CI on it. A branch pushed with the
   checkout credential is attributed to github-actions[bot], and GitHub parks
   the pull_request run in action_required - the first refresh arrived that
   way, with no checks until a human approved the run. The push therefore has
   to carry the PAT, which makes the actor the PAT's owner. */
if (
  ci.includes(
    `x-access-token:\${GH_TOKEN}@github.com/\${GITHUB_REPOSITORY}.git`
  )
) {
  ok("the refresh push carries the PAT, so the refresh PR gets CI");
} else {
  fail(
    "the nightly refresh pushes through the checkout credential; the " +
      "pull_request run then lands in action_required and the refresh gets " +
      "no CI until someone approves the run by hand"
  );
}

if (/^\s*id-token:\s*write/m.test(release)) {
  ok("release.yml grants id-token: write for OIDC trusted publishing");
} else {
  fail(
    "release.yml has no id-token: write, so npm trusted publishing cannot " +
      "authenticate and the publish would need a stored token"
  );
}

if (/npm view .* version 2>\/dev\/null/.test(release)) {
  ok("release.yml skips a version that is already on the registry");
} else {
  fail(
    "release.yml does not skip an already-published version, so re-running a " +
      "tag fails on npm's refusal to republish"
  );
}

/* --------------------------------------------------- 9. the toolchain is Vite+ */

const TOOLCHAIN = ["build", "check", "format", "lint", "test"];
const UNBYPASSED = /(?:^|[\s(])(oxlint|oxfmt|tsdown|vitest|tsc)(?:[\s)]|$)/;

if (pkg.devDependencies?.["vite-plus"]) {
  ok(`the toolchain is vite-plus (${pkg.devDependencies["vite-plus"]})`);
} else {
  fail("the package does not depend on vite-plus; the toolchain is unpinned");
}

for (const name of TOOLCHAIN) {
  const script = pkg.scripts?.[name];
  if (!script) {
    fail(`no ${name} script`);
  } else if (!/\bvp\b/.test(script)) {
    fail(`the ${name} script does not go through vp: ${script}`);
  } else if (UNBYPASSED.test(script.replaceAll(/\bvp\b[^\s]*/g, ""))) {
    const bare = script.match(new RegExp(UNBYPASSED, "g")) ?? [];
    const real = bare.filter((tool: string) => tool.trim() !== "tsc");
    if (real.length > 0) {
      fail(
        `the ${name} script reaches past vp for ${real.map((t: string) => t.trim()).join(", ")}; ` +
          "that bypasses the entry point that reads the config"
      );
    }
  }
}
ok(`${TOOLCHAIN.length} toolchain scripts route through vp`);

/* -------------------------------------------- 10. the scoped alias ships too */

const releaseYml = readFileSync(join(workflows, "release.yml"), "utf8");
if (releaseYml.includes("scripts/publish-scoped.ts")) {
  ok("release.yml publishes scoped aliases from the same tree");
} else {
  fail(
    "release.yml does not publish the scoped alias; @viztor/dsh-opencode-patch " +
      "would go stale while dsh-opencode-patch moves on"
  );
}

/* ----------------- 10b. what exports names ships, and what ships is checked */

// An `exports` target outside `files` resolves in this repository and nowhere
// else: `./src/*` was exported for releases while `src/` was never packed.
const outside = exportsOutsideFiles(pkg);
if (outside.length === 0) {
  ok("every exports target is inside files");
} else {
  for (const target of outside) {
    fail(
      `exports names ${target}, which files does not pack; a consumer resolving ` +
        `${target} from the tarball gets ENOENT`
    );
  }
}

// The verify step polls its own list. A name publish-scoped.ts publishes and
// the step never polls goes unchecked; a name it polls and nothing publishes
// fails every release.
const pending = releasePendingTargets(releaseYml);
if (pending === undefined) {
  fail(
    'release.yml must carry exactly one pending="…" verify line (none, or more than one, found); the publish list cannot be checked'
  );
} else {
  const mismatch = publishListMismatch([pkg.name, ...SCOPED_TARGETS], pending);
  if (mismatch.length === 0) {
    ok(
      `release.yml verifies exactly what is published (${pending.join(", ")})`
    );
  } else {
    for (const message of mismatch) {
      fail(message);
    }
  }
}

/* ------------------------------------------ 11. the client stays lean */

/*
 * A TRIPWIRE, not a budget. The owner: "the budget doesn't matter — it is there to
 * avoid accidents." It was 64 KiB when the bundle was 604 bytes of copy, then 72
 * KiB when the panel's own work reached ~73 KB — and at THAT number it stopped
 * answering the question it exists for, because a comment or a copy string trips
 * it just as hard as the accident it was built to catch.
 *
 * What it really watches is a DEPENDENCY bundled instead of left external, and
 * that arrives as a jump of THOUSANDS of bytes. So the ceiling sits ~3 KB above
 * the real working size: far enough that prose and copy never trip it, far
 * enough below that a real regression (a date library, an SDK — the bundled React
 * alone is 40+ KB) still lands over it. Raising it costs nothing in signal and
 * buys back the prose in the files that own the knowledge. Measure with
 * `wc -c lib/client.js`.
 */
/**
 * A TRIPWIRE, not a budget. 79 KiB sits ~3.5 KB above the real working size
 * (77.3 KB), which is the whole point: the number catches a dependency being
 * bundled instead of left external, and that lands as a jump of THOUSANDS of
 * bytes. It must never fire on prose. Raised from 75 KiB when a couple of
 * hundred bytes of client comments pushed the bundle over — the owner's
 * standing instruction is to raise the ceiling, never to cut content.
 */
/**
 * A TRIPWIRE, not a budget. 96 KiB sits ~2 KB above the real working size
 * (86.5 KB), which is the whole point: the number catches a dependency being
 * bundled instead of left external, and that lands as a jump of THOUSANDS of
 * bytes. It must never fire on prose or on a feature that earns its bytes.
 *
 * Raised 75 -> 79 when client comments pushed it over, 79 -> 85 when the reset
 * line gained localized durations and an absolute date-time composed from
 * `Intl` parts, and 85 -> 88 when the session-spend row became a component with
 * its own empty state and the Zen hover gained the price. All three were real
 * behaviour, and the owner's standing instruction is to raise the ceiling
 * rather than delete something to fit.
 *
 * Raised 88 -> 96 when the settings card gained the Go usage summary. That was
 * a measured +7.8 KB, and it is the module's own source: this file's rule is
 * that comments ship, and the summary's rationale (why "left" is a percentage
 * and never a dollar figure) is load-bearing. Verified against a stashed
 * baseline before raising, precisely because a jump that size is the shape this
 * guard exists to catch.
 *
 * The margin is what matters, not the number: at 85 the bundle sat 526 bytes
 * under the line, which means the next honest edit trips a guard whose only
 * job is to notice a dependency.
 *
 * Raised 112 -> 116 KB when the sign-in row gained a plane selector. The login
 * is per plane — two authentication routes, one grant each — and the row had no
 * way to say which one it was writing or describing, so a deployment living on
 * Go could not sign in on the plane it used. The growth is a radio group, its
 * two localized labels, and the rationale for why a grant written on one plane
 * still serves the other.
 *
 * Raised 116 -> 120 KB when the login row gained cancellation. A flow started
 * from the card could only be abandoned by reloading the page, and the effect
 * that owns the poll loop now cancels the flow it owns on the way out. The
 * growth is the cancel call, its result type and the release path.
 *
 * Raised 120 -> 124 KB when the client measured 123122 bytes and this ceiling
 * caught it. The commit that crossed the line grew it by 835 bytes — the meter
 * saying WHY it renders nothing instead of rendering nothing quietly — and the
 * growth since the last raise is that kind of thing: copy and JSX in the usage
 * and settings surfaces, hundreds of bytes at a time. Nothing in the curve is a
 * dependency that should have stayed external, which is the case this tripwire
 * exists to catch.
 *
 * Raised 124 -> 128 KB when the local-store inspection row landed: a heading, a
 * hint, one button and the report it renders, plus their two localized copies.
 * That is the same kind of growth as the last raise — UI, not a dependency — and
 * the client measured 127048 bytes against the old line.
 *
 * The 140 KB raise that the catalog-gap row once justified is REVERTED, together
 * with the row: the owner's call was that the card should not offer to declare
 * catalog models at all, so the contract, the caller, the report, the per-plane
 * list and twenty localized strings left with it. A ceiling that stayed at 140
 * would have quietly stopped being a tripwire — 12 KB of slack is more than this
 * guard exists to tolerate.
 *
 * Raised 128 -> 132 KB when the usage contract grew: the client's one helper
 * for the sibling's zero-argument \`read\` (the meter's scoped read and the
 * settings card's quota row both go through it now, instead of each spelling its
 * own call), the account row's \`readAccount\` answer, and the codec that
 * validates the reference before it can reach a credential lookup. The client
 * measured 132541 bytes against the old line.
 *
 * The same 128 -> 132 KB raise was made, independently, when the
 * store-inspection row's remote descriptor landed: the row had been calling a
 * namespace the client never mounted, and the fix is the descriptor plus the
 * whitelist parser its codec runs. Source, not a dependency — the client
 * measured 132320 bytes against the old line, about 1.2 KB over, which is this
 * guard's "raise it" case.
 *
 * Raised 132 -> 136 KB when those two raises met in one merge: each had been
 * measured against a tree without the other, and together the client measured
 * 135604 bytes, about 0.4 KB over. Nothing new arrived with the merge — it is
 * the same two surfaces, counted once each.
 *
 * That is the kind of growth the last four raises were: a surface the HOST
 * answers, not a dependency that should have stayed external — which is the case
 * this tripwire exists to catch, and which the ceiling is not raised for.
 */
const CLIENT_BUDGET = 136 * 1024;
const clientPath = join(ROOT, "lib/client.js");
if (existsSync(clientPath)) {
  const clientStat = statSync(clientPath);
  if (clientStat.size <= CLIENT_BUDGET) {
    ok(
      `lib/client.js is ${clientStat.size} bytes, under the ${CLIENT_BUDGET} tripwire`
    );
  } else {
    fail(
      `lib/client.js is ${clientStat.size} bytes, over the ${CLIENT_BUDGET} tripwire. ` +
        "Two causes, two responses — the owner's standing instruction is to RAISE THE " +
        "CEILING, never to cut content:\n" +
        "  - a jump of thousands of bytes? A dependency was bundled instead of left " +
        "external. Add it to deps.neverBundle in vite.config.ts.\n" +
        "  - a few hundred bytes of copy or comments? Raise CLIENT_BUDGET. Do NOT trim " +
        "prose to fit a number that exists only to catch the case above."
    );
  }
} else {
  fail("lib/client.js is missing — run `pnpm run build`");
}

/* ------------------------------------ 12. one name everywhere (identity + i18n) */

const settingsPage = readFileSync(join(ROOT, "src/settings-page.tsx"), "utf8");
const nsMatch = /export const NS = "([^"]+)"/u.exec(settingsPage);
if (nsMatch?.[1] === pkg.name) {
  ok(`settings namespace == package name (${pkg.name})`);
} else {
  fail(
    `settings NS is "${nsMatch?.[1]}" but package.json name is "${pkg.name}" — ` +
      "the card would bind a namespace the host never serves"
  );
}

const localeKeys = (value: unknown, prefix = ""): string[] =>
  value !== null && typeof value === "object" && !Array.isArray(value)
    ? Object.entries(value as Record<string, unknown>).flatMap(([key, child]) =>
        localeKeys(child, prefix === "" ? key : `${prefix}.${key}`)
      )
    : [prefix];

const [enLocale, zhLocale] = ["en", "zh"].map(
  (lang) =>
    JSON.parse(
      readFileSync(join(ROOT, `locale/${lang}.json`), "utf8")
    ) as unknown
);
const enKeys = localeKeys(enLocale).toSorted();
const zhKeys = localeKeys(zhLocale).toSorted();
if (enKeys.join("\n") === zhKeys.join("\n")) {
  ok(`${enKeys.length} locale keys in sync across en/zh`);
} else {
  fail(
    `locale/en.json and locale/zh.json disagree on keys (${enKeys.length} en vs ` +
      `${zhKeys.length} zh) — a missing translation would render as a raw key`
  );
}

const bundleTitle = (enLocale as { meta?: { title?: unknown } }).meta?.title;
if (bundleTitle === cardCopy.title) {
  ok(`one display name everywhere ("${bundleTitle}")`);
} else {
  fail(
    `the plugin shows two names: locale/en.json meta.title "${String(bundleTitle)}" ` +
      `!= settings-card title "${cardCopy.title}" — keep one display name`
  );
}

/* ------------------------------- 13. the live suite stays wired and opt-in */

const e2eConfigPath = join(ROOT, "vitest.e2e.config.ts");
const e2eScript: unknown = pkg.scripts?.["test:e2e"];
if (!existsSync(e2eConfigPath)) {
  fail("vitest.e2e.config.ts is missing — `pnpm run test:e2e` has no config");
} else if (
  typeof e2eScript !== "string" ||
  !e2eScript.includes("vitest.e2e.config.ts")
) {
  fail(
    "the test:e2e script does not use vitest.e2e.config.ts, so the E2E files " +
      "would either be collected by the unit run or never run at all"
  );
} else {
  ok("the E2E suite has its own config and script");
}

// The unit run must stay offline. An E2E file matched by the unit `include`
// would start reaching the network on every `pnpm test`.
const unitInclude =
  /include:\s*\[([^\]]*)\]/u.exec(
    readFileSync(join(ROOT, "vite.config.ts"), "utf8")
  )?.[1] ?? "";
if (unitInclude.includes("e2e")) {
  fail(
    "the unit test include matches E2E files; `pnpm test` would stop being " +
      "offline and deterministic"
  );
} else {
  ok("the unit test include excludes the E2E files");
}

if (/pnpm run test:e2e/u.test(ci)) {
  ok("ci.yml runs the live E2E suite");
} else {
  fail(
    "ci.yml does not run `pnpm run test:e2e`; the live gateway contract would " +
      "go unchecked until a user's meter broke"
  );
}

/* --------------------------------- 14. the automation itself cannot rot quietly */

/**
 * The generated catalog.
 *
 * `src/catalog-data.ts` is written from models.dev, and the one field that went
 * stale before — `provider_npm` — put nine models on an endpoint that cannot
 * serve them. That is a WRONG answer rather than a missing one, so no unit test
 * can catch it: only regenerating and diffing can. Hence a script, and hence a
 * job that runs it.
 */
const shimScript: unknown = pkg.scripts?.["catalog:shim"];
const shimPath = join(ROOT, "scripts/regenerate-catalog-shim.ts");
/**
 * Whether a workflow RUNS a command, as opposed to merely mentioning it.
 *
 * Matching the whole file is not good enough: a step that fails prints the very
 * command it ran, so `pnpm run catalog:shim` appears in ci.yml whether or not
 * anything invokes it. So each line is reduced past its `run:` scaffolding —
 * `- run: cmd`, `run: cmd`, `run: |` plus the block body — comments dropped — and
 * the command has to be the first thing on a line. An `echo "… run 'pnpm run X'"`
 * line no longer qualifies, which is exactly the false positive this exists to
 * remove.
 */
const runs = (source: string, command: string): boolean =>
  source
    .split("\n")
    .map((line) =>
      line
        .trim()
        .replace(/^(?:- )?run:(?:\s*\|\s*)?/, "")
        .trim()
    )
    // A comment-only line is documentation, not an invocation.
    .filter((line) => line.length > 0 && !line.startsWith("#"))
    .some((line) => line.startsWith(command));

const shimScripted =
  typeof shimScript === "string" &&
  shimScript.includes("scripts/regenerate-catalog-shim.ts");
const shimRunsInCi = runs(ci, String.raw`pnpm run catalog:shim`);

if (existsSync(shimPath) && shimScripted && shimRunsInCi) {
  ok("the bundled catalog is generated, scripted, and checked on a schedule");
} else {
  // Plain unnested `if`s, not a chain: the first test has to be the POSITIVE
  // one, and a chain of `else if (!…)` also hides that exactly one of several
  // independent things broke. Most specific reason first.
  if (!existsSync(shimPath)) {
    fail(
      "scripts/regenerate-catalog-shim.ts is missing; the catalog is unmaintainable"
    );
  }
  if (!shimScripted) {
    fail(
      "no catalog:shim script; regenerating the bundled catalog means knowing a " +
        "path, and nothing runs it on a schedule"
    );
  }
  if (!shimRunsInCi) {
    fail(
      "no ci.yml step RUNS `pnpm run catalog:shim`; a stale bundled catalog " +
        "goes unnoticed until a model is dispatched to the wrong endpoint"
    );
  }
}

/**
 * The same arrangement for the Go plan's per-model dollar allowance.
 *
 * `src/go-limits-data.ts` is written from OpenCode's own Go documentation, and it
 * is what lets the meter put a dollar amount on a percentage. A stale table is a
 * WRONG dollar figure wearing the costume of a right one — the vendor says limits
 * "may change", so this moves without a commit. No unit test can catch it: the
 * tests read the very table they are meant to verify. So the same three things
 * are asserted: the script exists, package.json points at it, and a workflow step
 * actually RUNS it (matched as a command, for the reason `runs` documents).
 */
const limitsScript: unknown = pkg.scripts?.["limits:shim"];
const limitsPath = join(ROOT, "scripts/generate-go-limits.ts");
const limitsScripted =
  typeof limitsScript === "string" &&
  limitsScript.includes("scripts/generate-go-limits.ts");
const limitsRunsInCi = runs(ci, String.raw`pnpm run limits:shim`);

if (existsSync(limitsPath) && limitsScripted && limitsRunsInCi) {
  ok(
    "the Go plan allowance table is generated, scripted, and checked on a schedule"
  );
} else {
  if (!existsSync(limitsPath)) {
    fail(
      "scripts/generate-go-limits.ts is missing; the allowance table is unmaintainable"
    );
  }
  if (!limitsScripted) {
    fail(
      "no limits:shim script; regenerating the Go allowance means knowing a " +
        "path, and nothing runs it on a schedule"
    );
  }
  if (!limitsRunsInCi) {
    fail(
      "no ci.yml step RUNS `pnpm run limits:shim`; a stale allowance table " +
        "shows a wrong dollar figure that looks authoritative"
    );
  }
}

/**
 * The coverage ratchet.
 *
 * A threshold set above today's number would block every PR, and one set below
 * it would never fire. The value of a ratchet is that it fails when coverage
 * DROPS, so what has to be asserted here is that one exists at all — and that
 * it actually runs, or it is decoration.
 */
const viteConfig = readFileSync(join(ROOT, "vite.config.ts"), "utf8");
const coverageProvider: unknown = pkg.devDependencies?.["@vitest/coverage-v8"];
const hasCoverageScript = typeof pkg.scripts?.["test:coverage"] === "string";
// Anchored: an unanchored /thresholds:/ also matches `_thresholds:`, so a
// rename would still read as present.
const hasCoverageThresholds = /^\s*thresholds\s*:/mu.test(viteConfig);
const coverageRunsInCi = runs(ci, String.raw`pnpm run test:coverage`);

if (
  hasCoverageScript &&
  typeof coverageProvider === "string" &&
  hasCoverageThresholds &&
  coverageRunsInCi
) {
  ok(
    `coverage is ratcheted and runs in CI (@vitest/coverage-v8 ${coverageProvider})`
  );
} else {
  if (!hasCoverageScript) {
    fail(
      "no test:coverage script; a coverage threshold that never runs is decoration"
    );
  }
  if (typeof coverageProvider !== "string") {
    fail(
      "@vitest/coverage-v8 is not a devDependency; `vp test --coverage` fails " +
        "at startup without it"
    );
  }
  if (!hasCoverageThresholds) {
    fail(
      "vite.config.ts sets no coverage thresholds; coverage is reported but never " +
        "gated, so a regression in the load-bearing modules goes unnoticed"
    );
  }
  if (!coverageRunsInCi) {
    fail(
      "no ci.yml step RUNS `pnpm run test:coverage`; the ratchet cannot fail a " +
        "build from the unit run alone"
    );
  }
}

/**
 * The `jobs:` block of a workflow, split into one string per job.
 *
 * Deliberately a scan rather than a YAML parse: the gate has no YAML dependency,
 * and "a dependency to validate two files" is a worse trade than four lines of
 * indentation-aware splitting. A job key is a bare `name:` at exactly two spaces,
 * which is what `jobs:` children always look like — `steps:`/`with:`/`run:` are
 * deeper, and top-level keys sit at column zero.
 */
const jobsIn = (source: string): string[] => {
  const heading = /^jobs:\s*$/mu.exec(source);
  if (heading === null) {
    return [];
  }
  const body = source.slice(heading.index + heading[0].length);
  // Everything before the next top-level key is the jobs block.
  const nextTopLevel = /^\S/mu.exec(body);
  const block =
    nextTopLevel === null ? body : body.slice(0, nextTopLevel.index);
  return block
    .split(/^ {2}(?=[\w-]+:[ \t]*$)/mu)
    .map((job) => job.trim())
    .filter((job) => job.length > 0);
};

/**
 * Every job is bounded.
 *
 * GitHub's default is six hours. A hung test in a fast suite should fail in
 * minutes, and a release whose polling loop has wedged should fail rather than
 * hold a concurrency group open indefinitely.
 */
let unboundedTotal = 0;
for (const [label, source] of [
  ["ci.yml", ci],
  ["release.yml", releaseYml],
] as const) {
  const jobs = jobsIn(source);
  if (jobs.length === 0) {
    fail(`${label} has no readable jobs block; this check cannot see its jobs`);
    continue;
  }
  const unbounded = jobs.filter((job) => !/^\s*timeout-minutes:/mu.test(job));
  if (unbounded.length > 0) {
    unboundedTotal += unbounded.length;
    fail(
      `${label} has ${unbounded.length} of ${jobs.length} job(s) without ` +
        "timeout-minutes; a hang would burn GitHub's six-hour default first"
    );
  }
}
if (unboundedTotal === 0) {
  ok(
    `every job in ci.yml and release.yml is bounded (${jobsIn(ci).length + jobsIn(releaseYml).length} jobs)`
  );
}

/**
 * Release concurrency must queue, never cancel.
 *
 * Cancelling a re-run of the same tag is precisely the failure that lost
 * v0.7.0: the first run holds a half-published registry and the second — the
 * recovery — is killed before it can finish it.
 */
const releaseQueues =
  /concurrency:/u.test(releaseYml) &&
  !/cancel-in-progress:\s*true/u.test(releaseYml);

if (releaseQueues) {
  ok("release runs queue per tag instead of cancelling each other");
} else {
  if (!/concurrency:/u.test(releaseYml)) {
    fail(
      "release.yml sets no concurrency group; two runs of one tag race on the " +
        "registry"
    );
  }
  if (/cancel-in-progress:\s*true/u.test(releaseYml)) {
    fail(
      "release.yml cancels an in-progress run of the same tag; a re-run meant " +
        "to recover a transient npm fault would instead be killed"
    );
  }
}

/** The tarball a release publishes is recorded, not assumed. */
const packsTarball = /npm pack/u.test(releaseYml);
const hashesTarball = /shasum -a 256/u.test(releaseYml);

if (packsTarball && hashesTarball) {
  ok("the published tarball is packed, hashed and kept as an artifact");
} else {
  if (!packsTarball) {
    fail(
      "release.yml never packs the tarball it publishes, so the bytes that reach " +
        "the registry cannot be compared with the bytes that were built"
    );
  }
  if (!hashesTarball) {
    fail(
      "release.yml packs without recording a digest; there is nothing to verify"
    );
  }
}

/** Dependabot, because the release path is actions and cannot be exercised. */
const dependabotPath = join(ROOT, ".github/dependabot.yml");
if (existsSync(dependabotPath)) {
  const dependabot = readFileSync(dependabotPath, "utf8");
  const missing = ["github-actions", "npm"].filter(
    (ecosystem) => !dependabot.includes(`package-ecosystem: ${ecosystem}`)
  );
  if (missing.length > 0) {
    fail(
      `dependabot.yml does not cover ${missing.join(", ")}; the toolchain that ` +
        "runs the release is the thing most likely to rot"
    );
  } else {
    ok("dependabot covers the release actions and the dependency tree");
  }
} else {
  fail(
    ".github/dependabot.yml is missing; a stale release action is how a tag " +
      "stops producing a publish while the workflow stays green"
  );
}

/* ------------------------------------------------------- build is current */

/**
 * `vp pack` CLEANS `lib/` and emits `lib/client.cjs`; the served `lib/client.js`
 * comes from `scripts/name-client-bundle.ts`. A build that failed, or one whose
 * rename step was skipped, therefore leaves a `lib/` missing a file the host
 * loads, or older than the source it should have been built from —
 * indistinguishable from success to everything downstream, and the settings card
 * and the meter load exactly the missing file.
 *
 * Not hypothetical: a `vp pack` whose output was discarded shipped a `lib/` with
 * no `client.js`, and nothing here or in the suite noticed.
 */
const LIB = join(ROOT, "lib");
const REQUIRED_ARTIFACTS = ["index.mjs", "client.js"];

const newestSource = (dir: string): number => {
  let newest = 0;
  for (const entry of readdirSync(dir, { withFileTypes: true })) {
    const full = join(dir, entry.name);
    newest = Math.max(
      newest,
      entry.isDirectory() ? newestSource(full) : statSync(full).mtimeMs
    );
  }
  return newest;
};

const missingArtifacts = REQUIRED_ARTIFACTS.filter(
  (name) => !existsSync(join(LIB, name))
);
if (missingArtifacts.length > 0) {
  const hint = existsSync(join(LIB, "client.cjs"))
    ? " (lib/client.cjs exists — run scripts/name-client-bundle.ts)"
    : "";
  fail(
    `lib/ is missing ${missingArtifacts.join(", ")}${hint}; the host loads these ` +
      "files, so a build that failed looks exactly like one that succeeded"
  );
} else {
  const builtAt = Math.min(
    ...REQUIRED_ARTIFACTS.map((name) => statSync(join(LIB, name)).mtimeMs)
  );
  if (builtAt < newestSource(join(ROOT, "src"))) {
    fail(
      "lib/ is OLDER than src/ — the artifacts were not rebuilt from the current " +
        "source, which ships a plugin whose behaviour does not match its code"
    );
  } else {
    ok("lib/ carries the current build, including the served client bundle");
  }
}

/* ------------------------------------------------------------------- report */

for (const note of notes) console.log(`  ok   ${note}`);
for (const message of failures) console.error(`  FAIL ${message}`);

if (failures.length) {
  console.error(`\ncheck failed — ${failures.length} problem(s)`);
  process.exit(1);
}
console.log("\ncheck passed");