test(repo): verify packed consumers

[jrusso1020]

What

Verify publish artifacts as clean consumers instead of only scanning tarball manifests.

Why

A package can contain all declared files and still fail when installed or imported by Node, TypeScript, or a browser bundler.

How

Pack workspaces, install them into isolated fixtures, validate relative imports, and execute representative consumer entry points.

Test plan

• packed-manifest unit tests; clean packed install and consumer smoke
• Stack-wide lint, format, build, typecheck, and relevant integration gates

[jrusso1020]

• refactor(repo): resolve changed-code audit #2174
• test(engine): isolate peer abort regression #2173
• refactor(cli): decompose render phases #2172
• refactor(cli): centralize process lifecycle #2171
• fix(cloudrun): publish adapter contract #2170
• test(repo): execute packed subpaths #2169
• refactor(repo): centralize package subpaths #2168
• refactor(core): own edit protocol contract #2167
• test(compiler): enforce preview render parity #2166
• refactor(studio): gate SDK operation families #2165
• refactor(studio): gate Acorn writer migration #2164
• refactor(producer): make capture plans immutable #2163
• refactor(producer): unify render requests #2162
• refactor(engine): type capture failures #2161
• refactor(engine): manage child process lifecycles #2160
• refactor(engine): add fingerprinted browser leases #2159
• refactor(render): centralize execution ownership #2158
• refactor(core): unify composition contract #2157
• fix(studio): enforce optimistic file concurrency #2156
• fix(studio): make sdk cutover transactional #2155
• fix(render): publish artifacts atomically #2154
• fix(render): surface structured outcomes #2153
• fix(player): own connection and media resources #2152
• fix(core): preserve runtime transport contract #2151
• fix(player): version runtime protocol #2150
• test(repo): verify packed consumers #2149 👈 (View in Graphite)
• test(repo): enforce workspace contracts #2148
• fix(core): enforce strict runtime safety #2147
• test(producer): gate source tests by execution lane #2146
• fix(core): make timing masks safe for source loaders #2145
• chore(repo): forbid tracked generated artifacts #2144
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[miga-heygen]

Review — test(repo): verify packed consumers

SSOT check: clean. The verification pipeline is a single linear chain: pack → verify manifest → install as consumer → typecheck → runtime smoke → CLI startup. No decision duplication.

packageExportSpecifier / listPackedExportContracts: correctly derive consumer specifiers from the export map. The typechecked flag (Boolean(target?.types)) gates which specifiers go into the TS consumer fixture vs. the runtime-only smoke. Clean separation.

Consumer fixture: installs packed tarballs via file: references (not workspace links — genuine "install as a consumer" simulation), pulls typescript and @types/node from the root devDeps (no version drift). The tsconfig.json uses moduleResolution: "NodeNext" — matches real consumer environments.

Runtime smoke: import.meta.resolve for all specifiers (fast, no side effects), then dynamic import() for specific SDK entry points with typeof assertions. Good — catches broken export maps without running heavy initialization.

CLI startup: hyperframes --help with telemetry disabled. Catches missing bin entry / unresolvable CLI entry point.

Refactoring: verifyWorkspace → packAndVerifyWorkspace returns { workspace, filename, packedPackage } or null for private packages; main() orchestrates pack-all → consumer-verify. The shared packDir is created once and cleaned up in a finally. Clean.

Tests: packageExportSpecifier and listPackedExportContracts unit-tested with the types-present/absent distinction. Good.

LGTM — no issues found.

— Miga

[james-russo-rames-d-jusso]

Reviewed at 03acdb3.

Solid infra addition. This lifts the pack-verify script from "pack and inspect manifests" to "pack, install into a real consumer fixture, typecheck + smoke-import + CLI-help." That's exactly the layer that catches the shape of bugs where the packed manifest lists an export but the packed tarball is missing the .d.ts (which the R1-flavor assertPublishedExportsMatchSource alone can't catch — it verifies source correctness, not packed availability).

Structural notes:

• writeConsumerFixture — reasonable shape. Pins typescript + @types/node from root's devDependencies (verified: ^5.0.0 / ^25.0.10, semver ranges — bun install will resolve from npm, not a workspace:* protocol issue). The fixture's consumer.ts bulk-imports every types-carrying export, and consumer-smoke.mjs runtime-imports every declared export + spot-checks four public function names (openComposition, createMemoryAdapter, createFsAdapter, plus the four core/parsers/lint/studio-server round-trips). Good coverage of both TS surface and runtime surface.

• listPackedExportContracts + packageExportSpecifier — clean extract, unit-tested. typechecked: Boolean(target?.types) correctly handles both string exports (untyped) and object exports with a types field.

Two small observations, non-blocking:

• packages/cli/utils/verify-packed-manifests.mjs:116 — the CLI-help assertion is cliOutput.toLowerCase().includes("hyperframes"). Since execFileSync throws on non-zero exit, the throw path covers CLI failure. The .includes("hyperframes") catches the "ran but printed something unexpected" case, but "hyperframes" is broad enough that error output like hyperframes: command not found (though that would exit non-zero) or a stub help would still pass. A slightly stronger check for a known subcommand token (e.g., "render" or "snapshot") would tighten this. Not important for correctness, just makes the assert more descriptive of what it's actually checking.

• packages/cli/utils/verify-packed-manifests.mjs:107 + :113 — mixed process.execPath (for tsc) vs bare "node" (for consumer-smoke.mjs). Both work; the process.execPath path is more robust to weird PATH configurations. Cosmetic — probably not worth changing on this PR.

What I didn't verify

• Behavior on packages with wildcard/pattern exports ("./adapters/*": …) — didn't check whether Object.entries(packedPackage.exports) handles those cleanly. If HF workspaces don't use wildcard exports today, this is moot.

LGTM.

— Review by Rames D Jusso

[miguel-heygen]

Re-review at 979e9d09 after the stack restack. The stable patch-id is identical to the previously reviewed 03acdb38 change, so the own boundary is unchanged.

• scripts/verify-packed-manifests.mjs:296-389 builds a genuine tarball-backed consumer, then verifies NodeNext type resolution, runtime imports, and CLI startup.
• scripts/verify-packed-manifests.mjs:404-413 keeps the shared temporary pack directory behind a single finally cleanup.
• All eight required checks are green, including Build, Test, runtime contract, Windows tests/render, and Typecheck.

— Magi / deepwork

Verdict: APPROVE
Reasoning: The exact reviewed patch survived the restack unchanged, the consumer verification boundary is sound, and required CI is green.

[jrusso1020]

Merge activity

• Jul 13, 5:27 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 13, 5:27 PM UTC: @jrusso1020 merged this pull request with Graphite.