test(runner): route-level version resolution on all four demo handlers (DEV-2565) - #245
Merged
Merged
Conversation
…s (DEV-2565) The ticket demanded worker tests for the four create/update handlers; only POST /api/mcp/demos had route-level version assertions. This adds the missing three, through the real router: POST /api/demos and PATCH /api/demos/:id (new demo-routes-version.test.mjs, real broker auth path stubbed at global fetch) and PATCH /api/mcp/demos/:id (appended to mcp-routes.test.mjs). Each proves derivation from the payload's package.json, dist-tag resolution to a concrete ref, a side-effect-free 400 on an invalid explicit ref, and the idempotent re-pin (bare ref in demos.ht_version, pkg.pr.new pins preserved — observed via the __source.json R2 value, the only pinned-files oracle since the fake build_cache always hits). Shared fakes lift into pipeline/fixtures/worker-harness.mjs; fakeR2 now records put values. The two existing mcp-routes create tests also seed the version catalog — they provably fetched live npm before, and the create response assertion pins the seeded 16.2.0 so a drifted CACHE key cannot silently reintroduce the registry dependency. Every test mutation-checked: reintroducing the ?? "latest" default per handler, dropping the 400, and clobbering an existing pkg.pr.new pin each fail at least two of the new tests. Full suite 817/0, tsc clean.
demtario
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the caveat noted on DEV-2565: the ticket's deliverable was route-level tests on all four create/update handlers, and only
POST /api/mcp/demoshad them. This adds the missing three, driven through the real router:POST /api/demosandPATCH /api/demos/:id— newpipeline/demo-routes-version.test.mjs(9 tests). Auth goes through the production broker path: a global fetch stub answers theBearerexchange and throws on every other URL, so an un-seeded fallthrough to npm fails as a 502 instead of silently passing against livelatest.PATCH /api/mcp/demos/:id— 3 tests appended topipeline/mcp-routes.test.mjs, whose charter is the MCP routes.Each handler is proven on the ticket's four behaviors: derivation from the payload's own
package.jsonpin whenhtVersionis absent, explicit-dist-tag resolution to a concrete release, a side-effect-free 400 on an invalid ref (empty write log, no R2 puts), and the idempotent re-pin — bare ref stored indemos.ht_version, an existing pkg.pr.new URL pin preserved as a fixed point, observed through the__source.jsonR2 value (the only pinned-files oracle, since the fakebuild_cachealways hits and skips the real build).Support changes: the shared fakes lift out of
mcp-routes.test.mjsintopipeline/fixtures/worker-harness.mjs(fakeR2 now records put values), and the two pre-existing MCP create tests seed the version catalog — a fetch-spy proved they hit live npm on every CI run until now; the create response now asserts the seeded16.2.0exactly so a drifted cache key can't quietly bring the registry dependency back.Verification. Every test is mutation-checked: per-handler reintroduction of the
?? "latest"default, removal of the 400, and clobbering a pkg.pr.new pin each fail 2–4 of the new tests (matrix in the commit message). Full pipeline suite: 817 pass / 0 fail (2 pre-existing todo).tsc --noEmitinworkers/api: clean. Three independent adversarial reviews (hollow-test, cannot-fail, assertion-drift lenses) came back clean.Note
Cursor Bugbot is generating a summary for commit ce29af2. Configure here.