feat: release design system engine, studio and component contracts

packages/core/test/control-templates.test.ts

@@ -1,23 +1,60 @@
 import { expect, test } from "bun:test";
-import { encodeControlTemplate, renderControlTemplates } from "../src/control-templates.ts";
+import {
+  encodeControlTemplate,
+  resolveControlTemplate,
+  renderControlTemplates,
+} from "../src/control-templates.ts";
 import { runWithRequestContext } from "../src/request-context.ts";
 import { createContext } from "../src/context.ts";
 import { resolveRequestUrl } from "../src/headers.ts";
 
+test("registry templates omit duplicated SSR ranges but preserve source and foreign controls", () => {
+  runWithRequestContext({} as never, () => {
+    const leaf = `<p>${"Large leaf".repeat(400)}</p>`;
+    let body = leaf;
+    for (let depth = 0; depth < 12; depth++) {
+      const reference = encodeControlTemplate([{ cond: "open", body }]);
+      body = `<template data-wrn-if="${reference}"></template>${body}<template data-wrn-control-end></template>`;
+    }
+    const html = renderControlTemplates();
+    expect(html.length).toBeLessThan(10000);
+    const compacted = JSON.parse(/data-wrn-controls[^>]*>(.*?)<\/script>/s.exec(html)![1]!);
+    expect(
+      compacted.filter((branches: Array<{ body: string }>) => branches[0]!.body.includes(leaf)),
+    ).toHaveLength(1);
+    expect(html).toContain("data-wrn-control-client");
+    expect(body).toContain(leaf);
+    const foreign =
+      '<template data-wrn-if="@foreign:0"></template><b>Keep</b><template data-wrn-control-end></template>';
+    const incomplete = body.replace(/<template data-wrn-control-end><\/template>$/, "");
+    encodeControlTemplate([
+      { cond: null, body: foreign },
+      { cond: null, body: incomplete },
+    ]);
+    const definitions = JSON.parse(
+      /data-wrn-controls[^>]*>(.*?)<\/script>/s.exec(renderControlTemplates())![1]!,
+    );
+    expect(definitions[12][0].body).toBe(foreign);
+    expect(definitions[12][1].body).toBe(incomplete);
+  });
+});
+
 test("nested controls use short references and HTML-safe isolated registries", async () => {
-  const results = await Promise.all(["first", "second"].map((name) =>
-    runWithRequestContext({} as never, async () => {
-      let body = `</script><p>${name}</p>`;
-      for (let i = 0; i < 30; i++) {
-        body = `<template data-wrn-if="${encodeControlTemplate([{cond: null, body}])}"></template>`;
-      }
-      await Promise.resolve();
-      const html = renderControlTemplates();
-      expect(html.length).toBeLessThan(7000);
-      expect(html.match(/<\/script>/g)).toHaveLength(1);
-      return html;
-    }),
-  ));
+  const results = await Promise.all(
+    ["first", "second"].map((name) =>
+      runWithRequestContext({} as never, async () => {
+        let body = `</script><p>${name}</p>`;
+        for (let i = 0; i < 30; i++) {
+          body = `<template data-wrn-if="${encodeControlTemplate([{ cond: null, body }])}"></template>`;
+        }
+        await Promise.resolve();
+        const html = renderControlTemplates();
+        expect(html.length).toBeLessThan(7000);
+        expect(html.match(/<\/script>/g)).toHaveLength(1);
+        return html;
+      }),
+    ),
+  );
   expect(results[0]).toContain("first");
   expect(results[0]).not.toContain("second");
   expect(results[1]).not.toContain("first");
@@ -28,11 +65,34 @@ test("standalone rendering keeps the base64 format", () => {
   expect(JSON.parse(Buffer.from(encodeControlTemplate([1]), "base64").toString())).toEqual([1]);
 });
 
+test("SSR control resolution accepts only the owning request and exact registry index", async () => {
+  let reference = "";
+  await runWithRequestContext({} as never, async () => {
+    const definition = [{ cond: "review", body: "<p>Review</p>" }];
+    reference = encodeControlTemplate(definition);
+    expect(resolveControlTemplate(reference)).toBe(definition);
+    expect(resolveControlTemplate(reference + "0")).toBeUndefined();
+    expect(resolveControlTemplate(reference.replace(/:0$/, ":-1"))).toBeUndefined();
+    expect(resolveControlTemplate(reference.replace(/:0$/, ":1"))).toBeUndefined();
+    await runWithRequestContext({} as never, async () => {
+      encodeControlTemplate([{ body: "Other request" }]);
+      expect(resolveControlTemplate(reference)).toBeUndefined();
+    });
+    expect(resolveControlTemplate(reference)).toBe(definition);
+  });
+  expect(resolveControlTemplate(reference)).toBeUndefined();
+});
+
 test("trusted proxy request URL and body agree with context; untrusted headers are ignored", async () => {
   for (const trust of [true, false]) {
     const request = new Request("http://internal:3000/api/captcha/challenge", {
-      method: "POST", body: '{"test":1}',
-      headers: { "x-forwarded-proto": "https", "x-forwarded-host": "wrnexus.com", origin: "https://evil.example" },
+      method: "POST",
+      body: '{"test":1}',
+      headers: {
+        "x-forwarded-proto": "https",
+        "x-forwarded-host": "wrnexus.com",
+        origin: "https://evil.example",
+      },
     });
     const context = createContext(request, resolveRequestUrl(request, trust));
     expect(context.req.url).toBe(context.url.href);