Simplify workspace authoring and isolate managed component styles

test/bundle-policy.test.ts

@@ -0,0 +1,21 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {bundlePolicyErrors} from "../src/bindings/bundle-policy.js";
+import {addImplementation} from "../src/capability-language/implementation-edit.js";
+
+test("bundled source policy rejects location and dynamic-loading assumptions, not static assets or runtime I/O", () => {
+  for (const code of ['new URL("../x", import.meta.url)', '__dirname', '__filename', 'import(name)', 'require(name)', 'eval(code)', 'new Function(code)'])
+    assert.ok(bundlePolicyErrors(code, "source.ts").length, code);
+  assert.deepEqual(bundlePolicyErrors('import source from "./component.js?browser-source"; import fs from "node:fs"; fs.readFile(userSelectedPath);', "source.ts"), []);
+  assert.deepEqual(bundlePolicyErrors('// import.meta.url\nconst text = "__dirname";', "source.ts"), []);
+});
+
+test("imperative handler insertion preserves arbitrary existing code and rejects ambiguous targets", () => {
+  const original = 'const keep = "createRuntime({fake:1})";\nservePackageRuntime(createRuntime({ existing: customHandler }));\n';
+  const edited = addImplementation(original, "createRuntime", "newHandler", "./impl/new.js");
+  assert.match(edited, /existing: customHandler/);
+  assert.match(edited, /const keep =/);
+  assert.match(edited, /"newHandler": qxImplementation/);
+  assert.throws(() => addImplementation(original, "createRuntime", "existing", "./x.js"), /already exists/);
+  assert.throws(() => addImplementation('createRuntime(one);', "createRuntime", "x", "./x.js"), /Cannot safely/);
+});