test(core,sisyphus): add 192 unit tests for pure functions

core (33 tests):
- deepMerge: flat merge, nested objects, arrays, prototype pollution
- mri-utils: buildMriOptions, convertNumbers, mapPositionals, validatePositionals

sisyphus (159 tests):
- BumpType: compareBumps, higherBump, isBumpType
- Stone: create, JSON roundtrip, merge, snapshot-drop edge case
- Commit: conventional commit parsing, breaking changes, scopes
- Package: fromJson, withBump, newVersion, labels
- helpers: nonEmpty, ChangesetParser.toStoneData
- VersionCalculator: semver bumps, pre-release, snapshot
- GitRemoteParser: URL parsing for GitHub/GitLab/Bitbucket
- utils: buildPackagePathMap, findAffectedPackages, findDependencyPackages

Author: ice-chillios

packages/core/tests/util/deepMerge.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, test } from "bun:test";
+import { deepMerge } from "../../src/util/misc";
+
+describe("deepMerge", () => {
+  test("merges flat objects", () => {
+    expect(deepMerge({ a: 1 }, { b: 2 })).toEqual({ a: 1, b: 2 });
+  });
+
+  test("source overrides target for same key", () => {
+    expect(deepMerge({ a: 1 }, { a: 2 })).toEqual({ a: 2 });
+  });
+
+  test("deep nested merge", () => {
+    expect(deepMerge({ a: { b: 1 } }, { a: { c: 2 } })).toEqual({ a: { b: 1, c: 2 } });
+  });
+
+  test("arrays are replaced entirely, not concatenated", () => {
+    expect(deepMerge({ a: [1, 2] }, { a: [3] })).toEqual({ a: [3] });
+  });
+
+  test("non-object source returns source", () => {
+    expect(deepMerge({ a: 1 }, "string")).toBe("string");
+  });
+
+  test("non-object target with object source returns source", () => {
+    expect(deepMerge("string", { a: 1 })).toEqual({ a: 1 });
+  });
+
+  test("null source returns null (source wins)", () => {
+    expect(deepMerge({ a: 1 }, null)).toBeNull();
+  });
+
+  test("undefined values in source overwrite target", () => {
+    expect(deepMerge({ a: 1, b: 2 }, { a: undefined })).toEqual({ a: undefined, b: 2 });
+  });
+
+  test("empty objects merge to empty object", () => {
+    expect(deepMerge({}, {})).toEqual({});
+  });
+
+  test("deep nested 3+ levels", () => {
+    const target = { a: { b: { c: 1, d: 2 }, e: 3 } };
+    const source = { a: { b: { c: 10, f: 4 }, g: 5 } };
+
+    expect(deepMerge(target, source)).toEqual({ a: { b: { c: 10, d: 2, f: 4 }, e: 3, g: 5 } });
+  });
+
+  /**
+   * SECURITY: prototype pollution via constructor key.
+   *
+   * The current implementation uses spread (`{ ...target }`) and `Object.keys()`,
+   * which treats `constructor` as a regular own property on the result object
+   * rather than walking up the prototype chain. This means `Object.prototype`
+   * is NOT polluted by this particular vector.
+   *
+   * However, the implementation does NOT explicitly reject dangerous keys
+   * (`__proto__`, `constructor`, `prototype`). If the merge strategy changes
+   * (e.g., to mutate in place), pollution could be re-introduced. Consider
+   * adding an explicit key blocklist for defense in depth.
+   */
+  test("SECURITY: prototype pollution via constructor key does not pollute Object.prototype", () => {
+    const malicious = JSON.parse('{"constructor":{"prototype":{"polluted":true}}}');
+
+    const result = deepMerge({}, malicious);
+
+    // Object.prototype must NOT be polluted
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+
+    // The constructor key should exist as a plain property on the result
+    expect(result).toHaveProperty("constructor");
+  });
+
+  test("mixed types: source number overwrites target object", () => {
+    expect(deepMerge({ a: { nested: true } }, { a: 42 })).toEqual({ a: 42 });
+  });
+
+  test("target keys not in source are preserved", () => {
+    expect(deepMerge({ a: 1, b: 2, c: 3 }, { b: 20 })).toEqual({ a: 1, b: 20, c: 3 });
+  });
+});

packages/core/tests/util/mri-utils.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test } from "bun:test";
+import type { ArgDefinition } from "../../src/command/args";
+import type { PositionalDefinition } from "../../src/command/positionals";
+import { buildMriOptions, convertNumbers, mapPositionals, validatePositionals } from "../../src/util/mri-utils";
+
+describe("buildMriOptions", () => {
+  test("boolean args go to boolean array", () => {
+    const defs: Record<string, ArgDefinition> = { debug: { type: "boolean" }, verbose: { type: "boolean" } };
+    const opts = buildMriOptions(defs);
+    expect(opts.boolean).toEqual(["debug", "verbose"]);
+    expect(opts.string).toEqual([]);
+  });
+
+  test("string and number args go to string array", () => {
+    const defs: Record<string, ArgDefinition> = { count: { type: "number" }, name: { type: "string" } };
+    const opts = buildMriOptions(defs);
+    expect(opts.string).toEqual(["count", "name"]);
+    expect(opts.boolean).toEqual([]);
+  });
+
+  test("aliases registered correctly", () => {
+    const defs: Record<string, ArgDefinition> = {
+      output: { alias: "o", type: "string" },
+      verbose: { alias: "v", type: "boolean" },
+    };
+    const opts = buildMriOptions(defs);
+    expect(opts.alias.v).toBe("verbose");
+    expect(opts.alias.o).toBe("output");
+  });
+
+  test("camelCase auto-generates kebab-case alias", () => {
+    const defs: Record<string, ArgDefinition> = { dryRun: { type: "boolean" }, outputDir: { type: "string" } };
+    const opts = buildMriOptions(defs);
+    expect(opts.alias["dry-run"]).toBe("dryRun");
+    expect(opts.alias["output-dir"]).toBe("outputDir");
+  });
+
+  test("defaults populated", () => {
+    const defs: Record<string, ArgDefinition> = {
+      count: { default: 10, type: "number" },
+      name: { type: "string" },
+      verbose: { default: false, type: "boolean" },
+    };
+    const opts = buildMriOptions(defs);
+    expect(opts.default).toEqual({ count: 10, verbose: false });
+  });
+});
+
+describe("convertNumbers", () => {
+  test("converts string '42' to number 42", () => {
+    const defs: Record<string, ArgDefinition> = { count: { type: "number" } };
+    const result = convertNumbers({ count: "42" }, defs);
+    expect(result.count).toBe(42);
+  });
+
+  test("throws on invalid number (NaN)", () => {
+    const defs: Record<string, ArgDefinition> = { count: { type: "number" } };
+    expect(() => convertNumbers({ count: "abc" }, defs)).toThrow('Invalid number for --count: "abc"');
+  });
+
+  test("skips boolean and string types", () => {
+    const defs: Record<string, ArgDefinition> = { name: { type: "string" }, verbose: { type: "boolean" } };
+    const result = convertNumbers({ name: "hello", verbose: true }, defs);
+    expect(result.verbose).toBe(true);
+    expect(result.name).toBe("hello");
+  });
+
+  test("skips undefined values", () => {
+    const defs: Record<string, ArgDefinition> = { count: { type: "number" } };
+    const result = convertNumbers({} as Record<string, string | boolean>, defs);
+    expect(result.count).toBeUndefined();
+  });
+});
+
+describe("mapPositionals", () => {
+  test("maps single positional correctly", () => {
+    const defs: Record<string, PositionalDefinition> = { name: { required: true } };
+    const result = mapPositionals(["foo"], defs);
+    expect(result.name).toBe("foo");
+  });
+
+  test("maps multiple positionals by index", () => {
+    const defs: Record<string, PositionalDefinition> = { dest: { required: true }, source: { required: true } };
+    const result = mapPositionals(["a.txt", "b.txt"], defs);
+    expect(result.dest).toBe("a.txt");
+    expect(result.source).toBe("b.txt");
+  });
+
+  test("variadic positional captures rest as array", () => {
+    const defs: Record<string, PositionalDefinition> = { first: { required: true }, rest: { variadic: true } };
+    const result = mapPositionals(["a", "b", "c", "d"], defs);
+    expect(result.first).toBe("a");
+    expect(result.rest).toEqual(["b", "c", "d"]);
+  });
+
+  test("missing positional returns undefined", () => {
+    const defs: Record<string, PositionalDefinition> = { extra: {}, name: { required: true } };
+    const result = mapPositionals(["foo"], defs);
+    expect(result.extra).toBe("foo");
+    expect(result.name).toBeUndefined();
+  });
+
+  test("extra positionals silently dropped", () => {
+    const defs: Record<string, PositionalDefinition> = { name: { required: true } };
+    const result = mapPositionals(["foo", "bar", "baz"], defs);
+    expect(result.name).toBe("foo");
+    expect(Object.keys(result)).toEqual(["name"]);
+  });
+});
+
+describe("validatePositionals", () => {
+  test("returns null when all required present", () => {
+    const defs: Record<string, PositionalDefinition> = { name: { required: true } };
+    const result = validatePositionals({ name: "foo" }, defs);
+    expect(result).toBeNull();
+  });
+
+  test("returns error for missing required", () => {
+    const defs: Record<string, PositionalDefinition> = { name: { required: true } };
+    const result = validatePositionals({ name: undefined }, defs);
+    expect(result).toBe("Missing required argument: <name>");
+  });
+
+  test("returns error for empty variadic required", () => {
+    const defs: Record<string, PositionalDefinition> = { files: { required: true, variadic: true } };
+    const result = validatePositionals({ files: [] }, defs);
+    expect(result).toBe("Missing required argument: <files...>");
+  });
+
+  test("skips non-required", () => {
+    const defs: Record<string, PositionalDefinition> = { optional: { required: false } };
+    const result = validatePositionals({ optional: undefined }, defs);
+    expect(result).toBeNull();
+  });
+});
+
+describe("toKebabCase (via buildMriOptions)", () => {
+  test("camelCase generates kebab-case alias", () => {
+    const defs: Record<string, ArgDefinition> = { myLongOption: { type: "string" } };
+    const opts = buildMriOptions(defs);
+    expect(opts.alias["my-long-option"]).toBe("myLongOption");
+  });
+
+  test("already kebab-case does not produce duplicate alias", () => {
+    const defs: Record<string, ArgDefinition> = { "already-kebab": { type: "string" } };
+    const opts = buildMriOptions(defs);
+    expect(opts.alias["already-kebab"]).toBeUndefined();
+  });
+});

packages/sisyphus/tests/domain/BumpType.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  BUMP_EMOJI,
+  BUMP_ORDER,
+  BUMP_PRIORITY,
+  BumpType,
+  compareBumps,
+  higherBump,
+  isBumpType,
+} from "../../src/domain/BumpType";
+
+describe("compareBumps", () => {
+  test("Major > Minor returns positive", () => {
+    expect(compareBumps(BumpType.Major, BumpType.Minor)).toBeGreaterThan(0);
+  });
+
+  test("Minor > Patch returns positive", () => {
+    expect(compareBumps(BumpType.Minor, BumpType.Patch)).toBeGreaterThan(0);
+  });
+
+  test("Patch > Dependency returns positive", () => {
+    expect(compareBumps(BumpType.Patch, BumpType.Dependency)).toBeGreaterThan(0);
+  });
+
+  test("Dependency > Snapshot returns positive", () => {
+    expect(compareBumps(BumpType.Dependency, BumpType.Snapshot)).toBeGreaterThan(0);
+  });
+
+  test("same type returns 0", () => {
+    expect(compareBumps(BumpType.Major, BumpType.Major)).toBe(0);
+    expect(compareBumps(BumpType.Minor, BumpType.Minor)).toBe(0);
+    expect(compareBumps(BumpType.Patch, BumpType.Patch)).toBe(0);
+    expect(compareBumps(BumpType.Dependency, BumpType.Dependency)).toBe(0);
+    expect(compareBumps(BumpType.Snapshot, BumpType.Snapshot)).toBe(0);
+  });
+
+  test("Minor < Major returns negative", () => {
+    expect(compareBumps(BumpType.Minor, BumpType.Major)).toBeLessThan(0);
+  });
+});
+
+describe("higherBump", () => {
+  test("returns Major when Major vs Minor", () => {
+    expect(higherBump(BumpType.Major, BumpType.Minor)).toBe(BumpType.Major);
+  });
+
+  test("returns Major when Minor vs Major (order independent)", () => {
+    expect(higherBump(BumpType.Minor, BumpType.Major)).toBe(BumpType.Major);
+  });
+
+  test("equal bumps returns first argument", () => {
+    expect(higherBump(BumpType.Patch, BumpType.Patch)).toBe(BumpType.Patch);
+  });
+});
+
+describe("isBumpType", () => {
+  test.each(["major", "minor", "patch", "dependency", "snapshot"])('returns true for valid value "%s"', (value) => {
+    expect(isBumpType(value)).toBe(true);
+  });
+
+  test.each(["invalid", "", "Major", "MAJOR"])('returns false for invalid value "%s"', (value) => {
+    expect(isBumpType(value)).toBe(false);
+  });
+});
+
+describe("BUMP_ORDER", () => {
+  test("contains all 5 types in priority order", () => {
+    expect(BUMP_ORDER).toEqual([
+      BumpType.Major,
+      BumpType.Minor,
+      BumpType.Patch,
+      BumpType.Dependency,
+      BumpType.Snapshot,
+    ]);
+    expect(BUMP_ORDER).toHaveLength(5);
+  });
+});
+
+describe("BUMP_PRIORITY", () => {
+  test("Major has highest priority (5)", () => {
+    expect(BUMP_PRIORITY[BumpType.Major]).toBe(5);
+
+    for (const type of [BumpType.Minor, BumpType.Patch, BumpType.Dependency, BumpType.Snapshot]) {
+      expect(BUMP_PRIORITY[type]).toBeLessThan(BUMP_PRIORITY[BumpType.Major]);
+    }
+  });
+});
+
+describe("BUMP_EMOJI", () => {
+  test("all types have an emoji", () => {
+    for (const type of Object.values(BumpType)) {
+      expect(BUMP_EMOJI[type]).toBeDefined();
+      expect(typeof BUMP_EMOJI[type]).toBe("string");
+      expect(BUMP_EMOJI[type].length).toBeGreaterThan(0);
+    }
+  });
+});