Remove packageManifest.test.ts

[sroussey]

Summary

Deletes src/packageManifest.test.ts — +2 / −123 across 2 files.

The PR started as a repair of the bunset assertion (#375) and changed direction on the maintainer's call: the case for deleting the suite is stronger than the case for fixing it. The intermediate commit is kept so the reasoning stays on the record.

Why

Of eleven assertions, most restated a value that lives one file away. They can only fail when someone edits package.json, and they cannot tell a mistaken edit from an intended one — which is the entire job they were being asked to do. Both of this month's failures were the tautological ones misfiring:

• the exact bunset pin turned main red for five days on a routine forward bump to a version that was never wrong;
• the gate-list assertion blesses a release-checks that never runs the test suite (release-checks never runs the test suite and runs format in write mode, so bun run release would publish from today's red tree — and packageManifest.test.ts pins that gate list as correct #376) — so the one assertion that looked like it protected the release path was rubber-stamping a gap in it.

What is genuinely lost

Two assertions encoded real intent rather than restating the file, and are recorded here rather than disappearing in a diff:

1. No better-sqlite3 in any dependency map or trustedDependencies. Nothing loads a native SQLite driver since @workglow/sqlite moved to node:sqlite, so a reappearance would be a stale copy-paste — and the trustedDependencies entry would run that package's install scripts. This is the one I would most want kept in some form.
2. Binary-only distribution — exactly the two bin entries, and no exports / main / types.

Neither belongs in a test that reads the same manifest it guards. The natural homes are a dependency policy or a prepack check against the packed tarball, which would also catch what a manifest assertion structurally cannot. Happy to add either as separate work.

Commits

1. 97ba4a85 — the floor fix, superseded. Kept for the reasoning.
2. 85313224 — the deletion.
3. 48f2c909 — drops the README's pointer to the deleted file.

That third commit is worth a note, because it is the counter-example to the rest of this PR. exampleCoverage.test.ts stats every src/… path the README names, so deleting the file turned it red. That is a guard doing real work: one test asserts that a file it reads says what it says, the other catches a claim that stopped being true. The second earned its place.

Verification

format-check, lint, typecheck and exampleCoverage.test.ts (4/4) all pass locally on 48f2c909.

Closes #375.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BLxewpuWR1ZeGdt3XHvVDh

[sroussey]

Changed direction on the maintainer's call: the suite is deleted rather than repaired. The net diff against main is now a single 121-line deletion; the intermediate floor-fix commit is kept so the reasoning is on the record.

The case for deleting it is stronger than the case for fixing it, and this month supplied the evidence. Of eleven assertions, most restate a value that lives one file away — they can only fail when someone edits package.json, and they cannot tell a mistaken edit from an intended one, which is the entire job they were being asked to do. Both of this month's failures were the tautological ones misfiring:

• the exact bunset pin turned main red for five days on a routine forward bump to a version that was never wrong;
• the gate-list assertion blesses a release-checks that never runs the test suite (release-checks never runs the test suite and runs format in write mode, so bun run release would publish from today's red tree — and packageManifest.test.ts pins that gate list as correct #376) — so the one assertion that looked like it protected the release path was rubber-stamping a gap in it.

What is genuinely lost

Two assertions encoded real intent rather than restating the file, and they deserve to be said out loud rather than to disappear in a diff:

1. No better-sqlite3 in any dependency map or trustedDependencies. Nothing loads a native SQLite driver since @workglow/sqlite moved to node:sqlite, so a reappearance would be a stale copy-paste — and the trustedDependencies entry would run that package's install scripts. This is a supply-chain guard, and it is the one I would most want to keep in some form.
2. Binary-only distribution — exactly the two bin entries, and no exports / main / types. Guards against accidentally publishing a library surface the re-founding deliberately removed.

Neither belongs in a test that reads the same manifest it guards. If they are worth keeping, the natural homes are a dependency policy or a prepack check that runs against the packed tarball rather than the source manifest — which would also catch what a manifest assertion structurally cannot. Happy to add either; say which, and I will keep it out of this PR.

Verification

format-check, lint and typecheck all exit 0 on the branch. This also closes #375 — by removing the assertion rather than correcting it.

---

Generated by Claude Code