@zimoby/cep-testkit

A Node-only development dependency for fail-closed CEP test orchestration. It must not be bundled into a CEP panel or ZXP.

Version 0.1.0 implements the accepted Milestone 0 kernel and Milestone 1 bounded CDP/runtime-identity layer. It supports Node.js 22 and builds ESM, CommonJS, and TypeScript declarations.

Release status: the source repository is public, and the complete package gates pass on macOS and Windows. npm registry availability is authoritative; the exact install command below resolves after the authorized 0.1.0 release is published.

Install

Pin the exact development version:

npm install --save-dev --save-exact @zimoby/[email protected]

Do not import this package from CEP/browser production source. Product repositories keep extension IDs, canonical entry paths, build probes, selectors, debug APIs, fixtures, AE actions, and scenarios in product-owned adapters.

Entry points

The root @zimoby/cep-testkit export contains the versioned schema and pure lifecycle kernel.

The @zimoby/cep-testkit/cdp subpath contains bounded discovery, exact canonical target selection, raw client lifecycle, runtime authentication, authenticated dispatch, reload reauthentication, and fail-closed quarantine.

import {
  CdpClient,
  authenticateRuntime,
  discoverCdpTargets,
  selectCanonicalTarget,
} from "@zimoby/cep-testkit/cdp";

CdpClient intentionally exposes no public unauthenticated dispatch method. A caller must discover, select exactly one canonical target, connect a fresh client, and successfully authenticate the independent runtime identity before using the returned authenticated session.

Operation and bootstrap dispatches are frozen CdpDispatch<T> capabilities rather than native Promise instances. Call wait(), use await, or use then/catch/finally and standard promise combinators; each consumption path acknowledges the child dispatch. CdpDispatch deliberately has no native Promise brand, so borrowed calls such as Promise.prototype.then.call(dispatch, ...) throw rather than pretending it is a Promise.

Development verification

Use Node.js 22 with npm 10.9.8:

npm run cache:seed
npm run prepublishOnly

cache:seed is the explicit network-capable dependency/cache bootstrap. The deterministic build, test, and packed-consumer probes then use the pinned lockfile and repository-local offline cache. prepublishOnly also runs a current registry-backed production dependency audit, so the complete publication gate requires network access.

Safety boundary

• The package is Node-only test infrastructure, never panel runtime code.
• A product must supply exact product identity and narrowly scoped callbacks.
• Unknown CDP completion quarantines that client permanently.
• A stale, closed, expired, copied, or unauthenticated capability cannot dispatch.
• Package CI and loopback probes are not evidence of live After Effects behavior.
• Live AE/CDP operations, product mutation, installation, packaging, signing, and release require separate product authorization.