feat(03-04): Worker [assets] binding + one-command deploy + D-14 build-artifact gate
- wrangler.jsonc assets block serves ../web/dist; run_worker_first keeps /api/* + /telegram/* on the Worker (D-13) - root npm run deploy = build theme → web → bot wrangler deploy + set-webhook (D-15); dev = build + wrangler dev --port 8787 --local (D-12) - vite.config.ts dual-build: __ARAHARAH_HARNESS__ define keyed on --mode harness, separate dist/dist-harness outDirs - main.ts guard unchanged; ambient constant declared once in web/src/vite-env.d.ts - build-artifact.test.mjs BA1..BA6: zero CDN refs, self-hosted fonts, MapLibre worker, inlined style, no mock installer in ANY emitted file (HTML included)
This commit is contained in:
araharah-executor
@@ -0,0 +1,135 @@
|
||||
#!/usr/bin/env node
|
||||
/*
|
||||
* build-artifact.test.mjs — the D-14 build-artifact gate (T-03-20, T-03-21).
|
||||
* ------------------------------------------------------------------------------
|
||||
* Reads web/dist (the PRODUCTION build only — the [assets] binding serves
|
||||
* exactly this directory) and proves the shipped bundle is fully
|
||||
* self-contained and free of the Mock-Telegram installer:
|
||||
*
|
||||
* BA1 no emitted .js/.css file references a third-party CDN
|
||||
* (cdn.tailwindcss.com, fonts.googleapis.com, fonts.gstatic.com,
|
||||
* unpkg.com, cdn.jsdelivr.net) — T-03-20: a CDN slip would leak
|
||||
* user navigation requests to third parties
|
||||
* BA2 at least one self-hosted .woff2 font was copied through by Vite's
|
||||
* url() resolution of @araharah/theme/dist/rams.css
|
||||
* BA3 a hashed MapLibre worker chunk exists under web/dist/assets
|
||||
* BA4 the built JS carries the inlined Rams style ("liberty-rams" or
|
||||
* "ne2_shaded" — build-time import, never a runtime fetch)
|
||||
* BA5 the PRODUCTION bundle contains "installMockWebApp"/"__ARAHARAH_MOCK__"
|
||||
* in NO emitted file — .js AND .html (web/index.html is the ONE entry
|
||||
* shared by both builds, so an unguarded runner-page profile block
|
||||
* would ship the mock and the fetch stubs as inline HTML that a
|
||||
* JS-only scan would miss entirely). Scans web/dist ONLY: the harness
|
||||
* build emits to web/dist-harness/ and is deliberately NOT clean —
|
||||
* BA5 pointed there would invert the gate it exists to enforce.
|
||||
* BA6 no emitted HTML carries the runner page's /api/session or
|
||||
* /api/location-fallback fetch stubs (same dead-code-elimination proof)
|
||||
*
|
||||
* If web/dist does not exist, every case fails with a build-first message.
|
||||
*/
|
||||
import { strict as assert } from "node:assert";
|
||||
import { readdirSync, readFileSync, existsSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import path from "node:path";
|
||||
import { test } from "./harness.mjs";
|
||||
|
||||
const WEB = path.join(fileURLToPath(new URL(import.meta.url)), "..", "..");
|
||||
const DIST = join(WEB, "dist");
|
||||
const DIST_ASSETS = join(DIST, "assets");
|
||||
|
||||
const CDN_HOSTS = [
|
||||
"cdn.tailwindcss.com",
|
||||
"fonts.googleapis.com",
|
||||
"fonts.gstatic.com",
|
||||
"unpkg.com",
|
||||
"cdn.jsdelivr.net",
|
||||
];
|
||||
|
||||
function claimBuildFirst() {
|
||||
return new Error(
|
||||
"web/dist does not exist — run `npm run build -w theme && npm run build -w web` before this suite",
|
||||
);
|
||||
}
|
||||
|
||||
/* walk web/dist recursively — DirEnt-based, no dependency */
|
||||
function walk(dir) {
|
||||
const out = [];
|
||||
for (const entry of readdirSync(dir, { withFileTypes: true })) {
|
||||
const full = join(dir, entry.name);
|
||||
if (entry.isDirectory()) out.push(...walk(full));
|
||||
else out.push(full);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function readIfExists(file) {
|
||||
return existsSync(file) ? readFileSync(file, "utf8") : null;
|
||||
}
|
||||
|
||||
const allFiles = existsSync(DIST) ? walk(DIST) : [];
|
||||
const jsFiles = allFiles.filter((f) => f.endsWith(".js"));
|
||||
const cssFiles = allFiles.filter((f) => f.endsWith(".css"));
|
||||
const htmlFiles = allFiles.filter((f) => f.endsWith(".html"));
|
||||
|
||||
test("BA1 no emitted .js/.css file references a third-party CDN (D-14)", () => {
|
||||
assert.ok(existsSync(DIST), claimBuildFirst().message);
|
||||
for (const file of [...jsFiles, ...cssFiles]) {
|
||||
const content = readFileSync(file, "utf8");
|
||||
for (const host of CDN_HOSTS) {
|
||||
assert.ok(
|
||||
!content.includes(host),
|
||||
`${file} references CDN host ${host} (D-14 forbids CDN fallbacks)`,
|
||||
);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
test("BA2 web/dist carries self-hosted woff2 fonts copied at build time", () => {
|
||||
assert.ok(existsSync(DIST), claimBuildFirst().message);
|
||||
const woff2 = allFiles.filter((f) => f.endsWith(".woff2"));
|
||||
assert.ok(woff2.length >= 1, `no .woff2 under web/dist — apply BA2's contingency (public/fonts copy or postbuild script), never a CDN link`);
|
||||
});
|
||||
|
||||
test("BA3 web/dist/assets contains a hashed MapLibre worker chunk", () => {
|
||||
assert.ok(existsSync(DIST_ASSETS), claimBuildFirst().message);
|
||||
const worker = readdirSync(DIST_ASSETS).filter((f) => f.endsWith(".js") && /worker/i.test(f));
|
||||
assert.ok(worker.length >= 1, `no MapLibre worker chunk in web/dist/assets (found: ${readdirSync(DIST_ASSETS).join(", ")})`);
|
||||
});
|
||||
|
||||
test("BA4 built JS carries the inlined Rams style JSON (liberty-rams/ne2_shaded)", () => {
|
||||
assert.ok(existsSync(DIST_ASSETS), claimBuildFirst().message);
|
||||
const bundle = jsFiles
|
||||
.filter((f) => f.startsWith(DIST_ASSETS))
|
||||
.map((f) => readFileSync(f, "utf8"))
|
||||
.join("");
|
||||
const hasStyle = bundle.includes("liberty-rams") || bundle.includes("ne2_shaded");
|
||||
assert.ok(hasStyle, "inlined Rams style marker absent from the JS bundle — style JSON was not inlined at build time");
|
||||
});
|
||||
|
||||
test("BA5 production bundle carries NO Mock-Telegram installer in ANY emitted file (.js + .html)", () => {
|
||||
assert.ok(existsSync(DIST), claimBuildFirst().message);
|
||||
const jsAssets = jsFiles.map((f) => readFileSync(f, "utf8")).join("");
|
||||
const allHtml = htmlFiles.map((f) => readFileSync(f, "utf8")).join("");
|
||||
for (const token of ["installMockWebApp", "__ARAHARAH_MOCK__"]) {
|
||||
assert.ok(
|
||||
!jsAssets.includes(token),
|
||||
`installMockWebApp gate: "${token}" found in a web/dist JS asset — the mock survived tree-shaking`,
|
||||
);
|
||||
assert.ok(
|
||||
!allHtml.includes(token),
|
||||
`installMockWebApp gate: "${token}" found in an emitted web/dist HTML (${htmlFiles.join(", ")}) — the runner page's profile block shipped`,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test("BA6 production HTML carries NO runner-page fetch stub endpoints", () => {
|
||||
assert.ok(existsSync(DIST), claimBuildFirst().message);
|
||||
const allHtml = htmlFiles.map((f) => readFileSync(f, "utf8")).join("");
|
||||
for (const endpoint of ["/api/session", "/api/location-fallback"]) {
|
||||
assert.ok(
|
||||
!allHtml.includes(endpoint),
|
||||
`runner-page fetch stub "${endpoint}" present in emitted web/dist HTML — an unguarded profile block shipped`,
|
||||
);
|
||||
}
|
||||
});
|
||||
Reference in New Issue
Block a user