@bongos/core 1.19.971 → 1.19.973

package/tests/served_paths_shipped.mjs

@@ -47,14 +47,39 @@ const INTENTIONALLY_UNSHIPPED = {
 // module is individually allowlisted), so the base alone is not a shippable-asset claim.
 const NOT_SERVED_BASE = new Set([
   'modules', // path.join(ROOT,'modules') → MODULES_ROOT; real serves are path.join(MODULES_ROOT, key, 'public', rel)
+  // Surfaced by widening the scan to root ladders (task 1002617). tryLoadInstanceConfig
+  // does path.join(root, 'config', name) with a DYNAMIC name, and the result is READ as
+  // instance configuration — never sendFile()d to a client, so it is not a served asset
+  // and this test's premise (a served path must ship or the box 404s) does not apply.
+  // Its exclusion is also deliberate rather than an oversight: serve-internal.js:59-62
+  // records that config/ is host content under publish-manifest INSTANCE_EXCLUDE, which
+  // is exactly WHY that function walks an instance-root-first ladder. Shipping it would
+  // be the bug.
+  'config',
 ]);
 
 // Extract the leading contiguous string-literal prefix of every path.join(ROOT, ...)
 // call. A trailing non-literal arg (a variable) means "some file under this dir", so the
 // literal prefix is the directory that must ship.
+// ROOT-LADDER FORMS (task 1002617). The scan originally matched `path.join(ROOT, …)`
+// only. Task 1002200 made the OpenAPI spec self-healing and multi-rooted:
+//
+//     const roots = [...new Set([resolveDocsRoot(), ROOT])];
+//     candidates: roots.map((r) => path.join(r, 'docs/api/openapi.json'))
+//
+// so the served path stopped matching and the scan silently stopped seeing it. The
+// existence guard below is what caught that — it is the only reason this test was parked
+// rather than quietly asserting nothing, which is precisely what a self-guard is for.
+//
+// The fix is to match any single-identifier first argument, not to special-case `r`.
+// A root ladder is still a root: whichever entry wins, the file must be IN the package or
+// the standalone box 404s. Accepting any identifier does pull in non-asset bases
+// (`root + 'config'`, `ROOT + 'infra'`, `ROOT + 'modules'`); those are handled by the
+// existing NOT_SERVED_BASE / INTENTIONALLY_UNSHIPPED lists, which is what they are for,
+// and each is individually asserted by the stale-exception guard.
 function extractRootJoinPrefixes(src) {
   const out = new Set();
-  const re = /path\.join\(\s*ROOT\s*,/g;
+  const re = /path\.join\(\s*[A-Za-z_$][\w$]*\s*,/g;
   let m;
   while ((m = re.exec(src))) {
     // Arg span up to the matching close paren. These calls contain no nested parens
@@ -84,10 +109,19 @@ function probe(prefix) {
 
 const prefixes = extractRootJoinPrefixes(fs.readFileSync(SERVE_INTERNAL, 'utf8'));
 
+// THE SELF-GUARD, and it has now earned its keep once (task 1002617). A static source
+// scan degrades to silence when the code it scans changes shape: the regex stops
+// matching, `prefixes` empties, and every downstream assertion passes over nothing. That
+// is strictly worse than a red test, because it reads as coverage. This test failed for
+// months for exactly the right reason — the OpenAPI serve moved to a root ladder — and
+// it was parked in KNOWN_FAILING rather than diagnosed. Keep it, and keep it specific:
+// a bare `size > 0` would have stayed green through the very change that blinded it.
 test('extraction found the known served assets (guards against a silent no-match)', () => {
   assert.ok(prefixes.size >= 5, `expected several ROOT-served paths, found ${prefixes.size}`);
   assert.ok(prefixes.has('clients/bongos-client/bongos-client.global.js'), 'must see the client bundle read');
-  assert.ok(prefixes.has('docs/api/openapi.json'), 'must see the openapi spec read');
+  assert.ok(prefixes.has('docs/api/openapi.json'),
+    'must see the openapi spec read — it is served from a ROOT LADDER (roots.map(r => path.join(r, …))), '
+    + 'so a scan matching only `path.join(ROOT, …)` goes blind here');
 });
 
 test('every ROOT-served asset ships in the core package (isPublishable)', () => {