@cspeach/cli 1.1.17 → 1.1.19

package/test-harness/fe-draft/fe-draft.e2e.test.ts

@@ -0,0 +1,461 @@
+/**
+ * L1-2b — the `smoke-e2e` project: the lane-1 smoke checks, run by the REAL
+ * `runSmoke` → real `openApp` driver, against an app built by the product's own
+ * tools and served offline (fe-mockserver on the captured draft `$metadata`).
+ *
+ * NOT part of `pnpm test` — it needs a local Edge/Chrome and the UI5 CDN (never
+ * the VPN, never SAP). Run it with `pnpm test:smoke-e2e`. Skipped, with the
+ * reason printed, when no browser is found.
+ *
+ * Plan rule: every lane-1 check must be green HERE before a gate sitting is
+ * booked. A red test in this file is a gate blocker, not a flaky harness —
+ * `harness self-check` proves, with the same driver, that the harness serves a
+ * working app whose list really reads its rows from the mock backend. Each red
+ * test names the finding (F-n) it stands for; the L1-2b report has the list.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtemp, mkdir, rm, readFile } from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { resolveBrowserExecutable } from '../../src/tools/fiori/smoke/browser.js';
+import { openApp } from '../../src/tools/fiori/smoke/driver.js';
+import { runSmoke, type SmokeResult, type SmokeExercise } from '../../src/tools/fiori/smoke/run-smoke.js';
+import { defaultEntryFile } from '../../src/tools/fiori/preview/start.js';
+import { fioriRenderSmokeHandler, fioriDraftSmokeHandler } from '../../src/tools/fiori/tools.js';
+import { auditMetadata } from '../../src/tools/fiori/metadata/audit.js';
+import type { MetadataAudit } from '../../src/tools/fiori/metadata/types.js';
+import type { ToolContext } from '../../src/tools/index.js';
+import { withCodeTexts, withoutLabels, rowsWithTexts, withValueHelps, VALUE_HELP_ROWS, inspectionLogHooks } from './variants.js';
+import { mintChangeApproval } from '../../src/approvals/jwt.js';
+import type { DraftSmokeResult } from '../../src/tools/fiori/smoke/draft-smoke.js';
+import { startHarness, fetchNeoApp, type HarnessServer } from './server.js';
+import { isHosted, selectUi5Versions, latestPatches, SUPPORTED_UI5_LINES, HARNESS_UI5_VERSIONS, type NeoApp } from './routes.js';
+import {
+  buildGoodApp,
+  buildBrokenApp,
+  buildBrokenPressApp,
+  customActionSelector,
+  flpEntry,
+  BROKEN_MARKER,
+  DRAFT_METADATA,
+  DRAFT_SERVICE_PATH,
+  DRAFT_MAIN_ENTITY,
+  HARNESS_MOCK_ROWS,
+  INSPECTION_ROWS,
+  type HarnessApp,
+} from './app.js';
+
+const browser = resolveBrowserExecutable();
+if (!browser) {
+  // eslint-disable-next-line no-console
+  console.warn('[smoke-e2e] SKIPPED: no Edge/Chrome found (set CSPEACH_BROWSER to one).');
+}
+
+const TIMEOUT_MS = 90_000;
+/** The columns the captured service's UI.LineItem names (by label). */
+const EXPECTED_COLUMNS = ['Equipment Name', 'Inspection Date', 'Inspector'];
+/** The list report's "Go" button (FE V4 filter bar). */
+const GO = '[id$="-btnSearch"]';
+/** A data row of the responsive table: a list item that is neither header nor the no-data line. */
+const DATA_ROW = '.sapMListTbl tr.sapMLIB:not(.sapMListTblNoData)';
+const isBatch = (url: string) => /\/\$batch(\?|$)/.test(url);
+
+/**
+ * Pinned in routes.ts; pick with CSP_HARNESS_UI5=newest|oldest|both|all|latest|x.y.z,…
+ * `latest` (the weekly run) resolves the newest hosted patch of every supported line.
+ */
+const UI5_VERSIONS =
+  process.env.CSP_HARNESS_UI5?.trim() === 'latest'
+    ? latestPatches(SUPPORTED_UI5_LINES, await fetchNeoApp())
+    : selectUi5Versions(process.env.CSP_HARNESS_UI5);
+
+let root: string;
+let neoApp: NeoApp;
+const servers: HarnessServer[] = [];
+
+interface Served {
+  app: HarnessApp;
+  server: HarnessServer;
+  /** fiori_metadata_audit's answer for EXACTLY the document the backend serves. */
+  audit: MetadataAudit;
+}
+
+async function serve(
+  app: HarnessApp,
+  variant?: { transform: (xml: string) => string; rows: Record<string, unknown[]>; scripts?: Record<string, string> },
+): Promise<Served> {
+  let servedXml = '';
+  const server = await startHarness({
+    appDir: app.dir,
+    metadataPath: DRAFT_METADATA,
+    mockRows: variant?.rows ?? HARNESS_MOCK_ROWS,
+    ...(variant ? { transformMetadata: variant.transform } : {}),
+    ...(variant?.scripts ? { mockScripts: variant.scripts } : {}),
+    onServedMetadata: (xml) => {
+      servedXml = xml;
+    },
+  });
+  servers.push(server);
+  const audit = auditMetadata({
+    servicePath: `${DRAFT_SERVICE_PATH}$metadata`,
+    mainXml: servedXml,
+    referenceDocs: new Map(),
+  });
+  if (audit.entitySet !== DRAFT_MAIN_ENTITY) throw new Error(`audit picked ${audit.entitySet}, expected ${DRAFT_MAIN_ENTITY}`);
+  return { app, server, audit };
+}
+
+const TEXT_ROWS = { [DRAFT_MAIN_ENTITY]: rowsWithTexts(INSPECTION_ROWS) };
+const harnessCtx = (dir: string): ToolContext =>
+  ({ adt: {}, sapAlias: 'HARNESS', session: {}, cwd: dir }) as unknown as ToolContext;
+
+/**
+ * The product path for L1-2/L1-3: fiori_render_smoke in Fiori Elements mode with
+ * the audit — expected columns derived from it, labels + no-raw-codes on.
+ */
+async function smokeWithAudit(target: Served, exercises: SmokeExercise[], shots: string): Promise<SmokeResult> {
+  const r = await fioriRenderSmokeHandler(
+    {
+      appUrl: `${target.server.origin}${flpEntry(target.app)}`,
+      controlKind: 'table',
+      exercises,
+      metadataAudit: target.audit,
+    },
+    harnessCtx(root),
+    { renderSmokeEnabled: true, timeoutMs: TIMEOUT_MS, artifactDir: path.join(root, shots) },
+  );
+  if (r.is_error) throw new Error(r.content);
+  return JSON.parse(r.content) as SmokeResult;
+}
+
+function check(result: { checks: SmokeResult['checks'] }, name: string) {
+  return result.checks.find((c) => c.name === name);
+}
+
+async function smoke(
+  target: { app: HarnessApp; server: HarnessServer },
+  exercises: SmokeExercise[],
+  shots: string,
+  entry: 'flp' | 'index' = 'flp',
+): Promise<SmokeResult> {
+  const url = entry === 'flp' ? `${target.server.origin}${flpEntry(target.app)}` : `${target.server.origin}/index.html`;
+  return runSmoke(
+    { appUrl: url, controlKind: 'table', expectedColumns: EXPECTED_COLUMNS, exercises },
+    { renderSmokeEnabled: true, timeoutMs: TIMEOUT_MS, artifactDir: path.join(root, shots) },
+  );
+}
+
+describe.skipIf(!browser).each(UI5_VERSIONS)('smoke-e2e — Fiori Elements draft app, offline, UI5 %s', (ui5Version) => {
+  let good: Served;
+  let broken: Served;
+  let brokenPress: Served;
+  let goodResult: SmokeResult;
+  /** $batch calls the mock backend saw DURING the lane-1 smoke run (none pressed Go). */
+  let batchesDuringSmoke: number;
+
+  beforeAll(async () => {
+    root = await mkdtemp(path.join(os.tmpdir(), 'csp-smoke-e2e-'));
+    neoApp = await fetchNeoApp();
+    // The apps under test are scaffolded for the PINNED version through
+    // fiori_scaffold_fe's own ui5Version input (the scaffold's default patch is
+    // no longer hosted — F-1, asserted below).
+    if (!isHosted(ui5Version, neoApp)) {
+      throw new Error(
+        `pinned UI5 ${ui5Version} is no longer on the UI5 CDN — bump the patch in HARNESS_UI5_VERSIONS (test-harness/fe-draft/routes.ts)`,
+      );
+    }
+    // eslint-disable-next-line no-console
+    console.info(`[smoke-e2e] UI5 ${ui5Version} (pinned) from ui5.sap.com`);
+
+    // The good app's backend is the capture WITH texts for its coded fields
+    // (TextOnly) — the shape gate A demands; built in memory, see variants.ts.
+    good = await serve(await buildGoodApp(root, ui5Version), {
+      transform: (xml) => withCodeTexts(xml, 'TextOnly'),
+      rows: TEXT_ROWS,
+    });
+    broken = await serve(await buildBrokenApp(root, ui5Version));
+    brokenPress = await serve(await buildBrokenPressApp(root, ui5Version));
+
+    goodResult = await smokeWithAudit(good, [{ kind: 'press', selectorHint: customActionSelector('Ping') }], 'shots-good');
+    batchesDuringSmoke = good.server.mockLog.filter((r) => isBatch(r.url)).length;
+  }, 600_000);
+
+  afterAll(async () => {
+    for (const s of servers.splice(0)) await s.close();
+    if (root) await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+  });
+
+  // ── The harness itself: must be green, or nothing below means anything ──
+  describe('harness self-check', () => {
+    it('the good app lists the seeded rows from the mock backend, with labelled headers (real driver)', async () => {
+      const page = await openApp(browser!.path, `${good.server.origin}${flpEntry(good.app)}`, TIMEOUT_MS);
+      try {
+        await page.waitForSelector(GO);
+        const before = good.server.mockLog.filter((r) => isBatch(r.url)).length;
+        await page.press!(GO);
+        await page.waitForSelector(DATA_ROW);
+        const rows = await page.queryTexts(DATA_ROW);
+        for (const r of INSPECTION_ROWS) expect(rows.join(' | ')).toContain(r.EquipmentName);
+        // UI5 1.84 hyphenates header text with soft hyphens (U+00AD); the harness
+        // proves the LABELS arrive, so it compares without them (finding F-8).
+        const headers = (await page.queryTexts('.sapMColumnHeader, [role="columnheader"]')).map((h) =>
+          h.replace(/\u00ad/g, ''),
+        );
+        for (const c of ['Equipment Name', 'Inspection Date']) expect(headers).toContain(c);
+        // The rows came from the mock backend: at least one $batch, all 200. (The
+        // list loads on open; FE on UI5 1.108 does not search again on Go when no
+        // filter changed, so "Go sent a NEW $batch" is not a version-neutral fact.)
+        void before;
+        const batches = good.server.mockLog.filter((r) => isBatch(r.url));
+        expect(batches.length).toBeGreaterThan(0);
+        expect(batches.every((b) => b.status === 200)).toBe(true);
+      } finally {
+        await page.close();
+      }
+    }, 180_000);
+  });
+
+  // ── Lane-1 checks on the good app: the gate needs every one green ──
+  describe('lane-1 checks on the good app (the npm-start FLP sandbox entry)', () => {
+    it('ran a real render (verification is smoke, not manual)', () => {
+      expect(goodResult.verification, JSON.stringify(goodResult.checks)).toBe('smoke');
+    });
+
+    for (const name of ['boot', 'odata', 'columns', 'rows', 'labels', 'no-raw-codes', 'exercises']) {
+      it(`${name} is green`, () => {
+        const c = check(goodResult, name);
+        expect(c, `no "${name}" check in ${JSON.stringify(goodResult.checks)}`).toBeDefined();
+        expect(c!.ok, c!.detail).toBe(true);
+      });
+    }
+
+    it('F-3: rows counts DATA rows — not the header row or the "choose Go" placeholder', () => {
+      expect(check(goodResult, 'rows')?.detail).toBe(`${INSPECTION_ROWS.length} row(s) rendered`);
+    });
+
+    it('F-2/F-4: odata green is not hollow — the list read reached the backend during the smoke', () => {
+      expect(batchesDuringSmoke, 'no $batch was sent before the checks ran: odata judged zero requests').toBeGreaterThan(
+        0,
+      );
+    });
+
+    it('columns were derived from the audit (all five LineItem labels), not a hand-written list', () => {
+      expect(check(goodResult, 'columns')?.detail).toBe('all 5 expected column(s) present');
+    });
+
+    it('no-raw-codes compared real cells (Severity + Status, 3 rows)', () => {
+      expect(check(goodResult, 'no-raw-codes')?.detail).toMatch(/2 coded column\(s\), 3 row\(s\).*6 cell/);
+    });
+    // L1-5a inner $batch statuses and the L1-5b draft round trip: see the
+    // "fiori_draft_smoke" describe below (a rejected Activate inside a 200 $batch).
+  });
+
+  // ── Negative tests: the smoke must go red on a broken app, for the RIGHT reason ──
+  describe('negative: a broken app must fail exercises', () => {
+    it('F-6: a custom action whose handler throws fails `exercises`, naming the handler error', async () => {
+      const r = await smoke(broken, [{ kind: 'press', selectorHint: customActionSelector('Boom') }], 'shots-broken');
+      const ex = check(r, 'exercises');
+      expect(ex, JSON.stringify(r.checks)).toBeDefined();
+      expect(ex!.ok, 'the handler threw and the smoke still said green').toBe(false);
+      // Red for the RIGHT reason: the uncaught page error carrying the handler's message.
+      expect(ex!.detail).toMatch(/uncaught page error/);
+      expect(ex!.detail).toContain(BROKEN_MARKER);
+      expect(ex!.detail).not.toMatch(/No element found/);
+    }, 240_000);
+
+    it('a custom action whose handler module is missing fails `exercises` on the load error', async () => {
+      const r = await smoke(
+        brokenPress,
+        [{ kind: 'press', selectorHint: customActionSelector('Boom') }],
+        'shots-broken-press',
+      );
+      const ex = check(r, 'exercises');
+      expect(ex, JSON.stringify(r.checks)).toBeDefined();
+      expect(ex!.ok).toBe(false);
+      // Red for the right reason — the press ran and UI5 logged the failed load.
+      expect(ex!.detail).not.toMatch(/No element found|threw:/i);
+      expect(ex!.detail).toMatch(/new console error/);
+    }, 240_000);
+
+  });
+
+  // ── Negative tests for L1-3: each red for the RIGHT reason ──
+  describe('negative: labels and raw codes', () => {
+    it('an un-annotated service (no labels) fails `labels`: technical names are shown as headers', async () => {
+      const bare = await serve(await buildGoodApp(path.join(root, 'nolabels'), ui5Version), {
+        transform: withoutLabels,
+        rows: HARNESS_MOCK_ROWS,
+      });
+      const r = await smokeWithAudit(bare, [], 'shots-nolabels');
+      const labels = check(r, 'labels');
+      expect(labels?.ok).toBe(false);
+      expect(labels?.detail).toMatch(/no label for: EquipmentName/);
+      // What the user SEES differs by release: 1.120 falls back to the technical
+      // name, 1.84 renders the header empty. Both are the missing label.
+      expect(labels?.detail).toMatch(/technical name shown as a header: .*EquipmentName|\d+ column header\(s\) are empty/);
+    }, 300_000);
+
+    it('a coded field with a text but NO TextArrangement ("Open (O)") fails `no-raw-codes`', async () => {
+      const textFirst = await serve(await buildGoodApp(path.join(root, 'textfirst'), ui5Version), {
+        transform: (xml) => withCodeTexts(xml),
+        rows: TEXT_ROWS,
+      });
+      const r = await smokeWithAudit(textFirst, [], 'shots-textfirst');
+      const codes = check(r, 'no-raw-codes');
+      expect(codes?.ok).toBe(false);
+      expect(codes?.detail).toMatch(/Status .*shows the raw code "O"/);
+      expect(check(r, 'labels')?.ok, check(r, 'labels')?.detail).toBe(true); // red for the codes, nothing else
+    }, 300_000);
+
+    it('the service as captured (coded fields with no text at all) fails `no-raw-codes`', async () => {
+      const raw = await serve(await buildGoodApp(path.join(root, 'raw'), ui5Version));
+      const r = await smokeWithAudit(raw, [], 'shots-raw');
+      const codes = check(r, 'no-raw-codes');
+      expect(codes?.ok).toBe(false);
+      expect(codes?.detail).toMatch(/Severity is coded but has no text/);
+      expect(codes?.detail).toMatch(/Status is coded but has no text/);
+    }, 300_000);
+  });
+
+  // ── L1-5b: fiori_draft_smoke through the tool, real browser, mock draft backend ──
+  describe('fiori_draft_smoke — the draft round trip through the UI (value help, Save, Discard)', () => {
+    /** The capture declares Severity IsDigitSequence while the harness seeds letters (H/M/L): FE would refuse "L" on Save. */
+    const lettersForSeverity = (xml: string) =>
+      xml.replace(/(<Annotations Target="SAP__self\.InspectionLogType\/Severity">(?:(?!<\/Annotations>)[\s\S])*?)<Annotation Term="SAP__common\.IsDigitSequence"\/>/, '$1');
+    const STALE = { ...rowsWithTexts(INSPECTION_ROWS)[0]!, InspectionUUID: '00000000-0000-4000-8000-0000000000aa', EquipmentName: 'Left over', Note: 'CSP-SMOKE-20260101000000-0000' };
+
+    async function serveDraft(name: string, opts: { rejectStatus?: string; stale?: boolean; editSeverity?: boolean } = {}) {
+      return serve(await buildGoodApp(path.join(root, name), ui5Version), {
+        transform: (xml) => {
+          const x = withValueHelps(withCodeTexts(xml, 'TextOnly'));
+          return opts.editSeverity ? lettersForSeverity(x) : x;
+        },
+        rows: {
+          [DRAFT_MAIN_ENTITY]: [...rowsWithTexts(INSPECTION_ROWS), ...(opts.stale ? [STALE] : [])],
+          ...VALUE_HELP_ROWS,
+        },
+        scripts: { [DRAFT_MAIN_ENTITY]: inspectionLogHooks(opts.rejectStatus ? { rejectStatus: opts.rejectStatus } : {}) },
+      });
+    }
+
+    async function draftSmoke(target: Served, editField: string, shots: string): Promise<DraftSmokeResult> {
+      const r = await fioriDraftSmokeHandler(
+        {
+          appUrl: `${target.server.origin}${flpEntry(target.app)}`,
+          // The tool fetches and audits the service itself (the mock backend over HTTP).
+          servicePath: DRAFT_SERVICE_PATH,
+          markerField: 'Note',
+          editField,
+          approval_id: await mintChangeApproval(
+            { op: 'modify', object: 'ZUI_LAS_INSPECTIONLOG_O4', type: 'DATA' },
+            'harness-session',
+          ),
+        },
+        harnessCtx(root),
+        {
+          renderSmokeEnabled: true,
+          timeoutMs: TIMEOUT_MS,
+          artifactDir: path.join(root, shots),
+          fetchDoc: async (p: string) => {
+            const res = await fetch(`${target.server.origin}${p}`);
+            return { status: res.status, body: await res.text() };
+          },
+        },
+      );
+      if (r.is_error) throw new Error(r.content);
+      return JSON.parse(r.content) as DraftSmokeResult;
+    }
+
+    /** Every row and draft the mock backend holds for the draft root (read over plain HTTP). */
+    async function backendRows(target: Served): Promise<Array<Record<string, unknown>>> {
+      const out: Array<Record<string, unknown>> = [];
+      for (const active of [true, false]) {
+        const res = await fetch(
+          `${target.server.origin}${DRAFT_SERVICE_PATH}${DRAFT_MAIN_ENTITY}?$filter=IsActiveEntity eq ${active}&$select=InspectionUUID,IsActiveEntity,Note,Status,Severity`,
+        );
+        out.push(...((await res.json()) as { value: Array<Record<string, unknown>> }).value);
+      }
+      return out;
+    }
+    const smokeRows = (rows: Array<Record<string, unknown>>) => rows.filter((r) => String(r.Note ?? '').startsWith('CSP-SMOKE-'));
+
+    it('green through the fixed-values DROPDOWN (Status): every check, and no CSP-SMOKE row or draft left', async () => {
+      const t = await serveDraft('draft-green', { stale: true });
+      const r = await draftSmoke(t, 'Status', 'shots-draft-green');
+      // eslint-disable-next-line no-console
+      console.info(`[smoke-e2e] draft-green: ${r.checks.map((c) => `${c.ok ? 'OK ' : 'RED'} ${c.name} — ${c.detail}`).join(' | ')}`);
+      for (const c of r.checks) expect(c.ok, `${c.name}: ${c.detail}`).toBe(true);
+      expect(r.verification).toBe('smoke');
+      expect(r.passed).toBe(true);
+      expect(check(r, 'value-help')?.detail).toMatch(/the popover opened with 2 entries/);
+      expect(check(r, 'draft-save')?.detail).toMatch(/Status "" → "C" via value help → Save: activated; the list shows "Closed"/);
+      expect(check(r, 'draft-discard')?.detail).toMatch(/the saved "C" is back, no draft left/);
+      // the start-of-run sweep removed the stale marker row — and only it
+      expect(check(r, 'sweep')?.detail).toMatch(/removed 1 leftover CSP-SMOKE-\* row\(s\)\/draft\(s\): CSP-SMOKE-20260101000000-0000/);
+      const after = await backendRows(t);
+      expect(smokeRows(after)).toEqual([]);
+      // the customer's rows are untouched
+      expect(after.filter((x) => x.IsActiveEntity === true).map((x) => x.InspectionUUID).sort()).toEqual(
+        INSPECTION_ROWS.map((x) => x.InspectionUUID).sort(),
+      );
+      expect(after.filter((x) => x.IsActiveEntity === false)).toEqual([]);
+    }, 300_000);
+
+    it('green through the value-help DIALOG (Severity)', async () => {
+      const t = await serveDraft('draft-dialog', { editSeverity: true });
+      const r = await draftSmoke(t, 'Severity', 'shots-draft-dialog');
+      // eslint-disable-next-line no-console
+      console.info(`[smoke-e2e] draft-dialog: ${r.checks.map((c) => `${c.ok ? 'OK ' : 'RED'} ${c.name} — ${c.detail}`).join(' | ')}`);
+      for (const c of r.checks) expect(c.ok, `${c.name}: ${c.detail}`).toBe(true);
+      expect(check(r, 'value-help')?.detail).toMatch(/the dialog opened with 3 entries/);
+      expect(smokeRows(await backendRows(t))).toEqual([]);
+    }, 300_000);
+
+    it('negative: the backend REJECTS the activation on Save → the smoke fails (draft-save + inner-400 odata) and still cleans up', async () => {
+      const t = await serveDraft('draft-reject', { rejectStatus: 'C' });
+      const r = await draftSmoke(t, 'Status', 'shots-draft-reject');
+      // eslint-disable-next-line no-console
+      console.info(`[smoke-e2e] draft-reject: ${r.checks.map((c) => `${c.ok ? 'OK ' : 'RED'} ${c.name} — ${c.detail}`).join(' | ')}`);
+      expect(r.passed).toBe(false);
+      expect(check(r, 'setup')?.ok, check(r, 'setup')?.detail).toBe(true); // setup activated with Status O
+      expect(check(r, 'draft-save')?.ok).toBe(false);
+      expect(check(r, 'no-error-dialogs')?.ok).toBe(false);
+      // L1-5a in a real browser: the outer $batch was 200, the inner Activate 400
+      const odata = check(r, 'odata');
+      expect(odata?.ok).toBe(false);
+      expect(odata?.detail).toMatch(/failed inner \$batch request\(s\): 400 POST .*\.Activate — CSP-HARNESS-REJECT: status C cannot be saved/);
+      expect(check(r, 'cleanup')?.ok, check(r, 'cleanup')?.detail).toBe(true);
+      expect(smokeRows(await backendRows(t))).toEqual([]);
+      expect((await backendRows(t)).filter((x) => x.IsActiveEntity === false)).toEqual([]);
+    }, 300_000);
+  });
+
+  // ── Findings about what the product scaffolds / previews ──
+  describe('scaffold and preview defaults', () => {
+    it('F-1: the UI5 version fiori_scaffold_fe writes by default is hosted on the UI5 CDN', async () => {
+      const dir = path.join(root, 'default-version');
+      await mkdir(dir, { recursive: true });
+      const app = await buildGoodApp(dir);
+      const manifest = JSON.parse(await readFile(path.join(app.dir, 'webapp', 'manifest.json'), 'utf8'));
+      const v: string = manifest['sap.ui5'].dependencies.minUI5Version;
+      expect(isHosted(v, neoApp), `scaffold default UI5 ${v} is not on ui5.sap.com (harness pins ${HARNESS_UI5_VERSIONS.newest})`).toBe(
+        true,
+      );
+    }, 120_000);
+
+    it.todo(
+      `runs on the oldest supported UI5 too (${HARNESS_UI5_VERSIONS.oldest}) — wired: CSP_HARNESS_UI5=both; not in the default run until the owner names the oldest supported release`,
+    );
+
+    it("F-7: fiori_preview's default entry for a scaffolded app is the page npm start opens (FLP sandbox)", async () => {
+      const pkg = JSON.parse(await readFile(path.join(good.app.dir, 'package.json'), 'utf8'));
+      expect('/' + defaultEntryFile(pkg.scripts.start)).toBe(flpEntry(good.app));
+    });
+
+    it('F-7: on that entry, pressing Go raises no console or page error', async () => {
+      const r = await smoke(good, [{ kind: 'press', selectorHint: GO }], 'shots-flp-go');
+      const ex = check(r, 'exercises');
+      expect(ex?.ok, ex?.detail).toBe(true);
+    }, 240_000);
+  });
+});

package/test-harness/fe-draft/manifest-enhancer.unit.test.ts

@@ -0,0 +1,51 @@
+/**
+ * The harness serves manifest.json the way `fiori run` does (2026-09-25): UI5
+ * tooling 4's dev server passes every app manifest through the builder's
+ * manifestEnhancer, which adds supportedLocales from the i18n files the app
+ * ships. Serving the raw file hid a boot error every real preview shows.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { enhancedManifest } from './server.js';
+
+const dirs: string[] = [];
+afterEach(async () => {
+  while (dirs.length > 0) await rm(dirs.pop()!, { recursive: true, force: true });
+});
+
+async function webapp(i18n: unknown, files: string[] = ['i18n.properties']): Promise<string> {
+  const dir = await mkdtemp(path.join(os.tmpdir(), 'csp-harness-manifest-'));
+  dirs.push(dir);
+  await mkdir(path.join(dir, 'i18n'));
+  for (const f of files) await writeFile(path.join(dir, 'i18n', f), 'appTitle=Test\n');
+  const manifest = {
+    _version: '1.60.0',
+    'sap.app': { id: 'z.harness.test', type: 'application', i18n },
+    'sap.ui5': {
+      models: { i18n: { type: 'sap.ui.model.resource.ResourceModel', settings: { bundleName: 'z.harness.test.i18n.i18n' } } },
+    },
+  };
+  await writeFile(path.join(dir, 'manifest.json'), JSON.stringify(manifest));
+  return dir;
+}
+
+describe('enhancedManifest — what `fiori run` serves', () => {
+  it('adds the locales the app ships and NO fallback (the case UI5 then logs at boot)', async () => {
+    const served = JSON.parse(await enhancedManifest(await webapp('i18n/i18n.properties')));
+    expect(served['sap.app'].i18n).toEqual({ bundleUrl: 'i18n/i18n.properties', supportedLocales: [''] });
+    expect(served['sap.ui5'].models.i18n.settings.supportedLocales).toEqual(['']);
+  });
+
+  it('keeps an explicitly declared fallback locale', async () => {
+    const dir = await webapp({ bundleUrl: 'i18n/i18n.properties', supportedLocales: [''], fallbackLocale: '' });
+    const served = JSON.parse(await enhancedManifest(dir));
+    expect(served['sap.app'].i18n).toEqual({ bundleUrl: 'i18n/i18n.properties', supportedLocales: [''], fallbackLocale: '' });
+  });
+
+  it('lists every locale file the app ships', async () => {
+    const served = JSON.parse(await enhancedManifest(await webapp('i18n/i18n.properties', ['i18n.properties', 'i18n_en.properties', 'i18n_de.properties'])));
+    expect([...served['sap.app'].i18n.supportedLocales].sort()).toEqual(['', 'de', 'en']);
+  });
+});