@mandujs/core 0.53.2 → 0.54.0

package/src/bundler/__tests__/prod-smoke.test.ts

@@ -1,138 +1,138 @@
-/**
- * Phase 7.2 R1 Agent C (H4) — production bundle smoke tests.
- *
- * Confirms the Phase 7.1 audit finding L-02 regression is closed: a
- * production build (`minify: true`, no Fast Refresh plugin) must NEVER
- * leak the dev-only symbols that would otherwise install Fast Refresh
- * stubs on `window` (`$RefreshReg$` / `$RefreshSig$` / `__MANDU_HMR__`)
- * or pull in the vendor runtime (`_vendor-react-refresh`).
- *
- * We assert at two layers:
- *   (A) the generated output JS bundle is free of the dev symbols
- *   (B) the returned manifest has `shared.fastRefresh === undefined`
- *
- * Both layers matter because (A) can drift independently of (B) if a
- * future refactor inlines a symbol name into a comment or data literal.
- *
- * References:
- *   docs/security/phase-7-1-audit.md §3 L-02
- *   docs/bun/phase-7-2-team-plan.md §3 Agent C H4
- */
-
-import { describe, expect, test, beforeAll, afterAll } from "bun:test";
-import { mkdtemp, mkdir, rm, writeFile } from "fs/promises";
-import fs from "fs/promises";
-import { tmpdir } from "os";
-import path from "path";
-import { fastRefreshPlugin } from "../fast-refresh-plugin";
-
-/**
- * Strings we treat as dev-only Fast Refresh fingerprints. Any of them
- * appearing in a prod bundle is a leak. We keep the list small and
- * precise so we don't false-flag legitimate unrelated code.
- */
-const DEV_LEAK_FINGERPRINTS = [
-  "$RefreshReg$",
-  "$RefreshSig$",
-  "__MANDU_HMR__",
-  "_vendor-react-refresh",
-  "_fast-refresh-runtime",
-] as const;
-
-// Integration tests that spin up Bun.build are gated on CI flaky-matrix
-// environments. See `fast-refresh.test.ts` for the same pattern.
-describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
-  "prod-smoke — no Fast Refresh leak in production bundles",
-  () => {
-    let rootDir = "";
-
-    beforeAll(async () => {
-      rootDir = await mkdtemp(path.join(tmpdir(), "mandu-prod-smoke-"));
-      // Minimal island source — no JSX runtime, no imports, small AST
-      await writeFile(
-        path.join(rootDir, "counter.client.tsx"),
-        `import { useState } from 'react';
-export default function Counter() {
-  const [count, setCount] = useState(0);
-  return <button onClick={() => setCount(c => c + 1)}>{count}</button>;
-}
-`,
-        "utf-8",
-      );
-    });
-
-    afterAll(async () => {
-      if (rootDir) await rm(rootDir, { recursive: true, force: true });
-    });
-
-    test("[S1] production build output contains no dev-only Fast Refresh symbols", async () => {
-      // Prod path: `reactFastRefresh` off, plugin `disabled: true`,
-      // minify on. Matches the config `buildClientBundles` uses when
-      // `options.minify === true`.
-      const result = await Bun.build({
-        entrypoints: [path.join(rootDir, "counter.client.tsx")],
-        target: "browser",
-        minify: true,
-        plugins: [fastRefreshPlugin({ disabled: true })],
-        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
-      });
-      expect(result.success).toBe(true);
-
-      const src = await result.outputs[0]!.text();
-      for (const fingerprint of DEV_LEAK_FINGERPRINTS) {
-        expect(src.includes(fingerprint)).toBe(false);
-      }
-    });
-
-    test("[S2] prod build with reactFastRefresh=true explicitly disabled does not emit stubs", async () => {
-      // Defense-in-depth: even if a future config accident leaves
-      // `reactFastRefresh: false` off-by-default, the disabled plugin
-      // MUST still prevent injection. We pass reactFastRefresh: false
-      // here to represent the guaranteed-prod config.
-      const result = await Bun.build({
-        entrypoints: [path.join(rootDir, "counter.client.tsx")],
-        target: "browser",
-        minify: true,
-        reactFastRefresh: false,
-        plugins: [fastRefreshPlugin({ disabled: true })],
-        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
-      });
-      expect(result.success).toBe(true);
-
-      const src = await result.outputs[0]!.text();
-      expect(src).not.toContain("$RefreshReg$");
-      expect(src).not.toContain("$RefreshSig$");
-      expect(src).not.toContain("__MANDU_HMR__");
-    });
-  },
-);
-
-// Pure manifest-shape tests run regardless of the bundler skip flag —
-// they don't invoke Bun.build and are safe everywhere.
-describe("prod-smoke — manifest shape invariants (no Bun.build)", () => {
-  test("[M1] buildClientBundles prod path would omit shared.fastRefresh", async () => {
-    // We cannot easily invoke `buildClientBundles` here without a
-    // full Mandu project scaffold, so we assert the contract
-    // semantically via the static build.ts source: the `fastRefresh`
-    // field is populated only when the vendor shim result has both
-    // `reactRefreshRuntime` and `fastRefreshRuntime`. In prod mode
-    // `buildVendorShims` is called with `isDev: false` which returns
-    // empty strings for those — unwinding to `undefined` in the
-    // ternary at `build.ts:1548-1554`.
-    //
-    // This test documents the invariant textually; the bundler-level
-    // integration tests (S1/S2 above) prove the output side.
-    const buildSource = await fs.readFile(
-      path.join(
-        import.meta.dir,
-        "..",
-        "build.ts",
-      ),
-      "utf-8",
-    );
-    // The precise construction MUST be guarded by runtime presence.
-    expect(buildSource).toContain("vendorResult.reactRefreshRuntime && vendorResult.fastRefreshRuntime");
-    // And MUST spread-conditionally include the field.
-    expect(buildSource).toContain("...(fastRefresh ? { fastRefresh } : {})");
-  });
-});
+/**
+ * Phase 7.2 R1 Agent C (H4) — production bundle smoke tests.
+ *
+ * Confirms the Phase 7.1 audit finding L-02 regression is closed: a
+ * production build (`minify: true`, no Fast Refresh plugin) must NEVER
+ * leak the dev-only symbols that would otherwise install Fast Refresh
+ * stubs on `window` (`$RefreshReg$` / `$RefreshSig$` / `__MANDU_HMR__`)
+ * or pull in the vendor runtime (`_vendor-react-refresh`).
+ *
+ * We assert at two layers:
+ *   (A) the generated output JS bundle is free of the dev symbols
+ *   (B) the returned manifest has `shared.fastRefresh === undefined`
+ *
+ * Both layers matter because (A) can drift independently of (B) if a
+ * future refactor inlines a symbol name into a comment or data literal.
+ *
+ * References:
+ *   docs/security/phase-7-1-audit.md §3 L-02
+ *   docs/bun/phase-7-2-team-plan.md §3 Agent C H4
+ */
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "fs/promises";
+import fs from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+import { fastRefreshPlugin } from "../fast-refresh-plugin";
+
+/**
+ * Strings we treat as dev-only Fast Refresh fingerprints. Any of them
+ * appearing in a prod bundle is a leak. We keep the list small and
+ * precise so we don't false-flag legitimate unrelated code.
+ */
+const DEV_LEAK_FINGERPRINTS = [
+  "$RefreshReg$",
+  "$RefreshSig$",
+  "__MANDU_HMR__",
+  "_vendor-react-refresh",
+  "_fast-refresh-runtime",
+] as const;
+
+// Integration tests that spin up Bun.build are gated on CI flaky-matrix
+// environments. See `fast-refresh.test.ts` for the same pattern.
+describe.skipIf(process.env.MANDU_SKIP_BUNDLER_TESTS === "1")(
+  "prod-smoke — no Fast Refresh leak in production bundles",
+  () => {
+    let rootDir = "";
+
+    beforeAll(async () => {
+      rootDir = await mkdtemp(path.join(tmpdir(), "mandu-prod-smoke-"));
+      // Minimal island source — no JSX runtime, no imports, small AST
+      await writeFile(
+        path.join(rootDir, "counter.client.tsx"),
+        `import { useState } from 'react';
+export default function Counter() {
+  const [count, setCount] = useState(0);
+  return <button onClick={() => setCount(c => c + 1)}>{count}</button>;
+}
+`,
+        "utf-8",
+      );
+    });
+
+    afterAll(async () => {
+      if (rootDir) await rm(rootDir, { recursive: true, force: true });
+    });
+
+    test("[S1] production build output contains no dev-only Fast Refresh symbols", async () => {
+      // Prod path: `reactFastRefresh` off, plugin `disabled: true`,
+      // minify on. Matches the config `buildClientBundles` uses when
+      // `options.minify === true`.
+      const result = await Bun.build({
+        entrypoints: [path.join(rootDir, "counter.client.tsx")],
+        target: "browser",
+        minify: true,
+        plugins: [fastRefreshPlugin({ disabled: true })],
+        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
+      });
+      expect(result.success).toBe(true);
+
+      const src = await result.outputs[0]!.text();
+      for (const fingerprint of DEV_LEAK_FINGERPRINTS) {
+        expect(src.includes(fingerprint)).toBe(false);
+      }
+    });
+
+    test("[S2] prod build with reactFastRefresh=true explicitly disabled does not emit stubs", async () => {
+      // Defense-in-depth: even if a future config accident leaves
+      // `reactFastRefresh: false` off-by-default, the disabled plugin
+      // MUST still prevent injection. We pass reactFastRefresh: false
+      // here to represent the guaranteed-prod config.
+      const result = await Bun.build({
+        entrypoints: [path.join(rootDir, "counter.client.tsx")],
+        target: "browser",
+        minify: true,
+        reactFastRefresh: false,
+        plugins: [fastRefreshPlugin({ disabled: true })],
+        external: ["react", "react-dom", "react/jsx-dev-runtime", "react/jsx-runtime"],
+      });
+      expect(result.success).toBe(true);
+
+      const src = await result.outputs[0]!.text();
+      expect(src).not.toContain("$RefreshReg$");
+      expect(src).not.toContain("$RefreshSig$");
+      expect(src).not.toContain("__MANDU_HMR__");
+    });
+  },
+);
+
+// Pure manifest-shape tests run regardless of the bundler skip flag —
+// they don't invoke Bun.build and are safe everywhere.
+describe("prod-smoke — manifest shape invariants (no Bun.build)", () => {
+  test("[M1] buildClientBundles prod path would omit shared.fastRefresh", async () => {
+    // We cannot easily invoke `buildClientBundles` here without a
+    // full Mandu project scaffold, so we assert the contract
+    // semantically via the static build.ts source: the `fastRefresh`
+    // field is populated only when the vendor shim result has both
+    // `reactRefreshRuntime` and `fastRefreshRuntime`. In prod mode
+    // `buildVendorShims` is called with `isDev: false` which returns
+    // empty strings for those — unwinding to `undefined` in the
+    // ternary at `build.ts:1548-1554`.
+    //
+    // This test documents the invariant textually; the bundler-level
+    // integration tests (S1/S2 above) prove the output side.
+    const buildSource = await fs.readFile(
+      path.join(
+        import.meta.dir,
+        "..",
+        "build.ts",
+      ),
+      "utf-8",
+    );
+    // The precise construction MUST be guarded by runtime presence.
+    expect(buildSource).toContain("vendorResult.reactRefreshRuntime && vendorResult.fastRefreshRuntime");
+    // And MUST spread-conditionally include the field.
+    expect(buildSource).toContain("...(fastRefresh ? { fastRefresh } : {})");
+  });
+});