@teamscala/service-boot 0.23.284

package/src/build-client-assets.test.ts

@@ -0,0 +1,216 @@
+/**
+ * @system server-handlers
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Regression guard for stripRemoteImports. Third-party package CSS must not
+ * inject a remote @import (the dropped/CSP-blocked Inter-font class, scala-docs
+ * 2026-06-13): @puckeditor/core/dist/index.css leads with `@import
+ * "https://rsms.me/inter/inter.css"`, a CDN our CSP forbids. The compiled
+ * bundle must carry zero remote @imports; the app loads its font from the
+ * CSP-allowlisted Google Fonts <link> in index.html instead.
+ */
+
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterAll, describe, expect, test } from "bun:test";
+import {
+	computeInputFingerprint,
+	stripRemoteImports,
+} from "./build-client-assets.ts";
+
+describe("stripRemoteImports", () => {
+	test("removes a remote @import (Puck's rsms.me font)", () => {
+		const css = `.a { color: red; }\n@import "https://rsms.me/inter/inter.css";\n:root { --x: 1; }`;
+		const out = stripRemoteImports(css);
+		expect(out).not.toContain("@import");
+		expect(out).not.toContain("rsms.me");
+		expect(out).toContain(".a { color: red; }");
+		expect(out).toContain("--x: 1;");
+	});
+
+	test("removes the url() form with a media suffix", () => {
+		const css = `.a{}\n@import url("https://fonts.example/f.css") screen;\n.b{}`;
+		const out = stripRemoteImports(css);
+		expect(out).not.toContain("@import");
+		expect(out).toContain(".a{}");
+		expect(out).toContain(".b{}");
+	});
+
+	test("removes multiple remote @imports", () => {
+		const css = `@import "https://a.test/x.css";\n.a{}\n@import "https://b.test/y.css";\n.b{}`;
+		expect(stripRemoteImports(css)).not.toContain("@import");
+	});
+
+	test("leaves local/relative @imports untouched (Tailwind inlines those)", () => {
+		const css = `@import "./local.css";\n.a{}`;
+		expect(stripRemoteImports(css)).toBe(css);
+	});
+
+	test("no remote @import → unchanged", () => {
+		const css = `:root{--x:1}\n.a{color:red}`;
+		expect(stripRemoteImports(css)).toBe(css);
+	});
+});
+
+// The client-bundle freshness check keys on input CONTENT, never mtime
+// (cache-key-hashes-source-inputs-only). mtime comparison silently served a
+// stale bundle on Railway (deploy-build bakes at image-build time; hoisted
+// hardlinks carry old mtimes; baked manifest is newer → wrongly skips), so a
+// published+installed @teamscala/* fix never reached the browser (2026-06-14).
+// These tests prove the fingerprint changes iff an input's CONTENT changes.
+describe("computeInputFingerprint", () => {
+	const dirs: string[] = [];
+	async function makeService(files: Record<string, string>): Promise<string> {
+		const dir = await mkdtemp(join(tmpdir(), "bca-fp-"));
+		dirs.push(dir);
+		await mkdir(join(dir, "src"), { recursive: true });
+		for (const [rel, content] of Object.entries(files)) {
+			await mkdir(dirname(join(dir, rel)), { recursive: true });
+			await writeFile(join(dir, rel), content);
+		}
+		return dir;
+	}
+	afterAll(async () => {
+		for (const d of dirs) await rm(d, { recursive: true, force: true });
+	});
+
+	test("identical inputs → identical fingerprint (skip path)", async () => {
+		const files = {
+			"bun.lock": `{ "ui-foundation": "99.100.86" }`,
+			"src/entry-client.ts": "export {};",
+			"src/page-manifest.ts": "export const M = {};",
+			"src/app.css": ".a{}",
+		};
+		const a = await makeService(files);
+		const b = await makeService(files);
+		expect(await computeInputFingerprint(a)).toBe(
+			await computeInputFingerprint(b),
+		);
+	});
+
+	// `no-uncontrolled-repetition-or-cascade`: bun.lock is NOT an input. A
+	// version bump of a package NOT in this service's client bundle (here
+	// ui-foundation is named in bun.lock but never imported and not installed)
+	// MUST NOT invalidate — otherwise every backend @teamscala/* publish rebuilds
+	// every UI service (the publish→rebuild storm). The closure content hashes
+	// are unchanged, so the fingerprint is identical → skip → storm cannot form.
+	test("a bun.lock change for a NON-closure package → SAME fingerprint (no false rebuild)", async () => {
+		const base = {
+			"src/entry-client.ts": "export {};",
+			"src/page-manifest.ts": "export const M = {};",
+			"src/app.css": ".a{}",
+		};
+		const oldD = await makeService({
+			...base,
+			"bun.lock": `{ "ui-foundation": "99.100.85" }`,
+		});
+		const newD = await makeService({
+			...base,
+			"bun.lock": `{ "ui-foundation": "99.100.86" }`,
+		});
+		expect(await computeInputFingerprint(oldD)).toBe(
+			await computeInputFingerprint(newD),
+		);
+	});
+
+	// The closure-scoped third-party boundary versions: a version bump of a
+	// third-party package that IS in the client closure still invalidates — the
+	// correctness property dropping bun.lock must not regress. The canonical case
+	// is react; a react version bump in the bundle MUST rebuild.
+	test("a third-party closure-dep version bump → different fingerprint (rebuild)", async () => {
+		const makeWith = (version: string) => ({
+			"src/entry-client.ts": `import "fake-react";\n`,
+			"src/page-manifest.ts": "export const M = {};\n",
+			"src/app.css": ".a{}",
+			"node_modules/fake-react/package.json":
+				`{"name":"fake-react","version":"${version}","exports":{".":"./index.js"}}\n`,
+			"node_modules/fake-react/index.js": `export const R = "${version}";\n`,
+		});
+		const before = await makeService(makeWith("1.0.0"));
+		const after = await makeService(makeWith("1.0.1"));
+		expect(await computeInputFingerprint(before)).not.toBe(
+			await computeInputFingerprint(after),
+		);
+	});
+
+	test("a regenerated page-manifest → different fingerprint", async () => {
+		const base = {
+			"bun.lock": `{ "x": "1" }`,
+			"src/entry-client.ts": "export {};",
+			"src/app.css": ".a{}",
+		};
+		const before = await makeService({
+			...base,
+			"src/page-manifest.ts": "export const M = { Hero: 1 };",
+		});
+		const after = await makeService({
+			...base,
+			"src/page-manifest.ts": "export const M = { Hero: 1, Cta: 2 };",
+		});
+		expect(await computeInputFingerprint(before)).not.toBe(
+			await computeInputFingerprint(after),
+		);
+	});
+
+	test("a missing input (backend service, no app.css) is stable, not a throw", async () => {
+		const dir = await makeService({
+			"bun.lock": `{ "x": "1" }`,
+			"src/entry-client.ts": "export {};",
+			"src/page-manifest.ts": "export const M = {};",
+		});
+		const fp1 = await computeInputFingerprint(dir);
+		const fp2 = await computeInputFingerprint(dir);
+		expect(fp1).toBe(fp2);
+		expect(fp1).toMatch(/^[a-f0-9]{16}$/);
+	});
+
+	// Regression guard for the 2026-07-12 scala-agents stale-bundle bug. A boot
+	// that builds MID-INSTALL (package-poller restarts after writing the new
+	// bun.lock but before node_modules extraction finishes) bakes OLD @teamscala/*
+	// JS while the lock-derived fingerprint records "current" — so every later
+	// restart recomputes the same fingerprint, skips the rebuild, and serves the
+	// STALE bundle forever. Bun.build itself never caches stale modules (an
+	// isolated splitting+minify repro proved it reads fresh content across
+	// processes), so the defense is to hash the actual @teamgbg JS CONTENT the
+	// bundle is built from (the JS twin of hashResolvedPackageStylesheets). With
+	// that in the fingerprint, the freshly-installed bytes hash differently and
+	// the bundle self-heals on the next boot. (bun.lock + entry files are
+	// IDENTICAL across these two fixtures — only the @teamgbg JS body changes.)
+	test("a @teamgbg JS module content change → different fingerprint (mid-install stale-bake self-heal)", async () => {
+		const makeWith = (pkgJs: string) => ({
+			"bun.lock": `{ "locks": { "@teamscala/repro-pkg": "1.0.0" } }`,
+			"src/entry-client.ts": `import { M } from "@teamscala/repro-pkg";\nconsole.log(M);\n`,
+			"src/page-manifest.ts": "export const M = {};\n",
+			"src/app.css": ".a{}",
+			"node_modules/@teamscala/repro-pkg/package.json":
+				`{"name":"@teamscala/repro-pkg","version":"1.0.0","exports":{".":"./index.ts"}}\n`,
+			"node_modules/@teamscala/repro-pkg/index.ts": pkgJs,
+		});
+		const before = await makeService(makeWith("export const M = 'AAA_REPRO';\n"));
+		const after = await makeService(makeWith("export const M = 'BBB_REPRO';\n"));
+		expect(await computeInputFingerprint(before)).not.toBe(
+			await computeInputFingerprint(after),
+		);
+	});
+
+	// The JS graph walk runs bounded-concurrent; the aggregate must be stable
+	// across runs (independent of async scheduling) — the per-file hashes are
+	// folded in sorted path order.
+	test("@teamgbg JS graph fingerprint is deterministic across runs", async () => {
+		const dir = await makeService({
+			"bun.lock": `{ "locks": { "@teamscala/repro-pkg": "1.0.0" } }`,
+			"src/entry-client.ts": `import { M } from "@teamscala/repro-pkg";\nconsole.log(M);\n`,
+			"src/page-manifest.ts": "export const M = {};\n",
+			"src/app.css": ".a{}",
+			"node_modules/@teamscala/repro-pkg/package.json":
+				`{"name":"@teamscala/repro-pkg","version":"1.0.0","exports":{".":"./index.ts"}}\n`,
+			"node_modules/@teamscala/repro-pkg/index.ts": "export const M = 'STABLE';\n",
+		});
+		const a = await computeInputFingerprint(dir);
+		const b = await computeInputFingerprint(dir);
+		expect(a).toBe(b);
+		expect(a).toMatch(/^[a-f0-9]{16}$/);
+	});
+});