Janady13/thatstupidcomputer / scripts/check-build.ts

1/** Actual built-artifact and Fastify integration checks. No socket, browser or email send. */ 2import assert from 'node:assert/strict'; 3import { readFile, readdir, lstat, mkdir, writeFile } from 'node:fs/promises'; 4import { resolve, relative, extname } from 'node:path'; 5import { createHash } from 'node:crypto'; 6import { DOMParser } from '@xmldom/xmldom'; 7import { createApp } from '../apps/api/src/app.ts'; 8import { htmlRoutes } from '../apps/api/src/static.ts'; 9import { ROUTES, getPage, SITE_ORIGIN } from '../packages/site/content.ts'; 10import { buildGraph, metadataForPage, robotsTxt, sitemapXml } from '../packages/site/search.ts'; 11import { CRAWLER_AGENTS, PUBLISHER_META, PROVIDERS } from '../packages/discovery/registry.ts'; 12import type { PublicSiteConfig } from '../packages/site/truth.ts'; 13 14const root = resolve(import.meta.dirname, '..'); 15const output = resolve(root, 'apps/web/dist'); 16const sha = (bytes: string | Buffer) => createHash('sha256').update(bytes).digest('hex'); 17type Check = { id: string; status: 'PASS' | 'FAIL'; detail?: unknown; error?: string }; 18const checks: Check[] = []; 19async function check(id: string, run: () => unknown | Promise<unknown>) { 20 try { checks.push({ id, status: 'PASS', detail: await run() }); } 21 catch (error) { checks.push({ id, status: 'FAIL', error: error instanceof Error ? error.message : String(error) }); } 22} 23async function walk(directory: string): Promise<string[]> { 24 const entries = await readdir(directory, { withFileTypes: true }); 25 return (await Promise.all(entries.map(async entry => { 26 const path = resolve(directory, entry.name); 27 assert(!entry.isSymbolicLink(), `Public output must not contain symlink: ${relative(output, path)}`); 28 return entry.isDirectory() ? walk(path) : [path]; 29 }))).flat().sort(); 30} 31function parse(html: string) { 32 const errors: string[] = []; 33 const document = new DOMParser({ onError: (level, message) => errors.push(`${level}: ${message}`) }).parseFromString(html, 'text/html'); 34 assert.deepEqual(errors, [], 'Unexpected parser warnings/errors in actual HTML'); 35 return document; 36} 37type Parsed = ReturnType<typeof parse>; 38const tags = (document: Parsed, tag: string) => Array.from(document.getElementsByTagName(tag)); 39function meta(document: Parsed, name: string) { 40 return tags(document, 'meta').filter(node => node.getAttribute('name') === name || node.getAttribute('property') === name); 41} 42function configFromHTML(document: Parsed): PublicSiteConfig { 43 const configs = tags(document, 'script').filter(node => node.getAttribute('id') === 'tsc-config'); 44 assert.equal(configs.length, 1, 'Exactly one hydration configuration'); 45 assert.equal(configs[0].getAttribute('type'), 'application/json'); 46 const text = configs[0].textContent ?? ''; 47 assert.doesNotMatch(text, /sourceCommit|approvedPaths|claimRefs|SMTP_PASS|SMTP_TO|private\/standards/); 48 assert.doesNotMatch(text, /BING_KEY|OPENAI_API_KEY|GEMINI_API_KEY|TSC_DISCOVERY_NODE|TSC_GSC_SERVICE_ACCOUNT|api\.openai\.com\/v1\/responses|api\.mistral\.ai\/v1\/conversations/); 49 const config = JSON.parse(text) as PublicSiteConfig; 50 assert(['preview', 'production'].includes(config.deployment)); 51 assert(config.crawlerPolicy, 'Current crawler contract must be present in the built hydration config'); 52 assert.equal(config.canonicalOrigin, SITE_ORIGIN); 53 return config; 54} 55 56const startedAt = new Date().toISOString(); 57const files = await walk(output); 58const snapshot = await Promise.all(files.map(async path => ({ path: relative(root, path), bytes: (await lstat(path)).size, sha256: sha(await readFile(path)) }))); 59// Explicit empty environment prevents use of real SMTP configuration from the host. 60const app = await createApp({ env: { NODE_ENV: 'test', PUBLIC_ORIGIN: SITE_ORIGIN }, staticRoot: output, logger: false, limits: { globalMax: 5000, demoMax: 50 }, crawlerVerification: { fetch: async () => new Response('', { status: 503 }) } }); 61const htmlHeaders = { accept: 'text/html' }; 62let config: PublicSiteConfig | undefined; 63const internalLinks = new Set<string>(); 64try { 65 await check('build-record-and-route-inventory', async () => { 66 assert.deepEqual([...htmlRoutes].sort(), ROUTES.map(page => page.path).sort(), 'Backend and editorial route inventories differ'); 67 const record = JSON.parse(await readFile(resolve(root, '.build/build-record.json'), 'utf8')); 68 assert.equal(record.lockSha256, sha(await readFile(resolve(root, 'package-lock.json'))), 'Build is stale relative to the dependency lock'); 69 assert.deepEqual(record.routes, ROUTES.map(page => page.path)); 70 assert.equal(record.node, process.version); 71 assert.equal(snapshot.filter(file => file.path.endsWith('.html')).length, ROUTES.length + 1); 72 const actualAssets = snapshot.map(file => relative(output, resolve(root, file.path))).filter(path => path.startsWith('assets/')).sort(); 73 assert(Array.isArray(record.clientAssets), 'Build record lacks the bundler output inventory'); 74 assert.deepEqual(actualAssets, [...record.clientAssets].sort(), 'Public assets differ from this build: stale or missing bundles'); 75 return { routes: ROUTES.length, missingPage: 1, builtAt: record.builtAt, deployment: record.deployment, lockSha256: record.lockSha256, currentGeneratedAssets: actualAssets.length }; 76 }); 77 for (const page of ROUTES) await check(`page:${page.path}`, async () => { 78 const response = await app.inject({ url: page.path, headers: htmlHeaders }); 79 assert.equal(response.statusCode, 200); 80 assert.match(String(response.headers['content-type']), /^text\/html/); 81 assert.match(String(response.headers['cache-control']), /must-revalidate/); 82 assert.equal(response.headers['x-content-type-options'], 'nosniff'); 83 const document = parse(response.body); 84 const pageConfig = configFromHTML(document); 85 if (config) assert.deepEqual(pageConfig, config, 'Hydration configuration differs between public pages'); 86 else config = pageConfig; 87 const expected = metadataForPage(page, pageConfig); 88 assert.equal(tags(document, 'title').length, 1); 89 assert.equal(tags(document, 'title')[0].textContent, expected.title); 90 for (const [name, value] of [['description', expected.description], ['robots', expected.robots], ['og:title', expected.title], ['og:url', expected.canonical]]) { 91 const nodes = meta(document, name!); assert.equal(nodes.length, 1, `Duplicate/missing ${name}`); assert.equal(nodes[0].getAttribute('content'), value); 92 } 93 const canonical = tags(document, 'link').filter(node => node.getAttribute('rel') === 'canonical'); 94 assert.equal(canonical.length, 1); assert.equal(canonical[0].getAttribute('href'), expected.canonical); 95 assert.equal(tags(document, 'h1').length, 1); assert.equal(tags(document, 'h1')[0].textContent, page.heading); 96 const main = document.getElementById('main-content'); assert(main); 97 assert.equal(document.documentElement?.getAttribute('lang'), 'en'); 98 for (const { name, content } of PUBLISHER_META) { 99 const nodes = meta(document, name); 100 assert.equal(nodes.length, 1, `Missing provider publisher directive: ${name}`); 101 assert.equal(nodes[0].getAttribute('content'), pageConfig.deployment === 'production' ? content : 'noindex, nofollow'); 102 } 103 assert(main.textContent?.includes(page.intro), 'Actual initial HTML lacks the visible introduction'); 104 for (const section of page.sections) assert(main.textContent?.includes(section.heading), `Initial HTML lacks section ${section.heading}`); 105 const graphNodes = tags(document, 'script').filter(node => node.getAttribute('type') === 'application/ld+json'); 106 assert.equal(graphNodes.length, 1); 107 assert.deepEqual(JSON.parse(graphNodes[0].textContent ?? ''), buildGraph(page, pageConfig), 'SSR graph and current route contract differ'); 108 const graph = JSON.parse(graphNodes[0].textContent ?? '')['@graph'] as Array<Record<string, unknown>>; 109 for (const section of page.sections.filter(section => section.id)) { 110 const element = document.getElementById(section.id!); 111 assert(element, `Missing published answer: ${section.id}`); 112 assert.equal(element.getAttribute('aria-labelledby'), `${section.id}-heading`); 113 assert.equal(document.getElementById(`${section.id}-heading`)?.textContent, section.heading); 114 assert.equal(tags(document, '*').filter(node => node.getAttribute('id') === section.id).length, 1); 115 const record = graph.find(node => node['@id'] === `${expected.canonical}#${section.id}`); 116 assert(record && record['@type'] === 'WebPageElement'); 117 for (const part of [...(section.paragraphs ?? []), ...(section.items ?? [])]) { 118 assert(element.textContent?.includes(part), 'A structured answer is missing from visible HTML'); 119 assert(String(record.text).includes(part), 'Answer metadata lost a condition or limitation'); 120 } 121 assert(!element.hasAttribute('data-nosnippet'), 'Public answer accidentally excluded from snippets'); 122 } 123 for (const script of tags(document, 'script')) { 124 if (!script.getAttribute('src')) assert(['application/json', 'application/ld+json'].includes(script.getAttribute('type') ?? ''), 'Executable inline script would violate the enforced CSP'); 125 } 126 for (const anchor of tags(document, 'a')) { 127 const href = anchor.getAttribute('href'); assert(href, 'Anchor has no native href'); 128 if (href.startsWith('/') && !href.startsWith('//')) internalLinks.add(href); 129 if (href.startsWith('#')) assert(document.getElementById(href.slice(1)), `Missing fragment target ${href}`); 130 } 131 const forms = tags(document, 'form'); 132 assert.equal(forms.length, page.path === '/contact/' ? 1 : 0); 133 if (forms.length) { 134 const form = forms[0]; assert.equal(form.getAttribute('action'), '/api/demo'); assert.equal(form.getAttribute('method'), 'post'); 135 assert(!form.hasAttribute('novalidate'), 'No-JavaScript form must keep native validation'); 136 const labels = tags(document, 'label').map(node => node.getAttribute('for')); 137 for (const field of [...tags(document, 'input'), ...tags(document, 'select'), ...tags(document, 'textarea')]) { 138 if (field.getAttribute('type') !== 'hidden') assert(labels.includes(field.getAttribute('id')), 'Form control lacks its associated label'); 139 } 140 const website = document.getElementById('demo-website'), message = document.getElementById('demo-message'); 141 // This parser preserves React's camel-case source spelling but folds getAttribute 142 // lookups in HTML mode; inspect its named attributes to match browser HTML semantics. 143 assert.equal(Array.from(website?.attributes ?? []).find(attribute => attribute.name.toLowerCase() === 'maxlength')?.value, '300'); 144 assert.equal(Array.from(message?.attributes ?? []).find(attribute => attribute.name.toLowerCase() === 'maxlength')?.value, '4000'); 145 } 146 return { status: response.statusCode, bytes: response.rawPayload.length, canonical: expected.canonical, title: expected.title, initialHTML: true, nativeForm: forms.length === 1 }; 147 }); 148 await check('all-native-internal-links-resolve', async () => { 149 for (const href of internalLinks) { 150 const target = href.split(/[?#]/)[0]; assert(getPage(target), `Link has no public route: ${target}`); 151 assert.equal((await app.inject({ url: target, headers: htmlHeaders })).statusCode, 200, href); 152 } 153 return { distinctTargets: internalLinks.size }; 154 }); 155 await check('publisher-crawler-public-private-parity-without-credentials', async () => { 156 const url = '/services/website-rescue/'; 157 const human = await app.inject({ url, headers: htmlHeaders }); 158 for (const { agent } of CRAWLER_AGENTS) { 159 const headers = { ...htmlHeaders, 'user-agent': `${agent}/1.0` }; 160 const response = await app.inject({ url, headers }); 161 assert.equal(response.statusCode, 200, agent); 162 assert.equal(response.body, human.body, `Bot-only content or challenge for ${agent}`); 163 assert.equal((await app.inject({ url: '/private/truth/reviewed-export.json', headers })).statusCode, 404, agent); 164 } 165 return { providersReviewed: Object.keys(PROVIDERS), simulatedAgents: CRAWLER_AGENTS.length, modelApiCalls: 0, outcome: 'publisher-delivery-only; not real crawler or citation evidence' }; 166 }); 167 await check('missing-page-and-hydration-input-consistency', async () => { 168 const response = await app.inject({ url: '/this-page-does-not-exist/', headers: htmlHeaders }); 169 assert.equal(response.statusCode, 404); assert.match(String(response.headers['cache-control']), /no-store/); 170 const document = parse(response.body); configFromHTML(document); 171 assert.equal(tags(document, 'h1').length, 1); 172 assert.equal(tags(document, 'link').filter(node => node.getAttribute('rel') === 'canonical').length, 0); 173 assert.equal(tags(document, 'script').filter(node => node.getAttribute('type') === 'application/ld+json').length, 0); 174 assert.match(meta(document, 'robots')[0].getAttribute('content') ?? '', /noindex/); 175 for (const path of ['/about//', '/services///', '/ABOUT/', '/%61bout/', '/this-page-does-not-exist/']) { 176 assert.equal(getPage(path), undefined, `Client resolver would hydrate unknown path into a public page: ${path}`); 177 assert.equal((await app.inject({ url: path, headers: htmlHeaders })).statusCode, 404, path); 178 } 179 return 'Actual 404 response and initial metadata agree with the current route resolver; browser hydration itself is untested.'; 180 }); 181 await check('canonical-redirect-and-attribution', async () => { 182 for (const page of ROUTES.filter(page => page.path !== '/')) { 183 const response = await app.inject({ url: `${page.path.slice(0, -1)}?utm_source=chatgpt.com&email=private%40example.test`, headers: htmlHeaders }); 184 assert.equal(response.statusCode, 308); assert.equal(response.headers.location, `${page.path}?utm_source=chatgpt.com`); 185 assert.equal(getPage(page.path.slice(0, -1))?.path, page.path); 186 } 187 const duplicate = await app.inject('/about?utm_source=chatgpt.com&utm_source=claude.ai'); 188 assert.equal(duplicate.headers.location, '/about/'); 189 return 'Each known slash alias redirects once; only the finite unique source label is preserved.'; 190 }); 191 await check('robots-sitemap-and-page-mode-agree', async () => { 192 assert(config, 'No valid built public configuration'); 193 const robots = await app.inject('/robots.txt'), sitemap = await app.inject('/sitemap.xml'); 194 assert.equal(robots.statusCode, 200); assert.equal(sitemap.statusCode, 200); 195 assert.equal(robots.body, robotsTxt(config)); assert.equal(sitemap.body, sitemapXml(config)); 196 return { deployment: config.deployment, sitemapEntries: (sitemap.body.match(/<loc>/g) ?? []).length, crawlerPolicy: config.crawlerPolicy }; 197 }); 198 await check('every-built-asset-is-served-with-exact-bytes-and-mime', async () => { 199 const types: Record<string, RegExp> = { '.js': /(?:java|ecma)script/, '.mjs': /(?:java|ecma)script/, '.css': /text\/css/, '.svg': /image\/svg\+xml/, '.png': /image\/png/, '.wasm': /application\/wasm/, '.riv': /application\/octet-stream/, '.json': /application\/json/, '.txt': /text\/plain/, '.xml': /(?:application|text)\/xml/ }; 200 const assets = snapshot.filter(file => !file.path.endsWith('.html')); 201 for (const file of assets) { 202 const url = '/' + relative(output, resolve(root, file.path)); 203 const response = await app.inject(url); assert.equal(response.statusCode, 200, url); 204 assert.equal(sha(response.rawPayload), file.sha256, `HTTP bytes differ from built artifact: ${url}`); 205 const type = types[extname(url)]; if (type) assert.match(String(response.headers['content-type']), type, url); 206 if (url.startsWith('/assets/')) assert.match(String(response.headers['cache-control']), /immutable/, url); 207 } 208 return { assets: assets.length, nativeRiveFiles: assets.filter(file => file.path.endsWith('.riv')).length }; 209 }); 210 await check('public-artifact-boundary-and-private-path-denial', async () => { 211 for (const file of snapshot) { 212 const url = relative(output, resolve(root, file.path)); 213 assert.doesNotMatch(url, /(?:^|\/)(?:private|standards|docs|src|node_modules|native)(?:\/|$)|\.map$|(?:^|\/)\./); 214 if (/\.(?:html|js|css|json|txt|xml|svg)$/.test(url)) assert.doesNotMatch(await readFile(resolve(root, file.path), 'utf8'), /2026\.09\.09-d26|2026\.09\.12-g40|PRIVATE_NOT_WEB_CONTENT|SEO-AIO-Library\.txt|Graph-Expansion\.txt|approvedPaths|claimRefs/); 215 if (url.endsWith('.js')) assert.doesNotMatch(await readFile(resolve(root, file.path), 'utf8'), /BING_KEY|OPENAI_API_KEY|GEMINI_API_KEY|TSC_DISCOVERY_NODE|TSC_GSC_SERVICE_ACCOUNT|api\.openai\.com\/v1\/responses|api\.mistral\.ai\/v1\/conversations/, 'Private provider implementations must not reach the browser'); 216 } 217 for (const url of ['/private/standards/SEO-AIO-Library.txt', '/docs/standards/coverage-ledger.json', '/native/reports/native-canvas.json', '/src/App.tsx', '/package.json', '/.env', '/assets/main.js.map', '/%2e%2e/private/truth/export.json']) { 218 const response = await app.inject({ url, headers: htmlHeaders }); assert.equal(response.statusCode, 404, url); 219 } 220 return 'No forbidden path or selected private-source/provenance markers found; targeted leak checks are not a universal secret scanner.'; 221 }); 222 await check('actual-build-form-and-api-failure-integration', async () => { 223 const headers = { origin: SITE_ORIGIN, 'content-type': 'application/json', accept: 'application/json' }; 224 const payload = { name: 'Synthetic Review', email: 'review@example.test', business: 'Synthetic Build Check', website: '', projectType: 'design', message: 'This is synthetic local build verification.', consent: true, companyWebsite: '', submissionId: '00000000-0000-4000-8000-000000000000' }; 225 const unavailable = await app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 226 assert.equal(unavailable.statusCode, 503); assert.equal(unavailable.json().ok, false); assert.equal(unavailable.json().code, 'service_unavailable'); 227 assert.match(String(unavailable.headers['cache-control']), /no-store/); 228 const invalid = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...payload, email: 'invalid' } }); 229 assert.equal(invalid.statusCode, 400); assert.equal(invalid.json().ok, false); 230 const hostile = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, origin: 'https://unrelated.example.test' }, payload }); 231 assert.equal(hostile.statusCode, 403); 232 const native = await app.inject({ method: 'POST', url: '/api/demo', headers: { origin: SITE_ORIGIN, 'content-type': 'application/x-www-form-urlencoded', accept: 'text/html' }, payload: new URLSearchParams(Object.entries(payload).map(([key, value]) => [key, String(value)])).toString() }); 233 assert.equal(native.statusCode, 503); assert.match(String(native.headers['content-type']), /text\/html/); assert.doesNotMatch(native.body, /review@example\.test|Synthetic Build Check/); 234 const ready = await app.inject('/api/ready'); assert.equal(ready.statusCode, 503); assert.equal(ready.json().checks.site, 'available'); assert.equal(ready.json().delivery, 'not_checked'); 235 const csp = String(unavailable.headers['content-security-policy']); assert.match(csp, /form-action 'self'/); assert.match(csp, /wasm-unsafe-eval/); assert.doesNotMatch(csp, /(?:^|\s)'unsafe-eval'/); 236 return { syntheticOnly: true, mailTransportConfigured: false, emailSends: 0, readinessIsDeliveryProof: false }; 237 }); 238 await check('built-output-unchanged-during-check', async () => { 239 assert.deepEqual(await walk(output), files); 240 for (const file of snapshot) assert.equal(sha(await readFile(resolve(root, file.path))), file.sha256, `Concurrent build changed ${file.path}`); 241 return { files: snapshot.length }; 242 }); 243} finally { await app.close(); } 244const report = { 245 schemaVersion: 1, visibility: 'PRIVATE_NOT_WEB_CONTENT', startedAt, endedAt: new Date().toISOString(), 246 command: 'node --import tsx scripts/check-build.ts', environment: { node: process.version, platform: process.platform, arch: process.arch, method: 'Fastify.inject plus non-rendering HTML parser; no sockets, browser, DNS or mail transport' }, 247 status: checks.some(check => check.status === 'FAIL') ? 'FAIL' : 'PASS', passed: checks.filter(check => check.status === 'PASS').length, failed: checks.filter(check => check.status === 'FAIL').length, 248 limitations: ['No actual browser hydration, JavaScript execution, layout, WebGL, keyboard or accessibility-conformance proof.', 'No live email send, mailbox receipt, production identity, account data, DNS/TLS, public indexing or field-performance observation.', 'Public-source marker checks are targeted artifact-boundary evidence, not a claim that arbitrary secrets cannot exist.'], 249 checks, publicBuild: snapshot, 250}; 251await mkdir(resolve(root, 'docs/standards'), { recursive: true }); 252await writeFile(resolve(root, 'docs/standards/build-integration.json'), JSON.stringify(report, null, 2) + '\n'); 253console.log(JSON.stringify({ status: report.status, passed: report.passed, failed: report.failed, publicFiles: snapshot.length, report: 'docs/standards/build-integration.json', failures: checks.filter(check => check.status === 'FAIL') })); 254if (report.failed) process.exitCode = 1; 255