feat: integrate XSLT Tools with toolbox portal

tests/releasePackaging.test.ts

@@ -0,0 +1,125 @@
+import { execFileSync } from 'node:child_process';
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import {
+  collectRuntimeDependencyLicenseEntries,
+  createDeterministicZip,
+  listFiles,
+  writeReleaseFiles,
+} from '../scripts/package-release.mjs';
+
+describe('release packaging', () => {
+  it('creates byte-for-byte deterministic ZIP files', () => {
+    const entries = [
+      { name: 'index.html', data: Buffer.from('<h1>XSLT tools</h1>') },
+      { name: 'toolbox-app.json', data: Buffer.from('{"schemaVersion":1}') },
+    ];
+
+    expect(createDeterministicZip(entries)).toEqual(
+      createDeterministicZip(entries)
+    );
+  });
+
+  it('creates the same archive in different host time zones', () => {
+    const moduleUrl = pathToFileURL(
+      join(process.cwd(), 'scripts/package-release.mjs')
+    ).href;
+    const program = `
+      import { createDeterministicZip } from ${JSON.stringify(moduleUrl)};
+      const archive = createDeterministicZip([
+        { name: 'index.html', data: Buffer.from('timezone invariant') }
+      ]);
+      process.stdout.write(archive.toString('base64'));
+    `;
+    const createInTimezone = (timezone: string) =>
+      execFileSync(
+        process.execPath,
+        ['--input-type=module', '--eval', program],
+        {
+          encoding: 'utf8',
+          env: { ...process.env, TZ: timezone },
+        }
+      );
+
+    expect(createInTimezone('UTC')).toBe(createInTimezone('Pacific/Honolulu'));
+  });
+
+  it('includes legal files for production dependencies but not test tooling', () => {
+    const names = collectRuntimeDependencyLicenseEntries().map(
+      (entry) => entry.name
+    );
+
+    expect(
+      names.some((name) =>
+        /^LICENSES\/npm\/add-ideas--toolbox-contract-[^/]+\/LICENSE$/.test(name)
+      )
+    ).toBe(true);
+    expect(
+      names.some((name) =>
+        /^LICENSES\/npm\/add-ideas--toolbox-shell-react-[^/]+\/LICENSE$/.test(
+          name
+        )
+      )
+    ).toBe(true);
+    expect(names.some((name) => /\/react-[^/]+\/LICENSE$/.test(name))).toBe(
+      true
+    );
+    expect(names.some((name) => name.includes('toolbox-testkit'))).toBe(false);
+  });
+
+  it('refuses same-version overwrites unless force is explicit', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'xslt-release-test-'));
+    const archiveTarget = join(directory, 'xslt-tools.zip');
+    const checksumTarget = join(directory, 'xslt-tools.sha256');
+    writeFileSync(archiveTarget, 'existing archive');
+    writeFileSync(checksumTarget, 'existing checksum');
+
+    try {
+      expect(() =>
+        writeReleaseFiles({
+          archive: Buffer.from('new archive'),
+          archiveTarget,
+          checksum: 'new checksum',
+          checksumTarget,
+        })
+      ).toThrow(/Refusing to overwrite/);
+      expect(readFileSync(archiveTarget, 'utf8')).toBe('existing archive');
+      expect(readFileSync(checksumTarget, 'utf8')).toBe('existing checksum');
+
+      writeReleaseFiles({
+        archive: Buffer.from('new archive'),
+        archiveTarget,
+        checksum: 'new checksum',
+        checksumTarget,
+        force: true,
+      });
+      expect(readFileSync(archiveTarget, 'utf8')).toBe('new archive');
+      expect(readFileSync(checksumTarget, 'utf8')).toBe('new checksum');
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects symlinks instead of following them into an archive', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'xslt-release-tree-test-'));
+    const target = join(directory, 'target.txt');
+    const link = join(directory, 'linked.txt');
+    writeFileSync(target, 'must not be followed through a link');
+    symlinkSync(target, link);
+
+    try {
+      expect(() => listFiles(directory)).toThrow(/symlink or special/i);
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+});