fix: certify generated symlink state

scripts/build-web.test.mjs

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict';
-import { access, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { access, mkdir, readFile, rm, symlink, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import test from 'node:test';
 
@@ -26,19 +26,27 @@ test.after(async () => {
   await rm(fixtureRoot, { recursive: true, force: true });
 });
 
-test('a successful web build atomically publishes its source fingerprint', async () => {
+test('a successful web build atomically publishes its source and symlink certification', async () => {
   const root = await fixture('success');
   const marker = path.join(root, 'apps', 'web', '.next', '.mosaic-source-hash');
+  const manifest = path.join(root, 'apps', 'web', '.next', '.mosaic-symlink-manifest');
 
   await buildWeb({ root, fingerprint: async () => 'certified', runBuild: async () => {} });
 
-  assert.equal(await readFile(marker, 'utf8'), 'certified\n');
+  assert.deepEqual(JSON.parse(await readFile(marker, 'utf8')), {
+    version: 1,
+    sourceFingerprint: 'certified',
+    symlinkManifestHash: '8a5a375cea6a55d24bd5f875856da63feba33adbefb15a92a0007719b84bcf11',
+  });
+  assert.equal(await readFile(manifest, 'utf8'), '{"version":1,"links":[]}\n');
 });
 
 test('a failed web build leaves no certification marker', async () => {
   const root = await fixture('failure');
   const marker = path.join(root, 'apps', 'web', '.next', '.mosaic-source-hash');
+  const manifest = path.join(root, 'apps', 'web', '.next', '.mosaic-symlink-manifest');
   await writeFile(marker, 'stale\n');
+  await writeFile(manifest, 'stale\n');
 
   await assert.rejects(
     buildWeb({
@@ -52,12 +60,15 @@ test('a failed web build leaves no certification marker', async () => {
   );
 
   assert.equal(await exists(marker), false);
+  assert.equal(await exists(manifest), false);
 });
 
 test('overlapping web builds are serialized while the marker remains absent', async () => {
   const root = await fixture('overlap');
   const marker = path.join(root, 'apps', 'web', '.next', '.mosaic-source-hash');
+  const manifest = path.join(root, 'apps', 'web', '.next', '.mosaic-symlink-manifest');
   await writeFile(marker, 'stale\n');
+  await writeFile(manifest, 'stale\n');
   let releaseFirst;
   let secondEntered = false;
   const firstEntered = new Promise((resolve) => {
@@ -87,16 +98,41 @@ test('overlapping web builds are serialized while the marker remains absent', as
   await new Promise((resolve) => setTimeout(resolve, 75));
   assert.equal(secondEntered, false);
   assert.equal(await exists(marker), false);
+  assert.equal(await exists(manifest), false);
 
   releaseFirst();
   await Promise.all([first, second]);
   assert.equal(secondEntered, true);
-  assert.equal(await readFile(marker, 'utf8'), 'certified\n');
+  assert.equal(JSON.parse(await readFile(marker, 'utf8')).sourceFingerprint, 'certified');
+  assert.equal(await readFile(manifest, 'utf8'), '{"version":1,"links":[]}\n');
+});
+
+test('a build that replaces .next with a symbolic link cannot publish outside the checkout', async () => {
+  const root = await fixture('symbolic-next');
+  const nextDir = path.join(root, 'apps', 'web', '.next');
+  const outside = path.join(root, 'outside-generated');
+  await mkdir(outside);
+
+  await assert.rejects(
+    buildWeb({
+      root,
+      fingerprint: async () => 'certified',
+      runBuild: async () => {
+        await rm(nextDir, { recursive: true });
+        await symlink(outside, nextDir);
+      },
+    }),
+    /must be a real directory/,
+  );
+
+  assert.equal(await exists(path.join(outside, '.mosaic-source-hash')), false);
+  assert.equal(await exists(path.join(outside, '.mosaic-symlink-manifest')), false);
 });
 
 test('inputs changed during a web build are not certified', async () => {
   const root = await fixture('changed-inputs');
   const marker = path.join(root, 'apps', 'web', '.next', '.mosaic-source-hash');
+  const manifest = path.join(root, 'apps', 'web', '.next', '.mosaic-symlink-manifest');
   const fingerprints = ['before', 'after'];
 
   await assert.rejects(
@@ -109,4 +145,5 @@ test('inputs changed during a web build are not certified', async () => {
   );
 
   assert.equal(await exists(marker), false);
+  assert.equal(await exists(manifest), false);
 });