完善(08-09-deployment-contract-single-source-harness): 收敛部署合同并补失败路径

server/tests/unit/scripts/check-source-provenance.test.js

@@ -25,6 +25,23 @@ describe("deployment source provenance", () => {
     provenance = await import(pathToFileURL(scriptPath).href);
   });
 
+  it("derives the complete candidate build environment as one immutable contract", () => {
+    const commit = "a".repeat(40);
+    const buildEnv = provenance.deriveCandidateBuildEnv(commit);
+    expect(Object.keys(buildEnv)).toEqual(["BUILD_SHA", "VITE_BUILD_SHA"]);
+    expect(buildEnv).toEqual({
+      BUILD_SHA: commit,
+      VITE_BUILD_SHA: commit.slice(0, 12),
+    });
+    expect(Object.isFrozen(buildEnv)).toBe(true);
+    expect(() => provenance.deriveCandidateBuildEnv("a".repeat(39))).toThrowError(
+      expect.objectContaining({ code: "commit_invalid" }),
+    );
+    expect(() => provenance.deriveCandidateBuildEnv("A".repeat(40))).toThrowError(
+      expect.objectContaining({ code: "commit_invalid" }),
+    );
+  });
+
   beforeEach(async () => {
     repoDir = await mkdtemp(path.join(os.tmpdir(), "hyb-oa-provenance-test-"));
     await git(["init", "--initial-branch=main"]);
@@ -72,6 +89,10 @@ describe("deployment source provenance", () => {
         published: true,
         overrideUsed: false,
         upstream: "origin/main",
+        buildEnv: {
+          BUILD_SHA: expect.stringMatching(/^[0-9a-f]{40,64}$/u),
+          VITE_BUILD_SHA: expect.stringMatching(/^[0-9a-f]{12}$/u),
+        },
       });
     } finally {
       await rm(remoteDir, { recursive: true, force: true });