fix(deploy): make portal installer runtime portable

www/tools/deploy.test.mjs

@@ -1,30 +1,39 @@
 import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import test from 'node:test';
 import { releaseManifest, rsyncArguments, sshTarget } from './deploy.mjs';
 
-test('site manifest follows the Contabo schema and detects unsafe public output', async () => {
+const fixturePath = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fixtures', 'contabo-release-manifest-v1.json');
+const fixture = JSON.parse(await fs.readFile(fixturePath, 'utf8'));
+
+async function writeContractArtifact(root) {
+  for (const [relative, contents] of Object.entries(fixture.input.files)) {
+    const target = path.join(root, relative);
+    await fs.mkdir(path.dirname(target), { recursive: true });
+    await fs.writeFile(target, contents);
+  }
+}
+
+test('site manifest follows the pinned merged-Contabo release contract and detects unsafe public output', async (t) => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'aia-deploy-manifest-'));
   try {
-    await fs.mkdir(path.join(root, '_astro'));
-    await fs.writeFile(path.join(root, 'index.html'), '<title>Synthetic</title>');
-    await fs.writeFile(path.join(root, '_astro', 'entry.abcdefgh.js'), 'export {}');
-    const manifest = await releaseManifest(root, 'a'.repeat(40));
-    assert.deepEqual(Object.keys(manifest).sort(), ['directories','files','immutableAssets','schema','sourceCommit','treeSha256']);
-    assert.equal(manifest.schema, 1);
-    assert.equal(manifest.immutableAssets[0], '_astro/entry.abcdefgh.js');
-    const expected = createHash('sha256').update(Object.entries(manifest.files).sort(([a], [b]) => a.localeCompare(b)).map(([name, meta]) => `${name}\0${meta.sha256}\n`).join('')).digest('hex');
-    assert.equal(manifest.treeSha256, expected);
-    const serverTool = path.resolve(process.cwd(), '../../contabo/scripts/website-release.py');
-    const parity = spawnSync('python3', [serverTool, 'manifest', root, 'a'.repeat(40)], { encoding: 'utf8' });
-    assert.equal(parity.status, 0, parity.stderr);
-    assert.deepEqual(manifest, JSON.parse(parity.stdout));
+    await writeContractArtifact(root);
+    const manifest = await releaseManifest(root, fixture.input.sourceCommit);
+    assert.deepEqual(manifest, fixture.expected);
+    const serverTool = process.env.AIA_CONTABO_RELEASE_TOOL;
+    if (serverTool) {
+      const parity = spawnSync('python3', [serverTool, 'manifest', root, fixture.input.sourceCommit], { encoding: 'utf8' });
+      assert.equal(parity.status, 0, `Configured Contabo release tool failed: ${parity.stderr}`);
+      assert.deepEqual(manifest, JSON.parse(parity.stdout));
+    } else {
+      t.diagnostic(`Live Contabo-tool parity was not run; this test validates the checked-in schema fixture generated from ${fixture.contaboCommit}. Set AIA_CONTABO_RELEASE_TOOL to the merged website-release.py path for direct parity.`);
+    }
     await fs.mkdir(path.join(root, 'private'));
-    await assert.rejects(releaseManifest(root, 'a'.repeat(40)), /Unexpected private artifact/);
+    await assert.rejects(releaseManifest(root, fixture.input.sourceCommit), /Unexpected private artifact/);
   } finally { await fs.rm(root, { recursive: true, force: true }); }
 });