refactor(app): share application components and request services

src/tooling/applicationHtml.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { expandApplicationHtml, APPLICATION_TEMPLATES } from '../../build/application-html.js';
+
+test('the standalone document expands every component once and preserves unique element ids', () => {
+  const source = readFileSync(new URL('../../index.html', import.meta.url), 'utf8');
+  const html = expandApplicationHtml(source);
+  assert.equal([...source.matchAll(/gev:template /g)].length, APPLICATION_TEMPLATES.length);
+  assert.doesNotMatch(html, /gev:template/);
+  const ids = [...html.matchAll(/\sid="([^"]+)"/g)].map(match => match[1]);
+  assert.equal(new Set(ids).size, ids.length);
+  assert.match(html, /id="cesiumContainer"/);
+  assert.match(html, /type="module" src="\/src\/main.js"/);
+});
+
+test('component selection includes only requested markup and refuses filesystem traversal', () => {
+  const html = expandApplicationHtml('<!-- gev:template welcome -->\n');
+  assert.match(html, /id="first-run-launcher"/);
+  assert.doesNotMatch(html, /id="cesiumContainer"/);
+  assert.throws(() => expandApplicationHtml('<!-- gev:template ../../.env -->'), /Unknown application template/);
+});

src/tooling/viteBuild.test.mjs

@@ -12,7 +12,7 @@ test('explicit build inputs preserve browser-only defines, plugin order and loop
     googleApiKey: 'browser-fixture',
     cesiumToken: 'ion-fixture',
   });
-  assert.equal(config.plugins[1], plugin);
+  assert.equal(config.plugins[2], plugin);
   assert.equal(config.server.host, 'localhost');
   assert.equal(config.server.port, 4173);
   assert.deepEqual(config.server.allowedHosts, [
@@ -51,7 +51,7 @@ test('build helper does not discover environment values or construct local provi
       config.define['import.meta.env.GOOGLE_MAPS_API_KEY'],
       undefined,
     );
-    assert.equal(config.plugins.length, 1);
+    assert.equal(config.plugins.length, 2);
   } finally {
     if (before === undefined) delete process.env.GOOGLE_MAPS_API_KEY;
     else process.env.GOOGLE_MAPS_API_KEY = before;
@@ -63,7 +63,7 @@ test('root config retains existing named exports and standalone provider order',
     assert.equal(compatibility[name], value, name);
   const config = standaloneConfig({ mode: 'test' });
   assert.deepEqual(
-    config.plugins.slice(1, -1).map((plugin) => plugin.name),
+    config.plugins.slice(2, -1).map((plugin) => plugin.name),
     providers.localProviderPlugins().map((plugin) => plugin.name),
   );
   assert.equal(config.plugins.at(-2).name, 'gev-key-setup');