build: assert DEBUG is off in every emitted bundle (closes #170)

PR #169 made DEBUG a build-time flag defaulting off, but nothing guarded
the wiring. The tests load src/shared/constants.js outside a bundle and
take the jest fallback branch, so deleting the __BUILD_DEBUG__ define
from build.js left all tests passing and make check green while silently
restoring the drainable-wallet vulnerability in every shipped artifact.
The property only exists in the emitted output, so it is now asserted
against the emitted output.

script/verify-build reads two independent facts per bundle. Which
bundles must be inspected comes from esbuild's metafile: build.js writes
dist/constants-bundles.txt naming every emitted JS output whose input
set includes constants.js, so the set is derived from the real
dependency graph rather than a hardcoded count or filenames. What each
bundle's DEBUG state is comes from BUILD_DEBUG_MARKER, a new constant
derived from DEBUG itself that the bundler folds to exactly one of two
string literals. Deriving the bundle set from the marker would be the
silent-pass hole: a bundle with no marker would be indistinguishable
from content/index.js, which legitimately contains none.

The marker is a plain string rather than a match on minified `DEBUG:!1`,
because minifier output is not a contract across esbuild versions. When
DEBUG is not known at build time the fold cannot happen and both
literals survive, which is exactly the shape of the regression this
guards against. Every way of failing to determine a bundle's state is a
hard failure: missing manifest, empty manifest, a listed file that does
not exist, both markers, neither marker, the wrong marker, or a bundle
carrying a marker while absent from the manifest. There is no path on
which the script exits 0 without positively identifying the expected
marker in at least one bundle.

It runs on the build path only. make build and make build-debug both
invoke it, the latter asserting the inverse, and Dockerfile:17 runs a
bare make build, so CI fails on a release build with a live debug
branch. It is deliberately not in script/check: that would make check
depend on dist/ existing and pull a full build into its time budget, and
the obvious workaround -- skip when dist/ is absent -- is precisely the
silently-green behaviour this exists to prevent.

build.js

@@ -3,14 +3,43 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
 
-const DIST_CHROME = path.join(__dirname, "dist", "chrome");
-const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
+const DIST = path.join(__dirname, "dist");
+const DIST_CHROME = path.join(DIST, "chrome");
+const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 
+// The module whose compiled DEBUG state script/verify-build asserts, and the
+// manifest naming every emitted bundle that ends up containing it. The
+// manifest is derived from esbuild's own dependency graph rather than from a
+// hardcoded list, so it tracks the bundle layout instead of rotting with it.
+const AUDITED_MODULE = "src/shared/constants.js";
+const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
+
 function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
 }
 
+// Repo-relative, forward-slashed, so the manifest reads the same on every
+// platform and can be consumed by a POSIX shell script without further work.
+function repoRelative(p) {
+    return path.relative(__dirname, p).split(path.sep).join("/");
+}
+
+// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
+// reports every input that contributed to an output in the metafile, which is
+// the authoritative answer to "is constants.js in this bundle" — unlike
+// searching the minified text, it does not depend on what survived minification.
+function outputsContainingAuditedModule(metafile) {
+    return Object.entries(metafile.outputs)
+        .filter(([outFile, info]) => {
+            if (!outFile.endsWith(".js")) return false;
+            return Object.keys(info.inputs).some(
+                (input) => repoRelative(input) === AUDITED_MODULE,
+            );
+        })
+        .map(([outFile]) => repoRelative(outFile));
+}
+
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
@@ -72,68 +101,70 @@ async function build() {
         __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
     };
 
+    // Emitted bundles that contain constants.js, accumulated across every
+    // esbuild run below and written out for script/verify-build.
+    const auditedBundles = [];
+
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
-    ensureDir(path.join(__dirname, "dist"));
+    const tailwindOutput = path.join(DIST, "styles.css");
+    ensureDir(DIST);
+
+    // Drop any manifest from a previous build before emitting anything, so a
+    // build that never gets around to writing one cannot be verified against
+    // a stale list.
+    fs.rmSync(BUNDLE_MANIFEST, { force: true });
     execSync(
         `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
         { stdio: "inherit" },
     );
 
+    // Every bundle goes through here, so metafile collection cannot be
+    // forgotten when a new entry point is added.
+    async function bundle(entryPoint, outfile) {
+        const result = await esbuild.build({
+            entryPoints: [entryPoint],
+            bundle: true,
+            format: "iife",
+            outfile,
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            metafile: true,
+            define,
+        });
+        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
+    }
+
     for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
         ensureDir(path.join(distDir, "src", "popup"));
         ensureDir(path.join(distDir, "src", "background"));
         ensureDir(path.join(distDir, "src", "content"));
 
         // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "popup", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "popup", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "popup", "index.js"),
+            path.join(distDir, "src", "popup", "index.js"),
+        );
 
         // bundle background script
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "background", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "background", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "background", "index.js"),
+            path.join(distDir, "src", "background", "index.js"),
+        );
 
         // bundle content script
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "content", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "content", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "content", "index.js"),
+            path.join(distDir, "src", "content", "index.js"),
+        );
 
         // bundle inpage script (injected into page context, separate file)
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "content", "inpage.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "content", "inpage.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "content", "inpage.js"),
+            path.join(distDir, "src", "content", "inpage.js"),
+        );
 
         // copy popup HTML
         fs.copyFileSync(
@@ -158,6 +189,16 @@ async function build() {
         path.join(DIST_FIREFOX, "manifest.json"),
     );
 
+    // Written last so a build that died partway through leaves no manifest
+    // at all, which script/verify-build treats as a hard failure rather than
+    // as "nothing to check".
+    const manifest = [...new Set(auditedBundles)].sort();
+    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
+    console.log(
+        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
+            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
+    );
+
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }