fix(web-full): generate and validate packaged asset manifest

[wybaby168]

Summary

Fresh Web Full builds can copy complete runtime assets yet omit flyfish-viewer-assets.json, so the packed standalone copy CLI fails with ENOENT. Validate the final sanitized asset tree and generate a fresh portable manifest before writing its package descriptor. Missing sources and required assets now fail the build, including when stale dist files exist.

This is a three-file packaging repair based on current main eb842206323f19793ce71836c116d54f461f849e, after #343 was merged. It adds five regression controls and runs them after the existing Public CI build. Workflow triggers and runtime-selection conditions are preserved. It neither incorporates nor replaces the separate dependency and consumer-fixture changes in #339/#342.

Related issue

N/A: packaging regression found during independent packed-consumer verification; no separate issue closure.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Fresh current-main source verification in an independent Linux cloud, Node 24.20.0, with NODE_PATH/NODE_OPTIONS cleared:

• node --test packages/components/web-full/test/asset-manifest.test.mjs — Passed: all five controls. All five fail on unchanged current-main code. The web Node helper and current core asset declarations were freshly compiled from blob-verified current-main source.
• node --check packages/components/web-full/scripts/build-iife.mjs and the new test — Passed.
• prettier --config .github/prettier-governance.json --check .github/workflows/public-ci.yml — Passed.

The focused test stubs Vite only; actual copy, sanitization, PPT integrity and asset-manifest implementations execute. It covers manifest-free bootstrap, stale metadata, missing PDF worker, stale dist WASM, and absent asset sources, plus unchanged source/binary bytes.

Earlier independent full-package evidence for the same build-script fix: real main/AMD and 22 renderer bundles; the existing sanitizer; a real 2,961-file archive; all 27 renderer groups copied outside the workspace with all 2,916 payload hashes matching; missing packed PDF worker fails atomically without changing the target. That archive uses an earlier dependency graph and is historical packaging evidence, not a current-main release candidate.

Current head d37b9054776751ef2085271d175fd85557ce36db passed full Public CI, Security, CodeQL, and PR governance. Public CI completed 51 successful steps; only failure-evidence upload was skipped. The actual full build, five-case manifest gate, type checks, issue regressions, documentation, native browsers, RequireJS, Vite Worker paths and packed Vue/React/Angular consumer checks all ran. The hosted synthetic merge commit has exactly the published head's verified tree. No npm release or merge occurred.

The hosted DOCX gate reports @file-viewer/docx@0.3.33, diagonalCount: 1, nativeHeaderFooter: true, nativeHyperlinkPolicy: true and passed: true. This exercises current main's inherited patched 0.3.33 runtime, not the separately prepared native 0.3.34 package, and does not complete the no-patch migration.

Security's workspace audit reports one low advisory ignored by the existing policy. The fresh packed-consumer installs separately report 42 affected entries for Vue/React (7 low, 16 moderate, 19 high) and 4 for Angular (2 high, 2 critical). These are installed-package audit counts, not independent exploit counts or production-only results. Passing functional checks is not a vulnerability-free consumer graph; the separate #339/#342 repairs are not included in this branch.

Sample / fixture evidence

N/A: no parser/rendering behavior changes. The new regression generates license-safe local runtime fixtures in temporary directories; existing public runtime fixtures are used by hosted checks.

Visual evidence

N/A: build-time asset metadata and failure behavior only; existing hosted browser gates remain required.

Risk and compatibility

• Affected packages/formats: @file-viewer/web-full packaging and its public asset manifest, plus the focused Public CI step.
• Compatibility or migration risk: incomplete asset sources now correctly fail packaging. Existing public manifest schema and sanitizer are reused. Current main's inherited DOCX 0.3.33 patch is outside this narrow change and still needs replacement by a formal upstream package; this PR does not claim to complete that migration. Functional CI success also does not establish a vulnerability-free downstream consumer graph; fix(deps): use Vitest 5 consistently in the workspace #339/fix(test): patch isolated consumer security fixtures #342 and their documented security boundaries remain separate.
• Rollback: revert this single packaging commit. No dependency versions, compatibility floors, sanitization policy, generated assets or release artifacts change.

Checklist

• I added focused automated coverage and verified failures before the fix.
• User-facing documentation/release notes are not applicable to this internal packaging correction; the existing manifest contract is preserved.
• I verified offline/private-deployment asset metadata and fail-closed copying with the scope and current-head limitations above.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.