@celilo/e2e 0.20.0 → 0.20.2

package/src/netapp-staleness.test.ts

@@ -0,0 +1,139 @@
+import { afterAll, beforeAll, expect, test } from 'bun:test';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { isNetappCurrent } from './netapp-staleness';
+
+let dir: string;
+let src: string;
+let netapp: string;
+const scratch: string[] = [];
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'netapp-stale-'));
+  scratch.push(dir);
+  src = join(dir, 'src');
+  netapp = join(dir, 'out.netapp');
+  mkdirSync(src);
+});
+
+afterAll(() => {
+  for (const path of scratch) rmSync(path, { recursive: true, force: true });
+});
+
+function writeSource(name: string, contents: string): string {
+  const target = join(src, name);
+  writeFileSync(target, contents);
+  return target;
+}
+
+test('no netapp yet: not current, even over an empty tree', () => {
+  expect(existsSync(netapp)).toBe(false);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('netapp newer than every source file: current (the skip case)', () => {
+  writeSource('main.sh', 'echo hello');
+  writeFileSync(netapp, 'netapp-bytes');
+  // The netapp was written after the source, so repackaging would produce
+  // the same bytes. build-infra must skip this module.
+  expect(isNetappCurrent(netapp, dir)).toBe(true);
+});
+
+test('recurrence gate (celilo#1258): touching a source file makes the netapp stale', () => {
+  // Touch, don't rewrite: proves the check reads mtimes, not contents.
+  const touched = writeSource('touched.txt', 'x');
+  const later = new Date(Date.now() + 60_000);
+  utimesSync(touched, later, later);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('netapp older than a source edit: stale', () => {
+  const older = new Date(Date.now() - 120_000);
+  utimesSync(netapp, older, older);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('a rebuilt binlink dir never marks the netapp stale (the bun install shape)', () => {
+  // Fresh tree: shared state above would leak src/'s own dir mtime into this
+  // assertion, and src/ is a shipped path whose mtime must count.
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-binlinks-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  const binDir = join(moduleDir, 'e2e', 'node_modules', '.bin');
+  mkdirSync(binDir, { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  symlinkSync('../real-tool', join(binDir, 'tool'));
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  // bun install recreates the binlink: the symlink file AND the .bin
+  // directory move past the netapp. Neither ships (see classifyModulePath
+  // and includeNodeModulesPath), so the netapp stays current. This is the
+  // dir-level case the file-level exclusion alone misses, probed 2026-09-08:
+  // `-not -path '*/node_modules/.bin/*'` does not match `.bin` itself, and
+  // creating an entry moves the dir's mtime.
+  rmSync(join(binDir, 'tool'));
+  symlinkSync('../real-tool', join(binDir, 'tool'));
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+});
+
+test('a change confined to the module e2e/ tree never marks the netapp stale', () => {
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-e2e-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  mkdirSync(join(moduleDir, 'e2e'), { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  writeFileSync(join(moduleDir, 'e2e', 'suite.test.ts'), 'test("x", () => {});');
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  // An e2e-only edit: the file and its parent dir are both unshipped, so
+  // the netapp stays current. A change to main.sh would NOT be excluded —
+  // covered by the recurrence gate above.
+  const later = new Date(Date.now() + 60_000);
+  const e2eFile = join(moduleDir, 'e2e', 'new.test.ts');
+  writeFileSync(e2eFile, 'test("y", () => {});');
+  utimesSync(e2eFile, later, later);
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+});
+
+test('a change to a SHIPPED bin-closure path marks the netapp stale', () => {
+  // scripts/node_modules minus .bin is the hook runtime closure the packager
+  // ships in full (ISS-0046). A change there must repackage, so the
+  // exclusion cannot be as broad as "anything under node_modules".
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-hookrt-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  const hookDep = join(moduleDir, 'scripts', 'node_modules', 'tldts');
+  mkdirSync(hookDep, { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  writeFileSync(join(hookDep, 'index.js'), 'module.exports = {};');
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  const later = new Date(Date.now() + 60_000);
+  const depFile = join(hookDep, 'index.js');
+  writeFileSync(depFile, 'module.exports = { changed: true };');
+  utimesSync(depFile, later, later);
+  expect(isNetappCurrent(staged, moduleDir)).toBe(false);
+});
+
+test('a nonexistent source tree repackages (a check that cannot answer never reuses)', () => {
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-missing-'));
+  scratch.push(tree);
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, join(tree, 'does-not-exist'))).toBe(false);
+});

package/src/netapp-staleness.ts

@@ -0,0 +1,62 @@
+/**
+ * Staleness helper for build-infra's `packageNetapp` (cli/build.ts).
+ *
+ * Before celilo#1258 build-infra repackaged all 37 modules on every run
+ * (about 5 minutes to reach a 38 second test) because nothing reused a
+ * current .netapp. publishModule's reuse of the staged netapp is a separate
+ * fix that landed from ce-nvd8 (bf05c946) and keeps its own probe.
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+
+/**
+ * True when `netappPath` exists and nothing that ships in the package has
+ * changed under `sourceDir` since it was written.
+ *
+ * `find -newer -quit` asks the filesystem instead of walking in JS and stops
+ * at the first newer file. A staleness check that cannot answer repackages:
+ * reusing on an inconclusive result is how a test silently runs against a
+ * stale module.
+ *
+ * Only paths the package actually contains can make it stale. `e2e/` is
+ * excluded from a module package wholesale and `node_modules/.bin` is excluded
+ * from the hook runtime closure — see `classifyModulePath` and
+ * `includeNodeModulesPath` in apps/celilo/src/module/packaging/, which are the
+ * authority. They are restated rather than imported because packages/e2e has
+ * no import path into apps/celilo, and registry-server's bootstrap.ts already
+ * carries the same duplication for the same reason.
+ *
+ * Both subtrees are excluded at the DIRECTORY level as well as the file
+ * level (path suffixes `e2e` and `node_modules/.bin`, with and without a
+ * trailing component): a directory's mtime moves whenever an entry inside
+ * it is created or replaced, so `bun install` recreating the binlinks in a
+ * module's `e2e/node_modules/.bin` would otherwise mark every module
+ * permanently dirty through the dir entry alone.
+ *
+ * Getting these wrong is safe in one direction only, and it is this one:
+ * counting a non-packaged path makes us repackage needlessly (slow), while
+ * MISSING a packaged path would reuse a stale netapp (wrong). Every exclusion
+ * here is a path the packager does not ship, so it cannot cause the latter.
+ */
+export function isNetappCurrent(netappPath: string, sourceDir: string): boolean {
+  if (!existsSync(netappPath)) return false;
+  // Each exclude needs both the bare dir and its contents: `find -newer`
+  // matches the directory's own mtime too, and creating or replacing an
+  // entry inside moves it.
+  const excludes = [
+    "-not -path '*/e2e'",
+    "-not -path '*/e2e/*'",
+    "-not -path '*/node_modules/.bin'",
+    "-not -path '*/node_modules/.bin/*'",
+  ];
+  try {
+    const newer = execSync(
+      `find ${JSON.stringify(sourceDir)} -newer ${JSON.stringify(netappPath)} ${excludes.join(' ')} -print -quit`,
+      { encoding: 'utf-8', timeout: 30_000 },
+    ).trim();
+    return newer === '';
+  } catch {
+    return false; // a check that cannot answer repackages
+  }
+}

package/src/network-builder.ts

@@ -38,6 +38,10 @@ async function ensureModuleDeps(hostPath: string): Promise<void> {
 export class NetworkBuilder {
   private config: NetworkConfig = {
     topology: 'default',
+    // The production topology: celilo-mgr sits on its own control-plane
+    // network. A suite that genuinely needs the single-network legacy
+    // topology opts out with `.managementZone('internal')` and says why.
+    managementZone: 'secure-mgmt',
     dmzMachines: [],
     appMachines: [],
     secureMachines: [],
@@ -72,9 +76,11 @@ export class NetworkBuilder {
 
   /**
    * Place the celilo management container in a given zone. Defaults to
-   * `internal`; `secure-mgmt` gives celilo-mgr its own control-plane network
-   * (the production topology), so a test can exercise celilo reaching and
-   * resolving for a fleet from OFF the internal LAN.
+   * `secure-mgmt` (the production topology, celilo-mgr on its own
+   * control-plane network). `internal` opts back into the legacy
+   * single-network topology, where "trusted subnet == network.internal.subnet"
+   * comes out true by construction — only for a suite that genuinely tests a
+   * behaviour on that topology, and says so.
    */
   managementZone(zone: 'internal' | 'secure-mgmt'): this {
     this.config.managementZone = zone;
@@ -278,6 +284,16 @@ export class NetworkBuilder {
     return this;
   }
 
+  /**
+   * The config this builder will hand to `startNetwork`, read back for tests
+   * that assert on the DEFAULTS rather than construct a literal. Without this
+   * a default is invisible to every gate (the literal-shaped configs in the
+   * unit tests never exercise it).
+   */
+  snapshotConfig(): Readonly<NetworkConfig> {
+    return { ...this.config };
+  }
+
   async start(): Promise<NetworkHandle> {
     // Pre-flight: ensure mounted module directories have deps installed.
     // Without this, `module import` tries to `bun install` inside Docker

package/src/registry-bundle.ts

@@ -28,7 +28,16 @@
  */
 
 import { cpSync, existsSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
+
+// @psbanka - 2026-09: Test files are excluded from the bundle (ce-62u1). A
+// bundled test copy is one directory deeper than its source, so
+// workspace-relative imports like '../../../apps/...' resolve one level short
+// and fail. The bundle exists to serve the sim image, which runs no tests, so
+// the tests belong to the source package only.
+function isTestFile(path: string): boolean {
+  return /\.test\.tsx?$/.test(basename(path));
+}
 
 /**
  * Ensure <pkgDir>/registry-server/ contains a fresh copy of the
@@ -76,6 +85,9 @@ function ensureSiblingBundle(pkgDir: string, name: string, entries: string[]): v
 
   rmSync(bundle, { recursive: true, force: true });
   for (const entry of entries) {
-    cpSync(join(upstream, entry), join(bundle, entry), { recursive: true });
+    cpSync(join(upstream, entry), join(bundle, entry), {
+      recursive: true,
+      filter: (src) => !isTestFile(src),
+    });
   }
 }

package/src/runner-keep.test.ts

@@ -0,0 +1,72 @@
+/**
+ * Gate on the wiring of the --keep exit path (celilo#1313).
+ *
+ * `cele2e run <suite> --keep` kept the per-test project but tore the SHARED
+ * infrastructure down anyway, so the kept stack had no DNS, no CA and no
+ * registry — half a system, in the one mode the debugging method prescribes.
+ * The mechanism was a wiring bug: the end-of-run `stopSharedInfra()` call
+ * carried no flagKeep guard, while the per-test path right above it was
+ * guarded. Like the sibling exit-cleanup gate, the unit gate is on the wiring;
+ * the behavioral proof (one cheap suite run with --keep, shared containers
+ * inspected afterwards) is an e2e run and needs the rig.
+ *
+ * Read the source instead of importing the runner: main() runs at import time
+ * (module top-level), so importing it would execute a docker run.
+ */
+
+import { expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC = readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'runner.ts'), 'utf-8');
+
+/** The end-of-run block, from the results summary to the last-run write. */
+function endOfRunBlock(): string {
+  return SRC.slice(SRC.indexOf('saveTiming(history);\n  saveBlockTiming(blockTiming);'));
+}
+
+test('end-of-run stopSharedInfra is guarded by flagKeep (celilo#1313)', () => {
+  // Today the call ran unconditionally, so a --keep run destroyed exactly the
+  // shared infra the kept stack depends on.
+  const block = endOfRunBlock();
+  const guardAt = block.indexOf('if (flagKeep)');
+  const stopAt = block.indexOf('stopSharedInfra()');
+  expect(guardAt).toBeGreaterThan(-1);
+  expect(stopAt).toBeGreaterThan(-1);
+  // The unconditional call sat BEFORE any guard; after the fix the guard
+  // precedes it, so the call is inside the flagKeep branch.
+  expect(guardAt).toBeLessThan(stopAt);
+});
+
+test('a --keep exit names what was kept, not just what stopped (celilo#1313)', () => {
+  // "Stopping shared infrastructure..." printed while the user had asked to
+  // keep things, and nothing said DNS and certs would be missing. The kept
+  // path must name the shared pieces (DNS, CA, registry) and the one teardown
+  // command that reaps them.
+  const block = endOfRunBlock();
+  const keepPath = block.slice(block.indexOf('if (flagKeep)'), block.indexOf('stopSharedInfra()'));
+  expect(keepPath).toContain('DNS');
+  expect(keepPath).toContain('cele2e down');
+});
+
+test('the kept lock marks under --keep even when no project was captured', () => {
+  // With shared infra left up, a --keep run that failed to capture a project
+  // (startNetwork failure) still leaves a live stack. The kept lock is the
+  // instrument that says so: the next run's live-stack guard reads the same
+  // state, but the refusal reads as contention rather than a deliberate kept
+  // stack unless the lock marks. Idempotent with the per-test markKept().
+  const block = endOfRunBlock();
+  const keepPath = block.slice(block.indexOf('if (flagKeep)'), block.indexOf('} else'));
+  expect(keepPath).toContain('markKept()');
+});
+
+test('SIGINT still stops shared infra unconditionally (abort is not a kept stack)', () => {
+  // Pinned as intended behavior: Ctrl-C is an abort, the persistent project
+  // was never written and no kept lock was marked, so tearing the shared
+  // pieces down is right. The next run's live-stack guard names the remedy
+  // for anything the abort left live.
+  const sigint = SRC.slice(SRC.indexOf("process.on('SIGINT'"), SRC.indexOf('for (let i = 0;'));
+  expect(sigint).toContain('stopSharedInfra()');
+  expect(sigint).not.toContain('flagKeep');
+});

package/src/runner.ts

@@ -1080,8 +1080,25 @@ async function main() {
   saveTiming(history);
   saveBlockTiming(blockTiming);
 
-  console.log(`${dim}Stopping shared infrastructure...${reset}`);
-  stopSharedInfra();
+  // A --keep run keeps the WHOLE stack: the per-test project (persistent file
+  // written in the loop) and the shared infra here. Tearing the shared pieces
+  // down under --keep gave a kept stack with no name resolution and no certs
+  // (celilo#1313) — half a system, in the mode the debugging method
+  // prescribes. The exit stays one command: `cele2e down` sweeps every
+  // celilo-e2e-* container, network and volume by name filter (bin/e2e-down)
+  // and releases the kept lock, so the kept shared infra costs nothing extra
+  // to reap. markKept() here too: with shared infra left up, a run that
+  // captured no project still leaves a live stack, and an unmarked lock makes
+  // the next run's live-stack refusal read as contention instead of a
+  // deliberate kept stack. Idempotent with the per-test markKept().
+  if (flagKeep) {
+    markKept();
+    console.log(`${dim}Keeping shared infrastructure (DNS, CA, registry) for debugging.${reset}`);
+    console.log(`${dim}  Tear down everything (project + shared infra): cele2e down${reset}`);
+  } else {
+    console.log(`${dim}Stopping shared infrastructure...${reset}`);
+    stopSharedInfra();
+  }
 
   const suiteDuration = Math.floor((Date.now() - suiteStart) / 1000);
 

package/src/shared-infra.ts

@@ -22,8 +22,10 @@ import {
 import {
   type DockerReader,
   LiveStackError,
+  type ProcessProbe,
   findLiveE2eStack,
   realDocker,
+  realProcessProbe,
   refuseOnLiveStack,
 } from './live-stack';
 import { ensureRegistryServerBundle, ensureTerraformFakeBundle } from './registry-bundle';
@@ -101,8 +103,9 @@ export function startupCleanup(
   e2eDir: string,
   docker: DockerReader = realDocker,
   lock: () => LockStatus = lockStatus,
+  processes: ProcessProbe = realProcessProbe,
 ): void {
-  const refusal = findLiveE2eStack(docker, lock);
+  const refusal = findLiveE2eStack(docker, lock, processes);
   if (refusal) throw new LiveStackError(refusal);
   console.log(
     '[progress:start] cleaning up stale shared infrastructure | shared infra cleanup complete',
@@ -173,7 +176,9 @@ export async function ensureSharedInfra(): Promise<void> {
       // DNS check failed — restart shared infra. The restart tears down the
       // running stack, so the live-stack guard fires first (celilo#1297): a
       // stack that is up is never force-removed, even when its DNS is wedged.
-      // The operator clears it with `cele2e down` and re-runs. This retires
+      // The operator clears it with the docker removal named in the refusal
+      // (a bare `cele2e down` does not exist on ephemeral CI hosts —
+      // celilo#1314) and re-runs. This retires
       // the automatic DNS-restart self-heal by decision (peba, 2026-09-07):
       // fail loudly naming the holder beats silently clobbering a stack that
       // might be another session's — the #1297 incident rode exactly this

package/src/source-fingerprint.ts

@@ -50,6 +50,17 @@ export const SOURCE_LABEL = 'computer.celilo.e2e.source';
  */
 export const PUBLISHED_FINGERPRINT_PREFIX = 'published:';
 
+/**
+ * Value stamped by a CONSUMER-mode bake: `cele2e build-infra` run from an
+ * installed `@celilo/e2e` with no monorepo checkout. The CLI comes from the sim
+ * registry's freshly staged tarballs, so it is neither real npm nor this tree,
+ * and no tree fingerprint exists to record. The version is the honest
+ * attribution. Deliberately NOT the published prefix: that one tells the
+ * freshness check there is nothing to be stale against, which would suppress a
+ * real warning if such an image were later inspected from a checkout.
+ */
+export const CONSUMER_FINGERPRINT_PREFIX = 'consumer:';
+
 /**
  * Repo-relative paths whose content reaches the baked CLI.
  *

package/src/types.ts

@@ -120,14 +120,16 @@ export interface NetworkConfig {
    */
   signalRelease: boolean;
   /**
-   * Which zone the celilo management container sits in. Defaults to `internal`
-   * — the single-network topology every existing test uses.
+   * Which zone the celilo management container sits in. Defaults to
+   * `secure-mgmt` — the production topology, celilo-mgr on its own
+   * control-plane network. (It used to default to `internal`, the
+   * single-network topology, and that default is why the control-plane-network
+   * bug reached production: with management always on `internal`, the hardcoded
+   * "trusted subnet == network.internal.subnet" assumption was accidentally
+   * true in every test.)
    *
-   * `secure-mgmt` places celilo-mgr on its OWN control-plane network, which is
-   * the production topology and the one the suite could not express before. That
-   * gap is why the control-plane-network bug reached production: with management
-   * always on `internal`, the hardcoded "trusted subnet == network.internal.subnet"
-   * assumption was accidentally true in every test.
+   * A suite that genuinely needs the legacy single-network topology sets
+   * `internal` EXPLICITLY and says why in a comment.
    */
   managementZone?: 'internal' | 'secure-mgmt';
   /**
@@ -290,6 +292,18 @@ export interface NetworkHandle {
    */
   moduleHost(moduleId: string): Promise<ModuleHost>;
 
+  /**
+   * The IPv4 address a module's deploy recorded, from `celilo module where
+   * --json` (the `module_systems` inventory).
+   *
+   * Replaces `grep target_ip` over the module's `generated/` tree, which D4
+   * of control-plane-stops-building-modules deletes after every successful
+   * deploy (celilo#1334). The inventory is the deploy's own durable record of
+   * the address, so this works on the machine pool and the container service
+   * alike. Throws when the deploy recorded nothing.
+   */
+  targetIp(moduleId: string): Promise<string>;
+
   /**
    * Tell celilo where its own control plane lives, and wait until the box is
    * usable again.

package/registry-server/src/auth.test.ts

@@ -1,76 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { ADMIN_SCOPE, TokenAuth, hashToken } from './auth';
-
-describe('TokenAuth (package-scoped — ISS-0140)', () => {
-  test('empty specs → no tokens; nothing authorizes', () => {
-    const auth = new TokenAuth([]);
-    expect(auth.hasTokens()).toBe(false);
-    expect(auth.authorize('anything', 'caddy')).toBe(false);
-    expect(auth.isAdmin('anything')).toBe(false);
-  });
-
-  test('admin-scoped token publishes ANY package', () => {
-    const auth = new TokenAuth([{ token: 'admin-tok', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('admin-tok', 'caddy')).toBe(true);
-    expect(auth.authorize('admin-tok', 'lunacycle')).toBe(true);
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-  });
-
-  test('package-scoped token publishes ONLY its package', () => {
-    const auth = new TokenAuth([{ token: 'luna-tok', scope: 'lunacycle' }]);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    // A scoped token is NOT an admin token — it cannot mint.
-    expect(auth.isAdmin('luna-tok')).toBe(false);
-  });
-
-  test('unknown token never authorizes', () => {
-    const auth = new TokenAuth([{ token: 'known', scope: 'lunacycle' }]);
-    expect(auth.authorize('unknown', 'lunacycle')).toBe(false);
-  });
-
-  test('tokens are stored hashed, not in cleartext', () => {
-    const auth = new TokenAuth([{ token: 'secret-token', scope: ADMIN_SCOPE }]);
-    expect(JSON.stringify(auth)).not.toContain('secret-token');
-  });
-
-  test('tolerates a Bearer prefix and surrounding whitespace', () => {
-    const auth = new TokenAuth([{ token: 'clean', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('  clean  ', 'caddy')).toBe(true);
-    expect(auth.authorize('Bearer clean', 'caddy')).toBe(true);
-  });
-
-  test('empty header rejected', () => {
-    const auth = new TokenAuth([{ token: 'secret', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('', 'caddy')).toBe(false);
-    expect(auth.scopeOf('')).toBe(null);
-  });
-
-  test('addHashed / removeHashed manage minted tokens at runtime', () => {
-    const auth = new TokenAuth([]);
-    const hash = hashToken('minted-tok');
-    auth.addHashed(hash, 'lunacycle');
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(true);
-    auth.removeHashed(hash);
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(false);
-  });
-});
-
-describe('TokenAuth.fromEnv (PUBLISH_TOKENS format)', () => {
-  test('bare line → admin scope; "token pkg" line → scoped', () => {
-    process.env.PUBLISH_TOKENS = 'admin-tok\nluna-tok lunacycle\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    process.env.PUBLISH_TOKENS = '';
-  });
-
-  test('blank lines ignored', () => {
-    process.env.PUBLISH_TOKENS = '\n  \nt1\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.hasTokens()).toBe(true);
-    expect(auth.isAdmin('t1')).toBe(true);
-    process.env.PUBLISH_TOKENS = '';
-  });
-});

package/registry-server/src/bootstrap-packaging.test.ts

@@ -1,71 +0,0 @@
-/**
- * Lockstep gate (ISS-0046): the registry-server's on-demand `walkDir` packager
- * can't import the canonical node_modules-bundling rule at runtime (this server
- * ships standalone, with no @celilo deps), so it carries a structural copy.
- * This test imports the canonical rule directly (zero-dependency module, safe to
- * pull in at test time from the workspace) and asserts walkDir's actual output
- * conforms to it — so a drift in either copy fails here instead of shipping a
- * broken `.netapp`.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-// Canonical rule lives in apps/celilo; importing it cross-package is fine in a
-// workspace test (it's not bundled into the standalone registry-sim image).
-import { includeNodeModulesPath } from '../../../apps/celilo/src/module/packaging/package-rules';
-import { walkDir } from './bootstrap';
-
-describe('bootstrap walkDir stays in lockstep with the canonical packaging rule', () => {
-  let dir: string;
-
-  // Representative node_modules paths spanning both branches of the rule.
-  const nmFiles = [
-    'scripts/node_modules/@celilo/capabilities/src/dns-internal.ts',
-    'scripts/node_modules/tldts/index.js',
-    'scripts/node_modules/drizzle-orm/index.js',
-    'scripts/node_modules/.bin/tldts',
-    'node_modules/@celilo/capabilities/index.js',
-    'node_modules/lodash/index.js',
-    'node_modules/@celilo/e2e/index.js',
-  ];
-
-  function write(rel: string): void {
-    const full = join(dir, rel);
-    mkdirSync(join(full, '..'), { recursive: true });
-    writeFileSync(full, 'x');
-  }
-
-  beforeEach(() => {
-    dir = mkdtempSync(join(tmpdir(), 'celilo-bootstrap-rule-'));
-    write('manifest.yml');
-    write('scripts/on-install.ts');
-    for (const f of nmFiles) write(f);
-  });
-
-  afterEach(() => {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  it("walkDir's node_modules decisions match includeNodeModulesPath", () => {
-    const bundled = new Set(walkDir(dir));
-    for (const rel of nmFiles) {
-      expect(bundled.has(rel)).toBe(includeNodeModulesPath(rel));
-    }
-  });
-
-  it('bundles scripts deps (tldts), drops .bin shims and non-scripts cruft', () => {
-    const bundled = new Set(walkDir(dir));
-    expect(bundled.has('scripts/node_modules/tldts/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/drizzle-orm/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/.bin/tldts')).toBe(false);
-    expect(bundled.has('node_modules/lodash/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/e2e/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/capabilities/index.js')).toBe(true);
-  });
-});