@celilo/e2e 0.20.1 → 0.20.3

package/src/module-host.test.ts

@@ -8,7 +8,7 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import { parseModuleHost } from './module-host';
+import { parseModuleHost, parseModuleWhere } from './module-host';
 
 /** How the CLI really prints it — clack gutter and ANSI included. */
 const withGutter = (line: string) => `\x1b[1mModule: caddy\x1b[0m\n│  Placement:\n│  ${line}\n`;
@@ -69,3 +69,57 @@ describe('parseModuleHost', () => {
     expect(parseModuleHost(output)?.hostname).toBe('web');
   });
 });
+
+describe('parseModuleWhere', () => {
+  test('the inventory payload yields the recorded address', () => {
+    const payload = JSON.stringify({
+      module: 'caddy-internal',
+      systems: [
+        {
+          name: 'main',
+          hostname: 'caddy-internal',
+          ipv4_address: '10.226.30.14',
+          zone: 'dmz',
+          vmid: 2201,
+          infra_type: 'container_service',
+          placement: 'caddy-internal (vmid 2201) → pve1 (zone dmz)',
+          reachability: "firewall-segmented (dmz) — reach via the firewall's natIp DNAT",
+        },
+      ],
+    });
+
+    expect(parseModuleWhere(payload)).toEqual(['10.226.30.14']);
+  });
+
+  test('ANSI and whitespace around the payload do not break it', () => {
+    // The success path prints verbatim (celilo#698), but dev-mode shims have
+    // surprised us before, so the parse tolerates decoration.
+    const payload = `\x1b[1m${JSON.stringify({ systems: [{ ipv4_address: '10.226.30.15' }] })}\x1b[0m\n`;
+
+    expect(parseModuleWhere(payload)).toEqual(['10.226.30.15']);
+  });
+
+  test('a module with several systems yields them all, caller picks', () => {
+    const payload = JSON.stringify({
+      systems: [
+        { name: 'main', ipv4_address: '10.226.20.9' },
+        { name: 'replica', ipv4_address: '10.226.20.10' },
+      ],
+    });
+
+    expect(parseModuleWhere(payload)).toEqual(['10.226.20.9', '10.226.20.10']);
+  });
+
+  test('an API-only module yields an empty list, a real state', () => {
+    // namecheap has no host. Empty is not a parse failure — the caller decides
+    // whether "no recorded address" is expected for their module.
+    expect(parseModuleWhere(JSON.stringify({ systems: [] }))).toEqual([]);
+  });
+
+  test('a non-JSON answer yields an empty list, not a throw', () => {
+    // Crash text on stdout is a CLI failure and the harness method attaches
+    // the raw output to its error; the parser's contract is "addresses found",
+    // not "reasons why not".
+    expect(parseModuleWhere('Error: module not found: caddy\n')).toEqual([]);
+  });
+});

package/src/module-host.ts

@@ -70,3 +70,34 @@ export function parseModuleHost(statusOutput: string): ModuleHost | null {
 
   return null;
 }
+
+/**
+ * The address(es) a module's deploy recorded, from `celilo module where --json`.
+ *
+ * The old source was `grep target_ip` over the module's `generated/` tree
+ * (celilo#1334). D4 of control-plane-stops-building-modules makes that tree
+ * ephemeral — a successful deploy deletes it — so the inventory is where the
+ * address lives now: `module_systems` is written by the deploy itself and
+ * survives it. Every current module declares exactly one system, so callers
+ * take the first address; a module with none is an API-only module or an
+ * undeployed one, and that distinction belongs to the caller.
+ */
+export function parseModuleWhere(whereOutput: string): string[] {
+  // The success path prints the payload verbatim (celilo#698), but defensive
+  // ANSI stripping costs one line and dev-mode shims have surprised us before.
+  const stripped = whereOutput.replace(/\x1b\[[0-9;]*m/g, '').trim();
+
+  let parsed: { systems?: { ipv4_address?: string }[] };
+  try {
+    parsed = JSON.parse(stripped) as { systems?: { ipv4_address?: string }[] };
+  } catch {
+    // A non-JSON answer is a CLI failure (version drift, crash text) arriving
+    // on stdout. An empty list reads as "no systems", which is a real state a
+    // caller may legitimately handle — these are not the same problem.
+    return [];
+  }
+
+  return (parsed.systems ?? [])
+    .map((system) => system.ipv4_address ?? '')
+    .filter((address) => address !== '');
+}

package/src/netapp-staleness.test.ts

@@ -0,0 +1,139 @@
+import { afterAll, beforeAll, expect, test } from 'bun:test';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { isNetappCurrent } from './netapp-staleness';
+
+let dir: string;
+let src: string;
+let netapp: string;
+const scratch: string[] = [];
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'netapp-stale-'));
+  scratch.push(dir);
+  src = join(dir, 'src');
+  netapp = join(dir, 'out.netapp');
+  mkdirSync(src);
+});
+
+afterAll(() => {
+  for (const path of scratch) rmSync(path, { recursive: true, force: true });
+});
+
+function writeSource(name: string, contents: string): string {
+  const target = join(src, name);
+  writeFileSync(target, contents);
+  return target;
+}
+
+test('no netapp yet: not current, even over an empty tree', () => {
+  expect(existsSync(netapp)).toBe(false);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('netapp newer than every source file: current (the skip case)', () => {
+  writeSource('main.sh', 'echo hello');
+  writeFileSync(netapp, 'netapp-bytes');
+  // The netapp was written after the source, so repackaging would produce
+  // the same bytes. build-infra must skip this module.
+  expect(isNetappCurrent(netapp, dir)).toBe(true);
+});
+
+test('recurrence gate (celilo#1258): touching a source file makes the netapp stale', () => {
+  // Touch, don't rewrite: proves the check reads mtimes, not contents.
+  const touched = writeSource('touched.txt', 'x');
+  const later = new Date(Date.now() + 60_000);
+  utimesSync(touched, later, later);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('netapp older than a source edit: stale', () => {
+  const older = new Date(Date.now() - 120_000);
+  utimesSync(netapp, older, older);
+  expect(isNetappCurrent(netapp, dir)).toBe(false);
+});
+
+test('a rebuilt binlink dir never marks the netapp stale (the bun install shape)', () => {
+  // Fresh tree: shared state above would leak src/'s own dir mtime into this
+  // assertion, and src/ is a shipped path whose mtime must count.
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-binlinks-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  const binDir = join(moduleDir, 'e2e', 'node_modules', '.bin');
+  mkdirSync(binDir, { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  symlinkSync('../real-tool', join(binDir, 'tool'));
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  // bun install recreates the binlink: the symlink file AND the .bin
+  // directory move past the netapp. Neither ships (see classifyModulePath
+  // and includeNodeModulesPath), so the netapp stays current. This is the
+  // dir-level case the file-level exclusion alone misses, probed 2026-09-08:
+  // `-not -path '*/node_modules/.bin/*'` does not match `.bin` itself, and
+  // creating an entry moves the dir's mtime.
+  rmSync(join(binDir, 'tool'));
+  symlinkSync('../real-tool', join(binDir, 'tool'));
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+});
+
+test('a change confined to the module e2e/ tree never marks the netapp stale', () => {
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-e2e-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  mkdirSync(join(moduleDir, 'e2e'), { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  writeFileSync(join(moduleDir, 'e2e', 'suite.test.ts'), 'test("x", () => {});');
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  // An e2e-only edit: the file and its parent dir are both unshipped, so
+  // the netapp stays current. A change to main.sh would NOT be excluded —
+  // covered by the recurrence gate above.
+  const later = new Date(Date.now() + 60_000);
+  const e2eFile = join(moduleDir, 'e2e', 'new.test.ts');
+  writeFileSync(e2eFile, 'test("y", () => {});');
+  utimesSync(e2eFile, later, later);
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+});
+
+test('a change to a SHIPPED bin-closure path marks the netapp stale', () => {
+  // scripts/node_modules minus .bin is the hook runtime closure the packager
+  // ships in full (ISS-0046). A change there must repackage, so the
+  // exclusion cannot be as broad as "anything under node_modules".
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-hookrt-'));
+  scratch.push(tree);
+  const moduleDir = join(tree, 'mod');
+  const hookDep = join(moduleDir, 'scripts', 'node_modules', 'tldts');
+  mkdirSync(hookDep, { recursive: true });
+  writeFileSync(join(moduleDir, 'main.sh'), 'echo hello');
+  writeFileSync(join(hookDep, 'index.js'), 'module.exports = {};');
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, moduleDir)).toBe(true);
+
+  const later = new Date(Date.now() + 60_000);
+  const depFile = join(hookDep, 'index.js');
+  writeFileSync(depFile, 'module.exports = { changed: true };');
+  utimesSync(depFile, later, later);
+  expect(isNetappCurrent(staged, moduleDir)).toBe(false);
+});
+
+test('a nonexistent source tree repackages (a check that cannot answer never reuses)', () => {
+  const tree = mkdtempSync(join(tmpdir(), 'netapp-missing-'));
+  scratch.push(tree);
+  const staged = join(tree, 'staged.netapp');
+  writeFileSync(staged, 'netapp-bytes');
+  expect(isNetappCurrent(staged, join(tree, 'does-not-exist'))).toBe(false);
+});

package/src/netapp-staleness.ts

@@ -0,0 +1,62 @@
+/**
+ * Staleness helper for build-infra's `packageNetapp` (cli/build.ts).
+ *
+ * Before celilo#1258 build-infra repackaged all 37 modules on every run
+ * (about 5 minutes to reach a 38 second test) because nothing reused a
+ * current .netapp. publishModule's reuse of the staged netapp is a separate
+ * fix that landed from ce-nvd8 (bf05c946) and keeps its own probe.
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+
+/**
+ * True when `netappPath` exists and nothing that ships in the package has
+ * changed under `sourceDir` since it was written.
+ *
+ * `find -newer -quit` asks the filesystem instead of walking in JS and stops
+ * at the first newer file. A staleness check that cannot answer repackages:
+ * reusing on an inconclusive result is how a test silently runs against a
+ * stale module.
+ *
+ * Only paths the package actually contains can make it stale. `e2e/` is
+ * excluded from a module package wholesale and `node_modules/.bin` is excluded
+ * from the hook runtime closure — see `classifyModulePath` and
+ * `includeNodeModulesPath` in apps/celilo/src/module/packaging/, which are the
+ * authority. They are restated rather than imported because packages/e2e has
+ * no import path into apps/celilo, and registry-server's bootstrap.ts already
+ * carries the same duplication for the same reason.
+ *
+ * Both subtrees are excluded at the DIRECTORY level as well as the file
+ * level (path suffixes `e2e` and `node_modules/.bin`, with and without a
+ * trailing component): a directory's mtime moves whenever an entry inside
+ * it is created or replaced, so `bun install` recreating the binlinks in a
+ * module's `e2e/node_modules/.bin` would otherwise mark every module
+ * permanently dirty through the dir entry alone.
+ *
+ * Getting these wrong is safe in one direction only, and it is this one:
+ * counting a non-packaged path makes us repackage needlessly (slow), while
+ * MISSING a packaged path would reuse a stale netapp (wrong). Every exclusion
+ * here is a path the packager does not ship, so it cannot cause the latter.
+ */
+export function isNetappCurrent(netappPath: string, sourceDir: string): boolean {
+  if (!existsSync(netappPath)) return false;
+  // Each exclude needs both the bare dir and its contents: `find -newer`
+  // matches the directory's own mtime too, and creating or replacing an
+  // entry inside moves it.
+  const excludes = [
+    "-not -path '*/e2e'",
+    "-not -path '*/e2e/*'",
+    "-not -path '*/node_modules/.bin'",
+    "-not -path '*/node_modules/.bin/*'",
+  ];
+  try {
+    const newer = execSync(
+      `find ${JSON.stringify(sourceDir)} -newer ${JSON.stringify(netappPath)} ${excludes.join(' ')} -print -quit`,
+      { encoding: 'utf-8', timeout: 30_000 },
+    ).trim();
+    return newer === '';
+  } catch {
+    return false; // a check that cannot answer repackages
+  }
+}

package/src/network-builder.ts

@@ -38,6 +38,10 @@ async function ensureModuleDeps(hostPath: string): Promise<void> {
 export class NetworkBuilder {
   private config: NetworkConfig = {
     topology: 'default',
+    // The production topology: celilo-mgr sits on its own control-plane
+    // network. A suite that genuinely needs the single-network legacy
+    // topology opts out with `.managementZone('internal')` and says why.
+    managementZone: 'secure-mgmt',
     dmzMachines: [],
     appMachines: [],
     secureMachines: [],
@@ -72,9 +76,11 @@ export class NetworkBuilder {
 
   /**
    * Place the celilo management container in a given zone. Defaults to
-   * `internal`; `secure-mgmt` gives celilo-mgr its own control-plane network
-   * (the production topology), so a test can exercise celilo reaching and
-   * resolving for a fleet from OFF the internal LAN.
+   * `secure-mgmt` (the production topology, celilo-mgr on its own
+   * control-plane network). `internal` opts back into the legacy
+   * single-network topology, where "trusted subnet == network.internal.subnet"
+   * comes out true by construction — only for a suite that genuinely tests a
+   * behaviour on that topology, and says so.
    */
   managementZone(zone: 'internal' | 'secure-mgmt'): this {
     this.config.managementZone = zone;
@@ -278,6 +284,16 @@ export class NetworkBuilder {
     return this;
   }
 
+  /**
+   * The config this builder will hand to `startNetwork`, read back for tests
+   * that assert on the DEFAULTS rather than construct a literal. Without this
+   * a default is invisible to every gate (the literal-shaped configs in the
+   * unit tests never exercise it).
+   */
+  snapshotConfig(): Readonly<NetworkConfig> {
+    return { ...this.config };
+  }
+
   async start(): Promise<NetworkHandle> {
     // Pre-flight: ensure mounted module directories have deps installed.
     // Without this, `module import` tries to `bun install` inside Docker

package/src/registry-bundle.ts

@@ -28,7 +28,16 @@
  */
 
 import { cpSync, existsSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
+
+// @psbanka - 2026-09: Test files are excluded from the bundle (ce-62u1). A
+// bundled test copy is one directory deeper than its source, so
+// workspace-relative imports like '../../../apps/...' resolve one level short
+// and fail. The bundle exists to serve the sim image, which runs no tests, so
+// the tests belong to the source package only.
+function isTestFile(path: string): boolean {
+  return /\.test\.tsx?$/.test(basename(path));
+}
 
 /**
  * Ensure <pkgDir>/registry-server/ contains a fresh copy of the
@@ -76,6 +85,9 @@ function ensureSiblingBundle(pkgDir: string, name: string, entries: string[]): v
 
   rmSync(bundle, { recursive: true, force: true });
   for (const entry of entries) {
-    cpSync(join(upstream, entry), join(bundle, entry), { recursive: true });
+    cpSync(join(upstream, entry), join(bundle, entry), {
+      recursive: true,
+      filter: (src) => !isTestFile(src),
+    });
   }
 }

package/src/runner-keep.test.ts

@@ -0,0 +1,72 @@
+/**
+ * Gate on the wiring of the --keep exit path (celilo#1313).
+ *
+ * `cele2e run <suite> --keep` kept the per-test project but tore the SHARED
+ * infrastructure down anyway, so the kept stack had no DNS, no CA and no
+ * registry — half a system, in the one mode the debugging method prescribes.
+ * The mechanism was a wiring bug: the end-of-run `stopSharedInfra()` call
+ * carried no flagKeep guard, while the per-test path right above it was
+ * guarded. Like the sibling exit-cleanup gate, the unit gate is on the wiring;
+ * the behavioral proof (one cheap suite run with --keep, shared containers
+ * inspected afterwards) is an e2e run and needs the rig.
+ *
+ * Read the source instead of importing the runner: main() runs at import time
+ * (module top-level), so importing it would execute a docker run.
+ */
+
+import { expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC = readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'runner.ts'), 'utf-8');
+
+/** The end-of-run block, from the results summary to the last-run write. */
+function endOfRunBlock(): string {
+  return SRC.slice(SRC.indexOf('saveTiming(history);\n  saveBlockTiming(blockTiming);'));
+}
+
+test('end-of-run stopSharedInfra is guarded by flagKeep (celilo#1313)', () => {
+  // Today the call ran unconditionally, so a --keep run destroyed exactly the
+  // shared infra the kept stack depends on.
+  const block = endOfRunBlock();
+  const guardAt = block.indexOf('if (flagKeep)');
+  const stopAt = block.indexOf('stopSharedInfra()');
+  expect(guardAt).toBeGreaterThan(-1);
+  expect(stopAt).toBeGreaterThan(-1);
+  // The unconditional call sat BEFORE any guard; after the fix the guard
+  // precedes it, so the call is inside the flagKeep branch.
+  expect(guardAt).toBeLessThan(stopAt);
+});
+
+test('a --keep exit names what was kept, not just what stopped (celilo#1313)', () => {
+  // "Stopping shared infrastructure..." printed while the user had asked to
+  // keep things, and nothing said DNS and certs would be missing. The kept
+  // path must name the shared pieces (DNS, CA, registry) and the one teardown
+  // command that reaps them.
+  const block = endOfRunBlock();
+  const keepPath = block.slice(block.indexOf('if (flagKeep)'), block.indexOf('stopSharedInfra()'));
+  expect(keepPath).toContain('DNS');
+  expect(keepPath).toContain('cele2e down');
+});
+
+test('the kept lock marks under --keep even when no project was captured', () => {
+  // With shared infra left up, a --keep run that failed to capture a project
+  // (startNetwork failure) still leaves a live stack. The kept lock is the
+  // instrument that says so: the next run's live-stack guard reads the same
+  // state, but the refusal reads as contention rather than a deliberate kept
+  // stack unless the lock marks. Idempotent with the per-test markKept().
+  const block = endOfRunBlock();
+  const keepPath = block.slice(block.indexOf('if (flagKeep)'), block.indexOf('} else'));
+  expect(keepPath).toContain('markKept()');
+});
+
+test('SIGINT still stops shared infra unconditionally (abort is not a kept stack)', () => {
+  // Pinned as intended behavior: Ctrl-C is an abort, the persistent project
+  // was never written and no kept lock was marked, so tearing the shared
+  // pieces down is right. The next run's live-stack guard names the remedy
+  // for anything the abort left live.
+  const sigint = SRC.slice(SRC.indexOf("process.on('SIGINT'"), SRC.indexOf('for (let i = 0;'));
+  expect(sigint).toContain('stopSharedInfra()');
+  expect(sigint).not.toContain('flagKeep');
+});

package/src/runner.ts

@@ -1080,8 +1080,25 @@ async function main() {
   saveTiming(history);
   saveBlockTiming(blockTiming);
 
-  console.log(`${dim}Stopping shared infrastructure...${reset}`);
-  stopSharedInfra();
+  // A --keep run keeps the WHOLE stack: the per-test project (persistent file
+  // written in the loop) and the shared infra here. Tearing the shared pieces
+  // down under --keep gave a kept stack with no name resolution and no certs
+  // (celilo#1313) — half a system, in the mode the debugging method
+  // prescribes. The exit stays one command: `cele2e down` sweeps every
+  // celilo-e2e-* container, network and volume by name filter (bin/e2e-down)
+  // and releases the kept lock, so the kept shared infra costs nothing extra
+  // to reap. markKept() here too: with shared infra left up, a run that
+  // captured no project still leaves a live stack, and an unmarked lock makes
+  // the next run's live-stack refusal read as contention instead of a
+  // deliberate kept stack. Idempotent with the per-test markKept().
+  if (flagKeep) {
+    markKept();
+    console.log(`${dim}Keeping shared infrastructure (DNS, CA, registry) for debugging.${reset}`);
+    console.log(`${dim}  Tear down everything (project + shared infra): cele2e down${reset}`);
+  } else {
+    console.log(`${dim}Stopping shared infrastructure...${reset}`);
+    stopSharedInfra();
+  }
 
   const suiteDuration = Math.floor((Date.now() - suiteStart) / 1000);
 

package/src/types.ts

@@ -120,14 +120,16 @@ export interface NetworkConfig {
    */
   signalRelease: boolean;
   /**
-   * Which zone the celilo management container sits in. Defaults to `internal`
-   * — the single-network topology every existing test uses.
+   * Which zone the celilo management container sits in. Defaults to
+   * `secure-mgmt` — the production topology, celilo-mgr on its own
+   * control-plane network. (It used to default to `internal`, the
+   * single-network topology, and that default is why the control-plane-network
+   * bug reached production: with management always on `internal`, the hardcoded
+   * "trusted subnet == network.internal.subnet" assumption was accidentally
+   * true in every test.)
    *
-   * `secure-mgmt` places celilo-mgr on its OWN control-plane network, which is
-   * the production topology and the one the suite could not express before. That
-   * gap is why the control-plane-network bug reached production: with management
-   * always on `internal`, the hardcoded "trusted subnet == network.internal.subnet"
-   * assumption was accidentally true in every test.
+   * A suite that genuinely needs the legacy single-network topology sets
+   * `internal` EXPLICITLY and says why in a comment.
    */
   managementZone?: 'internal' | 'secure-mgmt';
   /**
@@ -290,6 +292,18 @@ export interface NetworkHandle {
    */
   moduleHost(moduleId: string): Promise<ModuleHost>;
 
+  /**
+   * The IPv4 address a module's deploy recorded, from `celilo module where
+   * --json` (the `module_systems` inventory).
+   *
+   * Replaces `grep target_ip` over the module's `generated/` tree, which D4
+   * of control-plane-stops-building-modules deletes after every successful
+   * deploy (celilo#1334). The inventory is the deploy's own durable record of
+   * the address, so this works on the machine pool and the container service
+   * alike. Throws when the deploy recorded nothing.
+   */
+  targetIp(moduleId: string): Promise<string>;
+
   /**
    * Tell celilo where its own control plane lives, and wait until the box is
    * usable again.

package/registry-server/src/auth.test.ts

@@ -1,76 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { ADMIN_SCOPE, TokenAuth, hashToken } from './auth';
-
-describe('TokenAuth (package-scoped — ISS-0140)', () => {
-  test('empty specs → no tokens; nothing authorizes', () => {
-    const auth = new TokenAuth([]);
-    expect(auth.hasTokens()).toBe(false);
-    expect(auth.authorize('anything', 'caddy')).toBe(false);
-    expect(auth.isAdmin('anything')).toBe(false);
-  });
-
-  test('admin-scoped token publishes ANY package', () => {
-    const auth = new TokenAuth([{ token: 'admin-tok', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('admin-tok', 'caddy')).toBe(true);
-    expect(auth.authorize('admin-tok', 'lunacycle')).toBe(true);
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-  });
-
-  test('package-scoped token publishes ONLY its package', () => {
-    const auth = new TokenAuth([{ token: 'luna-tok', scope: 'lunacycle' }]);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    // A scoped token is NOT an admin token — it cannot mint.
-    expect(auth.isAdmin('luna-tok')).toBe(false);
-  });
-
-  test('unknown token never authorizes', () => {
-    const auth = new TokenAuth([{ token: 'known', scope: 'lunacycle' }]);
-    expect(auth.authorize('unknown', 'lunacycle')).toBe(false);
-  });
-
-  test('tokens are stored hashed, not in cleartext', () => {
-    const auth = new TokenAuth([{ token: 'secret-token', scope: ADMIN_SCOPE }]);
-    expect(JSON.stringify(auth)).not.toContain('secret-token');
-  });
-
-  test('tolerates a Bearer prefix and surrounding whitespace', () => {
-    const auth = new TokenAuth([{ token: 'clean', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('  clean  ', 'caddy')).toBe(true);
-    expect(auth.authorize('Bearer clean', 'caddy')).toBe(true);
-  });
-
-  test('empty header rejected', () => {
-    const auth = new TokenAuth([{ token: 'secret', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('', 'caddy')).toBe(false);
-    expect(auth.scopeOf('')).toBe(null);
-  });
-
-  test('addHashed / removeHashed manage minted tokens at runtime', () => {
-    const auth = new TokenAuth([]);
-    const hash = hashToken('minted-tok');
-    auth.addHashed(hash, 'lunacycle');
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(true);
-    auth.removeHashed(hash);
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(false);
-  });
-});
-
-describe('TokenAuth.fromEnv (PUBLISH_TOKENS format)', () => {
-  test('bare line → admin scope; "token pkg" line → scoped', () => {
-    process.env.PUBLISH_TOKENS = 'admin-tok\nluna-tok lunacycle\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    process.env.PUBLISH_TOKENS = '';
-  });
-
-  test('blank lines ignored', () => {
-    process.env.PUBLISH_TOKENS = '\n  \nt1\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.hasTokens()).toBe(true);
-    expect(auth.isAdmin('t1')).toBe(true);
-    process.env.PUBLISH_TOKENS = '';
-  });
-});

package/registry-server/src/bootstrap-packaging.test.ts

@@ -1,71 +0,0 @@
-/**
- * Lockstep gate (ISS-0046): the registry-server's on-demand `walkDir` packager
- * can't import the canonical node_modules-bundling rule at runtime (this server
- * ships standalone, with no @celilo deps), so it carries a structural copy.
- * This test imports the canonical rule directly (zero-dependency module, safe to
- * pull in at test time from the workspace) and asserts walkDir's actual output
- * conforms to it — so a drift in either copy fails here instead of shipping a
- * broken `.netapp`.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-// Canonical rule lives in apps/celilo; importing it cross-package is fine in a
-// workspace test (it's not bundled into the standalone registry-sim image).
-import { includeNodeModulesPath } from '../../../apps/celilo/src/module/packaging/package-rules';
-import { walkDir } from './bootstrap';
-
-describe('bootstrap walkDir stays in lockstep with the canonical packaging rule', () => {
-  let dir: string;
-
-  // Representative node_modules paths spanning both branches of the rule.
-  const nmFiles = [
-    'scripts/node_modules/@celilo/capabilities/src/dns-internal.ts',
-    'scripts/node_modules/tldts/index.js',
-    'scripts/node_modules/drizzle-orm/index.js',
-    'scripts/node_modules/.bin/tldts',
-    'node_modules/@celilo/capabilities/index.js',
-    'node_modules/lodash/index.js',
-    'node_modules/@celilo/e2e/index.js',
-  ];
-
-  function write(rel: string): void {
-    const full = join(dir, rel);
-    mkdirSync(join(full, '..'), { recursive: true });
-    writeFileSync(full, 'x');
-  }
-
-  beforeEach(() => {
-    dir = mkdtempSync(join(tmpdir(), 'celilo-bootstrap-rule-'));
-    write('manifest.yml');
-    write('scripts/on-install.ts');
-    for (const f of nmFiles) write(f);
-  });
-
-  afterEach(() => {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  it("walkDir's node_modules decisions match includeNodeModulesPath", () => {
-    const bundled = new Set(walkDir(dir));
-    for (const rel of nmFiles) {
-      expect(bundled.has(rel)).toBe(includeNodeModulesPath(rel));
-    }
-  });
-
-  it('bundles scripts deps (tldts), drops .bin shims and non-scripts cruft', () => {
-    const bundled = new Set(walkDir(dir));
-    expect(bundled.has('scripts/node_modules/tldts/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/drizzle-orm/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/.bin/tldts')).toBe(false);
-    expect(bundled.has('node_modules/lodash/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/e2e/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/capabilities/index.js')).toBe(true);
-  });
-});