@celilo/e2e 0.9.2-alpha.0 → 0.9.3

package/src/runner.ts

@@ -17,11 +17,11 @@
  *   Countdown goes negative when over estimate.
  */
 
-import { spawn, spawnSync, execSync } from 'node:child_process';
+import { execSync, spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
-import { parse as parseYaml } from 'yaml';
 import { type DisplayMode, ProgressDisplay } from '@celilo/cli-display';
+import { parse as parseYaml } from 'yaml';
 import {
   emitRunCompleted,
   emitRunFailed,
@@ -30,7 +30,7 @@ import {
   emitTestStarted,
 } from './bus-events';
 import { parseLine } from './parse-line';
-import { acquireRunLock, E2eBusyError, markKept } from './run-lock';
+import { E2eBusyError, acquireRunLock, markKept } from './run-lock';
 import { SIMULATOR_IPS } from './simulator-ips';
 
 // ─── Config ──────────────────────────────────────────────────────────
@@ -50,7 +50,9 @@ function resolveModuleTestsDir(dir: string): string {
   const manifestPath = join(dir, 'manifest.yml');
   if (existsSync(manifestPath)) {
     try {
-      const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as { e2e?: { tests_dir?: string } };
+      const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as {
+        e2e?: { tests_dir?: string };
+      };
       if (parsed?.e2e?.tests_dir) return resolve(dir, parsed.e2e.tests_dir);
     } catch {}
   }
@@ -84,11 +86,14 @@ const flagCi = rawArgs.includes('--ci');
 const flagNoCi = rawArgs.includes('--no-ci');
 const ci = flagCi || (!flagNoCi && !!process.env.CI);
 const patterns = rawArgs.filter((a) => !a.startsWith('--'));
-// --ci-safe: skip tests marked `cele2e-ci-unsafe` in their file (quarantined —
-// known-failing or builder-flaky, each tracked by an ISS). `--complete`/`--all`
-// run everything. Passed through from the CLI (not stripped) so the runner can
-// apply the exclusion.
-const flagCiSafe = rawArgs.includes('--ci-safe');
+// Quarantine: tests whose file contains the marker `cele2e-ci-unsafe` (a comment
+// naming the reason + ISS) are known-failing / builder-flaky and tracked
+// separately, so they must never turn a broad run red. They are SKIPPED by
+// default in every broad run (`--all`, `--all-modules`, `--ci-safe`, bare). Two
+// ways to run one anyway: name it explicitly (`cele2e run <name>`), or pass
+// `--complete` (the deliberate "run everything, including quarantined" opt-in).
+// `--complete` is passed through from the CLI (not stripped) so the runner sees it.
+const flagComplete = rawArgs.includes('--complete');
 // --notify: fire a desktop notification when the run finishes (handy for long
 // detached/background runs). Best-effort — never affects the exit code.
 const flagNotify = rawArgs.includes('--notify');
@@ -123,9 +128,20 @@ function notify(title: string, message: string): void {
   if (!flagNotify) return;
   try {
     if (process.platform === 'darwin') {
-      const r = spawnSync('terminal-notifier', ['-title', title, '-message', message, '-sound', 'Glass'], { stdio: 'ignore' });
+      const r = spawnSync(
+        'terminal-notifier',
+        ['-title', title, '-message', message, '-sound', 'Glass'],
+        { stdio: 'ignore' },
+      );
       if (r.error) {
-        spawnSync('osascript', ['-e', `display notification ${JSON.stringify(message)} with title ${JSON.stringify(title)} sound name "Glass"`], { stdio: 'ignore' });
+        spawnSync(
+          'osascript',
+          [
+            '-e',
+            `display notification ${JSON.stringify(message)} with title ${JSON.stringify(title)} sound name "Glass"`,
+          ],
+          { stdio: 'ignore' },
+        );
       }
       spawnSync('say', [message], { stdio: 'ignore' });
     } else if (process.platform === 'linux') {
@@ -182,7 +198,10 @@ function extractFailureMessage(lines: string[], exitCode: number): string {
   // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
   const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
   if (bunFailIdx >= 0) {
-    const testName = plain[bunFailIdx].replace(/^\s*✗\s+/, '').replace(/\s*\[\d+ms\].*$/, '').trim();
+    const testName = plain[bunFailIdx]
+      .replace(/^\s*✗\s+/, '')
+      .replace(/\s*\[\d+ms\].*$/, '')
+      .trim();
     // Grab the error detail on the next few lines (bun indents it under the test)
     const detail = plain
       .slice(bunFailIdx + 1, bunFailIdx + 6)
@@ -215,7 +234,13 @@ function extractFailureMessage(lines: string[], exitCode: number): string {
 
   // Last resort: print the last few non-empty, non-progress lines from the output
   const tail = plain
-    .filter((l) => l.length > 0 && !l.startsWith('[progress') && !l.startsWith('[e2e:') && !l.startsWith('[ansible:'))
+    .filter(
+      (l) =>
+        l.length > 0 &&
+        !l.startsWith('[progress') &&
+        !l.startsWith('[e2e:') &&
+        !l.startsWith('[ansible:'),
+    )
     .slice(-3)
     .map((l) => l.trim())
     .join(' | ');
@@ -270,7 +295,9 @@ async function runTest(
         testEnv.CELILO_E2E_REUSE = '1';
         testEnv.CELILO_E2E_PROJECT = data.projectName;
       } catch {
-        console.error(`${red}✗ --reuse: no persistent network found. Run with --keep first.${reset}`);
+        console.error(
+          `${red}✗ --reuse: no persistent network found. Run with --keep first.${reset}`,
+        );
         process.exit(1);
       }
     }
@@ -298,23 +325,32 @@ async function runTest(
       process.stdout.write(`${bold}\x1b[33m║${reset}  Container: ${bold}${container}${reset}\n`);
       process.stdout.write(`${bold}\x1b[33m║${reset}\n`);
       process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Run commands:${reset}\n`);
-      process.stdout.write(`${bold}\x1b[33m║${reset}    docker compose -f docker-compose.test.yml \\\n`);
-      process.stdout.write(`${bold}\x1b[33m║${reset}      -p ${project} exec ${container} bash -c '<cmd>'\n`);
+      process.stdout.write(
+        `${bold}\x1b[33m║${reset}    docker compose -f docker-compose.test.yml \\\n`,
+      );
+      process.stdout.write(
+        `${bold}\x1b[33m║${reset}      -p ${project} exec ${container} bash -c '<cmd>'\n`,
+      );
       process.stdout.write(`${bold}\x1b[33m║${reset}\n`);
 
       if (interactive) {
-        process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Or get a shell: type 'exit' to resume the test.${reset}\n`);
+        process.stdout.write(
+          `${bold}\x1b[33m║${reset}  ${dim}Or get a shell: type 'exit' to resume the test.${reset}\n`,
+        );
         process.stdout.write(`${bold}\x1b[33m╚${border}${reset}\n\n`);
 
-        spawnSync('docker', [
-          'compose', '-f', 'docker-compose.test.yml', '-p', project,
-          'exec', container, 'bash',
-        ], {
-          cwd: PKG_DIR,
-          stdio: 'inherit',
-        });
+        spawnSync(
+          'docker',
+          ['compose', '-f', 'docker-compose.test.yml', '-p', project, 'exec', container, 'bash'],
+          {
+            cwd: PKG_DIR,
+            stdio: 'inherit',
+          },
+        );
       } else {
-        process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Resume: touch ${signalFile}${reset}\n`);
+        process.stdout.write(
+          `${bold}\x1b[33m║${reset}  ${dim}Resume: touch ${signalFile}${reset}\n`,
+        );
         process.stdout.write(`${bold}\x1b[33m╚${border}${reset}\n\n`);
 
         // Non-interactive: just wait for the signal file (no shell)
@@ -376,7 +412,7 @@ async function runTest(
       writeFileSync(logFile, stdout + '\n---STDERR---\n' + stderr);
 
       const expectMatch = stdout.match(/(\d+) expect\(\) calls/);
-      const expectCount = expectMatch ? parseInt(expectMatch[1], 10) : undefined;
+      const expectCount = expectMatch ? Number.parseInt(expectMatch[1], 10) : undefined;
 
       if (code === 0) {
         if (expectCount === 0) {
@@ -389,7 +425,13 @@ async function runTest(
             error: '0 assertions — test likely exited before reaching assertions',
           });
         } else {
-          resolveTest({ name, status: 'pass', duration, hadDebugPause, projectName: capturedProjectName });
+          resolveTest({
+            name,
+            status: 'pass',
+            duration,
+            hadDebugPause,
+            projectName: capturedProjectName,
+          });
         }
       } else {
         // Collect a raw tail: strip ANSI, drop internal protocol lines, keep last 30
@@ -397,12 +439,13 @@ async function runTest(
           .split('\n')
           .map(stripAnsi)
           .map((l) => l.trimEnd())
-          .filter((l) =>
-            l.length > 0 &&
-            !l.startsWith('[progress') &&
-            !l.startsWith('[e2e:') &&
-            !l.startsWith('[ansible:') &&
-            !l.startsWith('[debug:'),
+          .filter(
+            (l) =>
+              l.length > 0 &&
+              !l.startsWith('[progress') &&
+              !l.startsWith('[e2e:') &&
+              !l.startsWith('[ansible:') &&
+              !l.startsWith('[debug:'),
           )
           .slice(-30)
           .join('\n');
@@ -424,10 +467,12 @@ async function runTest(
 
 function dockerComposeShared(cmd: string): string {
   try {
-    return execSync(
-      `docker compose -f docker-compose.shared.yml -p celilo-e2e-shared ${cmd}`,
-      { cwd: PKG_DIR, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 60_000 },
-    ).trim();
+    return execSync(`docker compose -f docker-compose.shared.yml -p celilo-e2e-shared ${cmd}`, {
+      cwd: PKG_DIR,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 60_000,
+    }).trim();
   } catch {
     return '';
   }
@@ -435,7 +480,9 @@ function dockerComposeShared(cmd: string): string {
 
 function stopSharedInfra(): void {
   dockerComposeShared('down --volumes --remove-orphans');
-  try { execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 }); } catch {}
+  try {
+    execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 });
+  } catch {}
 }
 
 /**
@@ -486,14 +533,20 @@ async function main() {
   // docker mutation so a competing run can't wipe our shared infra mid-setup.
   const lockLabel = patterns.length ? patterns.join(',') : moduleDirs.length ? 'modules' : 'all';
   try {
-    acquireRunLock({ test: lockLabel, runId: process.env.CELE2E_RUN_ID ?? ambientRunId, allowKept: flagReuse });
+    acquireRunLock({
+      test: lockLabel,
+      runId: process.env.CELE2E_RUN_ID ?? ambientRunId,
+      allowKept: flagReuse,
+    });
     // A --reuse run keeps using a kept stack that stays up afterwards — hold the
     // lock in kept state so it isn't freed out from under the reused network.
     if (flagReuse) markKept();
   } catch (err) {
     if (err instanceof E2eBusyError) {
       console.error(`\n${red}${err.message}${reset}`);
-      console.error(`${dim}Poll with: cele2e status   (machine-readable: cele2e status --json)${reset}\n`);
+      console.error(
+        `${dim}Poll with: cele2e status   (machine-readable: cele2e status --json)${reset}\n`,
+      );
       process.exit(3);
     }
     throw err;
@@ -511,7 +564,9 @@ async function main() {
       const tp = resolveModuleTestsDir(dir);
       if (!existsSync(tp)) {
         console.error(`${red}No tests directory found at ${tp}${reset}`);
-        console.error(`${red}Set e2e.tests_dir in ${join(dir, 'manifest.yml')} to point to your test files.${reset}`);
+        console.error(
+          `${red}Set e2e.tests_dir in ${join(dir, 'manifest.yml')} to point to your test files.${reset}`,
+        );
         process.exit(1);
       }
       // Auto-install e2e/ dependencies if package.json exists but node_modules is missing
@@ -573,11 +628,10 @@ async function main() {
     testFiles = testFiles.filter((f) => patterns.some((p) => basename(f, '.test.ts').includes(p)));
   }
 
-  // --ci-safe: drop quarantined tests — those whose file contains the marker
-  // `cele2e-ci-unsafe` (a comment naming the reason + ISS). Keeps the nightly
-  // green on the CI-safe subset while the quarantined tests are tracked + fixed
-  // separately. `--complete`/`--all` run everything (no exclusion).
-  if (flagCiSafe) {
+  // Drop quarantined tests (file contains `cele2e-ci-unsafe`) from broad runs so
+  // they never turn a full run red. Skipped by default; bypassed only when the
+  // user explicitly named tests (`patterns.length > 0`) or passed `--complete`.
+  if (!flagComplete && patterns.length === 0) {
     const before = testFiles.length;
     testFiles = testFiles.filter((f) => {
       try {
@@ -588,7 +642,9 @@ async function main() {
     });
     const skipped = before - testFiles.length;
     if (skipped > 0) {
-      console.log(`${dim}--ci-safe: skipped ${skipped} quarantined (cele2e-ci-unsafe) test(s)${reset}`);
+      console.log(
+        `${dim}skipped ${skipped} quarantined (cele2e-ci-unsafe) test(s) — pass --complete or name one to run it${reset}`,
+      );
     }
   }
 
@@ -637,7 +693,9 @@ async function main() {
   console.log(`${bold}╔══════════════════════════════════════════════════════════════${reset}`);
   console.log(`${bold}║  Celilo E2E Tests${moduleLabel}${reset}`);
   if (hasHistory) {
-    console.log(`${bold}║  ${testFiles.length} test(s) — expected ~${formatDuration(suiteExpected)}${reset}`);
+    console.log(
+      `${bold}║  ${testFiles.length} test(s) — expected ~${formatDuration(suiteExpected)}${reset}`,
+    );
   } else {
     console.log(`${bold}║  ${testFiles.length} test(s) — first run, no timing history${reset}`);
   }
@@ -741,7 +799,8 @@ async function main() {
     emitTestCompleted({
       runId,
       name,
-      status: result.status === 'pass' ? 'pass' : result.status === 'suspicious' ? 'suspicious' : 'fail',
+      status:
+        result.status === 'pass' ? 'pass' : result.status === 'suspicious' ? 'suspicious' : 'fail',
       durationMs: result.duration * 1000,
       error: result.error,
       logDir,
@@ -757,11 +816,15 @@ async function main() {
     if (flagKeep && result.projectName) {
       writeFileSync(
         persistentFile,
-        JSON.stringify({
-          projectName: result.projectName,
-          testFile: file,
-          createdAt: new Date().toISOString(),
-        }, null, 2) + '\n',
+        JSON.stringify(
+          {
+            projectName: result.projectName,
+            testFile: file,
+            createdAt: new Date().toISOString(),
+          },
+          null,
+          2,
+        ) + '\n',
       );
       console.log(`${dim}  Persistent network: ${result.projectName}${reset}`);
       console.log(`${dim}  Reuse: ${basename(process.argv[1])} --reuse${reset}`);
@@ -800,7 +863,9 @@ async function main() {
       JSON.stringify({ status: result.status, duration: result.duration, error: result.error }),
     );
 
-    try { execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 }); } catch {}
+    try {
+      execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 });
+    } catch {}
   }
 
   saveTiming(history);
@@ -820,7 +885,9 @@ async function main() {
   for (const r of results) {
     const icon = r.status === 'pass' ? '✓' : '✗';
     const color = r.status === 'pass' ? green : red;
-    console.log(`${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`);
+    console.log(
+      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`,
+    );
     if (r.error) {
       console.log(`${bold}║${reset}    ${red}└─ ${r.error}${reset}`);
     }
@@ -832,7 +899,11 @@ async function main() {
 
   writeFileSync(
     join(resultsDir, 'summary.json'),
-    JSON.stringify({ timestamp, total: testFiles.length, passed, failed, duration: suiteDuration }, null, 2),
+    JSON.stringify(
+      { timestamp, total: testFiles.length, passed, failed, duration: suiteDuration },
+      null,
+      2,
+    ),
   );
 
   const gitignore = join(testDir, '.gitignore');

package/registry-server/package.json

@@ -1,17 +0,0 @@
-{
-  "name": "@celilo/registry-server",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "main": "src/index.ts",
-  "scripts": {
-    "start": "bun run src/index.ts",
-    "dev": "bun --watch src/index.ts",
-    "build:binary": "bun build --compile --target=bun-linux-x64 --outfile=dist/celilo-registry-server src/index.ts",
-    "test": "bun test"
-  },
-  "devDependencies": {
-    "bun-types": "latest",
-    "typescript": "^5"
-  }
-}

package/registry-server/src/auth.test.ts

@@ -1,76 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { ADMIN_SCOPE, TokenAuth, hashToken } from './auth';
-
-describe('TokenAuth (package-scoped — ISS-0140)', () => {
-  test('empty specs → no tokens; nothing authorizes', () => {
-    const auth = new TokenAuth([]);
-    expect(auth.hasTokens()).toBe(false);
-    expect(auth.authorize('anything', 'caddy')).toBe(false);
-    expect(auth.isAdmin('anything')).toBe(false);
-  });
-
-  test('admin-scoped token publishes ANY package', () => {
-    const auth = new TokenAuth([{ token: 'admin-tok', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('admin-tok', 'caddy')).toBe(true);
-    expect(auth.authorize('admin-tok', 'lunacycle')).toBe(true);
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-  });
-
-  test('package-scoped token publishes ONLY its package', () => {
-    const auth = new TokenAuth([{ token: 'luna-tok', scope: 'lunacycle' }]);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    // A scoped token is NOT an admin token — it cannot mint.
-    expect(auth.isAdmin('luna-tok')).toBe(false);
-  });
-
-  test('unknown token never authorizes', () => {
-    const auth = new TokenAuth([{ token: 'known', scope: 'lunacycle' }]);
-    expect(auth.authorize('unknown', 'lunacycle')).toBe(false);
-  });
-
-  test('tokens are stored hashed, not in cleartext', () => {
-    const auth = new TokenAuth([{ token: 'secret-token', scope: ADMIN_SCOPE }]);
-    expect(JSON.stringify(auth)).not.toContain('secret-token');
-  });
-
-  test('tolerates a Bearer prefix and surrounding whitespace', () => {
-    const auth = new TokenAuth([{ token: 'clean', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('  clean  ', 'caddy')).toBe(true);
-    expect(auth.authorize('Bearer clean', 'caddy')).toBe(true);
-  });
-
-  test('empty header rejected', () => {
-    const auth = new TokenAuth([{ token: 'secret', scope: ADMIN_SCOPE }]);
-    expect(auth.authorize('', 'caddy')).toBe(false);
-    expect(auth.scopeOf('')).toBe(null);
-  });
-
-  test('addHashed / removeHashed manage minted tokens at runtime', () => {
-    const auth = new TokenAuth([]);
-    const hash = hashToken('minted-tok');
-    auth.addHashed(hash, 'lunacycle');
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(true);
-    auth.removeHashed(hash);
-    expect(auth.authorize('minted-tok', 'lunacycle')).toBe(false);
-  });
-});
-
-describe('TokenAuth.fromEnv (PUBLISH_TOKENS format)', () => {
-  test('bare line → admin scope; "token pkg" line → scoped', () => {
-    process.env.PUBLISH_TOKENS = 'admin-tok\nluna-tok lunacycle\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.isAdmin('admin-tok')).toBe(true);
-    expect(auth.authorize('luna-tok', 'lunacycle')).toBe(true);
-    expect(auth.authorize('luna-tok', 'caddy')).toBe(false);
-    process.env.PUBLISH_TOKENS = '';
-  });
-
-  test('blank lines ignored', () => {
-    process.env.PUBLISH_TOKENS = '\n  \nt1\n';
-    const auth = TokenAuth.fromEnv();
-    expect(auth.hasTokens()).toBe(true);
-    expect(auth.isAdmin('t1')).toBe(true);
-    process.env.PUBLISH_TOKENS = '';
-  });
-});

package/registry-server/src/auth.ts

@@ -1,105 +0,0 @@
-import { createHash } from 'node:crypto';
-
-/**
- * Package-scoped token auth (build-bus Phase 3, ISS-0140).
- *
- * Each token carries a SCOPE — either a single package name (the token may
- * publish only that module) or the admin scope `*` (publish anything + mint
- * scoped tokens). Tokens are stored SHA-256 hashed; cleartext never lives in
- * the auth set once the server starts.
- *
- *   PUBLISH_TOKENS env (newline-separated), per line:
- *     <token>              → admin scope `*` (publish any package, mint tokens)
- *     <token> <package>    → scoped to that one package
- *
- * A bare `<token>` line is the admin/bootstrap token — this preserves the
- * pre-scoping behavior (any configured token publishes anything) AND is the
- * privilege that the `registry_publish` capability uses to mint per-repo
- * scoped tokens. Minted scoped tokens are added at runtime via {@link addHashed}
- * (loaded from the persisted store) and removed via {@link removeHashed}.
- */
-
-/** Admin scope: publish any package + mint scoped tokens. */
-export const ADMIN_SCOPE = '*';
-
-export interface TokenSpec {
-  token: string;
-  /** Package name, or {@link ADMIN_SCOPE}. */
-  scope: string;
-}
-
-/** SHA-256 of a token (trimmed). The persisted scoped-token store hashes too. */
-export function hashToken(token: string): string {
-  return createHash('sha256').update(token.trim()).digest('hex');
-}
-
-/** Strip an optional `Bearer ` prefix and surrounding whitespace from a header. */
-function bareToken(header: string): string {
-  return header.replace(/^Bearer\s+/i, '').trim();
-}
-
-export class TokenAuth {
-  /** hash → scope. */
-  private readonly scopeByHash = new Map<string, string>();
-
-  constructor(specs: TokenSpec[]) {
-    for (const s of specs) this.addRaw(s.token, s.scope);
-  }
-
-  /**
-   * Parse the `PUBLISH_TOKENS` env format into the scoped auth set. Each line is
-   * `<token>` (admin scope) or `<token> <package>` (scoped to one package).
-   */
-  static fromEnv(): TokenAuth {
-    const raw = process.env.PUBLISH_TOKENS ?? '';
-    const specs: TokenSpec[] = [];
-    for (const line of raw.split('\n')) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      const [token, scope] = trimmed.split(/\s+/, 2);
-      specs.push({ token, scope: scope || ADMIN_SCOPE });
-    }
-    return new TokenAuth(specs);
-  }
-
-  /** Add a cleartext token (hashes it). Empty tokens are ignored. */
-  addRaw(rawToken: string, scope: string): void {
-    const t = rawToken.trim();
-    if (!t) return;
-    this.scopeByHash.set(hashToken(t), scope.trim() || ADMIN_SCOPE);
-  }
-
-  /** Add an already-hashed token (used when loading the persisted minted-token store). */
-  addHashed(hash: string, scope: string): void {
-    this.scopeByHash.set(hash, scope);
-  }
-
-  /** Remove a token by its hash (token revocation). */
-  removeHashed(hash: string): void {
-    this.scopeByHash.delete(hash);
-  }
-
-  /** If no tokens are configured, the server treats every write as unauthorized. */
-  hasTokens(): boolean {
-    return this.scopeByHash.size > 0;
-  }
-
-  /** The scope of a token (from an Authorization header value), or null if unknown. */
-  scopeOf(header: string): string | null {
-    const t = bareToken(header);
-    if (!t) return null;
-    return this.scopeByHash.get(hashToken(t)) ?? null;
-  }
-
-  /** True when the token may publish/yank the given package (admin or exact scope). */
-  authorize(header: string, pkg: string): boolean {
-    const scope = this.scopeOf(header);
-    if (scope === null) return false;
-    return scope === ADMIN_SCOPE || scope === pkg;
-  }
-
-  /** True when the token is an admin token (scope `*`) — required to mint scoped tokens. */
-  isAdmin(header: string): boolean {
-    return this.scopeOf(header) === ADMIN_SCOPE;
-  }
-}

package/registry-server/src/bootstrap-packaging.test.ts

@@ -1,71 +0,0 @@
-/**
- * Lockstep gate (ISS-0046): the registry-server's on-demand `walkDir` packager
- * can't import the canonical node_modules-bundling rule at runtime (this server
- * ships standalone, with no @celilo deps), so it carries a structural copy.
- * This test imports the canonical rule directly (zero-dependency module, safe to
- * pull in at test time from the workspace) and asserts walkDir's actual output
- * conforms to it — so a drift in either copy fails here instead of shipping a
- * broken `.netapp`.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-// Canonical rule lives in apps/celilo; importing it cross-package is fine in a
-// workspace test (it's not bundled into the standalone registry-sim image).
-import { includeNodeModulesPath } from '../../../apps/celilo/src/module/packaging/package-rules';
-import { walkDir } from './bootstrap';
-
-describe('bootstrap walkDir stays in lockstep with the canonical packaging rule', () => {
-  let dir: string;
-
-  // Representative node_modules paths spanning both branches of the rule.
-  const nmFiles = [
-    'scripts/node_modules/@celilo/capabilities/src/dns-internal.ts',
-    'scripts/node_modules/tldts/index.js',
-    'scripts/node_modules/drizzle-orm/index.js',
-    'scripts/node_modules/.bin/tldts',
-    'node_modules/@celilo/capabilities/index.js',
-    'node_modules/lodash/index.js',
-    'node_modules/@celilo/e2e/index.js',
-  ];
-
-  function write(rel: string): void {
-    const full = join(dir, rel);
-    mkdirSync(join(full, '..'), { recursive: true });
-    writeFileSync(full, 'x');
-  }
-
-  beforeEach(() => {
-    dir = mkdtempSync(join(tmpdir(), 'celilo-bootstrap-rule-'));
-    write('manifest.yml');
-    write('scripts/on-install.ts');
-    for (const f of nmFiles) write(f);
-  });
-
-  afterEach(() => {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  it("walkDir's node_modules decisions match includeNodeModulesPath", () => {
-    const bundled = new Set(walkDir(dir));
-    for (const rel of nmFiles) {
-      expect(bundled.has(rel)).toBe(includeNodeModulesPath(rel));
-    }
-  });
-
-  it('bundles scripts deps (tldts), drops .bin shims and non-scripts cruft', () => {
-    const bundled = new Set(walkDir(dir));
-    expect(bundled.has('scripts/node_modules/tldts/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/drizzle-orm/index.js')).toBe(true);
-    expect(bundled.has('scripts/node_modules/.bin/tldts')).toBe(false);
-    expect(bundled.has('node_modules/lodash/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/e2e/index.js')).toBe(false);
-    expect(bundled.has('node_modules/@celilo/capabilities/index.js')).toBe(true);
-  });
-});