@cosmicdrift/kumiko-dev-server 0.1.0

package/src/__tests__/create-kumiko-server.integration.ts

@@ -0,0 +1,286 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  createBooleanField,
+  createEntity,
+  createTextField,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { sql } from "drizzle-orm";
+import { afterEach, describe, expect, test } from "vitest";
+import { createKumikoServer, type KumikoServerHandle } from "../create-kumiko-server";
+
+// Integration-Test: bootet createKumikoServer mit echtem Postgres,
+// echtem Redis, echter Kumiko-Pipeline. Treibt den fetch-Handler
+// direkt an (nicht über Bun.serve + Socket), weil vitest unter Node
+// läuft. Unter Bun würde derselbe Handler identisch antworten —
+// das Routing ist runtime-neutral.
+
+const probeEntity = createEntity({
+  fields: {
+    title: createTextField({ required: true }),
+    done: createBooleanField(),
+  },
+  table: "kumiko_server_probe",
+});
+
+const probeFeature = defineFeature("dev-server-probe", (r) => {
+  r.entity("probe", probeEntity);
+});
+
+let handle: KumikoServerHandle | undefined;
+
+afterEach(async () => {
+  if (handle) {
+    await handle.stop();
+    handle = undefined;
+  }
+});
+
+async function boot(): Promise<KumikoServerHandle> {
+  handle = await createKumikoServer({
+    features: [probeFeature],
+    port: 0,
+    installSignalHandlers: false,
+  });
+  return handle;
+}
+
+describe("createKumikoServer", () => {
+  test("bootet den Kumiko-Stack + legt die Feature-Tables an", async () => {
+    const h = await boot();
+    const rows = await h.stack.db.execute<{ exists: boolean }>(
+      sql`SELECT to_regclass('public.kumiko_server_probe') IS NOT NULL AS exists`,
+    );
+    expect(rows[0]?.exists).toBe(true);
+  });
+
+  test("GET / → HTML + kumiko_auth/kumiko_csrf Set-Cookie", async () => {
+    const h = await boot();
+    const res = await h.fetch(new Request("http://localhost/"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toMatch(/text\/html/);
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toMatch(/kumiko_auth=/);
+    expect(setCookie).toMatch(/kumiko_csrf=/);
+    const body = await res.text();
+    expect(body).toMatch(/<div id="root">/);
+    // Reload-Snippet wurde in </body> injiziert.
+    expect(body).toMatch(/EventSource\("\/_reload"\)/);
+  });
+
+  test("GET /client.js → 404 wenn clientEntry fehlt (Route nicht registriert)", async () => {
+    // Pre-multi-entry-Refactor lieferte das eine 200 mit leerem Body —
+    // war eine Quirky Backwards-Compat. Mit der Multi-Entry-Engine wird
+    // /client.js erst registriert wenn ein Entry vorhanden ist (kein
+    // entries → kein Bundle-Asset-Path → 404 ist korrekt).
+    const h = await boot();
+    const res = await h.fetch(new Request("http://localhost/client.js"));
+    expect(res.status).toBe(404);
+  });
+
+  test("Single-Entry: clientEntry='client.tsx' liefert Bundle unter /client.js", async () => {
+    // Backwards-Compat-Smoke: existierende Samples (designer, ui-walkthrough,
+    // beammycar, …) nutzen clientEntry — der normalize-Pfad muss daraus
+    // `/client.js` als Asset-Path ableiten. Test injiziert via _buildBundle
+    // einen Stub damit der Body deterministisch geprüft werden kann (kein
+    // Bun.build unter Node).
+    const tmpFile = mkdtempSync(join(tmpdir(), "kumiko-single-it-"));
+    const entry = join(tmpFile, "client.tsx");
+    writeFileSync(entry, "// noop");
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        _buildBundle: async () => ({ js: "// SINGLE-ENTRY-STUB", map: "" }),
+      });
+      const res = await handle.fetch(new Request("http://localhost/client.js"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toMatch(/application\/javascript/);
+      expect(await res.text()).toBe("// SINGLE-ENTRY-STUB");
+    } finally {
+      rmSync(tmpFile, { recursive: true, force: true });
+    }
+  });
+
+  test("GET /client.js.map → 404 wenn kein Sourcemap vorhanden", async () => {
+    const h = await boot();
+    const res = await h.fetch(new Request("http://localhost/client.js.map"));
+    expect(res.status).toBe(404);
+  });
+
+  test("GET /_reload → text/event-stream mit connected-Komment", async () => {
+    const h = await boot();
+    const res = await h.fetch(new Request("http://localhost/_reload"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toMatch(/text\/event-stream/);
+    const reader = res.body?.getReader();
+    expect(reader).toBeDefined();
+    if (!reader) return;
+    const { value } = await reader.read();
+    const chunk = new TextDecoder().decode(value);
+    expect(chunk).toMatch(/connected/);
+    await reader.cancel();
+  });
+
+  test("unbekannter Pfad → forwarded an den Hono-Stack", async () => {
+    const h = await boot();
+    // /api/ghost existiert nicht → Hono liefert 404. Der entscheidende
+    // Punkt: die Response kommt VOM Stack, nicht vom Dev-Server-Layer.
+    // Wir unterscheiden, indem wir prüfen, dass es KEINE HTML- oder
+    // event-stream-Response ist — die gehören zum Dev-Server-Layer.
+    const res = await h.fetch(new Request("http://localhost/api/ghost"));
+    expect(res.headers.get("content-type") ?? "").not.toMatch(/text\/html/);
+    expect(res.headers.get("content-type") ?? "").not.toMatch(/text\/event-stream/);
+  });
+
+  test("Server-Instanz ist undefined unter Node (vitest)", async () => {
+    // Sanity check: unter Bun wäre .server gesetzt, unter Node
+    // (wo dieser Test läuft) muss er undefined sein, sonst hätten
+    // wir eine falsche Bun-Detection.
+    const h = await boot();
+    expect(h.server).toBeUndefined();
+  });
+});
+
+// Multi-Entry-Mode — exerciert clientEntries + hostDispatch (Discriminated-
+// Union). Bun.build wird via _buildBundle gestubbt; der Routing-Pfad
+// (HTML-Dispatch pro Host + Bundle-Routing pro Asset-Path) ist runtime-
+// neutral und wird hier vollständig getrieben. Echte Bundle-Produktion
+// deckt die `kumiko-build CLI`-Suite (build-prod-bundle.integration.ts) ab.
+describe("createKumikoServer (Multi-Entry)", () => {
+  let tmpDir = "";
+
+  afterEach(() => {
+    if (tmpDir) {
+      rmSync(tmpDir, { recursive: true, force: true });
+      tmpDir = "";
+    }
+  });
+
+  async function bootMultiEntry(): Promise<KumikoServerHandle> {
+    tmpDir = mkdtempSync(join(tmpdir(), "kumiko-multi-it-"));
+    const publicEntry = join(tmpDir, "client-public.tsx");
+    const adminEntry = join(tmpDir, "client-admin.tsx");
+    const publicHtml = join(tmpDir, "index.html");
+    const adminHtml = join(tmpDir, "admin.html");
+    writeFileSync(publicEntry, "// public");
+    writeFileSync(adminEntry, "// admin");
+    writeFileSync(
+      publicHtml,
+      `<!doctype html><html><body><div id="root"></div><script src="/client-public.js"></script>PUBLIC-HTML</body></html>`,
+    );
+    writeFileSync(
+      adminHtml,
+      `<!doctype html><html><body><div id="root"></div><script src="/client-admin.js"></script>ADMIN-HTML</body></html>`,
+    );
+
+    return createKumikoServer({
+      features: [probeFeature],
+      port: 0,
+      installSignalHandlers: false,
+      clientEntries: [
+        { name: "public", sourceFile: publicEntry, htmlPath: publicHtml },
+        { name: "admin", sourceFile: adminEntry, htmlPath: adminHtml },
+      ],
+      // Stub: der Bundle-Inhalt enthält den Entry-Namen damit der Test
+      // beweisen kann dass /client-public.js ≠ /client-admin.js. Echtes
+      // Bun.build würde unterschiedlich-gehashte Bundles produzieren —
+      // wir simulieren das mit deterministischen Markern.
+      _buildBundle: async (sourceFile) => {
+        if (sourceFile === publicEntry) {
+          return { js: "// PUBLIC-BUNDLE", map: "" };
+        }
+        if (sourceFile === adminEntry) {
+          return { js: "// ADMIN-BUNDLE", map: "" };
+        }
+        throw new Error(`unexpected entry: ${sourceFile}`);
+      },
+      hostDispatch: (req) => {
+        const host = (req.headers.get("host") ?? "").split(":")[0]?.toLowerCase() ?? "";
+        if (host === "apex.test") return { kind: "not-found" };
+        if (host === "old.test") return { kind: "redirect", to: "https://new.test/" };
+        if (host.startsWith("admin.")) {
+          return { kind: "html", entryName: "admin", injectSchema: true };
+        }
+        return { kind: "html", entryName: "public", injectSchema: false };
+      },
+    });
+  }
+
+  test("HTML-Dispatch: admin-Host bekommt admin.html, sonst index.html", async () => {
+    handle = await bootMultiEntry();
+
+    const publicRes = await handle.fetch(
+      new Request("http://status.localhost/", { headers: { host: "status.localhost" } }),
+    );
+    const publicBody = await publicRes.text();
+    expect(publicBody).toMatch(/PUBLIC-HTML/);
+    expect(publicBody).not.toMatch(/ADMIN-HTML/);
+
+    const adminRes = await handle.fetch(
+      new Request("http://admin.localhost/", { headers: { host: "admin.localhost" } }),
+    );
+    const adminBody = await adminRes.text();
+    expect(adminBody).toMatch(/ADMIN-HTML/);
+    expect(adminBody).not.toMatch(/PUBLIC-HTML/);
+  });
+
+  test("Bundle-Routing: /client-public.js ≠ /client-admin.js", async () => {
+    handle = await bootMultiEntry();
+
+    const publicJs = await handle.fetch(new Request("http://status.localhost/client-public.js"));
+    expect(publicJs.status).toBe(200);
+    expect(publicJs.headers.get("content-type")).toMatch(/application\/javascript/);
+    expect(await publicJs.text()).toBe("// PUBLIC-BUNDLE");
+
+    const adminJs = await handle.fetch(new Request("http://admin.localhost/client-admin.js"));
+    expect(adminJs.status).toBe(200);
+    expect(await adminJs.text()).toBe("// ADMIN-BUNDLE");
+
+    // Cross-routing existiert NICHT — /client.js (Single-Entry-Pfad)
+    // ist im Multi-Mode kein registrierter Asset-Path.
+    const noFallback = await handle.fetch(new Request("http://localhost/client.js"));
+    expect(noFallback.status).toBe(404);
+  });
+
+  test("Schema-Inject: admin → injected, public → NICHT injected", async () => {
+    handle = await bootMultiEntry();
+
+    const publicHtml = await (
+      await handle.fetch(
+        new Request("http://status.localhost/", { headers: { host: "status.localhost" } }),
+      )
+    ).text();
+    expect(publicHtml).not.toMatch(/__KUMIKO_SCHEMA__/);
+
+    const adminHtml = await (
+      await handle.fetch(
+        new Request("http://admin.localhost/", { headers: { host: "admin.localhost" } }),
+      )
+    ).text();
+    expect(adminHtml).toMatch(/__KUMIKO_SCHEMA__/);
+  });
+
+  test("hostDispatch redirect: liefert 302 mit Location-Header", async () => {
+    handle = await bootMultiEntry();
+
+    const res = await handle.fetch(
+      new Request("http://old.test/", { headers: { host: "old.test" } }),
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toBe("https://new.test/");
+  });
+
+  test("hostDispatch not-found: liefert 404", async () => {
+    handle = await bootMultiEntry();
+
+    const res = await handle.fetch(
+      new Request("http://apex.test/", { headers: { host: "apex.test" } }),
+    );
+    expect(res.status).toBe(404);
+  });
+});

package/src/__tests__/few-shot-corpus.test.ts

@@ -0,0 +1,311 @@
+// Few-Shot-Corpus tests:
+//   1. Smoke — buildFewShotCorpus produces a structurally valid corpus
+//      against a tmp-dir mini-repo (canonical multi-kind feature, broken
+//      legacy feature, and a non-feature file).
+//   2. Output shape — id stable, paths repo-relative, authoring-style
+//      flags match the parse-error count.
+//   3. Warnings — duplicate-id collisions and parser-throw don't get
+//      swallowed; they show up in the corpus.warnings array.
+//   4. pathToId — pure-function unit tests for the id derivation.
+//
+// Note: The drift-check against the checked-in `docs/few-shot-corpus.json`
+// has been moved to `kumiko-enterprise/packages/ai-foundation` (Phase O.6)
+// because the corpus JSON now lives there — framework is public and must
+// not carry the eval baseline.
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildFewShotCorpus, pathToId } from "@cosmicdrift/kumiko-dev-server";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+
+let workdir: string;
+
+beforeEach(() => {
+  workdir = mkdtempSync(join(tmpdir(), "kumiko-corpus-"));
+});
+
+afterEach(() => {
+  rmSync(workdir, { recursive: true, force: true });
+});
+
+// =============================================================================
+// Smoke test on a tmp-dir mini-repo
+// =============================================================================
+
+describe("buildFewShotCorpus — smoke", () => {
+  test("returns one entry per discovered feature-file with parsed shape", () => {
+    // Plant two feature-files inside `samples/recipes/` so the default
+    // scan-roots pick them up.
+    plantPackage(workdir, "samples/recipes/canonical-demo", {
+      pkgName: "@cosmicdrift/kumiko-sample-canonical-demo",
+      pkgDescription: "Canonical-form demo feature.",
+      featureSource: buildCanonicalMultiKindFeature("canonicalDemo"),
+    });
+    plantPackage(workdir, "samples/recipes/legacy-demo", {
+      pkgName: "@cosmicdrift/kumiko-sample-legacy-demo",
+      pkgDescription: "Identifier-ref-style legacy feature.",
+      featureSource: buildLegacyFeature("legacyDemo"),
+    });
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+
+    expect(corpus.entries).toHaveLength(2);
+    expect(corpus.totals.all).toBe(2);
+    expect(corpus.totals.canonical).toBe(1);
+    expect(corpus.totals.legacy).toBe(1);
+    expect(corpus.warnings).toEqual([]);
+  });
+
+  test("multi-kind canonical entry exposes tags and kind-counts across all kinds", () => {
+    plantPackage(workdir, "samples/recipes/multi-kind", {
+      pkgName: "@cosmicdrift/kumiko-sample-multi-kind",
+      pkgDescription: "Demo feature spanning entity, writeHandler, nav.",
+      featureSource: buildCanonicalMultiKindFeature("multiKind"),
+    });
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+    const entry = corpus.entries[0];
+    if (!entry) throw new Error("expected one entry");
+
+    // Tags collected from PATTERN_LIBRARY.category for each kind. The
+    // exact category names live in the library — assert the union has
+    // at least the categories we expect to see for these kinds, instead
+    // of pinning the full set (so adding categories doesn't break this
+    // test). Why this matters: `tags` is the retrieval key for L2.
+    expect(entry.tags.length).toBeGreaterThanOrEqual(2);
+
+    expect(entry.patternsByKind).toMatchObject({
+      entity: 1,
+      writeHandler: 1,
+      nav: 1,
+    });
+    expect(entry.authoringStyle).toBe("canonical");
+    expect(entry.parseErrors).toEqual([]);
+  });
+
+  test("entries carry id, repo-relative paths, description, tags", () => {
+    plantPackage(workdir, "samples/recipes/demo", {
+      pkgName: "@cosmicdrift/kumiko-sample-demo",
+      pkgDescription: "Demo.",
+      featureSource: buildCanonicalMultiKindFeature("demo"),
+    });
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+    const entry = corpus.entries[0];
+    if (!entry) throw new Error("expected one entry");
+
+    expect(entry.id).toBe("recipes/demo");
+    expect(entry.sourcePath).toBe("samples/recipes/demo/src/feature.ts");
+    expect(entry.packageJsonPath).toBe("samples/recipes/demo/package.json");
+    expect(entry.packageName).toBe("@cosmicdrift/kumiko-sample-demo");
+    expect(entry.description).toBe("Demo.");
+    expect(entry.featureName).toBe("demo");
+    expect(entry.authoringStyle).toBe("canonical");
+    expect(entry.parseErrors).toEqual([]);
+  });
+
+  test("source paths inside parsed patterns are repo-relative (no absolute paths)", () => {
+    plantPackage(workdir, "samples/recipes/demo", {
+      pkgName: "x",
+      pkgDescription: "x",
+      featureSource: buildCanonicalMultiKindFeature("demo"),
+    });
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+    const entry = corpus.entries[0];
+    if (!entry) throw new Error("expected one entry");
+
+    // Walk the patterns recursively and assert every `file` field is
+    // relative — no absolute paths leaking into the JSON.
+    const json = JSON.stringify(entry.patterns);
+    expect(json).not.toContain(workdir);
+  });
+
+  test("non-feature .ts files are ignored", () => {
+    const recipesDir = join(workdir, "samples", "recipes", "demo", "src");
+    mkdirSync(recipesDir, { recursive: true });
+    writeFileSync(
+      join(recipesDir, "..", "package.json"),
+      JSON.stringify({ name: "x", description: "x" }),
+    );
+    writeFileSync(join(recipesDir, "feature.ts"), buildCanonicalMultiKindFeature("demo"));
+    writeFileSync(join(recipesDir, "helpers.ts"), "export const x = 1;\n");
+    writeFileSync(join(recipesDir, "feature.test.ts"), "// not a feature\n");
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+    expect(corpus.entries).toHaveLength(1);
+    expect(corpus.entries[0]?.sourcePath.endsWith("feature.ts")).toBe(true);
+  });
+});
+
+// =============================================================================
+// Warnings — silent skips are gone; parser-throw / duplicate-id surface
+// =============================================================================
+
+describe("buildFewShotCorpus — warnings", () => {
+  test("duplicate id between two scan roots produces a warning, not an overwrite", () => {
+    // Both paths collapse to the same id under pathToId:
+    //   samples/foo/src/feature.ts   → strip "samples/" + "/src/feature.ts" → "foo"
+    //   packages/foo/src/feature.ts  → strip "packages/" + "/src/feature.ts" → "foo"
+    // Without the duplicate-id check the second entry would silently
+    // overwrite the first in any consumer that built `Map<id, entry>`.
+    plantPackage(workdir, "samples/foo", {
+      pkgName: "@cosmicdrift/kumiko-sample-foo-a",
+      pkgDescription: "First foo.",
+      featureSource: buildCanonicalMultiKindFeature("fooA"),
+    });
+    plantPackage(workdir, "packages/foo", {
+      pkgName: "@cosmicdrift/kumiko-sample-foo-b",
+      pkgDescription: "Second foo.",
+      featureSource: buildCanonicalMultiKindFeature("fooB"),
+    });
+
+    // Scan both roots so both feature-files get picked up.
+    const corpus = buildFewShotCorpus({
+      repoRoot: workdir,
+      scanRoots: ["samples", "packages"],
+    });
+
+    expect(corpus.entries).toHaveLength(1);
+    expect(corpus.warnings).toHaveLength(1);
+    expect(corpus.warnings[0]?.reason).toMatch(/^duplicate-id:/);
+  });
+
+  test("parser-throw surfaces as a warning instead of silent skip", () => {
+    // A file that ts-morph can read syntactically but parseFeatureFile's
+    // top-level invariants reject. Easiest: a file that matches the
+    // FEATURE_FILE_PATTERN regex but contains code that crashes the
+    // parser (e.g. raw `import` from a non-resolvable module isn't
+    // enough — the parser falls back to ParseError, not a throw). Use
+    // outright invalid TypeScript.
+    const recipesDir = join(workdir, "samples", "recipes", "broken", "src");
+    mkdirSync(recipesDir, { recursive: true });
+    writeFileSync(
+      join(recipesDir, "..", "package.json"),
+      JSON.stringify({ name: "x", description: "x" }),
+    );
+    // Garbage that ts-morph still parses but as a script with errors.
+    // The parser may either return a corpus with errors (legacy entry)
+    // or throw — both branches are valid. We assert: if it *throws*,
+    // the warning is present; if it doesn't, no warning is needed.
+    writeFileSync(join(recipesDir, "feature.ts"), "this is not typescript {{{");
+
+    const corpus = buildFewShotCorpus({ repoRoot: workdir });
+    // Either path is acceptable, but the corpus must not silently
+    // disappear the file:
+    const handled =
+      corpus.entries.length === 1 ||
+      corpus.warnings.some((w) => w.sourcePath.endsWith("feature.ts"));
+    expect(handled).toBe(true);
+  });
+});
+
+// =============================================================================
+// pathToId — pure function unit tests
+// =============================================================================
+
+describe("pathToId", () => {
+  test("strips samples/ prefix and /src/feature.ts suffix", () => {
+    expect(pathToId("samples/recipes/basic-entity/src/feature.ts")).toBe("recipes/basic-entity");
+  });
+
+  test("strips packages/ prefix", () => {
+    expect(pathToId("packages/bundled-features/src/auth-email-password/feature.ts")).toBe(
+      "bundled-features/src/auth-email-password",
+    );
+  });
+
+  test("strips plain /feature.ts suffix when no /src/ in the path", () => {
+    expect(pathToId("samples/apps/showcase/src/features/demos/feature.ts")).toBe(
+      "apps/showcase/src/features/demos",
+    );
+  });
+
+  test("returns the path unchanged when no prefix or suffix matches", () => {
+    expect(pathToId("misc/random.ts")).toBe("misc/random.ts");
+  });
+
+  test("only strips the leading samples|packages prefix once (no greedy)", () => {
+    // packages/samples/foo/feature.ts: only the first prefix gets dropped.
+    expect(pathToId("packages/samples/foo/feature.ts")).toBe("samples/foo");
+  });
+});
+
+// =============================================================================
+// Helpers — feature-file content + workspace planting
+// =============================================================================
+
+function plantPackage(
+  root: string,
+  relPath: string,
+  opts: {
+    pkgName: string;
+    pkgDescription: string;
+    featureSource: string;
+  },
+): void {
+  const dir = join(root, relPath, "src");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(root, relPath, "package.json"),
+    JSON.stringify({ name: opts.pkgName, description: opts.pkgDescription }),
+  );
+  writeFileSync(join(dir, "feature.ts"), opts.featureSource);
+}
+
+/**
+ * Hand-rolled canonical-form feature-file with three kinds (entity,
+ * writeHandler, nav) so the smoke-test exercises tags + counts across
+ * categories. Mirrors `samples/recipes/designer-demo/src/feature.ts`
+ * but inlined here so the test stays self-contained.
+ */
+function buildCanonicalMultiKindFeature(featureName: string): string {
+  return `// kumiko-feature-version: 1
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+
+defineFeature("${featureName}", (r) => {
+  r.entity({
+    name: "task",
+    fields: {
+      title: { type: "text", required: true },
+      done: { type: "boolean", default: false },
+    },
+  });
+
+  r.writeHandler({
+    name: "task:create",
+    schema: z.object({ title: z.string() }),
+    handler: async (_event, _ctx) => {
+      return { isSuccess: true, data: { id: "x" } };
+    },
+    access: { roles: ["user"] },
+  });
+
+  r.nav({
+    id: "tasks",
+    label: "Tasks",
+    screen: "${featureName}:screen:task-list",
+  });
+});
+`;
+}
+
+function buildLegacyFeature(featureName: string): string {
+  // Identifier-ref style — the parser refuses (entity definition is a
+  // captured const), produces a ParseError, and the corpus marks the
+  // entry as authoringStyle: "legacy".
+  return `
+import { defineFeature, createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+
+const itemEntity = createEntity({
+  table: "items",
+  fields: { title: createTextField({ required: true }) },
+});
+
+defineFeature("${featureName}", (r) => {
+  r.entity("item", itemEntity);
+});
+`;
+}

package/src/__tests__/inject-schema.test.ts

@@ -0,0 +1,62 @@
+// injectSchema teilt sich dev-server (every HTML response) und prod-
+// server (static-fallback index.html) Pfad. Bug hier wäre stiller
+// Production-Fail: createKumikoApp findet `window.__KUMIKO_SCHEMA__`
+// nicht und mountet leer. Tests pinnen die Idempotenz + die zwei
+// Insertion-Punkte (vor /client.js-Tag oder vor </body>).
+
+import { describe, expect, test } from "vitest";
+import { injectSchema } from "../inject-schema";
+
+const SCHEMA = '{"features":[]}';
+const TAG = `<script>window.__KUMIKO_SCHEMA__=${SCHEMA};</script>`;
+
+describe("injectSchema", () => {
+  test("HTML mit /client.js-Tag: Schema-Tag wird DAVOR eingefügt", () => {
+    const html = '<html><body><script src="/client.js" defer></script></body></html>';
+    const out = injectSchema(html, SCHEMA);
+    expect(out).toContain(TAG);
+    // Schema MUSS vor dem Client-Bundle stehen — sonst läuft
+    // createKumikoApp() bevor window.__KUMIKO_SCHEMA__ gesetzt ist.
+    expect(out.indexOf(TAG)).toBeLessThan(out.indexOf('<script src="/client.js"'));
+  });
+
+  test("HTML ohne /client.js-Tag: Schema-Tag wird vor </body> eingefügt", () => {
+    const html = "<html><body><div id=root></div></body></html>";
+    const out = injectSchema(html, SCHEMA);
+    expect(out).toContain(TAG);
+    expect(out.indexOf(TAG)).toBeLessThan(out.indexOf("</body>"));
+  });
+
+  test("HTML ohne </body>: Schema-Tag wird angehängt (defensiver Fallback)", () => {
+    const html = "<div>fragment</div>";
+    const out = injectSchema(html, SCHEMA);
+    expect(out.endsWith(TAG)).toBe(true);
+  });
+
+  test("Idempotent: bei bereits injectem Schema kein zweiter Tag", () => {
+    const html = `<html><body>${TAG}</body></html>`;
+    const out = injectSchema(html, '{"features":[{"differentSchema":true}]}');
+    // Original-Tag bleibt, kein zweiter Tag hinzugefügt — der Marker-
+    // Check verhindert sonst stacking-Tags bei repeated reads.
+    expect(out).toBe(html);
+  });
+
+  test("Schema mit Komplex-Daten (entities + screens) bleibt valides JS", () => {
+    const complex = JSON.stringify({
+      features: [
+        {
+          featureName: "items",
+          entities: { item: { fields: { title: { type: "text" } } } },
+          screens: [{ id: "list", type: "entityList", entity: "item", columns: ["title"] }],
+        },
+      ],
+    });
+    const html = '<html><body><script src="/client.js"></script></body></html>';
+    const out = injectSchema(html, complex);
+    // Sanity: das injected Skript muss valid JS sein (Object-Literal-
+    // Syntax, keine HTML-Reserved-Chars im JSON die den <script>-Block
+    // brechen würden — JSON.stringify entkommt /, < usw. nicht, aber
+    // die Standard-Chars die wir hier nutzen sind unkritisch).
+    expect(out).toContain(`window.__KUMIKO_SCHEMA__=${complex}`);
+  });
+});