@cosmicdrift/kumiko-dev-server 0.328.1 → 0.330.0

package/src/__tests__/saas-identity-wire.integration.test.ts

@@ -1,427 +0,0 @@
-// Cross-feature SaaS identity wire suite — one mount that mirrors a real app
-// stack (composeIdentityStack + delivery + renderer + channel-email) and drives
-// the happy paths apps always need. Proves auth ↔ delivery mail ↔ sessions
-// (login jti + mine) ↔ MFA challenge/verify. Renderer stack is mounted for
-// delivery deps; channel-email uses an injected in-memory transport (not a
-// template-resolver round-trip). Edge cases stay in per-feature suites.
-
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { AuthErrors, AuthHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import {
-  seedAdmin,
-  seedUserWithPassword,
-} from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import {
-  AuthMfaHandlers,
-  base32Decode,
-  bindMfaRevokeAllOtherSessionsFromFeature,
-  userMfaEntity,
-  userMfaTable,
-} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { currentTotpCode } from "@cosmicdrift/kumiko-bundled-features/auth-mfa/testing";
-import {
-  createChannelEmailFeature,
-  createInMemoryTransport,
-} from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import {
-  configValuesTable,
-  createConfigResolver,
-} from "@cosmicdrift/kumiko-bundled-features/config";
-import { createDeliveryTestContext } from "@cosmicdrift/kumiko-bundled-features/delivery";
-import { notificationPreferencesTable } from "@cosmicdrift/kumiko-bundled-features/delivery/tables";
-import { simpleRenderer } from "@cosmicdrift/kumiko-bundled-features/renderer-simple";
-import {
-  createSessionCallbacks,
-  type SessionCallbacks,
-  SessionQueries,
-  userSessionEntity,
-  userSessionTable,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { sessionCallbacksFromLateBound } from "@cosmicdrift/kumiko-bundled-features/sessions/testing";
-import {
-  tenantEntity,
-  tenantInvitationEntity,
-  tenantInvitationsTable,
-  tenantMembershipsTable,
-  tenantTable,
-} from "@cosmicdrift/kumiko-bundled-features/tenant";
-import {
-  seedTenant,
-  seedTenantMembership,
-} from "@cosmicdrift/kumiko-bundled-features/tenant/seeding";
-import { userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
-import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  setupTestStack,
-  type TestStack,
-  unsafeCreateEntityTable,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createLateBoundHolder,
-  createTestEnvelopeCipher,
-  deleteRows,
-  updateRows,
-} from "@cosmicdrift/kumiko-framework/testing";
-import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-import * as jose from "jose";
-import { composeIdentityStack, composeOpsStack, composeRendererStack } from "../compose-stacks";
-
-const SETUP_TOKEN_SECRET = "wire-mfa-setup-secret-at-least-32-bytes-long!!";
-const CHALLENGE_TOKEN_SECRET = "wire-mfa-challenge-secret-at-least-32-bytes!!";
-const RESET_SECRET = randomBytes(32).toString("base64");
-const VERIFY_SECRET = randomBytes(32).toString("base64");
-const APP_SIGNUP_URL = "https://app.example.com/signup/complete";
-const APP_RESET_URL = "https://app.example.com/reset";
-const APP_VERIFY_URL = "https://app.example.com/verify";
-const APP_INVITE_URL = "https://app.example.com/invite/accept";
-
-const emailTransport = createInMemoryTransport();
-const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
-
-let stack: TestStack;
-
-function extractTokenFromMail(html: string): string {
-  const match = html.match(/[?&]token=([^&"'<\s]+)/);
-  if (!match?.[1]) throw new Error(`No token in mail html: ${html.slice(0, 200)}`);
-  return decodeURIComponent(match[1]);
-}
-
-async function markVerified(userId: string): Promise<void> {
-  await updateRows(stack.db, userTable, { emailVerified: true }, { id: userId });
-}
-
-// writeOk drives real HTTP through the auth middleware, so a hand-built
-// actor needs a live sid — sessionChecker rejects sidless JWTs.
-async function withSession(user: SessionUser): Promise<SessionUser> {
-  const sid = await callbacks.get().sessionCreator(user, { ip: "127.0.0.1", userAgent: "test" });
-  return { ...user, sid };
-}
-
-beforeAll(async () => {
-  configureEntityFieldEncryption(createTestEnvelopeCipher());
-  const bound = sessionCallbacksFromLateBound(callbacks);
-
-  const identity = composeIdentityStack({
-    mfa: {
-      setupTokenSecret: SETUP_TOKEN_SECRET,
-      challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
-      issuer: "Kumiko Wire",
-    },
-  });
-  const mfaFeature = identity.find((f) => f.name === "auth-mfa");
-  if (!mfaFeature) throw new Error("composeIdentityStack did not mount auth-mfa");
-
-  const features = composeFeatures(
-    [
-      ...identity,
-      ...composeOpsStack({ delivery: true, audit: false, jobs: false }),
-      ...composeRendererStack(),
-      createChannelEmailFeature({
-        transport: emailTransport,
-        renderer: simpleRenderer,
-        resolveEmail: async () => "unused@test.local",
-      }),
-    ],
-    {
-      includeBundled: true,
-      authOptions: {
-        signup: { tokenTtlMinutes: 60, appUrl: APP_SIGNUP_URL },
-        invite: { tokenTtlMinutes: 60, appUrl: APP_INVITE_URL },
-        passwordReset: {
-          hmacSecret: RESET_SECRET,
-          tokenTtlMinutes: 15,
-          appUrl: APP_RESET_URL,
-        },
-        emailVerification: {
-          hmacSecret: VERIFY_SECRET,
-          tokenTtlMinutes: 60,
-          mode: "strict",
-          appUrl: APP_VERIFY_URL,
-        },
-      },
-    },
-  );
-
-  stack = await setupTestStack({
-    features,
-    extraContext: (deps) => ({
-      ...createDeliveryTestContext(deps),
-      configResolver: createConfigResolver(),
-    }),
-    authConfig: {
-      ...bound.asAuthConfig(),
-      // sessionChecker rejects sidless JWTs — hand-built actors used with
-      // writeOk go through withSession() to get a live sid first.
-      membershipQuery: "tenant:query:memberships",
-      loginHandler: AuthHandlers.login,
-      mfaVerifyHandler: AuthMfaHandlers.verify,
-      loginErrorStatusMap: {
-        [AuthErrors.invalidCredentials]: 401,
-        [AuthErrors.noMembership]: 403,
-        [AuthErrors.emailNotVerified]: 403,
-      },
-      signup: {
-        requestHandler: AuthHandlers.signupRequest,
-        confirmHandler: AuthHandlers.signupConfirm,
-      },
-      passwordReset: {
-        requestHandler: AuthHandlers.requestPasswordReset,
-        confirmHandler: AuthHandlers.resetPassword,
-      },
-      emailVerification: {
-        requestHandler: AuthHandlers.requestEmailVerification,
-        confirmHandler: AuthHandlers.verifyEmail,
-      },
-      invite: {
-        acceptHandler: AuthHandlers.inviteAccept,
-        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
-        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
-      },
-    },
-  });
-
-  const sessionCallbacks = createSessionCallbacks({ db: stack.db });
-  callbacks.set(sessionCallbacks);
-  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers);
-
-  await unsafeCreateEntityTable(stack.db, userEntity);
-  await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
-  await unsafeCreateEntityTable(stack.db, userMfaEntity);
-  await unsafeCreateEntityTable(stack.db, userSessionEntity);
-  await unsafePushTables(stack.db, {
-    configValuesTable,
-    tenantMembershipsTable,
-    notificationPreferencesTable,
-    userSessionTable,
-  });
-});
-
-afterAll(async () => {
-  await stack?.cleanup();
-  configureEntityFieldEncryption(undefined);
-});
-
-beforeEach(async () => {
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
-  await deleteRows(stack.db, userSessionTable, {});
-  await deleteRows(stack.db, userMfaTable, {});
-  emailTransport.sent.length = 0;
-  for (const pattern of ["signup:*", "invite:*"] as const) {
-    const keys = await stack.redis.redis.keys(pattern);
-    if (keys.length > 0) await stack.redis.redis.del(...keys);
-  }
-});
-
-describe("saas-identity-wire", () => {
-  test("signup → delivery mail → confirm → login JWT with sid", async () => {
-    const email = "signup-wire@example.com";
-    const password = "fresh-secure-pw-1234";
-
-    const req = await stack.http.raw("POST", "/api/auth/signup-request", { email });
-    expect(req.status).toBe(200);
-    expect(emailTransport.sent).toHaveLength(1);
-    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
-
-    const confirm = await stack.http.raw("POST", "/api/auth/signup-confirm", { token, password });
-    expect(confirm.status).toBe(200);
-
-    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
-    expect(login.status).toBe(200);
-    const body = (await login.json()) as { token?: string };
-    expect(body.token).toBeTypeOf("string");
-    expect(typeof jose.decodeJwt(body.token!).jti).toBe("string");
-  });
-
-  test("password reset → delivery mail → reset → login with new password", async () => {
-    const email = "reset-wire@example.com";
-    const oldPassword = "old-password-1234";
-    const newPassword = "new-password-5678";
-    const tenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
-    const { id } = await seedAdmin(stack.db, {
-      email,
-      password: oldPassword,
-      displayName: "Reset",
-      memberships: [
-        {
-          tenantId,
-          tenantKey: "reset-wire",
-          tenantName: "Reset Wire",
-          roles: ["User"],
-        },
-      ],
-    });
-    await markVerified(id);
-
-    const req = await stack.http.raw("POST", "/api/auth/request-password-reset", { email });
-    expect(req.status).toBe(200);
-    expect(emailTransport.sent).toHaveLength(1);
-    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
-
-    const reset = await stack.http.raw("POST", "/api/auth/reset-password", {
-      token,
-      newPassword,
-    });
-    expect(reset.status).toBe(200);
-
-    const oldLogin = await stack.http.raw("POST", "/api/auth/login", {
-      email,
-      password: oldPassword,
-    });
-    expect(oldLogin.status).toBe(401);
-
-    const login = await stack.http.raw("POST", "/api/auth/login", { email, password: newPassword });
-    expect(login.status).toBe(200);
-    const body = (await login.json()) as { token?: string };
-    expect(body.token).toBeTypeOf("string");
-  });
-
-  test("invite Branch3 → signup-complete → login", async () => {
-    const tenantId = crypto.randomUUID() as TenantId;
-    const { id: adminId } = await seedAdmin(stack.db, {
-      email: "admin-wire@example.com",
-      password: "admin-password-1234",
-      displayName: "Admin",
-      memberships: [
-        {
-          tenantId,
-          tenantKey: `invite-${tenantId.slice(0, 8)}`,
-          tenantName: "Invite Wire",
-          roles: ["Admin"],
-        },
-      ],
-    });
-    await markVerified(adminId);
-
-    const admin = await withSession({ id: adminId, tenantId, roles: ["Admin"] });
-    const invitee = "carol-wire@example.com";
-    await stack.http.writeOk(AuthHandlers.inviteCreate, { email: invitee, role: "User" }, admin);
-    expect(emailTransport.sent.length).toBeGreaterThanOrEqual(1);
-    const token = extractTokenFromMail(emailTransport.sent.at(-1)?.html ?? "");
-
-    const complete = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
-      token,
-      password: "carol-new-pw-1234",
-    });
-    expect(complete.status).toBe(200);
-
-    const login = await stack.http.raw("POST", "/api/auth/login", {
-      email: invitee,
-      password: "carol-new-pw-1234",
-    });
-    expect(login.status).toBe(200);
-  });
-
-  test("email verify gate: unverified blocked → verify → login ok", async () => {
-    const email = "verify-wire@example.com";
-    const password = "verify-password-1234";
-    const tenantId = "00000000-0000-4000-8000-000000000002" as TenantId;
-    await seedTenant(stack.db, {
-      id: tenantId,
-      key: "verify-wire",
-      name: "Verify Wire",
-    });
-    const { id } = await seedUserWithPassword(stack.db, {
-      email,
-      password,
-      displayName: "Verify",
-      emailVerified: false,
-    });
-    await seedTenantMembership(stack.db, {
-      userId: id,
-      tenantId,
-      roles: ["User"],
-    });
-
-    const blocked = await stack.http.raw("POST", "/api/auth/login", { email, password });
-    expect(blocked.status).toBe(403);
-    const blockedBody = (await blocked.json()) as { error?: { details?: { reason?: string } } };
-    expect(blockedBody.error?.details?.reason).toBe(AuthErrors.emailNotVerified);
-
-    const req = await stack.http.raw("POST", "/api/auth/request-email-verification", { email });
-    expect(req.status).toBe(200);
-    expect(emailTransport.sent).toHaveLength(1);
-    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
-
-    const verify = await stack.http.raw("POST", "/api/auth/verify-email", { token });
-    expect(verify.status).toBe(200);
-
-    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
-    expect(login.status).toBe(200);
-  });
-
-  test("MFA enable → login challenges → verify JWT; sessions:mine lists sid", async () => {
-    const email = "mfa-wire@example.com";
-    const password = "mfa-password-1234";
-    const tenantId = "00000000-0000-4000-8000-000000000003" as TenantId;
-    const { id: userId } = await seedAdmin(stack.db, {
-      email,
-      password,
-      displayName: "Mfa",
-      memberships: [
-        {
-          tenantId,
-          tenantKey: "mfa-wire",
-          tenantName: "MFA Wire",
-          roles: ["User"],
-        },
-      ],
-    });
-    await markVerified(userId);
-    const user = await withSession({ id: userId, tenantId, roles: ["User"] });
-
-    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
-      AuthMfaHandlers.enableStart,
-      { accountLabel: email },
-      user,
-    );
-    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
-    const secret = base32Decode(secretParam);
-    await stack.http.writeOk(
-      AuthMfaHandlers.enableConfirm,
-      { setupToken: start.setupToken, code: currentTotpCode(secret) },
-      user,
-    );
-
-    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
-    expect(login.status).toBe(200);
-    const challenge = (await login.json()) as {
-      mfaRequired?: boolean;
-      challengeToken?: string;
-      token?: string;
-    };
-    expect(challenge.mfaRequired).toBe(true);
-    expect(challenge.token).toBeUndefined();
-    expect(challenge.challengeToken).toBeTypeOf("string");
-
-    const verify = await stack.http.raw("POST", "/api/auth/mfa/verify", {
-      challengeToken: challenge.challengeToken,
-      code: currentTotpCode(secret),
-    });
-    expect(verify.status).toBe(200);
-    const { token } = (await verify.json()) as { token: string };
-    expect(token).toBeTypeOf("string");
-    const sid = jose.decodeJwt(token).jti;
-    expect(typeof sid).toBe("string");
-
-    const mineRes = await stack.http.raw(
-      "POST",
-      "/api/query",
-      { type: SessionQueries.mine, payload: {} },
-      { Authorization: `Bearer ${token}` },
-    );
-    expect(mineRes.status).toBe(200);
-    const mineBody = (await mineRes.json()) as { data: { rows: Array<{ id: string }> } };
-    expect(mineBody.data.rows.some((s) => s.id === sid)).toBe(true);
-
-    const rows = await selectMany(stack.db, userSessionTable, { userId });
-    expect(rows.length).toBeGreaterThanOrEqual(1);
-  });
-});

package/src/__tests__/scaffold-app-feature.test.ts

@@ -1,216 +0,0 @@
-// scaffoldAppFeature unit-tests (DX-2).
-
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { scaffoldApp } from "../scaffold-app";
-import { scaffoldAppFeature } from "../scaffold-app-feature";
-
-describe("scaffoldAppFeature", () => {
-  let tmp: string;
-  let appRoot: string;
-  beforeEach(async () => {
-    tmp = mkdtempSync(join(tmpdir(), "scaffold-app-feature-"));
-    appRoot = join(tmp, "my-shop");
-    await scaffoldApp({ name: "my-shop", destination: appRoot });
-  });
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  test("scaffolds die volle App-Feature-Konvention", () => {
-    const result = scaffoldAppFeature({ name: "product-catalog", appRoot });
-    expect(result.featureName).toBe("product-catalog");
-    expect(result.files).toEqual([
-      "src/features/product-catalog/feature.ts",
-      "src/features/product-catalog/index.ts",
-      "src/features/product-catalog/constants.ts",
-      "src/features/product-catalog/i18n.ts",
-      "src/features/product-catalog/schema/product-catalog-item.ts",
-      "src/features/product-catalog/schema/index.ts",
-      "src/features/product-catalog/web/index.ts",
-      "src/features/product-catalog/__tests__/feature.boot.test.ts",
-    ]);
-    for (const file of result.files) {
-      expect(existsSync(join(appRoot, file))).toBe(true);
-    }
-  });
-
-  test("feature.ts registriert nur — Entity aus schema/, Keys aus i18n.ts", () => {
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const feature = readFileSync(join(appRoot, "src/features/product-catalog/feature.ts"), "utf-8");
-    expect(feature).toContain("defineFeature(PRODUCT_CATALOG_FEATURE");
-    expect(feature).toContain("export const productCatalogFeature");
-    expect(feature).toContain('r.entity("product-catalog-item", productCatalogItemEntity)');
-    expect(feature).toContain('type: "entityList"');
-    expect(feature).toContain("r.translations({ keys: productCatalogTranslationKeys })");
-    // Konvention: Entity-Felder leben in schema/, nicht inline in feature.ts.
-    expect(feature).not.toContain("fields:");
-  });
-
-  test("Starter erfüllt Boot-Constraints: sortable-Feld, defaultSort, i18n-Pflichtkeys", () => {
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const entity = readFileSync(
-      join(appRoot, "src/features/product-catalog/schema/product-catalog-item.ts"),
-      "utf-8",
-    );
-    expect(entity).toContain("sortable: true");
-    const feature = readFileSync(join(appRoot, "src/features/product-catalog/feature.ts"), "utf-8");
-    expect(feature).toContain('defaultSort: { field: "title", dir: "asc" }');
-    const i18n = readFileSync(join(appRoot, "src/features/product-catalog/i18n.ts"), "utf-8");
-    expect(i18n).toContain('"screen:items.title"');
-    expect(i18n).toContain('"product-catalog:entity:product-catalog-item:field:title"');
-  });
-
-  test("web/index.ts ist Client-Stub, __tests__ enthält validateBoot-Test", () => {
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const web = readFileSync(join(appRoot, "src/features/product-catalog/web/index.ts"), "utf-8");
-    expect(web).toContain("@runtime client");
-    expect(web).toContain("export const productCatalogClient: ClientFeatureDefinition");
-    const bootTest = readFileSync(
-      join(appRoot, "src/features/product-catalog/__tests__/feature.boot.test.ts"),
-      "utf-8",
-    );
-    expect(bootTest).toContain("validateBoot([productCatalogFeature])");
-  });
-
-  test("auto-mounts in src/run-config.ts (import + APP_FEATURES entry)", () => {
-    const result = scaffoldAppFeature({ name: "product-catalog", appRoot });
-    expect(result.autoMounted).toBe(true);
-    const runConfig = readFileSync(join(appRoot, "src/run-config.ts"), "utf-8");
-    expect(runConfig).toContain(
-      `import { productCatalogFeature } from "./features/product-catalog";`,
-    );
-    expect(runConfig).toContain("productCatalogFeature");
-    // APP_FEATURES still ends with `as const`
-    expect(runConfig).toMatch(/\]\s*as const;/);
-  });
-
-  test("mounting a second feature keeps the first feature's import exactly once", () => {
-    // Cross-feature non-duplication: adding billing must not touch the
-    // product-catalog import/entry. Same-feature re-mount idempotency is the
-    // next test — the dir-exists guard blocks a direct second scaffold of the
-    // same name, so this one cannot reach the short-circuit branches.
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const firstRunConfig = readFileSync(join(appRoot, "src/run-config.ts"), "utf-8");
-    scaffoldAppFeature({ name: "billing", appRoot });
-    const secondRunConfig = readFileSync(join(appRoot, "src/run-config.ts"), "utf-8");
-    expect(secondRunConfig).toContain("productCatalogFeature");
-    expect(secondRunConfig).toContain("billingFeature");
-    // Count: each feature-import appears exactly once.
-    const occurrences = secondRunConfig.match(/productCatalogFeature/g) ?? [];
-    expect(occurrences.length).toBe(2); // 1 import + 1 array-entry
-    expect(firstRunConfig.length).toBeLessThan(secondRunConfig.length);
-  });
-
-  test("idempotent: re-scaffolding the same feature is a full no-op on run-config", () => {
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const runConfigPath = join(appRoot, "src/run-config.ts");
-    const afterFirst = readFileSync(runConfigPath, "utf-8");
-
-    // Drop only the feature dir so the dir-exists guard doesn't trip; the
-    // run-config import + APP_FEATURES entry both survive. The re-scaffold must
-    // hit the full short-circuit in mountInRunConfig (import present AND
-    // alreadyListed → changed=false → no save) and duplicate neither half —
-    // the branch the cross-feature test above never reaches.
-    rmSync(join(appRoot, "src/features/product-catalog"), { recursive: true, force: true });
-    const result = scaffoldAppFeature({ name: "product-catalog", appRoot });
-    expect(result.autoMounted).toBe(true);
-
-    const afterSecond = readFileSync(runConfigPath, "utf-8");
-    expect(afterSecond).toBe(afterFirst); // byte-identical: no save, no duplication
-    expect((afterSecond.match(/productCatalogFeature/g) ?? []).length).toBe(2);
-  });
-
-  test("self-heals a half-mounted run-config: import present but APP_FEATURES entry removed", () => {
-    scaffoldAppFeature({ name: "product-catalog", appRoot });
-    const runConfigPath = join(appRoot, "src/run-config.ts");
-
-    // Simulate a half-applied state: the feature dir is gone and the
-    // APP_FEATURES entry was hand-removed, but the import line still lingers.
-    rmSync(join(appRoot, "src/features/product-catalog"), { recursive: true, force: true });
-    const stripped = readFileSync(runConfigPath, "utf-8")
-      // Drop the APP_FEATURES array element (appended last, so `, productCatalogFeature`
-      // right before the closing `]`). The import `{ productCatalogFeature }` is
-      // followed by ` }`, not `]`/`,`, so the lookahead leaves it intact.
-      .replace(/,\s*productCatalogFeature(?=\s*\])/, "");
-    writeFileSync(runConfigPath, stripped, "utf-8");
-    // Guard the simulation itself: the import must remain, the array entry must
-    // be gone — exactly one mention left. Without this, a regex that failed to
-    // strip would leave the entry in place and the test would false-pass.
-    expect(stripped).toContain(
-      'import { productCatalogFeature } from "./features/product-catalog";',
-    );
-    expect((stripped.match(/productCatalogFeature/g) ?? []).length).toBe(1);
-
-    // Re-scaffold: dir is gone so it proceeds; mountInRunConfig sees the import
-    // already present and must still re-add the missing APP_FEATURES entry.
-    const result = scaffoldAppFeature({ name: "product-catalog", appRoot });
-    expect(result.autoMounted).toBe(true);
-
-    const healed = readFileSync(runConfigPath, "utf-8");
-    // Import stays exactly once; the array entry is back.
-    const occurrences = healed.match(/productCatalogFeature/g) ?? [];
-    expect(occurrences.length).toBe(2); // 1 import + 1 array-entry
-    expect(healed).toMatch(/\]\s*as const;/);
-  });
-
-  test("gescaffoldetes Feature bootet wirklich (validateBoot über dynamic import)", async () => {
-    // Ins Repo scaffolden (nicht os.tmpdir): nur hier löst der dynamic
-    // import "@cosmicdrift/kumiko-framework/engine" über node_modules auf.
-    const repoTmp = mkdtempSync(join(import.meta.dir, ".tmp-scaffold-"));
-    try {
-      scaffoldAppFeature({ name: "boot-probe", appRoot: repoTmp });
-      const mod = (await import(join(repoTmp, "src/features/boot-probe/feature.ts"))) as {
-        readonly bootProbeFeature: Parameters<typeof validateBoot>[0][number];
-      };
-      expect(() => validateBoot([mod.bootProbeFeature])).not.toThrow();
-    } finally {
-      rmSync(repoTmp, { recursive: true, force: true });
-    }
-  });
-
-  test("rejects non-kebab-case", () => {
-    expect(() => scaffoldAppFeature({ name: "ProductCatalog", appRoot })).toThrow(/kebab-case/);
-    expect(() => scaffoldAppFeature({ name: "product_catalog", appRoot })).toThrow(/kebab-case/);
-  });
-
-  test("rejects trailing- and double-hyphen names (kebabToCamel would break)", () => {
-    // `product-` → kebabToCamel leaves a trailing hyphen → `product-Feature`,
-    // an invalid identifier. The segment-strict regex must reject these.
-    expect(() => scaffoldAppFeature({ name: "product-", appRoot })).toThrow(/kebab-case/);
-    expect(() => scaffoldAppFeature({ name: "foo--bar", appRoot })).toThrow(/kebab-case/);
-  });
-
-  test("rolls back the scaffolded dir when run-config has no APP_FEATURES (re-run not blocked)", () => {
-    // run-config exists but is the wrong shape → mountInRunConfig throws. The
-    // feature files were already written; without rollback a re-run would hit
-    // the "already exists" guard and the user would be stuck.
-    const runConfigPath = join(appRoot, "src/run-config.ts");
-    writeFileSync(runConfigPath, "export const NOT_APP_FEATURES = [];\n", "utf-8");
-
-    expect(() => scaffoldAppFeature({ name: "orders", appRoot })).toThrow(/APP_FEATURES/);
-    // Rolled back: the half-written feature dir is gone.
-    expect(existsSync(join(appRoot, "src/features/orders"))).toBe(false);
-
-    // Re-run with a valid run-config now succeeds instead of "already exists".
-    writeFileSync(runConfigPath, "export const APP_FEATURES = [] as const;\n", "utf-8");
-    const result = scaffoldAppFeature({ name: "orders", appRoot });
-    expect(result.autoMounted).toBe(true);
-    expect(existsSync(join(appRoot, "src/features/orders/feature.ts"))).toBe(true);
-  });
-
-  test("refuses to overwrite existing feature dir", () => {
-    scaffoldAppFeature({ name: "billing", appRoot });
-    expect(() => scaffoldAppFeature({ name: "billing", appRoot })).toThrow(/already exists/);
-  });
-
-  test("autoMounted=false when run-config.ts is missing", () => {
-    const emptyRoot = join(tmp, "no-app");
-    expect(() => scaffoldAppFeature({ name: "foo", appRoot: emptyRoot })).not.toThrow();
-    const result = scaffoldAppFeature({ name: "bar", appRoot: emptyRoot });
-    expect(result.autoMounted).toBe(false);
-  });
-});