@cosmicdrift/kumiko-dev-server 1.0.0 → 2.0.0

package/src/__tests__/few-shot-corpus.test.ts

@@ -44,7 +44,7 @@ describe("buildFewShotCorpus — smoke", () => {
     });
     plantPackage(workdir, "samples/recipes/legacy-demo", {
       pkgName: "@cosmicdrift/kumiko-sample-legacy-demo",
-      pkgDescription: "Identifier-ref-style legacy feature.",
+      pkgDescription: "Handler-object-reference-style legacy feature.",
       featureSource: buildLegacyFeature("legacyDemo"),
     });
 
@@ -169,7 +169,7 @@ describe("buildFewShotCorpus — warnings", () => {
 
     expect(corpus.entries).toHaveLength(1);
     expect(corpus.warnings).toHaveLength(1);
-    expect(corpus.warnings[0]?.reason).toMatch(/^duplicate-id:/);
+    expect(corpus.warnings[0]?.message).toMatch(/^duplicate-id:/);
   });
 
   test("parser-throw surfaces as a warning instead of silent skip", () => {
@@ -293,19 +293,24 @@ defineFeature("${featureName}", (r) => {
 }
 
 function buildLegacyFeature(featureName: string): string {
-  // Identifier-ref style — the parser refuses (entity definition is a
-  // captured const), produces a ParseError, and the corpus marks the
-  // entry as authoringStyle: "legacy".
+  // Handler-object-reference style — writeHandler receives a single
+  // identifier referencing a pre-built handler object rather than an
+  // inline string name + schema + handler. The parser has no extractor
+  // shape for that (it only reads a literal name as the first arg, or
+  // an inline object-literal form), so it produces a ParseError and the
+  // corpus marks the entry as authoringStyle: "legacy".
+  //
+  // Note: a captured-const *entity definition* (`r.entity("x", xEntity)`)
+  // used to be the legacy example here, but #998 taught the parser to
+  // resolve such references via a raw-ref sentinel — that idiom parses
+  // cleanly now and no longer exercises the legacy path.
   return `
-import { defineFeature, createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
-const itemEntity = createEntity({
-  table: "items",
-  fields: { title: createTextField({ required: true }) },
-});
+const itemCreateHandler = { name: "item:create" };
 
 defineFeature("${featureName}", (r) => {
-  r.entity("item", itemEntity);
+  r.writeHandler(itemCreateHandler);
 });
 `;
 }

package/src/__tests__/merge-extra-context.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+import { mergeExtraContext } from "../setup-test-stack-from-features";
+
+// #882/4: the integration test only asserted getFeature("config") — which
+// includeBundled already provides — never that presets:["config"] actually
+// merges configResolver/textContent into extraContext. Unit-test the merge
+// directly instead.
+
+const fakeDeps = {
+  registry: {} as never,
+  db: { marker: "fake-db" } as never,
+  sseBroker: {} as never,
+  redis: {} as never,
+};
+
+describe("mergeExtraContext", () => {
+  test("no presets → returns base untouched (function passthrough)", () => {
+    const base = () => ({ foo: "bar" });
+    const merged = mergeExtraContext(base, []);
+    expect(merged).toBe(base);
+  });
+
+  test("no presets → returns base untouched (object passthrough)", () => {
+    const base = { foo: "bar" };
+    const merged = mergeExtraContext(base, []);
+    expect(merged).toBe(base);
+  });
+
+  test("config preset merges configResolver, keeping base-object fields", () => {
+    const merged = mergeExtraContext({ foo: "bar" }, ["config"]);
+    expect(typeof merged).toBe("function");
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["foo"]).toBe("bar");
+    expect(result["configResolver"]).toBeDefined();
+  });
+
+  test("config preset merges configResolver, keeping base-fn fields", () => {
+    const merged = mergeExtraContext(() => ({ fromFn: 1 }), ["config"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["fromFn"]).toBe(1);
+    expect(result["configResolver"]).toBeDefined();
+  });
+
+  test("text-content preset merges textContent, built from deps.db", () => {
+    const merged = mergeExtraContext(undefined, ["text-content"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["textContent"]).toBeDefined();
+  });
+
+  test("both presets merge both fields", () => {
+    const merged = mergeExtraContext(undefined, ["config", "text-content"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["configResolver"]).toBeDefined();
+    expect(result["textContent"]).toBeDefined();
+  });
+});

package/src/__tests__/resolve-stylesheet.test.ts

@@ -64,6 +64,22 @@ describe("resolveStylesheet", () => {
     }
   });
 
+  test("Bun.resolveSync failure → undefined (catch path, no throw)", () => {
+    const tmpDir = realpathSync(mkdtempSync(join(tmpdir(), "kumiko-resolve-catch-")));
+    const cwdBefore = process.cwd();
+    process.chdir(tmpDir);
+    try {
+      const out = resolveStylesheet({
+        features: [],
+        clientEntry: "./entry.tsx",
+      });
+      expect(out).toBeUndefined();
+    } finally {
+      process.chdir(cwdBefore);
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
   test("undefined + clientEntry + src/styles.css existiert → returns App-Theme-Override", () => {
     // Auto-Detection greift VOR dem renderer-web-Fallback: Wenn die App
     // ein eigenes src/styles.css hat (App-Theme-Pattern), wird das

package/src/__tests__/saas-identity-wire.integration.test.ts

@@ -0,0 +1,430 @@
+// Cross-feature SaaS identity wire suite — one mount that mirrors a real app
+// stack (composeIdentityStack + delivery + renderer + channel-email) and drives
+// the happy paths apps always need. Proves auth ↔ delivery mail ↔ sessions
+// (login jti + mine) ↔ MFA challenge/verify. Renderer stack is mounted for
+// delivery deps; channel-email uses an injected in-memory transport (not a
+// template-resolver round-trip). Edge cases stay in per-feature suites.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { AuthErrors, AuthHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import {
+  seedAdmin,
+  seedUserWithPassword,
+} from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
+import {
+  AuthMfaHandlers,
+  base32Decode,
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  userMfaEntity,
+  userMfaTable,
+} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { currentTotpCode } from "@cosmicdrift/kumiko-bundled-features/auth-mfa/testing";
+import {
+  createChannelEmailFeature,
+  createInMemoryTransport,
+} from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import {
+  configValuesTable,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import { createDeliveryTestContext } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { notificationPreferencesTable } from "@cosmicdrift/kumiko-bundled-features/delivery/tables";
+import { simpleRenderer } from "@cosmicdrift/kumiko-bundled-features/renderer-simple";
+import {
+  createSessionCallbacks,
+  type SessionCallbacks,
+  SessionQueries,
+  userSessionEntity,
+  userSessionTable,
+} from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { sessionCallbacksFromLateBound } from "@cosmicdrift/kumiko-bundled-features/sessions/testing";
+import {
+  tenantEntity,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+  tenantMembershipsTable,
+  tenantTable,
+} from "@cosmicdrift/kumiko-bundled-features/tenant";
+import {
+  seedTenant,
+  seedTenantMembership,
+} from "@cosmicdrift/kumiko-bundled-features/tenant/seeding";
+import { userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  deleteRows,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import * as jose from "jose";
+import { composeIdentityStack, composeOpsStack, composeRendererStack } from "../compose-stacks";
+
+const SETUP_TOKEN_SECRET = "wire-mfa-setup-secret-at-least-32-bytes-long!!";
+const CHALLENGE_TOKEN_SECRET = "wire-mfa-challenge-secret-at-least-32-bytes!!";
+const RESET_SECRET = randomBytes(32).toString("base64");
+const VERIFY_SECRET = randomBytes(32).toString("base64");
+const APP_SIGNUP_URL = "https://app.example.com/signup/complete";
+const APP_RESET_URL = "https://app.example.com/reset";
+const APP_VERIFY_URL = "https://app.example.com/verify";
+const APP_INVITE_URL = "https://app.example.com/invite/accept";
+
+const emailTransport = createInMemoryTransport();
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+let stack: TestStack;
+
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
+async function markVerified(userId: string): Promise<void> {
+  await updateRows(stack.db, userTable, { emailVerified: true }, { id: userId });
+}
+
+// writeOk drives real HTTP through the auth middleware, so a hand-built
+// actor needs a live sid — sessionChecker rejects sidless JWTs.
+async function withSession(user: SessionUser): Promise<SessionUser> {
+  const sid = await callbacks.get().sessionCreator(user, { ip: "127.0.0.1", userAgent: "test" });
+  return { ...user, sid };
+}
+
+beforeAll(async () => {
+  configureEntityFieldEncryption(createTestEnvelopeCipher());
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  const identity = composeIdentityStack({
+    mfa: {
+      setupTokenSecret: SETUP_TOKEN_SECRET,
+      challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      issuer: "Kumiko Wire",
+    },
+  });
+  const mfaFeature = identity.find((f) => f.name === "auth-mfa");
+  if (!mfaFeature) throw new Error("composeIdentityStack did not mount auth-mfa");
+
+  const features = composeFeatures(
+    [
+      ...identity,
+      ...composeOpsStack({ delivery: true, audit: false, jobs: false }),
+      ...composeRendererStack(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+    ],
+    {
+      includeBundled: true,
+      authOptions: {
+        signup: { tokenTtlMinutes: 60, appUrl: APP_SIGNUP_URL },
+        invite: { tokenTtlMinutes: 60, appUrl: APP_INVITE_URL },
+        passwordReset: {
+          hmacSecret: RESET_SECRET,
+          tokenTtlMinutes: 15,
+          appUrl: APP_RESET_URL,
+        },
+        emailVerification: {
+          hmacSecret: VERIFY_SECRET,
+          tokenTtlMinutes: 60,
+          mode: "strict",
+          appUrl: APP_VERIFY_URL,
+        },
+      },
+    },
+  );
+
+  stack = await setupTestStack({
+    features,
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      ...bound.asAuthConfig(),
+      // sessionChecker rejects sidless JWTs — hand-built actors used with
+      // writeOk go through withSession() to get a live sid first.
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      mfaVerifyHandler: AuthMfaHandlers.verify,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+        [AuthErrors.emailNotVerified]: 403,
+      },
+      signup: {
+        requestHandler: AuthHandlers.signupRequest,
+        confirmHandler: AuthHandlers.signupConfirm,
+      },
+      passwordReset: {
+        requestHandler: AuthHandlers.requestPasswordReset,
+        confirmHandler: AuthHandlers.resetPassword,
+      },
+      emailVerification: {
+        requestHandler: AuthHandlers.requestEmailVerification,
+        confirmHandler: AuthHandlers.verifyEmail,
+      },
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  const sessionCallbacks = createSessionCallbacks({ db: stack.db });
+  callbacks.set(sessionCallbacks);
+  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+    userSessionTable,
+  });
+});
+
+afterAll(async () => {
+  await stack?.cleanup();
+  configureEntityFieldEncryption(undefined);
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  await deleteRows(stack.db, userSessionTable, {});
+  await deleteRows(stack.db, userMfaTable, {});
+  emailTransport.sent.length = 0;
+  for (const pattern of ["signup:*", "invite:*"] as const) {
+    const keys = await stack.redis.redis.keys(pattern);
+    if (keys.length > 0) await stack.redis.redis.del(...keys);
+  }
+});
+
+describe("saas-identity-wire", () => {
+  test("signup → delivery mail → confirm → login JWT with sid", async () => {
+    const email = "signup-wire@example.com";
+    const password = "fresh-secure-pw-1234";
+
+    const req = await stack.http.raw("POST", "/api/auth/signup-request", { email });
+    expect(req.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(1);
+    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
+
+    const confirm = await stack.http.raw("POST", "/api/auth/signup-confirm", { token, password });
+    expect(confirm.status).toBe(200);
+
+    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
+    expect(login.status).toBe(200);
+    const body = (await login.json()) as { token?: string };
+    expect(body.token).toBeTypeOf("string");
+    expect(typeof jose.decodeJwt(body.token!).jti).toBe("string");
+  });
+
+  test("password reset → delivery mail → reset → login with new password", async () => {
+    const email = "reset-wire@example.com";
+    const oldPassword = "old-password-1234";
+    const newPassword = "new-password-5678";
+    const tenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
+    const { id } = await seedAdmin(stack.db, {
+      email,
+      password: oldPassword,
+      displayName: "Reset",
+      memberships: [
+        {
+          tenantId,
+          tenantKey: "reset-wire",
+          tenantName: "Reset Wire",
+          roles: ["User"],
+        },
+      ],
+    });
+    await markVerified(id);
+
+    const req = await stack.http.raw("POST", "/api/auth/request-password-reset", { email });
+    expect(req.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(1);
+    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
+
+    const reset = await stack.http.raw("POST", "/api/auth/reset-password", {
+      token,
+      newPassword,
+    });
+    expect(reset.status).toBe(200);
+
+    const oldLogin = await stack.http.raw("POST", "/api/auth/login", {
+      email,
+      password: oldPassword,
+    });
+    expect(oldLogin.status).toBe(401);
+
+    const login = await stack.http.raw("POST", "/api/auth/login", { email, password: newPassword });
+    expect(login.status).toBe(200);
+    const body = (await login.json()) as { token?: string };
+    expect(body.token).toBeTypeOf("string");
+  });
+
+  test("invite Branch3 → signup-complete → login", async () => {
+    const tenantId = crypto.randomUUID() as TenantId;
+    const { id: adminId } = await seedAdmin(stack.db, {
+      email: "admin-wire@example.com",
+      password: "admin-password-1234",
+      displayName: "Admin",
+      memberships: [
+        {
+          tenantId,
+          tenantKey: `invite-${tenantId.slice(0, 8)}`,
+          tenantName: "Invite Wire",
+          roles: ["Admin"],
+        },
+      ],
+    });
+    await markVerified(adminId);
+
+    const admin = await withSession({ id: adminId, tenantId, roles: ["Admin"] });
+    const invitee = "carol-wire@example.com";
+    await stack.http.writeOk(AuthHandlers.inviteCreate, { email: invitee, role: "User" }, admin);
+    expect(emailTransport.sent.length).toBeGreaterThanOrEqual(1);
+    const token = extractTokenFromMail(emailTransport.sent.at(-1)?.html ?? "");
+
+    const complete = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "carol-new-pw-1234",
+    });
+    expect(complete.status).toBe(200);
+
+    const login = await stack.http.raw("POST", "/api/auth/login", {
+      email: invitee,
+      password: "carol-new-pw-1234",
+    });
+    expect(login.status).toBe(200);
+  });
+
+  test("email verify gate: unverified blocked → verify → login ok", async () => {
+    const email = "verify-wire@example.com";
+    const password = "verify-password-1234";
+    const tenantId = "00000000-0000-4000-8000-000000000002" as TenantId;
+    await seedTenant(stack.db, {
+      id: tenantId,
+      key: "verify-wire",
+      name: "Verify Wire",
+    });
+    const { id } = await seedUserWithPassword(stack.db, {
+      email,
+      password,
+      displayName: "Verify",
+      emailVerified: false,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: id,
+      tenantId,
+      roles: ["User"],
+    });
+
+    const blocked = await stack.http.raw("POST", "/api/auth/login", { email, password });
+    expect(blocked.status).toBe(403);
+    const blockedBody = (await blocked.json()) as { error?: { details?: { reason?: string } } };
+    expect(blockedBody.error?.details?.reason).toBe(AuthErrors.emailNotVerified);
+
+    const req = await stack.http.raw("POST", "/api/auth/request-email-verification", { email });
+    expect(req.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(1);
+    const token = extractTokenFromMail(emailTransport.sent[0]?.html ?? "");
+
+    const verify = await stack.http.raw("POST", "/api/auth/verify-email", { token });
+    expect(verify.status).toBe(200);
+
+    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
+    expect(login.status).toBe(200);
+  });
+
+  test("MFA enable → login challenges → verify JWT; sessions:mine lists sid", async () => {
+    const email = "mfa-wire@example.com";
+    const password = "mfa-password-1234";
+    const tenantId = "00000000-0000-4000-8000-000000000003" as TenantId;
+    const { id: userId } = await seedAdmin(stack.db, {
+      email,
+      password,
+      displayName: "Mfa",
+      memberships: [
+        {
+          tenantId,
+          tenantKey: "mfa-wire",
+          tenantName: "MFA Wire",
+          roles: ["User"],
+        },
+      ],
+    });
+    await markVerified(userId);
+    const user = await withSession({ id: userId, tenantId, roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: email },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const login = await stack.http.raw("POST", "/api/auth/login", { email, password });
+    expect(login.status).toBe(200);
+    const challenge = (await login.json()) as {
+      mfaRequired?: boolean;
+      challengeToken?: string;
+      token?: string;
+    };
+    expect(challenge.mfaRequired).toBe(true);
+    expect(challenge.token).toBeUndefined();
+    expect(challenge.challengeToken).toBeTypeOf("string");
+
+    const verify = await stack.http.raw("POST", "/api/auth/mfa/verify", {
+      challengeToken: challenge.challengeToken,
+      code: currentTotpCode(secret),
+    });
+    expect(verify.status).toBe(200);
+    const { token } = (await verify.json()) as { token: string };
+    expect(token).toBeTypeOf("string");
+    const sid = jose.decodeJwt(token).jti;
+    expect(typeof sid).toBe("string");
+
+    const mineRes = await stack.http.raw(
+      "POST",
+      "/api/query",
+      { type: SessionQueries.mine, payload: {} },
+      { Authorization: `Bearer ${token}` },
+    );
+    expect(mineRes.status).toBe(200);
+    const mineBody = (await mineRes.json()) as {
+      data?: Array<{ id: string }> | { items?: Array<{ id: string }> };
+    };
+    const items = Array.isArray(mineBody.data) ? mineBody.data : (mineBody.data?.items ?? []);
+    expect(items.some((s) => s.id === sid)).toBe(true);
+
+    const rows = await selectMany(stack.db, userSessionTable, { userId });
+    expect(rows.length).toBeGreaterThanOrEqual(1);
+  });
+});

package/src/__tests__/scaffold-app-feature.test.ts

@@ -4,6 +4,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { scaffoldApp } from "../scaffold-app";
 import { scaffoldAppFeature } from "../scaffold-app-feature";
 
@@ -19,23 +20,60 @@ describe("scaffoldAppFeature", () => {
     rmSync(tmp, { recursive: true, force: true });
   });
 
-  test("scaffolds src/features/<name>/feature.ts + index.ts", () => {
+  test("scaffolds die volle App-Feature-Konvention", () => {
     const result = scaffoldAppFeature({ name: "product-catalog", appRoot });
     expect(result.featureName).toBe("product-catalog");
     expect(result.files).toEqual([
       "src/features/product-catalog/feature.ts",
       "src/features/product-catalog/index.ts",
+      "src/features/product-catalog/constants.ts",
+      "src/features/product-catalog/i18n.ts",
+      "src/features/product-catalog/schema/product-catalog-item.ts",
+      "src/features/product-catalog/schema/index.ts",
+      "src/features/product-catalog/web/index.ts",
+      "src/features/product-catalog/__tests__/feature.boot.test.ts",
     ]);
-    expect(existsSync(join(appRoot, "src/features/product-catalog/feature.ts"))).toBe(true);
-    expect(existsSync(join(appRoot, "src/features/product-catalog/index.ts"))).toBe(true);
+    for (const file of result.files) {
+      expect(existsSync(join(appRoot, file))).toBe(true);
+    }
   });
 
-  test("feature.ts uses kebab-name + camelCase variable", () => {
+  test("feature.ts registriert nur — Entity aus schema/, Keys aus i18n.ts", () => {
     scaffoldAppFeature({ name: "product-catalog", appRoot });
     const feature = readFileSync(join(appRoot, "src/features/product-catalog/feature.ts"), "utf-8");
-    expect(feature).toContain(`defineFeature("product-catalog"`);
+    expect(feature).toContain("defineFeature(PRODUCT_CATALOG_FEATURE");
     expect(feature).toContain("export const productCatalogFeature");
-    expect(feature).toContain('r.entity("product-catalog-item"');
+    expect(feature).toContain('r.entity("product-catalog-item", productCatalogItemEntity)');
+    expect(feature).toContain('type: "entityList"');
+    expect(feature).toContain("r.translations({ keys: productCatalogTranslationKeys })");
+    // Konvention: Entity-Felder leben in schema/, nicht inline in feature.ts.
+    expect(feature).not.toContain("fields:");
+  });
+
+  test("Starter erfüllt Boot-Constraints: sortable-Feld, defaultSort, i18n-Pflichtkeys", () => {
+    scaffoldAppFeature({ name: "product-catalog", appRoot });
+    const entity = readFileSync(
+      join(appRoot, "src/features/product-catalog/schema/product-catalog-item.ts"),
+      "utf-8",
+    );
+    expect(entity).toContain("sortable: true");
+    const feature = readFileSync(join(appRoot, "src/features/product-catalog/feature.ts"), "utf-8");
+    expect(feature).toContain('defaultSort: { field: "title", dir: "asc" }');
+    const i18n = readFileSync(join(appRoot, "src/features/product-catalog/i18n.ts"), "utf-8");
+    expect(i18n).toContain('"screen:items.title"');
+    expect(i18n).toContain('"product-catalog:entity:product-catalog-item:field:title"');
+  });
+
+  test("web/index.ts ist Client-Stub, __tests__ enthält validateBoot-Test", () => {
+    scaffoldAppFeature({ name: "product-catalog", appRoot });
+    const web = readFileSync(join(appRoot, "src/features/product-catalog/web/index.ts"), "utf-8");
+    expect(web).toContain("@runtime client");
+    expect(web).toContain("export const productCatalogClient: ClientFeatureDefinition");
+    const bootTest = readFileSync(
+      join(appRoot, "src/features/product-catalog/__tests__/feature.boot.test.ts"),
+      "utf-8",
+    );
+    expect(bootTest).toContain("validateBoot([productCatalogFeature])");
   });
 
   test("auto-mounts in src/run-config.ts (import + APP_FEATURES entry)", () => {
@@ -119,6 +157,21 @@ describe("scaffoldAppFeature", () => {
     expect(healed).toMatch(/\]\s*as const;/);
   });
 
+  test("gescaffoldetes Feature bootet wirklich (validateBoot über dynamic import)", async () => {
+    // Ins Repo scaffolden (nicht os.tmpdir): nur hier löst der dynamic
+    // import "@cosmicdrift/kumiko-framework/engine" über node_modules auf.
+    const repoTmp = mkdtempSync(join(import.meta.dir, ".tmp-scaffold-"));
+    try {
+      scaffoldAppFeature({ name: "boot-probe", appRoot: repoTmp });
+      const mod = (await import(join(repoTmp, "src/features/boot-probe/feature.ts"))) as {
+        readonly bootProbeFeature: Parameters<typeof validateBoot>[0][number];
+      };
+      expect(() => validateBoot([mod.bootProbeFeature])).not.toThrow();
+    } finally {
+      rmSync(repoTmp, { recursive: true, force: true });
+    }
+  });
+
   test("rejects non-kebab-case", () => {
     expect(() => scaffoldAppFeature({ name: "ProductCatalog", appRoot })).toThrow(/kebab-case/);
     expect(() => scaffoldAppFeature({ name: "product_catalog", appRoot })).toThrow(/kebab-case/);