@cosmicdrift/kumiko-server-runtime 0.328.1 → 0.330.0

package/src/__tests__/compose-features.test.ts

@@ -1,206 +0,0 @@
-// Unit-Tests für composeFeatures.authOptions — pinst dass die
-// passwordReset / emailVerification options an
-// createAuthEmailPasswordFeature durchgereicht werden, sodass die
-// request- und confirm-Handler im resultierenden Feature registriert
-// sind. Bug-Pattern: ohne diesen Wiring würde runProdApp.options.auth.
-// passwordReset = {sendResetEmail, appResetUrl} die routes mounten,
-// aber die Handler fehlen → POST /api/auth/request-password-reset
-// dispatched ins Leere → 500.
-
-import { describe, expect, spyOn, test } from "bun:test";
-import { securityBaselineFeatures } from "@cosmicdrift/kumiko-bundled-features/presets";
-import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { composeFeatures } from "../compose-features";
-
-const noopFeature = defineFeature("noop-app", () => {});
-
-// Mirrors what the create-kumiko-app picker hands back when the user
-// ticks an auto-mounted feature: a stub with the same name as a bundled
-// one. The dedupe path drops it and warns.
-const pickerAuthDupe = defineFeature("auth-email-password", () => {});
-
-const HMAC_SECRET = "test-secret-with-at-least-32-bytes-aaa";
-
-describe("composeFeatures", () => {
-  test("includeBundled=false → nur App-Features", () => {
-    const features = composeFeatures([noopFeature], { includeBundled: false });
-    expect(features.map((f) => f.name)).toEqual(["noop-app"]);
-  });
-
-  test("includeBundled=true → 4 bundled Features davor", () => {
-    const features = composeFeatures([noopFeature], { includeBundled: true });
-    expect(features.map((f) => f.name)).toEqual([
-      "config",
-      "user",
-      "tenant",
-      "auth-email-password",
-      "noop-app",
-    ]);
-  });
-
-  test("authOptions.passwordReset → request-password-reset + reset-password handlers registriert", () => {
-    const features = composeFeatures([noopFeature], {
-      includeBundled: true,
-      authOptions: { passwordReset: { hmacSecret: HMAC_SECRET, appUrl: "https://app/reset" } },
-    });
-    const auth = features.find((f) => f.name === "auth-email-password");
-    expect(auth).toBeDefined();
-    if (!auth) return;
-    const handlerNames = Array.from(Object.keys(auth.writeHandlers));
-    expect(handlerNames).toContain("request-password-reset");
-    expect(handlerNames).toContain("reset-password");
-  });
-
-  test("authOptions.emailVerification → request-email-verification + verify-email handlers registriert", () => {
-    const features = composeFeatures([noopFeature], {
-      includeBundled: true,
-      authOptions: { emailVerification: { hmacSecret: HMAC_SECRET, appUrl: "https://app/verify" } },
-    });
-    const auth = features.find((f) => f.name === "auth-email-password");
-    expect(auth).toBeDefined();
-    if (!auth) return;
-    const handlerNames = Array.from(Object.keys(auth.writeHandlers));
-    expect(handlerNames).toContain("request-email-verification");
-    expect(handlerNames).toContain("verify-email");
-  });
-
-  test("authOptions.signup → signup-request + signup-confirm handlers registriert", () => {
-    const features = composeFeatures([noopFeature], {
-      includeBundled: true,
-      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
-    });
-    const auth = features.find((f) => f.name === "auth-email-password");
-    expect(auth).toBeDefined();
-    if (!auth) return;
-    const handlerNames = Array.from(Object.keys(auth.writeHandlers));
-    expect(handlerNames).toContain("signup-request");
-    expect(handlerNames).toContain("signup-confirm");
-  });
-
-  // Regression: signup-request no-ops silently (always-200 anti-enumeration
-  // contract) unless "auth-self-registration" is mounted. composeFeatures
-  // must bundle it alongside authOptions.signup, not leave apps using the
-  // includeBundled convenience path to mount it by hand.
-  test("authOptions.signup → auth-self-registration mounted, default ON", () => {
-    const features = composeFeatures([noopFeature], {
-      includeBundled: true,
-      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
-    });
-    const toggle = features.find((f) => f.name === "auth-self-registration");
-    expect(toggle).toBeDefined();
-    // The security-relevant part isn't that the feature is mounted, it's
-    // that self-signup defaults ON — a flip to `default: false` upstream
-    // would silently no-op signup (always-200 anti-enumeration masks it)
-    // while this assertion alone (toBeDefined) stayed green.
-    expect(toggle?.toggleableDefault).toBe(true);
-  });
-
-  test("no authOptions.signup → auth-self-registration NOT mounted", () => {
-    const features = composeFeatures([noopFeature], { includeBundled: true });
-    expect(features.map((f) => f.name)).not.toContain("auth-self-registration");
-  });
-
-  test("authOptions.signup + app also mounts its own auth-self-registration stub → deduped to exactly one", () => {
-    const pickerSelfRegDupe = defineFeature("auth-self-registration", () => {});
-    const features = composeFeatures([noopFeature, pickerSelfRegDupe], {
-      includeBundled: true,
-      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
-    });
-    const names = features.map((f) => f.name).filter((n) => n === "auth-self-registration");
-    expect(names).toEqual(["auth-self-registration"]);
-  });
-
-  test("OHNE authOptions → KEINE reset/verify-handlers (anti-default-deploy-bug)", () => {
-    // Genau der Bug der vom Review-Agent gefangen wurde: composeFeatures
-    // ohne authOptions registriert die handler nicht. Wenn jemand das
-    // versehentlich vergisst und nur die routes (auth-routes-config)
-    // wired, schlagen die requests auf prod fehl. Der Test pinst dass
-    // dieser default-deny-Pfad bewusst leer ist.
-    const features = composeFeatures([noopFeature], { includeBundled: true });
-    const auth = features.find((f) => f.name === "auth-email-password");
-    expect(auth).toBeDefined();
-    if (!auth) return;
-    const handlerNames = Array.from(Object.keys(auth.writeHandlers));
-    expect(handlerNames).not.toContain("request-password-reset");
-    expect(handlerNames).not.toContain("reset-password");
-    expect(handlerNames).not.toContain("request-email-verification");
-    expect(handlerNames).not.toContain("verify-email");
-    // Die regulären auth-handlers (login/logout/change-password) MÜSSEN
-    // aber immer da sein — das ist der core-flow.
-    expect(handlerNames).toContain("login");
-    expect(handlerNames).toContain("logout");
-  });
-
-  // fw#2223 regression: without this wiring, includeBundled apps that DO
-  // configure authOptions.invite still got /members with no invite button —
-  // the screen is bound to auth-email-password's invite-create handler,
-  // which only exists when opts.invite is set (feature.ts:238-239).
-  test("authOptions.invite → tenant bekommt invite-Screen + Toolbar-Action; ohne invite bootet sauber ohne beides", () => {
-    const withInvite = composeFeatures([noopFeature], {
-      includeBundled: true,
-      authOptions: { invite: { appUrl: "https://app/invite" } },
-    });
-    const tenantWith = withInvite.find((f) => f.name === "tenant");
-    expect(tenantWith).toBeDefined();
-    if (!tenantWith) return;
-    const membersScreenWith = tenantWith.screens["members"];
-    if (membersScreenWith?.type !== "projectionList") {
-      throw new Error("expected members screen to be projectionList");
-    }
-    expect(membersScreenWith.toolbarActions?.some((a) => a.id === "invite")).toBe(true);
-    expect(tenantWith.screens["invite-create"]).toBeDefined();
-
-    const withoutInvite = composeFeatures([noopFeature], { includeBundled: true });
-    const tenantWithout = withoutInvite.find((f) => f.name === "tenant");
-    expect(tenantWithout).toBeDefined();
-    if (!tenantWithout) return;
-    const membersScreenWithout = tenantWithout.screens["members"];
-    if (membersScreenWithout?.type !== "projectionList") {
-      throw new Error("expected members screen to be projectionList");
-    }
-    expect(membersScreenWithout.toolbarActions ?? []).toHaveLength(0);
-    expect(tenantWithout.screens["invite-create"]).toBeUndefined();
-    expect(() => validateBoot(withoutInvite)).not.toThrow();
-  });
-
-  test("app feature duplicating a bundled name is dropped (no createRegistry crash)", () => {
-    // create-kumiko-app's picker hands back createAuthEmailPasswordFeature()
-    // because the user ticked it in the recommended set; runDevApp then adds
-    // its OWN bundled copy via includeBundled:true, and createRegistry throws
-    // "Duplicate feature: auth-email-password". The dedupe path keeps the
-    // bundled instance (it carries authOptions wiring) and drops the app stub.
-    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
-    const features = composeFeatures([pickerAuthDupe, noopFeature], {
-      includeBundled: true,
-    });
-    // The warn is part of the fix contract (changeset: "warn so the user can
-    // remove the line") — without this assertion the warn is removable with no RED.
-    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("auth-email-password"));
-    warnSpy.mockRestore();
-    expect(features.map((f) => f.name)).toEqual([
-      "config",
-      "user",
-      "tenant",
-      "auth-email-password",
-      "noop-app",
-    ]);
-    // The kept instance is the bundled one — confirmed by the presence of
-    // login/logout handlers (the picker stub has none).
-    const auth = features.find((f) => f.name === "auth-email-password");
-    expect(auth).toBeDefined();
-    if (!auth) return;
-    expect(Object.keys(auth.writeHandlers)).toContain("login");
-  });
-
-  test("includeBundled=false → sessions mounted via preset + standalone collapses to one entry", () => {
-    const sessionsInstances = securityBaselineFeatures();
-    const standaloneSessions = createSessionsFeature();
-    const features = composeFeatures([...sessionsInstances, standaloneSessions], {
-      includeBundled: false,
-    });
-    const sessionsEntries = features.filter((f) => f.name === "sessions");
-    expect(sessionsEntries).toHaveLength(1);
-    expect(sessionsEntries[0]).toBe(sessionsInstances[0]);
-  });
-});

package/src/__tests__/config-seed-boot.integration.test.ts

@@ -1,158 +0,0 @@
-// Pins the boot-wiring contract for config-seeds. runDevApp's onAfterSetup
-// and runProdApp's seed-block both call `applyBootSeeds(...)` — this test
-// calls the SAME helper, so if someone removes the call site from
-// runDevApp / runProdApp the helper still has at least one caller (this
-// test). Code review then sees an orphaned helper, not a silently broken
-// boot. For a stricter end-to-end pin you'd start an actual runDevApp;
-// that's heavy and not done here.
-//
-// Tests:
-//   1. seed rows land in the projection after applyBootSeeds runs,
-//   2. a re-boot is a no-op (idempotent),
-//   3. an admin set on top of a seed wins the resolver cascade; coexistence
-//      vs. override semantics depend on the admin user's tenantId.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import {
-  configValuesTable,
-  createConfigAccessorFactory,
-  createConfigFeature,
-  createConfigResolver,
-} from "@cosmicdrift/kumiko-bundled-features/config";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  access,
-  createSystemConfig,
-  createSystemSeed,
-  createTenantConfig,
-  createTenantSeed,
-  defineFeature,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  setupTestStack,
-  type TestStack,
-  TestUsers,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { applyBootSeeds } from "../boot/apply-boot-seeds";
-
-const bootSeedsFeature = defineFeature("boot-seeds-test", (r) => {
-  r.requires("config");
-  r.config({
-    keys: {
-      siteName: createTenantConfig("text", {
-        default: "DEFAULT_SITE",
-        read: access.all,
-        write: access.all,
-      }),
-      maintenance: createSystemConfig("boolean", {
-        default: false,
-        read: access.all,
-        write: access.systemAdmin,
-      }),
-    },
-    seeds: {
-      siteName: createTenantSeed({ value: "from-seed" }),
-      maintenance: createSystemSeed({ value: true }),
-    },
-  });
-});
-
-const SITE_KEY = "boot-seeds-test:config:site-name";
-const MAINT_KEY = "boot-seeds-test:config:maintenance";
-
-let stack: TestStack;
-const resolver = createConfigResolver();
-
-beforeAll(async () => {
-  stack = await setupTestStack({
-    features: [createConfigFeature(), bootSeedsFeature],
-    extraContext: ({ registry }) => ({
-      configResolver: resolver,
-      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-    }),
-  });
-  await unsafePushTables(stack.db, { configValuesTable });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-describe("config-seed boot wiring", () => {
-  test("first boot: applyBootSeeds writes one row per seed", async () => {
-    await applyBootSeeds({ registry: stack.registry, db: stack.db });
-
-    const rows = await selectMany(stack.db, configValuesTable);
-    expect(rows.length).toBe(2);
-
-    const siteKeyDef = stack.registry.getConfigKey(SITE_KEY);
-    expect(siteKeyDef).toBeDefined();
-    const sitePeek = await resolver.get(
-      SITE_KEY,
-      siteKeyDef!,
-      TestUsers.systemAdmin.tenantId,
-      TestUsers.systemAdmin.id,
-      stack.db,
-    );
-    expect(sitePeek).toBe("from-seed");
-
-    const maintKeyDef = stack.registry.getConfigKey(MAINT_KEY);
-    expect(maintKeyDef).toBeDefined();
-    const maintPeek = await resolver.get(
-      MAINT_KEY,
-      maintKeyDef!,
-      TestUsers.systemAdmin.tenantId,
-      TestUsers.systemAdmin.id,
-      stack.db,
-    );
-    expect(maintPeek).toBe(true);
-  });
-
-  test("re-boot: idempotent — every seed already on disk → no extra rows", async () => {
-    await applyBootSeeds({ registry: stack.registry, db: stack.db });
-
-    const rows = await selectMany(stack.db, configValuesTable);
-    expect(rows.length).toBe(2);
-  });
-
-  test("admin set on top of seed wins resolver — Re-Boot preserves admin", async () => {
-    // siteName is a TENANT-scope key. The seed writes a row under
-    // SYSTEM_TENANT_ID (= "for all tenants"). An admin on a real tenant
-    // writes a row under THAT tenantId — higher specificity. Both rows
-    // coexist; the resolver returns the more specific one.
-    //
-    // If the admin happens to write as SYSTEM_TENANT_ID (e.g. test user
-    // is the system-admin on the system-tenant), the admin write hits
-    // the seed-row directly and updates the same aggregate stream. Both
-    // paths end up with the admin value winning — the row-count
-    // assertion makes the path explicit.
-    await stack.http.writeOk(
-      "config:write:set",
-      { key: SITE_KEY, value: "admin-override", scope: "tenant" },
-      TestUsers.systemAdmin,
-    );
-
-    await applyBootSeeds({ registry: stack.registry, db: stack.db });
-
-    const siteKeyDef = stack.registry.getConfigKey(SITE_KEY);
-    expect(siteKeyDef).toBeDefined();
-    const peek = await resolver.get(
-      SITE_KEY,
-      siteKeyDef!,
-      TestUsers.systemAdmin.tenantId,
-      TestUsers.systemAdmin.id,
-      stack.db,
-    );
-    expect(peek).toBe("admin-override");
-
-    // Row-count tells us which path was hit:
-    //   - 2 rows = override path (admin tenantId === SYSTEM_TENANT_ID,
-    //     updated the seed-stream in place).
-    //   - 3 rows = coexistence path (admin tenantId !== SYSTEM_TENANT_ID,
-    //     new specific-tenant row sits next to the seed system-row).
-    // Either is correct as long as the resolver picks the admin value.
-    const rows = await selectMany(stack.db, configValuesTable);
-    expect([2, 3]).toContain(rows.length);
-  });
-});

package/src/__tests__/pii-boot-gate.test.ts

@@ -1,112 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import * as z from "zod";
-import { assertPiiBootInvariants } from "../pii-boot-gate";
-
-const piiFeature = defineFeature("gate-pii", (r) => {
-  r.entity(
-    "person",
-    createEntity({
-      table: "read_gate_persons",
-      fields: { email: createTextField({ required: true, personal: "self", find: "exact" }) },
-    }),
-  );
-});
-const plainFeature = defineFeature("gate-plain", (r) => {
-  r.entity(
-    "thing",
-    createEntity({
-      table: "read_gate_things",
-      fields: { name: createTextField({ personal: false, reason: "test_fixture" }) },
-    }),
-  );
-});
-
-// Entity-free features: the gate must react to the event stance on its own,
-// not ride along on an entity annotation (fw#2776).
-const piiEventFeature = defineFeature("gate-pii-event", (r) => {
-  r.defineEvent("attempt", z.object({ userId: z.string(), email: z.string() }), {
-    piiFields: { email: { personal: { of: "userId" } } },
-  });
-});
-const noneEventFeature = defineFeature("gate-none-event", (r) => {
-  r.defineEvent("ping", z.object({ at: z.string() }), { piiFields: "none" });
-});
-
-const kms = new InMemoryKmsAdapter();
-const KEY = Buffer.alloc(32, 7).toString("base64");
-
-describe("assertPiiBootInvariants — prod", () => {
-  test("PII without a KMS aborts boot", () => {
-    expect(() => assertPiiBootInvariants([piiFeature], { mode: "prod" })).toThrow(
-      /BOOT ABORTED.*PLAINTEXT.*allowPlaintextPii/s,
-    );
-  });
-
-  test("explicit allowPlaintextPii downgrades to a warning", () => {
-    expect(() =>
-      assertPiiBootInvariants([piiFeature], {
-        mode: "prod",
-        allowPlaintextPii: "kms rollout pending, infra#188",
-      }),
-    ).not.toThrow();
-  });
-
-  test("KMS + blindIndexKey boots", () => {
-    expect(() =>
-      assertPiiBootInvariants([piiFeature], { mode: "prod", kms, blindIndexKey: KEY }),
-    ).not.toThrow();
-  });
-
-  test("KMS without blindIndexKey aborts when lookupable fields exist", () => {
-    expect(() => assertPiiBootInvariants([piiFeature], { mode: "prod", kms })).toThrow(
-      /blindIndexKey/,
-    );
-  });
-
-  test("no PII entities → nothing to gate", () => {
-    expect(() => assertPiiBootInvariants([plainFeature], { mode: "prod" })).not.toThrow();
-  });
-
-  test('an entity-free feature with a non-"none" event stance aborts boot without a KMS', () => {
-    expect(() => assertPiiBootInvariants([piiEventFeature], { mode: "prod" })).toThrow(
-      /BOOT ABORTED.*gate-pii-event:event:attempt.*PLAINTEXT/s,
-    );
-  });
-
-  test('events declaring piiFields: "none" are not gated', () => {
-    expect(() => assertPiiBootInvariants([noneEventFeature], { mode: "prod" })).not.toThrow();
-  });
-
-  test("a KMS satisfies the event gate", () => {
-    expect(() =>
-      assertPiiBootInvariants([piiEventFeature], { mode: "prod", kms, blindIndexKey: KEY }),
-    ).not.toThrow();
-  });
-
-  test("allowPlaintextPii acknowledges the event gate too", () => {
-    expect(() =>
-      assertPiiBootInvariants([piiEventFeature], {
-        mode: "prod",
-        allowPlaintextPii: "kms rollout pending",
-      }),
-    ).not.toThrow();
-  });
-});
-
-describe("assertPiiBootInvariants — dev", () => {
-  test("PII without a KMS only warns in dev", () => {
-    expect(() => assertPiiBootInvariants([piiFeature], { mode: "dev" })).not.toThrow();
-  });
-
-  test("KMS without blindIndexKey aborts in dev too (lookups broken in any mode)", () => {
-    expect(() => assertPiiBootInvariants([piiFeature], { mode: "dev", kms })).toThrow(
-      /blindIndexKey/,
-    );
-  });
-
-  test("a PII event without a KMS only warns in dev", () => {
-    expect(() => assertPiiBootInvariants([piiEventFeature], { mode: "dev" })).not.toThrow();
-  });
-});

package/src/__tests__/renderer-web-css-relocation.integration.test.ts

@@ -1,85 +0,0 @@
-// Relocation-Test für den @source-Layout-Fix (#359).
-//
-// Der Bug: renderer-web/src/styles.css scannte seine eigenen Shell-Klassen
-// über einen MONOREPO-relativen @source (`../../renderer-web/src`). Im
-// Workspace löst der via Symlink auf (grün), in einem Standalone-Consumer
-// (echtes node_modules ohne Monorepo-Geschwister) findet er nichts → unstyled
-// prod (15KB statt 48KB). Der Fix macht die Zeile self-relativ (`./`), weil
-// das Paket `src` shippt.
-//
-// Am REALEN Ort der styles.css sind `./` und `../../renderer-web/src`
-// identisch — ein Test dort wäre grün mit Bug UND Fix. Der Diskriminator ist
-// RELOCATION: wir kopieren die echte styles.css an einen Ort, an dem der alte
-// Pfad tot ist und nur `./` greift. Der Ort liegt unter dem Repo-Root, damit
-// `@import "tailwindcss"` / `react-day-picker` weiter über node_modules
-// auflösen. Braucht Bun (Bun.spawn im Tailwind-One-Shot) — sonst silent skip.
-
-import { describe, expect, test } from "bun:test";
-import { execFileSync } from "node:child_process";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { runTailwindOnce } from "../build-prod-bundle";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, "../../../..");
-const RENDERER_WEB_STYLES = resolve(__dirname, "../../../renderer-web/src/styles.css");
-const SELF_SOURCE = '@source "./**/*.{ts,tsx}";';
-const MONOREPO_SOURCE = '@source "../../renderer-web/src/**/*.{ts,tsx}";';
-
-function bunAvailable(): boolean {
-  try {
-    execFileSync("bun", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe("renderer-web styles.css @source relocation (#359)", () => {
-  // skipIf statt `if (!bunAvailable()) return;` — sonst meldet der Runner den
-  // Test grün, obwohl er nie lief (silent-pass verschleiert fehlende Coverage).
-  test.skipIf(!bunAvailable())(
-    "self-relative @source scans the shell standalone; monorepo path would not",
-    async () => {
-      // Tailwind v4 auto-scannt nur das cwd-Verzeichnis (empirisch bestätigt:
-      // das Verzeichnis der Input-CSS wird NICHT automatisch gescannt). Im echten
-      // Standalone-Consumer ist renderer-web zudem in node_modules (gitignored) →
-      // ebenfalls nicht auto-gescannt. Die Shell-Klassen erreicht also NUR der
-      // explizite @source der styles.css. Hier mirrorn wir das robust, ohne
-      // gitignore-/node_modules-Semantik: das Paket-`src` (mit der Shell-Probe)
-      // liegt AUSSERHALB des Build-cwd — nur der self-relative `@source "./**"`
-      // der relozierten styles.css erreicht es, der monorepo-Pfad ist tot.
-      // Temp unter REPO_ROOT, damit @import "tailwindcss"/react-day-picker via
-      // node_modules auflösen.
-      const dir = await mkdtemp(join(REPO_ROOT, ".reloc-rendererweb-"));
-      const buildCwd = join(dir, "app");
-      const pkgSrc = join(dir, "pkg");
-      try {
-        const realCss = await readFile(RENDERER_WEB_STYLES, "utf8");
-        // Guard: der Fix MUSS in der Quelle stehen, sonst testet die Relocation nichts.
-        expect(realCss).toContain(SELF_SOURCE);
-
-        await mkdir(buildCwd, { recursive: true });
-        await mkdir(join(pkgSrc, "layout"), { recursive: true });
-        await writeFile(
-          join(pkgSrc, "layout/probe.tsx"),
-          `export const P = () => <div className="min-h-screen" />;\n`,
-        );
-
-        await writeFile(join(pkgSrc, "styles.css"), realCss);
-        const fixed = await runTailwindOnce(join(pkgSrc, "styles.css"), buildCwd);
-        expect(fixed).toContain("min-h-screen");
-
-        // Diskriminator: mit dem ALTEN monorepo-relativen @source ist die Probe
-        // an diesem relozierten Ort unerreichbar → Sentinel fehlt. Beweist, dass
-        // der Fix kein No-op ist (der Test würde bei einem Revert rot).
-        await writeFile(join(pkgSrc, "styles.css"), realCss.replace(SELF_SOURCE, MONOREPO_SOURCE));
-        const buggy = await runTailwindOnce(join(pkgSrc, "styles.css"), buildCwd);
-        expect(buggy).not.toContain("min-h-screen");
-      } finally {
-        await rm(dir, { recursive: true, force: true });
-      }
-    },
-  );
-});

package/src/__tests__/renderer-web-shell-sentinel.test.ts

@@ -1,35 +0,0 @@
-// Unit-Test für den CSS-Completeness-Guard (#359): nach dem Tailwind-One-Shot
-// prüft der Build, ob das Output-CSS die renderer-web-Shell-Sentinel-Klasse
-// enthält — aber NUR wenn auf das gepackte renderer-web-styles.css
-// zurückgefallen wurde. Fehlt sie dort, würde prod unstyled rendern → laut
-// failen mit Hinweis auf src/styles.css.
-
-import { describe, expect, test } from "bun:test";
-import { assertRendererWebShellPresent } from "../build-prod-bundle";
-
-const fallback = {
-  path: "/app/node_modules/renderer-web/src/styles.css",
-  isRendererWebFallback: true,
-};
-const appOwned = { path: "/app/src/styles.css", isRendererWebFallback: false };
-
-describe("assertRendererWebShellPresent (#359 CSS-completeness guard)", () => {
-  test("fallback + fehlende Shell-Sentinel-Klasse → wirft mit src/styles.css-Hinweis", () => {
-    expect(() => assertRendererWebShellPresent(".some-other{display:flex}", fallback)).toThrow(
-      /min-h-screen/,
-    );
-    expect(() => assertRendererWebShellPresent(".some-other{display:flex}", fallback)).toThrow(
-      /src\/styles\.css/,
-    );
-  });
-
-  test("fallback + Shell-Sentinel vorhanden → kein Throw", () => {
-    expect(() =>
-      assertRendererWebShellPresent(".min-h-screen{min-height:100vh}", fallback),
-    ).not.toThrow();
-  });
-
-  test("app-eigenes styles.css (kein Fallback) → nie asserten, auch ohne Sentinel", () => {
-    expect(() => assertRendererWebShellPresent("", appOwned)).not.toThrow();
-  });
-});

package/src/__tests__/renderer-web-theme-plugin.integration.test.ts

@@ -1,77 +0,0 @@
-// The app theme plugin only works if its base-layer output lands AFTER the framework's light
-// palette (`@layer base :root:not(.dark)`); same selector, same layer, so source order decides.
-// This runs the real Tailwind one-shot over an app stylesheet that imports the framework CSS and
-// loads a theme module through the published `theme-plugin` subpath.
-
-import { describe, expect, test } from "bun:test";
-import { execFileSync } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { runTailwindOnce } from "../build-prod-bundle";
-
-const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../../..");
-const FRAMEWORK_LIGHT_PRIMARY = "--color-primary:#1a1c1e";
-
-function bunAvailable(): boolean {
-  try {
-    execFileSync("bun", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe("renderer-web theme plugin in a real Tailwind build", () => {
-  test.skipIf(!bunAvailable())(
-    "app theme overrides the framework light palette, sets dark values and adds utilities for new colors",
-    async () => {
-      const dir = await mkdtemp(join(REPO_ROOT, ".theme-plugin-"));
-      try {
-        await writeFile(
-          join(dir, "theme.ts"),
-          `import { createThemePlugin, defineAppTheme } from "@cosmicdrift/kumiko-renderer-web/theme-plugin";
-export default createThemePlugin(defineAppTheme({
-  colors: {
-    primary: { light: "#0a7d5a", dark: "#34d399" },
-    "brand-soft": "#e0f5ee",
-  },
-  shadows: { card: "none" },
-  fonts: { sans: "Manrope, sans-serif" },
-}));
-`,
-        );
-        await writeFile(
-          join(dir, "probe.tsx"),
-          `export const Probe = () => <div className="bg-brand-soft text-primary" />;\n`,
-        );
-        await writeFile(
-          join(dir, "styles.css"),
-          `@import "@cosmicdrift/kumiko-renderer-web/styles.css";\n@plugin "./theme.ts";\n@source "./probe.tsx";\n`,
-        );
-
-        const css = await runTailwindOnce(join(dir, "styles.css"), dir);
-
-        const frameworkLight = css.indexOf(FRAMEWORK_LIGHT_PRIMARY);
-        const appLight = css.indexOf("--color-primary:#0a7d5a");
-        expect(frameworkLight).toBeGreaterThan(-1);
-        expect(appLight).toBeGreaterThan(frameworkLight);
-
-        expect(css).toMatch(/\.dark\{[^}]*--color-primary:#34d399/);
-        expect(css).toMatch(/\.bg-brand-soft\{background-color:var\(--color-brand-soft\)\}/);
-
-        const frameworkCardShadow = css.indexOf("--card-shadow:0 1px 3px");
-        const appCardShadow = css.indexOf("--card-shadow:none");
-        expect(frameworkCardShadow).toBeGreaterThan(-1);
-        expect(appCardShadow).toBeGreaterThan(frameworkCardShadow);
-        // An unlayered framework :root would beat the plugin's base layer despite the order.
-        expect(css).toMatch(/:root\{[^}]*--kumiko-grid-row-h/);
-        expect(css).not.toMatch(/:root\{[^}]*--kumiko-grid-row-h[^}]*--card-/);
-        expect(css).not.toMatch(/:root\{[^}]*--card-[^}]*--kumiko-grid-row-h/);
-        expect(css).toMatch(/body\{font-family:var\(--font-sans\)\}/);
-      } finally {
-        await rm(dir, { recursive: true, force: true });
-      }
-    },
-  );
-});