@cosmicdrift/kumiko-server-runtime 0.329.0 → 0.330.0

package/src/__tests__/require-env.test.ts

@@ -1,34 +0,0 @@
-// requireEnv — the missing-var error message must match the actual caller.
-// Regression (728/2): the advice text was hardcoded to prod/container
-// wording ("Coolify secrets") regardless of the `context` param, so a
-// runDevApp caller got misleading production-deploy instructions for a
-// missing local .env var.
-
-import { describe, expect, test } from "bun:test";
-import { requireEnv as requireEnvFromPackageExport } from "@cosmicdrift/kumiko-server-runtime";
-import { requireEnv } from "../run-prod-app";
-
-describe("requireEnv", () => {
-  test("is part of the package's public export, not just the internal run-prod-app module", () => {
-    expect(requireEnvFromPackageExport).toBe(requireEnv);
-  });
-
-  test("default context (runProdApp) gives container/production advice", () => {
-    expect(() => requireEnv("MISSING_VAR", {})).toThrow(/container env.*Coolify secrets/);
-  });
-
-  test("runDevApp context gives local .env advice, not production advice", () => {
-    expect(() => requireEnv("MISSING_VAR", {}, "runDevApp")).toThrow(
-      /\.env \/ shell before running the dev server/,
-    );
-  });
-
-  test("runDevApp context error does NOT mention Coolify", () => {
-    try {
-      requireEnv("MISSING_VAR", {}, "runDevApp");
-      throw new Error("expected requireEnv to throw");
-    } catch (err) {
-      expect(String(err)).not.toContain("Coolify");
-    }
-  });
-});

package/src/__tests__/resolve-auth-mail.test.ts

@@ -1,144 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { type RunProdAppAuthOptions, resolveAuthMail } from "../run-prod-app";
-
-// Pins the auth.mail convenience (resolveAuthMail): one mail block expands
-// into the four explicit flow setups built from DEFAULT_AUTH_PATHS, the
-// null-transport guard (no SMTP_HOST → flows stay unwired), and explicit
-// per-flow setups winning over the mail default.
-
-const admin: RunProdAppAuthOptions["admin"] = {
-  email: "admin@example.com",
-  password: "pw-long-enough",
-  displayName: "Admin",
-  memberships: [],
-};
-
-const withMail: RunProdAppAuthOptions = {
-  admin,
-  mail: { baseUrl: "https://app.example.com", appName: "Test" },
-};
-
-describe("resolveAuthMail", () => {
-  test("no mail block → auth returned unchanged", () => {
-    const noMail: RunProdAppAuthOptions = { admin };
-    const out = resolveAuthMail(noMail, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset).toBeUndefined();
-    expect(out.signup).toBeUndefined();
-  });
-
-  test("mail + SMTP_HOST → all four flows wired from DEFAULT_AUTH_PATHS", () => {
-    const out = resolveAuthMail(withMail, "secret", { SMTP_HOST: "localhost" });
-    // All four flows carry appUrl as feature options — each handler mails via
-    // delivery (ctx.notify); no callback wiring remains.
-    expect(out.passwordReset?.appUrl).toBe("https://app.example.com/reset-password");
-    expect(out.emailVerification?.appUrl).toBe("https://app.example.com/verify-email");
-    expect(out.signup?.appUrl).toBe("https://app.example.com/signup/complete");
-    expect(out.invite?.appUrl).toBe("https://app.example.com/invite/accept");
-    expect(out.passwordReset?.hmacSecret).toBe("secret");
-  });
-
-  test("mail but NO SMTP_HOST → null-transport guard, flows stay unwired", () => {
-    const out = resolveAuthMail(withMail, "secret", {});
-    expect(out.passwordReset).toBeUndefined();
-    expect(out.signup).toBeUndefined();
-  });
-
-  test("explicit per-flow setup wins over the mail default", () => {
-    const explicit: RunProdAppAuthOptions = {
-      ...withMail,
-      passwordReset: {
-        hmacSecret: "h",
-        appUrl: "https://custom.example.com/pw",
-      },
-    };
-    const out = resolveAuthMail(explicit, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appUrl).toBe("https://custom.example.com/pw");
-    // other flows still come from the mail default
-    expect(out.signup?.appUrl).toBe("https://app.example.com/signup/complete");
-  });
-
-  test("paths override only affects the named path", () => {
-    const pathsOverride: RunProdAppAuthOptions = {
-      admin,
-      mail: { baseUrl: "https://app.example.com", paths: { resetPassword: "/pw" } },
-    };
-    const out = resolveAuthMail(pathsOverride, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appUrl).toBe("https://app.example.com/pw");
-    expect(out.emailVerification?.appUrl).toBe("https://app.example.com/verify-email");
-  });
-
-  test("function path → locale-aware appUrl, still signed with the resolved hmacSecret", () => {
-    const localeAware: RunProdAppAuthOptions = {
-      admin,
-      mail: {
-        baseUrl: "https://app.example.com",
-        paths: {
-          resetPassword: (locale) => (locale === "de" ? "/de/reset-password" : "/reset-password"),
-        },
-      },
-    };
-    const out = resolveAuthMail(localeAware, "secret", { SMTP_HOST: "localhost" });
-    const appUrl = out.passwordReset?.appUrl;
-    if (typeof appUrl !== "function") throw new Error("expected a locale-aware appUrl function");
-    expect(appUrl("de")).toBe("https://app.example.com/de/reset-password");
-    expect(appUrl("en")).toBe("https://app.example.com/reset-password");
-    expect(out.passwordReset?.hmacSecret).toBe("secret");
-  });
-
-  test("mail.hmacSecret overrides the call-site secret for passwordReset and emailVerification", () => {
-    const dedicatedSecret: RunProdAppAuthOptions = {
-      admin,
-      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
-    };
-    const out = resolveAuthMail(dedicatedSecret, "jwt-secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
-    expect(out.emailVerification?.hmacSecret).toBe("mail-only-secret");
-  });
-
-  test("no mail.hmacSecret → falls back to the call-site secret", () => {
-    const out = resolveAuthMail(withMail, "jwt-secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.hmacSecret).toBe("jwt-secret");
-  });
-
-  test("explicit passwordReset/emailVerification without hmacSecret is backfilled from mail.hmacSecret", () => {
-    const explicitNoSecret: RunProdAppAuthOptions = {
-      admin,
-      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
-      passwordReset: { appUrl: "https://custom.example.com/pw" },
-      emailVerification: { appUrl: "https://custom.example.com/verify" },
-    };
-    const out = resolveAuthMail(explicitNoSecret, "jwt-secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appUrl).toBe("https://custom.example.com/pw");
-    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
-    expect(out.emailVerification?.hmacSecret).toBe("mail-only-secret");
-  });
-
-  test("explicit passwordReset with its own hmacSecret wins over mail.hmacSecret", () => {
-    const explicitOwnSecret: RunProdAppAuthOptions = {
-      admin,
-      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
-      passwordReset: { appUrl: "https://custom.example.com/pw", hmacSecret: "app-own-secret" },
-    };
-    const out = resolveAuthMail(explicitOwnSecret, "jwt-secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.hmacSecret).toBe("app-own-secret");
-  });
-
-  test("explicit passwordReset without hmacSecret and no mail block falls back to the call-site secret", () => {
-    const explicitNoMail: RunProdAppAuthOptions = {
-      admin,
-      passwordReset: { appUrl: "https://custom.example.com/pw" },
-    };
-    const out = resolveAuthMail(explicitNoMail, "jwt-secret", {});
-    expect(out.passwordReset?.hmacSecret).toBe("jwt-secret");
-  });
-
-  test("explicit passwordReset without hmacSecret is still backfilled when SMTP_HOST is unset", () => {
-    const explicitNoSmtp: RunProdAppAuthOptions = {
-      admin,
-      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
-      passwordReset: { appUrl: "https://custom.example.com/pw" },
-    };
-    const out = resolveAuthMail(explicitNoSmtp, "jwt-secret", {});
-    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
-  });
-});

package/src/__tests__/resolve-tailwind-cli.test.ts

@@ -1,81 +0,0 @@
-// Unit-Tests für resolveTailwindCli — die zwei Failure-Branches sind
-// genau das, was den dev-server-Crash bei flakigem Netz verhindert:
-// kein Bun → undefined, Package nicht installiert → undefined.
-
-import { describe, expect, test } from "bun:test";
-import { canResolveTailwindStylesheet, resolveTailwindCli } from "../resolve-tailwind-cli";
-
-describe("resolveTailwindCli", () => {
-  test("ohne Bun-Resolver → undefined (silent skip)", () => {
-    const out = resolveTailwindCli({ bun: undefined, cwd: "/somewhere" });
-    expect(out).toBeUndefined();
-  });
-
-  test("Bun.resolveSync wirft → undefined", () => {
-    const out = resolveTailwindCli({
-      bun: {
-        resolveSync: () => {
-          throw new Error("module not found");
-        },
-      },
-      cwd: "/somewhere",
-    });
-    expect(out).toBeUndefined();
-  });
-
-  test("Bun.resolveSync liefert package.json → absoluter Bin-Pfad", () => {
-    const out = resolveTailwindCli({
-      bun: {
-        resolveSync: () => "/repo/node_modules/@tailwindcss/cli/package.json",
-      },
-      cwd: "/repo",
-    });
-    expect(out).toBe("/repo/node_modules/@tailwindcss/cli/dist/index.mjs");
-  });
-
-  test("Bun-Resolver wird mit korrektem id und cwd aufgerufen", () => {
-    const calls: Array<{ id: string; from: string }> = [];
-    resolveTailwindCli({
-      bun: {
-        resolveSync: (id, from) => {
-          calls.push({ id, from });
-          return "/x/node_modules/@tailwindcss/cli/package.json";
-        },
-      },
-      cwd: "/some/working/dir",
-    });
-    expect(calls).toEqual([{ id: "@tailwindcss/cli/package.json", from: "/some/working/dir" }]);
-  });
-});
-
-describe("canResolveTailwindStylesheet", () => {
-  test("tailwindcss resolvable from entry dir → true", () => {
-    const out = canResolveTailwindStylesheet("/repo/packages/app/src/styles.css", {
-      bun: {
-        resolveSync: (id, from) => {
-          if (id === "tailwindcss" && from === "/repo/packages/app/src") {
-            return "/repo/node_modules/tailwindcss/index.css";
-          }
-          throw new Error("not found");
-        },
-      },
-      cwd: "/repo/packages/app",
-    });
-    expect(out).toBe(true);
-  });
-
-  test("tailwindcss not resolvable from entry dir → false", () => {
-    const out = canResolveTailwindStylesheet(
-      "/cache/@cosmicdrift/kumiko-renderer-web/src/styles.css",
-      {
-        bun: {
-          resolveSync: () => {
-            throw new Error("not found");
-          },
-        },
-        cwd: "/tmp/minimal-fixture",
-      },
-    );
-    expect(out).toBe(false);
-  });
-});

package/src/__tests__/run-prod-app-dry-run.test.ts

@@ -1,135 +0,0 @@
-// Dry-run + bootErrorReporter paths — no DB/Redis. envSource avoids process.exit(0).
-
-import { describe, expect, test } from "bun:test";
-import { composeEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
-import * as z from "zod";
-import { runProdApp } from "../run-prod-app";
-import { makeProbeFeature, withClearedBootEnv } from "./boot-probe-fixture";
-
-const probeFeature = makeProbeFeature({
-  name: "dry-run-probe",
-  table: "dry_run_probe",
-  extraSetup: (r) => {
-    r.envSchema(z.object({ DRY_RUN_PROBE: z.string().optional().describe("probe var") }));
-  },
-});
-
-describe("runProdApp dry-run / bootErrorReporter", () => {
-  withClearedBootEnv();
-
-  test("KUMIKO_DRY_RUN_ENV=human + envSource → render + dry-run handle (no exit)", async () => {
-    const logs: string[] = [];
-    const originalLog = console.log;
-    console.log = (...args: unknown[]) => {
-      logs.push(args.map(String).join(" "));
-    };
-    const envSchema = composeEnvSchema({ features: [probeFeature] });
-    let handle: Awaited<ReturnType<typeof runProdApp>>;
-    try {
-      handle = await runProdApp({
-        features: [probeFeature],
-        envSchema,
-        autoListen: false,
-        migrations: false,
-        envSource: { KUMIKO_DRY_RUN_ENV: "human" },
-      });
-    } finally {
-      console.log = originalLog;
-    }
-
-    expect(logs.some((l) => l.includes("DRY_RUN_PROBE"))).toBe(true);
-    const res = await handle!.fetch(new Request("http://test/"));
-    expect(res.status).toBe(503);
-    expect(await res.text()).toBe("dry-run");
-    await handle!.stop();
-  });
-
-  test("KUMIKO_DRY_RUN_ENV=json → structured dry-run output", async () => {
-    const logs: string[] = [];
-    const originalLog = console.log;
-    console.log = (...args: unknown[]) => {
-      logs.push(args.map(String).join(" "));
-    };
-    const envSchema = composeEnvSchema({ features: [probeFeature] });
-    try {
-      const handle = await runProdApp({
-        features: [probeFeature],
-        envSchema,
-        autoListen: false,
-        migrations: false,
-        envSource: { KUMIKO_DRY_RUN_ENV: "json" },
-      });
-      await handle.stop();
-    } finally {
-      console.log = originalLog;
-    }
-    const jsonLine = logs.find((l) => l.trimStart().startsWith("{"));
-    if (!jsonLine) throw new Error(`No JSON line in logs: ${JSON.stringify(logs)}`);
-    const parsed = JSON.parse(jsonLine) as {
-      optional: Array<{ name: string; feature: string }>;
-    };
-    expect(parsed.optional).toContainEqual(
-      expect.objectContaining({ name: "DRY_RUN_PROBE", feature: "dry-run-probe" }),
-    );
-  });
-
-  test("unrecognized KUMIKO_DRY_RUN_ENV warns then hits envSchema parse", async () => {
-    const warnings: string[] = [];
-    const originalWarn = console.warn;
-    console.warn = (...args: unknown[]) => {
-      warnings.push(args.map(String).join(" "));
-    };
-    const envSchema = composeEnvSchema({
-      features: [],
-      extend: z.object({ MUST_HAVE: z.string().describe("required for test") }),
-    });
-    try {
-      await expect(
-        runProdApp({
-          features: [probeFeature],
-          envSchema,
-          autoListen: false,
-          migrations: false,
-          envSource: { KUMIKO_DRY_RUN_ENV: "not-a-real-mode" },
-          bootErrorReporter: (err) => {
-            throw err;
-          },
-        }),
-      ).rejects.toBeInstanceOf(KumikoBootError);
-    } finally {
-      console.warn = originalWarn;
-    }
-    expect(
-      warnings.some(
-        (w) => w.includes('KUMIKO_DRY_RUN_ENV="not-a-real-mode"') && w.includes("unrecognized"),
-      ),
-    ).toBe(true);
-  });
-
-  test("bootErrorReporter receives KumikoBootError instead of process.exit", async () => {
-    const envSchema = composeEnvSchema({
-      features: [],
-      extend: z.object({ MUST_HAVE: z.string().describe("required for test") }),
-    });
-    let reported: KumikoBootError | undefined;
-    await expect(
-      runProdApp({
-        features: [probeFeature],
-        envSchema,
-        autoListen: false,
-        migrations: false,
-        envSource: {
-          // no MUST_HAVE → parseEnv throws KumikoBootError
-          DATABASE_URL: "postgres://x",
-          REDIS_URL: "redis://x",
-        },
-        bootErrorReporter: (err) => {
-          reported = err;
-          throw err;
-        },
-      }),
-    ).rejects.toBeInstanceOf(KumikoBootError);
-    expect(reported).toBeInstanceOf(KumikoBootError);
-    expect(reported!.errors.some((e) => e.name === "MUST_HAVE")).toBe(true);
-  });
-});

package/src/__tests__/run-prod-app-env-source.test.ts

@@ -1,118 +0,0 @@
-// Regression: the boot-path must read the injected `envSource`, not the real
-// process.env. Boot-mode (KUMIKO_DRY_RUN_ENV=boot) validates wiring + builds
-// the registry, then tears down the lazy DB/Redis clients before any socket
-// opens — so this runs without a real Postgres/Redis (same as the CI boot
-// smoke). Before the fix, requireEnv/readEnv read process.env directly, so the
-// required-var test would throw "required env var DATABASE_URL is missing" and
-// the PORT test would bind the default instead of the injected port.
-
-import { describe, expect, test } from "bun:test";
-import { runProdApp } from "../run-prod-app";
-import { makeProbeFeature, withClearedBootEnv } from "./boot-probe-fixture";
-
-const probeFeature = makeProbeFeature({
-  name: "env-source-probe",
-  table: "env_source_probe",
-});
-
-const DUMMY_ENV = {
-  KUMIKO_DRY_RUN_ENV: "boot",
-  DATABASE_URL: "postgres://smoke:smoke@127.0.0.1:1/smoke",
-  REDIS_URL: "redis://127.0.0.1:1",
-  JWT_SECRET: "smokesmokesmokesmokesmokesmokesmokesmoke",
-} as const;
-
-describe("runProdApp boot-mode env-source", () => {
-  withClearedBootEnv();
-
-  test("boots from injected envSource even when process.env lacks the required vars", async () => {
-    const logs: string[] = [];
-    const originalLog = console.log;
-    console.log = (...args: unknown[]) => {
-      logs.push(args.map(String).join(" "));
-    };
-    let handle: Awaited<ReturnType<typeof runProdApp>>;
-    try {
-      handle = await runProdApp({
-        features: [probeFeature],
-        autoListen: false,
-        migrations: false,
-        // REDIS_URL points at an unreachable port — boot-mode must NOT
-        // construct the (eager) Redis client, so this never tries to connect.
-        envSource: { ...DUMMY_ENV },
-      });
-    } finally {
-      console.log = originalLog;
-    }
-
-    // Boot-mode with an injected envSource returns an inert dry-run handle.
-    expect(handle).toBeDefined();
-    expect(typeof handle.stop).toBe("function");
-    // The registry was built + validated before any connection was opened.
-    expect(logs.some((line) => line.includes("boot validation OK"))).toBe(true);
-    await handle.stop();
-  });
-
-  test("boot-mode constructs no eager Redis client — kein TCP-Connect auf REDIS_URL", async () => {
-    // Kern-Garantie (224/2), als Netzwerk-Beweis statt Konstruktor-Spy:
-    // REDIS_URL zeigt auf einen lokalen Listener — `new Redis(...)`
-    // connectet eager, der Boot-Exit MUSS also vorher liegen, sonst
-    // zählt der Listener eine Connection.
-    let connections = 0;
-    const listener = Bun.listen({
-      hostname: "127.0.0.1",
-      port: 0,
-      socket: {
-        open(socket) {
-          connections += 1;
-          socket.end();
-        },
-        data() {},
-      },
-    });
-
-    const originalLog = console.log;
-    console.log = () => {};
-    try {
-      const handle = await runProdApp({
-        features: [probeFeature],
-        autoListen: false,
-        migrations: false,
-        envSource: { ...DUMMY_ENV, REDIS_URL: `redis://127.0.0.1:${listener.port}` },
-      });
-      await handle.stop();
-    } finally {
-      console.log = originalLog;
-    }
-
-    // Ein eager Connect wäre bereits beim runProdApp-await passiert;
-    // kleine Nachfrist für asynchrone Socket-Anläufe.
-    await new Promise((resolve) => setTimeout(resolve, 150));
-    listener.stop(true);
-    expect(connections).toBe(0);
-  });
-
-  test("resolves PORT from envSource, not process.env", async () => {
-    const logs: string[] = [];
-    const originalLog = console.log;
-    console.log = (...args: unknown[]) => {
-      logs.push(args.map(String).join(" "));
-    };
-    try {
-      const handle = await runProdApp({
-        features: [probeFeature],
-        autoListen: false,
-        migrations: false,
-        envSource: { ...DUMMY_ENV, PORT: "8123" },
-      });
-      await handle.stop();
-    } finally {
-      console.log = originalLog;
-    }
-
-    // The boot logs "booting Kumiko stack on port <port>" — pre-fix this read
-    // process.env["PORT"] (deleted here) and would log the 3000 default.
-    expect(logs.some((line) => line.includes("port 8123"))).toBe(true);
-    expect(logs.some((line) => line.includes("port 3000"))).toBe(false);
-  });
-});

package/src/__tests__/run-prod-app-kms-slots.test.ts

@@ -1,108 +0,0 @@
-// A schema field marked `kms` is decrypted once at boot and the RESOLVED env
-// feeds the master-key probe: a ciphertext-only KUMIKO_SECRETS_MASTER_KEY_V1
-// boots, and without any key the probe still fails. Boot-mode runs without
-// Postgres/Redis (see run-prod-app-env-source.test.ts).
-
-import { afterEach, describe, expect, test } from "bun:test";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import type { ComposedEnvSchema } from "@cosmicdrift/kumiko-framework/env";
-import * as z from "zod";
-import { runProdApp } from "../run-prod-app";
-import { withClearedBootEnv } from "./boot-probe-fixture";
-
-const MASTER_KEY = Buffer.alloc(32, 7).toString("base64");
-
-const encryptedFeature = defineFeature("kms-slots-probe", (r) => {
-  r.entity(
-    "note",
-    createEntity({
-      table: "kms_slots_probe_note",
-      fields: {
-        body: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
-      },
-    }),
-  );
-});
-
-const envSchema: ComposedEnvSchema = {
-  schema: z.object({
-    KUMIKO_SECRETS_MASTER_KEY_V1: z.string().meta({ kumiko: { kms: true } }),
-  }),
-  sources: {},
-};
-
-const BASE_ENV = {
-  KUMIKO_DRY_RUN_ENV: "boot",
-  DATABASE_URL: "postgres://smoke:smoke@127.0.0.1:1/smoke",
-  REDIS_URL: "redis://127.0.0.1:1",
-  JWT_SECRET: "smokesmokesmokesmokesmokesmokesmokesmoke",
-} as const;
-
-const originalFetch = globalThis.fetch;
-const originalLog = console.log;
-const originalInfo = console.info;
-
-function bootWith(env: Record<string, string>): ReturnType<typeof runProdApp> {
-  return runProdApp({
-    features: [encryptedFeature],
-    envSchema,
-    autoListen: false,
-    migrations: false,
-    envSource: { ...BASE_ENV, ...env },
-  });
-}
-
-describe("runProdApp kms slots", () => {
-  withClearedBootEnv();
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    console.log = originalLog;
-    console.info = originalInfo;
-  });
-
-  test("boots with a master key that exists only as Key Manager ciphertext", async () => {
-    const decrypted: string[] = [];
-    globalThis.fetch = (async (_url: string | URL, init?: RequestInit) => {
-      decrypted.push(JSON.parse(String(init?.body)).ciphertext);
-      return new Response(JSON.stringify({ plaintext: MASTER_KEY }), { status: 200 });
-    }) as unknown as typeof globalThis.fetch;
-    console.log = () => {};
-    console.info = () => {};
-
-    const handle = await bootWith({
-      KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: "Y2lwaGVy",
-      PLATFORM_KEK_KMS_KEY_ID: "key-1",
-      PLATFORM_KEK_KMS_TOKEN: "token",
-    });
-
-    await handle.stop();
-    expect(decrypted).toEqual(["Y2lwaGVy"]);
-  });
-
-  test("a plaintext master key boots without any Key Manager request", async () => {
-    let requests = 0;
-    globalThis.fetch = (async () => {
-      requests += 1;
-      throw new Error("must not be called");
-    }) as unknown as typeof globalThis.fetch;
-    console.log = () => {};
-    console.info = () => {};
-
-    const handle = await bootWith({
-      KUMIKO_SECRETS_MASTER_KEY_V1: MASTER_KEY,
-      KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: "Y2lwaGVy",
-    });
-
-    await handle.stop();
-    expect(requests).toBe(0);
-  });
-
-  test("without plaintext or ciphertext the boot probe still rejects", async () => {
-    console.log = () => {};
-    console.info = () => {};
-
-    await expect(bootWith({ KUMIKO_SECRETS_MASTER_KEY_V1: "" })).rejects.toThrow(
-      /no usable master key/,
-    );
-  });
-});