@decohere/scaffold 0.0.1-dev.125 → 0.0.1-dev.18

package/tests/compose.model.spec.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { DockerCompose } from "../src/models/compose.model.js";
+
+describe("DockerCompose SSRF/exposure hardening helpers", () => {
+	it("renders loopback-bound ports and optional profiles", () => {
+		const compose = new DockerCompose()
+			.setProjectName("webapi")
+			.addService("postgres", {
+				image: "postgres:16",
+				ports: ["127.0.0.1:5433:5432"],
+			})
+			.addService("adminer", {
+				image: "adminer",
+				profiles: ["tools"],
+				ports: ["127.0.0.1:8081:8080"],
+			});
+
+		const yaml = compose.getContent();
+		expect(yaml).toContain('ports:\n      - "127.0.0.1:5433:5432"');
+		expect(yaml).toContain("profiles:\n      - tools");
+		expect(yaml).toContain('ports:\n      - "127.0.0.1:8081:8080"');
+		expect(yaml).not.toMatch(/ports:\n\s+- "5433:5432"/);
+		expect(yaml).not.toMatch(/ports:\n\s+- "8081:8080"/);
+	});
+
+	it("renders header comments and bind mounts without a named volumes section", () => {
+		const yaml = new DockerCompose()
+			.addHeaderComment("Bind mount dies with the working tree.")
+			.addService("postgres", {
+				image: "postgres:16",
+				volumes: ["./postgres-data:/var/lib/postgresql/data"],
+			})
+			.getContent();
+
+		expect(yaml.startsWith("# Bind mount dies with the working tree.")).toBe(true);
+		expect(yaml).toContain("./postgres-data:/var/lib/postgresql/data");
+		expect(yaml).not.toMatch(/^volumes:\s*$/m);
+	});
+
+	it("quotes compose user so 0:0 is not parsed as a number", () => {
+		const yaml = new DockerCompose()
+			.addService("devcontainer", {
+				build: ".",
+				user: "0:0",
+				command: "sleep infinity",
+			})
+			.getContent();
+
+		expect(yaml).toContain('user: "0:0"');
+	});
+});

package/tests/container-image.model.spec.ts

@@ -0,0 +1,162 @@
+import { describe, expect, it } from "vitest";
+import {
+	DevContainerImageModel,
+	DockerfileModel,
+	DockerStep,
+	withGithubCli,
+	withPnpm,
+	withPostgresqlClient,
+} from "../src/models/docker-image.model.js";
+import { WebapiProductionDockerfile } from "../src/webapi/models/production-dockerfile.model.js";
+import { WebapiDevContainer } from "../src/webapi/models/webapi-image.model.js";
+
+describe("DockerfileModel", () => {
+	it("supports from() and entrypoint() with entrypoint rendered at the end", () => {
+		const dockerfile = new DockerfileModel("node:24").from("debian:bookworm");
+		dockerfile.entrypoint(["node", "/app/index.js"]);
+
+		const content = dockerfile.build();
+		expect(content).toContain("FROM debian:bookworm");
+		expect(content.trimEnd().endsWith('ENTRYPOINT ["node","/app/index.js"]')).toBe(true);
+	});
+
+	it("generic image model writes Dockerfile at project root", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		const files = dockerfile.files();
+
+		expect(files).toHaveLength(1);
+		expect(files[0]?.filePath).toBe("./Dockerfile");
+	});
+
+	it("base model is generic and has no devcontainer defaults", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		const content = dockerfile.build();
+
+		expect(content).toContain("FROM node:24");
+		expect(content).not.toContain("ENV HISTFILE=/commandhistory/.bash_history");
+		expect(content).not.toContain("pnpm@10");
+		expect(content).not.toContain("bootloader.js");
+	});
+
+	it("devcontainer subtype adds command history and vscode bootloader fix", () => {
+		const dockerfile = new DevContainerImageModel("node:24");
+		const content = dockerfile.build();
+		const files = dockerfile.files();
+
+		expect(content).toContain("ENV HISTFILE=/commandhistory/.bash_history");
+		expect(content).toContain("chown -R node /commandhistory");
+		expect(content).toContain("PROMPT_COMMAND='history -a'");
+		expect(content).toContain("bootloader.js");
+		expect(files).toHaveLength(1);
+		expect(files[0]?.filePath).toBe(".devcontainer/Dockerfile");
+	});
+
+	it("applies string layers as RUN steps", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer("echo hello-world");
+
+		const content = dockerfile.build();
+		expect(content).toContain("RUN echo hello-world");
+	});
+
+	it("executes layer writers at build and sorts keyed steps by order", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer((df) => {
+			df.addStep(DockerStep.run("ordered-b", "echo second", 2_001));
+			df.addStep(DockerStep.run("ordered-a", "echo first", 2_000));
+		});
+
+		const content = dockerfile.build();
+		expect(content.indexOf("RUN echo first")).toBeLessThan(content.indexOf("RUN echo second"));
+	});
+
+	it("uses keyed upsert semantics when multiple layers write the same step key", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer((df) => {
+			df.addStep(DockerStep.run("replace-me", "echo old", 2_000));
+		});
+		dockerfile.addLayer((df) => {
+			df.addStep(DockerStep.run("replace-me", "echo new", 2_000));
+		});
+
+		const content = dockerfile.build();
+		expect(content).not.toContain("RUN echo old");
+		expect(content).toContain("RUN echo new");
+	});
+
+	it("supports reusable layer writers", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer(withPnpm({ version: "9" }));
+
+		const content = dockerfile.build();
+		expect(content).toContain("pnpm@9");
+	});
+
+	it("withPostgresqlClient escalates to root so it works on a published base image", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer(withPostgresqlClient());
+
+		const content = dockerfile.build();
+		expect(content).toContain("USER root");
+		expect(content).toContain("postgresql-client");
+		expect(content).toContain("apt-get install");
+		expect(content).toContain("USER node");
+	});
+
+	it("withGithubCli installs gh before USER", () => {
+		const dockerfile = new DockerfileModel("node:24");
+		dockerfile.addLayer(withGithubCli());
+
+		const content = dockerfile.build();
+		expect(content).toContain("apt-get install -y --no-install-recommends gh");
+	});
+
+	it("webapi production dockerfile uses conventional pnpm build/start", () => {
+		const dockerfile = new WebapiProductionDockerfile();
+		const files = dockerfile.files();
+		const docker = files.find((f) => f.filePath === "Dockerfile");
+		expect(docker?.content).toContain("pnpm run build");
+		expect(docker?.content).toContain('CMD ["pnpm", "start"]');
+		expect(docker?.content).toContain("COPY projects/api");
+		expect(files.some((f) => f.filePath === ".dockerignore")).toBe(true);
+		expect(files.some((f) => f.filePath === "Dockerfile.api")).toBe(false);
+	});
+
+	it("webapi production dockerfile copies production-only node_modules into the run image", () => {
+		const docker = new WebapiProductionDockerfile()
+			.files()
+			.find((f) => f.filePath === "Dockerfile");
+		expect(docker?.content).toContain("AS prod-deps");
+		expect(docker?.content).toContain("pnpm install --frozen-lockfile --prod");
+		expect(docker?.content).toContain(
+			"COPY --from=prod-deps /app/node_modules ./node_modules",
+		);
+		expect(docker?.content).not.toContain("COPY --from=build /app/node_modules");
+	});
+
+	it("emits Dockerfile.<name> for extra or custom-named APIs", () => {
+		const files = new WebapiProductionDockerfile(["api", "billing"]).files();
+		expect(files.some((f) => f.filePath === "Dockerfile.billing")).toBe(true);
+		const billing = files.find((f) => f.filePath === "Dockerfile.billing");
+		expect(billing?.content).toContain("COPY projects/billing");
+		expect(billing?.content).toContain('CMD ["pnpm", "run", "start:billing"]');
+		expect(billing?.content).toContain(
+			"COPY --from=prod-deps /app/node_modules ./node_modules",
+		);
+		expect(billing?.content).not.toContain("COPY --from=build /app/node_modules");
+		const root = files.find((f) => f.filePath === "Dockerfile");
+		expect(root?.content).toContain("COPY projects/api");
+	});
+
+	it("webapi scaffold Dockerfile is a thin FROM the published base image", () => {
+		const dockerfile = new WebapiDevContainer();
+		const content = dockerfile.build();
+		const files = dockerfile.files();
+
+		expect(content).toMatch(/^FROM ghcr\.io\/typesmiths\/decohere\/devcontainer:/);
+		expect(content).not.toContain("pnpm@10");
+		expect(content).not.toContain("bootloader.js");
+		expect(files).toHaveLength(1);
+		expect(files[0]?.filePath).toBe(".devcontainer/Dockerfile");
+	});
+});

package/tests/dev-container.model.spec.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { DevContainer } from "../src/models/dev-container.model.js";
+
+describe("DevContainer", () => {
+	it("renders postCreateCommand and updateContentCommand when set", () => {
+		const files = new DevContainer()
+			.setPostCreateCommand("bash .devcontainer/post-create.sh")
+			.setUpdateContentCommand("bash .devcontainer/post-create.sh")
+			.setPostStartCommand("bash .devcontainer/post-start.sh")
+			.useCompose()
+			.files();
+
+		const json = JSON.parse(files[0]!.content) as Record<string, unknown>;
+		expect(json.postCreateCommand).toBe("bash .devcontainer/post-create.sh");
+		expect(json.updateContentCommand).toBe("bash .devcontainer/post-create.sh");
+		expect(json.postStartCommand).toBe("bash .devcontainer/post-start.sh");
+		expect(json).not.toHaveProperty("initializeCommand");
+	});
+
+	it("omits install lifecycle keys when unset", () => {
+		const files = new DevContainer()
+			.setPostStartCommand("bash .devcontainer/post-start.sh")
+			.files();
+		const json = JSON.parse(files[0]!.content) as Record<string, unknown>;
+		expect(json).not.toHaveProperty("postCreateCommand");
+		expect(json).not.toHaveProperty("updateContentCommand");
+		expect(json.postStartCommand).toBe("bash .devcontainer/post-start.sh");
+	});
+});

package/tests/devcontainer-base-image.spec.ts

@@ -0,0 +1,32 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+import { AppDevContainerBaseImage } from "../src/models/docker-image.model.js";
+
+const realFs = await vi.importActual<typeof import("node:fs")>("node:fs");
+
+const DOCKERFILE = join(
+	dirname(fileURLToPath(import.meta.url)),
+	"../../devcontainer/Dockerfile",
+);
+
+describe("published app Dev Container base image", () => {
+	it("keeps projects/devcontainer/Dockerfile in sync with AppDevContainerBaseImage", () => {
+		const expected = new AppDevContainerBaseImage("node:24").build();
+		const onDisk = realFs.readFileSync(DOCKERFILE, "utf8");
+		const fromIdx = onDisk.indexOf("\nFROM ");
+		const body = fromIdx >= 0 ? onDisk.slice(fromIdx + 1) : onDisk;
+		expect(body).toBe(expected);
+	});
+
+	it("includes writable bash history, pnpm, gh, and node user", () => {
+		const content = new AppDevContainerBaseImage("node:24").build();
+		expect(content).toContain("ENV HISTFILE=/commandhistory/.bash_history");
+		expect(content).toContain("chown -R node /commandhistory");
+		expect(content).toContain("PROMPT_COMMAND='history -a'");
+		expect(content).toContain("pnpm@10");
+		expect(content).toContain("apt-get install -y --no-install-recommends gh");
+		expect(content).toContain("USER ${USERNAME}");
+		expect(content).toContain("bootloader.js");
+	});
+});

package/tests/hello-di-inject.scaffold.spec.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { ControllerSourceFile } from "../src/webapi/models/controller-source-file.model.js";
+
+/**
+ * Regression CU-869eja46u: SWC can emit design:paramtypes as Object when the
+ * service class is still undefined at decorate time. Crucible then resolves
+ * "Object" → null → getGreeting TypeError. Explicit @inject(token) is required.
+ */
+describe("HelloController DI inject tokens", () => {
+	it("annotates SampleService with @inject so anonymous hello cannot get a null sample", () => {
+		const content = new ControllerSourceFile().files()[0]?.content ?? "";
+		expect(content).toContain('import { inject } from "@decohere/crucible/decorators"');
+		expect(content).toContain(
+			'@inject("SampleService") private readonly sample: SampleService',
+		);
+		expect(content).toContain("await this.sample.getGreeting()");
+	});
+});

package/tests/hello-route.contract.spec.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from "vitest";
+import type { RouteMetadata } from "../../cortex/src/routing/anvil.types.js";
+import {
+	Controller,
+	Delete,
+	Get,
+	Param,
+	Post,
+	Put,
+	Query,
+} from "../../cortex/src/routing/index.js";
+import { RouteRegistry } from "../../cortex/src/routing/services/route-registry.js";
+import { POSTMAN_CALLBACKS } from "../src/webapi/features/postman.feature.js";
+import { ControllerSourceFile } from "../src/webapi/models/controller-source-file.model.js";
+import { MainSourceFile } from "../src/webapi/models/main-source-file.model.js";
+import { buildHelloOpenApiDocument } from "../src/webapi/postman/hello-openapi.js";
+
+/**
+ * Contract: scaffolded Hello routes must match Postman / OpenAPI paths.
+ * Regression: `@Post("/")` registered POST /hello/ while Postman called POST /hello.
+ */
+
+describe("Hello controller ↔ Postman route contract", () => {
+	it("generates @Post() without a trailing-slash path", () => {
+		const content = new ControllerSourceFile().files()[0]?.content ?? "";
+		expect(content).toMatch(/@Post\(\)/);
+		expect(content).not.toMatch(/@Post\("\/"\)/);
+	});
+
+	it("enables withOpenApi by default so Hello @Field bodies are validated", () => {
+		const content = new MainSourceFile("demo.api").files()[0]?.content ?? "";
+		expect(content).toContain("withOpenApi");
+		expect(content).toContain('title: "demo.api"');
+	});
+
+	it("registers the same paths OpenAPI / Postman Local View call", () => {
+		@Controller({ prefix: "/hello" })
+		class HelloController {
+			@Get()
+			public getAll(@Query("filter") _filter: string) {}
+
+			@Get("/:id")
+			public getOne(@Param("id") _id: string) {}
+
+			@Post()
+			public create() {}
+
+			@Put("/:id")
+			public update(@Param("id") _id: string) {}
+
+			@Delete("/:id")
+			public remove(@Param("id") _id: string) {}
+		}
+
+		const registry = new RouteRegistry();
+		registry.addController(HelloController);
+
+		const registered: Record<string, RouteMetadata | undefined> = {
+			getAll: registry.getRoute("GET|/hello"),
+			getOne: registry.getRoute("GET|/hello/:id"),
+			create: registry.getRoute("POST|/hello"),
+			update: registry.getRoute("PUT|/hello/:id"),
+			remove: registry.getRoute("DELETE|/hello/:id"),
+		};
+
+		expect(registered.getAll).toMatchObject({ method: "GET", path: "/hello" });
+		expect(registered.getOne).toMatchObject({ method: "GET", path: "/hello/:id" });
+		expect(registered.create).toMatchObject({ method: "POST", path: "/hello" });
+		expect(registered.update).toMatchObject({ method: "PUT", path: "/hello/:id" });
+		expect(registered.remove).toMatchObject({ method: "DELETE", path: "/hello/:id" });
+
+		const openapi = buildHelloOpenApiDocument("Contract");
+		expect(Object.keys(openapi.paths)).toEqual(
+			expect.arrayContaining(["/hello", "/hello/{id}"]),
+		);
+
+		const postman = {
+			list: { method: "GET", url: "{{baseUrl}}/hello" },
+			getOne: { method: "GET", url: "{{baseUrl}}/hello/:id" },
+			create: { method: "POST", url: "{{baseUrl}}/hello" },
+			update: { method: "PUT", url: "{{baseUrl}}/hello/:id" },
+			remove: { method: "DELETE", url: "{{baseUrl}}/hello/:id" },
+		};
+		expect(postman.create.url.replace("{{baseUrl}}", "")).toBe(registered.create?.path);
+		expect(postman.list.url.replace("{{baseUrl}}", "")).toBe(registered.getAll?.path);
+		expect(postman.getOne.url.replace("{{baseUrl}}", "")).toBe(registered.getOne?.path);
+		expect(postman.update.url.replace("{{baseUrl}}", "")).toBe(registered.update?.path);
+		expect(postman.remove.url.replace("{{baseUrl}}", "")).toBe(registered.remove?.path);
+	});
+
+	it("keeps Postman OAuth callbacks stable (sanity for auth contract)", () => {
+		expect(POSTMAN_CALLBACKS).toContain("https://oauth.pstmn.io/v1/callback");
+	});
+});

package/tests/package-json.order.spec.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { PackageJson, sortStringMap } from "../src/models/package-json.model.js";
+import { ApiPackageJson } from "../src/webapi/models/api-package-json.model.js";
+
+describe("sortStringMap CU-869ej9z6p", () => {
+	it("orders keys A→Z", () => {
+		expect(Object.keys(sortStringMap({ zebra: "1", alpha: "2", "@scope/pkg": "3" }))).toEqual([
+			"@scope/pkg",
+			"alpha",
+			"zebra",
+		]);
+	});
+});
+
+describe("PackageJson dependency order CU-869ej9z6p", () => {
+	it("renders dependencies and devDependencies sorted regardless of add order", () => {
+		const pkg = new PackageJson("demo.api", { apiNames: ["api"], workspaceName: "demo" });
+		pkg.addDependency("typeorm", "^0.3.28");
+		pkg.addDependency("@casl/ability", "^6.8.1");
+		pkg.addDependency("@decohere/codex", "0.0.1");
+		pkg.addDevDependency("vitest", "^3.2.4");
+		pkg.addDevDependency("@biomejs/biome", "^2.0.0");
+
+		const rendered = JSON.parse(pkg.files()[0]!.content) as {
+			dependencies: Record<string, string>;
+			devDependencies: Record<string, string>;
+		};
+
+		expect(Object.keys(rendered.dependencies)).toEqual(
+			[...Object.keys(rendered.dependencies)].sort((a, b) => a.localeCompare(b, "en")),
+		);
+		expect(Object.keys(rendered.devDependencies)).toEqual(
+			[...Object.keys(rendered.devDependencies)].sort((a, b) => a.localeCompare(b, "en")),
+		);
+		expect(Object.keys(rendered.dependencies).indexOf("@casl/ability")).toBeLessThan(
+			Object.keys(rendered.dependencies).indexOf("typeorm"),
+		);
+	});
+});
+
+describe("ApiPackageJson dependency order CU-869ej9z6p", () => {
+	it("renders dependencies sorted regardless of add order", () => {
+		const pkg = new ApiPackageJson("demo", "api");
+		pkg.addDependency("@decohere/codex-typeorm", "0.0.1");
+		pkg.addDependency("@casl/ability", "^6.8.1");
+		pkg.addDependency("@decohere/codex", "0.0.1");
+
+		const rendered = JSON.parse(pkg.files()[0]!.content) as {
+			dependencies: Record<string, string>;
+		};
+		expect(Object.keys(rendered.dependencies)).toEqual([
+			"@casl/ability",
+			"@decohere/codex",
+			"@decohere/codex-typeorm",
+			"@decohere/cortex",
+			"@decohere/crucible",
+		]);
+	});
+});

package/tests/postman-from-openapi.spec.ts

@@ -0,0 +1,197 @@
+import { describe, expect, it } from "vitest";
+import {
+	buildHybridPostmanCollection,
+	POSTMAN_CALLBACKS,
+	POSTMAN_SCOPES,
+} from "../src/webapi/features/postman.feature.js";
+import { buildHelloOpenApiDocument } from "../src/webapi/postman/hello-openapi.js";
+import {
+	buildEnvironmentYaml,
+	buildLocalViewFilesFromCollection,
+} from "../src/webapi/postman/local-view.js";
+import {
+	applyPostmanAuthOverlay,
+	openApiPathParamsToColon,
+	openApiToPostmanCollection,
+	type PostmanCollection,
+} from "../src/webapi/postman/openapi-to-postman.js";
+
+const auth0 = {
+	auth0Domain: "example.auth0.com",
+	auth0Audience: "https://api.example.com",
+	auth0ClientId: "abc",
+};
+
+describe("Postman from OpenAPI (hybrid)", () => {
+	it("converts Hello OpenAPI into a Postman collection with :id paths", async () => {
+		const openapi = buildHelloOpenApiDocument("Demo");
+		const base = await openApiToPostmanCollection(openapi);
+		const collection = applyPostmanAuthOverlay(base, "Demo", undefined, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+			description: "test",
+		});
+
+		expect(collection.info.name).toBe("Demo WebAPI");
+		const helloFolder = collection.item?.find((i) => i.name === "Hello");
+		expect(helloFolder?.item?.length).toBeGreaterThanOrEqual(5);
+
+		const urls = (helloFolder?.item ?? [])
+			.map((i) => {
+				const url = i.request?.url;
+				return typeof url === "string" ? url : url?.raw;
+			})
+			.filter(Boolean);
+
+		expect(urls).toEqual(
+			expect.arrayContaining(["{{baseUrl}}/hello", "{{baseUrl}}/hello/:id"]),
+		);
+
+		const list = helloFolder?.item?.find((i) => i.name === "List (anonymous)");
+		expect(list?.request?.auth).toEqual({ type: "noauth" });
+	});
+
+	it("applies Auth0 overlay without changing route inventory", async () => {
+		const collection = await buildHybridPostmanCollection("Demo", auth0);
+		expect(collection.auth).toMatchObject({ type: "oauth2" });
+		const hello = collection.item?.find((i) => i.name === "Hello");
+		expect(hello?.item?.some((i) => i.name === "Create")).toBe(true);
+	});
+
+	it("emits Local View YAML requests from the hybrid collection", async () => {
+		const collection = await buildHybridPostmanCollection("Demo");
+		const files = buildLocalViewFilesFromCollection(collection, "Demo", undefined, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+		});
+		const paths = files.map((f) => f.filePath);
+		expect(paths).toContain("postman/collections/Demo WebAPI/.resources/definition.yaml");
+		expect(paths.some((p) => p.includes("List (anonymous).request.yaml"))).toBe(true);
+		expect(paths.some((p) => p.includes("Create.request.yaml"))).toBe(true);
+
+		const create = files.find((f) => f.filePath.endsWith("Create.request.yaml"));
+		expect(create?.content).toContain('url: "{{baseUrl}}/hello"');
+		expect(create?.content).toContain("method: POST");
+	});
+
+	it("builds environment YAML with and without Auth0", () => {
+		const bare = buildEnvironmentYaml("Demo Local", undefined, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+		});
+		expect(bare).toContain("name: Demo Local");
+		expect(bare).toContain("key: baseUrl");
+		expect(bare).not.toContain("auth0Domain");
+
+		const withAuth = buildEnvironmentYaml("Demo Local", auth0, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+		});
+		expect(withAuth).toContain("key: auth0Domain");
+		expect(withAuth).toContain("value: example.auth0.com");
+		expect(withAuth).toContain("key: callbackUrl");
+	});
+
+	it("emits Local View collection auth block and request edge cases", async () => {
+		const collection = await buildHybridPostmanCollection("Demo", auth0);
+		const files = buildLocalViewFilesFromCollection(collection, "Demo", auth0, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+		});
+		const definition = files.find((f) =>
+			f.filePath.endsWith(".resources/definition.yaml"),
+		)?.content;
+		expect(definition).toContain("auth:");
+		expect(definition).toContain("type: oauth2");
+
+		const list = files.find((f) => f.filePath.endsWith("List (anonymous).request.yaml"));
+		expect(list?.content).toContain("auth:");
+		expect(list?.content).toContain("type: noauth");
+
+		const create = files.find((f) => f.filePath.endsWith("Create.request.yaml"));
+		expect(create?.content).toContain("body:");
+		expect(create?.content).toContain("type: json");
+	});
+
+	it("rewrites OpenAPI path params without touching Postman variables", () => {
+		expect(openApiPathParamsToColon("{{baseUrl}}/hello/{id}")).toBe("{{baseUrl}}/hello/:id");
+		expect(openApiPathParamsToColon("/hello")).toBe("/hello");
+		expect(openApiPathParamsToColon("hello")).toBe("hello");
+	});
+
+	it("uses default collection schema when converter omits info.schema", async () => {
+		const base = await openApiToPostmanCollection(buildHelloOpenApiDocument("Demo"));
+		const withoutSchema: PostmanCollection = {
+			...base,
+			info: { ...base.info, schema: undefined as unknown as string },
+		};
+		const collection = applyPostmanAuthOverlay(withoutSchema, "Demo", auth0, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+			description: "test",
+		});
+		expect(collection.info.schema).toBe(
+			"https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
+		);
+	});
+
+	it("handles nested folders and non-request items in overlay rewrite", () => {
+		const collection: PostmanCollection = {
+			info: {
+				name: "stub",
+				schema: "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
+			},
+			item: [
+				{ name: "Docs" },
+				{
+					name: "Hello",
+					item: [
+						{
+							name: "Get one",
+							request: {
+								method: "GET",
+								url: { host: ["{{baseUrl}}"], path: ["hello", "{id}"] },
+							},
+						},
+						{
+							name: "Create",
+							request: {
+								method: "POST",
+								url: "hello",
+								header: [{ key: "Content-Type", value: "application/json" }],
+								body: { raw: '{"message":"x"}' },
+							},
+						},
+					],
+				},
+			],
+		};
+		const next = applyPostmanAuthOverlay(collection, "Demo", undefined, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+			description: "test",
+		});
+		const hello = next.item?.find((i) => i.name === "Hello");
+		const getOne = hello?.item?.find((i) => i.name === "Get one");
+		const create = hello?.item?.find((i) => i.name === "Create");
+		expect(getOne?.request?.url).toMatchObject({ raw: "{{baseUrl}}/hello/:id" });
+		expect(create?.request?.url).toMatchObject({ raw: "{{baseUrl}}/hello" });
+		expect(next.item?.find((i) => i.name === "Docs")).toEqual({ name: "Docs" });
+	});
+
+	it("rejects invalid OpenAPI documents at conversion time", async () => {
+		await expect(
+			openApiToPostmanCollection({ foo: "bar" } as unknown as ReturnType<
+				typeof buildHelloOpenApiDocument
+			>),
+		).rejects.toThrow(/semantic version|conversion failed/i);
+	});
+
+	it("quotes YAML values that need escaping", () => {
+		const yaml = buildEnvironmentYaml('Demo: Local "env"', auth0, {
+			callbacks: POSTMAN_CALLBACKS,
+			scopes: POSTMAN_SCOPES,
+		});
+		expect(yaml).toContain('"Demo: Local \\"env\\""');
+	});
+});