@envive-ai/react-hooks 0.3.64 → 0.3.66

package/src/services/enviveConfigService/__tests__/enviveConfigService.test.ts

@@ -3,65 +3,15 @@ import { EnviveConfigService } from '../enviveConfigService';
 const mockFetch = vi.fn();
 globalThis.fetch = mockFetch;
 
-// getWidgetConfig is the single config call now: it returns org identity +
-// gates + experiment assignments alongside productsConfig (the separate
-// GET /v1/org/config fetch was removed). productsConfig has no colors, so
-// fetchUnifiedGraphQLConfig falls back to its mock config — fine here since
-// these tests only care about caching / fetch-count behaviour.
-function makeOkConfigFetch() {
-  mockFetch.mockResolvedValueOnce({
-    ok: true,
-    json: () =>
-      Promise.resolve({
-        data: {
-          me: {
-            org: {
-              id: 'org-1',
-              shortName: 'test-org',
-              displayName: 'Test Org',
-              domain: 'test.com',
-              createdAt: '2024-01-01T00:00:00.000Z',
-              updatedAt: '2024-01-01T00:00:00.000Z',
-            },
-            getWidgetConfig: { productsConfig: {}, gates: [], experimentAssignments: [] },
-          },
-        },
-      }),
-  });
-}
-
-// getWidgetConfig response with the use_unified_config gate ON (plus a real
-// version pin) — the trigger for the /v1/session/bootstrap upgrade.
-function makeGateOnConfigFetch() {
-  mockFetch.mockResolvedValueOnce({
-    ok: true,
-    json: () =>
-      Promise.resolve({
-        data: {
-          me: {
-            org: {
-              id: 'org-1',
-              shortName: 'test-org',
-              displayName: 'Test Org',
-              domain: 'test.com',
-              createdAt: '2024-01-01T00:00:00.000Z',
-              updatedAt: '2024-01-01T00:00:00.000Z',
-            },
-            getWidgetConfig: {
-              productsConfig: {},
-              gates: [{ name: 'use_unified_config', value: true }],
-              experimentAssignments: [],
-              resolution: { baseVersion: '1.0.0', baseVersionSource: 'merchant_layer' },
-            },
-          },
-        },
-      }),
-  });
-}
-
-// /v1/session/bootstrap response (REST snake_case). Distinct org id so tests can
-// assert the config actually came from bootstrap, not the getWidgetConfig call.
-function makeBootstrapFetch() {
+// /v1/session/bootstrap is the single session-config call now (getWidgetConfig
+// and the separate GET /v1/org/config were removed). A valid response carries
+// org identity + a NON-EMPTY gates array (the malformed-payload guard requires
+// it) + widget_config. orgId is parameterised so cache tests can assert the
+// config actually came back; urlResolving is null-able for the config-only path.
+function makeBootstrapFetch(
+  orgId = 'org-1',
+  urlResolving: unknown = { variant_type: 'pdp', specific_details: {}, ready: true },
+) {
   mockFetch.mockResolvedValueOnce({
     ok: true,
     json: () =>
@@ -69,10 +19,10 @@ function makeBootstrapFetch() {
         org_config: {
           org: {
             org: {
-              id: 'org-boot',
-              short_name: 'boot-org',
-              display_name: 'Boot Org',
-              domain: 'boot.com',
+              id: orgId,
+              short_name: 'test-org',
+              display_name: 'Test Org',
+              domain: 'test.com',
               status: 'active',
               created_at: '2024-01-01T00:00:00.000Z',
               updated_at: '2024-01-01T00:00:00.000Z',
@@ -84,7 +34,7 @@ function makeBootstrapFetch() {
         },
         widget_config: {
           products_config: {},
-          // Assignments come from widget_config (matches getWidgetConfig, ungated).
+          // Assignments come from widget_config (ungated).
           experiment_assignments: [
             {
               layer_name: 'ml',
@@ -95,7 +45,7 @@ function makeBootstrapFetch() {
           ],
           resolution: { base_version: '1.0.0', base_version_source: 'merchant_layer' },
         },
-        url_resolving: { variant_type: 'pdp', specific_details: {}, ready: true },
+        url_resolving: urlResolving,
       }),
   });
 }
@@ -125,17 +75,18 @@ afterEach(() => {
 });
 
 describe('EnviveConfigService caching', () => {
-  it('fetches the unified config once on a cold cache', async () => {
-    makeOkConfigFetch();
+  it('fetches the session config once on a cold cache', async () => {
+    makeBootstrapFetch();
 
     const result = await makeService().getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch.mock.calls[0][0]).toContain('/v1/session/bootstrap');
     expect(result.org.org.id).toBe('org-1');
   });
 
   it('serves a warm cache to a new instance with identical params without hitting the network', async () => {
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService().getEnviveConfig();
     expect(mockFetch).toHaveBeenCalledTimes(1);
 
@@ -151,13 +102,13 @@ describe('EnviveConfigService caching', () => {
     vi.useFakeTimers();
     vi.setSystemTime(new Date('2026-01-01T00:00:00.000Z'));
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService().getEnviveConfig();
     expect(mockFetch).toHaveBeenCalledTimes(1);
 
     vi.setSystemTime(new Date('2026-01-01T00:05:01.000Z'));
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService().getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(2);
@@ -168,11 +119,11 @@ describe('EnviveConfigService caching', () => {
     async param => {
       window.history.replaceState({}, '', `/?${param}=1.2.3`);
 
-      makeOkConfigFetch();
+      makeBootstrapFetch();
       await makeService().getEnviveConfig();
       expect(mockFetch).toHaveBeenCalledTimes(1);
 
-      makeOkConfigFetch();
+      makeBootstrapFetch();
       await makeService().getEnviveConfig();
 
       // No cache read/write happened, so a second instance refetches instead
@@ -183,33 +134,33 @@ describe('EnviveConfigService caching', () => {
 
   it('does not read a version-pinned cache entry after the override is removed', async () => {
     window.history.replaceState({}, '', '/?envive_config_version=1.2.3');
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService().getEnviveConfig();
 
     window.history.replaceState({}, '', '/');
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService().getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(2);
   });
 
   it('keeps separate cache entries per userId', async () => {
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService({ userId: 'user-1' }).getEnviveConfig();
     expect(mockFetch).toHaveBeenCalledTimes(1);
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService({ userId: 'user-2' }).getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(2);
   });
 
   it('keeps separate cache entries per namespace/source/baseUrl/apiKey', async () => {
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService({ namespace: 'ns-a' }).getEnviveConfig();
     expect(mockFetch).toHaveBeenCalledTimes(1);
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await makeService({ namespace: 'ns-b' }).getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(2);
@@ -220,7 +171,7 @@ describe('EnviveConfigService caching', () => {
       throw new Error('quota exceeded');
     });
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
 
     const result = await makeService().getEnviveConfig();
 
@@ -232,7 +183,7 @@ describe('EnviveConfigService caching', () => {
       throw new Error('storage disabled');
     });
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
 
     const result = await makeService().getEnviveConfig();
 
@@ -241,47 +192,34 @@ describe('EnviveConfigService caching', () => {
 
   it('fails open and refetches when a cached entry is corrupted JSON', async () => {
     const service = makeService();
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     await service.getEnviveConfig();
     const [key] = Object.keys(sessionStorage);
     sessionStorage.setItem(key, 'not json');
 
-    makeOkConfigFetch();
+    makeBootstrapFetch();
     const result = await makeService().getEnviveConfig();
 
     expect(result.org.org.id).toBe('org-1');
   });
 });
 
-describe('EnviveConfigService bootstrap upgrade (use_unified_config)', () => {
-  // The injection bundle supplies env + contextSource; without them the branch
-  // is skipped entirely (see the "non-bundle caller" case below).
+describe('EnviveConfigService bootstrap request', () => {
+  // The injection bundle supplies env + contextSource, which request bootstrap's
+  // url_resolving branch. Without them the branch is omitted (see the config-only
+  // case below), but bootstrap is still the config call either way.
   const bootstrapService = () => makeService({ env: 'dev', contextSource: 'app' });
 
-  it('stays on getWidgetConfig (no bootstrap) when the gate is off', async () => {
-    makeOkConfigFetch(); // gates: []
+  it('issues a single /v1/session/bootstrap call and returns its config', async () => {
+    makeBootstrapFetch('org-boot');
 
     const service = bootstrapService();
     const result = await service.getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(1);
-    expect(mockFetch.mock.calls[0][0]).toContain('/v1/graphql');
-    expect(result.org.org.id).toBe('org-1');
-    expect(service.takeBootstrapUrlResolving()).toBeNull();
-  });
-
-  it('calls /v1/session/bootstrap and uses ITS config when the gate is on', async () => {
-    makeGateOnConfigFetch();
-    makeBootstrapFetch();
-
-    const service = bootstrapService();
-    const result = await service.getEnviveConfig();
-
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-    expect(mockFetch.mock.calls[1][0]).toContain('/v1/session/bootstrap');
-    // config is bootstrap's, not the getWidgetConfig call used to read the gate.
+    expect(mockFetch.mock.calls[0][0]).toContain('/v1/session/bootstrap');
     expect(result.org.org.id).toBe('org-boot');
-    expect(result.org.org.short_name).toBe('boot-org');
+    expect(result.org.org.short_name).toBe('test-org');
     // gates: snake group_name mapped to camel groupName.
     expect(result.gates).toContainEqual({
       name: 'use_unified_config',
@@ -300,7 +238,6 @@ describe('EnviveConfigService bootstrap upgrade (use_unified_config)', () => {
   });
 
   it('stashes bootstrap url_resolving (paired with its URL) for the warm-up to consume once', async () => {
-    makeGateOnConfigFetch();
     makeBootstrapFetch();
 
     const service = bootstrapService();
@@ -315,96 +252,73 @@ describe('EnviveConfigService bootstrap upgrade (use_unified_config)', () => {
     expect(service.takeBootstrapUrlResolving()).toBeNull();
   });
 
-  it('sends url_resolving context + gate names + version pin in the bootstrap body', async () => {
-    makeGateOnConfigFetch();
+  it('sends the url_resolving context (no org identity), gate names, and namespace in the body', async () => {
     makeBootstrapFetch();
 
     await bootstrapService().getEnviveConfig();
 
-    const [, options] = mockFetch.mock.calls[1];
+    const [, options] = mockFetch.mock.calls[0];
     const body = JSON.parse(options.body as string);
     expect(body.include_feature_gates).toContain('use_unified_config');
     // Scopes org_config.configs so bootstrap doesn't dump internal configs to the browser.
     expect(body.namespace).toBe('spiffy-react-components');
-    expect(body.url_resolving.context).toMatchObject({
-      org_id: 'org-1',
-      org_short_name: 'test-org',
-      source: 'app',
-      env: 'dev',
-    });
-    // The version comes ONLY from the URL query param (none set here) — never from
-    // getWidgetConfig's resolution, so bootstrap doesn't depend on the discarded
-    // getWidgetConfig response.
+    // org identity is NOT sent — the server fills it from the authenticated org.
+    expect(body.url_resolving.context).toMatchObject({ source: 'app', env: 'dev' });
+    expect(body.url_resolving.context.org_id).toBeUndefined();
+    expect(body.url_resolving.context.org_short_name).toBeUndefined();
+    // No config-version override set here.
     expect(body.url_resolving.org_base_config_version).toBeUndefined();
     expect(body.url_resolving.override_config_version).toBeUndefined();
-    // override-aware gates (FeatureFlagService.getFeatureFlags()) forwarded so
-    // client gate overrides reach page-variant resolution.
-    expect(body.url_resolving.feature_gates.use_unified_config).toBe(true);
+    // No client gate overrides set → empty map (server resolves the real gates).
+    expect(body.url_resolving.feature_gates).toEqual({});
     // the persistent chat session id is threaded (not an empty string).
     expect(body.url_resolving.context.chat_id).toBeTruthy();
   });
 
-  it('reflects a ?<gate>=true override in the bootstrap feature_gates it sends', async () => {
-    // Force a page-variant gate the server did NOT return — it must still reach
-    // bootstrap's url_resolving via getFeatureFlags()'s override precedence.
+  it('forwards ?<gate>=true overrides in the bootstrap feature_gates it sends', async () => {
+    // Client overrides (query param) must reach bootstrap's url_resolving so they
+    // still drive page-variant selection; the server merges them over its gates.
     window.history.replaceState({}, '', '/?use_unified_config=true&is_empty_div_plp_enabled=true');
-    makeOkConfigFetch(); // gates: [] — the ?use_unified_config=true override drives the bootstrap path
     makeBootstrapFetch();
 
     await bootstrapService().getEnviveConfig();
 
-    const body = JSON.parse(mockFetch.mock.calls[1][1].body as string);
+    const body = JSON.parse(mockFetch.mock.calls[0][1].body as string);
+    expect(body.url_resolving.feature_gates.use_unified_config).toBe(true);
     expect(body.url_resolving.feature_gates.is_empty_div_plp_enabled).toBe(true);
   });
 
-  it('skips bootstrap for non-bundle callers (no env/contextSource) even when the gate is on', async () => {
-    makeGateOnConfigFetch();
+  it('omits the url_resolving branch for non-bundle callers (no env/contextSource) but still fetches config', async () => {
+    makeBootstrapFetch('org-1', null);
 
-    const result = await makeService().getEnviveConfig(); // no env/contextSource
+    const service = makeService(); // no env/contextSource
+    const result = await service.getEnviveConfig();
 
     expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch.mock.calls[0][0]).toContain('/v1/session/bootstrap');
+    const body = JSON.parse(mockFetch.mock.calls[0][1].body as string);
+    expect(body.url_resolving).toBeUndefined();
     expect(result.org.org.id).toBe('org-1');
+    expect(service.takeBootstrapUrlResolving()).toBeNull();
   });
 
-  it('falls back to the getWidgetConfig config when bootstrap fails', async () => {
-    makeGateOnConfigFetch();
+  it('throws (aborting injection) when bootstrap fails — there is no getWidgetConfig fallback', async () => {
     mockFetch.mockResolvedValueOnce({ ok: false, statusText: 'Bad Gateway' });
 
-    const service = bootstrapService();
-    const result = await service.getEnviveConfig();
-
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-    // degraded to the proven path rather than aborting.
-    expect(result.org.org.id).toBe('org-1');
-    expect(service.takeBootstrapUrlResolving()).toBeNull();
+    await expect(bootstrapService().getEnviveConfig()).rejects.toThrow(
+      'Bootstrap config request failed',
+    );
   });
 
-  it('falls back to getWidgetConfig config when bootstrap returns a malformed 2xx payload', async () => {
-    makeGateOnConfigFetch();
-    // 2xx but missing required sections — must NOT replace the known-good config
-    // with empty gates / mock products (which would disable the client session).
+  it('throws when bootstrap returns a malformed 2xx payload', async () => {
+    // 2xx but missing required sections — must NOT become a config with empty
+    // gates / mock products (which would disable the client session). No fallback
+    // left, so the throw propagates and injection aborts.
     mockFetch.mockResolvedValueOnce({
       ok: true,
       json: () => Promise.resolve({ org_config: {}, widget_config: null }),
     });
 
-    const service = bootstrapService();
-    const result = await service.getEnviveConfig();
-
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-    expect(result.org.org.id).toBe('org-1'); // getWidgetConfig's, not bootstrap's empty payload
-    expect(service.takeBootstrapUrlResolving()).toBeNull();
-  });
-
-  it('honors a ?use_unified_config=true override when the gate itself is off', async () => {
-    window.history.replaceState({}, '', '/?use_unified_config=true');
-    makeOkConfigFetch(); // gates: [] — the override, not the gate, forces bootstrap
-    makeBootstrapFetch();
-
-    const result = await bootstrapService().getEnviveConfig();
-
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-    expect(mockFetch.mock.calls[1][0]).toContain('/v1/session/bootstrap');
-    expect(result.org.org.id).toBe('org-boot');
+    await expect(bootstrapService().getEnviveConfig()).rejects.toThrow('missing required sections');
   });
 });

package/src/services/enviveConfigService/__tests__/fetchBootstrapConfig.test.ts

@@ -67,9 +67,9 @@ const baseParams: FetchBootstrapConfigParams = {
   source: 'app',
   namespace: 'spiffy-react-components',
   gateNames: ['use_unified_config', 'is_client_session_enabled'],
+  // url_resolving inputs (org identity is NOT sent — the server fills it from the
+  // authenticated org). Absent url ⇒ bootstrap omits the url_resolving branch.
   url: 'https://shop.example.com/products/thing',
-  orgId: 'org-1',
-  orgShortName: 'test-org',
   contextSource: 'app',
   env: 'prod',
   featureGates: { use_unified_config: true, is_empty_div_plp_enabled: true },
@@ -180,20 +180,38 @@ describe('fetchBootstrapConfig', () => {
     });
     expect(body.url_resolving).toMatchObject({
       url: 'https://shop.example.com/products/thing',
-      // Override-aware gates forwarded so client overrides reach page-variant resolution.
+      // Override-only gates forwarded so client overrides reach page-variant resolution.
       feature_gates: { use_unified_config: true, is_empty_div_plp_enabled: true },
     });
-    // No org_base_config_version — the version comes only from the URL query param
-    // (override_config_version), never from getWidgetConfig's resolution.
+    // No org_base_config_version — the version comes only from the URL query param.
     expect(body.url_resolving.org_base_config_version).toBeUndefined();
+    // org identity is NOT sent — the server fills org_id/org_short_name from the
+    // authenticated org (bootstrap-only has no getWidgetConfig to source them from).
     expect(body.url_resolving.context).toEqual({
       user_id: 'user-1',
-      org_id: 'org-1',
-      org_short_name: 'test-org',
       chat_id: 'chat-9',
       source: 'app',
       env: 'prod',
     });
+    expect(body.url_resolving.context.org_id).toBeUndefined();
+    expect(body.url_resolving.context.org_short_name).toBeUndefined();
+  });
+
+  it('omits the url_resolving branch from the request when no url is supplied', async () => {
+    makeBootstrapResponse();
+
+    // A disabled session (envive_on=false) requests config only — no page to resolve.
+    const { url, contextSource, env, featureGates, ...configOnly } = baseParams;
+    await fetchBootstrapConfig(configOnly);
+
+    const body = JSON.parse(mockFetch.mock.calls[0][1].body as string);
+    // Config inputs still sent; the whole url_resolving object is absent.
+    expect(body).toMatchObject({
+      user_id: 'user-1',
+      namespace: 'spiffy-react-components',
+      include_feature_gates: ['use_unified_config', 'is_client_session_enabled'],
+    });
+    expect(body.url_resolving).toBeUndefined();
   });
 
   it('threads a config-version query param into version + override_config_version', async () => {
@@ -207,7 +225,67 @@ describe('fetchBootstrapConfig', () => {
     expect(body.url_resolving.override_config_version).toBe('9.9.9');
   });
 
-  it('throws on a non-ok response so the caller can fall back', async () => {
+  it('degrades a malformed products_config to mock WITHOUT losing org/gates/experiments', async () => {
+    // A 2xx with valid org/gates/widget_config but a products_config that throws
+    // in transformV3ProductsConfig (invalid floating-button position). With no
+    // getWidgetConfig fallback left, this catch is the SOLE thing keeping a bad
+    // products config from aborting injection — it must null colors/frontend only
+    // and preserve org identity + gates + experiment_assignments + resolution.
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          org_config: {
+            org: { org: { id: 'org-boot', short_name: 'boot-org' } },
+            gates: [{ name: 'use_unified_config', value: true, group_name: 'Treatment' }],
+          },
+          widget_config: {
+            products_config: {
+              v_three_config: {
+                values: {
+                  colors: { values: { text_primary: '#000000' } },
+                  ui_configs: {
+                    floating_button: { position: 'top-center' }, // invalid → transform throws
+                    look_and_feel: { typography: {} },
+                  },
+                },
+              },
+            },
+            experiment_assignments: [
+              {
+                layer_name: 'ml',
+                namespace: 'ml',
+                allocated_experiment_name: 'exp_a',
+                group_name: 'A',
+              },
+            ],
+            resolution: { base_version: '2.0.0', base_version_source: 'merchant_layer' },
+          },
+          url_resolving: null,
+        }),
+    });
+
+    const { config } = await fetchBootstrapConfig(baseParams);
+
+    // org / gates / experiments survived the products-config failure.
+    expect(config.org.org.id).toBe('org-boot');
+    expect(config.gates).toContainEqual({
+      name: 'use_unified_config',
+      value: true,
+      groupName: 'Treatment',
+    });
+    expect(config.experiment_assignments).toEqual([
+      { layer_name: 'ml', namespace: 'ml', allocated_experiment_name: 'exp_a', group_name: 'A' },
+    ]);
+    // colors/frontend degraded to undefined, resolution still attached.
+    expect(config.orgConfig).toEqual({
+      colorsConfig: undefined,
+      frontendConfig: undefined,
+      resolution: { baseVersion: '2.0.0', baseVersionSource: 'merchant_layer' },
+    });
+  });
+
+  it('throws on a non-ok response so the caller aborts injection (no fallback)', async () => {
     mockFetch.mockResolvedValueOnce({ ok: false, statusText: 'Bad Gateway' });
 
     await expect(fetchBootstrapConfig(baseParams)).rejects.toThrow(
@@ -225,14 +303,13 @@ describe('fetchBootstrapConfig', () => {
       'partial org_config (no org.org)',
       { org_config: { org: {}, gates: okGates }, widget_config: okWidget },
     ],
-    ['absent gates', { org_config: { org: { org: { id: 'o' } } }, widget_config: okWidget }],
     [
-      'empty gates',
-      { org_config: { org: { org: { id: 'o' } }, gates: [] }, widget_config: okWidget },
+      'absent gates (not an array)',
+      { org_config: { org: { org: { id: 'o' } } }, widget_config: okWidget },
     ],
     ['missing widget_config', { org_config: okOrg, widget_config: null }],
   ])(
-    'throws on a 2xx with %s so the caller can fall back to getWidgetConfig',
+    'throws on a 2xx with %s so the caller aborts injection instead of using empty config',
     async (_label, payload) => {
       mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve(payload) });
 
@@ -240,6 +317,27 @@ describe('fetchBootstrapConfig', () => {
     },
   );
 
+  it('accepts an EMPTY (but present) gates array as a valid all-disabled config', async () => {
+    // An empty gates array is a legitimate "everything off" response (no user to
+    // bucket, or every requested gate off). It must NOT be rejected as malformed:
+    // FeatureFlagService resolves every gate to false → the session disables
+    // gracefully (with the init event still firing), rather than aborting injection.
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          org_config: { org: { org: { id: 'org-boot', short_name: 'boot-org' } }, gates: [] },
+          widget_config: { products_config: {}, experiment_assignments: [] },
+          url_resolving: null,
+        }),
+    });
+
+    const { config } = await fetchBootstrapConfig(baseParams);
+
+    expect(config.org.org.id).toBe('org-boot');
+    expect(config.gates).toEqual([]);
+  });
+
   it('passes an AbortSignal to fetch (timeout wiring)', async () => {
     makeBootstrapResponse();
 
@@ -249,7 +347,7 @@ describe('fetchBootstrapConfig', () => {
     expect(options.signal).toBeInstanceOf(AbortSignal);
   });
 
-  it('aborts and rejects when the request exceeds the timeout so the caller can fall back', async () => {
+  it('aborts and rejects when the request exceeds the timeout (injection aborts, no fallback)', async () => {
     vi.useFakeTimers();
     // Mimic real fetch: reject with an AbortError once its signal aborts.
     mockFetch.mockImplementationOnce(