@happier-dev/stack 0.1.0 → 0.2.0-preview.1775370152.55749

package/scripts/auth_copy_from_runCapture.integration.test.mjs

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { resolveStackCredentialPaths } from './utils/auth/credentials_paths.mjs';
 import { buildStackStableScopeId } from './utils/auth/stable_scope_id.mjs';
 import { authScriptPath, runNodeCapture } from './testkit/auth_testkit.mjs';
+import { buildLightMigrationBaseEnv, resolveDbProviderForLightFromEnv } from './auth.mjs';
 
 test('hstack stack auth copy-from does not hit ReferenceError: runCapture is not defined', async (t) => {
   const scriptsDir = dirname(fileURLToPath(import.meta.url));
@@ -20,19 +21,20 @@ test('hstack stack auth copy-from does not hit ReferenceError: runCapture is not
   const homeDir = join(tmp, 'home');
   const storageDir = join(tmp, 'storage');
   const workspaceDir = join(tmp, 'workspace');
+  const nvmDir = join(tmp, 'nvm');
   await mkdir(homeDir, { recursive: true });
   await mkdir(storageDir, { recursive: true });
   await mkdir(workspaceDir, { recursive: true });
+  await mkdir(nvmDir, { recursive: true });
 
   // Stub yarn to keep this test fast/deterministic. This is an external boundary.
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
   const yarnPath = join(binDir, 'yarn');
-  const yarnLogPath = join(tmp, 'yarn.calls.log');
-  await writeFile(yarnPath, `#!/bin/bash\necho \"$*\" >> ${JSON.stringify(yarnLogPath)}\nexit 0\n`, 'utf-8');
+  await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir); // .../apps/stack -> .../ (monorepo root)
+  const repoRoot = dirname(dirname(rootDir)); // .../apps/stack -> repo root
 
   const mkStackEnv = async (name) => {
     const baseDir = join(storageDir, name);
@@ -76,12 +78,6 @@ test('hstack stack auth copy-from does not hit ReferenceError: runCapture is not
     !res.stdout.includes('spawn yarn ENOENT') && !res.stderr.includes('spawn yarn ENOENT'),
     `expected yarn to be resolvable in light migrations step\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
   );
-  const yarnCalls = await readFile(yarnLogPath, 'utf-8');
-  assert.match(
-    yarnCalls,
-    /\bmigrate:sqlite:deploy\b/,
-    `expected light auth flow without explicit DB provider to use sqlite migrations\ncalls:\n${yarnCalls}`
-  );
 });
 
 test('hstack stack auth copy-from prefers source server-scoped credential over unrelated legacy key', async (t) => {
@@ -95,9 +91,11 @@ test('hstack stack auth copy-from prefers source server-scoped credential over u
   const homeDir = join(tmp, 'home');
   const storageDir = join(tmp, 'storage');
   const workspaceDir = join(tmp, 'workspace');
+  const nvmDir = join(tmp, 'nvm');
   await mkdir(homeDir, { recursive: true });
   await mkdir(storageDir, { recursive: true });
   await mkdir(workspaceDir, { recursive: true });
+  await mkdir(nvmDir, { recursive: true });
 
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
@@ -105,7 +103,7 @@ test('hstack stack auth copy-from prefers source server-scoped credential over u
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const serverPort = 4201;
@@ -172,9 +170,11 @@ test('hstack stack auth copy-from prefers source stable-scope credential when so
   const homeDir = join(tmp, 'home');
   const storageDir = join(tmp, 'storage');
   const workspaceDir = join(tmp, 'workspace');
+  const nvmDir = join(tmp, 'nvm');
   await mkdir(homeDir, { recursive: true });
   await mkdir(storageDir, { recursive: true });
   await mkdir(workspaceDir, { recursive: true });
+  await mkdir(nvmDir, { recursive: true });
 
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
@@ -182,7 +182,7 @@ test('hstack stack auth copy-from prefers source stable-scope credential when so
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const sourceCliHome = join(storageDir, sourceStack, 'cli');
@@ -272,9 +272,11 @@ test('hstack stack auth copy-from fails closed when source token subject is miss
   const homeDir = join(tmp, 'home');
   const storageDir = join(tmp, 'storage');
   const workspaceDir = join(tmp, 'workspace');
+  const nvmDir = join(tmp, 'nvm');
   await mkdir(homeDir, { recursive: true });
   await mkdir(storageDir, { recursive: true });
   await mkdir(workspaceDir, { recursive: true });
+  await mkdir(nvmDir, { recursive: true });
 
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
@@ -282,7 +284,7 @@ test('hstack stack auth copy-from fails closed when source token subject is miss
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const sourceCliHome = join(storageDir, sourceStack, 'cli');
@@ -356,9 +358,11 @@ test('hstack stack auth copy-from accepts source auth when source server validat
   const homeDir = join(tmp, 'home');
   const storageDir = join(tmp, 'storage');
   const workspaceDir = join(tmp, 'workspace');
+  const nvmDir = join(tmp, 'nvm');
   await mkdir(homeDir, { recursive: true });
   await mkdir(storageDir, { recursive: true });
   await mkdir(workspaceDir, { recursive: true });
+  await mkdir(nvmDir, { recursive: true });
 
   const binDir = join(tmp, 'bin');
   await mkdir(binDir, { recursive: true });
@@ -366,7 +370,7 @@ test('hstack stack auth copy-from accepts source auth when source server validat
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const sourceCliHome = join(storageDir, sourceStack, 'cli');
@@ -474,7 +478,7 @@ test('hstack stack auth copy-from fails closed when source stack is not running
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const serverPort = 4311;
@@ -551,7 +555,7 @@ test('hstack stack auth copy-from --no-secret does not overwrite target master s
   await writeFile(yarnPath, '#!/bin/bash\nexit 0\n', 'utf-8');
   await chmod(yarnPath, 0o755);
 
-  const repoRoot = dirname(rootDir);
+  const repoRoot = dirname(dirname(rootDir));
   const sourceStack = 'dev-auth';
   const targetStack = 'dev';
   const serverPort = 4331;
@@ -614,3 +618,360 @@ test('hstack stack auth copy-from --no-secret does not overwrite target master s
   const targetSecret = await readFile(join(targetDirs.dataDir, 'handy-master-secret.txt'), 'utf-8');
   assert.equal(targetSecret.trim(), 'target-secret');
 });
+
+test('hstack stack auth copy-from reads source light sqlite db from the source stack base dir when target light env leaks into process.env', async (t) => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const repoRoot = dirname(dirname(rootDir));
+
+  const tmp = await mkdtemp(join(tmpdir(), 'hstack-auth-copy-from-source-light-sqlite-'));
+  t.after(async () => {
+    await rm(tmp, { recursive: true, force: true });
+  });
+
+  const homeDir = join(tmp, 'home');
+  const storageDir = join(tmp, 'storage');
+  const workspaceDir = join(tmp, 'workspace');
+  await mkdir(homeDir, { recursive: true });
+  await mkdir(storageDir, { recursive: true });
+  await mkdir(workspaceDir, { recursive: true });
+
+  const sourceStack = 'dev-auth';
+  const targetStack = 'dev';
+  const sourceBaseDir = join(storageDir, sourceStack);
+  const targetBaseDir = join(storageDir, targetStack);
+  const sourceCliHome = join(sourceBaseDir, 'cli');
+  const targetCliHome = join(targetBaseDir, 'cli');
+  const sourceDataDir = join(sourceBaseDir, 'server-light');
+  const targetDataDir = join(targetBaseDir, 'server-light');
+  const serverDir = join(repoRoot, 'apps', 'server');
+  const nvmDir = join(tmp, 'nvm');
+
+  const writeStackEnv = async ({ name, baseDir, cliHomeDir, dataDir, includeLightDirs }) => {
+    await mkdir(baseDir, { recursive: true });
+    await mkdir(cliHomeDir, { recursive: true });
+    await mkdir(dataDir, { recursive: true });
+    const lines = [
+      `HAPPIER_STACK_STACK=${name}`,
+      `HAPPIER_STACK_SERVER_COMPONENT=happier-server-light`,
+      `HAPPIER_STACK_REPO_DIR=${repoRoot}`,
+      `HAPPIER_STACK_CLI_HOME_DIR=${cliHomeDir}`,
+    ];
+    if (includeLightDirs) {
+      lines.push(`HAPPIER_SERVER_LIGHT_DATA_DIR=${dataDir}`);
+      lines.push(`HAPPIER_SERVER_LIGHT_FILES_DIR=${join(dataDir, 'files')}`);
+      lines.push(`HAPPIER_SERVER_LIGHT_DB_DIR=${join(dataDir, 'pglite')}`);
+    }
+    await writeFile(join(baseDir, 'env'), `${lines.join('\n')}\n`, 'utf-8');
+  };
+
+  await writeStackEnv({
+    name: sourceStack,
+    baseDir: sourceBaseDir,
+    cliHomeDir: sourceCliHome,
+    dataDir: sourceDataDir,
+    includeLightDirs: false,
+  });
+  await writeStackEnv({
+    name: targetStack,
+    baseDir: targetBaseDir,
+    cliHomeDir: targetCliHome,
+    dataDir: targetDataDir,
+    includeLightDirs: true,
+  });
+
+  const migrateSqlite = async (dataDir) => {
+    const { spawnSync } = await import('node:child_process');
+    const res = spawnSync('yarn', ['-s', 'migrate:sqlite:deploy'], {
+      cwd: serverDir,
+      env: {
+        ...process.env,
+        HAPPIER_SERVER_LIGHT_DATA_DIR: dataDir,
+        HAPPIER_SERVER_LIGHT_FILES_DIR: join(dataDir, 'files'),
+        HAPPIER_SERVER_LIGHT_DB_DIR: join(dataDir, 'pglite'),
+        HAPPIER_DB_PROVIDER: 'sqlite',
+      },
+      encoding: 'utf-8',
+    });
+    assert.equal(res.status, 0, `expected sqlite migrations to succeed\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`);
+  };
+
+  const runSqliteClient = async ({ databaseUrl, code }) => {
+    const result = await runNodeCapture(
+      [
+        '--input-type=module',
+        '-e',
+        `
+const { PrismaClient } = await import(${JSON.stringify(join(serverDir, 'generated', 'sqlite-client', 'index.js'))});
+const db = new PrismaClient();
+try {
+${code}
+} finally {
+  await db.$disconnect();
+}
+        `.trim(),
+      ],
+      {
+        cwd: serverDir,
+        env: {
+          ...process.env,
+          DATABASE_URL: databaseUrl,
+        },
+      }
+    );
+    return result.stdout.trim();
+  };
+
+  await migrateSqlite(sourceDataDir);
+  await migrateSqlite(targetDataDir);
+
+  const sourceDatabaseUrl = `file:${join(sourceDataDir, 'happier-server-light.sqlite')}`;
+  const targetDatabaseUrl = `file:${join(targetDataDir, 'happier-server-light.sqlite')}`;
+  const sourceAccountId = 'source-account-id';
+  const targetAccountId = 'target-account-id';
+
+  await runSqliteClient({
+    databaseUrl: sourceDatabaseUrl,
+    code: `
+await db.account.create({ data: { id: ${JSON.stringify(sourceAccountId)}, publicKey: ${JSON.stringify('source-public-key')} } });
+console.log('ok');
+    `,
+  });
+  await runSqliteClient({
+    databaseUrl: targetDatabaseUrl,
+    code: `
+await db.account.create({ data: { id: ${JSON.stringify(targetAccountId)}, publicKey: ${JSON.stringify('target-public-key')} } });
+console.log('ok');
+    `,
+  });
+
+  const b64 = (value) =>
+    Buffer.from(value, 'utf-8').toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+  const sourceToken = `${b64(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${b64(JSON.stringify({ sub: sourceAccountId }))}.sig`;
+  await writeFile(join(sourceCliHome, 'access.key'), JSON.stringify({ token: sourceToken }) + '\n', 'utf-8');
+
+  const env = {
+    ...process.env,
+    HAPPIER_SERVER_LIGHT_DATA_DIR: targetDataDir,
+    HAPPIER_SERVER_LIGHT_FILES_DIR: join(targetDataDir, 'files'),
+    HAPPIER_SERVER_LIGHT_DB_DIR: join(targetDataDir, 'pglite'),
+    HAPPIER_STACK_HOME_DIR: homeDir,
+    HAPPIER_STACK_STORAGE_DIR: storageDir,
+    HAPPIER_STACK_WORKSPACE_DIR: workspaceDir,
+    HAPPIER_STACK_STACK: targetStack,
+    HAPPIER_STACK_ENV_FILE: join(targetBaseDir, 'env'),
+  };
+
+  const res = await runNodeCapture([authScriptPath(rootDir), 'copy-from', sourceStack, '--offline-ok', '--force'], {
+    cwd: rootDir,
+    env,
+  });
+  assert.equal(res.code, 0, `expected copy-from to succeed\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`);
+
+  const targetIdsRaw = await runSqliteClient({
+    databaseUrl: targetDatabaseUrl,
+    code: `
+const rows = await db.account.findMany({ select: { id: true }, orderBy: { id: 'asc' } });
+console.log(JSON.stringify(rows.map((row) => row.id)));
+    `,
+  });
+  const targetIds = JSON.parse(targetIdsRaw);
+  assert.deepEqual(
+    targetIds,
+    [sourceAccountId, targetAccountId].sort(),
+    `expected target sqlite db to include the source account copied from the source stack\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
+  );
+});
+
+test('hstack stack auth copy-from does not require source sqlite migrations when the source light db is already readable and process env leaks pglite provider flags', async (t) => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const repoRoot = dirname(dirname(rootDir));
+
+  const tmp = await mkdtemp(join(tmpdir(), 'hstack-auth-copy-from-source-sqlite-no-migrate-'));
+  t.after(async () => {
+    await rm(tmp, { recursive: true, force: true });
+  });
+
+  const homeDir = join(tmp, 'home');
+  const storageDir = join(tmp, 'storage');
+  const workspaceDir = join(tmp, 'workspace');
+  await mkdir(homeDir, { recursive: true });
+  await mkdir(storageDir, { recursive: true });
+  await mkdir(workspaceDir, { recursive: true });
+  await mkdir(join(tmp, 'nvm'), { recursive: true });
+
+  const sourceStack = 'dev-auth';
+  const targetStack = 'dev';
+  const sourceBaseDir = join(storageDir, sourceStack);
+  const targetBaseDir = join(storageDir, targetStack);
+  const sourceCliHome = join(sourceBaseDir, 'cli');
+  const targetCliHome = join(targetBaseDir, 'cli');
+  const sourceDataDir = join(sourceBaseDir, 'server-light');
+  const targetDataDir = join(targetBaseDir, 'server-light');
+  const serverDir = join(repoRoot, 'apps', 'server');
+
+  const writeStackEnv = async ({ name, baseDir, cliHomeDir, dataDir, dbProvider }) => {
+    await mkdir(baseDir, { recursive: true });
+    await mkdir(cliHomeDir, { recursive: true });
+    await mkdir(dataDir, { recursive: true });
+    const lines = [
+      `HAPPIER_STACK_STACK=${name}`,
+      `HAPPIER_STACK_SERVER_COMPONENT=happier-server-light`,
+      `HAPPIER_STACK_REPO_DIR=${repoRoot}`,
+      `HAPPIER_STACK_CLI_HOME_DIR=${cliHomeDir}`,
+    ];
+    if (dbProvider) {
+      lines.push(`HAPPIER_DB_PROVIDER=${dbProvider}`);
+    }
+    lines.push(
+      `HAPPIER_SERVER_LIGHT_DATA_DIR=${dataDir}`,
+      `HAPPIER_SERVER_LIGHT_FILES_DIR=${join(dataDir, 'files')}`,
+      `HAPPIER_SERVER_LIGHT_DB_DIR=${join(dataDir, 'pglite')}`,
+      '',
+    );
+    await writeFile(
+      join(baseDir, 'env'),
+      lines.join('\n'),
+      'utf-8'
+    );
+  };
+
+  await writeStackEnv({ name: sourceStack, baseDir: sourceBaseDir, cliHomeDir: sourceCliHome, dataDir: sourceDataDir });
+  await writeStackEnv({
+    name: targetStack,
+    baseDir: targetBaseDir,
+    cliHomeDir: targetCliHome,
+    dataDir: targetDataDir,
+    dbProvider: 'sqlite',
+  });
+
+  const migrateSqlite = async (dataDir) => {
+    const { spawnSync } = await import('node:child_process');
+    const res = spawnSync('yarn', ['-s', 'migrate:sqlite:deploy'], {
+      cwd: serverDir,
+      env: {
+        ...process.env,
+        HAPPIER_SERVER_LIGHT_DATA_DIR: dataDir,
+        HAPPIER_SERVER_LIGHT_FILES_DIR: join(dataDir, 'files'),
+        HAPPIER_SERVER_LIGHT_DB_DIR: join(dataDir, 'pglite'),
+        HAPPIER_DB_PROVIDER: 'sqlite',
+      },
+      encoding: 'utf-8',
+    });
+    assert.equal(res.status, 0, `expected sqlite migrations to succeed\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`);
+  };
+
+  const runSqliteClient = async ({ databaseUrl, code }) => {
+    const result = await runNodeCapture(
+      [
+        '--input-type=module',
+        '-e',
+        `
+const { PrismaClient } = await import(${JSON.stringify(join(serverDir, 'generated', 'sqlite-client', 'index.js'))});
+const db = new PrismaClient();
+try {
+${code}
+} finally {
+  await db.$disconnect();
+}
+        `.trim(),
+      ],
+      {
+        cwd: serverDir,
+        env: {
+          ...process.env,
+          DATABASE_URL: databaseUrl,
+        },
+      }
+    );
+    return result.stdout.trim();
+  };
+
+  await migrateSqlite(sourceDataDir);
+  await migrateSqlite(targetDataDir);
+
+  const sourceDbPath = join(sourceDataDir, 'happier-server-light.sqlite');
+  const sourceDatabaseUrl = `file:${sourceDbPath}`;
+  const targetDatabaseUrl = `file:${join(targetDataDir, 'happier-server-light.sqlite')}`;
+  const sourceAccountId = 'source-no-migrate-id';
+
+  await runSqliteClient({
+    databaseUrl: sourceDatabaseUrl,
+    code: `
+await db.account.create({ data: { id: ${JSON.stringify(sourceAccountId)}, publicKey: ${JSON.stringify('source-no-migrate-key')} } });
+console.log('ok');
+    `,
+  });
+
+  const b64 = (value) =>
+    Buffer.from(value, 'utf-8').toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+  const sourceToken = `${b64(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${b64(JSON.stringify({ sub: sourceAccountId }))}.sig`;
+  await writeFile(join(sourceCliHome, 'access.key'), JSON.stringify({ token: sourceToken }) + '\n', 'utf-8');
+
+  const sourceEnv = {
+    HAPPIER_STACK_STACK: sourceStack,
+    HAPPIER_STACK_SERVER_COMPONENT: 'happier-server-light',
+    HAPPIER_STACK_REPO_DIR: repoRoot,
+    HAPPIER_SERVER_LIGHT_DATA_DIR: sourceDataDir,
+    HAPPIER_SERVER_LIGHT_FILES_DIR: join(sourceDataDir, 'files'),
+    HAPPIER_SERVER_LIGHT_DB_DIR: join(sourceDataDir, 'pglite'),
+  };
+  const leakedLightEnv = buildLightMigrationBaseEnv(
+    {
+      ...process.env,
+      HAPPIER_DB_PROVIDER: 'pglite',
+      HAPPY_DB_PROVIDER: 'pglite',
+    },
+    sourceEnv
+  );
+  assert.equal(
+    leakedLightEnv.HAPPIER_DB_PROVIDER,
+    undefined,
+    'expected leaked HAPPIER_DB_PROVIDER to be stripped before light migration resolution'
+  );
+  assert.equal(
+    leakedLightEnv.HAPPY_DB_PROVIDER,
+    undefined,
+    'expected leaked HAPPY_DB_PROVIDER to be stripped before light migration resolution'
+  );
+  assert.equal(
+    resolveDbProviderForLightFromEnv(leakedLightEnv),
+    'sqlite',
+    'expected leaked provider flags to stop influencing the source light migration path'
+  );
+
+  const env = {
+    ...process.env,
+    HAPPIER_STACK_HOME_DIR: homeDir,
+    HAPPIER_STACK_STORAGE_DIR: storageDir,
+    HAPPIER_STACK_WORKSPACE_DIR: workspaceDir,
+    HAPPIER_STACK_STACK: targetStack,
+    HAPPIER_STACK_ENV_FILE: join(targetBaseDir, 'env'),
+    HAPPIER_DB_PROVIDER: 'pglite',
+    HAPPY_DB_PROVIDER: 'pglite',
+  };
+
+  const res = await runNodeCapture([authScriptPath(rootDir), 'copy-from', sourceStack, '--offline-ok', '--force'], {
+    cwd: rootDir,
+    env,
+  });
+  assert.equal(
+    res.code,
+    0,
+    `expected copy-from to succeed without source-side sqlite migration\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
+  );
+
+  const targetIdsRaw = await runSqliteClient({
+    databaseUrl: targetDatabaseUrl,
+    code: `
+const rows = await db.account.findMany({ select: { id: true }, orderBy: { id: 'asc' } });
+console.log(JSON.stringify(rows.map((row) => row.id)));
+    `,
+  });
+  const targetIds = JSON.parse(targetIdsRaw);
+  assert.ok(
+    targetIds.includes(sourceAccountId),
+    `expected source account to be seeded into target db\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
+  );
+});

package/scripts/auth_dev_key_cmd.test.mjs

@@ -0,0 +1,35 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { authScriptPath, getStackRootFromMeta, runNodeCapture } from './testkit/auth_testkit.mjs';
+
+test('hstack auth dev-key --set stores key and exits successfully', async () => {
+  const rootDir = getStackRootFromMeta(import.meta.url);
+  const homeDir = await mkdtemp(join(tmpdir(), 'happier-auth-dev-key-'));
+  const key = Buffer.alloc(32, 7).toString('base64url');
+
+  try {
+    const env = {
+      ...process.env,
+      HAPPIER_STACK_HOME_DIR: homeDir,
+      HAPPIER_STACK_STACK: 'test-stack',
+      HAPPIER_STACK_ENV_FILE: join(homeDir, 'missing.env'),
+    };
+
+    const res = await runNodeCapture([authScriptPath(rootDir), 'dev-key', `--set=${key}`], { cwd: rootDir, env });
+    assert.equal(
+      res.code,
+      0,
+      `expected exit 0, got ${res.code}\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
+    );
+
+    const storedRaw = await readFile(join(homeDir, 'keys', 'dev-auth.json'), 'utf-8');
+    const stored = JSON.parse(storedRaw);
+    assert.equal(stored.secretKeyBase64Url, key);
+  } finally {
+    await rm(homeDir, { recursive: true, force: true });
+  }
+});