@ultimat3/cli 22.15.0 → 24.0.0

package/src/verify-tests.ts

@@ -14,14 +14,19 @@ import type { TestType } from '@ultimat3/testing';
 import { TEST_TYPES } from '@ultimat3/testing';
 import { checkEvalBaselines, checkEvalCoverage, checkEvalRecording } from './app-evals';
 import { APP_CONFIG_FILE } from './app-root';
+import { judgeCoverage } from './coverage-floor';
+import { msg } from './messages';
 import { countsOf } from './test-counts';
 import { testEnvOverrides } from './test-dotenv';
+import { IGNORED_TEST_PATTERNS } from './test-ignores';
 import type { TestFile } from './test-select';
 import { discoverTests } from './test-select';
 import { machineLease } from './test-slots';
 import type { WorkerPlan } from './test-workers';
 import { availableCpus, SERIAL_TYPES, totalMemory, workerPlan } from './test-workers';
+import { runCovered } from './verify-coverage-run';
 import { withE2eApp } from './verify-e2e';
+import { readVerifyFloor } from './verify-floor';
 import { shardFiles } from './verify-shard';
 import type { StepOutcome, VerifyContext, VerifyStep } from './verify-step';
 import { fromExec, fromFindings } from './verify-step';
@@ -120,7 +125,9 @@ const isSerial = (type: TestType): boolean => SERIAL_TYPES.includes(type);
  * Build output, and nested projects that carry their own `x verify`. `examples/**` and
  * `dummy/**` are the second kind: each holds a whole app gated by its own run of this same step
  * list, so collecting them here would report one app failure on two different gates. The patterns
- * are relative to the run's root, so this excludes nothing when the app itself is the root.
+ * are relative to the run's root, so this excludes nothing when the app itself is the root. The
+ * policy — which directories, and which are anchored at the root — is `test-ignores.ts`'s, the same
+ * one `discoverTests` filters the parallel steps by; this is its glob projection.
  *
  * `dummy/**` was added after the framework gate started running a demo app's tests and disagreeing
  * with `bun run test` — which already excluded it — for no reason a reader could see.
@@ -129,7 +136,7 @@ const isSerial = (type: TestType): boolean => SERIAL_TYPES.includes(type);
  * those apps and blocks on a per-app ratchet. Until 2026-08 that was only true of `examples/**`,
  * and `dummy/social-media-clone` was excluded by this list and gated by nothing.
  */
-const NEVER_A_TEST = ['**/dist/**', '**/build/**', '**/examples/**', '**/dummy/**'];
+const NEVER_A_TEST = IGNORED_TEST_PATTERNS;
 
 const ignoreFlags = (patterns: readonly string[]): readonly string[] =>
   patterns.map((pattern) => `--path-ignore-patterns=${pattern}`);
@@ -240,6 +247,21 @@ const runType = async (ctx: VerifyContext, type: TestType): Promise<StepOutcome>
     ctx.workers === undefined ? workerPlan(availableCpus(), totalMemory(), env) : undefined;
   const workers = ctx.workers ?? (plan as WorkerPlan).workers;
   const lease = plan === undefined ? undefined : machineLease(plan.workers, env);
+  const widthReason =
+    plan === undefined
+      ? `${String(Math.min(workers, files.length))} workers (--workers)`
+      : files.length < plan.workers
+        ? `${String(files.length)} of ${plan.reason}`
+        : plan.reason;
+  if (type === 'unit' && isApp(ctx.root)) {
+    return coveredUnit(ctx, {
+      files: files.map((file) => file.path),
+      workers,
+      widthReason,
+      shard,
+      lease,
+    });
+  }
   const outcome = await runParallel({
     root: ctx.root,
     runner: ctx.runner,
@@ -247,18 +269,71 @@ const runType = async (ctx: VerifyContext, type: TestType): Promise<StepOutcome>
     workers,
     type,
     isolate: ctx.isolate === true,
-    widthReason:
-      plan === undefined
-        ? `${String(Math.min(workers, files.length))} workers (--workers)`
-        : files.length < plan.workers
-          ? `${String(files.length)} of ${plan.reason}`
-          : plan.reason,
+    widthReason,
     ...(lease === undefined ? {} : { lease }),
     ...(ctx.env === undefined ? {} : { env: ctx.env }),
   });
   return shard === undefined ? outcome : { ...outcome, shard };
 };
 
+/**
+ * An APP's unit step: the suite, and what it covered of the app's own source held to the floor in
+ * `x.verify.json` (`coverage-floor.ts`). Only the unit suite counts — it is the one every run
+ * executes, and an opt-in suite cannot hold a floor a default run must meet. Only an app: the
+ * framework's packages are held to the same bar one process each, by `scripts/coverage-gate.ts`,
+ * because one run over a monorepo reads every package diluted by the ones it imports.
+ *
+ * A red suite is not judged — a slice that died wrote no lcov, and a coverage finding beside
+ * `X_TEST_FAILED` would send the reader to the wrong fix. A `--shard` slice is not judged either:
+ * it hands its facts to `x verify merge`, which folds every shard and judges once.
+ */
+const coveredUnit = async (
+  ctx: VerifyContext,
+  run: {
+    readonly files: readonly string[];
+    readonly workers: number;
+    readonly widthReason: string;
+    readonly shard: ReturnType<typeof shardFiles> | undefined;
+    readonly lease: ReturnType<typeof machineLease> | undefined;
+  },
+): Promise<StepOutcome> => {
+  const { coverage, ...outcome } = await runCovered({
+    root: ctx.root,
+    runner: ctx.runner,
+    files: run.files,
+    workers: run.workers,
+    isolate: ctx.isolate === true,
+    widthReason: run.widthReason,
+    ...(run.lease === undefined ? {} : { lease: run.lease }),
+    ...(ctx.env === undefined ? {} : { env: ctx.env }),
+  });
+  if (!outcome.ok) return run.shard === undefined ? outcome : { ...outcome, shard: run.shard };
+  if (run.shard !== undefined) {
+    return {
+      ...outcome,
+      shard: run.shard,
+      coverage,
+      output: msg('cli.verify.coverageDeferred'),
+    };
+  }
+  const verdict = await judgeCoverage(
+    ctx.root,
+    coverage,
+    (await readVerifyFloor(ctx.root))?.coverage,
+  );
+  return {
+    ...outcome,
+    ok: verdict.findings.length === 0,
+    findings: verdict.findings,
+    output: verdict.output,
+    measured: {
+      lines: verdict.measure.lines,
+      funcs: verdict.measure.funcs,
+      files: verdict.measure.files,
+    },
+  };
+};
+
 const isApp = (root: string): boolean => existsSync(join(root, APP_CONFIG_FILE));
 
 /**

package/src/workspace-checks.ts

@@ -10,10 +10,17 @@
 // public subject. `isReExportManifest` is the whole carve-out — one statement of logic in such a
 // file re-arms the ceiling on the same save, which is what keeps it from being a hole.
 
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ERROR_DOCS_URL, renderCauseValue } from '@ultimat3/core';
 import type { Finding } from './output';
+import {
+  entryFilesOf,
+  FIXTURE_SUFFIX,
+  fixtureReachFinding,
+  fixturesReachedFrom,
+  mayReachFixture,
+} from './publish-closure';
 import { isReExportManifest } from './reexport-manifest';
 import { eachSourceFile, isGenerated } from './source-files';
 import { checkRootReferences } from './tsconfig-references';
@@ -177,6 +184,16 @@ export function checkLockstep(
  */
 export const TEST_EXCLUSION = '!src/**/*.test.ts';
 
+/**
+ * The same rule for the other suffix test code is written under. A `-fixture.ts` is a harness a
+ * test imports — a fake driver, a recorded page, a scaffolded tree — and `src` sweeps it into the
+ * tarball exactly as it sweeps a `*.test.ts`: six packages shipped 18 of them, 2026-10.
+ */
+export const FIXTURE_EXCLUSION = '!src/**/*-fixture.ts';
+
+/** Every exclusion a published package's `files` carries, in the order it is written. */
+export const TEST_CODE_EXCLUSIONS: readonly string[] = [TEST_EXCLUSION, FIXTURE_EXCLUSION];
+
 export const missingPublishedFileFinding = (dir: string, entry: string): Finding => ({
   code: 'X_PACKAGE_SHAPE',
   cause: `packages/${dir}/package.json ships "${entry}" in "files", but packages/${dir}/${entry} does not exist`,
@@ -185,10 +202,10 @@ export const missingPublishedFileFinding = (dir: string, entry: string): Finding
   at: `packages/${dir}/package.json`,
 });
 
-export const publishesTestsFinding = (dir: string): Finding => ({
+export const publishesTestsFinding = (dir: string, exclusion: string): Finding => ({
   code: 'X_PACKAGE_SHAPE',
-  cause: `packages/${dir}/package.json does not exclude ${TEST_EXCLUSION} from "files"`,
-  fix: `add "${TEST_EXCLUSION}" to "files" in packages/${dir}/package.json, after "src"`,
+  cause: `packages/${dir}/package.json does not exclude ${exclusion} from "files"`,
+  fix: `add "${exclusion}" to "files" in packages/${dir}/package.json, after "src"`,
   docs: ERROR_DOCS_URL,
   at: `packages/${dir}/package.json`,
 });
@@ -222,7 +239,7 @@ export const buildArtifactsFinding = (dir: string, count: number): Finding => ({
 export const noFilesAllowlistFinding = (dir: string): Finding => ({
   code: 'X_PACKAGE_SHAPE',
   cause: `packages/${dir}/package.json publishes with no "files" allowlist, so the tarball carries whatever is in the directory`,
-  fix: `add "files": ["src", "${TEST_EXCLUSION}", "README.md", "LICENSE"] to packages/${dir}/package.json`,
+  fix: `add "files": ["src", ${TEST_CODE_EXCLUSIONS.map((entry) => `"${entry}"`).join(', ')}, "README.md", "LICENSE"] to packages/${dir}/package.json`,
   docs: ERROR_DOCS_URL,
   at: `packages/${dir}/package.json`,
 });
@@ -239,7 +256,7 @@ export const noFilesAllowlistFinding = (dir: string): Finding => ({
  * The second half is `src` sweeping in every `*.test.ts` beside it. Tests are the framework's own,
  * they run against a preloaded frozen clock and a sealed network, and a consumer's test runner
  * collecting them is a failure nobody asked for — 393 files, over half of `@ultimat3/cli`'s
- * tarball.
+ * tarball. A `*-fixture.ts` is the same code under its other suffix (`TEST_CODE_EXCLUSIONS`).
  *
  * Private packages are exempt: a generated app's `packages/*` never reach a registry, carry no
  * `files` and need no license of their own.
@@ -258,8 +275,10 @@ export function checkPublishShape(root: string, manifests: readonly ManifestFact
       if (existsSync(join(root, 'packages', manifest.dir, entry))) continue;
       findings.push(missingPublishedFileFinding(manifest.dir, entry));
     }
-    if (!manifest.files.includes(TEST_EXCLUSION)) {
-      findings.push(publishesTestsFinding(manifest.dir));
+    for (const exclusion of TEST_CODE_EXCLUSIONS) {
+      if (!manifest.files.includes(exclusion)) {
+        findings.push(publishesTestsFinding(manifest.dir, exclusion));
+      }
     }
   }
   return findings;
@@ -312,6 +331,28 @@ export interface PackageShapeOptions {
   readonly release?: string;
 }
 
+/**
+ * The fixtures a published package's entry points reach. A package with no fixture costs one glob
+ * — 19 of 31 — and one with some is read once: `mayReachFixture` answers from the text, and only a
+ * package it cannot clear pays for the import walk.
+ */
+async function fixtureReach(root: string, dir: string, manifest: unknown): Promise<Finding[]> {
+  const base = join(root, 'packages', dir);
+  const fixtures = new Bun.Glob(`src/**/*${FIXTURE_SUFFIX}`).scan({ cwd: base, absolute: false });
+  if ((await fixtures.next()).done === true) return [];
+  const entries = entryFilesOf(manifest);
+  // What the tarball carries of `src`, plus the fixtures themselves: a test's imports are not a
+  // consumer's, so no `*.test.ts` is read.
+  const sources = new Map<string, string>();
+  for await (const path of new Bun.Glob('src/**/*.{ts,tsx}').scan({ cwd: base, absolute: false })) {
+    if (!/\.test\.tsx?$/.test(path)) sources.set(path, readFileSync(join(base, path), 'utf8'));
+  }
+  if (!mayReachFixture(sources, entries)) return [];
+  return fixturesReachedFrom({ read: (path) => sources.get(path) }, entries).map((fixture) =>
+    fixtureReachFinding(dir, fixture, entries),
+  );
+}
+
 /** Every package ships the same contract files; a missing one is a build error, not a chore. */
 export async function checkPackageShape(
   root: string,
@@ -348,6 +389,7 @@ export async function checkPackageShape(
       findings.push(badVersionFinding(dir, version));
       continue;
     }
+    if (record.private !== true) findings.push(...(await fixtureReach(root, dir, manifest)));
     facts.push({
       dir,
       name: typeof record.name === 'string' ? record.name : `@ultimat3/${dir}`,

package/src/workspace-dep-edit.ts

@@ -0,0 +1,127 @@
+// One workspace declaring another in its `package.json`, as a TEXT edit. A generator that makes
+// `packages/db` import the web app owes the manifest line `package-shape` would otherwise demand
+// (`X_WORKSPACE_DEP_UNDECLARED`), and re-serialising the whole file would reformat arrays and
+// spacing the author — or their formatter — chose.
+
+import { containedPath } from './generate-write';
+
+const MANIFEST = 'package.json';
+
+/** The fields a manifest edit reads. Anything else in the file is carried through untouched. */
+interface Manifest {
+  readonly name?: unknown;
+  readonly version?: unknown;
+  readonly dependencies?: unknown;
+  readonly devDependencies?: unknown;
+  readonly peerDependencies?: unknown;
+}
+
+function parseManifest(text: string): Manifest | undefined {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as Manifest)
+      : undefined;
+  } catch {
+    // A manifest that does not parse is `bun install`'s finding, and `package-shape`'s.
+    return undefined;
+  }
+}
+
+const stringRecord = (value: unknown): Readonly<Record<string, string>> =>
+  typeof value === 'object' && value !== null
+    ? Object.fromEntries(
+        Object.entries(value).filter(
+          (entry): entry is [string, string] => typeof entry[1] === 'string',
+        ),
+      )
+    : {};
+
+const declares = (manifest: Manifest, name: string): boolean =>
+  [manifest.dependencies, manifest.devDependencies, manifest.peerDependencies].some((block) =>
+    Object.hasOwn(stringRecord(block), name),
+  );
+
+/**
+ * `manifest` with `name` declared under `dependencies`, or `undefined` when it already is — or
+ * when the text is not a manifest this can edit safely. The block is rewritten from its parsed
+ * entries, sorted the way `bun add` sorts them; every byte outside it is the author's.
+ */
+export function withDependency(
+  manifest: string,
+  name: string,
+  version: string,
+): string | undefined {
+  const parsed = parseManifest(manifest);
+  if (parsed === undefined || declares(parsed, name)) return undefined;
+  const block = /^([ \t]*)"dependencies":\s*\{/m.exec(manifest);
+  if (block === null) {
+    const close = manifest.lastIndexOf('}');
+    const body = manifest.slice(0, close).trimEnd();
+    // `{}` has no property to put a comma after; nothing a scaffold writes is that.
+    if (close === -1 || body.endsWith('{')) return undefined;
+    return `${body},\n  "dependencies": {\n    "${name}": "${version}"\n  }\n}\n`;
+  }
+  const indent = block[1] ?? '';
+  const open = block.index + block[0].length;
+  const close = manifest.indexOf('}', open);
+  if (close === -1) return undefined;
+  const entries = Object.entries({ ...stringRecord(parsed.dependencies), [name]: version })
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .map(([key, value]) => `${indent}  ${JSON.stringify(key)}: ${JSON.stringify(value)}`);
+  return `${manifest.slice(0, open)}\n${entries.join(',\n')}\n${indent}${manifest.slice(close)}`;
+}
+
+/** A workspace's `name` and `version`, or `undefined` when its manifest supplies no name. */
+export async function readWorkspace(
+  root: string,
+  dir: string,
+): Promise<{ readonly name: string; readonly version: string } | undefined> {
+  const file = Bun.file(containedPath(root, `${dir}/${MANIFEST}`));
+  if (!(await file.exists())) return undefined;
+  const parsed = parseManifest(await file.text());
+  if (parsed === undefined || typeof parsed.name !== 'string' || parsed.name === '') {
+    return undefined;
+  }
+  return {
+    name: parsed.name,
+    version: typeof parsed.version === 'string' ? parsed.version : '0.0.0',
+  };
+}
+
+/** One file a caller is about to write: its app-root-relative path and its whole new text. */
+export interface PlannedEdit {
+  readonly path: string;
+  readonly contents: string;
+}
+
+/**
+ * The edit that declares the workspace at `toDir` in `fromDir`'s manifest, NOT yet written — a
+ * registrar plans every file it touches and writes all of them or none. `undefined` when the edge
+ * is already declared or either manifest is unreadable; the `package-shape` step then names the
+ * line, which is the same edit by hand.
+ */
+export async function planWorkspaceDependency(
+  root: string,
+  fromDir: string,
+  toDir: string,
+): Promise<PlannedEdit | undefined> {
+  const target = await readWorkspace(root, toDir);
+  const path = `${fromDir}/${MANIFEST}`;
+  const file = Bun.file(containedPath(root, path));
+  if (target === undefined || !(await file.exists())) return undefined;
+  const contents = withDependency(await file.text(), target.name, target.version);
+  return contents === undefined ? undefined : { path, contents };
+}
+
+/** Declares it now. Answers the path it rewrote, or `undefined` when there was nothing to write. */
+export async function declareWorkspaceDependency(
+  root: string,
+  fromDir: string,
+  toDir: string,
+): Promise<string | undefined> {
+  const edit = await planWorkspaceDependency(root, fromDir, toDir);
+  if (edit === undefined) return undefined;
+  await Bun.write(containedPath(root, edit.path), edit.contents);
+  return edit.path;
+}

package/src/build-errors.ts

@@ -1,54 +0,0 @@
-// The CLI's build and bundle refusals: an entry an app does not have, an island that will not
-// compile, a framework browser script that will not bundle. Split from `errors.ts` at its 500-line
-// ceiling; `errors.ts` re-exports every name, so no import site moves.
-
-import { UltimateError } from '@ultimat3/core';
-import { quoteArg } from './shell-quote';
-
-/**
- * A build target names an entry file the app does not have. `x build` refuses before it spawns the
- * builder: `bun build`'s own "module not found" says nothing about which file an Ultimate app is
- * supposed to own, and `docker build`'s says nothing about which target wanted it.
- */
-export class BuildEntryMissingError extends UltimateError {
-  constructor(input: { target: string; entry: string }) {
-    super({
-      code: 'X_BUILD_ENTRY_MISSING',
-      cause: `x build --target ${input.target} builds from ${input.entry}, and the app does not have it`,
-      fix: `x new scratch-app --dry-run --json   # its file list carries ${input.entry}; copy that file into this app`,
-    });
-  }
-}
-
-/**
- * A client entry would not compile. `X_BUILD_FAILED`, not a code of its own: an island is a bundle
- * entry point like any other, and the target's own logs are what says which line. The fix builds
- * exactly that one file, so the next message an author reads is the compiler's and not the CLI's.
- */
-export class IslandBuildFailedError extends UltimateError {
-  constructor(input: { file: string; logs: string }) {
-    super({
-      code: 'X_BUILD_FAILED',
-      cause: `${input.file} is an island entry point and would not bundle: ${input.logs}`,
-      fix: `bun build --target browser ${input.file}`,
-    });
-  }
-}
-
-/** Which framework script a page ships: the sync worker, the page boot, or the client router. */
-export type FrameworkScriptKind = 'sync worker' | 'page boot' | 'client router';
-
-/**
- * One of the page's framework scripts would not bundle. Same code as an island: "a browser entry
- * the framework builds did not build" is one condition, and the entry here is framework code, not
- * the app's — the cause names WHICH script, so the reader knows what the page is now missing.
- */
-export class FrameworkScriptBuildFailedError extends UltimateError {
-  constructor(input: { what: FrameworkScriptKind; entry: string; logs: string }) {
-    super({
-      code: 'X_BUILD_FAILED',
-      cause: `the ${input.what} (${input.entry}) would not bundle for the browser: ${input.logs}`,
-      fix: `bun build --target browser --format iife ${quoteArg(input.entry)}`,
-    });
-  }
-}

package/src/cmd-dev-fixture.ts

@@ -1,204 +0,0 @@
-// The app `x dev` boots in its tests, and the one place it is declared: every assertion that
-// needs a booted app lives in `cmd-dev.test.ts`, because a process has ONE lifecycle — the second
-// in-process boot is refused (X_LIFECYCLE_DRAINED) — and the coverage gate runs a package in one
-// process. So the fixture is a module of its own, and that file keeps its line budget for tests.
-//
-// What the app declares, and what each declaration is here to prove:
-//   app.config.ts               the root marker a real `x dev` cannot start without; `ai.mcp` by default
-//   apps/web/mcp.ts             the app's own MCP endpoint, mounted by the web role
-//   apps/web/runtime.ts         the app's middleware and disks, reaching a development process
-//   .git/HEAD                   the fixture is its own repository — see the entry below
-//   apps/web/app/hello/*        an SSR page with a component, edited on disk while `x dev` runs
-//   apps/web/app/notes/*        a memory-backed entity and a live query, fed by the in-process bridge
-//   apps/web/app/posts/*        an action, a policy and a query, mounted as HTTP routes
-//   apps/web/site/pricing/*     a static page with its own stylesheet, under the CSP `x dev` sends
-import { resetRegistry as resetActions } from '@ultimat3/action';
-import { clearRegistry as clearEntities } from '@ultimat3/entity';
-import { resetJobs, resetTasks } from '@ultimat3/jobs';
-import { clearPermissions, clearRoles } from '@ultimat3/policy';
-import { resetRegistry as resetQueries } from '@ultimat3/query';
-import type { Frame } from '@ultimat3/realtime';
-import { decode } from '@ultimat3/realtime';
-import type { WsLike } from '@ultimat3/realtime/server';
-import { clearRoutes } from '@ultimat3/render';
-import { resetAppLoad } from './app-load';
-
-export const DEV_FIXTURE_FILES: Readonly<Record<string, string>> = {
-  'package.json': JSON.stringify({ name: 'dev-fixture', version: '1.4.0' }),
-
-  // Its own repository, so the ignore walk stops HERE. The framework's root `.gitignore` lists
-  // `packages/cli/.dev-fixture/`, and `devIgnore` honours every ancestor up to a `.git` — without
-  // this marker the watcher admitted the fixture root and nothing under it, so no save in this
-  // tree ever reached `rebuild`, and the reload path was booted by every run and exercised by none.
-  '.git/HEAD': 'ref: refs/heads/main\n',
-
-  // The root marker a real `x dev` cannot start without, and where `ai.mcp` is declared — by
-  // default `{ expose: true, path: '/mcp' }`, which is what the MCP mount reads.
-  'app.config.ts': `import { defineConfig } from '@ultimat3/core';
-export const config = defineConfig({ name: 'dev-fixture' });
-`,
-
-  // The app's own MCP endpoint, in the contract `app-mcp.ts` reads. `resolveToken` answering
-  // `null` rejects every bearer, which is enough to prove the ROUTE is mounted (401, not 404).
-  'apps/web/mcp.ts': `import { defineAppMcp } from '@ultimat3/mcp';
-export const mcp = defineAppMcp({ include: 'exposed', resolveToken: () => null });
-`,
-
-  // The app's own middleware, in the contract `app-runtime.ts` reads: a header on every response
-  // is the cheapest proof that the chain `x dev` composed is the app's and not only the replica's.
-  // Its disks too: `x dev` built its own embedded disk and ignored this one until 22.4.
-  'apps/web/runtime.ts': `import { defineStorage, localDriver } from '@ultimat3/storage';
-const stamp = async (request, ctx, next) => {
-  const response = await next(request, ctx);
-  const headers = new Headers(response.headers);
-  headers.set('x-dev-runtime', 'app');
-  return new Response(response.body, { status: response.status, headers });
-};
-const storage = defineStorage({
-  disks: { appdisk: localDriver({ root: new URL('../../.app-disk', import.meta.url).pathname }) },
-  default: 'appdisk',
-});
-export const runtime = { middleware: [stamp], storage };
-`,
-
-  // A memory-backed entity, so the fixture needs no migration: the row observer sits on
-  // `database()`'s repo wrapper, the same seam a Postgres-backed repo writes through.
-  'apps/web/app/notes/entity.ts': `import { database, entity, memoryDriver, text, uuid } from '@ultimat3/entity';
-export const notes = entity('notes', { columns: { id: uuid().primaryKey(), title: text() } });
-export const db = database({ notes }, { driver: memoryDriver() });
-`,
-  'apps/web/app/notes/live.ts': `import { allow } from '@ultimat3/policy';
-import { from, query, t } from '@ultimat3/query';
-import { db } from './entity';
-export const liveNotes = query({
-  input: t.object({}),
-  policy: allow('public'),
-  live: true,
-  subscribes: ['notes'],
-  sql: () =>
-    from<{ id: string; title: string }>('notes', () => db.notes.where({}).all())
-      .orderBy('id')
-      .limit(50),
-});
-`,
-
-  'apps/web/app/posts/policy.ts': `import { allow, can, definePermissions, defineRoles } from '@ultimat3/policy';
-export const permissions = definePermissions(['post:publish'] as const);
-export const roles = defineRoles({
-  author: { grants: ['post:publish'] },
-  reader: { grants: [] },
-});
-export const canPostWrite = can('post:publish');
-export const anyone = allow();
-`,
-
-  'apps/web/app/posts/actions.ts': `import { action, t } from '@ultimat3/action';
-import { anyone, canPostWrite } from './policy';
-
-export const publishPost = action({
-  input: t.object({ id: t.uuid }),
-  output: t.object({ id: t.uuid }),
-  policy: canPostWrite,
-  async handle({ input }) {
-    return { id: input.id };
-  },
-});
-
-export const echoPost = action({
-  input: t.object({ word: t.string }),
-  output: t.object({ word: t.string }),
-  policy: anyone,
-  async handle({ input }) {
-    return { word: input.word };
-  },
-});
-`,
-
-  // A page with a body, on the surface an author edits all day. What the reload test rewrites: the
-  // module must be imported again for the new body to be served, which `import()` alone never does.
-  'apps/web/app/hello/page.tsx': `import { defineRoute } from '@ultimat3/render';
-
-export const config = defineRoute({
-  render: 'ssr',
-  hydrate: 'visible',
-  offline: 'runtime',
-  budget: { js: '60kb' },
-  meta: () => ({ title: 'Hello', description: 'A page that is edited while x dev runs' }),
-});
-
-export function Page() {
-  return <p>generation one</p>;
-}
-`,
-
-  // An ISR page whose body is a COMPONENT in another file — the shape every real page has. What the
-  // component-reload test rewrites: the page module's own bytes never change, so only evicting what
-  // imports the component re-evaluates it, and only clearing the ISR store stops the first render
-  // from answering for the rest of the process (notificado.co, 2026-09-27).
-  'apps/web/site/news/headline.tsx': `export function Headline() {
-  return <h1>headline one</h1>;
-}
-`,
-
-  'apps/web/site/news/page.tsx': `import { defineRoute } from '@ultimat3/render';
-import { Headline } from './headline';
-
-export const config = defineRoute({
-  render: 'isr',
-  revalidate: { ttl: '1h' },
-  offline: 'runtime',
-  hydrate: 'never',
-  budget: { js: '0kb' },
-  meta: () => ({ title: 'News', description: 'A page whose component is edited while x dev runs' }),
-});
-
-export function Page() {
-  return <main><Headline /></main>;
-}
-`,
-
-  // A stylesheet the page imports, because that import is what registers it — and the document's
-  // inline `<style>` is what the CSP has to name. Without one this file served no styled page and
-  // could not have caught the policy that blanked every deployed app.
-  'apps/web/site/pricing/page.module.scss': `.price { color: #123456; }
-`,
-
-  'apps/web/site/pricing/page.tsx': `import { defineRoute } from '@ultimat3/render';
-import './page.module.scss';
-
-export const config = defineRoute({
-  render: 'static',
-  offline: 'precache',
-  hydrate: 'never',
-  budget: { js: '0kb' },
-  meta: () => ({ title: 'Pricing', description: 'What it costs' }),
-});
-`,
-};
-
-export const resetRegistries = (): void => {
-  resetActions();
-  resetQueries();
-  clearEntities();
-  clearRoutes();
-  resetJobs();
-  resetTasks();
-  clearPermissions();
-  clearRoles();
-  resetAppLoad();
-};
-
-/** A `WsLike` that keeps every frame the node sends, decoded — what a live assertion reads. */
-export class FakeWs implements WsLike {
-  readonly frames: Frame[] = [];
-  send(data: string): number {
-    this.frames.push(decode(data));
-    return data.length;
-  }
-  close(): void {}
-  subscribe(): void {}
-  unsubscribe(): void {}
-  getBufferedAmount(): number {
-    return 0;
-  }
-}