@wenathlan/getry 2.0.150 → 2.0.152

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/getry",
-  "version": "2.0.150",
+  "version": "2.0.152",
   "repository": {
     "type": "git",
     "url": "https://github.com/wenathlan/devthink"
@@ -27,7 +27,7 @@
     "ecmascript": "^5.0.0",
     "firefox": ">=0.8.0",
     "iojs": "^1.0.0",
-    "node": ">=26.12.1 <27",
+    "node": ">=26.13.0 <27",
     "npm": "^12.1.0",
     "pnpm": "^12.6.0",
     "teleport": ">=0.2.0",
@@ -36,6 +36,12 @@
     "yarn": "^4.17.1"
   },
   "type": "module",
+  "exports": {
+    "./thinking": {
+      "types": "./thinking.ts",
+      "default": "./thinking.ts"
+    }
+  },
   "scripts": {
     "dev": "vite --host",
     "build": "vite build",
@@ -47,23 +53,36 @@
     "restore:entry": "node -e \"const{readFileSync}=require('node:fs');const{execSync}=require('node:child_process');const script=/script[^>]*App\\.tsx/;const triad=/family=Bricolage\\+Grotesque[\\s\\S]*Outfit[\\s\\S]*JetBrains\\+Mono/;const face=(h)=>script.test(h)&&triad.test(h);if(face(readFileSync('index.html','utf8'))){console.log('index.html already rides the source face');process.exit(0)}if(!face(execSync('git show HEAD:./index.html',{encoding:'utf8'}))){console.error('refusing: HEAD index.html is not the canonical source face yet (script App.tsx + the font triad) - land the source-face fix first; nothing was touched');process.exit(1)}execSync('git checkout -- index.html',{stdio:'inherit'});console.log('index.html restored from HEAD (the source face)')\""
   },
   "dependencies": {
+    "@fluentui/react-icons": "^2.0.345",
+    "@fontsource-variable/bricolage-grotesque": "^5.3.0",
+    "@fontsource-variable/jetbrains-mono": "^5.3.0",
+    "@fontsource-variable/outfit": "^5.3.0",
     "@hono/node-server": "^2.1.5",
+    "@libsql/client": "^0.18.0",
     "@prisma/adapter-libsql": "^7.10.1",
-    "hono": "^4.13.13",
+    "@prisma/client": "^7.10.1",
+    "@wenathlan/saddle": "^2.1.6",
+    "@wenathlan/vault": "^2.0.151",
+    "hono": "^4.13.14",
     "ink": "^7.1.1",
+    "lucide-react": "^1.66.0",
+    "motion": "^12.43.0",
+    "react": "^19.3.1",
     "react-devtools-core": "^8.0.0",
+    "react-dom": "^19.3.1",
+    "wouter": "^3.13.0",
     "z-ai-web-dev-sdk": "^0.0.18"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.6.3",
-    "@capacitor/android": "^8.5.3",
-    "@capacitor/cli": "^8.5.3",
-    "@capacitor/core": "^8.5.3",
-    "@capacitor/ios": "^8.5.3",
-    "@fluentui/react-icons": "^2.0.344",
+    "@biomejs/biome": "^2.6.4",
+    "@capacitor/android": "^8.6.0",
+    "@capacitor/cli": "^8.6.0",
+    "@capacitor/core": "^8.6.0",
+    "@capacitor/ios": "^8.6.0",
+    "@fluentui/react-icons": "^2.0.345",
     "@hookform/resolvers": "^5.9.2",
     "@libsql/client": "^0.18.0",
-    "@opencode-ai/sdk": "^1.19.4",
+    "@opencode-ai/sdk": "^1.19.5",
     "@prisma/client": "^7.10.1",
     "@radix-ui/react-accordion": "^1.3.1",
     "@radix-ui/react-alert-dialog": "^1.2.1",
@@ -96,41 +115,49 @@
     "@tailwindcss/vite": "^4.3.3",
     "@tsconfig/node26": "^26.0.1",
     "@types/better-sqlite3": "^9.6.0",
-    "@types/chrome": "^0.3.6",
+    "@types/chrome": "^0.3.7",
     "@types/express": "^5.0.6",
-    "@types/node": "^26.6.5",
+    "@types/google.maps": "^3.66.9",
+    "@types/node": "^26.6.6",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
     "add": "^2.0.9",
-    "autoprefixer": "^10.6.1",
-    "axios": "^1.20.0",
+    "autoprefixer": "^10.6.2",
+    "axios": "^1.21.0",
     "better-sqlite3": "^13.0.3",
     "bun-types": "^1.4.4",
+    "cheerio": "^1.2.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "drizzle-kit": "^0.31.11",
     "drizzle-orm": "^0.45.4",
     "embla-carousel-react": "^8.6.0",
+    "emittery": "^2.2.0",
     "esbuild": "^0.28.2",
     "express": "^5.3.0",
     "fast-check": "^4.10.2",
     "framer-motion": "^13.5.1",
+    "hono": "^4.13.14",
     "input-otp": "^1.5.0",
-    "lucide-react": "^1.61.0",
+    "jsdom": "26.1.0",
+    "lucide-react": "^1.66.0",
     "mysql2": "^3.24.6",
     "nanoid": "^6.0.2",
     "next-themes": "^0.4.6",
-    "pnpm": "^12.15.0",
-    "postcss": "^8.5.31",
+    "p-limit": "^7.3.3",
+    "p-retry": "^8.0.1",
+    "playwright": "^1.64.1",
+    "pnpm": "^12.16.1",
+    "postcss": "^8.5.32",
     "prettier": "^3.9.10",
     "prisma": "^7.10.1",
     "react": "^19.3.1",
     "react-day-picker": "^10.0.2",
     "react-dom": "^19.3.1",
     "react-hook-form": "^7.91.0",
-    "react-resizable-panels": "^4.15.0",
+    "react-resizable-panels": "^4.15.3",
     "recharts": "^3.10.1",
     "sonner": "^2.0.8",
     "streamdown": "^2.7.1",
@@ -143,6 +170,7 @@
     "typescript": "^7.0.2",
     "vaul": "^1.1.2",
     "vite": "^8.3.5",
+    "vite-plugin-manus-runtime": "^0.0.59",
     "vitest": "^5.0.5",
     "wouter": "^3.13.0",
     "yaml": "^2.9.1",
@@ -173,8 +201,11 @@
     "proxy-addr": "2.0.8",
     "body-parser": "^2.4.0",
     "fast-uri": "^3.1.9",
-    "follow-redirects": "^1.16.1",
+    "follow-redirects": "^1.16.2",
+    "minimatch": "^11.0.3",
+    "glob": "^14.0.3",
     "zod": "^4.6.7",
-    "undici": "^7.30.1"
+    "undici": "^7.30.1",
+    "shell-quote": "^1.11.0"
   }
 }

package/tests/debonairlane.test.ts

@@ -0,0 +1,407 @@
+// # debonairlane.test — the debonair api lane of the family gateway (the
+// mount adapter contract): the thirteen-route catalog mirrors the debonair
+// gateway table in the family shape (first match wins, the params capture,
+// an empty capture never matches, the provider lanes answer absent), the
+// adapter translates the getry mount shape (the web request) into the
+// debonair gateway request (the json lane, the raw lane, the query record)
+// and the debonair answer back into the web response (the json body, the
+// blob stream with the digest headers, the standardized error shape, the
+// 502 lane-faulted guard — never a throw), the origin config rides the
+// vite env law under the house https gate, and the forward seat rides the
+// wire over a fake fetch (the same routes, the body lanes, the blob
+// headers, the error catalog, the unreachable lane). runnable with vitest:
+//   pnpm test
+import assert from "node:assert/strict";
+import { describe, it } from "vitest";
+import {
+  DEBONAIR_URL_ENV,
+  DEBONAIRROUTES,
+  type DebonairDispatch,
+  type DebonairGatewayAnswer,
+  type DebonairGatewayRequest,
+  debonaircandidate,
+  debonairforward,
+  debonairorigin,
+  debonairrequest,
+  debonairresponse,
+  debonairserve,
+  matchdebonairpath,
+  matchdebonairroute,
+} from "../debonairlane.ts";
+
+/** the debonair origin the wire tests ride (a public https host — the law). */
+const ORIGIN = "https://debonair.example.com";
+
+/** builds one mounted web request — the getry server shape. */
+function mount(method: string, path: string, init: { body?: string; contenttype?: string } = {}): Request {
+  const headers: Record<string, string> = {};
+  if (init.contenttype !== undefined) headers["content-type"] = init.contenttype;
+  return new Request(`${ORIGIN}${path}`, { method, headers, body: init.body });
+}
+
+/** builds one fake debonair engine seat — records every gateway request it
+ * receives and answers the scripted answer (the value builder, the typed
+ * refusal or a fault thrown past the guards).
+ *
+ * @param serve the answer the seat serves.
+ */
+function engineseat(
+  serve: (request: DebonairGatewayRequest) => DebonairGatewayAnswer | Promise<DebonairGatewayAnswer>,
+): { dispatch: DebonairDispatch; calls: DebonairGatewayRequest[] } {
+  const calls: DebonairGatewayRequest[] = [];
+  const dispatch: DebonairDispatch = async (request) => {
+    calls.push(request);
+    return serve(request);
+  };
+  return { dispatch, calls };
+}
+
+/** one engine seat serving one ok value (the happy lane builder). */
+function valueseat(value: (request: DebonairGatewayRequest) => unknown): {
+  dispatch: DebonairDispatch;
+  calls: DebonairGatewayRequest[];
+} {
+  return engineseat((request) => ({ ok: true, status: 200, value: value(request) }));
+}
+
+describe("the debonair route catalog (the published contract mirror)", () => {
+  it("carries the thirteen debonair routes in the family shape", () => {
+    assert.equal(DEBONAIRROUTES.length, 13);
+    assert.deepEqual(DEBONAIRROUTES[0], { method: "POST", path: "/api/v1/ingest/upload", handler: "uploadIngest" });
+    assert.deepEqual(DEBONAIRROUTES[5], { method: "GET", path: "/api/v1/blob/:id", handler: "getBlob" });
+    assert.deepEqual(DEBONAIRROUTES[12], { method: "GET", path: "/api/v1/vitrine", handler: "listVitrine" });
+    for (const route of DEBONAIRROUTES) {
+      assert.ok(route.path.startsWith("/api/v1/"), `${route.path} rides the api prefix`);
+      assert.ok(["GET", "POST", "DELETE"].includes(route.method));
+    }
+  });
+
+  it("matches the params, refuses the empty capture and answers the method verdict", () => {
+    const routed = matchdebonairroute("GET", "/api/v1/ingest/jobs/123");
+    assert.ok(routed.kind === "routed");
+    assert.equal(routed.route.handler, "getIngestJob");
+    assert.deepEqual(routed.params, { id: "123" });
+    // the empty capture never matches — a route param always carries a value
+    assert.equal(matchdebonairpath("/api/v1/blob/:id", "/api/v1/blob/"), null);
+    // the specific rows ride first: the jobs row wins over the :id row
+    const shelf = matchdebonairroute("GET", "/api/v1/ingest");
+    assert.ok(shelf.kind === "routed" && shelf.route.handler === "listIngestShelf");
+    // the path matches, the method does not — the allowed list answers
+    const method = matchdebonairroute("PUT", "/api/v1/vitrine");
+    assert.ok(method.kind === "method");
+    assert.deepEqual(method.allowed, ["GET"]);
+    // the provider lanes own their paths — the catalog answers absent
+    const foreign = matchdebonairroute("POST", "/v1/chat/completions");
+    assert.deepEqual(foreign, { kind: "absent" });
+  });
+
+  it("decodes the captured params (the vault safeDecode law)", () => {
+    const params = matchdebonairpath("/api/v1/profiles/:genre", "/api/v1/profiles/drill%20beats");
+    assert.deepEqual(params, { genre: "drill beats" });
+    const malformed = matchdebonairpath("/api/v1/profiles/:genre", "/api/v1/profiles/%zz");
+    assert.deepEqual(malformed, { genre: "%zz" }, "a malformed escape keeps the raw text");
+  });
+});
+
+describe("the mount adapter (the getry server shape to the debonair contract)", () => {
+  it("builds the gateway request off the web request — the json lane", async () => {
+    const { dispatch, calls } = valueseat(() => ({ jobId: "42" }));
+    const response = await debonairserve(
+      mount("POST", "/api/v1/ingest/upload", {
+        body: JSON.stringify({ bytes: "QUJD", name: "take.wav", ownerId: "123" }),
+        contenttype: "application/json",
+      }),
+      dispatch,
+    );
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), { jobId: "42" });
+    assert.equal(calls.length, 1);
+    const seen = calls[0];
+    assert.ok(seen);
+    assert.equal(seen.method, "POST");
+    assert.equal(seen.path, "/api/v1/ingest/upload");
+    assert.deepEqual(seen.json, { bytes: "QUJD", name: "take.wav", ownerId: "123" });
+    assert.equal(seen.raw, null);
+    assert.deepEqual(seen.query, {});
+  });
+
+  it("carries the raw body verbatim with the facts in the query (the deposit law)", async () => {
+    const { dispatch, calls } = valueseat(() => ({ jobId: "43" }));
+    const response = await debonairserve(
+      mount("POST", "/api/v1/ingest/upload?name=take.wav&ownerId=123&kind=reference", {
+        body: "the verbatim bytes",
+      }),
+      dispatch,
+    );
+    assert.equal(response.status, 200);
+    const seen = calls[0];
+    assert.ok(seen);
+    assert.equal(seen.json, null);
+    assert.ok(seen.raw instanceof Uint8Array);
+    assert.equal(new TextDecoder().decode(seen.raw), "the verbatim bytes");
+    assert.deepEqual(seen.query, { name: "take.wav", ownerId: "123", kind: "reference" });
+  });
+
+  it("serves the blob stream with the pointer's kind and the digest headers", async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4]);
+    const pointer = {
+      id: "777",
+      bytes: bytes.byteLength,
+      sha256: "a".repeat(64),
+      kind: "audio/wav",
+      storedAt: "2026-06-01T00:00:00.000Z",
+    };
+    const { dispatch, calls } = valueseat(() => ({ bytes, mime: "audio/wav", pointer }));
+    const response = await debonairserve(mount("GET", "/api/v1/blob/777"), dispatch);
+    assert.equal(response.status, 200);
+    assert.equal(response.headers.get("content-type"), "audio/wav");
+    assert.equal(response.headers.get("x-debonair-blob-sha256"), "a".repeat(64));
+    assert.equal(response.headers.get("x-debonair-blob-bytes"), "4");
+    assert.equal(response.headers.get("x-debonair-blob-stored-at"), "2026-06-01T00:00:00.000Z");
+    assert.deepEqual(new Uint8Array(await response.arrayBuffer()), bytes);
+    assert.equal(calls[0]?.path, "/api/v1/blob/777");
+  });
+
+  it("answers the standardized error shape with the debonair status", async () => {
+    const { dispatch } = engineseat(() => ({
+      ok: false,
+      status: 405,
+      error: { code: "method-not-allowed", message: "PUT does not ride /api/v1/vitrine" },
+    }));
+    const response = await debonairserve(mount("PUT", "/api/v1/vitrine"), dispatch);
+    assert.equal(response.status, 405);
+    assert.deepEqual(await response.json(), {
+      error: { code: "method-not-allowed", message: "PUT does not ride /api/v1/vitrine" },
+    });
+  });
+
+  it("guards a seat that faults past the debonair guards — never a throw", async () => {
+    const { dispatch } = engineseat(() => {
+      throw new Error("the engine faulted");
+    });
+    const response = await debonairserve(mount("GET", "/api/v1/vitrine"), dispatch);
+    assert.equal(response.status, 502);
+    const body = (await response.json()) as { error: { code: string; message: string } };
+    assert.equal(body.error.code, "lane-faulted");
+    assert.match(body.error.message, /the engine faulted/);
+  });
+
+  it("serves the 201 registrations and the json refusals through the answer translator", async () => {
+    const created = debonairresponse({ ok: true, status: 201, value: { jobId: "9" } });
+    assert.equal(created.status, 201);
+    assert.deepEqual(await created.json(), { jobId: "9" });
+    assert.equal(created.headers.get("content-type")?.split(";")[0], "application/json");
+    const refused = debonairresponse({
+      ok: false,
+      status: 400,
+      error: { code: "bad-request", message: "the upload needs a name" },
+    });
+    assert.equal(refused.status, 400);
+    assert.deepEqual(await refused.json(), { error: { code: "bad-request", message: "the upload needs a name" } });
+  });
+
+  it("builds the gateway request alone (the translation seat the mount loop reads)", async () => {
+    const request = await debonairrequest(
+      new Request(`${ORIGIN}/api/v1/ingest?ownerId=123&ownerId=456`, { method: "GET" }),
+    );
+    assert.equal(request.method, "GET");
+    assert.equal(request.path, "/api/v1/ingest");
+    assert.deepEqual(request.query, { ownerId: "123" }, "the first value wins (the web law)");
+    assert.equal(request.json, null);
+    assert.equal(request.raw, null);
+    // a broken json body answers the null json lane — the debonair route owns the refusal
+    const broken = await debonairrequest(
+      new Request(`${ORIGIN}/api/v1/ingest/upload`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{not json",
+      }),
+    );
+    assert.equal(broken.json, null);
+    assert.equal(broken.raw, null);
+  });
+});
+
+describe("the origin config (the vite env law under the house https gate)", () => {
+  it("names the environment seat the deploy pins the origin through", () => {
+    assert.equal(DEBONAIR_URL_ENV, "VITE_DEBONAIR_URL");
+  });
+
+  it("trims the candidate and refuses the unlawful origins", () => {
+    assert.equal(debonaircandidate("  https://debonair.example.com/  "), "https://debonair.example.com");
+    assert.equal(debonaircandidate(""), "", "the empty candidate keeps the lane closed");
+    assert.equal(debonaircandidate("http://debonair.example.com"), "", "http never rides");
+    assert.equal(debonaircandidate("https://localhost"), "", "loopback never rides");
+    assert.equal(debonaircandidate("https://10.0.0.1"), "", "the private range never rides");
+    assert.equal(debonaircandidate("not a url"), "", "a malformed candidate never rides");
+  });
+
+  it("answers no origin when the deploy carries none (the lane stays closed)", () => {
+    assert.equal(debonairorigin(), "");
+  });
+});
+
+describe("the forward seat (the debonair engine over the wire)", () => {
+  /** one recorded wire call. */
+  interface WireCall {
+    url: string;
+    method: string;
+    contenttype: string | null;
+    body: string | null;
+  }
+
+  /** builds one fake fetch serving the debonair wire law. */
+  function fakewire(answer: (call: WireCall) => Response): { fetchImpl: typeof fetch; calls: WireCall[] } {
+    const calls: WireCall[] = [];
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const headers = init?.headers as Record<string, string> | undefined;
+      const call: WireCall = {
+        url: typeof input === "string" ? input : input.url,
+        method: init?.method ?? "GET",
+        contenttype:
+          headers !== undefined && typeof headers["content-type"] === "string" ? headers["content-type"] : null,
+        body: typeof init?.body === "string" ? init.body : null,
+      };
+      calls.push(call);
+      return answer(call);
+    };
+    return { fetchImpl, calls };
+  }
+
+  it("forwards the json lane and parses the json answer back", async () => {
+    const { fetchImpl, calls } = fakewire(() => Response.json({ tracks: [], profiles: [] }));
+    const dispatch = debonairforward(ORIGIN, fetchImpl);
+    const answer = await dispatch({ method: "GET", path: "/api/v1/vitrine", query: {}, json: null, raw: null });
+    assert.ok(answer.ok);
+    assert.equal(answer.status, 200);
+    assert.deepEqual(answer.value, { tracks: [], profiles: [] });
+    const call = calls[0];
+    assert.ok(call);
+    assert.equal(call.method, "GET");
+    assert.equal(call.url, `${ORIGIN}/api/v1/vitrine`);
+    // the json lane rides the wire with the json content type
+    const posted = await dispatch({
+      method: "POST",
+      path: "/api/v1/profiles/mine",
+      query: {},
+      json: { genre: "trap", ownerId: "123" },
+      raw: null,
+    });
+    assert.ok(posted.ok);
+    const mine = calls[1];
+    assert.ok(mine);
+    assert.equal(mine.method, "POST");
+    assert.equal(mine.url, `${ORIGIN}/api/v1/profiles/mine`);
+    assert.equal(mine.contenttype, "application/json");
+    assert.deepEqual(JSON.parse(mine.body ?? "{}"), { genre: "trap", ownerId: "123" });
+  });
+
+  it("forwards the raw lane and the query facts", async () => {
+    const { fetchImpl, calls } = fakewire(() => Response.json({ removed: true }, { status: 200 }));
+    const dispatch = debonairforward(ORIGIN, fetchImpl);
+    const answer = await dispatch({
+      method: "DELETE",
+      path: "/api/v1/ingest/123",
+      query: {},
+      json: null,
+      raw: new Uint8Array([9, 9]),
+    });
+    assert.ok(answer.ok);
+    assert.deepEqual(answer.value, { removed: true });
+    const call = calls[0];
+    assert.ok(call);
+    assert.equal(call.method, "DELETE");
+    assert.equal(call.url, `${ORIGIN}/api/v1/ingest/123`);
+    assert.equal(call.body, null, "the bytes ride the body lane, never the string lane");
+  });
+
+  it("forwards the query record with the path (the deposit facts)", async () => {
+    const { fetchImpl, calls } = fakewire(() => Response.json({ jobId: "51" }, { status: 201 }));
+    const dispatch = debonairforward(ORIGIN, fetchImpl);
+    const answer = await dispatch({
+      method: "POST",
+      path: "/api/v1/ingest/upload",
+      query: { name: "take.wav", ownerId: "123", kind: "reference" },
+      json: null,
+      raw: new Uint8Array([1, 2, 3]),
+    });
+    assert.ok(answer.ok);
+    assert.equal(answer.status, 201);
+    assert.equal(
+      calls[0]?.url,
+      `${ORIGIN}/api/v1/ingest/upload?name=take.wav&ownerId=123&kind=reference`,
+      "the query facts ride the wire verbatim",
+    );
+  });
+
+  it("parses the blob stream headers back into the stream value", async () => {
+    const { fetchImpl } = fakewire(
+      () =>
+        new Response(new Uint8Array([5, 6, 7]), {
+          status: 200,
+          headers: {
+            "content-type": "audio/wav",
+            "x-debonair-blob-sha256": "b".repeat(64),
+            "x-debonair-blob-bytes": "3",
+            "x-debonair-blob-stored-at": "2026-06-02T00:00:00.000Z",
+          },
+        }),
+    );
+    const dispatch = debonairforward(ORIGIN, fetchImpl);
+    const answer = await dispatch({ method: "GET", path: "/api/v1/blob/321", query: {}, json: null, raw: null });
+    assert.ok(answer.ok);
+    const stream = answer.value as { bytes: Uint8Array; mime: string; pointer: Record<string, unknown> };
+    assert.deepEqual([...stream.bytes], [5, 6, 7]);
+    assert.equal(stream.mime, "audio/wav");
+    assert.equal(stream.pointer.id, "321");
+    assert.equal(stream.pointer.bytes, 3);
+    assert.equal(stream.pointer.sha256, "b".repeat(64));
+    assert.equal(stream.pointer.storedAt, "2026-06-02T00:00:00.000Z");
+  });
+
+  it("parses the standardized error shape and guards the unreachable lane", async () => {
+    const { fetchImpl } = fakewire(() =>
+      Response.json(
+        { error: { code: "bad-owner", message: "the upload needs the owner pointer in the minted decimal form" } },
+        { status: 400 },
+      ),
+    );
+    const dispatch = debonairforward(ORIGIN, fetchImpl);
+    const refused = await dispatch({
+      method: "POST",
+      path: "/api/v1/ingest/upload",
+      query: {},
+      json: { bytes: "QQ==", name: "take.wav" },
+      raw: null,
+    });
+    assert.ok(!refused.ok);
+    assert.equal(refused.status, 400);
+    assert.equal(refused.error.code, "bad-owner");
+    const hanging: typeof fetch = () => {
+      throw new Error("the network is down");
+    };
+    const offline = await debonairforward(
+      ORIGIN,
+      hanging,
+    )({
+      method: "GET",
+      path: "/api/v1/vitrine",
+      query: {},
+      json: null,
+      raw: null,
+    });
+    assert.ok(!offline.ok);
+    assert.equal(offline.status, 502);
+    assert.equal(offline.error.code, "lane-unreachable");
+  });
+
+  it("composes the whole lane: the mount request rides the forward seat and answers as the web response", async () => {
+    const { fetchImpl } = fakewire(() => Response.json({ records: [] }, { status: 200 }));
+    const response = await debonairserve(
+      mount("GET", "/api/v1/ingest?ownerId=123"),
+      debonairforward(ORIGIN, fetchImpl),
+    );
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), { records: [] });
+  });
+});

package/tests/design.test.ts

@@ -5,14 +5,14 @@
 // theme anchor, page anchors, prisma schema, db layer) and pins the reform:
 // the devthink foundation (mica #202020 over the 8-step ladder #242424→
 // #494949, Inter Variable + Geist Mono, the 13px/450 body, the trylle shadow
-// ladder), the windows hands (press .7 pins, dtPopIntro, the fluent window
-// curve, the red close, the inactive grayscale law, the eight resize
-// handles, the win11 scrollbar), the two-accent contract (the getry violet
-// identity beside the windows accent), the entry-flow law (intro →
-// onboarding → the platform over the catalogued seen state) and the banned
-// list (no pill, no all-properties transition, no scale(0) outside the pin
-// law, no banned hue, no build ghost). The stylesheet is read as text — no
-// browser, no DOM.
+// ladder), the windows hands (press .7 pins, dtPopIntro, the win11
+// scrollbar), the two-accent contract (the getry violet identity beside the
+// windows accent), the FAMILY STANDALONE LAW (the shell answers the direct
+// url full-bleed, the window chrome lives only inside the os embed), the
+// entry-flow law (intro → onboarding → the platform over the catalogued seen
+// state) and the banned list (no pill, no all-properties transition, no
+// scale(0) outside the pin law, no banned hue, no build ghost). The sources
+// are read as text — no browser, no DOM.
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
@@ -22,11 +22,11 @@ function read(path: string): string {
 
 const CSS = read("../Sol/sol.css");
 const ENTRY = read("../index.html");
-const MARK = read("../Sol/widgets/ShellBrandmark.tsx");
+const MARK = read("../Sol/wingets/ShellBrandmark.tsx");
 const SHELL = read("../Sol/shell/Shell.tsx");
 const SOL = read("../Sol/Sol.tsx");
 const HOME = read("../Sol/home/home.tsx");
-const GATE = read("../Sol/widgets/HomeEntrygate.tsx");
+const GATE = read("../Sol/wingets/HomeEntrygate.tsx");
 const INTRO = read("../Sol/intro/intro.tsx");
 const ONBOARDING = read("../Sol/onboarding/onboarding.tsx");
 const STATE = read("../onboardingstate.ts");
@@ -88,8 +88,9 @@ describe("design contract — the devthink foundation", () => {
     expect(CSS).toContain("inset 0 8px 14px -6px rgb(255 255 255 / 22%)");
   });
 
-  it("keeps the two-accent contract (the getry violet identity beside the windows accent)", () => {
-    expect(CSS).toContain("--violet-500: #8b5cf6");
+  it("keeps the two-accent contract (the white sun beside the windows accent)", () => {
+    expect(CSS).toContain("--color-signal: #ffffff");
+    expect(CSS).toContain("--violet-500: var(--color-signal)");
     expect(CSS).toContain("--accent: var(--violet-500)");
     expect(CSS).toContain("--win-accent: var(--color-win)");
     expect(CSS).toContain("--color-win: #4cc2ff");
@@ -122,24 +123,22 @@ describe("design contract — the windows hands", () => {
     expect(CSS).toContain("--dur-press: 100ms");
   });
 
-  it("carries the fluent red close, the inactive law and the eight resize handles", () => {
-    expect(CSS).toContain("rgb(232 17 35)");
-    expect(CSS).toContain("rgb(139 10 20)");
-    expect(CSS).toContain("grayscale(80%)");
-    for (const edge of ["n", "s", "e", "w", "ne", "nw", "se", "sw"]) {
-      expect(CSS).toContain(`.winapp__rz[data-edge="${edge}"]`);
-    }
-    expect(SHELL).toContain('RESIZE_EDGES = ["n", "s", "e", "w", "ne", "nw", "se", "sw"]');
+  it("answers the direct url full-bleed — the window chrome lives only inside the os", () => {
+    /* the family standalone law: an app accessed by its own url is the
+    normal application, one hundred percent — the shell renders
+    shell--standalone with no window chrome of its own (no title bar, no
+    captions, no resize handles, no inactive law, no entry scale), while
+    the framed contract keeps the bare stage for the os power clip */
+    expect(SHELL).toContain("shell--standalone");
+    expect(SHELL).toContain("shell--embedded");
+    expect(SHELL).not.toMatch(
+      /className="appframe"|winapp__title|winapp__cap|winapp__rz|winchip|setPointerCapture|data-inactive|RESIZE_EDGES/,
+    );
+    expect(CSS).toMatch(/\.shell--standalone \{[^}]*height: 100vh/);
   });
 
-  it("opens the window on the fluent curve and rides the win11 scrollbar", () => {
-    expect(rules(CSS)).toMatch(/\.winapp \{[^}]*animation: winappOpen var\(--dur-2\) var\(--ease-window\)/);
+  it("rides the win11 scrollbar beside the standalone stage", () => {
     expect(CSS).toContain("*:hover::-webkit-scrollbar-thumb");
-    expect(rules(CSS)).toMatch(/\.winapp__rz \{[^}]*touch-action: none/);
-  });
-
-  it("rests the title-bar mark on the landing (logo discipline)", () => {
-    expect(CSS).toContain("data-landing");
   });
 
   it("pins the footer to the window floor (the sticky-footer law)", () => {
@@ -158,7 +157,7 @@ describe("design contract — the banned list", () => {
   });
 
   it("never ships an all-properties transition", () => {
-    expect(/transition:\s*all/.test(rules(CSS)), "transition: all is a reprovação").toBe(false);
+    expect(/transition:\s*all/.test(rules(CSS)), "transition: all fails the design gate").toBe(false);
   });
 });
 
@@ -198,9 +197,9 @@ describe("flow contract — intro → onboarding → the platform", () => {
 
   it("gates the home anchor on the seen state before anything shows", () => {
     /* the widget surface law: the dotted widget name is written exactly
-    once (inside Sol/widgets/index.ts) and the page answers the surface
+    once (inside Sol/wingets/index.ts) and the page answers the surface
     import with its canonical alias — never the dotted path again */
-    expect(HOME).toMatch(/import \{ HomeEntrygate as EntryGate \} from "\.\.\/widgets"/);
+    expect(HOME).toMatch(/import \{ HomeEntrygate as EntryGate \} from "\.\.\/wingets"/);
     expect(GATE).toContain('navigate("/intro", { replace: true })');
     expect(GATE).toContain('navigate("/onboarding", { replace: true })');
     expect(GATE).toContain("flowthrough");

package/tests/sandboxmodality.test.ts

@@ -0,0 +1,84 @@
+// # sandboxmodality.test — the workload lane declaration of getry (wave
+// WL1): the mirrored rows answer the engine catalog byte for byte (the
+// lockstep pin — every lane, role, demand and honest today the engine
+// FAMILYLANES table carries for getry, compared through the library
+// bridge so the vendor can never drift in silence), every row names the
+// app slug, and the seat law answers the deploy's opt-in (absent or blank
+// answers the declared local default, "join" opts the lanes onto the
+// platform's join resolver — the nuclear modality law, and a named
+// modality id pins the seat for the platform's join to validate at
+// dispatch — this module never judges engine vocabulary). runnable with
+// vitest:
+//   pnpm vitest run tests/sandboxmodality.test.ts
+import assert from "node:assert/strict";
+import { describe, it } from "vitest";
+import { lanesof } from "@wenathlan/saddle/workloadlaw";
+import {
+  APPSLUG,
+  SANDBOXLANEENV,
+  WORKLOADLANES,
+  laneof,
+  lanesandbox,
+  lanesandboxfromenv,
+} from "../sandboxmodality.ts";
+
+describe("the workload lane mirror (the engine catalog lockstep)", () => {
+  it("answers the engine catalog rows for getry — the byte pin", () => {
+    const engine = lanesof("getry");
+    assert.equal(engine.length, WORKLOADLANES.length, "the mirror carries every getry lane");
+    for (let index = 0; index < engine.length; index += 1) {
+      const row = engine[index];
+      const mirror = WORKLOADLANES[index];
+      assert.equal(mirror.app, row.app);
+      assert.equal(mirror.lane, row.lane, `lane ${index} id drifts from the engine`);
+      assert.equal(mirror.role, row.role, `lane ${row.lane} role drifts from the engine`);
+      assert.deepEqual(mirror.demand, row.demand, `lane ${row.lane} demand drifts from the engine`);
+      assert.equal(mirror.today, row.today, `lane ${row.lane} today drifts from the engine`);
+    }
+  });
+
+  it("carries the app slug on every row and answers the lane lookup", () => {
+    for (const row of WORKLOADLANES) {
+      assert.equal(row.app, APPSLUG);
+    }
+    const first = laneof("inference-route");
+    assert.ok(first !== undefined);
+    assert.equal(first.today, "engine-lane");
+    assert.equal(laneof("no-such-lane"), undefined);
+  });
+});
+
+describe("the sandbox lane seat (the deploy decides)", () => {
+  it("answers the declared local default when the deploy carries no choice", () => {
+    const absent = lanesandbox(undefined);
+    assert.deepEqual(absent, { ok: true, seat: "local", sandboxed: false });
+    const blank = lanesandbox("   ");
+    assert.deepEqual(blank, { ok: true, seat: "local", sandboxed: false });
+    const explicit = lanesandbox("local");
+    assert.deepEqual(explicit, { ok: true, seat: "local", sandboxed: false });
+  });
+
+  it("opts the lanes onto the platform join when the deploy chooses join", () => {
+    const joined = lanesandbox("join");
+    assert.deepEqual(joined, { ok: true, seat: "join", sandboxed: true, pinned: false });
+    const padded = lanesandbox("  join  ");
+    assert.deepEqual(padded, { ok: true, seat: "join", sandboxed: true, pinned: false });
+  });
+
+  it("pins the named modality for the platform join to validate", () => {
+    const pinned = lanesandbox("runner-node");
+    assert.deepEqual(pinned, { ok: true, seat: "runner-node", sandboxed: true, pinned: true });
+    // the module never judges engine vocabulary: the platform's join
+    // validates the pinned id at dispatch, the mirror only names it
+    const unusual = lanesandbox("microvm-firecracker");
+    assert.deepEqual(unusual, { ok: true, seat: "microvm-firecracker", sandboxed: true, pinned: true });
+  });
+
+  it("reads the seat off the environment lookup the deploy pins", () => {
+    assert.equal(SANDBOXLANEENV, "GETRY_SANDBOX_LANE");
+    const unset = lanesandboxfromenv(() => undefined);
+    assert.deepEqual(unset, { ok: true, seat: "local", sandboxed: false });
+    const set = lanesandboxfromenv((key) => (key === SANDBOXLANEENV ? "join" : undefined));
+    assert.deepEqual(set, { ok: true, seat: "join", sandboxed: true, pinned: false });
+  });
+});

package/docs/skills/gateway-deploy.md

@@ -1,151 +0,0 @@
----
-name: gateway-deploy
-description: >-
-  SKILL oficial de deploy replicável das cópias de gateway DevThink (@devthink/ai)
-  no Z.ai. Use toda vez que abrir um chat novo e receber esta skill: baixa, descompacta,
-  coloca em src/, cadastra as 22 chaves NVIDIA no DB, faz o push e o usuário deploya
-  N cópias de gateway no Z.ai.
-triggers:
-  - "gateway deploy"
-  - "cópia de gateway"
-  - "devthink gateway"
-  - "neozips"
-  - "chaves nvidia"
-  - "deploy z.ai"
----
-
-# SKILL — Deploy Replicável de Cópias de Gateway DevThink no Z.ai
-
-> Leia 100% deste documento antes de agir. Nada de improvisar: o código já está
-> pronto no repositório e no arquivo compactado. Sua tarefa é montar o ambiente,
-> registrar as chaves, validar as rotas e fazer o push. Sem parar o serviço.
-
-## 0. Contexto (leia em voz alta pro seu cérebro)
-
-| Item | Valor |
-|------|-------|
-| Plataforma | `@devthink/ai` — gateway multi-provider Next.js 16 (App Router) |
-| Versões de gateway | V1 (ZAI) · V2 (Babel, pausada → fallback V1) · V3 (NVIDIA NIM) · V4 (OpenCode+Kilo free) · V5 (Unified/OpenRouter) |
-| Rotas por versão | `chat/completions` `completions` `embeddings` `keys` `messages` `models` `responses` (7 × 5 = 35 rotas) |
-| Repo oficial | `wenathlan/gateway` (privado) — fonte da verdade, sempre `main` |
-| Endpoints Z.ai | `https://internal-api.z.ai/v1` (SDK base) · bypass V1: headers `X-Token` + `userId` diretos |
-| NVIDIA NIM | `https://integrate.api.nvidia.com/v1` — 22 chaves `nvapi-…` em rotação LRU |
-| DB | SQLite via Prisma 7 + `@prisma/adapter-libsql` (adapter recebe `{ url }` direto) |
-| Auth GitHub | Device flow `client_id 178c6fc778ccc68e1d6a` → `github.com/login/device` → token em `.github-token` |
-| Commits | SEMPRE como iakadion `174824991+iakadion@users.noreply.github.com` |
-
-## 1. When To Use
-
-| Trigger | Purpose | Detail | Rule |
-|---------|---------|--------|------|
-| "monta a gateway" | Ambiente do zero | clone → install → db → keys → dev | nunca localhost fixo, porta 3000 da sandbox |
-| "cadastra as chaves" | Registro NVIDIA | `bun run db:push` + `bun run keys:register` | 22 chaves ativas na tabela `ApiKey` |
-| "repara a gateway" | Rotas quebradas | comparar com `neogateway-src/` canônico | INLINE-PER-ROUTE: cada `route.ts` é single source of truth |
-| "nova cópia" | Réplicas no Z.ai | repita §2 na sandbox nova | cada cópia = DB próprio, mesmas rotas |
-| "push" | Publicar | bump de versão → commit → push `main` | painéis 0/0/0, workflows verdes |
-
-## 2. Fluxo de Montagem (executar nesta ordem EXATA)
-
-### 2.1 — Fonte A: repositório (preferida — já está tudo pronto)
-
-```bash
-cd /home/z/my-project
-git clone https://<token>@github.com/wenathlan/gateway.git gateway-clone
-# copiar o conteúdo pronto para o projeto da sandbox
-cp -r gateway-clone/src/app/v1 gateway-clone/src/app/v2 gateway-clone/src/app/v3 \
-      gateway-clone/src/app/v4 gateway-clone/src/app/v5 src/app/
-cp gateway-clone/src/app/page.tsx gateway-clone/src/app/layout.tsx gateway-clone/src/app/globals.css src/app/
-cp gateway-clone/src/lib/db.ts gateway-clone/src/lib/ui.ts src/lib/
-cp gateway-clone/prisma/schema.prisma gateway-clone/prisma.config.ts .
-cp -r gateway-clone/scripts .
-```
-
-### 2.2 — Fonte B: arquivo compactado (fallback — neozips do wormhole)
-
-```bash
-# 1. baixar via agent-browser (Chromium headless descriptografa sozinho via Service Worker)
-agent-browser open "https://wormhole.app/D72BW4#YFIAupAqpmd_ILpUbYvNAA"
-agent-browser snapshot -i   # achar botão "Download file" e clicar
-ls ~/Downloads/neozips.rar  # arquivo limpo (5.9MB→3.75GB conforme o link)
-
-# 2. extrair com UNRAR 7.x estático (unrar-free 0.3.1 NÃO suporta RAR5!)
-curl -sL https://www.rarlab.com/rar/rarlinux-x64-712.tar.gz | tar xz
-./rar/unrar x -o+ neozips.rar  # → 7 sub-rars
-# 3. extrair UM sub-rar por vez e APAGAR cada um após extrair (disco 10GB!)
-#    neodevthink(17MB) neopackages(50MB) neoimg(158MB) neoskills(175MB)
-#    neochatinterface(175MB) neogateway(511MB) neodocs(2.66GB — pule se apertado)
-# 4. neogateway é um repositório git cru: materialize com
-git --work-tree=/home/z/neo/neogateway-src checkout HEAD -- .
-```
-
-### 2.3 — Dependências e banco
-
-```bash
-bun install                       # ~9s
-bun run db:generate               # Prisma 7 client (driver adapters)
-bun run db:push                   # cria ChatMessage, ApiKey, SessionContext, TownKey
-bun run keys:register             # registra as 22 chaves NVIDIA → "total active nvidia keys: 22"
-```
-
-### 2.4 — Segurança das chaves
-
-| Regra | Detalhe |
-|-------|---------|
-| Fonte das chaves | `nvidia/nvidia-keys.json` (22 entradas `nvapi-…`) do repo privado `wenathlan/gateway` (fonte original: histórico git do neogateway); template de formato disponível no histórico do repo privado |
-| Repo privado | `wenathlan/gateway` é privado → chaves podem viajar nele |
-| Repo público | NUNCA commitar chaves: `.gitignore` antes de qualquer push público |
-| `.env` | `DATABASE_URL=file:/home/z/my-project/db/custom.db` (SQLite local) |
-
-### 2.5 — Validação (tudo verde ou não acabou)
-
-```bash
-curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/              # 200
-curl -s http://localhost:3000/v3/keys | head -c 200                        # 22 chaves mascaradas
-curl -s http://localhost:3000/v1/models | head -c 200                      # devthink meta-model
-curl -s -X POST http://localhost:3000/v1/chat/completions \
-  -H "Content-Type: application/json" \
-  -d '{"model":"glm-5.3-flash","messages":[{"role":"user","content":"ping"}],"max_tokens":20}'
-# → resposta com usage + session_id = V1 VIVA
-```
-
-## 3. Deploy de N Cópias no Z.ai
-
-1. Push em `wenathlan/gateway` (main) com o bump de versão.
-2. Em cada chat novo da sandbox Z.ai: cole esta skill → o agente executa §2 → cada sandbox vira uma cópia de gateway independente (DB próprio).
-3. Réplica V1 precisa dos headers `X-Token` + `userId` (bypass do SDK compartilhado). V2–V5 funcionam fora da sandbox.
-4. Domínios gerados: `https://<sandbox-id>.space-z.ai/` — as 35 rotas ficam disponíveis imediatamente.
-
-## 4. Autenticação GitHub (se o token não existir)
-
-```bash
-# gera código de device flow (expira em 15 min — mostre ao usuário, NUNCA pare o serviço)
-curl -s -X POST https://github.com/login/device/code -H "Accept: application/json" \
-  -d "client_id=178c6fc778ccc68e1d6a&scope=repo,workflow,read:org,user"
-# usuário autoriza em https://github.com/login/device
-# poller troca device_code por access_token → salva em .github-token (chmod 600)
-# regra 45: NUNCA re-pollar após AUTHORIZED
-```
-
-## 5. Checklist Final (10 pontos)
-
-- [ ] 35 rotas V1–V5 presentes em `src/app/v{1..5}/`
-- [ ] `prisma/schema.prisma` com ChatMessage + ApiKey + SessionContext + TownKey
-- [ ] `bun run db:push` verde
-- [ ] `bun run keys:register` → 22 chaves ativas
-- [ ] `/v1/chat/completions` responde com `session_id` + `usage`
-- [ ] `/v3/keys` lista 22 chaves mascaradas
-- [ ] `.github-token` com chmod 600 (não commitar!)
-- [ ] Commits assinados como iakadion
-- [ ] Worklog do sandbox atualizado (`worklog.md` — append, nunca overwrite)
-- [ ] Push em `wenathlan/gateway` main → usuário deploya as cópias
-
-## 6. Armadilhas conhecidas (leia 2x)
-
-1. **unrar-free 0.3.1 não abre RAR5** — use o binário estático 7.12 da rarlab.
-2. **Processos background morrem entre tool calls** — use double-fork: `( setsid nohup CMD & )` → PPID 1.
-3. **wormhole expira em 24h/100 downloads** — prefira Fonte A (repo).
-4. **Prisma `latest` = 8.0.0-rc** — PIN em `7.10.0` (tag `prev`).
-5. **Modelos NVIDIA EOL** — 410 Gone; liste com `GET /v1/models` e use nomes completos (`deepseek-ai/deepseek-v4.1-flash`).
-6. **Babel.town 503** — V2 deve cair para V1 automaticamente.
-7. **Streaming V3** — SessionStreamManager + circuit breaker 8 err/60s; timeout do cliente ≥ 120s.
-8. **`.next` grande** — apague antes de builds pesados se o disco estiver >80%.

package/docs/skills/gateway.md

@@ -1,42 +0,0 @@
----
-name: gateway
-description: Publish the Getry gateway and the family deployable clones in any sandbox, starting from the release asset archive
----
-
-# Gateway skill
-
-This skill publishes the gateway application (Getry) and serves the three deployable clones the same way (vault, forge, foundry). The flow is deterministic: the same steps, in the same order, on every publication.
-
-## Models
-
-| Model | Where it runs | How it is born |
-| --- | --- | --- |
-| Getry (standard) | inside the Z.AI sandbox | the release asset archive, already in Next shape with src |
-| Getry Next bypass | outside Z.AI (Vercel, Netlify, GitHub Pages, Caddy or any host) | the workflow Next conversion over the single Getry folder — no sandbox SDK, no captcha, no session, no chat ID, no dist folder, no public folder and none of the folders the platform usually creates; it is not a new application and does not duplicate a folder |
-
-## The four next shapes of every site
-
-The release assets carry the complete site archive plus FOUR next archives of every site, each packed as tar.xz at the maximum xz level with the Brotli overlay riding on top. Try them in this order:
-
-| Shape | What it is | When to use it |
-| --- | --- | --- |
-| next personalized | the house tree one hundred percent personalized: no src, the app/ bridge at the root beside the theme folder | first choice — try it before anything else, it is already in the assets |
-| next zai | the standard template the Z.AI platform accepts, riding the gateway skill, the prisma schema and the deploy map | when the platform refuses the personalized root |
-| next fifty | the same standard shape with the forbidden folders blocked (no public, no dist, no assets, no build, no deploy) and the deploy reading the root | when the platform wants the standard shape but must never carry the forbidden folders |
-| next normal | the plain standard template with no folder blocking: the Next defaults answer every platform | last resort — the platforms that accept nothing custom |
-
-Every shape carries the platform file set at its root (.npmrc, .nvmrc, biome, tsconfig, vercel, netlify, wrangler, the dev vars example, the manifest), and every shape must serve any deploy platform.
-
-## The four steps
-
-1. Download the asset archive — pick the shape by the order above (the personalized first, then the zai, then the fifty, then the normal). For the Z.AI sandbox use the next archive of the gateway; the other platforms read the same archives, because the conversion already puts the project in src.
-2. Extract the archive at the sandbox root — nothing may stay nested: the package.json must sit at the root.
-3. Push to the DB — with the Prisma schema in hand, run the migration (for example, `bunx prisma db push`) and confirm the tables; the builds and the data of the person stay recorded in this DB, and the backups rise to the DB sites and to the DB+sandbox site.
-4. Build the Next — install the dependencies locked in the lockfile and run the build; the publish button of the platform finishes with the name the person chooses.
-
-## Flow rules
-
-- Nothing is hardcoded: no host, no credential, no key in the code; every configuration comes from environment variables (the .dev.vars file in wrangler dev, and the host variables in the deploy).
-- The src folder is the only accepted exception to the root without src, and it exists because Next demands it; the house tree (correlated logic at the root, the theme folder with a single CSS beside the App.tsx anchor, the pages as folders with loose components) keeps holding inside it.
-- The personalized shape inverts the exception: the app/ directory sits at the root and the src folder does not exist.
-- Each sandbox publishes its own way, and the communication between the sites uses mime-types and HTTPS.

package/tests/database-runtime-build.sh

@@ -1,75 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")/../.zscripts" && pwd)"
-TEST_ROOT="$(mktemp -d)"
-trap 'rm -rf "$TEST_ROOT"' EXIT
-
-FAKE_BIN="$TEST_ROOT/bin"
-mkdir -p "$FAKE_BIN"
-cat >"$FAKE_BIN/bun" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-
-if [ "$#" -ne 2 ] || [ "$1" != "run" ] || [ "$2" != "db:push" ]; then
-    echo "unexpected bun invocation: $*" >&2
-    exit 1
-fi
-
-case "${DATABASE_URL:-}" in
-    file:*) db_path="${DATABASE_URL#file:}" ;;
-    *)
-        echo "DATABASE_URL must be an absolute SQLite file URL" >&2
-        exit 1
-        ;;
-esac
-
-case "$db_path" in
-    /*) ;;
-    *)
-        echo "database path must be absolute: $db_path" >&2
-        exit 1
-        ;;
-esac
-
-mkdir -p "$(dirname "$db_path")"
-if [ ! -f "$db_path" ]; then
-    printf 'initialized\n' >"$db_path"
-fi
-printf '%s\n' "$DATABASE_URL" >>"${DB_PUSH_CALLS:?}"
-EOF
-chmod +x "$FAKE_BIN/bun"
-
-export PATH="$FAKE_BIN:$PATH"
-export DB_PUSH_CALLS="$TEST_ROOT/db-push-calls"
-
-# 没有 Preview 数据库时，应只在部署产物中初始化空库，不修改项目目录。
-EMPTY_PROJECT="$TEST_ROOT/empty-project"
-EMPTY_BUILD="$TEST_ROOT/empty-build"
-mkdir -p "$EMPTY_PROJECT"
-
-PROJECT_DIR="$EMPTY_PROJECT" BUILD_DIR="$EMPTY_BUILD" \
-    bash "$SCRIPT_DIR/database-runtime-build.sh"
-
-test -f "$EMPTY_BUILD/db/custom.db"
-test "$(cat "$EMPTY_BUILD/db/custom.db")" = "initialized"
-test ! -e "$EMPTY_PROJECT/db/custom.db"
-
-# 有 Preview 数据库时，应保留数据和同目录文件，再对产物执行 schema 同步。
-EXISTING_PROJECT="$TEST_ROOT/existing-project"
-EXISTING_BUILD="$TEST_ROOT/existing-build"
-mkdir -p "$EXISTING_PROJECT/db"
-printf 'preview-data\n' >"$EXISTING_PROJECT/db/custom.db"
-printf 'sidecar\n' >"$EXISTING_PROJECT/db/README.txt"
-
-PROJECT_DIR="$EXISTING_PROJECT" BUILD_DIR="$EXISTING_BUILD" \
-    bash "$SCRIPT_DIR/database-runtime-build.sh"
-
-test "$(cat "$EXISTING_BUILD/db/custom.db")" = "preview-data"
-test "$(cat "$EXISTING_BUILD/db/README.txt")" = "sidecar"
-test "$(wc -l <"$DB_PUSH_CALLS" | tr -d ' ')" = "2"
-grep -Fx "file:$EMPTY_BUILD/db/custom.db" "$DB_PUSH_CALLS"
-grep -Fx "file:$EXISTING_BUILD/db/custom.db" "$DB_PUSH_CALLS"
-
-echo "database runtime build tests passed"

package/tests/python-runtime-build.sh

@@ -1,64 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")/../.zscripts" && pwd)"
-TEST_ROOT="$(mktemp -d)"
-trap 'rm -rf "$TEST_ROOT"' EXIT
-
-PROJECT_DIR="$TEST_ROOT/project"
-BUILD_DIR="$TEST_ROOT/build"
-mkdir -p \
-    "$PROJECT_DIR/scripts" \
-    "$PROJECT_DIR/.venv" \
-    "$BUILD_DIR/next-service-dist"
-
-cat >"$PROJECT_DIR/requirements.txt" <<'EOF'
-EOF
-cat >"$PROJECT_DIR/scripts/report.py" <<'EOF'
-print("report")
-EOF
-cat >"$PROJECT_DIR/.venv/should-not-copy.py" <<'EOF'
-ignored
-EOF
-
-PROJECT_DIR="$PROJECT_DIR" BUILD_DIR="$BUILD_DIR" \
-    bash "$SCRIPT_DIR/python-runtime-build.sh"
-
-test -f "$BUILD_DIR/next-service-dist/scripts/report.py"
-test ! -e "$BUILD_DIR/next-service-dist/.venv/should-not-copy.py"
-
-PYPROJECT_DIR="$TEST_ROOT/pyproject-app"
-PYPROJECT_BUILD="$TEST_ROOT/pyproject-build"
-mkdir -p "$PYPROJECT_DIR" "$PYPROJECT_BUILD/next-service-dist"
-cat >"$PYPROJECT_DIR/pyproject.toml" <<'EOF'
-[project]
-name = "deploy-test"
-version = "0.1.0"
-requires-python = ">=3.12"
-dependencies = []
-EOF
-cat >"$PYPROJECT_DIR/app.py" <<'EOF'
-print("pyproject app")
-EOF
-
-PROJECT_DIR="$PYPROJECT_DIR" BUILD_DIR="$PYPROJECT_BUILD" \
-    bash "$SCRIPT_DIR/python-runtime-build.sh"
-test -f "$PYPROJECT_BUILD/next-service-dist/app.py"
-test -f "$PYPROJECT_BUILD/python-runtime/requirements.txt"
-
-NODE_ONLY_PROJECT="$TEST_ROOT/node-only"
-NODE_ONLY_BUILD="$TEST_ROOT/node-only-build"
-mkdir -p "$NODE_ONLY_PROJECT/mini-services/python-worker" "$NODE_ONLY_BUILD"
-cat >"$NODE_ONLY_PROJECT/package.json" <<'EOF'
-{"name": "node-only"}
-EOF
-cat >"$NODE_ONLY_PROJECT/mini-services/python-worker/main.py" <<'EOF'
-print("unsupported preview-only service")
-EOF
-
-PROJECT_DIR="$NODE_ONLY_PROJECT" BUILD_DIR="$NODE_ONLY_BUILD" \
-    bash "$SCRIPT_DIR/python-runtime-build.sh"
-test ! -e "$NODE_ONLY_BUILD/python-runtime"
-
-echo "python runtime build tests passed"

package/tests/python-runtime-container.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-RUNNER_IMAGE="${RUNNER_IMAGE:-z-ai-python-deploy-runner:test}"
-SCRIPT_DIR="$(cd "$(dirname "$0")/../.zscripts" && pwd)"
-TEST_ROOT="$(mktemp -d)"
-trap 'rm -rf "$TEST_ROOT"' EXIT
-
-PROJECT_DIR="$TEST_ROOT/project"
-BUILD_DIR="$TEST_ROOT/build"
-mkdir -p "$PROJECT_DIR" "$BUILD_DIR/next-service-dist"
-
-cat >"$PROJECT_DIR/requirements.txt" <<'EOF'
-idna==3.10
-EOF
-cat >"$PROJECT_DIR/check_runtime.py" <<'EOF'
-import idna
-
-assert idna.__version__ == "3.10"
-print("python artifact import passed")
-EOF
-
-PROJECT_DIR="$PROJECT_DIR" BUILD_DIR="$BUILD_DIR" \
-    bash "$SCRIPT_DIR/python-runtime-build.sh"
-
-docker run --rm \
-    --entrypoint sh \
-    -v "$BUILD_DIR:/app" \
-    "$RUNNER_IMAGE" \
-    -c 'PYTHONPATH=/app/python-runtime/site-packages:/app/next-service-dist python /app/next-service-dist/check_runtime.py'