create-kumiko-app 0.349.0 → 0.351.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.349.0",
+  "version": "0.351.0",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,10 +27,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.349.0",
-    "@cosmicdrift/kumiko-framework": "0.349.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.349.0",
-    "@cosmicdrift/kumiko-testing": "0.349.0",
+    "@cosmicdrift/kumiko-dev-server": "0.351.0",
+    "@cosmicdrift/kumiko-framework": "0.351.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.351.0",
+    "@cosmicdrift/kumiko-testing": "0.351.0",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },
@@ -43,6 +43,8 @@
     "src",
     "feature-manifest.json",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "!bin/__tests__/**",
+    "!src/**/__tests__/**"
   ]
 }

package/src/index.ts

@@ -15,6 +15,8 @@ import { FEATURE_CONSTRUCTORS } from "./feature-constructors";
 import { loadManifest, type Manifest } from "./manifest";
 import { buildChoices, runPicker } from "./picker";
 
+const USAGE = "Usage: bun create kumiko-app <name> [--yes] [--print-manifest] [-h | --help]";
+
 export type CliArgs = {
   /** App name (kebab-case). Required for `scaffold` mode. */
   readonly name?: string;
@@ -22,6 +24,8 @@ export type CliArgs = {
   readonly printManifest?: boolean;
   /** Skip the interactive picker, take every `recommended:true` feature. */
   readonly yes?: boolean;
+  /** Print usage and exit 0 without scaffolding. */
+  readonly help?: boolean;
   /** Override cwd for scaffoldApp (mostly for the smoke test). */
   readonly cwd?: string;
   /** Override stdout sink (default: console.log). */
@@ -30,6 +34,10 @@ export type CliArgs = {
 
 export async function runCreate(args: CliArgs): Promise<number> {
   const log = args.log ?? ((line) => console.log(line));
+  if (args.help) {
+    log(USAGE);
+    return 0;
+  }
   const manifest = loadManifest();
 
   if (args.printManifest) {
@@ -38,7 +46,7 @@ export async function runCreate(args: CliArgs): Promise<number> {
   }
 
   if (!args.name) {
-    log("Usage: bun create kumiko-app <name> [--yes] [--print-manifest]");
+    log(USAGE);
     return 1;
   }
 
@@ -99,6 +107,7 @@ export function parseArgv(argv: readonly string[]): CliArgs {
   for (const arg of argv) {
     if (arg === "--print-manifest") out.printManifest = true;
     else if (arg === "--yes" || arg === "-y") out.yes = true;
+    else if (arg === "--help" || arg === "-h") out.help = true;
     else if (!arg.startsWith("-") && out.name === undefined) out.name = arg;
   }
   return out;

package/src/__tests__/cli.test.ts

@@ -1,114 +0,0 @@
-// CLI smoke: `bun create kumiko-app demo --yes` scaffolds an app whose
-// run-config.ts imports the recommended features. Full boot is out of
-// scope here (needs DB/Redis) — the gate is "scaffold succeeds, files
-// look right".
-
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { parseArgv, runCreate } from "../index";
-
-describe("create-kumiko-app CLI", () => {
-  let tmp: string;
-  let logs: string[];
-  beforeEach(() => {
-    tmp = mkdtempSync(join(tmpdir(), "create-kumiko-app-"));
-    logs = [];
-  });
-  afterEach(() => rmSync(tmp, { recursive: true, force: true }));
-
-  test("--yes scaffolds the recommended stack", async () => {
-    const startedAt = performance.now();
-    const code = await runCreate({
-      name: "demo-app",
-      yes: true,
-      cwd: tmp,
-      log: (line) => logs.push(line),
-    });
-    const scaffoldMs = performance.now() - startedAt;
-    expect(code).toBe(0);
-    // Onboarding regression gate: the scaffold step is the first thing a new
-    // user waits on. Generous ceiling so slow CI runners pass — what we catch
-    // is an order-of-magnitude blowup, not seconds. Needs an explicit test
-    // timeout above the 30s ceiling: bun's default (5s) would fail a slow-
-    // but-fine CI run on its own timeout before this assertion ever gets to
-    // fire, making the "ceiling" the opposite of what the comment claims.
-    expect(scaffoldMs, `scaffold took ${Math.round(scaffoldMs)}ms (ceiling 30s)`).toBeLessThan(
-      30_000,
-    );
-
-    const dest = join(tmp, "demo-app");
-    expect(existsSync(dest)).toBe(true);
-    expect(existsSync(join(dest, "package.json"))).toBe(true);
-    expect(existsSync(join(dest, "bin/main.ts"))).toBe(true);
-    expect(existsSync(join(dest, "playwright.config.ts"))).toBe(true);
-    expect(existsSync(join(dest, "e2e/smoke.spec.ts"))).toBe(true);
-    const pkg = JSON.parse(readFileSync(join(dest, "package.json"), "utf-8")) as {
-      devDependencies: Record<string, string>;
-    };
-    expect(pkg.devDependencies["@cosmicdrift/kumiko-testing"]).toMatch(/^\^\d+\.\d+\.\d+/);
-
-    const cfg = readFileSync(join(dest, "src/run-config.ts"), "utf-8");
-    // Picker-MVP recommended features land in run-config — except the four
-    // composeFeatures({ includeBundled: true }) auto-mounts (config, user,
-    // tenant, auth-email-password), which scaffold-app filters out so they
-    // don't trigger dedupe-warn spam on every dev boot.
-    expect(cfg).not.toContain("createAuthEmailPasswordFeature");
-    expect(cfg).not.toContain("createUserFeature");
-    expect(cfg).not.toContain("createTenantFeature");
-    expect(cfg).not.toContain("createConfigFeature");
-    expect(cfg).toContain("createDeliveryFeature");
-    // mail-transport-smtp is opt-in (not recommended, no transitive require) — should NOT auto-mount.
-    expect(cfg).not.toContain("mailTransportSmtpFeature");
-    // issue-1174: user-profile (recommended) requires user-data-rights
-    // transitively, which trips the GDPR boot-validator unless
-    // user-data-rights-defaults (the PII export/delete hooks for `user`)
-    // is auto-included too.
-    expect(cfg).toContain("createUserDataRightsDefaultsFeature");
-
-    // UX-polish: Next-steps points at `bun dev` (the primary dev path since
-    // PR #583 introduced bin/dev.ts), not the CI-only `bun run boot` smoke.
-    const out = logs.join("\n");
-    expect(out).toContain("bun dev");
-    expect(out).toContain("docker compose up -d");
-    expect(out).not.toContain("bun run boot");
-
-    // Setup-impact preview lands before the scaffold actually runs.
-    expect(out).toMatch(/→ Scaffolding \d+ features? into \.\/demo-app\//);
-  }, 35_000);
-
-  test("--print-manifest emits JSON, no name needed", async () => {
-    const code = await runCreate({
-      printManifest: true,
-      log: (line) => logs.push(line),
-    });
-    expect(code).toBe(0);
-    const json = JSON.parse(logs.join(""));
-    expect(Array.isArray(json)).toBe(true);
-    expect(json.length).toBeGreaterThan(0);
-  });
-
-  test("missing name prints usage + exits 1", async () => {
-    const code = await runCreate({ log: (line) => logs.push(line) });
-    expect(code).toBe(1);
-    expect(logs.join("\n")).toContain("Usage:");
-  });
-});
-
-describe("parseArgv", () => {
-  test("first positional is the app name", () => {
-    expect(parseArgv(["my-app"]).name).toBe("my-app");
-  });
-
-  test("--yes / -y flips yes flag", () => {
-    expect(parseArgv(["--yes"]).yes).toBe(true);
-    expect(parseArgv(["-y"]).yes).toBe(true);
-  });
-
-  test("--print-manifest works alone (no name)", () => {
-    const args = parseArgv(["--print-manifest"]);
-    expect(args.printManifest).toBe(true);
-    expect(args.name).toBeUndefined();
-  });
-});

package/src/__tests__/dep-resolver.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { resolveDeps } from "../dep-resolver";
-import type { Manifest } from "../manifest";
-
-const MANIFEST: Manifest = {
-  source: "test",
-  featureCount: 5,
-  features: [
-    {
-      name: "auth-email-password",
-      description: null,
-      requires: ["user", "tenant"],
-      optionalRequires: [],
-    },
-    { name: "user", description: null, requires: [], optionalRequires: [] },
-    { name: "tenant", description: null, requires: ["config"], optionalRequires: [] },
-    { name: "config", description: null, requires: [], optionalRequires: [] },
-    { name: "billing", description: null, requires: ["tenant"], optionalRequires: [] },
-  ],
-};
-
-describe("resolveDeps", () => {
-  test("transitive requires close (auth → user + tenant + config)", () => {
-    const result = resolveDeps(["auth-email-password"], MANIFEST);
-    expect(new Set(result.featureNames)).toEqual(
-      new Set(["auth-email-password", "user", "tenant", "config"]),
-    );
-    expect(new Set(result.autoAdded)).toEqual(new Set(["user", "tenant", "config"]));
-  });
-
-  test("dedupes overlapping deps", () => {
-    const result = resolveDeps(["auth-email-password", "billing"], MANIFEST);
-    expect(result.featureNames.length).toBe(new Set(result.featureNames).size);
-    expect(new Set(result.featureNames)).toContain("tenant");
-  });
-
-  test("explicit selection NOT counted as autoAdded", () => {
-    const result = resolveDeps(["user", "auth-email-password"], MANIFEST);
-    expect(result.autoAdded).not.toContain("user");
-    expect(result.autoAdded).toContain("tenant");
-  });
-
-  test("unknown feature throws (manifest bug)", () => {
-    expect(() => resolveDeps(["does-not-exist"], MANIFEST)).toThrow(/not in manifest/);
-  });
-});

package/src/__tests__/feature-constructors.test.ts

@@ -1,54 +0,0 @@
-// Guards against #1425/1: callExpression (rendered into generated
-// run-config.ts) and callArgs (used at runtime by instantiateScaffoldFeatures)
-// encode the same call twice by hand. If someone edits one without the
-// other, the boot test validates a different feature config than what
-// actually gets scaffolded. This derives the expected callExpression from
-// exportName + callArgs for every entry and diffs it against the literal.
-
-import { describe, expect, test } from "bun:test";
-import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
-
-// Renders a value as hand-written TS source (unquoted object keys, quoted
-// string values) instead of JSON — JSON.stringify(1) and JSON.stringify("1")
-// both survive a whitespace+quote-strip compare as "1", which would hide a
-// string/number divergence between callExpression and callArgs. Rendering
-// like this and normalizing whitespace only keeps that divergence visible.
-function renderTsLiteral(value: unknown): string {
-  if (Array.isArray(value)) return `[${value.map(renderTsLiteral).join(", ")}]`;
-  if (value !== null && typeof value === "object") {
-    const entries = Object.entries(value as Record<string, unknown>).map(
-      ([key, val]) => `${key}: ${renderTsLiteral(val)}`,
-    );
-    return `{ ${entries.join(", ")} }`;
-  }
-  return JSON.stringify(value);
-}
-
-function expectedCallExpression(exportName: string, callArgs: readonly unknown[]): string {
-  const args = callArgs.map(renderTsLiteral).join(", ");
-  return `${exportName}(${args})`;
-}
-
-describe("FEATURE_CONSTRUCTORS callExpression/callArgs consistency", () => {
-  for (const [name, entry] of Object.entries(FEATURE_CONSTRUCTORS)) {
-    test(`${name}: callExpression matches exportName + callArgs`, () => {
-      if (entry.callArgs !== undefined) {
-        // callExpression is hand-formatted TS source; compare with
-        // whitespace stripped only — NOT quotes, so a string arg ("1") vs.
-        // a number arg (1) still diverges after normalize.
-        const normalize = (s: string) => s.replace(/\s+/g, "");
-        expect(normalize(entry.callExpression)).toBe(
-          normalize(expectedCallExpression(entry.exportName, entry.callArgs)),
-        );
-        return;
-      }
-      // No callArgs: either `exportName()` (zero-arg factory) or bare
-      // `exportName` (object export) — both are legal, but the export name
-      // itself must be the prefix either way.
-      expect(
-        entry.callExpression === entry.exportName ||
-          entry.callExpression === `${entry.exportName}()`,
-      ).toBe(true);
-    });
-  }
-});

package/src/__tests__/manifest-drift.test.ts

@@ -1,32 +0,0 @@
-// Vendored manifest.json must match the source-of-truth in
-// samples/apps/use-all-bundled/feature-manifest.json. The picker reads
-// the vendored copy at runtime; a stale copy lets the picker show old
-// features or miss new ones. Refresh by running `bun run gen:manifest`
-// inside samples/apps/use-all-bundled (writes both copies at once).
-
-import { describe, expect, test } from "bun:test";
-import { readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const VENDOR = resolve(HERE, "..", "..", "feature-manifest.json");
-const SOURCE = resolve(
-  HERE,
-  "..",
-  "..",
-  "..",
-  "..",
-  "samples",
-  "apps",
-  "use-all-bundled",
-  "feature-manifest.json",
-);
-
-describe("vendored manifest", () => {
-  test("byte-identical to samples/apps/use-all-bundled/feature-manifest.json", () => {
-    const vendor = readFileSync(VENDOR, "utf-8");
-    const source = readFileSync(SOURCE, "utf-8");
-    expect(vendor).toBe(source);
-  });
-});

package/src/__tests__/picker.test.ts

@@ -1,35 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
-import { loadManifest } from "../manifest";
-import { buildChoices } from "../picker";
-
-describe("buildChoices", () => {
-  const manifest = loadManifest();
-  const choices = buildChoices(manifest);
-
-  test("only emits features that have a constructor entry", () => {
-    for (const c of choices) {
-      expect(Object.hasOwn(FEATURE_CONSTRUCTORS, c.name)).toBe(true);
-    }
-  });
-
-  test("every MVP feature is represented (no silent drops)", () => {
-    const choiceNames = new Set(choices.map((c) => c.name));
-    for (const name of Object.keys(FEATURE_CONSTRUCTORS)) {
-      expect(choiceNames.has(name)).toBe(true);
-    }
-  });
-
-  test("recommended features land checked by default", () => {
-    const recommended = choices.filter((c) => c.recommended);
-    expect(recommended.length).toBeGreaterThan(0);
-    expect(recommended.map((c) => c.name)).toContain("auth-email-password");
-  });
-
-  test("category falls back to 'other' when uiHints absent", () => {
-    for (const c of choices) {
-      expect(typeof c.category).toBe("string");
-      expect(c.category.length).toBeGreaterThan(0);
-    }
-  });
-});

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -1,281 +0,0 @@
-// issue-1174: `bun create kumiko-app <name> --yes` resolves the recommended
-// feature set through the manifest's `requires` graph (dep-resolver.ts), not
-// through hand-written app composition. That graph can pull in a feature
-// (here: user-data-rights, transitively via user-profile) whose boot-time
-// obligations (an EXT_USER_DATA hook per PII entity) no OTHER auto-included
-// feature satisfies — cli.test.ts's file-existence checks can't catch that,
-// only actually booting the resolved set through validateBoot can.
-
-import { afterAll, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { frameworkCoreEnvSchema } from "@cosmicdrift/kumiko-dev-server";
-import { requireKmsWiring, resolveKmsWiring } from "@cosmicdrift/kumiko-framework/crypto";
-import {
-  createRegistry,
-  type FeatureDefinition,
-  type TenantId,
-  validateBoot as validateBootRaw,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { composeEnvSchema } from "@cosmicdrift/kumiko-framework/env";
-import { withBootValidatorFixture } from "@cosmicdrift/kumiko-framework/testing";
-import { runProdApp } from "@cosmicdrift/kumiko-server-runtime";
-import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-import { resolveDeps } from "../dep-resolver";
-import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
-import { runCreate } from "../index";
-import { loadManifest } from "../manifest";
-import { buildChoices } from "../picker";
-
-function validateBoot(features: readonly FeatureDefinition[]): void {
-  validateBootRaw(withBootValidatorFixture(features));
-}
-
-async function instantiateResolved(names: readonly string[]): Promise<FeatureDefinition[]> {
-  const instances: FeatureDefinition[] = [];
-  for (const name of names) {
-    const entry = FEATURE_CONSTRUCTORS[name];
-    if (!entry) continue; // mirrors index.ts:47-49 — auto-mounted core deps have no entry
-    const mod = (await import(entry.importPath)) as Record<string, unknown>;
-    const exp = mod[entry.exportName];
-    if (typeof exp === "function") {
-      instances.push((exp as (...args: unknown[]) => FeatureDefinition)(...(entry.callArgs ?? [])));
-    } else {
-      instances.push(exp as FeatureDefinition);
-    }
-  }
-  return instances;
-}
-
-describe("--yes resolved set boots (issue-1174 regression)", () => {
-  const manifest = loadManifest();
-  const recommended = buildChoices(manifest)
-    .filter((c) => c.recommended)
-    .map((c) => c.name);
-  const resolved = resolveDeps(recommended, manifest);
-
-  test("resolves user-data-rights-defaults alongside the transitively-pulled user-data-rights", () => {
-    expect(resolved.featureNames).toContain("user-data-rights");
-    expect(resolved.featureNames).toContain("user-data-rights-defaults");
-  });
-
-  test("the resolved --yes feature set boots without the GDPR PII-hook-coverage error", async () => {
-    // sessions (auto-included) pulls auth-foundation; #1570 allows zero
-    // tokenVerifier when sessionStore is mounted — PAT stays opt-in (#1514).
-    expect(resolved.featureNames).not.toContain("personal-access-tokens");
-    const instances = await instantiateResolved(resolved.featureNames);
-    const composed = composeFeatures(instances, { includeBundled: true });
-    expect(() => validateBoot(composed)).not.toThrow();
-    expect(() => createRegistry(composed)).not.toThrow();
-  });
-});
-
-// kumiko-framework#2330: validateBoot/createRegistry above never reach
-// runProdApp's PII boot gate (assertPiiBootInvariants) — it's not part of
-// validateBoot, it runs a step later. The --yes set mounts PII-annotated
-// entities (user, tenant-invitation, fileRef via user-data-rights), so the
-// generated bin/main.ts must wire kms/allowPlaintextPii or the first
-// `bun run boot` throws BOOT ABORTED. This drives the SAME resolved feature
-// set through the actual runProdApp (KUMIKO_DRY_RUN_ENV=boot — no DB/Redis
-// connect) to pin both halves of the fix.
-describe("--yes resolved set through runProdApp's PII boot gate (issue-2330 regression)", () => {
-  const manifest = loadManifest();
-  const recommended = buildChoices(manifest)
-    .filter((c) => c.recommended)
-    .map((c) => c.name);
-  const resolved = resolveDeps(recommended, manifest);
-
-  const auth = {
-    admin: {
-      email: "admin@test.local",
-      password: "change-me-on-first-deploy",
-      displayName: "Admin",
-      memberships: [
-        {
-          tenantId: "93238e36-e2e5-4e2e-8be4-00004739a98c" as TenantId,
-          tenantKey: "test",
-          tenantName: "test",
-          roles: ["TenantAdmin" as const],
-        },
-      ],
-    },
-  };
-
-  async function bootWithWiring(wiring: Record<string, unknown>) {
-    const instances = await instantiateResolved(resolved.featureNames);
-    const bootFeatures = composeFeatures(instances, { includeBundled: true });
-    const envSchema = composeEnvSchema({ core: frameworkCoreEnvSchema, features: bootFeatures });
-    return runProdApp({
-      features: instances,
-      envSchema,
-      autoListen: false,
-      migrations: false,
-      auth,
-      envSource: {
-        KUMIKO_DRY_RUN_ENV: "boot",
-        JWT_SECRET: "a".repeat(32),
-        KUMIKO_SECRETS_MASTER_KEY_V1: Buffer.alloc(32, 7).toString("base64"),
-        DATABASE_URL: "postgres://dummy:dummy@127.0.0.1:1/dummy",
-        REDIS_URL: "redis://127.0.0.1:1",
-      },
-      ...wiring,
-    });
-  }
-
-  test("without kms/allowPlaintextPii wiring, boot aborts (pins the bug this issue reports)", async () => {
-    await expect(bootWithWiring({})).rejects.toThrow(
-      /BOOT ABORTED.*user.*tenant-invitation.*fileRef/s,
-    );
-  });
-
-  test("requireKmsWiring throws the required-trio error when the trio is empty", () => {
-    expect(() =>
-      requireKmsWiring(
-        {},
-        {
-          logPrefix: "[test]",
-          plaintextReason: "should-not-fallback",
-        },
-      ),
-    ).toThrow(
-      "[test] PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY are required here",
-    );
-  });
-
-  test("with resolveKmsWiring's fallback (generated bin/main.ts non-prod path), boot succeeds", async () => {
-    // Empty object, not process.env: a dev machine with the real trio set
-    // would otherwise flip this into the ActiveKmsWiring branch and the test
-    // would stop exercising the plaintext fallback it's meant to pin.
-    const kmsWiring = resolveKmsWiring(
-      {},
-      {
-        logPrefix: "[test]",
-        plaintextReason: "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set",
-      },
-    );
-    expect(kmsWiring).toHaveProperty("allowPlaintextPii");
-    const handle = await bootWithWiring(kmsWiring);
-    expect(handle).toBeDefined();
-  });
-
-  test("generated .env.example's unset trio (empty string, not absent) still resolves to the plaintext fallback", async () => {
-    // dotenv turns `PLATFORM_KEK=` into process.env.PLATFORM_KEK === "" — the
-    // actual value a user gets from `cp .env.example .env` without filling it
-    // in. resolveKmsWiring reads raw env (not the zod-validated envSchema),
-    // and Boolean("") === Boolean(undefined), so this must behave identically
-    // to the {} case above.
-    const kmsWiring = resolveKmsWiring({
-      PLATFORM_KEK: "",
-      SUBJECT_KEYS_DATABASE_URL: "",
-      KUMIKO_BLIND_INDEX_KEY: "",
-    });
-    expect(kmsWiring).toHaveProperty("allowPlaintextPii");
-    const handle = await bootWithWiring(kmsWiring);
-    expect(handle).toBeDefined();
-  });
-});
-
-// The suite above rebuilds the wiring in-process and pins that the pieces
-// are individually correct — it never imports the file scaffoldApp actually
-// writes, so a typo in bin/main.ts's import specifier or a `...kmsWiring`
-// spread landing in the wrong object literal would stay green. This drives
-// the real generated bin/main.ts as a subprocess instead. Fixtures live
-// under __tests__/.tmp-fixtures/ (gitignored, same trick as
-// dev-server/src/codegen/__tests__/watch.test.ts) so Bun's node_modules
-// walk-up from bin/main.ts still finds the repo's hoisted @cosmicdrift/*
-// symlinks — a system tmpdir sits outside the workspace and can't resolve
-// them (see walkthrough.integration.test.ts's comment on the same issue).
-describe("generated bin/main.ts actually boots (issue-2330 regression, real subprocess)", () => {
-  const FIXTURE_ROOT = join(import.meta.dir, ".tmp-fixtures");
-  const createdDirs: string[] = [];
-
-  afterAll(() => {
-    for (const d of createdDirs) {
-      try {
-        rmSync(d, { recursive: true, force: true });
-      } catch {
-        // ignore — best-effort
-      }
-    }
-  });
-
-  test("KUMIKO_DRY_RUN_ENV=boot bun bin/main.ts exits 0 against the file scaffoldApp wrote", async () => {
-    mkdirSync(FIXTURE_ROOT, { recursive: true });
-    const cwd = mkdtempSync(join(FIXTURE_ROOT, "boot-"));
-    createdDirs.push(cwd);
-
-    const exitCode = await runCreate({ name: "boot-fixture", yes: true, cwd, log: () => {} });
-    expect(exitCode).toBe(0);
-
-    const appDir = join(cwd, "boot-fixture");
-    const proc = Bun.spawn({
-      cmd: ["bun", "bin/main.ts"],
-      cwd: appDir,
-      env: {
-        ...process.env,
-        KUMIKO_DRY_RUN_ENV: "boot",
-        JWT_SECRET: "a".repeat(32),
-        KUMIKO_SECRETS_MASTER_KEY_V1: Buffer.alloc(32, 7).toString("base64"),
-        DATABASE_URL: "postgres://dummy:dummy@127.0.0.1:1/dummy",
-        REDIS_URL: "redis://127.0.0.1:1",
-        // Pinned empty, not inherited from process.env: a dev machine with
-        // the real trio set would otherwise flip resolveKmsWiring into the
-        // ActiveKmsWiring branch (and its KMS health check) instead of the
-        // plaintext fallback this test exercises.
-        PLATFORM_KEK: "",
-        SUBJECT_KEYS_DATABASE_URL: "",
-        KUMIKO_BLIND_INDEX_KEY: "",
-      },
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    const [stdout, stderr, code] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited,
-    ]);
-
-    expect(code, `stdout:\n${stdout}\nstderr:\n${stderr}`).toBe(0);
-    expect(`${stdout}${stderr}`).not.toContain("BOOT ABORTED");
-    expect(stdout).toContain("boot validation OK");
-    // The scaffold no longer warns itself; the plaintext path must still be loud via the boot gate.
-    expect(`${stdout}${stderr}`).toContain("stored in PLAINTEXT");
-  }, 30_000);
-
-  test("NODE_ENV=production with an empty KMS trio aborts the generated bin/main.ts", async () => {
-    mkdirSync(FIXTURE_ROOT, { recursive: true });
-    const cwd = mkdtempSync(join(FIXTURE_ROOT, "boot-prod-"));
-    createdDirs.push(cwd);
-
-    const exitCode = await runCreate({ name: "boot-prod-fixture", yes: true, cwd, log: () => {} });
-    expect(exitCode).toBe(0);
-
-    const proc = Bun.spawn({
-      cmd: ["bun", "bin/main.ts"],
-      cwd: join(cwd, "boot-prod-fixture"),
-      env: {
-        ...process.env,
-        NODE_ENV: "production",
-        KUMIKO_DRY_RUN_ENV: "boot",
-        JWT_SECRET: "a".repeat(32),
-        KUMIKO_SECRETS_MASTER_KEY_V1: Buffer.alloc(32, 7).toString("base64"),
-        DATABASE_URL: "postgres://dummy:dummy@127.0.0.1:1/dummy",
-        REDIS_URL: "redis://127.0.0.1:1",
-        PLATFORM_KEK: "",
-        SUBJECT_KEYS_DATABASE_URL: "",
-        KUMIKO_BLIND_INDEX_KEY: "",
-      },
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    const [stdout, stderr, code] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited,
-    ]);
-
-    expect(code, `stdout:\n${stdout}\nstderr:\n${stderr}`).not.toBe(0);
-    expect(`${stdout}${stderr}`).toContain("PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL");
-    expect(`${stdout}${stderr}`).toContain("are required here");
-  }, 30_000);
-});