cursedbelt 2.7.0 → 3.0.0

package/src/verify/promotion/nodePromotionFs.ts

@@ -1,52 +0,0 @@
-/**
- * The real filesystem behind `PromotionFileSystem`.
- *
- * Kept out of `promote.ts` so the routine itself imports nothing from `node:fs`
- * — which is what lets the whole promotion sequence, including the destructive
- * steps, run in a test against an in-memory tree.
- */
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative } from 'node:path';
-import type { PromotionFileSystem } from './promote';
-
-/** Directories never walked: they are not source, and they are enormous. */
-const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', '___gen', 'coverage']);
-
-export const nodePromotionFileSystem: PromotionFileSystem = {
-  exists: (path) => existsSync(path),
-
-  readText: (path) => (existsSync(path) ? readFileSync(path, 'utf8') : ''),
-
-  writeText: (path, text) => {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, text, 'utf8');
-  },
-
-  listFiles: (dir) => {
-    const out: string[] = [];
-    const walk = (current: string): void => {
-      for (const entry of readdirSync(current, { withFileTypes: true })) {
-        if (entry.isDirectory()) {
-          if (SKIP_DIRS.has(entry.name)) continue;
-          walk(join(current, entry.name));
-        } else if (entry.isFile()) {
-          out.push(relative(dir, join(current, entry.name)));
-        }
-      }
-    };
-    if (existsSync(dir)) walk(dir);
-    return out;
-  },
-
-  ensureDir: (path) => {
-    mkdirSync(path, { recursive: true });
-  },
-
-  removeDir: (path) => {
-    rmSync(path, { recursive: true, force: true });
-  },
-
-  remove: (path) => {
-    if (existsSync(path)) unlinkSync(path);
-  },
-};

package/src/verify/promotion/promote.spec.ts

@@ -1,177 +0,0 @@
-/**
- * Promotion (02 §3.3). The properties that matter are the refusals: a package
- * that cannot be promoted safely must be refused BEFORE anything moves, and a
- * promotion that leaves a staging reference behind must fail rather than hand
- * the next build a tree it will reject.
- */
-import { describe, expect, it } from 'bun:test';
-import {
-  planPromotion,
-  type PromotionFileSystem,
-  rewriteTokenIds,
-  runPromotion,
-  shortId,
-  type StagingPackageManifest,
-} from './promote';
-
-/** An in-memory tree — the reason `promote.ts` imports no `node:fs`. */
-const memoryFs = (files: Record<string, string>): PromotionFileSystem & { files: Record<string, string> } => {
-  const tree = { ...files };
-  const dirs = new Set<string>();
-  return {
-    files: tree,
-    exists: (path) => dirs.has(path) || Object.keys(tree).some((file) => file === path || file.startsWith(`${path}/`)),
-    readText: (path) => tree[path] ?? '',
-    writeText: (path, text) => {
-      tree[path] = text;
-    },
-    listFiles: (dir) =>
-      Object.keys(tree)
-        .filter((file) => file.startsWith(`${dir}/`))
-        .map((file) => file.slice(dir.length + 1)),
-    ensureDir: (path) => {
-      dirs.add(path);
-    },
-    removeDir: (path) => {
-      for (const file of Object.keys(tree)) if (file === path || file.startsWith(`${path}/`)) delete tree[file];
-      dirs.delete(path);
-    },
-    remove: (path) => {
-      delete tree[path];
-    },
-  };
-};
-
-const manifest: StagingPackageManifest = { id: 'plugin-habits', targetEngine: 'knowledge', featureKey: 'habits' };
-
-const stagingTree = (): Record<string, string> => ({
-  'staging/plugin-habits/index.ts': "export const token = 'x-habits:mark';\n",
-  'staging/plugin-habits/habits.token-extension.ts': "export const tokens = [{ id: 'x-habits:mark' }];\n",
-  'staging/plugin-habits/habits.schema.sql': 'CREATE TABLE x_habits_marks (id TEXT PRIMARY KEY);\n',
-  'staging/plugin-habits/README.md': 'Habits plugin\n',
-});
-
-const options = (fs: PromotionFileSystem, overrides: Record<string, unknown> = {}) => ({
-  fs,
-  manifest,
-  stagingDir: 'staging/plugin-habits',
-  destinationDir: 'packages/cursedbelt/src/engines/knowledge/habits',
-  ...overrides,
-});
-
-describe('shortId / rewriteTokenIds', () => {
-  it('strips the package prefix for the token namespace', () => {
-    expect(shortId('plugin-habits')).toBe('habits');
-  });
-
-  it('rewrites every occurrence of a renamed token', () => {
-    const out = rewriteTokenIds("a 'x-habits:mark' and 'x-habits:mark'", [
-      { from: 'x-habits:mark', to: 'knowledge:mark' },
-    ]);
-    expect(out).toBe("a 'knowledge:mark' and 'knowledge:mark'");
-  });
-});
-
-describe('planPromotion', () => {
-  it('lists the files and derives the token renames', () => {
-    const plan = planPromotion(options(memoryFs(stagingTree())));
-
-    expect(plan.files).toEqual(['README.md', 'habits.schema.sql', 'habits.token-extension.ts', 'index.ts']);
-    expect(plan.tokenRenames).toEqual([{ from: 'x-habits:mark', to: 'knowledge:mark' }]);
-  });
-
-  it('refuses a package with no targetEngine — before anything moves', () => {
-    const fs = memoryFs(stagingTree());
-    expect(() =>
-      planPromotion(options(fs, { manifest: { ...manifest, targetEngine: undefined as never } })),
-    ).toThrow(/targetEngine/);
-  });
-
-  it('refuses an invalid feature key', () => {
-    const fs = memoryFs(stagingTree());
-    expect(() => planPromotion(options(fs, { manifest: { ...manifest, featureKey: 'not a flag' } }))).toThrow(
-      /feature flag name/,
-    );
-  });
-
-  it('refuses a package that is not there', () => {
-    expect(() => planPromotion(options(memoryFs({})))).toThrow(/No staging package/);
-  });
-});
-
-describe('runPromotion', () => {
-  it('is a DRY RUN unless apply is set — one-way operations are opt-in', () => {
-    const fs = memoryFs(stagingTree());
-    const result = runPromotion(options(fs));
-
-    expect(result.applied).toBe(false);
-    expect(result.moved).toEqual([]);
-    // Nothing moved, nothing deleted.
-    expect(fs.files['staging/plugin-habits/index.ts']).toBeDefined();
-  });
-
-  it('runs the storage half FIRST, so a refusal leaves the tree untouched', () => {
-    const fs = memoryFs(stagingTree());
-    expect(() =>
-      runPromotion(
-        options(fs, {
-          apply: true,
-          migrate: () => {
-            throw new Error('a live app still holds knowledge.db');
-          },
-        }),
-      ),
-    ).toThrow(/live app/);
-
-    expect(fs.files['staging/plugin-habits/index.ts']).toBeDefined();
-    expect(fs.files['packages/cursedbelt/src/engines/knowledge/habits/index.ts']).toBeUndefined();
-  });
-
-  it('moves the files, rewrites the tokens and deletes the package', () => {
-    const fs = memoryFs(stagingTree());
-    const result = runPromotion(options(fs, { apply: true }));
-
-    expect(result.applied).toBe(true);
-    expect(fs.files['packages/cursedbelt/src/engines/knowledge/habits/index.ts']).toContain("'knowledge:mark'");
-    expect(fs.files['packages/cursedbelt/src/engines/knowledge/habits/index.ts']).not.toContain('x-habits:');
-    // A `/staging` directory that still exists is one something will import.
-    expect(fs.files['staging/plugin-habits/index.ts']).toBeUndefined();
-    expect(result.rewritten).toHaveLength(2);
-  });
-
-  it('reports the staging tables the caller dropped', () => {
-    const fs = memoryFs(stagingTree());
-    const result = runPromotion(
-      options(fs, { apply: true, dropStagingTables: () => ['x_habits_marks'] }),
-    );
-    expect(result.plan.stagingTables).toEqual(['x_habits_marks']);
-  });
-
-  it('FAILS when a staging reference survives elsewhere in the tree', () => {
-    const fs = memoryFs({
-      ...stagingTree(),
-      'apps/demo/wiring.ts': "import { habits } from '../../staging/plugin-habits';\n",
-    });
-
-    expect(() => runPromotion(options(fs, { apply: true, scanRoots: ['apps'] }))).toThrow(
-      /reference\(s\) to its staging id/,
-    );
-  });
-
-  it('passes the post-scan when the tree is clean', () => {
-    const fs = memoryFs({ ...stagingTree(), 'apps/demo/wiring.ts': "export const ok = 'knowledge:mark';\n" });
-    const result = runPromotion(options(fs, { apply: true, scanRoots: ['apps'] }));
-    expect(result.residues).toEqual([]);
-  });
-
-  it('leaves a token id belonging to ANOTHER plugin alone', () => {
-    const fs = memoryFs({
-      ...stagingTree(),
-      'staging/plugin-habits/other.ts': "export const foreign = 'x-budgets:entry';\n",
-    });
-    runPromotion(options(fs, { apply: true }));
-
-    // Renaming a neighbor's token here would break it silently; V3 owns that check.
-    expect(fs.files['packages/cursedbelt/src/engines/knowledge/habits/other.ts']).toContain('x-budgets:entry');
-  });
-});

package/src/verify/promotion/promote.ts

@@ -1,238 +0,0 @@
-/**
- * `promote` (02 §3.3, 01 §5.4) — the only path from `/staging` to production.
- *
- * `runOfflineMigration` landed in cwip and nothing called it: the dangerous half
- * of promotion (DDL against a database an app may hold open) had a correct
- * implementation and no operator surface. This is that surface, plus the four
- * mechanical steps around it.
- *
- * The ordering is not a style choice — each step exists because the previous one
- * can fail safely and the next one cannot:
- *
- *   1. **Validate.** A package with no `targetEngine`/`featureKey`, or a token
- *      outside its `x-<pluginId>:` namespace, is refused before anything moves.
- *      A half-promoted plugin is worse than an unpromoted one.
- *   2. **Migrate offline.** Pre-flight `apps.boot_pid`, migrate an isolated
- *      `VACUUM INTO` copy, verify it, swap by atomic rename. A `SQLITE_BUSY`
- *      anywhere leaves the live file byte-identical (J1-C).
- *   3. **Move source and rename tokens.** `x-<id>:*` becomes `<engine>:*` in
- *      every moved file. Old ids are recorded as deprecation aliases rather than
- *      deleted, because external consumers exist and an internal grep proves
- *      nothing.
- *   4. **Drop the staging tables and delete the package**, then re-scan. Any
- *      surviving `x-<id>:` reference or `/staging` import fails the promotion —
- *      the same rule V5 enforces at build time, applied here so a promotion
- *      cannot leave the tree in a state the next build rejects.
- *
- * Everything is a **dry run** unless `apply: true`. The plan is the output; the
- * mutation is the opt-in.
- */
-import type { EngineId } from '../../config/appConfig';
-import { AppError } from '../../server/errors';
-
-/** The file operations promotion needs. Injected so the whole routine is testable. */
-export interface PromotionFileSystem {
-  exists(path: string): boolean;
-  readText(path: string): string;
-  writeText(path: string, text: string): void;
-  /** Every file under `dir`, recursively, as paths relative to `dir`. */
-  listFiles(dir: string): string[];
-  ensureDir(path: string): void;
-  /** Remove a directory and everything under it. */
-  removeDir(path: string): void;
-  remove(path: string): void;
-}
-
-/** What a staging package declares about where it is going (02 §3.2). */
-export interface StagingPackageManifest {
-  /** `plugin-habits`. */
-  id: string;
-  targetEngine: EngineId;
-  /** The flag it becomes: `habits` → `features.habits`, default false. */
-  featureKey: string;
-}
-
-export interface TokenRename {
-  from: string;
-  to: string;
-}
-
-export interface PromotionPlan {
-  pluginId: string;
-  targetEngine: EngineId;
-  featureKey: string;
-  /** Paths relative to the staging package, in scan order. */
-  files: readonly string[];
-  /** Where those files land. */
-  destinationDir: string;
-  /** `x-habits:mark` → `knowledge:mark`, for every id the package declares. */
-  tokenRenames: readonly TokenRename[];
-  /** Staging tables dropped from `staging.db` once the DDL has been promoted. */
-  stagingTables: readonly string[];
-}
-
-export interface PromotionOptions {
-  fs: PromotionFileSystem;
-  manifest: StagingPackageManifest;
-  /** `/staging/plugin-<id>`. */
-  stagingDir: string;
-  /** The engine package directory the files move into. */
-  destinationDir: string;
-  /**
-   * Roots re-scanned after the move. A surviving `x-<id>:` reference or
-   * `/staging` import anywhere here fails the promotion (V5's rule, applied at
-   * promotion time).
-   */
-  scanRoots?: readonly string[];
-  /** Nothing is written unless this is true. */
-  apply?: boolean;
-  /**
-   * The storage half (01 §5.4): pre-flight, isolated-copy migration, atomic
-   * swap. Supplied by the caller because cwip — not cursedbelt — owns
-   * `runOfflineMigration`, and the caller owns the DB handles it needs.
-   */
-  migrate?: () => void;
-  /** Drops the plugin's tables from `staging.db` once its DDL is promoted. */
-  dropStagingTables?: () => readonly string[];
-}
-
-export interface PromotionResult {
-  plan: PromotionPlan;
-  applied: boolean;
-  /** Files actually written at the destination. */
-  moved: readonly string[];
-  /** Files whose token ids were rewritten. */
-  rewritten: readonly string[];
-  /** Residual `x-<id>:`/`/staging` references found by the post-scan. */
-  residues: readonly string[];
-}
-
-/** Token ids a staging package may declare. */
-const stagingTokenPattern = (pluginId: string): RegExp => new RegExp(`x-${escapeRegExp(shortId(pluginId))}:([a-z0-9-]+)`, 'g');
-
-const escapeRegExp = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-
-/** `plugin-habits` → `habits`. The token namespace uses the short form. */
-export const shortId = (pluginId: string): string => pluginId.replace(/^plugin-/, '');
-
-const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.sql', '.json', '.md'];
-
-const isSourceFile = (path: string): boolean => SOURCE_EXTENSIONS.some((ext) => path.endsWith(ext));
-
-/**
- * Build the plan without touching anything.
- *
- * Exported separately because "show me what promotion would do" is the question
- * an operator actually asks first, and answering it must not require trusting a
- * flag not to have been typed.
- */
-export function planPromotion(options: PromotionOptions): PromotionPlan {
-  const { fs, manifest, stagingDir } = options;
-
-  if (!manifest.targetEngine)
-    throw new AppError(`Staging package '${manifest.id}' declares no targetEngine — it cannot be promoted (02 §3.2).`, {
-      code: 'promotion-target-missing',
-      status: 400,
-      context: { pluginId: manifest.id },
-    });
-  if (!/^[a-z][a-zA-Z0-9]*$/.test(manifest.featureKey))
-    throw new AppError(
-      `Staging package '${manifest.id}' declares featureKey '${manifest.featureKey}', which is not a valid feature flag name.`,
-      { code: 'promotion-feature-key-invalid', status: 400, context: { featureKey: manifest.featureKey } },
-    );
-  if (!fs.exists(stagingDir))
-    throw new AppError(`No staging package at ${stagingDir}.`, {
-      code: 'promotion-package-missing',
-      status: 404,
-      context: { stagingDir },
-    });
-
-  const files = fs.listFiles(stagingDir).filter(isSourceFile).sort();
-
-  // Token ids are harvested from the package's own sources, so a package that
-  // declares a token it never uses still gets its alias — and one that uses an
-  // id outside its namespace is caught by V3, not silently renamed here.
-  const pattern = stagingTokenPattern(manifest.id);
-  const found = new Set<string>();
-  for (const file of files) {
-    const text = fs.readText(`${stagingDir}/${file}`);
-    for (const match of text.matchAll(pattern)) found.add(match[0]);
-  }
-
-  const tokenRenames: TokenRename[] = [...found]
-    .sort()
-    .map((from) => ({ from, to: `${manifest.targetEngine}:${from.slice(from.indexOf(':') + 1)}` }));
-
-  return {
-    pluginId: manifest.id,
-    targetEngine: manifest.targetEngine,
-    featureKey: manifest.featureKey,
-    files,
-    destinationDir: options.destinationDir,
-    tokenRenames,
-    stagingTables: [],
-  };
-}
-
-/** Rewrite every `x-<id>:*` occurrence in `text`. */
-export const rewriteTokenIds = (text: string, renames: readonly TokenRename[]): string => {
-  let out = text;
-  for (const rename of renames) out = out.split(rename.from).join(rename.to);
-  return out;
-};
-
-export function runPromotion(options: PromotionOptions): PromotionResult {
-  const plan = planPromotion(options);
-  const { fs } = options;
-
-  if (options.apply !== true) return { plan, applied: false, moved: [], rewritten: [], residues: [] };
-
-  // ── the storage half FIRST (01 §5.4) ──────────────────────────────────────
-  // If the migration refuses (a live app holds the file), nothing has moved yet
-  // and the tree is exactly as it was.
-  options.migrate?.();
-  const stagingTables = options.dropStagingTables?.() ?? [];
-
-  const moved: string[] = [];
-  const rewritten: string[] = [];
-
-  fs.ensureDir(options.destinationDir);
-  for (const file of plan.files) {
-    const source = `${options.stagingDir}/${file}`;
-    const destination = `${options.destinationDir}/${file}`;
-    const original = fs.readText(source);
-    const next = rewriteTokenIds(original, plan.tokenRenames);
-    const parent = destination.slice(0, destination.lastIndexOf('/'));
-    if (parent.length > 0) fs.ensureDir(parent);
-    fs.writeText(destination, next);
-    moved.push(destination);
-    if (next !== original) rewritten.push(destination);
-  }
-
-  // The package is deleted, not archived in place: a `/staging` directory that
-  // still exists is a `/staging` directory something will import (V5).
-  fs.removeDir(options.stagingDir);
-
-  // ── post-scan: the same rule V5 enforces at build time ────────────────────
-  const residues: string[] = [];
-  const stagingRef = new RegExp(`x-${escapeRegExp(shortId(plan.pluginId))}:|/staging/${escapeRegExp(plan.pluginId)}\\b`);
-  for (const root of options.scanRoots ?? []) {
-    if (!fs.exists(root)) continue;
-    for (const file of fs.listFiles(root)) {
-      if (!isSourceFile(file)) continue;
-      if (stagingRef.test(fs.readText(`${root}/${file}`))) residues.push(`${root}/${file}`);
-    }
-  }
-
-  if (residues.length > 0)
-    throw new AppError(
-      `Promotion of '${plan.pluginId}' left ${residues.length} reference(s) to its staging id behind. A promoted plugin must have no surviving 'x-${shortId(plan.pluginId)}:' token or '/staging' import (V5 staging-plugin-in-export).`,
-      {
-        code: 'staging-plugin-in-export',
-        status: 500,
-        context: { pluginId: plan.pluginId, residues: residues.slice(0, 20) },
-      },
-    );
-
-  return { plan: { ...plan, stagingTables }, applied: true, moved, rewritten, residues };
-}

package/src/verify/runtime/billingEnforcement.spec.ts

@@ -1,176 +0,0 @@
-/**
- * `plan-limit-enforced` (11 §4) — billing enforcement through the REAL composed
- * server, not a unit stub.
- *
- * The audit's revenue-critical finding: `assertMetricWithinPlan` was called by
- * nothing, so `USAGE_LIMIT_EXCEEDED` could never fire from a running app — every
- * feature was given away for free while the meter recorded how much. These tests
- * drive a saas server (via the production `composeServer` the verify harness now
- * calls) with a tenant AT its ceiling and assert the metered route refuses with
- * a typed 402 BEFORE the work — and that the same routes are unlimited under the
- * local profile, where there is no gate.
- *
- * manifest-fidelity-allow: billing-enforcement boundary unit (06 §4) — this file
- * hand-builds a manifest to place a tenant EXACTLY at a plan ceiling, which is the
- * variable under test; the tier-gate's own feature→tier materialization is not the
- * subject here. Converting it to a pipeline-derived saas config at a ceiling is a
- * tracked §4 follow-up (see the progress report), not a silent bypass.
- */
-import { describe, expect, it } from 'bun:test';
-import type { BillingService, PlanUsage } from '../../server/mixins/billing.mixin';
-import type { EffectiveInstance, EffectiveManifest } from '../types';
-import { createVerifyServer } from './verifyServer';
-
-const instance = (over: Partial<EffectiveInstance> & Pick<EffectiveInstance, 'id' | 'engine'>): EffectiveInstance => ({
-  effective: {},
-  effectiveFeaturesHash: `hash_${over.id}`,
-  ports: [],
-  routes: [],
-  fills: [],
-  cssIsolation: 'none',
-  ops: [],
-  ...over,
-});
-
-const manifestOf = (over: Partial<EffectiveManifest> = {}): EffectiveManifest => ({
-  appId: 'test-app',
-  title: 'Test App',
-  profile: 'saas',
-  moment: 'ci',
-  // `theme` is REQUIRED on `EffectiveManifest` (E7) and V2 always emits it, so a
-  // fixture without one was a manifest the real pipeline could never produce.
-  theme: { preset: 'cc-default', overrides: {} },
-  engines: ['knowledge', 'asset', 'guard'],
-  instances: [
-    instance({ id: 'notes', engine: 'knowledge', effective: { notes: true, ragChat: true, aiOrganizer: true } }),
-    instance({ id: 'gallery', engine: 'asset', effective: { gallery: true } }),
-    instance({ id: 'guard-main', engine: 'guard', effective: { rbac: true } }),
-  ],
-  connections: [],
-  cspConnectAllowlist: [],
-  bundleKey: 'bk_test',
-  requiredTiers: [],
-  capabilities: {},
-  capabilitySource: 'pinned-fixture',
-  tokenIds: [],
-  stagingCatalogs: [],
-  ...over,
-});
-
-/** A plan reporting the same fixed usage for every tenant — the ceiling under test. */
-const billingAt = (rows: readonly PlanUsage[]): BillingService => ({
-  async usage() {
-    return rows;
-  },
-  async plan() {
-    return { id: 'starter', title: 'Starter', limits: {} };
-  },
-});
-
-const AT_TOKEN_CEILING: readonly PlanUsage[] = [
-  { metric: 'ai.tokens', used: 1000, limit: 1000 },
-  { metric: 'storage.bytes', used: 0, limit: 1_000_000_000 },
-];
-const AT_STORAGE_CEILING: readonly PlanUsage[] = [
-  { metric: 'ai.tokens', used: 0, limit: 1_000_000 },
-  { metric: 'storage.bytes', used: 1_000_000_000, limit: 1_000_000_000 },
-];
-const AMPLE: readonly PlanUsage[] = [
-  { metric: 'ai.tokens', used: 1, limit: 1_000_000 },
-  { metric: 'storage.bytes', used: 1, limit: 1_000_000_000 },
-];
-
-const post = (server: ReturnType<typeof createVerifyServer>, path: string, token: string, init?: RequestInit) =>
-  Promise.resolve(
-    server.fetch(
-      new Request(`http://localhost${path}`, {
-        method: 'POST',
-        headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-        body: '{}',
-        ...init,
-      }),
-    ),
-  );
-
-describe('billing enforcement — metered AI work (ai.tokens)', () => {
-  it('refuses knowledge:organize with a typed 402 when the tenant is at its ai.tokens ceiling', async () => {
-    const server = createVerifyServer({ manifest: manifestOf(), billing: billingAt(AT_TOKEN_CEILING) });
-    const token = server.mintToken({ tenantId: 't_a', permissions: ['knowledge:write'] });
-
-    const res = await post(server, '/api/knowledge/organize', token);
-    expect(res.status).toBe(402);
-    const body = (await res.json()) as { error?: { code?: string; context?: { metric?: string; limit?: number } } };
-    expect(body.error?.code).toBe('USAGE_LIMIT_EXCEEDED');
-    // The 402 body names the metric and plan ceiling so the upgrade dialog can render.
-    expect(body.error?.context?.metric).toBe('ai.tokens');
-    expect(body.error?.context?.limit).toBe(1000);
-  });
-
-  it('allows knowledge:organize when there is ai.tokens headroom (a MEMBER upgrade lifts it)', async () => {
-    const server = createVerifyServer({ manifest: manifestOf(), billing: billingAt(AMPLE) });
-    const token = server.mintToken({ tenantId: 't_a', permissions: ['knowledge:write'] });
-
-    const res = await post(server, '/api/knowledge/organize', token);
-    // 202 (job accepted) — enforcement passed, so the metered work proceeds.
-    expect(res.status).toBe(202);
-  });
-
-  it('gates the ragChat search surface on ai.tokens too', async () => {
-    const server = createVerifyServer({ manifest: manifestOf(), billing: billingAt(AT_TOKEN_CEILING) });
-    const token = server.mintToken({ tenantId: 't_a', permissions: ['knowledge:write'] });
-
-    const res = await Promise.resolve(
-      server.fetch(new Request('http://localhost/api/knowledge/search?q=hi', { headers: { authorization: `Bearer ${token}` } })),
-    );
-    expect(res.status).toBe(402);
-  });
-});
-
-describe('billing enforcement — metered storage (storage.bytes)', () => {
-  it('refuses an upload BEFORE the stream when the tenant is at its storage ceiling', async () => {
-    const server = createVerifyServer({ manifest: manifestOf(), billing: billingAt(AT_STORAGE_CEILING) });
-    const token = server.mintToken({ tenantId: 't_a', permissions: ['knowledge:write'] });
-
-    const res = await post(server, '/api/asset/upload', token, {
-      // A declared payload that, even at the minimum, has no room under the ceiling.
-      headers: { authorization: `Bearer ${token}`, 'content-length': '5000000' },
-      body: 'x',
-    });
-    expect(res.status).toBe(402);
-    const body = (await res.json()) as { error?: { context?: { metric?: string } } };
-    expect(body.error?.context?.metric).toBe('storage.bytes');
-  });
-
-  it('allows an upload with storage headroom', async () => {
-    const server = createVerifyServer({ manifest: manifestOf(), billing: billingAt(AMPLE) });
-    const token = server.mintToken({ tenantId: 't_a', permissions: ['knowledge:write'] });
-
-    const res = await post(server, '/api/asset/upload', token, {
-      headers: { authorization: `Bearer ${token}`, 'content-length': '2048' },
-      body: 'x',
-    });
-    // 201 created — enforcement passed and the verify asset service accepted it.
-    expect(res.status).toBe(201);
-  });
-});
-
-describe('billing enforcement — the local profile is unlimited (no gate composed)', () => {
-  const localManifest = manifestOf({
-    profile: 'local',
-    engines: ['knowledge', 'asset'],
-    instances: [
-      instance({ id: 'notes', engine: 'knowledge', effective: { notes: true, aiOrganizer: true } }),
-      instance({ id: 'gallery', engine: 'asset', effective: { gallery: true } }),
-    ],
-  });
-
-  it('never 402s a metered route under local, even with a billing service reporting over-ceiling', async () => {
-    // Under local there is no BillingService wired (composeServer builds no
-    // enforcer), so a hostile/over-ceiling billing is irrelevant — unlimited.
-    const server = createVerifyServer({ manifest: localManifest, billing: billingAt(AT_TOKEN_CEILING) });
-    const token = server.mintToken({ tenantId: 't_local', permissions: ['knowledge:write'] });
-
-    const res = await post(server, '/api/knowledge/organize', token);
-    expect(res.status).toBe(202);
-  });
-});

package/src/verify/runtime/bin/ccVerify.ts

@@ -1,12 +0,0 @@
-#!/usr/bin/env bun
-/**
- * `cc-verify` executable — the CI hook and the `gen-app --verify` backend.
- *
- * Kept to argv-in / exit-code-out so the whole CLI is testable as a function
- * (`runCli`) with no process manipulation in the tests.
- */
-import { runCli } from '../cli';
-
-const result = await runCli(process.argv.slice(2));
-if (result.output.length > 0) console.log(result.output);
-process.exit(result.exitCode);