Test website app bootstrap behavior

docs/ops/HYPERTWIST_PUBLIC_WEBSITE_AUTH_BILLING_AND_DISTRIBUTION_PACKET_2026-06-22.md

@@ -156,6 +156,7 @@ The frontend behavior coverage now also explicitly pins:
 - login/register page continuation behavior plus the public `/download` page rule that configured release targets still route through the protected dashboard instead of exposing raw URLs
 - protected app-route loading/redirect behavior plus auth-aware marketing/app shell actions
 - real `AppRouteTree` smoke coverage for homepage, pricing, download, login, dashboard, and dashboard-download routes through the lazy public/protected router itself
+- top-level `App` bootstrap coverage for unknown-route redirect plus SuperTokens wrapper enabled-versus-fallback posture
 - dashboard launch-readiness visibility plus generated desktop-link verify URL behavior
 
 The first-party auth server now also supports bounded same-origin public serving

docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md

@@ -264,7 +264,7 @@ repo.
 | Feature | Status | Primary authority | Notes |
 |---|---|---|---|
 | Public `hypertwist.app` marketing shell | Implemented now | first-party `website/` app + feature registry/roadmap authority | HyperTwist now has a dedicated first-party public web surface for homepage, about, resources, pricing, download, support, and legal routes. This lane is separate from the embedded Unreal browser runtime under `Content/Browser/` and does not claim browser-simulator parity. The same package now also carries a first-party external runtime-readiness verifier so deploy-time env and live health posture can be checked outside the dashboard, plus separated local-versus-production env templates whose placeholder values are intentionally rejected until real launch config is in place, bootstrap CI now validates both the frontend and auth-server website commands directly, and the auth server can now auto-serve the built `website/dist` bundle with bounded SPA fallback for same-origin public deployment. Request-level server coverage now also proves that public/app shell delivery does not shadow `/api/*`, `/auth*`, `/health`, or missing asset paths. |
-| Browser-based operator/account dashboard | Implemented now | first-party `website/` app + shared auth/dashboard packet | A protected browser dashboard is now live for operator access, account state, download posture, browser-access boundary explanation, notices review, and bounded billing/entitlement status. It reuses the shared SuperTokens auth posture proven in FamiliarOS and ScriptoriumAI while remaining HyperTwist-specific in product content and boundary claims, the current auth-health surface now truthfully distinguishes configured versus reachable or ready shared-core posture while exposing fallback-active reason instead of hardcoding readiness, and the same dashboard now also surfaces launch-readiness truth for download URLs, checkout links, source/notices URLs, billing-secret/map configuration, and local-versus-public runtime deployment posture. Focused frontend coverage now also protects deep-link login redirect preservation, safe `next`-path normalization across auth entry points, fallback/email auth-bootstrap normalization, login/register continuation behavior, public download-gating behavior, protected-route/shell behavior, real lazy-route tree behavior for key public and protected paths, and desktop-link verify-url/dashboard readiness behavior. |
+| Browser-based operator/account dashboard | Implemented now | first-party `website/` app + shared auth/dashboard packet | A protected browser dashboard is now live for operator access, account state, download posture, browser-access boundary explanation, notices review, and bounded billing/entitlement status. It reuses the shared SuperTokens auth posture proven in FamiliarOS and ScriptoriumAI while remaining HyperTwist-specific in product content and boundary claims, the current auth-health surface now truthfully distinguishes configured versus reachable or ready shared-core posture while exposing fallback-active reason instead of hardcoding readiness, and the same dashboard now also surfaces launch-readiness truth for download URLs, checkout links, source/notices URLs, billing-secret/map configuration, and local-versus-public runtime deployment posture. Focused frontend coverage now also protects deep-link login redirect preservation, safe `next`-path normalization across auth entry points, fallback/email auth-bootstrap normalization, login/register continuation behavior, public download-gating behavior, protected-route/shell behavior, real lazy-route tree behavior for key public and protected paths, top-level app-bootstrap and SuperTokens-wrapper posture, and desktop-link verify-url/dashboard readiness behavior. |
 | Desktop download posture and browser-to-desktop pairing | Implemented now | first-party `website/` app + `website/server` desktop-link endpoints | Public download targets, dashboard-side release posture, and short-lived desktop-link token generation/verification are now first-party owned. The current server posture now enforces exact website-origin matching, bounded per-user issuance, one-time token consumption, and billing-backed plan/download entitlement resolution with focused `website/server` tests green on `2026-06-22`, and the verify handshake now returns the same resolved download-entitlement posture the dashboard sees instead of only identity plus plan/role. The public `/download` page now keeps raw download URLs behind the protected dashboard instead of exposing them directly. Actual release URLs remain deployment configuration rather than hardcoded product truth. |
 | Paddle-ready pricing and billing webhook seam | Implemented now | first-party `website/` app + `website/server` billing endpoint | The public pricing surface now exists with plan structure, checkout-link configuration seams, and the same `/api/billing/paddle/webhook` endpoint family used by the broader product website lane. The current server now verifies `Paddle-Signature` against `PADDLE_WEBHOOK_SECRET` using the documented raw-body HMAC flow, persists a bounded first-party billing state file, and applies verified Paddle events into account/download entitlement state that the browser dashboard consumes, with focused `website/server` tests green on `2026-06-22`. Production checkout URLs, secret management, and broader operator/admin billing workflows remain deployment/application tasks, not shipped-code omissions. |
 | Public open-source notices and corresponding-source surface | Implemented now | first-party `website/` app + `HYPERTWIST_MPL_DISTRIBUTION_PLACEMENT_CHECKLIST_2026-05-25.md` | HyperTwist now has a stable public `Open Source Notices` route linked from pricing, download, and footer surfaces, satisfying the requirement that public distribution surfaces expose notice and corresponding-source guidance when shipped builds contain `MPL`-covered material. The exact public corresponding-source URL still must be configured before external launch. |

docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md

@@ -225,6 +225,8 @@ Current consolidated milestone snapshot:
   protected-route plus shell-action behavior, and dashboard launch-readiness
   plus desktop-link verify-url behavior, with real lazy-route smoke coverage now
   pinned for `/`, `/pricing`, `/download`, `/login`, `/app`, and `/app/downloads`,
+  plus top-level `App` bootstrap proof for unknown-route redirect and
+  SuperTokens-wrapper posture,
   and the auth server can now auto-serve the built
   `website/dist` bundle with bounded SPA fallback for same-origin `hypertwist.app`
   deployment when that build output is present, while the env templates and

website/README.md

@@ -98,4 +98,5 @@ The focused frontend test coverage now also pins:
 - login/register page continuation behavior and protected-dashboard download gating on the public download page
 - protected-route loading/redirect behavior plus auth-aware marketing/app shell actions
 - real `AppRouteTree` smoke coverage for `/`, `/pricing`, `/download`, `/login`, `/app`, and `/app/downloads`
+- top-level `App` bootstrap coverage for unknown-route redirect and SuperTokens wrapper on/off posture
 - dashboard launch-readiness plus desktop-link verify-url behavior

website/src/__tests__/App.bootstrap.test.tsx

@@ -0,0 +1,76 @@
+import { cleanup, render, screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockUsePlatformAuth = vi.fn()
+const mockIsSuperTokensConfigured = vi.fn(() => false)
+
+vi.mock('../auth/platform-auth', () => ({
+  PlatformAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  usePlatformAuth: () => mockUsePlatformAuth(),
+}))
+
+vi.mock('../auth/supertokens-client', () => ({
+  isSuperTokensConfigured: () => mockIsSuperTokensConfigured(),
+}))
+
+vi.mock('supertokens-auth-react', () => ({
+  SuperTokensWrapper: ({ children }: { children: React.ReactNode }) => (
+    <div data-testid="supertokens-wrapper">{children}</div>
+  ),
+}))
+
+import App from '../App'
+
+describe('App bootstrap', () => {
+  beforeEach(() => {
+    cleanup()
+    mockUsePlatformAuth.mockReset()
+    mockIsSuperTokensConfigured.mockReset()
+    mockIsSuperTokensConfigured.mockReturnValue(false)
+    mockUsePlatformAuth.mockReturnValue({
+      isAuthenticated: false,
+      isLoading: false,
+      login: vi.fn(),
+      register: vi.fn(),
+      logout: vi.fn(),
+      toggleColorMode: vi.fn(),
+      colorMode: 'dark',
+      superTokensConfigured: false,
+      user: null,
+    })
+    window.history.replaceState({}, '', '/')
+  })
+
+  it('redirects unknown routes to the homepage through the real app root', async () => {
+    window.history.replaceState({}, '', '/totally-unknown')
+
+    render(<App />)
+
+    expect(await screen.findByText('HyperTwist turns cube practice into a real operator-grade training stack.')).toBeTruthy()
+    await waitFor(() => {
+      expect(window.location.pathname).toBe('/')
+    })
+    expect(screen.queryByTestId('supertokens-wrapper')).toBeNull()
+  })
+
+  it('wraps the app in SuperTokens when configured and still renders the real public route', async () => {
+    mockIsSuperTokensConfigured.mockReturnValue(true)
+    mockUsePlatformAuth.mockReturnValue({
+      isAuthenticated: false,
+      isLoading: false,
+      login: vi.fn(),
+      register: vi.fn(),
+      logout: vi.fn(),
+      toggleColorMode: vi.fn(),
+      colorMode: 'dark',
+      superTokensConfigured: true,
+      user: null,
+    })
+    window.history.replaceState({}, '', '/pricing')
+
+    render(<App />)
+
+    expect(await screen.findByText('Pricing that matches the actual delivery model.')).toBeTruthy()
+    expect(screen.getByTestId('supertokens-wrapper')).toBeTruthy()
+  })
+})