test(e2e): Batch A LIVE prod read specs (W-OBS/RES/VAULT/APIKEYS/BILLING/AUDIT)

[mastermanas805]

What

Adds e2e/live-reads.spec.ts — real-backend (LIVE) integration specs covering every authed READ user-flow against PRODUCTION via the minted PRO cohort account (Authorization: Bearer ${E2E_SESSION_JWT}). Run by e2e-prod.yml; gated on E2E_LIVE=1 + a sanctioned minted session. Whole file test.skips loudly in normal PR CI (default config testIgnore: ['live-*.spec.ts'] — mocked suite unaffected).

Executes Batch A of the prod-coverage expansion (docs/sessions/2026-06-04/PROD-COVERAGE-MATRIX.md §3, waves W1–W6).

Routes moved to LIVE-PROD-NOW (~32 route-legs, 19 tests)

No prodLiveTestMap exists in the api repo yet, so per the DONE-BAR these routes are recorded here as graduating LIVE-PROD-TODO → LIVE-PROD-NOW (and exported as coveredRoutes for the future done-bar, matrix §4 Option B):

W-OBS (unauthed/minted GETs, zero write risk): GET /livez, /healthz (+commit_id), /readyz, /openapi.json (3.1 + vault paths), /api/v1/capabilities (plans.Registry tiers incl. pro), /api/v1/status, /.well-known/oauth-protected-resource, /api/v1/incidents, /llms.txt, /security.txt.

W-RES: GET /api/v1/whoami (+ tampered-bearer 401 authz), /api/v1/resources, /resources/:id (asserts no connection_url leak in detail), /:id/credentials (redis URL revealed), /:id/metrics (200 Pro / 402 tier-gated), explicit DELETE /resources/:id, /resources/families, /:id/family, /:id/backups, /:id/restores. Seeded with one fast cache resource (Redis hot-pool, no dedicated DB) + reaped.

W-VAULT: PUT /vault/:env/:key → GET /vault/:env/:key (encrypt-at-rest decrypt round-trip) → GET /vault/:env (list, names-only). Key reaped inline; account cascade backstop.

W-APIKEYS: POST → GET (plaintext-once; list is metadata-only, asserts no key leak) → DELETE (revoked flips) on /api/v1/auth/api-keys.

W-BILLING (reads only, NO charge): GET /api/v1/billing, /billing/invoices, /billing/usage, /usage/wall.

W-AUDIT: GET /api/v1/audit (paginated envelope + next_cursor + masked-email redaction) + GET /api/v1/audit.csv (text/csv + header parity).

Skipped-with-reason (matching matrix PROD-EXEMPT reasoning)

• GET /api/v1/billing/invoices → test.skip on 503 (Razorpay portal unavailable on prod, recurring disabled — documented contract); 200 path asserts invoices[].
• GET /:id/metrics → accepts 402 when the stack isn't Pro (the minted account is PRO, so 200 expected on prod).
• Every authed leg test.skips loudly when E2E_SESSION_JWT is absent.
• Cache-seed legs test.skip on a 503 cache backend.

Safety (rule 24)

Mirrors live-anon-provision/live-claim-deploy exactly: assertSafeApiTarget() refuses an un-sanctioned prod target, cohort-branded cohortName, recordEntity before any throwing assert, inline reap + afterAll backstop + out-of-process reap-cohort.ts in the workflow if: always() teardown. Reads create nothing; the few seed rows (cache resource, vault key, api-key) are reaped inline and double-covered by the account cascade.

Verification

• npm run gate GREEN (tsc + build + vitest: 1115 passed / 3 skipped, 80 files).
• playwright test --config=playwright.live.config.ts --list lists all 19 new tests cleanly.
• Default mocked suite unaffected.

🤖 Generated with Claude Code

[github-actions]

size-limit report 📦

Path	Size
dist/assets/index-902QtfQT.js	161.98 KB (0%)
dist/assets/index-BsJUZYRr.css	6.13 KB (0%)