feat: release 2.7.0

tests/command/trust.test.ts

@@ -1,8 +1,14 @@
 import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { rm } from "node:fs/promises";
+import { runCommand } from "citty";
 import { KuberApiError, type ApiRequestInit } from "../../lib/api";
 import { getTrustPath, readTrust, updateTrust } from "../../lib/trust";
-import { grantTrust, revokeTrust, statusTrust } from "../../command/trust";
+import {
+  grantTrust,
+  revokeTrust,
+  statusTrust,
+  trust,
+} from "../../command/trust";
 
 const originalConfig = process.env.XDG_CONFIG_HOME;
 const identity = { project: "demo", fingerprint: "a".repeat(64) };
@@ -28,6 +34,31 @@ function requester(
 }
 
 describe("trust command", () => {
+  test("citty dispatch of bare trust runs the parent grant handler", async () => {
+    await expect(runCommand(trust, { rawArgs: [] })).rejects.toThrow();
+  });
+
+  test.each(["status", "revoke"])(
+    "citty dispatch of %s does not run the parent grant handler",
+    async (subcommand) => {
+      const command = {
+        ...trust,
+        subCommands: Object.fromEntries(
+          Object.entries(trust.subCommands!).map(([name, child]) => [
+            name,
+            { ...child, run: async () => {} },
+          ]),
+        ),
+      };
+
+      // Without a provided app context, a parent grant would reject in
+      // current(). Successful dispatch proves citty did not grant afterward.
+      await expect(
+        runCommand(command, { rawArgs: [subcommand] }),
+      ).resolves.toBeDefined();
+    },
+  );
+
   test("grants, reports, and revokes the current namespace fingerprint", async () => {
     process.env.XDG_CONFIG_HOME = `/tmp/kuber-trust-command-${crypto.randomUUID()}`;
     const calls: Array<{ path: string; init?: ApiRequestInit }> = [];