# Testing Twungeon

## Automated gates

From a clean checkout:

```bash
npm install
npm run lint
npm run typecheck
npm test
npm run test:integration
npm run build
```

`npm test` covers deterministic domain rules and 500 generated floors.
`npm run test:integration` covers the HTTP/session boundary and independent
viewer authority. Tests use injected clocks, IDs, random rolls, and synthetic
Twitch identities; they do not require credentials.

## Local gameplay verification

1. Run `npm run dev` and open `http://localhost:3000`.
2. Confirm the exact dormant banner appears and no timer runs.
3. Use **Local viewer login** to spawn and bind a viewer.
4. Confirm 3 HP, 2 AP, no Guard, a ready heal, and a 25-second phase.
5. Exercise movement, invalid walls, Attack, Heal, and Pass. Invalid actions
   must not consume AP.
6. Open a second browser/private window with a different ID. Confirm both
   characters share the dungeon but each controller spends only its own AP.
7. Refresh during a phase. Confirm a snapshot restores the map/log and no
   command replays.
8. Run `npm run build && npm start` and repeat the smoke test against the built
   server.

The local-only endpoints `/api/dev/spawn` and `/api/dev/redemption` exist only while
`TWITCH_ENABLED` is false.

## Live-channel campaign

After completing `docs/twitch-setup.md`, use two follower accounts and one
non-follower account. Capture redacted evidence for:

- eligible, ineligible, and duplicate `!spawn` attempts;
- matching and mismatched Extension identities;
- independent commands from two viewers;
- phase expiry and AutoGuard while one viewer is disconnected;
- death and a configured Channel Points reward redemption from the same user;
- escape with the Goblin alive, floor revival, and a total-party wipe;
- refresh/reconnect during a phase and transition; and
- repeated floors and a short soak session.

Do not record tokens, JWTs, secrets, or complete authorization headers. Use the
acceptance matrix in `Twungeon_MVP_Acceptance_Test_and_Build_Checklist.md` for
AT-001 through AT-033 evidence. Automated passing tests do not substitute for
the clean-operator, live Twitch, first-time-viewer, or concept-validation gates.

## Fault injection

Test each failure separately: expired Extension JWT, wrong channel claim,
unlinked identity, invalid broadcaster token, missing follower scope, Twitch
chat disconnect, wrong/duplicate Channel Points redemption, WebSocket interruption, and
stale run/floor/phase command. Expected behavior is a stable rejection or a
fresh snapshot without partial game-state mutation.