nuget reorganization

src/Scanner/__Tests/StellaOps.Scanner.Surface.Env.Tests/SurfaceEnvironmentBuilderTests.cs

@@ -65,6 +65,70 @@ public sealed class SurfaceEnvironmentBuilderTests
         }
     }
 
+    [Fact]
+    public void Build_Throws_WhenEndpointMissing_AndRequired()
+    {
+        var services = CreateServices();
+        var exception = Assert.Throws<SurfaceEnvironmentException>(() =>
+            SurfaceEnvironmentFactory.Create(services, options => options.RequireSurfaceEndpoint = true));
+
+        Assert.Equal("SURFACE_FS_ENDPOINT", exception.Variable);
+    }
+
+    [Fact]
+    public void Build_Throws_WhenEndpointInvalid()
+    {
+        Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", "not-a-uri");
+        try
+        {
+            var services = CreateServices();
+            var ex = Assert.Throws<SurfaceEnvironmentException>(() => SurfaceEnvironmentFactory.Create(services));
+            Assert.Equal("SURFACE_FS_ENDPOINT", ex.Variable);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", null);
+        }
+    }
+
+    [Fact]
+    public void Build_Throws_WhenTlsCertificateMissing()
+    {
+        Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", "https://surface.example.test");
+        Environment.SetEnvironmentVariable("SCANNER_SURFACE_TLS_CERT_PATH", "/does/not/exist.pem");
+        try
+        {
+            var services = CreateServices();
+            var ex = Assert.Throws<SurfaceEnvironmentException>(() => SurfaceEnvironmentFactory.Create(services));
+            Assert.Equal("SURFACE_TLS_CERT_PATH", ex.Variable);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCANNER_SURFACE_TLS_CERT_PATH", null);
+            Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", null);
+        }
+    }
+
+    [Fact]
+    public void Build_UsesTenantResolver_WhenNotProvided()
+    {
+        Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", "https://surface.example.test");
+        try
+        {
+            var services = CreateServices();
+            var environment = SurfaceEnvironmentFactory.Create(services, options =>
+            {
+                options.TenantResolver = _ => "resolved-tenant";
+            });
+
+            Assert.Equal("resolved-tenant", environment.Settings.Tenant);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCANNER_SURFACE_FS_ENDPOINT", null);
+        }
+    }
+
     private static IServiceProvider CreateServices(Action<IServiceCollection>? configure = null)
     {
         var services = new ServiceCollection();