#[tokio::test]
async fn rejects_blank_inject_mapping_env_var() {
    let result = envseal_mcp::tools::inject::execute(envseal_mcp::tools::inject::InjectParams {
        mappings: vec![envseal_mcp::tools::inject::InjectMapping {
            secret: "api-key".to_string(),
            env_var: "   ".to_string(),
        }],
        command: vec!["/bin/echo".to_string(), "ok".to_string()],
    })
    .await;

    let err = result.expect_err("expected blank env_var to be rejected");
    assert!(
        err.contains("mappings[].env_var must not be empty"),
        "unexpected error: {err}"
    );
}
