@astram/identity 0.13.0 → 0.14.0

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.js

@@ -0,0 +1,604 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditRowsFor = exports.linkLines = exports.callsOf = exports.writeCalls = exports.isWriteCall = exports.sha256 = exports.FakeApp = exports.current = exports.emptyState = exports.FILE_DAVE = exports.FILE_MINI = exports.FILE_TWO_TENANTS = exports.FILE_MAIN = exports.PROD_ENV = exports.TEST_ENV = exports.ROOT_PW_VAR = exports.LOCK_NAME = exports.DEFAULT_DEV_BASE = exports.BASE = exports.OPERATOR = exports.PW = exports.SCHEMAS = void 0;
+exports.stateMini = stateMini;
+exports.makeWorld = makeWorld;
+exports.noWritesAtAll = noWritesAtAll;
+exports.lockProblems = lockProblems;
+exports.visibleText = visibleText;
+exports.linkFor = linkFor;
+/**
+ * G-009 T10 test harness for the org bootstrap runner specs (fakes only: no DB, no Redis, no Nest).
+ *
+ * Not a spec. It builds a `World`: a fake `INestApplicationContext` plus recording fakes for every
+ * collaborator the runner reaches. The runner contract these fakes pin down is stated in
+ * `org-bootstrap-runner.spec.ts` (header). Summary of the seams:
+ *
+ *  - singletons come from `app.get(token, { strict: false })`: the authz pool (`IDENTITY_AUTHZ_POOL`),
+ *    `IDENTITY_FRAMEWORK_SCHEMAS`, `IDENTITY_CREDENTIAL_PROVISIONER`, `SHIELD_RESET_TOKEN_STORE`,
+ *    `GrantAdminService` (listCatalog + grant take an explicit principal; no request needed);
+ *  - request-scoped services come from `ContextIdFactory.create()`, `app.registerRequestByContextId(
+ *    { principal }, ctx)` and `app.resolve(ServiceClass, ctx, { strict: false })`, one context per step;
+ *  - `OrgStateReader` and `transitionRoleOwner` are module-mocked (their own specs cover them).
+ */
+const node_crypto_1 = require("node:crypto");
+const guard_1 = require("@astram/guard");
+const company_service_js_1 = require("../company/company.service.js");
+const company_hierarchy_service_js_1 = require("../company/company-hierarchy.service.js");
+const role_service_js_1 = require("../role/role.service.js");
+const user_service_js_1 = require("../user/user.service.js");
+const membership_service_js_1 = require("../membership/membership.service.js");
+const posting_service_js_1 = require("../membership/posting.service.js");
+const org_catalog_service_js_1 = require("../org-structure/org-catalog.service.js");
+const grant_admin_service_js_1 = require("../authz/grant-admin.service.js");
+const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
+const credential_provisioner_token_js_1 = require("../user/credential-provisioner.token.js");
+const org_bootstrap_runner_mocks_js_1 = require("./org-bootstrap-runner.mocks.js");
+Object.defineProperty(exports, "current", { enumerable: true, get: function () { return org_bootstrap_runner_mocks_js_1.current; } });
+const org_bootstrap_manifest_js_1 = require("./org-bootstrap.manifest.js");
+// ---------------------------------------------------------------- constants
+exports.SCHEMAS = {
+    namespace: 'zzns',
+    app: 'zzns_app',
+    identity: 'zzns_identity',
+    authz: 'zzns_authz',
+    audit: 'zzns_audit',
+    isDefault: false,
+};
+exports.PW = 'Zq-root-pass-1';
+exports.OPERATOR = 'op.person@example.test';
+exports.BASE = 'https://app.example.test/reset-password';
+exports.DEFAULT_DEV_BASE = 'http://localhost:5173/reset-password';
+exports.LOCK_NAME = 'astram_org_bootstrap:zzns_app';
+exports.ROOT_PW_VAR = 'ASTRAM_BOOTSTRAP_ROOT_PASSWORD_ZROOT';
+/** Env of a development/test run that would pass every refusal. */
+exports.TEST_ENV = {
+    NODE_ENV: 'test',
+    ASTRAM_BOOTSTRAP_OPERATOR: exports.OPERATOR,
+    [exports.ROOT_PW_VAR]: exports.PW,
+    RESET_LINK_BASE_URL: exports.BASE,
+};
+/** Env of a production run; the root password must be secret-ref resolved (the spec adds ROOT_PW_VAR to its hoisted secretRefs set). */
+exports.PROD_ENV = {
+    NODE_ENV: 'production',
+    ASTRAM_BOOTSTRAP_OPERATOR: exports.OPERATOR,
+    [exports.ROOT_PW_VAR]: exports.PW,
+    RESET_LINK_BASE_URL: exports.BASE,
+};
+// ---------------------------------------------------------------- fixtures
+/** Fresh-database file: 1 root, 2 companies, 1 dept, 1 branch, 3 roles, 3 non-root users. */
+exports.FILE_MAIN = {
+    version: 1,
+    roots: [{ username: 'zroot', email: 'zroot@example.test', homeCompany: 'Acme Co' }],
+    tenants: [
+        {
+            name: 'Acme Co',
+            departments: ['Sales'],
+            branches: ['HQ'],
+            roles: [
+                { name: 'Zrole Admin', permissions: ['identity:user:read', 'identity:company:read'] },
+                { name: 'Zrole Empty', permissions: [] },
+            ],
+            users: [
+                {
+                    username: 'zalice',
+                    email: 'zalice@example.test',
+                    postings: [{ role: 'Zrole Admin', department: 'Sales', branch: 'HQ' }],
+                },
+                { username: 'zbob', email: 'zbob@example.test' },
+            ],
+            children: [
+                {
+                    name: 'Acme Sub',
+                    roles: [{ name: 'Zrole Sub', permissions: [] }],
+                    users: [
+                        {
+                            username: 'zcarol',
+                            email: 'zcarol@example.test',
+                            postings: [{ role: 'Zrole Sub' }],
+                        },
+                    ],
+                },
+            ],
+        },
+    ],
+};
+/** Two tenants: used to prove `operationRoleIds` never reach across tenants. */
+exports.FILE_TWO_TENANTS = {
+    version: 1,
+    roots: [{ username: 'zroot', email: 'zroot@example.test', homeCompany: 'Acme Co' }],
+    tenants: [
+        {
+            name: 'Acme Co',
+            roles: [{ name: 'Zrole Admin', permissions: [] }],
+            users: [
+                { username: 'zalice', email: 'zalice@example.test', postings: [{ role: 'Zrole Admin' }] },
+            ],
+        },
+        {
+            name: 'Beta Co',
+            roles: [{ name: 'Zrole Beta', permissions: [] }],
+            users: [{ username: 'zdan', email: 'zdan@example.test', postings: [{ role: 'Zrole Beta' }] }],
+        },
+    ],
+};
+/** One tenant already holding everything: the state below makes every entry `unchanged`. */
+exports.FILE_MINI = {
+    version: 1,
+    roots: [{ username: 'zroot', email: 'zroot@example.test', homeCompany: 'Acme Co' }],
+    tenants: [
+        {
+            name: 'Acme Co',
+            roles: [{ name: 'Zrole Admin', permissions: ['identity:user:read'] }],
+            users: [
+                { username: 'zalice', email: 'zalice@example.test', postings: [{ role: 'Zrole Admin' }] },
+            ],
+        },
+    ],
+};
+/** A tenant with one user whose membership does not exist yet (for the "existing user" cases). */
+exports.FILE_DAVE = {
+    version: 1,
+    roots: [{ username: 'zroot', email: 'zroot@example.test', homeCompany: 'Acme Co' }],
+    tenants: [
+        {
+            name: 'Acme Co',
+            roles: [{ name: 'Zrole Admin', permissions: [] }],
+            users: [
+                { username: 'zdave', email: 'zdave@example.test', postings: [{ role: 'Zrole Admin' }] },
+            ],
+        },
+    ],
+};
+const emptyState = () => ({
+    companies: [],
+    departments: [],
+    branches: [],
+    roles: [],
+    users: [],
+    emailHolders: [],
+    ambiguousCompanies: [],
+});
+exports.emptyState = emptyState;
+/** The state that makes FILE_MINI entirely `unchanged`, alice's credential as given. */
+function stateMini(aliceCredential = 'usable') {
+    return {
+        companies: [{ path: 'Acme Co', departments: [], branches: [] }],
+        departments: [],
+        branches: [],
+        roles: [
+            {
+                name: 'Zrole Admin',
+                ownerTenant: 'Acme Co',
+                heldOutside: false,
+                permissions: ['identity:user:read'],
+            },
+        ],
+        users: [
+            {
+                username: 'zroot',
+                email: 'zroot@example.test',
+                credential: 'usable',
+                isPlatformSuperuser: true,
+                // A bootstrapped root holds no membership (R1-1: an existing root with one is a conflict).
+                memberships: [],
+                membershipsOutside: false,
+            },
+            {
+                username: 'zalice',
+                email: 'zalice@example.test',
+                credential: aliceCredential,
+                isPlatformSuperuser: false,
+                memberships: [
+                    { companyPath: 'Acme Co', active: true, postings: [{ role: 'Zrole Admin' }] },
+                ],
+                membershipsOutside: false,
+            },
+        ],
+        emailHolders: [],
+        ambiguousCompanies: [],
+    };
+}
+const READ_METHODS = new Set(['listMemberships', 'listCatalog']);
+const isBootstrapPrincipal = (a) => typeof a === 'object' && a !== null && a.id === org_bootstrap_manifest_js_1.ORG_BOOTSTRAP_PRINCIPAL_ID;
+class FakeApp {
+    singletons;
+    scoped;
+    initCalls = 0;
+    requests = new Map();
+    resolved = [];
+    constructor(singletons, scoped) {
+        this.singletons = singletons;
+        this.scoped = scoped;
+    }
+    async init() {
+        this.initCalls += 1;
+        return this;
+    }
+    get(token, _options) {
+        if (!this.singletons.has(token)) {
+            throw new Error(`Nest could not find ${String(token)} element (this provider does not exist)`);
+        }
+        return this.singletons.get(token);
+    }
+    registerRequestByContextId(request, contextId) {
+        this.requests.set(contextId, request);
+    }
+    async resolve(token, contextId, _options) {
+        const factory = this.scoped.get(token);
+        if (factory === undefined) {
+            if (this.singletons.has(token))
+                return this.singletons.get(token);
+            throw new Error(`Nest could not find ${String(token)} element (this provider does not exist)`);
+        }
+        const principal = this.requests.get(contextId)?.principal;
+        this.resolved.push({ token, principal });
+        return factory(principal);
+    }
+}
+exports.FakeApp = FakeApp;
+const uuidN = (n) => `00000000-0000-4000-8000-${String(n).padStart(12, '0')}`;
+function makeWorld(options) {
+    const idMap = new Map();
+    let counter = 100;
+    const world = {};
+    world.state = options.state ?? (0, exports.emptyState)();
+    world.out = [];
+    world.outFn = (line) => {
+        world.out.push(line);
+    };
+    world.events = [];
+    world.calls = [];
+    world.queries = [];
+    world.transitions = [];
+    world.issued = [];
+    world.invalidated = [];
+    world.provisionedLocked = [];
+    world.provisionedPassword = [];
+    world.conns = [];
+    world.readerCalls = 0;
+    world.lockMode = options.lockMode ?? 'acquired';
+    world.failOn = options.failOn;
+    world.failTransition = undefined;
+    world.failQuery = undefined;
+    world.roleHeldOutside = false;
+    world.tables = options.tables ?? {};
+    world.id = (kind, name) => {
+        const key = `${kind}:${name}`;
+        let v = idMap.get(key);
+        if (v === undefined) {
+            counter += 1;
+            v = uuidN(counter);
+            idMap.set(key, v);
+        }
+        return v;
+    };
+    const memberships = [...(options.memberships ?? [])];
+    const rec = (service, method, principal, args) => {
+        world.calls.push({
+            seq: world.calls.length,
+            service,
+            method,
+            args,
+            principal,
+            actor: args.find(isBootstrapPrincipal),
+        });
+        world.events.push(`${service}.${method}`);
+        const err = world.failOn?.(service, method, args);
+        if (err !== undefined)
+            throw err;
+    };
+    // ---- pool and connections (lock, claim transaction, superuser flag, audit rows)
+    const lookup = (sql, params) => {
+        // membership ids are read by (user, company) from the memberships the fake services recorded
+        if (/FROM\s+`?[\w]+`?\.`?company_membership`?/i.test(sql)) {
+            const [userUuid, companyUuid] = params;
+            return memberships
+                .filter((m) => m.userUuid === userUuid && m.companyUuid === companyUuid)
+                .map((m) => ({ cm_uuid: m.id }));
+        }
+        const t = /FROM\s+`?[\w]+`?\.`?(users|companies|roles|departments|branches)`?/i.exec(sql);
+        if (!t)
+            return [];
+        const rows = world.tables[t[1].toLowerCase()] ?? [];
+        const wanted = params
+            .filter((p) => typeof p === 'string')
+            .map((p) => p.toLowerCase());
+        const hit = wanted.length === 0
+            ? rows
+            : rows.filter((r) => Object.values(r).some((v) => typeof v === 'string' && wanted.includes(v.toLowerCase())));
+        // honour `col AS alias` so any alias the runner picks resolves
+        const aliases = [...sql.matchAll(/(?:[\w]+\.)?`?(\w+)`?\s+AS\s+`?(\w+)`?/gi)];
+        return hit.map((r) => {
+            const copy = { ...r };
+            for (const a of aliases)
+                if (a[1] in r)
+                    copy[a[2]] = r[a[1]];
+            return copy;
+        });
+    };
+    const run = (connId, sql, params = []) => {
+        world.queries.push({ conn: connId, sql, params });
+        const failure = world.failQuery?.(connId, sql, params);
+        if (failure !== undefined)
+            throw failure;
+        if (/^\s*SELECT\b/i.test(sql) && /FROM\s+`?\w+`?\.`?roles`?[^]*FOR UPDATE/i.test(sql)) {
+            world.events.push('LOCK_ROLE');
+            return [{ r_uuid: params[0] }];
+        }
+        if (/^\s*SELECT\b/i.test(sql) && /membership_posting/i.test(sql)) {
+            world.events.push('CHECK_HELD_OUTSIDE');
+            return world.roleHeldOutside ? [{ held: 1 }] : [];
+        }
+        if (/GET_LOCK/i.test(sql)) {
+            world.events.push('GET_LOCK');
+            const alias = /\bAS\s+`?(\w+)`?/i.exec(sql)?.[1] ?? 'GET_LOCK(?, ?)';
+            return [{ [alias]: world.lockMode === 'acquired' ? 1 : 0 }];
+        }
+        if (/RELEASE_LOCK/i.test(sql)) {
+            world.events.push('RELEASE_LOCK');
+            const alias = /\bAS\s+`?(\w+)`?/i.exec(sql)?.[1] ?? 'RELEASE_LOCK(?)';
+            return [{ [alias]: 1 }];
+        }
+        if (/^\s*UPDATE\b/i.test(sql) && /u_is_platform_superuser/i.test(sql)) {
+            world.events.push('UPDATE_SUPERUSER');
+            return { affectedRows: 1 };
+        }
+        if (/^\s*(INSERT|UPDATE|DELETE)\b/i.test(sql))
+            return { affectedRows: 1 };
+        if (/^\s*SELECT\b/i.test(sql))
+            return lookup(sql, params);
+        return [];
+    };
+    const pool = {
+        query: async (sql, params) => run('pool', sql, params),
+        getConnection: async () => {
+            const id = `conn${world.conns.length + 1}`;
+            const conn = {
+                id,
+                released: false,
+                log: [],
+                query: async (sql, params) => run(id, sql, params),
+                beginTransaction: async () => {
+                    conn.log.push('begin');
+                    world.events.push(`begin:${id}`);
+                },
+                commit: async () => {
+                    conn.log.push('commit');
+                    world.events.push(`commit:${id}`);
+                },
+                rollback: async () => {
+                    conn.log.push('rollback');
+                    world.events.push(`rollback:${id}`);
+                },
+                release: async () => {
+                    conn.released = true;
+                    world.events.push(`release:${id}`);
+                },
+                end: async () => {
+                    conn.released = true;
+                    world.events.push(`release:${id}`);
+                },
+            };
+            world.conns.push(conn);
+            return conn;
+        },
+    };
+    // ---- guard fakes
+    const store = {
+        issue: async (principalId, hash, expiresAtMs) => {
+            world.events.push('issue');
+            world.issued.push({ principalId, hash, expiresAtMs });
+        },
+        consume: async () => null,
+        invalidateAllForPrincipal: async (principalId) => {
+            world.events.push('invalidate');
+            world.invalidated.push(principalId);
+        },
+    };
+    // The real provisioner INSERTs through the `query` it is handed (a transaction connection) or the pool.
+    const insertCredential = async (query, principalId) => {
+        const sql = 'INSERT INTO `zzns_identity`.`identity_credential` (ic_principal_id) VALUES (?)';
+        await (query ?? ((q, p) => pool.query(q, p)))(sql, [principalId]);
+    };
+    const provisioner = {
+        provisionLocked: async (input, query) => {
+            world.events.push('provisionLocked');
+            await insertCredential(query, input.principalId);
+            world.provisionedLocked.push({ ...input });
+        },
+        provisionPassword: async (input, query) => {
+            world.events.push('provisionPassword');
+            await insertCredential(query, input.principalId);
+            world.provisionedPassword.push({ ...input });
+        },
+        stateOf: async () => 'none',
+    };
+    const grantAdmin = {
+        listCatalog: async () => ({
+            catalog: [
+                {
+                    key: 'identity:user:read',
+                    label: 'Read users',
+                    module: 'identity',
+                    typeKey: 'user',
+                    action: 'read',
+                },
+                {
+                    key: 'identity:company:read',
+                    label: 'Read companies',
+                    module: 'identity',
+                    typeKey: 'company',
+                    action: 'read',
+                },
+                {
+                    key: 'identity:audit:read',
+                    label: 'Read audit',
+                    module: 'identity',
+                    typeKey: 'audit',
+                    action: 'read',
+                },
+            ],
+            wildcards: ['identity:*', 'identity:user:*', 'identity:company:*', 'identity:audit:*'],
+        }),
+        grant: async (roleUuid, key, grantor) => {
+            rec('GrantAdminService', 'grant', undefined, [roleUuid, key, grantor]);
+        },
+    };
+    const singletons = new Map();
+    const scoped = new Map();
+    if (options.wired !== false) {
+        singletons.set(options.poolToken, pool);
+        singletons.set(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS, exports.SCHEMAS);
+        singletons.set(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER, provisioner);
+        singletons.set(guard_1.SHIELD_RESET_TOKEN_STORE, store);
+        singletons.set(grant_admin_service_js_1.GrantAdminService, grantAdmin);
+        scoped.set(company_service_js_1.CompanyService, (p) => ({
+            createCompany: async (actor, name) => {
+                rec('CompanyService', 'createCompany', p, [actor, name]);
+                return world.id('company', name);
+            },
+        }));
+        scoped.set(company_hierarchy_service_js_1.CompanyHierarchyService, (p) => ({
+            move: async (actor, nodeUuid, newParentUuid) => {
+                rec('CompanyHierarchyService', 'move', p, [actor, nodeUuid, newParentUuid]);
+            },
+        }));
+        scoped.set(role_service_js_1.RoleService, (p) => ({
+            createRole: async (name, actor) => {
+                rec('RoleService', 'createRole', p, [name, actor]);
+                return world.id('role', name);
+            },
+        }));
+        scoped.set(user_service_js_1.UserService, (p) => ({
+            createUserWithCredential: async (actor, input) => {
+                rec('UserService', 'createUserWithCredential', p, [actor, input]);
+                if (input.companyUuid === undefined)
+                    world.events[world.events.length - 1] += ':root';
+                const id = world.id('user', input.username);
+                if (input.companyUuid !== undefined) {
+                    memberships.push({
+                        // keyed by user id, like addActiveMembership below and the specs' expectations
+                        id: world.id('membership', `${id}@${input.companyUuid}`),
+                        userUuid: id,
+                        companyUuid: input.companyUuid,
+                    });
+                    return { id, credential: 'locked' };
+                }
+                return { id, credential: 'none', reason: 'no_company' };
+            },
+        }));
+        scoped.set(membership_service_js_1.MembershipService, (p) => ({
+            addActiveMembership: async (actor, userUuid, companyUuid) => {
+                rec('MembershipService', 'addActiveMembership', p, [actor, userUuid, companyUuid]);
+                const id = world.id('membership', `${userUuid}@${companyUuid}`);
+                memberships.push({ id, userUuid, companyUuid });
+                return id;
+            },
+            listMemberships: async (userUuid) => {
+                rec('MembershipService', 'listMemberships', p, [userUuid]);
+                return memberships
+                    .filter((m) => m.userUuid === userUuid)
+                    .map((m) => ({
+                    id: m.id,
+                    fields: { userUuid, companyUuid: m.companyUuid, isActive: true },
+                }));
+            },
+        }));
+        scoped.set(posting_service_js_1.PostingService, (p) => ({
+            addPostings: async (actor, membershipUuid, toAdd, opts) => {
+                rec('PostingService', 'addPostings', p, [actor, membershipUuid, toAdd, opts]);
+            },
+        }));
+        scoped.set(org_catalog_service_js_1.OrgCatalogService, (p) => ({
+            ensureDepartment: async (name) => {
+                rec('OrgCatalogService', 'ensureDepartment', p, [name]);
+                return world.id('department', name);
+            },
+            ensureBranch: async (name) => {
+                rec('OrgCatalogService', 'ensureBranch', p, [name]);
+                return world.id('branch', name);
+            },
+            attachDepartment: async (companyUuid, departmentUuid) => {
+                rec('OrgCatalogService', 'attachDepartment', p, [companyUuid, departmentUuid]);
+            },
+            attachBranch: async (companyUuid, branchUuid) => {
+                rec('OrgCatalogService', 'attachBranch', p, [companyUuid, branchUuid]);
+            },
+        }));
+    }
+    world.app = new FakeApp(singletons, scoped);
+    org_bootstrap_runner_mocks_js_1.current.world = world;
+    return world;
+}
+// ---------------------------------------------------------------- assertion helpers
+const sha256 = (s) => (0, node_crypto_1.createHash)('sha256').update(s).digest('hex');
+exports.sha256 = sha256;
+const isWriteCall = (c) => !READ_METHODS.has(c.method);
+exports.isWriteCall = isWriteCall;
+const writeCalls = (w) => w.calls.filter(exports.isWriteCall);
+exports.writeCalls = writeCalls;
+const callsOf = (w, service, method) => w.calls.filter((c) => c.service === service && c.method === method);
+exports.callsOf = callsOf;
+/** Every non-audit write the runner could make is absent. Lock and SELECT traffic is allowed. */
+function noWritesAtAll(w) {
+    const problems = [];
+    if ((0, exports.writeCalls)(w).length > 0)
+        problems.push(`service writes: ${(0, exports.writeCalls)(w)
+            .map((c) => c.method)
+            .join(',')}`);
+    if (w.provisionedLocked.length + w.provisionedPassword.length > 0)
+        problems.push('credential provisioned');
+    if (w.issued.length > 0)
+        problems.push('reset token issued');
+    if (w.invalidated.length > 0)
+        problems.push('reset tokens invalidated');
+    if (w.transitions.length > 0)
+        problems.push('role owner transitioned');
+    const dml = w.queries.filter((q) => /^\s*(INSERT|UPDATE|DELETE)\b/i.test(q.sql));
+    if (dml.length > 0)
+        problems.push(`DML: ${dml.map((q) => q.sql.slice(0, 40)).join(' | ')}`);
+    return problems;
+}
+/** Lock discipline: every GET_LOCK ran on a dedicated connection and was released on that one. */
+function lockProblems(w) {
+    const problems = [];
+    const gets = w.queries.filter((q) => /GET_LOCK/i.test(q.sql));
+    const rels = w.queries.filter((q) => /RELEASE_LOCK/i.test(q.sql));
+    for (const g of gets) {
+        if (g.conn === 'pool')
+            problems.push('GET_LOCK ran on the shared pool, not a dedicated connection');
+        if (w.lockMode === 'acquired' && !rels.some((r) => r.conn === g.conn)) {
+            problems.push('lock acquired but not released on the same connection');
+        }
+    }
+    for (const c of w.conns)
+        if (!c.released)
+            problems.push(`${c.id} was never released`);
+    return problems;
+}
+/** Everything the run said or stored that must never carry a secret. Provisioner args excluded. */
+function visibleText(w, extra = []) {
+    return [
+        w.out.join('\n'),
+        JSON.stringify(w.queries),
+        JSON.stringify(w.transitions.map((t) => t.filter((x) => typeof x !== 'function'))),
+        ...extra.map((e) => e instanceof Error ? `${e.name} ${e.message} ${JSON.stringify(e)}` : JSON.stringify(e)),
+    ].join('\n');
+}
+/** The raw token of the link printed for `username` (a line with the name and `<base>?token=<hex>`). */
+function linkFor(w, username) {
+    for (const line of w.out) {
+        if (!line.includes(username))
+            continue;
+        const m = /https?:\/\/\S+?\?token=([0-9a-f]{32,})/i.exec(line);
+        if (m)
+            return { raw: m[1], line };
+    }
+    return undefined;
+}
+const linkLines = (w) => w.out.filter((l) => /\?token=/.test(l));
+exports.linkLines = linkLines;
+/** The audit rows (INSERTs into audit_log) naming `action`, from any connection. */
+const auditRowsFor = (w, action) => w.queries.filter((q) => /audit_log/i.test(q.sql) && q.params.some((p) => p === action));
+exports.auditRowsFor = auditRowsFor;

package/dist/features/org-bootstrap/org-bootstrap-runner.mocks.d.ts

@@ -0,0 +1,24 @@
+import type { OrgState } from './org-bootstrap-plan.js';
+/** The slice of the harness `World` the mocks touch. */
+export interface MockWorld {
+    state: OrgState;
+    events: string[];
+    readerCalls: number;
+    transitions: unknown[][];
+    failTransition: Error | undefined;
+}
+/** Shared handle the module mocks read from; `makeWorld` sets it. */
+export declare const current: {
+    world: MockWorld | undefined;
+};
+export declare function readerModule(): {
+    OrgStateReader: {
+        new (): {
+            read(): Promise<OrgState>;
+        };
+    };
+};
+export declare function transitionModule(): {
+    transitionRoleOwner: import("vitest").Mock<(...args: unknown[]) => Promise<void>>;
+};
+//# sourceMappingURL=org-bootstrap-runner.mocks.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-runner.mocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap-runner.mocks.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-runner.mocks.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;CACnC;AAED,qEAAqE;AACrE,eAAO,MAAM,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAA;CAAyB,CAAC;AAE9E,wBAAgB,YAAY;;;oBAGR,OAAO,CAAC,QAAQ,CAAC;;;EAQpC;AAED,wBAAgB,gBAAgB;yDAEe,OAAO,EAAE;EAOvD"}

package/dist/features/org-bootstrap/org-bootstrap-runner.mocks.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.current = void 0;
+exports.readerModule = readerModule;
+exports.transitionModule = transitionModule;
+/**
+ * G-009 T10: module-mock factories for the runner specs. Deliberately imports NOTHING heavy (only
+ * `vitest` and types): `vi.mock` factories run while the harness is still loading its service imports,
+ * so a factory that imports the harness would deadlock on the circular import.
+ *
+ *   vi.mock('./org-state.reader.js', async () => (await import('./org-bootstrap-runner.mocks.js')).readerModule());
+ *   vi.mock('../role/role-owner-transition.js', async () => (await import('./org-bootstrap-runner.mocks.js')).transitionModule());
+ */
+const vitest_1 = require("vitest");
+/** Shared handle the module mocks read from; `makeWorld` sets it. */
+exports.current = { world: undefined };
+function readerModule() {
+    return {
+        OrgStateReader: class {
+            async read() {
+                const w = exports.current.world;
+                w.readerCalls += 1;
+                w.events.push('read');
+                return w.state;
+            }
+        },
+    };
+}
+function transitionModule() {
+    return {
+        transitionRoleOwner: vitest_1.vi.fn(async (...args) => {
+            const w = exports.current.world;
+            w.events.push('transitionRoleOwner');
+            w.transitions.push(args);
+            if (w.failTransition)
+                throw w.failTransition;
+        }),
+    };
+}