@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/index.ts

@@ -1,12 +1,12 @@
-export * from './account-cache-invalidator.port';
-export * from './account-cache-invalidator.token';
-export * from './account-loader.port';
-export * from './account-loader.token';
-export * from './authentication-strategy.port';
-export * from './authentication-strategy.token';
-export * from './credential-verifier.port';
-export * from './credential-verifier.token';
-export * from './hub-session-manager.port';
-export * from './hub-session-manager.token';
-export * from './jwt-signer.port';
-export * from './jwt-signer.token';
+export * from './account-cache-invalidator.port.js';
+export * from './account-cache-invalidator.token.js';
+export * from './account-loader.port.js';
+export * from './account-loader.token.js';
+export * from './authentication-strategy.port.js';
+export * from './authentication-strategy.token.js';
+export * from './credential-verifier.port.js';
+export * from './credential-verifier.token.js';
+export * from './hub-session-manager.port.js';
+export * from './hub-session-manager.token.js';
+export * from './jwt-signer.port.js';
+export * from './jwt-signer.token.js';

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/resolve-authentication-mode.spec.ts

@@ -1,4 +1,4 @@
-import { resolveAuthenticationMode } from './resolve-authentication-mode';
+import { resolveAuthenticationMode } from './resolve-authentication-mode.js';
 
 describe('resolveAuthenticationMode', () => {
   it('defaults to "none" when the value is undefined', () => {

package/dist/templates/backend/application/src/@aurora/modules/authentication/index.ts

@@ -1,5 +1,5 @@
-export * from './authentication.module';
-export * from './domain/ports';
-export * from './domain/resolve-authentication-mode';
-export * from './infrastructure/guards';
-export * from './infrastructure/strategies';
+export * from './authentication.module.js';
+export * from './domain/ports/index.js';
+export * from './domain/resolve-authentication-mode.js';
+export * from './infrastructure/guards/index.js';
+export * from './infrastructure/strategies/index.js';

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/factory/authentication-strategy.factory.spec.ts

@@ -9,9 +9,10 @@ import { generateKeyPairSync } from 'node:crypto';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ACCOUNT_LOADER } from '../../domain/ports';
-import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter';
-import { LocalProviderAdapter } from '../strategies/local-provider/local-provider.adapter';
+import { ACCOUNT_LOADER } from '../../domain/ports/index.js';
+import { authenticationStrategyProvider } from './authentication-strategy.factory.js';
+import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter.js';
+import { LocalProviderAdapter } from '../strategies/local-provider/local-provider.adapter.js';
 
 // ---------------------------------------------------------------------------
 // JwtSignerAdapter — none mode
@@ -22,7 +23,7 @@ describe('JwtSignerAdapter — none mode', () => {
 
   beforeEach(async () => {
     const configService = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'none';
         return fallback;
       }),
@@ -78,7 +79,7 @@ describe('JwtSignerAdapter — local-provider mode', () => {
 
   it('constructs and signs tokens when mode is local-provider and key file exists', async () => {
     const configService = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'local-provider';
         if (key === 'OAUTH_PRIVATE_KEY_PATH') return privateKeyPath;
         if (key === 'JWT_ACCESS_TTL_SECONDS') return 3600;
@@ -105,7 +106,7 @@ describe('JwtSignerAdapter — local-provider mode', () => {
 describe('LocalProviderAdapter — none mode skips readFileSync', () => {
   it('constructs without reading any public key file (no readFileSync error)', async () => {
     const configService = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'none';
         return fallback;
       }),
@@ -136,7 +137,7 @@ describe('LocalProviderAdapter — aurora-hub mode skips readFileSync', () => {
     // aurora-hub mode: the local public key is irrelevant. Construction MUST NOT call
     // readFileSync regardless of whether OAUTH_PUBLIC_KEY_PATH is set.
     const configService = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'aurora-hub';
         // Point the key path at a guaranteed-missing file so the test stays discriminating
         // even in a dev env where ./.keys/ exists: reverting the dormant guard would make the
@@ -162,26 +163,12 @@ describe('LocalProviderAdapter — aurora-hub mode skips readFileSync', () => {
 
 // ---------------------------------------------------------------------------
 // Authentication strategy factory — none mode returns a dormant strategy
-//
-// Note: the factory module imports AuroraHubConsumerAdapter which imports
-// `jwks-rsa` (ESM-only — not transformable by ts-jest). To work around this
-// known limitation (catalyst-backend-testing SKILL.md), we mock the entire
-// adapter module so the import chain doesn't reach jwks-rsa, then call the
-// factory's useFactory directly.
 // ---------------------------------------------------------------------------
 
-// Mock the ESM-importing module before any imports run.
-jest.mock('../strategies/aurora-hub/aurora-hub-consumer.adapter', () => ({
-  AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {},
-}));
-
 describe('authenticationStrategyProvider — none mode (direct factory call)', () => {
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const { authenticationStrategyProvider } = require('./authentication-strategy.factory');
-
   it('returns a dormant strategy with valid getPassportOptions() when mode is none', () => {
     const configService = {
-      get: jest.fn((key: string) => {
+      get: vi.fn((key: string) => {
         if (key === 'OAUTH_STRATEGY') return 'none';
         return undefined;
       }),
@@ -206,7 +193,7 @@ describe('authenticationStrategyProvider — none mode (direct factory call)', (
 
   it('validate() throws a clear error if invoked in none mode (should never happen)', () => {
     const configService = {
-      get: jest.fn((key: string) => {
+      get: vi.fn((key: string) => {
         if (key === 'OAUTH_STRATEGY') return 'none';
         return undefined;
       }),
@@ -221,13 +208,13 @@ describe('authenticationStrategyProvider — none mode (direct factory call)', (
 
   it('returns the aurora-hub adapter stub when mode is aurora-hub', () => {
     const configService = {
-      get: jest.fn((key: string) => {
+      get: vi.fn((key: string) => {
         if (key === 'OAUTH_STRATEGY') return 'aurora-hub';
         return undefined;
       }),
     };
 
-    const stubAuroraHub = { getPassportOptions: jest.fn() } as never;
+    const stubAuroraHub = { getPassportOptions: vi.fn() } as never;
     const stubLocalProvider = {} as never;
 
     const strategy = authenticationStrategyProvider.useFactory(
@@ -241,14 +228,14 @@ describe('authenticationStrategyProvider — none mode (direct factory call)', (
 
   it('returns the local-provider adapter stub when mode is local-provider', () => {
     const configService = {
-      get: jest.fn((key: string) => {
+      get: vi.fn((key: string) => {
         if (key === 'OAUTH_STRATEGY') return 'local-provider';
         return undefined;
       }),
     };
 
     const stubAuroraHub = {} as never;
-    const stubLocalProvider = { getPassportOptions: jest.fn() } as never;
+    const stubLocalProvider = { getPassportOptions: vi.fn() } as never;
 
     const strategy = authenticationStrategyProvider.useFactory(
       configService,

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/factory/authentication-strategy.factory.ts

@@ -5,10 +5,10 @@ import {
   AUTHENTICATION_STRATEGY,
   type AuthenticatedAccount,
   type IAuthenticationStrategy,
-} from '../../domain/ports';
-import { resolveAuthenticationMode } from '../../domain/resolve-authentication-mode';
-import { AuroraHubConsumerAdapter } from '../strategies/aurora-hub/aurora-hub-consumer.adapter';
-import { LocalProviderAdapter } from '../strategies/local-provider/local-provider.adapter';
+} from '../../domain/ports/index.js';
+import { resolveAuthenticationMode } from '../../domain/resolve-authentication-mode.js';
+import { AuroraHubConsumerAdapter } from '../strategies/aurora-hub/index.js';
+import { LocalProviderAdapter } from '../strategies/local-provider/local-provider.adapter.js';
 
 /**
  * Authentication strategy registry. To add a new strategy (e.g. an OIDC external consumer

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/guards/authentication-jwt.guard.spec.ts

@@ -1,17 +1,16 @@
 /**
  * Unit test for AuthenticationJwtGuard.canActivate — none-mode shortcircuit.
  *
- * Note: testing @Auth-decorated classes via ts-jest pulls in ESM modules (cache-manager,
- * jwks-rsa) that are not transpiled and break the test runner. This test exercises the
- * guard CLASS DIRECTLY with a faked ExecutionContext, per the known ts-jest limitation
- * documented in catalyst-backend-testing SKILL.md.
+ * This test exercises the guard CLASS DIRECTLY with a faked ExecutionContext, so it
+ * needs no TestingModule and no real ConfigService/CACHE_MANAGER wiring.
  */
+import type { Mock } from 'vitest';
 import { Api } from '@aurorajs.dev/core-back';
 import { ExecutionContext } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Test } from '@nestjs/testing';
-import * as anonymousAccountModule from '../../domain/anonymous-account';
-import { AuthenticationJwtGuard } from './authentication-jwt.guard';
+import * as anonymousAccountModule from '../../domain/anonymous-account.js';
+import { AuthenticationJwtGuard } from './authentication-jwt.guard.js';
 
 // ---------------------------------------------------------------------------
 // Context factory helpers
@@ -56,10 +55,10 @@ function makeGraphqlContext(userContainer: { user?: unknown }): ExecutionContext
 
 describe('AuthenticationJwtGuard', () => {
   let guard: AuthenticationJwtGuard;
-  let configService: { get: jest.Mock };
+  let configService: { get: Mock };
 
   beforeEach(async () => {
-    configService = { get: jest.fn() };
+    configService = { get: vi.fn() };
     const module = await Test.createTestingModule({
       providers: [AuthenticationJwtGuard, { provide: ConfigService, useValue: configService }],
     }).compile();
@@ -68,7 +67,7 @@ describe('AuthenticationJwtGuard', () => {
   });
 
   afterEach(() => {
-    jest.restoreAllMocks();
+    vi.restoreAllMocks();
   });
 
   describe('mode=none — shortcircuit path', () => {
@@ -83,7 +82,7 @@ describe('AuthenticationJwtGuard', () => {
       const userContainer: { user?: unknown } = {};
       const ctx = makeHttpContext(userContainer);
 
-      const superSpy = jest
+      const superSpy = vi
         .spyOn(Object.getPrototypeOf(Object.getPrototypeOf(guard)), 'canActivate')
         .mockResolvedValue(true);
 
@@ -98,11 +97,11 @@ describe('AuthenticationJwtGuard', () => {
       const ctx = makeHttpContext(userContainer);
 
       // Mock Api.getRequestFromExecutionContext to return our container
-      jest.spyOn(Api, 'getRequestFromExecutionContext').mockReturnValue(userContainer);
+      vi.spyOn(Api, 'getRequestFromExecutionContext').mockReturnValue(userContainer);
 
       // Confirm createAnonymousAccount IS called in none mode (counterpart to the
       // local-provider negative assertion that it is NOT called).
-      const createAnonymousSpy = jest.spyOn(anonymousAccountModule, 'createAnonymousAccount');
+      const createAnonymousSpy = vi.spyOn(anonymousAccountModule, 'createAnonymousAccount');
 
       await guard.canActivate(ctx);
 
@@ -117,7 +116,7 @@ describe('AuthenticationJwtGuard', () => {
       const userContainer: { user?: unknown } = {};
       const ctx = makeGraphqlContext(userContainer);
 
-      jest.spyOn(Api, 'getRequestFromExecutionContext').mockReturnValue(userContainer);
+      vi.spyOn(Api, 'getRequestFromExecutionContext').mockReturnValue(userContainer);
 
       const result = await guard.canActivate(ctx);
 
@@ -133,7 +132,7 @@ describe('AuthenticationJwtGuard', () => {
       const ctxA = makeHttpContext(containerA);
       const ctxB = makeHttpContext(containerB);
 
-      jest
+      vi
         .spyOn(Api, 'getRequestFromExecutionContext')
         .mockReturnValueOnce(containerA)
         .mockReturnValueOnce(containerB);
@@ -157,7 +156,7 @@ describe('AuthenticationJwtGuard', () => {
       const userContainer: { user?: unknown } = {};
       const ctx = makeHttpContext(userContainer);
 
-      const superSpy = jest
+      const superSpy = vi
         .spyOn(Object.getPrototypeOf(Object.getPrototypeOf(guard)), 'canActivate')
         .mockResolvedValue(true);
 
@@ -172,9 +171,9 @@ describe('AuthenticationJwtGuard', () => {
 
       // Spy on the module-level factory so we can assert the short-circuit
       // code path (none mode) never fires when JWT mode is active.
-      const createAnonymousSpy = jest.spyOn(anonymousAccountModule, 'createAnonymousAccount');
+      const createAnonymousSpy = vi.spyOn(anonymousAccountModule, 'createAnonymousAccount');
 
-      jest
+      vi
         .spyOn(Object.getPrototypeOf(Object.getPrototypeOf(guard)), 'canActivate')
         .mockResolvedValue(true);
 

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/guards/authentication-jwt.guard.ts

@@ -3,8 +3,8 @@ import { ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/com
 import { ConfigService } from '@nestjs/config';
 import { AuthGuard } from '@nestjs/passport';
 import { Observable } from 'rxjs';
-import { createAnonymousAccount } from '../../domain/anonymous-account';
-import { resolveAuthenticationMode } from '../../domain/resolve-authentication-mode';
+import { createAnonymousAccount } from '../../domain/anonymous-account.js';
+import { resolveAuthenticationMode } from '../../domain/resolve-authentication-mode.js';
 
 @Injectable()
 export class AuthenticationJwtGuard extends AuthGuard('jwt') {

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/guards/index.ts

@@ -1,2 +1,2 @@
-export * from './authentication-jwt.guard';
-export * from './authorization-permissions.guard';
+export * from './authentication-jwt.guard.js';
+export * from './authorization-permissions.guard.js';

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/providers/hub-session-manager.provider.ts

@@ -1,6 +1,6 @@
 import type { Provider } from '@nestjs/common';
-import { HUB_SESSION_MANAGER } from '../../domain/ports';
-import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter';
+import { HUB_SESSION_MANAGER } from '../../domain/ports/index.js';
+import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter.js';
 
 /**
  * Port-to-adapter binding for the hub session manager (intra-module DI, NOT a cross-BC bridge).

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/providers/jwt-signer.provider.ts

@@ -1,6 +1,6 @@
 import type { Provider } from '@nestjs/common';
-import { JWT_SIGNER } from '../../domain/ports';
-import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter';
+import { JWT_SIGNER } from '../../domain/ports/index.js';
+import { JwtSignerAdapter } from '../strategies/local-provider/jwt-signer.adapter.js';
 
 /**
  * Port-to-adapter binding for the JWT signer (intra-module DI, NOT a cross-BC bridge).

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter.ts

@@ -6,8 +6,8 @@ import type { Cache } from 'cache-manager';
 import type { Request } from 'express';
 import { passportJwtSecret } from 'jwks-rsa';
 import { ExtractJwt, type StrategyOptionsWithRequest } from 'passport-jwt';
-import type { AuthenticatedAccount, IAuthenticationStrategy } from '../../../domain/ports';
-import { buildJwtAccountCacheKey } from '../cache-key';
+import type { AuthenticatedAccount, IAuthenticationStrategy } from '../../../domain/ports/index.js';
+import { buildJwtAccountCacheKey } from '../cache-key.js';
 
 @Injectable()
 export class AuroraHubConsumerAdapter implements IAuthenticationStrategy {
@@ -58,6 +58,7 @@ export class AuroraHubConsumerAdapter implements IAuthenticationStrategy {
             dApplicationCodes
             dPermissions
             dTenants
+            hasAddChildTenants
             meta
             roles {
               id

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/aurora-hub/index.ts

@@ -0,0 +1 @@
+export * from './aurora-hub-consumer.adapter.js';

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/authentication-cache-invalidator.adapter.spec.ts

@@ -10,21 +10,21 @@
  *   - The call is idempotent: calling del on a missing key does not throw
  *     (cache-manager's del is a no-op when the key is absent).
  *
- * ESM break: CACHE_MANAGER is a plain string token from @nestjs/cache-manager;
- * no ESM issues here. We provide it directly as a mock object literal.
+ * CACHE_MANAGER is a plain injection token from @nestjs/cache-manager; we provide
+ * it directly as a mock object literal.
  */
 
 import { CACHE_MANAGER } from '@nestjs/cache-manager';
 import { Test } from '@nestjs/testing';
-import { AuthenticationCacheInvalidatorAdapter } from './authentication-cache-invalidator.adapter';
-import { buildJwtAccountCacheKey } from './cache-key';
+import { AuthenticationCacheInvalidatorAdapter } from './authentication-cache-invalidator.adapter.js';
+import { buildJwtAccountCacheKey } from './cache-key.js';
 
 describe('AuthenticationCacheInvalidatorAdapter', () => {
   let adapter: AuthenticationCacheInvalidatorAdapter;
-  const cacheManager = { del: jest.fn() };
+  const cacheManager = { del: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
 
     const moduleRef = await Test.createTestingModule({
       providers: [

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/authentication-cache-invalidator.adapter.ts

@@ -1,8 +1,8 @@
 import { CACHE_MANAGER } from '@nestjs/cache-manager';
 import { Inject, Injectable } from '@nestjs/common';
 import type { Cache } from 'cache-manager';
-import type { IAccountCacheInvalidator } from '../../domain/ports';
-import { buildJwtAccountCacheKey } from './cache-key';
+import type { IAccountCacheInvalidator } from '../../domain/ports/index.js';
+import { buildJwtAccountCacheKey } from './cache-key.js';
 
 /**
  * Adapter: AuthenticationCacheInvalidatorAdapter

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/index.ts

@@ -8,4 +8,4 @@
  * NOT be surfaced here: `authentication` is a leaf module (HR-MODGRAPH-001) and this
  * surface stays intentionally bounded (HR-BARRELS-001).
  */
-export * from './authentication-cache-invalidator.adapter';
+export * from './authentication-cache-invalidator.adapter.js';

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/jwt-passport.strategy.ts

@@ -2,7 +2,7 @@ import { Inject, Injectable } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import type { Request } from 'express';
 import { Strategy } from 'passport-jwt';
-import { AUTHENTICATION_STRATEGY, type IAuthenticationStrategy } from '../../domain/ports';
+import { AUTHENTICATION_STRATEGY, type IAuthenticationStrategy } from '../../domain/ports/index.js';
 
 @Injectable()
 export class JwtPassportStrategy extends PassportStrategy(Strategy, 'jwt') {

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/anonymous-account-loader.adapter.spec.ts

@@ -7,8 +7,8 @@
  */
 
 import { Test } from '@nestjs/testing';
-import { createAnonymousAccount } from '../../../domain/anonymous-account';
-import { AnonymousAccountLoaderAdapter } from './anonymous-account-loader.adapter';
+import { createAnonymousAccount } from '../../../domain/anonymous-account.js';
+import { AnonymousAccountLoaderAdapter } from './anonymous-account-loader.adapter.js';
 
 describe('AnonymousAccountLoaderAdapter', () => {
   let adapter: AnonymousAccountLoaderAdapter;

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/anonymous-account-loader.adapter.ts

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
-import { createAnonymousAccount } from '../../../domain/anonymous-account';
-import type { AuthenticatedAccount, IAccountLoader } from '../../../domain/ports';
+import { createAnonymousAccount } from '../../../domain/anonymous-account.js';
+import type { AuthenticatedAccount, IAccountLoader } from '../../../domain/ports/index.js';
 
 /**
  * Framework-default implementation of `IAccountLoader` for scaffolds that have no IAM

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/jwt-signer.adapter.spec.ts

@@ -5,8 +5,8 @@ import { generateKeyPairSync, randomUUID } from 'node:crypto';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { TokenIssuanceDisabledError } from '../../../domain/errors';
-import { JwtSignerAdapter } from './jwt-signer.adapter';
+import { TokenIssuanceDisabledError } from '../../../domain/errors/index.js';
+import { JwtSignerAdapter } from './jwt-signer.adapter.js';
 
 describe('JwtSignerAdapter', () => {
   let tempDir: string;
@@ -36,7 +36,7 @@ describe('JwtSignerAdapter', () => {
 
   beforeEach(async () => {
     const config = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'local-provider';
         if (key === 'OAUTH_PRIVATE_KEY_PATH') return privateKeyPath;
         if (key === 'JWT_ACCESS_TTL_SECONDS') return 3600;
@@ -155,7 +155,7 @@ describe('JwtSignerAdapter', () => {
       rawValue: unknown,
     ): Promise<JwtSignerAdapter> => {
       const config = {
-        get: jest.fn((key: string, fallback?: unknown) => {
+        get: vi.fn((key: string, fallback?: unknown) => {
           if (key === 'OAUTH_STRATEGY') return 'local-provider';
           if (key === 'OAUTH_PRIVATE_KEY_PATH') return privateKeyPath;
           if (key === 'JWT_ACCESS_TTL_SECONDS') return 3600;
@@ -346,7 +346,7 @@ describe('JwtSignerAdapter — aurora-hub mode', () => {
 
   beforeEach(async () => {
     const configService = {
-      get: jest.fn((key: string, fallback?: unknown) => {
+      get: vi.fn((key: string, fallback?: unknown) => {
         if (key === 'OAUTH_STRATEGY') return 'aurora-hub';
         // Point the key path at a guaranteed-missing file so the test stays discriminating
         // even in a dev env where ./.keys/ exists: reverting the dormant guard would make the
@@ -411,7 +411,7 @@ describe('JwtSignerAdapter — aurora-hub mode', () => {
 
     try {
       const config = {
-        get: jest.fn((key: string, fallback?: unknown) => {
+        get: vi.fn((key: string, fallback?: unknown) => {
           if (key === 'OAUTH_STRATEGY') return 'local-provider';
           if (key === 'OAUTH_PRIVATE_KEY_PATH') return localPrivateKeyPath;
           if (key === 'JWT_ACCESS_TTL_SECONDS') return 3600;
@@ -428,7 +428,7 @@ describe('JwtSignerAdapter — aurora-hub mode', () => {
       // Reaching into the private jwtService is the only way to force a genuine signing failure —
       // it is real key material otherwise, so there is no config-level way to make signAsync reject.
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      (localAdapter as any).jwtService.signAsync = jest.fn().mockRejectedValue(signingFailure);
+      (localAdapter as any).jwtService.signAsync = vi.fn().mockRejectedValue(signingFailure);
 
       await expect(localAdapter.signAccess({ aci: 'test-id' })).rejects.toBe(signingFailure);
       await expect(localAdapter.signAccess({ aci: 'test-id' })).rejects.not.toBeInstanceOf(

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/jwt-signer.adapter.ts

@@ -3,9 +3,9 @@ import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
 import { createPublicKey, randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { TokenIssuanceDisabledError } from '../../../domain/errors';
-import type { IHubSessionManager, IJwtSigner, SignedToken } from '../../../domain/ports';
-import { resolveAuthenticationMode } from '../../../domain/resolve-authentication-mode';
+import { TokenIssuanceDisabledError } from '../../../domain/errors/index.js';
+import type { IHubSessionManager, IJwtSigner, SignedToken } from '../../../domain/ports/index.js';
+import { resolveAuthenticationMode } from '../../../domain/resolve-authentication-mode.js';
 
 const DEFAULT_SESSION_TTL_SECONDS = 28800; // 8 hours
 

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/local-provider-cache-invalidation.spec.ts

@@ -0,0 +1,84 @@
+// Deep import of the subscriber's implementation file (not a barrel): it is a hand-written
+// provider registered directly in IamModule, with no barrel entry of its own.
+import { IamAccountUpdatedCacheInvalidatorSubscriber } from '@app/iam/account/application/update/subscribers/iam-account-updated-cache-invalidator.subscriber.js';
+import { CACHE_MANAGER } from '@nestjs/cache-manager';
+import { EventEmitter2, EventEmitterModule } from '@nestjs/event-emitter';
+import { Test } from '@nestjs/testing';
+import type { Cache } from 'cache-manager';
+import { ACCOUNT_CACHE_INVALIDATOR, type AuthenticatedAccount } from '../../../domain/ports/index.js';
+import { AuthenticationCacheInvalidatorAdapter } from '../authentication-cache-invalidator.adapter.js';
+import { buildJwtAccountCacheKey } from '../cache-key.js';
+
+const ACCOUNT_ID = 'acc-1111-1111-1111-111111111111';
+const CACHE_TTL_MS = 300_000; // mirrors LocalProviderAdapter's own CACHE_TTL_MS
+
+/** Minimal in-memory stand-in for cache-manager's `Cache` — enough for get/set/del. */
+class FakeCache {
+  private readonly store = new Map<string, unknown>();
+
+  async get<T>(key: string): Promise<T | undefined> {
+    return this.store.get(key) as T | undefined;
+  }
+
+  async set(key: string, value: unknown): Promise<void> {
+    this.store.set(key, value);
+  }
+
+  async del(key: string): Promise<void> {
+    this.store.delete(key);
+  }
+}
+
+describe('local-provider cache invalidation on iam.account.updated', () => {
+  let cacheManager: Cache;
+  let eventEmitter: EventEmitter2;
+
+  beforeEach(async () => {
+    // Real EventEmitterModule + real @OnEvent wiring: this proves the actual listener
+    // registration works end to end, not a hand-rolled restatement of it.
+    const moduleRef = await Test.createTestingModule({
+      imports: [EventEmitterModule.forRoot()],
+      providers: [
+        { provide: CACHE_MANAGER, useClass: FakeCache },
+        AuthenticationCacheInvalidatorAdapter,
+        { provide: ACCOUNT_CACHE_INVALIDATOR, useExisting: AuthenticationCacheInvalidatorAdapter },
+        IamAccountUpdatedCacheInvalidatorSubscriber,
+      ],
+    }).compile();
+
+    await moduleRef.init();
+
+    cacheManager = moduleRef.get(CACHE_MANAGER);
+    eventEmitter = moduleRef.get(EventEmitter2);
+  });
+
+  it('AC #2: evicts the cached account on iam.account.updated, forcing the next validate() into a cache MISS instead of waiting out the 5-min TTL', async () => {
+    const cacheKey = buildJwtAccountCacheKey(ACCOUNT_ID);
+    const oldCachedAccount = {
+      id: ACCOUNT_ID,
+      dPermissions: { all: ['old.permission'] },
+    } as unknown as AuthenticatedAccount;
+
+    // (a) Seed the cache exactly like LocalProviderAdapter.validate() does on a cache miss.
+    await cacheManager.set(cacheKey, oldCachedAccount, CACHE_TTL_MS);
+
+    // (b) Sanity check: the OLD snapshot is what a concurrent request would still see.
+    await expect(cacheManager.get(cacheKey)).resolves.toEqual(oldCachedAccount);
+
+    // (c) The scope-narrowing update, shaped exactly like IamUpdateAccountByIdHandler's
+    // @EmitEvent('iam.account.updated') emission (single IamAccount, no returnInputPayload).
+    eventEmitter.emit('iam.account.updated', {
+      payload: { id: ACCOUNT_ID, dPermissions: { all: [] } },
+      meta: { timestamp: Date.now() },
+    });
+
+    // Let the async @OnEvent handler settle (EventEmitter2 dispatches async listeners
+    // fire-and-forget by default; awaiting a microtask tick is enough since the handler's
+    // own await chain is a single `cacheManager.del` call against the in-memory fake).
+    await new Promise((resolve) => setImmediate(resolve));
+
+    // (d) The next `validate()` call for this account is now forced into a cache MISS —
+    // this is the exact mechanism AC #2 relies on to see the new scope immediately.
+    await expect(cacheManager.get(cacheKey)).resolves.toBeUndefined();
+  });
+});

package/dist/templates/backend/application/src/@aurora/modules/authentication/infrastructure/strategies/local-provider/local-provider.adapter.spec.ts

@@ -1,11 +1,12 @@
+import type { Mock } from 'vitest';
 import { CACHE_MANAGER } from '@nestjs/cache-manager';
 import { ConfigService } from '@nestjs/config';
 import { Test, TestingModule } from '@nestjs/testing';
 import type { Request } from 'express';
 import { randomUUID } from 'node:crypto';
-import { ACCOUNT_LOADER, type AuthenticatedAccount } from '../../../domain/ports';
-import { buildJwtAccountCacheKey } from '../cache-key';
-import { LocalProviderAdapter } from './local-provider.adapter';
+import { ACCOUNT_LOADER, type AuthenticatedAccount } from '../../../domain/ports/index.js';
+import { buildJwtAccountCacheKey } from '../cache-key.js';
+import { LocalProviderAdapter } from './local-provider.adapter.js';
 
 /** Builds a fake AuthenticatedAccount as IAccountLoader.loadById would return it — plain,
  * undecorated, with `impersonatedBy` defaulted to null (never set by the loader itself). */
@@ -19,6 +20,7 @@ const buildFakeAccount = (id: string): AuthenticatedAccount => ({
   dApplicationCodes: [],
   dPermissions: { all: [] },
   dTenants: [],
+  hasAddChildTenants: false,
   meta: null,
   roles: [],
   tenants: [],
@@ -31,19 +33,19 @@ const buildFakeAccount = (id: string): AuthenticatedAccount => ({
 
 describe('LocalProviderAdapter', () => {
   let adapter: LocalProviderAdapter;
-  let cacheManager: { get: jest.Mock; set: jest.Mock };
-  let accountLoader: { loadById: jest.Mock };
+  let cacheManager: { get: Mock; set: Mock };
+  let accountLoader: { loadById: Mock };
   const fakeRequest = {} as Request;
 
   beforeEach(async () => {
-    cacheManager = { get: jest.fn().mockResolvedValue(undefined), set: jest.fn() };
-    accountLoader = { loadById: jest.fn() };
+    cacheManager = { get: vi.fn().mockResolvedValue(undefined), set: vi.fn() };
+    accountLoader = { loadById: vi.fn() };
 
     const config = {
       // OAUTH_STRATEGY intentionally NOT 'local-provider': skips the constructor's
       // readFileSync(publicKeyPath) — irrelevant to validate(), which never reads
       // this.publicKey. Keeps this suite filesystem-free.
-      get: jest.fn((_key: string, fallback?: unknown) => fallback),
+      get: vi.fn((_key: string, fallback?: unknown) => fallback),
     };
 
     const module: TestingModule = await Test.createTestingModule({