@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/hub/src/@api/hub/hub-per-app-permission.seeder.ts

@@ -21,17 +21,17 @@
  * MANUALLY MAINTAINED — H2.5, design D6 (boot reconciliation).
  */
 // From @app/iam/shared (leaf constants), NOT @api/iam/iam-bootstrap.seeder: that
-// reverse-layer import (@app → @api) closed a module-load cycle under Jest's
-// ordering — NestJS surfaced it as "A circular dependency has been detected
-// inside HubModule" (an undefined entry in HubModule's providers array).
-import { HubGetAppsService } from '@app/hub/app';
-import { hubAppAccessPermissionName } from '@app/hub/app/domain';
-import { BOOTSTRAP_ADMIN_ROLE_ID } from '@app/iam/shared';
-import { bootstrapSeederIsEnabled } from '@aurora/services';
-import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context';
-import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
-import type { IIamPermissionWriter } from '@bridges/iam/permission';
-import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
+// reverse-layer import (@app → @api) closes a module-load cycle — NestJS surfaces
+// it as "A circular dependency has been detected inside HubModule" (an undefined
+// entry in HubModule's providers array).
+import { HubGetAppsService } from '@app/hub/app/index.js';
+import { hubAppAccessPermissionName } from '@app/hub/app/domain/index.js';
+import { BOOTSTRAP_ADMIN_ROLE_ID } from '@app/iam/shared/index.js';
+import { bootstrapSeederIsEnabled } from '@aurora/services/index.js';
+import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context/index.js';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context/index.js';
+import type { IIamPermissionWriter } from '@bridges/iam/permission/index.js';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission/index.js';
 import { Inject, Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';
 

package/dist/templates/backend/packages/hub/src/@api/hub/hub.module.ts

@@ -6,13 +6,13 @@
  *   - HubPerAppPermissionSeeder: boot migration seeder for H2.5 per-app IAM provisioning.
  *     Registered directly in providers so it has access to HubModule's own services.
  */
-import { HubHandlers, HubRepositories, HubServices } from '@app/hub';
-import { SharedModule } from '@aurora/shared.module';
+import { HubHandlers, HubRepositories, HubServices } from '@app/hub/index.js';
+import { SharedModule } from '@aurora/shared.module.js';
 import { Module } from '@nestjs/common';
-import { HubAppApiControllers, HubAppApiResolvers } from './app';
-import { HubAppAccountApiControllers, HubAppAccountApiResolvers } from './app-account';
-import { HubPerAppPermissionSeeder } from './hub-per-app-permission.seeder';
-import { HubSeeder } from './hub.seeder';
+import { HubAppApiControllers, HubAppApiResolvers } from './app/index.js';
+import { HubAppAccountApiControllers, HubAppAccountApiResolvers } from './app-account/index.js';
+import { HubPerAppPermissionSeeder } from './hub-per-app-permission.seeder.js';
+import { HubSeeder } from './hub.seeder.js';
 
 @Module({
   imports: [SharedModule],

package/dist/templates/backend/packages/hub/src/@api/hub/hub.seeder.ts

@@ -2,12 +2,12 @@
  * @aurora-catalyst-generated
  * @source cliter/hub
  */
-import { boundedContexts, permissions } from '@app/hub/hub.seed';
+import { boundedContexts, permissions } from '@app/hub/hub.seed.js';
 import {
   IAM_BOUNDED_CONTEXT_SEEDER,
   type IIamBoundedContextSeeder,
-} from '@bridges/iam/bounded-context/ports';
-import { IAM_PERMISSION_SEEDER, type IIamPermissionSeeder } from '@bridges/iam/permission/ports';
+} from '@bridges/iam/bounded-context/ports/index.js';
+import { IAM_PERMISSION_SEEDER, type IIamPermissionSeeder } from '@bridges/iam/permission/ports/index.js';
 import { Inject, Injectable, OnApplicationBootstrap } from '@nestjs/common';
 
 @Injectable()
@@ -21,13 +21,13 @@ export class HubSeeder implements OnApplicationBootstrap {
 
   async onApplicationBootstrap(): Promise<void> {
     await this.boundedContextSeeder.seedAll(boundedContexts, {
-      conflictUpdateFields: ['name', 'sort', 'isActive'],
       conflictTarget: ['root'],
+      conflictUpdateFields: ['name', 'sort', 'isActive'],
     });
 
     void this.permissionSeeder.seedAll(permissions, {
-      conflictUpdateFields: ['boundedContextId'],
       conflictTarget: ['name'],
+      conflictUpdateFields: ['boundedContextId'],
     });
   }
 }

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/create/hub-create-app.handler.spec.ts

@@ -5,57 +5,74 @@
 //
 // Design constraints respected:
 //   - Testing the HANDLER directly (not the @Auth-decorated resolver/controller).
-//     The Auth module drags ESM into ts-jest; see Jest+@Auth ESM limitation.
 //   - @EmitEvent and @ApplySchema fire inside TestingModule; provide EventEmitter2 mock.
 //   - Sequelize.transaction is mocked to run the callback synchronously.
 //   - Both writer ports injected via Symbol tokens (IAM_PERMISSION_WRITER / IAM_BOUNDED_CONTEXT_WRITER).
 //
-// ESM cascade: @app/hub/app → @app/hub/app/domain → hub-app.field-schema.ts →
-//   @app/o-auth/application (field-schema) → @aurorajs.dev/core-back → core-back ESM.
-
-jest.mock('@api/graphql', () => ({}));
+// Dependency-isolation mocking below: @app/hub/app → @app/hub/app/domain →
+//   hub-app.field-schema.ts → @app/o-auth/application (field-schema) →
+//   @aurorajs.dev/core-back pulls a heavy dependency graph this unit test does not need.
+
+// HubApp/HubAppCredentials/HubCreateAppInput are used only as TYPE annotations in the
+// handler, but esbuild's single-file transform cannot tell type-only usage from value
+// usage on a plain (non `import type`) specifier, so it keeps the import as a real
+// binding that must resolve at runtime.
+vi.mock('@api/graphql.js', () => ({
+  HubApp: class HubApp {},
+  HubAppCredentials: class HubAppCredentials {},
+  HubCreateAppInput: class HubCreateAppInput {},
+}));
 // The handler deep-imports its services (cycle-proofing — see the handler's
 // import comment), so the DEEP paths carry the canonical stub classes; the
 // barrel mock ALIASES them (same class identity) because the spec's DI
 // providers reference the classes via the barrel — two distinct classes would
 // break Nest's paramtype-token matching ("can't resolve dependencies").
-jest.mock('@app/hub/app/application/create/hub-create-app.service', () => ({
+vi.mock('@app/hub/app/application/create/hub-create-app.service.js', () => ({
   HubCreateAppService: class HubCreateAppService {},
 }));
-jest.mock('@app/hub/app/application/find/hub-find-app-by-id.service', () => ({
+vi.mock('@app/hub/app/application/find/hub-find-app-by-id.service.js', () => ({
   HubFindAppByIdService: class HubFindAppByIdService {},
 }));
-jest.mock('@app/hub/app', () => ({
-  HubCreateAppService: jest.requireMock('@app/hub/app/application/create/hub-create-app.service')
-    .HubCreateAppService,
-  HubFindAppByIdService: jest.requireMock(
-    '@app/hub/app/application/find/hub-find-app-by-id.service',
-  ).HubFindAppByIdService,
-}));
-// Prevent the field-schema cascade, but expose domain helpers the handler needs
-jest.mock('@app/hub/app/domain', () => ({
+vi.mock('@app/hub/app/index.js', async () => {
+  const createMod = await vi.importMock<
+    typeof import('@app/hub/app/application/create/hub-create-app.service.js')
+  >('@app/hub/app/application/create/hub-create-app.service.js');
+  const findMod = await vi.importMock<
+    typeof import('@app/hub/app/application/find/hub-find-app-by-id.service.js')
+  >('@app/hub/app/application/find/hub-find-app-by-id.service.js');
+  return {
+    HubCreateAppService: createMod.HubCreateAppService,
+    HubFindAppByIdService: findMod.HubFindAppByIdService,
+  };
+});
+// Prevent the field-schema cascade, but expose domain helpers the handler needs.
+// HubAppFieldSchema must still be present: Vitest's ESM-backed mocking throws on an export
+// the factory did not return (unlike Jest's silent undefined), and @ApplySchema reads it.
+vi.mock('@app/hub/app/domain/index.js', () => ({
+  HubAppFieldSchema: [],
   hubAppAccessPermissionName: (code: string) => `hub.app.${code}.access`,
 }));
-jest.mock('@aurorajs.dev/core-back', () => ({
+vi.mock('@aurorajs.dev/core-back', () => ({
   ApplySchema: () => (_t: unknown, _k: unknown, d: unknown) => d,
   EmitEvent: () => (_t: unknown, _k: unknown, d: unknown) => d,
   HandlerMeta: class {},
   DRIZZLE_CONNECTION: 'AURORA_DRIZZLE_CONNECTION',
 }));
 // Mock writer ports tokens (Symbol constants) to avoid import resolution issues
-jest.mock('@bridges/iam/permission', () => ({
+vi.mock('@bridges/iam/permission/index.js', () => ({
   IAM_PERMISSION_WRITER: 'IAM_PERMISSION_WRITER',
 }));
-jest.mock('@bridges/iam/bounded-context', () => ({
+vi.mock('@bridges/iam/bounded-context/index.js', () => ({
   IAM_BOUNDED_CONTEXT_WRITER: 'IAM_BOUNDED_CONTEXT_WRITER',
 }));
 
-import { HubCreateAppInput } from '@api/graphql';
-import { HubCreateAppService, HubFindAppByIdService } from '@app/hub/app';
+import type { Mock } from 'vitest';
+import { HubCreateAppInput } from '@api/graphql.js';
+import { HubCreateAppService, HubFindAppByIdService } from '@app/hub/app/index.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
-import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
-import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
-import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context/index.js';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission/index.js';
+import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application/index.js';
 import {
   BadRequestException,
   ConflictException,
@@ -63,7 +80,7 @@ import {
 } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubCreateAppHandler } from './hub-create-app.handler';
+import { HubCreateAppHandler } from './hub-create-app.handler.js';
 
 // ——— Test data ———————————————————————————————————————————————————————————————
 
@@ -91,21 +108,21 @@ const buildPayload = (overrides: Partial<HubCreateAppInput> = {}): HubCreateAppI
 
 describe('HubCreateAppHandler', () => {
   let handler: HubCreateAppHandler;
-  let createService: { main: jest.Mock };
-  let findByIdService: { main: jest.Mock };
-  let provisioner: { provision: jest.Mock };
-  let eventEmitter: { emit: jest.Mock };
-  let db: { transaction: jest.Mock };
+  let createService: { main: Mock };
+  let findByIdService: { main: Mock };
+  let provisioner: { provision: Mock };
+  let eventEmitter: { emit: Mock };
+  let db: { transaction: Mock };
   let permissionWriter: {
-    createForBoundedContext: jest.Mock;
-    findIdByName: jest.Mock;
-    deleteByName: jest.Mock;
-    attachToBootstrapAdminRole: jest.Mock;
+    createForBoundedContext: Mock;
+    findIdByName: Mock;
+    deleteByName: Mock;
+    attachToBootstrapAdminRole: Mock;
   };
   let boundedContextWriter: {
-    createForApp: jest.Mock;
-    findIdByName: jest.Mock;
-    deleteByName: jest.Mock;
+    createForApp: Mock;
+    findIdByName: Mock;
+    deleteByName: Mock;
   };
 
   const fakeTransaction = Symbol('t') as any;
@@ -113,12 +130,12 @@ describe('HubCreateAppHandler', () => {
   beforeEach(async () => {
     // Run the callback immediately with a fake Drizzle tx handle (callback-scoped)
     db = {
-      transaction: jest.fn().mockImplementation(async (cb: (t: unknown) => Promise<unknown>) => {
+      transaction: vi.fn().mockImplementation(async (cb: (t: unknown) => Promise<unknown>) => {
         return cb(fakeTransaction);
       }),
     };
 
-    createService = { main: jest.fn().mockResolvedValue(undefined) };
+    createService = { main: vi.fn().mockResolvedValue(undefined) };
 
     // Return a FAKE SEQUELIZE MODEL: data lives in `dataValues`; `toJSON()` returns only that.
     const fakeAppDataValues = {
@@ -135,29 +152,29 @@ describe('HubCreateAppHandler', () => {
       },
     };
     findByIdService = {
-      main: jest.fn().mockResolvedValue(fakeAppModel),
+      main: vi.fn().mockResolvedValue(fakeAppModel),
     };
     provisioner = {
-      provision: jest.fn().mockResolvedValue({
+      provision: vi.fn().mockResolvedValue({
         applicationId: APP_APPLICATION_ID,
         code: 'my-app',
         secret: FIXED_SECRET,
         redirectUri: 'https://my-app.example.com/auth/callback',
       }),
     };
-    eventEmitter = { emit: jest.fn() };
+    eventEmitter = { emit: vi.fn() };
 
     // Writer ports — by default no collision (findIdByName returns null)
     permissionWriter = {
-      createForBoundedContext: jest.fn().mockResolvedValue(undefined),
-      findIdByName: jest.fn().mockResolvedValue(null),
-      deleteByName: jest.fn().mockResolvedValue(undefined),
-      attachToBootstrapAdminRole: jest.fn().mockResolvedValue(undefined),
+      createForBoundedContext: vi.fn().mockResolvedValue(undefined),
+      findIdByName: vi.fn().mockResolvedValue(null),
+      deleteByName: vi.fn().mockResolvedValue(undefined),
+      attachToBootstrapAdminRole: vi.fn().mockResolvedValue(undefined),
     };
     boundedContextWriter = {
-      createForApp: jest.fn().mockResolvedValue(undefined),
-      findIdByName: jest.fn().mockResolvedValue(null),
-      deleteByName: jest.fn().mockResolvedValue(undefined),
+      createForApp: vi.fn().mockResolvedValue(undefined),
+      findIdByName: vi.fn().mockResolvedValue(null),
+      deleteByName: vi.fn().mockResolvedValue(undefined),
     };
 
     // Set APP_URL for hubServerUrl resolution

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/create/hub-create-app.handler.ts

@@ -2,16 +2,16 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubApp, HubAppCredentials, HubCreateAppInput } from '@api/graphql';
+import { HubApp, HubAppCredentials, HubCreateAppInput } from '@api/graphql.js';
 // Deep service imports (NOT the '@app/hub/app' barrel): this handler is
 // deep-imported FIRST by the hub e2e specs; a self-barrel import makes the
 // barrel evaluate mid-handler-initialization and freeze `undefined` into
 // HubAppHandlers — NestJS then throws the misleading "circular dependency
 // detected inside HubModule" at TestingModule.compile().
-import { HubCreateAppService } from '@app/hub/app/application/create/hub-create-app.service';
-import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service';
-import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain';
-import { hubValidateRedirectUri } from '@app/hub/app/shared';
+import { HubCreateAppService } from '@app/hub/app/application/create/hub-create-app.service.js';
+import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service.js';
+import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain/index.js';
+import { hubValidateRedirectUri } from '@app/hub/app/shared/index.js';
 import {
   ApplySchema,
   DRIZZLE_CONNECTION,
@@ -19,12 +19,12 @@ import {
   HandlerMeta,
   QueryStatement,
 } from '@aurorajs.dev/core-back';
-import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context';
-import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
-import type { IIamPermissionWriter } from '@bridges/iam/permission';
-import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
-import type { IOAuthApplicationProvisioner } from '@bridges/o-auth/application';
-import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application';
+import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context/index.js';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context/index.js';
+import type { IIamPermissionWriter } from '@bridges/iam/permission/index.js';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission/index.js';
+import type { IOAuthApplicationProvisioner } from '@bridges/o-auth/application/index.js';
+import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application/index.js';
 import {
   BadRequestException,
   ConflictException,
@@ -64,7 +64,7 @@ export class HubCreateAppHandler {
   ) {}
 
   @EmitEvent('hub.app.created')
-  @ApplySchema(HubAppFieldSchema)
+  @ApplySchema({ schema: HubAppFieldSchema, operation: 'create' })
   async main(payload: HubCreateAppInput, handlerMeta?: HandlerMeta): Promise<HubApp> {
     /* #region customizations */
     // Field-schema `rules` do not support pattern/regex today (handler-only).

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/create/hub-create-app.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubCreateAppInput } from '@api/graphql';
-import { HubDrizzleAppRepository } from '@app/hub/app';
+import { HubCreateAppInput } from '@api/graphql.js';
+import { HubDrizzleAppRepository } from '@app/hub/app/infrastructure/drizzle/hub-drizzle-app.repository.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/delete/hub-delete-app-by-id.handler.spec.ts

@@ -1,7 +1,6 @@
 // TDD — RED→GREEN for HubDeleteAppByIdHandler (add-hub-app-deprovisioning, design D6)
 //
 // Strategy: test the HANDLER directly, NOT the @Auth-decorated resolver/controller.
-// (Jest+@Auth ESM limitation — project memory reference_jest_auth_esm_limitation)
 //
 // The handler opens a Drizzle transaction (callback-scoped), resolves the app first (NotFound before TX),
 // then inside the TX: deprovision → deleteById. Any throw rolls back.
@@ -11,52 +10,56 @@
 //   be provided. @Format(HubAppFieldSchema) also wraps main(); the return value is
 //   serialized through the schema (fields not masked → no issue for HubApp identity fields).
 
-// — jest.mock hoisting (ESM workarounds) ————————————————————————————————————
-jest.mock('@api/graphql', () => ({}));
+// — vi.mock hoisting (dependency-isolation mocking) —————————————————————————
+vi.mock('@api/graphql.js', () => ({}));
 // The handler deep-imports its services (cycle-proofing — see the handler's
 // import comment), so the DEEP paths carry the canonical stub classes; the
 // barrel mock ALIASES them (same class identity) because the spec's DI
 // providers reference the classes via the barrel — two distinct classes would
 // break Nest's paramtype-token matching ("can't resolve dependencies").
-jest.mock('@app/hub/app/application/delete/hub-delete-app-by-id.service', () => ({
+vi.mock('@app/hub/app/application/delete/hub-delete-app-by-id.service.js', () => ({
   HubDeleteAppByIdService: class HubDeleteAppByIdService {},
 }));
-jest.mock('@app/hub/app/application/find/hub-find-app-by-id.service', () => ({
+vi.mock('@app/hub/app/application/find/hub-find-app-by-id.service.js', () => ({
   HubFindAppByIdService: class HubFindAppByIdService {},
 }));
-jest.mock('@app/hub/app', () => ({
-  HubDeleteAppByIdService: jest.requireMock(
-    '@app/hub/app/application/delete/hub-delete-app-by-id.service',
-  ).HubDeleteAppByIdService,
-  HubFindAppByIdService: jest.requireMock(
-    '@app/hub/app/application/find/hub-find-app-by-id.service',
-  ).HubFindAppByIdService,
-}));
-jest.mock('@app/hub/app/domain', () => ({
+vi.mock('@app/hub/app/index.js', async () => {
+  const deleteMod = await vi.importMock<
+    typeof import('@app/hub/app/application/delete/hub-delete-app-by-id.service.js')
+  >('@app/hub/app/application/delete/hub-delete-app-by-id.service.js');
+  const findMod = await vi.importMock<
+    typeof import('@app/hub/app/application/find/hub-find-app-by-id.service.js')
+  >('@app/hub/app/application/find/hub-find-app-by-id.service.js');
+  return {
+    HubDeleteAppByIdService: deleteMod.HubDeleteAppByIdService,
+    HubFindAppByIdService: findMod.HubFindAppByIdService,
+  };
+});
+vi.mock('@app/hub/app/domain/index.js', () => ({
   HubAppFieldSchema: [],
   hubAppAccessPermissionName: (code: string) => `hub.app.${code}.access`,
 }));
-jest.mock('@bridges/o-auth/application', () => ({
+vi.mock('@bridges/o-auth/application/index.js', () => ({
   IOAuthApplicationProvisioner: class IOAuthApplicationProvisioner {},
   OAUTH_APPLICATION_PROVISIONER: 'OAUTH_APPLICATION_PROVISIONER',
 }));
-jest.mock('@bridges/iam/permission', () => ({
+vi.mock('@bridges/iam/permission/index.js', () => ({
   IAM_PERMISSION_WRITER: 'IAM_PERMISSION_WRITER',
 }));
-jest.mock('@bridges/iam/bounded-context', () => ({
+vi.mock('@bridges/iam/bounded-context/index.js', () => ({
   IAM_BOUNDED_CONTEXT_WRITER: 'IAM_BOUNDED_CONTEXT_WRITER',
 }));
 
 // — imports ——————————————————————————————————————————————————————————————————
-import { HubDeleteAppByIdService, HubFindAppByIdService } from '@app/hub/app';
+import { HubDeleteAppByIdService, HubFindAppByIdService } from '@app/hub/app/index.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
-import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
-import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
-import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application';
-import { NotFoundException } from '@nestjs/common';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context/index.js';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission/index.js';
+import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application/index.js';
+import { ForbiddenException, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubDeleteAppByIdHandler } from './hub-delete-app-by-id.handler';
+import { HubDeleteAppByIdHandler } from './hub-delete-app-by-id.handler.js';
 
 // ─── helpers ────────────────────────────────────────────────────────────────
 
@@ -89,32 +92,32 @@ describe('HubDeleteAppByIdHandler', () => {
   let handler: HubDeleteAppByIdHandler;
 
   // mocks
-  const mockEventEmitter = { emit: jest.fn() };
-  const mockFindByIdService = { main: jest.fn() };
-  const mockDeleteByIdService = { main: jest.fn() };
-  const mockProvisioner = { deprovision: jest.fn() };
+  const mockEventEmitter = { emit: vi.fn() };
+  const mockFindByIdService = { main: vi.fn() };
+  const mockDeleteByIdService = { main: vi.fn() };
+  const mockProvisioner = { deprovision: vi.fn() };
   const mockPermissionWriter = {
-    createForBoundedContext: jest.fn(),
-    findIdByName: jest.fn(),
-    deleteByName: jest.fn(),
-    attachToRole: jest.fn(),
+    createForBoundedContext: vi.fn(),
+    findIdByName: vi.fn(),
+    deleteByName: vi.fn(),
+    attachToRole: vi.fn(),
   };
   const mockBoundedContextWriter = {
-    createForApp: jest.fn(),
-    findIdByName: jest.fn(),
-    deleteByName: jest.fn(),
+    createForApp: vi.fn(),
+    findIdByName: vi.fn(),
+    deleteByName: vi.fn(),
   };
 
   // db.transaction mock (Drizzle callback-scoped tx): runs the callback synchronously
   const mockTransaction = Symbol('tx');
   const mockDb = {
-    transaction: jest.fn().mockImplementation(async (cb: (t: any) => Promise<any>) => {
+    transaction: vi.fn().mockImplementation(async (cb: (t: any) => Promise<any>) => {
       return cb(mockTransaction);
     }),
   };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
 
     mockFindByIdService.main.mockResolvedValue(buildApp());
     mockDeleteByIdService.main.mockResolvedValue(undefined);
@@ -194,6 +197,32 @@ describe('HubDeleteAppByIdHandler', () => {
     }
   });
 
+  // ─── Security (close-hub-accounts-query-oracle): a reference to `accounts` is an
+  //     EXISTS oracle over IamAccount — rejected with a 403 before ANY read, write, or
+  //     transaction is opened. ────────────────────────────────────────────────
+
+  it('(oracle-1) rejects an accounts reference in constraint with 403, opens no transaction, calls no service', async () => {
+    const rejection = await handler
+      .main(
+        APP_ID,
+        { where: { 'accounts.email': { eq: 'user@example.test' } } },
+        buildHandlerMeta(),
+      )
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts.email', aggregate: 'HubApp' },
+    });
+    expect(mockFindByIdService.main).not.toHaveBeenCalled();
+    expect(mockDb.transaction).not.toHaveBeenCalled();
+    expect(mockProvisioner.deprovision).not.toHaveBeenCalled();
+    expect(mockDeleteByIdService.main).not.toHaveBeenCalled();
+    expect(mockPermissionWriter.deleteByName).not.toHaveBeenCalled();
+    expect(mockBoundedContextWriter.deleteByName).not.toHaveBeenCalled();
+  });
+
   // ─── (a) success path ──────────────────────────────────────────────────────
 
   it('(a) reads the app, calls deprovision then deleteByIdService inside ONE transaction', async () => {

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/delete/hub-delete-app-by-id.handler.ts

@@ -30,14 +30,15 @@
  *
  * @see openspec/changes/add-hub-app-deprovisioning/design.md — decisions D2, D4, D6
  */
-import { HubApp } from '@api/graphql';
+import { HubApp } from '@api/graphql.js';
 // Deep service imports (NOT the '@app/hub/app' barrel) — see
 // hub-create-app.handler.ts: self-barrel imports break under the hub e2e
 // specs' deep-import-first module order (undefined entry in HubAppHandlers).
-import { HubDeleteAppByIdService } from '@app/hub/app/application/delete/hub-delete-app-by-id.service';
-import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service';
-import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain';
-import { hubSanitizeEagerLoads } from '@app/hub/app/shared/functions/hub-sanitize-eager-loads.function';
+import { HubDeleteAppByIdService } from '@app/hub/app/application/delete/hub-delete-app-by-id.service.js';
+import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service.js';
+import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain/index.js';
+import { hubAssertNoAccountsReference } from '@app/hub/app/shared/functions/hub-assert-no-accounts-reference.function.js';
+import { hubSanitizeEagerLoads } from '@app/hub/app/shared/functions/hub-sanitize-eager-loads.function.js';
 import {
   DRIZZLE_CONNECTION,
   EmitEvent,
@@ -45,12 +46,12 @@ import {
   HandlerMeta,
   QueryStatement,
 } from '@aurorajs.dev/core-back';
-import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context';
-import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
-import type { IIamPermissionWriter } from '@bridges/iam/permission';
-import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
-import type { IOAuthApplicationProvisioner } from '@bridges/o-auth/application';
-import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application';
+import type { IIamBoundedContextWriter } from '@bridges/iam/bounded-context/index.js';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context/index.js';
+import type { IIamPermissionWriter } from '@bridges/iam/permission/index.js';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission/index.js';
+import type { IOAuthApplicationProvisioner } from '@bridges/o-auth/application/index.js';
+import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application/index.js';
 import { Inject, Injectable, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 
@@ -87,6 +88,10 @@ export class HubDeleteAppByIdHandler {
   @EmitEvent('hub.app.deleted')
   @Format(HubAppFieldSchema)
   async main(id: string, constraint?: QueryStatement, handlerMeta?: HandlerMeta): Promise<HubApp> {
+    // Reject before sanitizing, and before the transaction below: a reference to `accounts` is an
+    // EXISTS oracle over IamAccount, and a rejected delete must leave no side effect behind.
+    hubAssertNoAccountsReference(constraint);
+
     // SECURITY DIVERGENCE — do NOT remove on regeneration. `constraint` is sanitised the same way
     // the four hub/app READ paths sanitise it (BR-HUB-APP-003). The omission was harmless only
     // while `application` was the sole cross-BC relation, whose `secret` is `type: 'password'`

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/delete/hub-delete-app-by-id.service.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubDrizzleAppRepository } from '@app/hub/app';
+import { HubDrizzleAppRepository } from '@app/hub/app/infrastructure/drizzle/hub-drizzle-app.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';