@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app-by-id.handler.spec.ts

@@ -8,38 +8,55 @@
  *   HubFindAppByIdHandler is another hub/app read path and must apply the SAME
  *   strip to its `constraint` argument uniformly.
  *
- * ESM cascade workaround — same jest.mock pattern as hub-get-apps.handler.spec.ts.
+ * Dependency-isolation mocking — same vi.mock pattern as hub-get-apps.handler.spec.ts.
  */
 
-jest.mock('@api/graphql', () => ({}));
-jest.mock('@app/hub/app', () => ({
+vi.mock('@api/graphql.js', () => ({}));
+vi.mock('@app/hub/app/application/find/hub-find-app-by-id.service.js', () => ({
   HubFindAppByIdService: class HubFindAppByIdService {},
 }));
-jest.mock('@app/hub/app/domain', () => ({}));
-jest.mock('@app/hub/app/shared', () => ({
-  hubSanitizeEagerLoads: jest.requireActual(
-    '@app/hub/app/shared/functions/hub-sanitize-eager-loads.function',
-  ).hubSanitizeEagerLoads,
-}));
-jest.mock('@aurorajs.dev/core-back', () => ({
-  Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
-  HandlerMeta: class {},
-  QueryStatement: class QueryStatement {},
-}));
+// The handler statically imports HubAppFieldSchema from this module for @Format; Vitest's
+// ESM-backed mocking throws on an export the factory did not return (unlike Jest's silent
+// undefined), so an empty stub is not enough here.
+vi.mock('@app/hub/app/domain/index.js', () => ({ HubAppFieldSchema: [] }));
+vi.mock('@app/hub/app/shared/index.js', async () => {
+  const assertMod = await vi.importActual<
+    typeof import('@app/hub/app/shared/functions/hub-assert-no-accounts-reference.function.js')
+  >('@app/hub/app/shared/functions/hub-assert-no-accounts-reference.function');
+  const sanitizeMod = await vi.importActual<
+    typeof import('@app/hub/app/shared/functions/hub-sanitize-eager-loads.function.js')
+  >('@app/hub/app/shared/functions/hub-sanitize-eager-loads.function');
+  return {
+    hubAssertNoAccountsReference: assertMod.hubAssertNoAccountsReference,
+    hubSanitizeEagerLoads: sanitizeMod.hubSanitizeEagerLoads,
+  };
+});
+vi.mock('@aurorajs.dev/core-back', async () => {
+  const actual =
+    await vi.importActual<typeof import('@aurorajs.dev/core-back')>('@aurorajs.dev/core-back');
+  return {
+    Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
+    HandlerMeta: class {},
+    QueryStatement: class QueryStatement {},
+    // The real DSL constants hubAssertNoAccountsReference walks with — re-exported, not copied.
+    DEFAULT_MAX_DEPTH: actual.DEFAULT_MAX_DEPTH,
+    LOGICAL_OPERATOR: actual.LOGICAL_OPERATOR,
+  };
+});
 
-import { HubFindAppByIdService } from '@app/hub/app';
-import { NotFoundException } from '@nestjs/common';
+import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service.js';
+import { ForbiddenException, NotFoundException } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubFindAppByIdHandler } from './hub-find-app-by-id.handler';
+import { HubFindAppByIdHandler } from './hub-find-app-by-id.handler.js';
 
 const handlerMeta = { timezone: 'UTC', repositoryOptions: { auditing: null } };
 
 describe('HubFindAppByIdHandler — include/relations-stripping security fix (ITEM 2)', () => {
   let handler: HubFindAppByIdHandler;
-  const findByIdService = { main: jest.fn() };
+  const findByIdService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     findByIdService.main.mockResolvedValue({ id: '1', code: 'myapp' });
 
     const moduleRef: TestingModule = await Test.createTestingModule({
@@ -96,4 +113,20 @@ describe('HubFindAppByIdHandler — include/relations-stripping security fix (IT
       NotFoundException,
     );
   });
+
+  // ── Security (close-hub-accounts-query-oracle): a reference to `accounts` is an
+  //    EXISTS oracle over IamAccount — rejected with a 403 before the service runs. ──
+
+  it('(oracle-1) rejects an accounts reference in constraint with 403 and never calls the service', async () => {
+    const rejection = await handler
+      .main('1', { where: { 'accounts.email': { eq: 'user@example.test' } } }, handlerMeta)
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts.email', aggregate: 'HubApp' },
+    });
+    expect(findByIdService.main).not.toHaveBeenCalled();
+  });
 });

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app-by-id.handler.ts

@@ -8,10 +8,10 @@
  * a client cannot eager-load OAuthApplication through this path either
  * (F3 security review, ITEM 2).
  */
-import { HubApp } from '@api/graphql';
-import { HubFindAppByIdService } from '@app/hub/app';
-import { HubAppFieldSchema } from '@app/hub/app/domain';
-import { hubSanitizeEagerLoads } from '@app/hub/app/shared';
+import { HubApp } from '@api/graphql.js';
+import { HubFindAppByIdService } from '@app/hub/app/application/find/hub-find-app-by-id.service.js';
+import { HubAppFieldSchema } from '@app/hub/app/domain/index.js';
+import { hubAssertNoAccountsReference, hubSanitizeEagerLoads } from '@app/hub/app/shared/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 
@@ -21,6 +21,9 @@ export class HubFindAppByIdHandler {
 
   @Format(HubAppFieldSchema)
   async main(id: string, constraint?: QueryStatement, handlerMeta?: HandlerMeta): Promise<HubApp> {
+    // Reject before sanitizing: a reference to `accounts` is an EXISTS oracle over IamAccount.
+    hubAssertNoAccountsReference(constraint);
+
     const app = await this.findByIdService.main(id, hubSanitizeEagerLoads(constraint), handlerMeta);
 
     if (!app) {

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app-by-id.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubApp } from '@api/graphql';
-import { HubDrizzleAppRepository } from '@app/hub/app';
+import { HubApp } from '@api/graphql.js';
+import { HubDrizzleAppRepository } from '@app/hub/app/infrastructure/drizzle/hub-drizzle-app.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -12,9 +12,11 @@ export class HubFindAppByIdService {
   constructor(private readonly repository: HubDrizzleAppRepository) {}
 
   async main(id: string, constraint?: QueryStatement, handlerMeta?: HandlerMeta): Promise<HubApp> {
-    return await this.repository.findById(id, {
+    const app = await this.repository.findById(id, {
       constraint,
       handlerMeta,
     });
+
+    return app;
   }
 }

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app.handler.spec.ts

@@ -8,38 +8,55 @@
  *   HubFindAppHandler is another hub/app read path and must apply the SAME strip
  *   uniformly, or a client could eager-load through this path instead.
  *
- * ESM cascade workaround — same jest.mock pattern as hub-get-apps.handler.spec.ts.
+ * Dependency-isolation mocking — same vi.mock pattern as hub-get-apps.handler.spec.ts.
  */
 
-jest.mock('@api/graphql', () => ({}));
-jest.mock('@app/hub/app', () => ({
+vi.mock('@api/graphql.js', () => ({}));
+vi.mock('@app/hub/app/application/find/hub-find-app.service.js', () => ({
   HubFindAppService: class HubFindAppService {},
 }));
-jest.mock('@app/hub/app/domain', () => ({}));
-jest.mock('@app/hub/app/shared', () => ({
-  hubSanitizeEagerLoads: jest.requireActual(
-    '@app/hub/app/shared/functions/hub-sanitize-eager-loads.function',
-  ).hubSanitizeEagerLoads,
-}));
-jest.mock('@aurorajs.dev/core-back', () => ({
-  Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
-  HandlerMeta: class {},
-  QueryStatement: class QueryStatement {},
-}));
+// The handler statically imports HubAppFieldSchema from this module for @Format; Vitest's
+// ESM-backed mocking throws on an export the factory did not return (unlike Jest's silent
+// undefined), so an empty stub is not enough here.
+vi.mock('@app/hub/app/domain/index.js', () => ({ HubAppFieldSchema: [] }));
+vi.mock('@app/hub/app/shared/index.js', async () => {
+  const assertMod = await vi.importActual<
+    typeof import('@app/hub/app/shared/functions/hub-assert-no-accounts-reference.function.js')
+  >('@app/hub/app/shared/functions/hub-assert-no-accounts-reference.function');
+  const sanitizeMod = await vi.importActual<
+    typeof import('@app/hub/app/shared/functions/hub-sanitize-eager-loads.function.js')
+  >('@app/hub/app/shared/functions/hub-sanitize-eager-loads.function');
+  return {
+    hubAssertNoAccountsReference: assertMod.hubAssertNoAccountsReference,
+    hubSanitizeEagerLoads: sanitizeMod.hubSanitizeEagerLoads,
+  };
+});
+vi.mock('@aurorajs.dev/core-back', async () => {
+  const actual =
+    await vi.importActual<typeof import('@aurorajs.dev/core-back')>('@aurorajs.dev/core-back');
+  return {
+    Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
+    HandlerMeta: class {},
+    QueryStatement: class QueryStatement {},
+    // The real DSL constants hubAssertNoAccountsReference walks with — re-exported, not copied.
+    DEFAULT_MAX_DEPTH: actual.DEFAULT_MAX_DEPTH,
+    LOGICAL_OPERATOR: actual.LOGICAL_OPERATOR,
+  };
+});
 
-import { HubFindAppService } from '@app/hub/app';
-import { NotFoundException } from '@nestjs/common';
+import { HubFindAppService } from '@app/hub/app/application/find/hub-find-app.service.js';
+import { ForbiddenException, NotFoundException } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubFindAppHandler } from './hub-find-app.handler';
+import { HubFindAppHandler } from './hub-find-app.handler.js';
 
 const handlerMeta = { timezone: 'UTC', repositoryOptions: { auditing: null } };
 
 describe('HubFindAppHandler — include/relations-stripping security fix (ITEM 2)', () => {
   let handler: HubFindAppHandler;
-  const findService = { main: jest.fn() };
+  const findService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     findService.main.mockResolvedValue({ id: '1', code: 'myapp' });
 
     const moduleRef: TestingModule = await Test.createTestingModule({
@@ -50,14 +67,22 @@ describe('HubFindAppHandler — include/relations-stripping security fix (ITEM 2
   });
 
   it('(sec-1) strips `include` from constraint before calling the service', async () => {
-    await handler.main(undefined, { include: [{ association: 'application' }] } as never, handlerMeta);
+    await handler.main(
+      undefined,
+      { include: [{ association: 'application' }] } as never,
+      handlerMeta,
+    );
 
     const [, receivedConstraint] = findService.main.mock.calls[0];
     expect(receivedConstraint).not.toHaveProperty('include');
   });
 
   it('(sec-2) strips `include` from queryStatement before calling the service', async () => {
-    await handler.main({ include: [{ association: 'application' }] } as never, undefined, handlerMeta);
+    await handler.main(
+      { include: [{ association: 'application' }] } as never,
+      undefined,
+      handlerMeta,
+    );
 
     const [receivedQuery] = findService.main.mock.calls[0];
     expect(receivedQuery).not.toHaveProperty('include');
@@ -107,4 +132,41 @@ describe('HubFindAppHandler — include/relations-stripping security fix (ITEM 2
       NotFoundException,
     );
   });
+
+  // ── Security (close-hub-accounts-query-oracle): a reference to `accounts` is an
+  //    EXISTS oracle over IamAccount — rejected with a 403 before the service runs. ──
+
+  it('(oracle-1) rejects an accounts reference in queryStatement with 403 and never calls the service', async () => {
+    const rejection = await handler
+      .main(
+        { where: { or: [{ accounts: { user: { name: { eq: 'Jane' } } } }] } },
+        undefined,
+        handlerMeta,
+      )
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts.user.name', aggregate: 'HubApp' },
+    });
+    expect(findService.main).not.toHaveBeenCalled();
+  });
+
+  it('(oracle-2) rejects an accounts reference in constraint with 403 and never calls the service', async () => {
+    const rejection = await handler
+      .main(
+        { where: { isActive: { eq: true } } },
+        { where: { accounts: {} } } as never,
+        handlerMeta,
+      )
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts', aggregate: 'HubApp' },
+    });
+    expect(findService.main).not.toHaveBeenCalled();
+  });
 });

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app.handler.ts

@@ -7,10 +7,10 @@
  * hubSanitizeEagerLoads() (shared at @app/hub/app/shared) so a client cannot
  * eager-load OAuthApplication through this path either (F3 security review, ITEM 2).
  */
-import { HubApp } from '@api/graphql';
-import { HubFindAppService } from '@app/hub/app';
-import { HubAppFieldSchema } from '@app/hub/app/domain';
-import { hubSanitizeEagerLoads } from '@app/hub/app/shared';
+import { HubApp } from '@api/graphql.js';
+import { HubFindAppService } from '@app/hub/app/application/find/hub-find-app.service.js';
+import { HubAppFieldSchema } from '@app/hub/app/domain/index.js';
+import { hubAssertNoAccountsReference, hubSanitizeEagerLoads } from '@app/hub/app/shared/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 
@@ -24,6 +24,10 @@ export class HubFindAppHandler {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<HubApp> {
+    // Reject before sanitizing: a reference to `accounts` is an EXISTS oracle over IamAccount.
+    hubAssertNoAccountsReference(queryStatement);
+    hubAssertNoAccountsReference(constraint);
+
     const app = await this.findService.main(
       hubSanitizeEagerLoads(queryStatement),
       hubSanitizeEagerLoads(constraint),

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/find/hub-find-app.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubApp } from '@api/graphql';
-import { HubDrizzleAppRepository } from '@app/hub/app';
+import { HubApp } from '@api/graphql.js';
+import { HubDrizzleAppRepository } from '@app/hub/app/infrastructure/drizzle/hub-drizzle-app.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,10 +16,12 @@ export class HubFindAppService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<HubApp> {
-    return await this.repository.find({
+    const app = await this.repository.find({
       queryStatement,
       constraint,
       handlerMeta,
     });
+
+    return app;
   }
 }

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/get/hub-get-apps.handler.spec.ts

@@ -14,42 +14,56 @@
  * before calling the service.  `where` / `order` / `limit` / `offset` are
  * legitimate filters and MUST be preserved.
  *
- * ESM cascade workaround — same jest.mock pattern as hub-create-app.handler.spec.ts:
+ * Dependency-isolation mocking — same vi.mock pattern as hub-create-app.handler.spec.ts:
  *   @api/graphql, @app/hub/app, @app/hub/app/domain, @aurorajs.dev/core-back
- *   all pull in ESM that ts-jest cannot transform; we replace them with no-op shims.
+ *   all pull in a heavy dependency graph; we replace them with no-op shims.
  *   @Format is shimmed to a no-op so the handler's return value is not transformed;
  *   the tests assert on service call arguments, not on formatted output.
  */
 
-// Block the ESM cascade before any imports.
-// The handler imports QueryStatement from @aurorajs.dev/core-back, which transitively
-// pulls in mime (an ESM-only package) that ts-jest cannot transform.
-// We mock the whole chain to prevent the ESM parse error.
-jest.mock('@api/graphql', () => ({}));
+vi.mock('@api/graphql.js', () => ({}));
 // The handler deep-imports its service (cycle-proofing — see the handler's
 // import comment), so the DEEP path carries the canonical stub class; the
 // barrel mock ALIASES it (same class identity) because the spec's DI provider
 // references the class via the barrel — two distinct classes would break
 // Nest's paramtype-token matching ("can't resolve dependencies").
-jest.mock('@app/hub/app/application/get/hub-get-apps.service', () => ({
+vi.mock('@app/hub/app/application/get/hub-get-apps.service.js', () => ({
   HubGetAppsService: class HubGetAppsService {},
 }));
-jest.mock('@app/hub/app', () => ({
-  HubGetAppsService: jest.requireMock('@app/hub/app/application/get/hub-get-apps.service')
-    .HubGetAppsService,
-}));
-jest.mock('@app/hub/app/domain', () => ({
-  hubAppAccessPermissionName: (code: string) => `hub.app.${code}.access`,
-}));
-jest.mock('@aurorajs.dev/core-back', () => ({
-  Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
-  HandlerMeta: class {},
-  QueryStatement: class QueryStatement {},
-}));
+vi.mock('@app/hub/app/index.js', async () => {
+  const mod = await vi.importMock<typeof import('@app/hub/app/application/get/hub-get-apps.service.js')>(
+    '@app/hub/app/application/get/hub-get-apps.service.js',
+  );
+  return { HubGetAppsService: mod.HubGetAppsService };
+});
+// Vitest's ESM-backed mocking is stricter than Jest's CJS interop: accessing an export the
+// factory did not return THROWS ("No X export is defined on the mock") instead of silently
+// yielding undefined. The handler's `@Format(HubAppFieldSchema)` decorator reads HubAppFieldSchema
+// from this same module, so the factory must spread the real module and override only the target.
+vi.mock('@app/hub/app/domain/index.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@app/hub/app/domain/index.js')>();
+  return {
+    ...actual,
+    hubAppAccessPermissionName: (code: string) => `hub.app.${code}.access`,
+  };
+});
+vi.mock('@aurorajs.dev/core-back', async () => {
+  const actual =
+    await vi.importActual<typeof import('@aurorajs.dev/core-back')>('@aurorajs.dev/core-back');
+  return {
+    Format: () => (_t: unknown, _k: unknown, d: unknown) => d,
+    HandlerMeta: class {},
+    QueryStatement: class QueryStatement {},
+    // The real DSL constants hubAssertNoAccountsReference walks with — re-exported, not copied.
+    DEFAULT_MAX_DEPTH: actual.DEFAULT_MAX_DEPTH,
+    LOGICAL_OPERATOR: actual.LOGICAL_OPERATOR,
+  };
+});
 
-import { HubGetAppsService } from '@app/hub/app';
+import { HubGetAppsService } from '@app/hub/app/index.js';
+import { ForbiddenException } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubGetAppsHandler } from './hub-get-apps.handler';
+import { HubGetAppsHandler } from './hub-get-apps.handler.js';
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -63,10 +77,10 @@ const handlerMeta = { timezone: 'UTC', repositoryOptions: { auditing: null } };
 
 describe('HubGetAppsHandler — include-stripping security fix', () => {
   let handler: HubGetAppsHandler;
-  const getService = { main: jest.fn() };
+  const getService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     getService.main.mockResolvedValue([]);
 
     const moduleRef: TestingModule = await Test.createTestingModule({
@@ -79,14 +93,22 @@ describe('HubGetAppsHandler — include-stripping security fix', () => {
   // ── Security: include must be stripped ───────────────────────────────────
 
   it('(sec-1) strips `include` from constraint before calling the service', async () => {
-    await handler.main(undefined, { include: [{ association: 'application' }] } as never, handlerMeta);
+    await handler.main(
+      undefined,
+      { include: [{ association: 'application' }] } as never,
+      handlerMeta,
+    );
 
     const [, receivedConstraint] = getService.main.mock.calls[0];
     expect(receivedConstraint).not.toHaveProperty('include');
   });
 
   it('(sec-2) strips `include` from queryStatement before calling the service', async () => {
-    await handler.main({ include: [{ association: 'application' }] } as never, undefined, handlerMeta);
+    await handler.main(
+      { include: [{ association: 'application' }] } as never,
+      undefined,
+      handlerMeta,
+    );
 
     const [receivedQuery] = getService.main.mock.calls[0];
     expect(receivedQuery).not.toHaveProperty('include');
@@ -195,16 +217,50 @@ describe('HubGetAppsHandler — include-stripping security fix', () => {
     expect(receivedQuery).toEqual(queryStatement);
     expect(receivedConstraint).toEqual(constraint);
   });
+
+  // ── Security (close-hub-accounts-query-oracle): a `where` on `accounts` is an
+  //    EXISTS oracle over IamAccount for every launchpad caller — rejected with a
+  //    403 before the service runs, on BOTH statement arguments. ────────────────
+
+  it('(oracle-1) rejects an accounts reference in queryStatement with 403 and never calls the service', async () => {
+    const rejection = await handler
+      .main({ where: { accounts: { email: { iLike: '%@example.test' } } } }, undefined, handlerMeta)
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts.email', aggregate: 'HubApp' },
+    });
+    expect(getService.main).not.toHaveBeenCalled();
+  });
+
+  it('(oracle-2) rejects an accounts reference in constraint with 403 and never calls the service', async () => {
+    const rejection = await handler
+      .main(
+        { where: { isActive: { eq: true } } },
+        { order: [{ field: 'accounts.username', dir: 'asc' }] },
+        handlerMeta,
+      )
+      .catch((error: unknown) => error);
+
+    expect(rejection).toBeInstanceOf(ForbiddenException);
+    expect((rejection as ForbiddenException).getResponse()).toMatchObject({
+      statusCode: 403,
+      params: { path: 'accounts.username', aggregate: 'HubApp' },
+    });
+    expect(getService.main).not.toHaveBeenCalled();
+  });
 });
 
 // ─── Launchpad filter (H2.5 task 5, design D5) ───────────────────────────────
 
 describe('HubGetAppsHandler — per-app permission launchpad filter', () => {
   let handler: HubGetAppsHandler;
-  const getService = { main: jest.fn() };
+  const getService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
 
     const moduleRef: TestingModule = await Test.createTestingModule({
       providers: [HubGetAppsHandler, { provide: HubGetAppsService, useValue: getService }],

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/get/hub-get-apps.handler.ts

@@ -25,13 +25,13 @@
  * CLOSED and returns an empty list — there is no fallback path that skips
  * the filter.
  */
-import { HubApp, IamAccount } from '@api/graphql';
+import { HubApp, IamAccount } from '@api/graphql.js';
 // Deep service import (NOT the '@app/hub/app' barrel) — see
 // hub-create-app.handler.ts: self-barrel imports break under the hub e2e
 // specs' deep-import-first module order (undefined entry in HubAppHandlers).
-import { HubGetAppsService } from '@app/hub/app/application/get/hub-get-apps.service';
-import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain';
-import { hubSanitizeEagerLoads } from '@app/hub/app/shared';
+import { HubGetAppsService } from '@app/hub/app/application/get/hub-get-apps.service.js';
+import { HubAppFieldSchema, hubAppAccessPermissionName } from '@app/hub/app/domain/index.js';
+import { hubAssertNoAccountsReference, hubSanitizeEagerLoads } from '@app/hub/app/shared/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -59,6 +59,10 @@ export class HubGetAppsHandler {
     // ─────────────────────────────────────────────────────────────────────────
     currentAccount?: LaunchpadCaller,
   ): Promise<HubApp[]> {
+    // Reject before sanitizing: a reference to `accounts` is an EXISTS oracle over IamAccount.
+    hubAssertNoAccountsReference(queryStatement);
+    hubAssertNoAccountsReference(constraint);
+
     const apps = await this.getService.main(
       hubSanitizeEagerLoads(queryStatement),
       hubSanitizeEagerLoads(constraint),

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/get/hub-get-apps.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/hub/app.aurora.yaml
  */
-import { HubApp } from '@api/graphql';
-import { HubDrizzleAppRepository } from '@app/hub/app';
+import { HubApp } from '@api/graphql.js';
+import { HubDrizzleAppRepository } from '@app/hub/app/infrastructure/drizzle/hub-drizzle-app.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,10 +16,12 @@ export class HubGetAppsService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<HubApp[]> {
-    return await this.repository.get({
+    const rows = await this.repository.get({
       queryStatement,
       constraint,
       handlerMeta,
     });
+
+    return rows;
   }
 }

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/my-preferences/hub-my-preferences-app.handler.spec.ts

@@ -7,26 +7,26 @@
  *   3. Returns an empty array (not an error) when the account has no preferences.
  *   4. Two different accounts each get only their own rows.
  *
- * ESM cascade workaround: same jest.mock pattern as hub-create-app.handler.spec.ts.
+ * Dependency-isolation mocking: same vi.mock pattern as hub-create-app.handler.spec.ts.
  */
 
-jest.mock('@api/graphql', () => ({}));
-jest.mock('@app/hub/app', () => ({}));
-jest.mock('@app/hub/app/domain', () => ({}));
-jest.mock('@app/hub/app-account', () => ({
+vi.mock('@api/graphql.js', () => ({}));
+vi.mock('@app/hub/app/index.js', () => ({}));
+vi.mock('@app/hub/app/domain/index.js', () => ({}));
+vi.mock('@app/hub/app-account/index.js', () => ({
   HubGetAppsAccountsService: class HubGetAppsAccountsService {},
 }));
-jest.mock('@aurorajs.dev/core-back', () => ({
+vi.mock('@aurorajs.dev/core-back', () => ({
   ApplySchema: () => (_t: unknown, _k: unknown, d: unknown) => d,
   EmitEvent: () => (_t: unknown, _k: unknown, d: unknown) => d,
   HandlerMeta: class {},
   CurrentAccount: () => (_t: unknown, _k: unknown) => {},
 }));
 
-import { HubGetAppsAccountsService } from '@app/hub/app-account';
+import { HubGetAppsAccountsService } from '@app/hub/app-account/index.js';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Test, TestingModule } from '@nestjs/testing';
-import { HubMyPreferencesAppHandler } from './hub-my-preferences-app.handler';
+import { HubMyPreferencesAppHandler } from './hub-my-preferences-app.handler.js';
 
 const ACCOUNT_ID_A = 'acc-AAAA-0000-0000-000000000001';
 const ACCOUNT_ID_B = 'acc-BBBB-0000-0000-000000000002';
@@ -46,11 +46,11 @@ function makePrefRow(
 describe('HubMyPreferencesAppHandler', () => {
   let handler: HubMyPreferencesAppHandler;
 
-  const getService = { main: jest.fn() };
-  const eventEmitter = { emit: jest.fn() };
+  const getService = { main: vi.fn() };
+  const eventEmitter = { emit: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     const moduleRef: TestingModule = await Test.createTestingModule({
       providers: [
         HubMyPreferencesAppHandler,
@@ -130,12 +130,12 @@ describe('HubMyPreferencesAppHandler', () => {
   // shorthand `{ accountId: 'x' }` — every comparison must be an operator
   // object (`{ eq: 'x' }`). getService is mocked above, so that runtime
   // failure is invisible unless the exact `where` shape is fed through the
-  // REAL validator here. `@aurorajs.dev/core-back` is jest.mock'd at the top
-  // of this file for the ESM cascade workaround, so the real validator is
-  // pulled via requireActual.
+  // REAL validator here. `@aurorajs.dev/core-back` is vi.mock'd at the top
+  // of this file for dependency isolation, so the real validator is
+  // pulled via importActual.
   it('builds a where clause the real QueryDslValidator accepts', async () => {
     const { QueryDslValidator } =
-      jest.requireActual<typeof import('@aurorajs.dev/core-back')>('@aurorajs.dev/core-back');
+      await vi.importActual<typeof import('@aurorajs.dev/core-back')>('@aurorajs.dev/core-back');
     getService.main.mockResolvedValue([]);
 
     await handler.main({ id: ACCOUNT_ID_A } as any);

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/my-preferences/hub-my-preferences-app.handler.ts

@@ -5,8 +5,8 @@
  * MANUALLY MAINTAINED — handler body implementing the my-preferences business logic.
  * Re-apply after regen: currentAccount injection, account-scoped query.
  */
-import { HubAppPreference, IamAccount } from '@api/graphql';
-import { HubGetAppsAccountsService } from '@app/hub/app-account';
+import { HubAppPreference, IamAccount } from '@api/graphql.js';
+import { HubGetAppsAccountsService } from '@app/hub/app-account/index.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';