@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/impersonate-token/o-auth-create-impersonate-token.handler.spec.ts

@@ -1,5 +1,6 @@
-import { ACCOUNT_LOADER } from '@aurora/modules/authentication/domain/ports';
-import { TOOLS_KEY_VALUE_CONFIG } from '@bridges/tools/key-value/ports';
+import type { Mock } from 'vitest';
+import { ACCOUNT_LOADER } from '@aurora/modules/authentication/domain/ports/index.js';
+import { TOOLS_KEY_VALUE_CONFIG } from '@bridges/tools/key-value/ports/index.js';
 import { Test, TestingModule } from '@nestjs/testing';
 import {
   ImpersonationChainError,
@@ -8,9 +9,9 @@ import {
   ImpersonationTargetNoClientError,
   ImpersonationTargetNotFoundError,
   ImpersonationTargetPrivilegedError,
-} from '../../domain/errors';
-import { OAuthCreateImpersonateTokenHandler } from './o-auth-create-impersonate-token.handler';
-import { OAuthCreateImpersonateTokenService } from './services/o-auth-create-impersonate-token.service';
+} from '../../domain/errors/index.js';
+import { OAuthCreateImpersonateTokenHandler } from './o-auth-create-impersonate-token.handler.js';
+import { OAuthCreateImpersonateTokenService } from './services/o-auth-create-impersonate-token.service.js';
 
 const TARGET_ID = 'target-0000-0000-0000-000000000001';
 const REQUESTER_ID = 'requester-000-0000-0000-00000000002';
@@ -53,17 +54,17 @@ const buildResponse = () => ({
 
 describe('OAuthCreateImpersonateTokenHandler (composite)', () => {
   let handler: OAuthCreateImpersonateTokenHandler;
-  let accountLoader: { loadById: jest.Mock };
-  let service: { main: jest.Mock };
-  let toolsConfig: { getKeyValue: jest.Mock; setKeyValue: jest.Mock };
+  let accountLoader: { loadById: Mock };
+  let service: { main: Mock };
+  let toolsConfig: { getKeyValue: Mock; setKeyValue: Mock };
 
   beforeEach(async () => {
-    accountLoader = { loadById: jest.fn() };
-    service = { main: jest.fn().mockResolvedValue(buildResponse()) };
+    accountLoader = { loadById: vi.fn() };
+    service = { main: vi.fn().mockResolvedValue(buildResponse()) };
     // Default: key absent → resolveImpersonationPrivilegeDenylist falls back to the hard-coded
     // default deny-list (verified by its own dedicated spec). Individual tests below override
     // this to prove the config-override and malformed-fallback behaviors at the handler level.
-    toolsConfig = { getKeyValue: jest.fn().mockResolvedValue(null), setKeyValue: jest.fn() };
+    toolsConfig = { getKeyValue: vi.fn().mockResolvedValue(null), setKeyValue: vi.fn() };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/impersonate-token/o-auth-create-impersonate-token.handler.ts

@@ -1,5 +1,5 @@
-import { ACCOUNT_LOADER, type IAccountLoader } from '@aurora/modules/authentication/domain/ports';
-import { TOOLS_KEY_VALUE_CONFIG, type IToolsKeyValueConfig } from '@bridges/tools/key-value/ports';
+import { ACCOUNT_LOADER, type IAccountLoader } from '@aurora/modules/authentication/domain/ports/index.js';
+import { TOOLS_KEY_VALUE_CONFIG, type IToolsKeyValueConfig } from '@bridges/tools/key-value/ports/index.js';
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import {
   ImpersonationChainError,
@@ -8,16 +8,16 @@ import {
   ImpersonationTargetNoClientError,
   ImpersonationTargetNotFoundError,
   ImpersonationTargetPrivilegedError,
-} from '../../domain/errors';
+} from '../../domain/errors/index.js';
 import type {
   OAuthCreateImpersonateTokenInput,
   OAuthCreateImpersonateTokenResponse,
-} from '../../domain/flows.types';
+} from '../../domain/flows.types.js';
 import {
   permissionGrantsPrivilege,
   resolveImpersonationPrivilegeDenylist,
-} from '../../domain/impersonation-privilege-denylist';
-import { OAuthCreateImpersonateTokenService } from './services/o-auth-create-impersonate-token.service';
+} from '../../domain/impersonation-privilege-denylist.js';
+import { OAuthCreateImpersonateTokenService } from './services/o-auth-create-impersonate-token.service.js';
 
 /**
  * Composite handler for the impersonate-token flow — one business flow, two transports

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/impersonate-token/services/o-auth-create-impersonate-token.service.spec.ts

@@ -1,19 +1,21 @@
-import { OAuthCredentialGrantTypeEnum } from '@api/graphql';
-import { OAuthCreateAccessTokenService } from '@app/o-auth/access-token';
-import { OAuthCreateCredentialService } from '@app/o-auth/credential';
-// Deep import (NOT the '@aurora/modules' barrel): the barrel transitively loads the
-// authentication module's jwks-rsa/jose ESM chain, which ts-jest cannot parse.
-import { TokenIssuanceDisabledError } from '@aurora/modules/authentication/domain/errors';
-import { ACCOUNT_LOADER, JWT_SIGNER } from '@aurora/modules/authentication/domain/ports';
+import type { Mock } from 'vitest';
+import { OAuthCredentialGrantTypeEnum } from '@api/graphql.js';
+import { OAuthCreateAccessTokenService } from '@app/o-auth/access-token/index.js';
+import { OAuthCreateCredentialService } from '@app/o-auth/credential/index.js';
+// Sub-barrel imports, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/errors` and
+// `domain/ports` are both zero-side-effect (plain error classes; interfaces + Symbol tokens).
+import { TokenIssuanceDisabledError } from '@aurora/modules/authentication/domain/errors/index.js';
+import { ACCOUNT_LOADER, JWT_SIGNER } from '@aurora/modules/authentication/domain/ports/index.js';
 import { Logger } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
 import {
   ImpersonationTargetNoClientError,
   ImpersonationTargetNotFoundError,
   ImpersonationUnavailableError,
-} from '../../../domain/errors';
-import type { OAuthCreateImpersonateTokenInput } from '../../../domain/flows.types';
-import { OAuthCreateImpersonateTokenService } from './o-auth-create-impersonate-token.service';
+} from '../../../domain/errors/index.js';
+import type { OAuthCreateImpersonateTokenInput } from '../../../domain/flows.types.js';
+import { OAuthCreateImpersonateTokenService } from './o-auth-create-impersonate-token.service.js';
 
 const TARGET_ID = 'target-0000-0000-0000-000000000001';
 const REQUESTER_ID = 'requester-000-0000-0000-00000000002';
@@ -41,21 +43,21 @@ const buildInput = (
 
 describe('OAuthCreateImpersonateTokenService', () => {
   let service: OAuthCreateImpersonateTokenService;
-  let accountLoader: { loadById: jest.Mock };
-  let jwtSigner: { signAccess: jest.Mock };
-  let createAccessToken: { main: jest.Mock };
-  let createCredential: { main: jest.Mock };
+  let accountLoader: { loadById: Mock };
+  let jwtSigner: { signAccess: Mock };
+  let createAccessToken: { main: Mock };
+  let createCredential: { main: Mock };
 
   beforeEach(async () => {
-    accountLoader = { loadById: jest.fn().mockResolvedValue(buildTargetAccount()) };
+    accountLoader = { loadById: vi.fn().mockResolvedValue(buildTargetAccount()) };
     jwtSigner = {
-      signAccess: jest.fn().mockResolvedValue({
+      signAccess: vi.fn().mockResolvedValue({
         token: 'header.payload.signature',
         expiresAt: new Date(Date.now() + 900_000),
       }),
     };
-    createAccessToken = { main: jest.fn().mockResolvedValue(undefined) };
-    createCredential = { main: jest.fn().mockResolvedValue(undefined) };
+    createAccessToken = { main: vi.fn().mockResolvedValue(undefined) };
+    createCredential = { main: vi.fn().mockResolvedValue(undefined) };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -74,13 +76,25 @@ describe('OAuthCreateImpersonateTokenService', () => {
   // test would throw before reaching an inline `mockRestore()`, leaking the global
   // `Logger.prototype.error` no-op into every test that runs afterwards.
   afterEach(() => {
-    jest.restoreAllMocks();
+    vi.restoreAllMocks();
   });
 
   it('loads the target with { refreshPermissions: true }', async () => {
     await service.main(buildInput());
 
-    expect(accountLoader.loadById).toHaveBeenCalledWith(TARGET_ID, { refreshPermissions: true });
+    expect(accountLoader.loadById).toHaveBeenCalledWith(
+      TARGET_ID,
+      expect.objectContaining({ refreshPermissions: true }),
+    );
+  });
+
+  it('loads the target with refreshTenants: true, same door as the three grants', async () => {
+    await service.main(buildInput());
+
+    expect(accountLoader.loadById).toHaveBeenCalledWith(TARGET_ID, {
+      refreshPermissions: true,
+      refreshTenants: true,
+    });
   });
 
   it('signs ONE access token carrying act and relies on the signer for the impersonation TTL', async () => {
@@ -215,7 +229,7 @@ describe('OAuthCreateImpersonateTokenService', () => {
   it('C12 — re-throws a genuine signing failure instead of disguising it as the mode limitation, and logs it', async () => {
     const cause = new Error('error:0909006C:PEM routines:get_name:no start line');
     jwtSigner.signAccess.mockRejectedValue(cause);
-    const logError = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+    const logError = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
 
     // Non-tautological: with the blanket catch this rejects with ImpersonationUnavailableError
     // ("Impersonation is not available with the current authentication mode"), which is a lie —

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/impersonate-token/services/o-auth-create-impersonate-token.service.ts

@@ -1,27 +1,27 @@
-import { OAuthCredentialGrantTypeEnum } from '@api/graphql';
-import { OAuthCreateAccessTokenService } from '@app/o-auth/access-token';
-import { OAuthCreateCredentialService } from '@app/o-auth/credential';
-// Deep import (NOT the '@aurora/modules' barrel): the barrel transitively loads the
-// authentication module's jwks-rsa/jose ESM chain, which ts-jest cannot parse — same reason the
-// existing grant services (o-auth-create-token-password.service.ts, etc.) do it.
-import { TokenIssuanceDisabledError } from '@aurora/modules/authentication/domain/errors';
+import { OAuthCredentialGrantTypeEnum } from '@api/graphql.js';
+import { OAuthCreateAccessTokenService } from '@app/o-auth/access-token/index.js';
+import { OAuthCreateCredentialService } from '@app/o-auth/credential/index.js';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/errors` is
+// plain error classes, zero side-effects.
+import { TokenIssuanceDisabledError } from '@aurora/modules/authentication/domain/errors/index.js';
 import {
   ACCOUNT_LOADER,
   type IAccountLoader,
   type IJwtSigner,
   JWT_SIGNER,
-} from '@aurora/modules/authentication/domain/ports';
+} from '@aurora/modules/authentication/domain/ports/index.js';
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';
 import {
   ImpersonationTargetNoClientError,
   ImpersonationTargetNotFoundError,
   ImpersonationUnavailableError,
-} from '../../../domain/errors';
+} from '../../../domain/errors/index.js';
 import type {
   OAuthCreateImpersonateTokenInput,
   OAuthCreateImpersonateTokenResponse,
-} from '../../../domain/flows.types';
+} from '../../../domain/flows.types.js';
 
 /**
  * Issuance + persistence for a successful impersonation (design D4). The handler
@@ -50,11 +50,14 @@ export class OAuthCreateImpersonateTokenService {
   async main(
     input: OAuthCreateImpersonateTokenInput,
   ): Promise<OAuthCreateImpersonateTokenResponse> {
-    // Refresh the target's dPermissions snapshot at issuance (BR-IAM-ACCOUNT-001, extended to
-    // this 4th path by design D4) — same call the handler already made; fail-soft and idempotent,
-    // so a second call costs a recompute, never a wrong result.
+    // Refresh the target's dPermissions and dTenants snapshots at issuance (BR-IAM-ACCOUNT-001,
+    // extended to this 4th path by design D4) — same call the handler already made; fail-soft
+    // and idempotent, so a second call costs a recompute, never a wrong result. Impersonation
+    // issues a token through the same ACCOUNT_LOADER port as the three grants, so it must not
+    // hand out a stale tenant scope either.
     const target = await this.accountLoader.loadById(input.targetAccountId, {
       refreshPermissions: true,
+      refreshTenants: true,
     });
 
     // Defensive re-check: the handler already validated existence/active/clientId, but a

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/revoke-token/o-auth-revoke-token.handler.spec.ts

@@ -1,8 +1,9 @@
+import type { Mock } from 'vitest';
 import { Test, TestingModule } from '@nestjs/testing';
-import { InvalidClientError, InvalidRequestError } from '../../domain/errors';
-import type { OAuthRevokeTokenInput } from '../../domain/flows.types';
-import { OAuthRevokeTokenHandler } from './o-auth-revoke-token.handler';
-import { OAuthRevokeTokenService } from './services/o-auth-revoke-token.service';
+import { InvalidClientError, InvalidRequestError } from '../../domain/errors/index.js';
+import type { OAuthRevokeTokenInput } from '../../domain/flows.types.js';
+import { OAuthRevokeTokenHandler } from './o-auth-revoke-token.handler.js';
+import { OAuthRevokeTokenService } from './services/o-auth-revoke-token.service.js';
 
 const buildInput = (overrides: Partial<OAuthRevokeTokenInput> = {}): OAuthRevokeTokenInput => ({
   clientId: 'aurora',
@@ -13,10 +14,10 @@ const buildInput = (overrides: Partial<OAuthRevokeTokenInput> = {}): OAuthRevoke
 
 describe('OAuthRevokeTokenHandler', () => {
   let handler: OAuthRevokeTokenHandler;
-  let service: { main: jest.Mock };
+  let service: { main: Mock };
 
   beforeEach(async () => {
-    service = { main: jest.fn().mockResolvedValue({ revoked: true }) };
+    service = { main: vi.fn().mockResolvedValue({ revoked: true }) };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [OAuthRevokeTokenHandler, { provide: OAuthRevokeTokenService, useValue: service }],

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/revoke-token/o-auth-revoke-token.handler.ts

@@ -4,8 +4,8 @@ import {
   InvalidRequestError,
   type OAuthRevokeTokenInput,
   type OAuthRevokeTokenResponse,
-} from '../../domain';
-import { OAuthRevokeTokenService } from './services/o-auth-revoke-token.service';
+} from '../../domain/index.js';
+import { OAuthRevokeTokenService } from './services/o-auth-revoke-token.service.js';
 
 /**
  * Composite handler for OAuth2 token revocation (RFC 7009) — one business flow, two transports.

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/revoke-token/services/o-auth-revoke-token.service.spec.ts

@@ -1,20 +1,22 @@
 // Mock bcrypt.compare so tests can use plaintext-vs-plaintext fixtures.
 // oAuthAuthenticateApplication now uses bcrypt.compare(presented, stored);
 // stubbing it to do a simple equality check preserves match/mismatch semantics.
-jest.mock('bcrypt', () => ({
-  compare: jest.fn((presented: string, stored: string) => Promise.resolve(presented === stored)),
+vi.mock('bcrypt', () => ({
+  compare: vi.fn((presented: string, stored: string) => Promise.resolve(presented === stored)),
 }));
 
-import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token';
-import { OAuthFindApplicationService } from '@app/o-auth/application';
-import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token';
-// Deep import — the '@aurora/modules' barrel drags the authentication module's
-// jwks-rsa/jose ESM chain, which ts-jest cannot parse (pre-existing limitation).
-import { ACCOUNT_CACHE_INVALIDATOR } from '@aurora/modules/authentication/domain/ports';
+import type { Mock } from 'vitest';
+import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token/index.js';
+import { OAuthFindApplicationService } from '@app/o-auth/application/index.js';
+import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token/index.js';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
+import { ACCOUNT_CACHE_INVALIDATOR } from '@aurora/modules/authentication/domain/ports/index.js';
 import { Test, TestingModule } from '@nestjs/testing';
-import { InvalidClientError } from '../../../domain/errors';
-import type { OAuthRevokeTokenInput } from '../../../domain/flows.types';
-import { OAuthRevokeTokenService } from './o-auth-revoke-token.service';
+import { InvalidClientError } from '../../../domain/errors/index.js';
+import type { OAuthRevokeTokenInput } from '../../../domain/flows.types.js';
+import { OAuthRevokeTokenService } from './o-auth-revoke-token.service.js';
 
 const APPLICATION_CODE = 'aurora';
 const APPLICATION_SECRET = 'top-secret-12345';
@@ -39,28 +41,28 @@ const buildInput = (overrides: Partial<OAuthRevokeTokenInput> = {}): OAuthRevoke
 
 describe('OAuthRevokeTokenService', () => {
   let service: OAuthRevokeTokenService;
-  let findApplication: { main: jest.Mock };
-  let refreshTokenRepo: { find: jest.Mock; updateById: jest.Mock };
-  let accessTokenRepo: { find: jest.Mock; updateById: jest.Mock };
-  let cacheInvalidator: { invalidate: jest.Mock };
+  let findApplication: { main: Mock };
+  let refreshTokenRepo: { find: Mock; updateById: Mock };
+  let accessTokenRepo: { find: Mock; updateById: Mock };
+  let cacheInvalidator: { invalidate: Mock };
 
   beforeEach(async () => {
-    findApplication = { main: jest.fn().mockResolvedValue(buildApplication()) };
+    findApplication = { main: vi.fn().mockResolvedValue(buildApplication()) };
     refreshTokenRepo = {
-      find: jest.fn().mockResolvedValue({
+      find: vi.fn().mockResolvedValue({
         id: REFRESH_TOKEN_ID,
         accessTokenId: ACCESS_TOKEN_ID,
         isRevoked: false,
       }),
-      updateById: jest.fn().mockResolvedValue(undefined),
+      updateById: vi.fn().mockResolvedValue(undefined),
     };
     accessTokenRepo = {
       // The accountId — needed to invalidate the cached JWT account — lives on the
       // paired access token, not on the refresh token.
-      find: jest.fn().mockResolvedValue({ id: ACCESS_TOKEN_ID, accountId: ACCOUNT_ID }),
-      updateById: jest.fn().mockResolvedValue(undefined),
+      find: vi.fn().mockResolvedValue({ id: ACCESS_TOKEN_ID, accountId: ACCOUNT_ID }),
+      updateById: vi.fn().mockResolvedValue(undefined),
     };
-    cacheInvalidator = { invalidate: jest.fn().mockResolvedValue(undefined) };
+    cacheInvalidator = { invalidate: vi.fn().mockResolvedValue(undefined) };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/revoke-token/services/o-auth-revoke-token.service.ts

@@ -1,16 +1,17 @@
-import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token';
-import { OAuthFindApplicationService } from '@app/o-auth/application';
-import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token';
-import { oAuthAuthenticateApplication } from '@app/o-auth/shared';
+import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token/index.js';
+import { OAuthFindApplicationService } from '@app/o-auth/application/index.js';
+import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token/index.js';
+import { oAuthAuthenticateApplication } from '@app/o-auth/shared/index.js';
 import { unsafeAllowMaskedPropertyQuery, type QueryStatement } from '@aurorajs.dev/core-back';
-// Deep import (NOT the '@aurora/modules' barrel): the barrel transitively loads the
-// authentication module's jwks-rsa/jose ESM chain, which ts-jest cannot parse.
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
 import {
   ACCOUNT_CACHE_INVALIDATOR,
   type IAccountCacheInvalidator,
-} from '@aurora/modules/authentication/domain/ports';
+} from '@aurora/modules/authentication/domain/ports/index.js';
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import type { OAuthRevokeTokenInput, OAuthRevokeTokenResponse } from '../../../domain/flows.types';
+import type { OAuthRevokeTokenInput, OAuthRevokeTokenResponse } from '../../../domain/flows.types.js';
 
 @Injectable()
 export class OAuthRevokeTokenService {

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/session/o-auth-hub-session.service.spec.ts

@@ -1,10 +1,12 @@
-// Deep import (NOT the '@aurora/modules' barrel): the barrel transitively loads the
-// authentication module's jwks-rsa/jose ESM chain, which ts-jest cannot parse.
-import { HUB_SESSION_MANAGER } from '@aurora/modules/authentication/domain/ports';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
+import type { Mock } from 'vitest';
+import { HUB_SESSION_MANAGER } from '@aurora/modules/authentication/domain/ports/index.js';
 import { ConfigService } from '@nestjs/config';
 import { Test, TestingModule } from '@nestjs/testing';
 import type { Response } from 'express';
-import { OAuthHubSessionService } from './o-auth-hub-session.service';
+import { OAuthHubSessionService } from './o-auth-hub-session.service.js';
 
 const STUB_ACCOUNT_ID = 'account-uuid-1234';
 const STUB_TOKEN = 'eyJhbGciOiJSUzI1NiJ9.stub';
@@ -12,16 +14,16 @@ const STUB_TOKEN = 'eyJhbGciOiJSUzI1NiJ9.stub';
 describe('OAuthHubSessionService', () => {
   let service: OAuthHubSessionService;
   let hubSessionManager: {
-    signHubSession: jest.Mock;
-    verifyHubSession: jest.Mock;
-    verifyAccessToken: jest.Mock;
+    signHubSession: Mock;
+    verifyHubSession: Mock;
+    verifyAccessToken: Mock;
   };
 
   const buildModule = async (): Promise<void> => {
     hubSessionManager = {
-      signHubSession: jest.fn().mockReturnValue(STUB_TOKEN),
-      verifyHubSession: jest.fn().mockReturnValue(STUB_ACCOUNT_ID),
-      verifyAccessToken: jest.fn().mockReturnValue(STUB_ACCOUNT_ID),
+      signHubSession: vi.fn().mockReturnValue(STUB_TOKEN),
+      verifyHubSession: vi.fn().mockReturnValue(STUB_ACCOUNT_ID),
+      verifyAccessToken: vi.fn().mockReturnValue(STUB_ACCOUNT_ID),
     };
 
     const module: TestingModule = await Test.createTestingModule({
@@ -31,7 +33,7 @@ describe('OAuthHubSessionService', () => {
         {
           provide: ConfigService,
           useValue: {
-            get: jest.fn((key: string, defaultValue?: unknown) => {
+            get: vi.fn((key: string, defaultValue?: unknown) => {
               const map: Record<string, unknown> = {
                 OAUTH_SESSION_COOKIE_TTL: '28800',
                 OAUTH_SESSION_COOKIE_SECURE: 'false',
@@ -49,7 +51,7 @@ describe('OAuthHubSessionService', () => {
   };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     await buildModule();
   });
 
@@ -81,7 +83,7 @@ describe('OAuthHubSessionService', () => {
 
   describe('createSessionCookie', () => {
     it('sets a hub_session cookie with httpOnly, secure, sameSite=lax, and correct maxAge', () => {
-      const mockCookieFn = jest.fn();
+      const mockCookieFn = vi.fn();
       const mockRes = { cookie: mockCookieFn } as unknown as Response;
 
       service.createSessionCookie(mockRes, STUB_ACCOUNT_ID);
@@ -112,7 +114,7 @@ describe('OAuthHubSessionService', () => {
           {
             provide: ConfigService,
             useValue: {
-              get: jest.fn((key: string, defaultValue?: unknown) => {
+              get: vi.fn((key: string, defaultValue?: unknown) => {
                 const map: Record<string, unknown> = {
                   OAUTH_SESSION_COOKIE_TTL: '28800',
                   OAUTH_SESSION_COOKIE_SECURE: 'false', // explicitly false
@@ -127,7 +129,7 @@ describe('OAuthHubSessionService', () => {
       }).compile();
 
       const noneService = module.get(OAuthHubSessionService);
-      const mockCookieFn = jest.fn();
+      const mockCookieFn = vi.fn();
       const mockRes = { cookie: mockCookieFn } as unknown as Response;
 
       noneService.createSessionCookie(mockRes, STUB_ACCOUNT_ID);
@@ -155,7 +157,7 @@ describe('OAuthHubSessionService', () => {
           {
             provide: ConfigService,
             useValue: {
-              get: jest.fn((key: string, defaultValue?: unknown) => {
+              get: vi.fn((key: string, defaultValue?: unknown) => {
                 const map: Record<string, unknown> = {
                   OAUTH_SESSION_COOKIE_TTL: 'not-a-number',
                   OAUTH_SESSION_COOKIE_SECURE: 'false',
@@ -170,7 +172,7 @@ describe('OAuthHubSessionService', () => {
       }).compile();
 
       const nanGuardService = module.get(OAuthHubSessionService);
-      const mockCookieFn = jest.fn();
+      const mockCookieFn = vi.fn();
       const mockRes = { cookie: mockCookieFn } as unknown as Response;
 
       nanGuardService.createSessionCookie(mockRes, STUB_ACCOUNT_ID);
@@ -189,14 +191,14 @@ describe('OAuthHubSessionService', () => {
     it('returns null when the access token is invalid', async () => {
       hubSessionManager.verifyAccessToken.mockReturnValueOnce(null);
 
-      const result = await service.verifyAccessTokenAndGetAccountId('bad-token');
+      const result = service.verifyAccessTokenAndGetAccountId('bad-token');
       expect(result).toBeNull();
     });
 
     it('returns the accountId (aci claim) when the access token is valid', async () => {
       hubSessionManager.verifyAccessToken.mockReturnValueOnce(STUB_ACCOUNT_ID);
 
-      const result = await service.verifyAccessTokenAndGetAccountId(STUB_TOKEN);
+      const result = service.verifyAccessTokenAndGetAccountId(STUB_TOKEN);
       expect(result).toBe(STUB_ACCOUNT_ID);
     });
   });

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/application/session/o-auth-hub-session.service.ts

@@ -1,9 +1,10 @@
-// Deep import (NOT the '@aurora/modules' barrel): the barrel transitively loads the
-// authentication module's jwks-rsa/jose ESM chain, which ts-jest cannot parse.
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
 import {
   HUB_SESSION_MANAGER,
   type IHubSessionManager,
-} from '@aurora/modules/authentication/domain/ports';
+} from '@aurora/modules/authentication/domain/ports/index.js';
 import { Inject, Injectable } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import type { Response } from 'express';

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/domain/errors/impersonation.errors.spec.ts

@@ -7,7 +7,7 @@ import {
   ImpersonationTargetNotFoundError,
   ImpersonationTargetPrivilegedError,
   ImpersonationUnavailableError,
-} from './index';
+} from './index.js';
 
 /**
  * Regression for the "toast shows undefined" bug: all seven impersonation refusal classes threw

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/domain/errors/index.ts

@@ -1,12 +1,12 @@
-export * from './impersonation-chain.error';
-export * from './impersonation-permission-refresh-failed.error';
-export * from './impersonation-self.error';
-export * from './impersonation-target-no-client.error';
-export * from './impersonation-target-not-found.error';
-export * from './impersonation-target-privileged.error';
-export * from './impersonation-unavailable.error';
-export * from './invalid-client.error';
-export * from './invalid-grant.error';
-export * from './invalid-request.error';
-export * from './unauthorized-client.error';
-export * from './unsupported-grant-type.error';
+export * from './impersonation-chain.error.js';
+export * from './impersonation-permission-refresh-failed.error.js';
+export * from './impersonation-self.error.js';
+export * from './impersonation-target-no-client.error.js';
+export * from './impersonation-target-not-found.error.js';
+export * from './impersonation-target-privileged.error.js';
+export * from './impersonation-unavailable.error.js';
+export * from './invalid-client.error.js';
+export * from './invalid-grant.error.js';
+export * from './invalid-request.error.js';
+export * from './unauthorized-client.error.js';
+export * from './unsupported-grant-type.error.js';

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/flows/domain/impersonation-privilege-denylist.spec.ts

@@ -1,4 +1,4 @@
-import type { IToolsKeyValueConfig } from '@bridges/tools/key-value/ports';
+import type { IToolsKeyValueConfig } from '@bridges/tools/key-value/ports/index.js';
 import { Logger } from '@nestjs/common';
 import {
   DEFAULT_IMPERSONATION_PRIVILEGE_DENYLIST,
@@ -6,7 +6,7 @@ import {
   IMPERSONATION_PRIVILEGE_DENYLIST_KEY,
   permissionGrantsPrivilege,
   resolveImpersonationPrivilegeDenylist,
-} from './impersonation-privilege-denylist';
+} from './impersonation-privilege-denylist.js';
 
 // NEW-1 / RESIDUAL-2 (security review, post-F2) — sentinel asserting the floor export exists and
 // is non-empty, so a future refactor that deletes or empties it fails loudly here first.
@@ -177,8 +177,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
   // 'iam.tag.create' on top of the floor, it does not narrow the floor away.
   it('unions the configured array with the floor — it can ADD entries, never replace them', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockResolvedValue(['iam.tag.create']),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockResolvedValue(['iam.tag.create']),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -192,8 +192,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
 
   it('an explicit empty array adds nothing — the result is exactly the floor, not an empty veto', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockResolvedValue([]),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockResolvedValue([]),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -213,8 +213,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
     'floor survives a hostile override ($label) — write AND credential-read permissions still trigger the veto',
     async ({ configured }) => {
       const toolsConfig: IToolsKeyValueConfig = {
-        getKeyValue: jest.fn().mockResolvedValue(configured),
-        setKeyValue: jest.fn(),
+        getKeyValue: vi.fn().mockResolvedValue(configured),
+        setKeyValue: vi.fn(),
       };
 
       const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -236,8 +236,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
 
   it('falls back to the DEFAULT deny-list — never an empty list — when the key is absent (null)', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockResolvedValue(null),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockResolvedValue(null),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -248,8 +248,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
 
   it('falls back to the DEFAULT deny-list when the configured value is malformed (not an array of strings)', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockResolvedValue('not-an-array'),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockResolvedValue('not-an-array'),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -259,8 +259,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
 
   it('falls back to the DEFAULT deny-list when the configured array contains a non-string entry', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockResolvedValue(['iam.role.create', 42]),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockResolvedValue(['iam.role.create', 42]),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);
@@ -270,8 +270,8 @@ describe('resolveImpersonationPrivilegeDenylist', () => {
 
   it('falls back to the DEFAULT deny-list when getKeyValue itself throws (unreadable)', async () => {
     const toolsConfig: IToolsKeyValueConfig = {
-      getKeyValue: jest.fn().mockRejectedValue(new Error('DB unreachable — simulated failure')),
-      setKeyValue: jest.fn(),
+      getKeyValue: vi.fn().mockRejectedValue(new Error('DB unreachable — simulated failure')),
+      setKeyValue: vi.fn(),
     };
 
     const result = await resolveImpersonationPrivilegeDenylist(toolsConfig, logger);