@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/application/get/o-auth-get-scopes.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/o-auth/scope.aurora.yaml
  */
-import { OAuthScope } from '@api/graphql';
-import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope';
+import { OAuthScope } from '@api/graphql.js';
+import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,10 +16,12 @@ export class OAuthGetScopesService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<OAuthScope[]> {
-    return await this.repository.get({
+    const rows = await this.repository.get({
       queryStatement,
       constraint,
       handlerMeta,
     });
+
+    return rows;
   }
 }

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/application/paginate/o-auth-paginate-scopes.handler.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/o-auth/scope.aurora.yaml
  */
-import { Pagination } from '@api/graphql';
-import { OAuthPaginateScopesService } from '@app/o-auth/scope';
-import { OAuthScopeFieldSchema } from '@app/o-auth/scope/domain';
+import { Pagination } from '@api/graphql.js';
+import { OAuthPaginateScopesService } from '@app/o-auth/scope/application/paginate/o-auth-paginate-scopes.service.js';
+import { OAuthScopeFieldSchema } from '@app/o-auth/scope/domain/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/application/paginate/o-auth-paginate-scopes.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/o-auth/scope.aurora.yaml
  */
-import { OAuthScope } from '@api/graphql';
-import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope';
+import { OAuthScope } from '@api/graphql.js';
+import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.repository.js';
 import { HandlerMeta, Pagination, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,10 +16,12 @@ export class OAuthPaginateScopesService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<Pagination<OAuthScope>> {
-    return await this.repository.paginate({
+    const pagination = await this.repository.paginate({
       queryStatement,
       constraint,
       handlerMeta,
     });
+
+    return pagination;
   }
 }

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/application/update/o-auth-update-scope-by-id.handler.ts

@@ -2,9 +2,10 @@
  * @aurora-catalyst-generated
  * @source cliter/o-auth/scope.aurora.yaml
  */
-import { OAuthScope, OAuthUpdateScopeByIdInput } from '@api/graphql';
-import { OAuthFindScopeByIdService, OAuthUpdateScopeByIdService } from '@app/o-auth/scope';
-import { OAuthScopeFieldSchema } from '@app/o-auth/scope/domain';
+import { OAuthScope, OAuthUpdateScopeByIdInput } from '@api/graphql.js';
+import { OAuthFindScopeByIdService } from '@app/o-auth/scope/application/find/o-auth-find-scope-by-id.service.js';
+import { OAuthUpdateScopeByIdService } from '@app/o-auth/scope/application/update/o-auth-update-scope-by-id.service.js';
+import { OAuthScopeFieldSchema } from '@app/o-auth/scope/domain/index.js';
 import { ApplySchema, EmitEvent, HandlerMeta, Obj, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
@@ -18,7 +19,7 @@ export class OAuthUpdateScopeByIdHandler {
   ) {}
 
   @EmitEvent('oAuth.scope.updated')
-  @ApplySchema(OAuthScopeFieldSchema)
+  @ApplySchema({ schema: OAuthScopeFieldSchema, operation: 'update' })
   async main(
     payload: OAuthUpdateScopeByIdInput,
     constraint?: QueryStatement,
@@ -36,7 +37,6 @@ export class OAuthUpdateScopeByIdHandler {
     // data loss, reproduced twice in production) — see
     // cliter/harness-rules/persistence-integrity.md.
     const dataToUpdate = Obj.diffAtomic(payload, scope);
-
     await this.updateByIdService.main(
       {
         ...dataToUpdate,

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/application/update/o-auth-update-scope-by-id.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/o-auth/scope.aurora.yaml
  */
-import { OAuthUpdateScopeByIdInput } from '@api/graphql';
-import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope';
+import { OAuthUpdateScopeByIdInput } from '@api/graphql.js';
+import { OAuthDrizzleScopeRepository } from '@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/domain/index.ts

@@ -1 +1 @@
-export * from './o-auth-scope.field-schema';
+export * from './o-auth-scope.field-schema.js';

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/index.ts

@@ -3,49 +3,30 @@
  * @source cliter/o-auth/scope.aurora.yaml
  */
 // 1 - export domain
-export * from './domain';
+export * from './domain/index.js';
 
 // 2 - export infrastructure
-export { OAuthDrizzleScopeRepository } from './infrastructure/drizzle/o-auth-drizzle-scope.repository';
-export { oAuthScopeTable } from './infrastructure/drizzle/o-auth-drizzle-scope.schema';
+export { OAuthDrizzleScopeRepository } from './infrastructure/drizzle/o-auth-drizzle-scope.repository.js';
+export { oAuthScopeTable } from './infrastructure/drizzle/o-auth-drizzle-scope.schema.js';
 
 // 3 - import services
-import { OAuthCreateScopeService } from './application/create/o-auth-create-scope.service';
-import { OAuthDeleteScopeByIdService } from './application/delete/o-auth-delete-scope-by-id.service';
-import { OAuthFindScopeByIdService } from './application/find/o-auth-find-scope-by-id.service';
-import { OAuthFindScopeService } from './application/find/o-auth-find-scope.service';
-import { OAuthGetScopesService } from './application/get/o-auth-get-scopes.service';
-import { OAuthPaginateScopesService } from './application/paginate/o-auth-paginate-scopes.service';
-import { OAuthUpdateScopeByIdService } from './application/update/o-auth-update-scope-by-id.service';
+import { OAuthCreateScopeService } from './application/create/o-auth-create-scope.service.js';
+import { OAuthDeleteScopeByIdService } from './application/delete/o-auth-delete-scope-by-id.service.js';
+import { OAuthFindScopeByIdService } from './application/find/o-auth-find-scope-by-id.service.js';
+import { OAuthFindScopeService } from './application/find/o-auth-find-scope.service.js';
+import { OAuthGetScopesService } from './application/get/o-auth-get-scopes.service.js';
+import { OAuthPaginateScopesService } from './application/paginate/o-auth-paginate-scopes.service.js';
+import { OAuthUpdateScopeByIdService } from './application/update/o-auth-update-scope-by-id.service.js';
 
 // 4 - import handlers
-import { OAuthCreateScopeHandler } from './application/create/o-auth-create-scope.handler';
-import { OAuthDeleteScopeByIdHandler } from './application/delete/o-auth-delete-scope-by-id.handler';
-import { OAuthFindScopeByIdHandler } from './application/find/o-auth-find-scope-by-id.handler';
-import { OAuthFindScopeHandler } from './application/find/o-auth-find-scope.handler';
-import { OAuthGetScopesHandler } from './application/get/o-auth-get-scopes.handler';
-import { OAuthPaginateScopesHandler } from './application/paginate/o-auth-paginate-scopes.handler';
-import { OAuthUpdateScopeByIdHandler } from './application/update/o-auth-update-scope-by-id.handler';
+import { OAuthCreateScopeHandler } from './application/create/o-auth-create-scope.handler.js';
+import { OAuthDeleteScopeByIdHandler } from './application/delete/o-auth-delete-scope-by-id.handler.js';
+import { OAuthFindScopeByIdHandler } from './application/find/o-auth-find-scope-by-id.handler.js';
+import { OAuthFindScopeHandler } from './application/find/o-auth-find-scope.handler.js';
+import { OAuthGetScopesHandler } from './application/get/o-auth-get-scopes.handler.js';
+import { OAuthPaginateScopesHandler } from './application/paginate/o-auth-paginate-scopes.handler.js';
+import { OAuthUpdateScopeByIdHandler } from './application/update/o-auth-update-scope-by-id.handler.js';
 
-export const OAuthScopeHandlers = [
-  OAuthCreateScopeHandler,
-  OAuthPaginateScopesHandler,
-  OAuthGetScopesHandler,
-  OAuthFindScopeByIdHandler,
-  OAuthFindScopeHandler,
-  OAuthUpdateScopeByIdHandler,
-  OAuthDeleteScopeByIdHandler,
-];
-
-export const OAuthScopeServices = [
-  OAuthCreateScopeService,
-  OAuthPaginateScopesService,
-  OAuthGetScopesService,
-  OAuthFindScopeService,
-  OAuthFindScopeByIdService,
-  OAuthUpdateScopeByIdService,
-  OAuthDeleteScopeByIdService,
-];
 // 5 - export services
 export {
   OAuthCreateScopeService,
@@ -68,3 +49,22 @@ export {
   OAuthUpdateScopeByIdHandler,
 };
 
+export const OAuthScopeHandlers = [
+  OAuthCreateScopeHandler,
+  OAuthPaginateScopesHandler,
+  OAuthGetScopesHandler,
+  OAuthFindScopeByIdHandler,
+  OAuthFindScopeHandler,
+  OAuthUpdateScopeByIdHandler,
+  OAuthDeleteScopeByIdHandler,
+];
+
+export const OAuthScopeServices = [
+  OAuthCreateScopeService,
+  OAuthPaginateScopesService,
+  OAuthGetScopesService,
+  OAuthFindScopeService,
+  OAuthFindScopeByIdService,
+  OAuthUpdateScopeByIdService,
+  OAuthDeleteScopeByIdService,
+];

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.repository.ts

@@ -7,8 +7,8 @@ import {
   OAuthScope,
   OAuthUpdateScopeByIdInput,
   OAuthUpdateScopesInput,
-} from '@api/graphql';
-import { oAuthScopeTable } from '@app/o-auth/scope';
+} from '@api/graphql.js';
+import { oAuthScopeTable } from '@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.schema.js';
 import {
   AuditingRunner,
   DRIZZLE_CONNECTION,

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/scope/infrastructure/drizzle/o-auth-drizzle-scope.schema.ts

@@ -16,5 +16,8 @@ export const oAuthScopeTable = pgTable(
     updatedAt: timestamp('updated_at', { mode: 'string', withTimezone: true }),
     deletedAt: timestamp('deleted_at', { mode: 'string', withTimezone: true }),
   },
-  (table) => [uniqueIndex('o_auth_scope_row_id').on(table.rowId), uniqueIndex('o_auth_scope_code').on(table.code)],
+  (table) => [
+    uniqueIndex('o_auth_scope_row_id').on(table.rowId),
+    uniqueIndex('o_auth_scope_code').on(table.code),
+  ],
 );

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-authenticate-application.function.spec.ts

@@ -2,22 +2,23 @@
  * Unit tests for oAuthAuthenticateApplication after the bcrypt.compare migration (D2).
  *
  * We mock 'bcrypt' at the module level because the bcrypt native addon marks its
- * exports as non-configurable in some environments, making jest.spyOn unreliable.
+ * exports as non-configurable in some environments, making vi.spyOn unreliable.
  * The mock is replaced per-test via bcryptCompareMock.mockResolvedValue(…).
  */
-jest.mock('bcrypt', () => ({
-  compare: jest.fn(),
+vi.mock('bcrypt', () => ({
+  compare: vi.fn(),
 }));
 
+import type { Mock } from 'vitest';
 import * as bcrypt from 'bcrypt';
-import { InvalidClientError } from '../../flows/domain/errors';
+import { InvalidClientError } from '../../flows/domain/errors/index.js';
 import {
   oAuthAuthenticateApplication,
   type OAuthFindApplicationPort,
-} from './o-auth-authenticate-application.function';
+} from './o-auth-authenticate-application.function.js';
 
 // Typed reference to the mocked compare function
-const bcryptCompareMock = bcrypt.compare as jest.Mock;
+const bcryptCompareMock = bcrypt.compare as Mock;
 
 const APPLICATION_CODE = 'aurora';
 // The plaintext the frontend presents on the password grant
@@ -33,7 +34,7 @@ const buildApplication = (overrides: Record<string, unknown> = {}) => ({
   ...overrides,
 });
 
-const buildFind = (impl: jest.Mock): OAuthFindApplicationPort => ({ main: impl });
+const buildFind = (impl: Mock): OAuthFindApplicationPort => ({ main: impl });
 
 const args = (overrides: Partial<Parameters<typeof oAuthAuthenticateApplication>[1]> = {}) => ({
   clientId: APPLICATION_CODE,
@@ -43,12 +44,12 @@ const args = (overrides: Partial<Parameters<typeof oAuthAuthenticateApplication>
 
 describe('oAuthAuthenticateApplication — bcrypt.compare verification', () => {
   beforeEach(() => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
   });
 
   it('(a) returns the application when presented plaintext matches the stored bcrypt hash', async () => {
     const application = buildApplication();
-    const findApplication = buildFind(jest.fn().mockResolvedValue(application));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(application));
     bcryptCompareMock.mockResolvedValue(true);
 
     const result = await oAuthAuthenticateApplication(findApplication, args());
@@ -62,7 +63,7 @@ describe('oAuthAuthenticateApplication — bcrypt.compare verification', () => {
 
   it('(b) throws InvalidClientError when bcrypt.compare returns false (wrong plaintext)', async () => {
     const application = buildApplication();
-    const findApplication = buildFind(jest.fn().mockResolvedValue(application));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(application));
     bcryptCompareMock.mockResolvedValue(false);
 
     await expect(
@@ -72,7 +73,7 @@ describe('oAuthAuthenticateApplication — bcrypt.compare verification', () => {
 
   it('(c) throws InvalidClientError for unknown code — indistinguishable from wrong secret', async () => {
     // Repository throws (application not found)
-    const findApplication = buildFind(jest.fn().mockRejectedValue(new Error('NotFound')));
+    const findApplication = buildFind(vi.fn().mockRejectedValue(new Error('NotFound')));
     bcryptCompareMock.mockResolvedValue(false);
 
     await expect(
@@ -85,7 +86,7 @@ describe('oAuthAuthenticateApplication — bcrypt.compare verification', () => {
 
   it('(d) the not-found path (null return) performs a bcrypt comparison (timing-equivalent to a real compare)', async () => {
     // Repository returns null (application not found)
-    const findApplication = buildFind(jest.fn().mockResolvedValue(null));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(null));
     bcryptCompareMock.mockResolvedValue(false);
 
     await expect(oAuthAuthenticateApplication(findApplication, args())).rejects.toBeInstanceOf(
@@ -97,7 +98,7 @@ describe('oAuthAuthenticateApplication — bcrypt.compare verification', () => {
   });
 
   it('queries the application by code with clients eager-loaded', async () => {
-    const main = jest.fn().mockResolvedValue(buildApplication());
+    const main = vi.fn().mockResolvedValue(buildApplication());
     bcryptCompareMock.mockResolvedValue(true);
 
     await oAuthAuthenticateApplication(buildFind(main), args());

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-authenticate-application.function.ts

@@ -1,7 +1,7 @@
-import { type OAuthApplication } from '@api/graphql';
+import { type OAuthApplication } from '@api/graphql.js';
 import type { QueryStatement } from '@aurorajs.dev/core-back';
 import * as bcrypt from 'bcrypt';
-import { InvalidClientError } from '../../flows/domain/errors';
+import { InvalidClientError } from '../../flows/domain/errors/index.js';
 
 /**
  * Minimal port over the Cliter-generated `OAuthFindApplicationService`. The service's

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-generate-application-secret.function.spec.ts

@@ -1,4 +1,4 @@
-import { generateApplicationSecret } from './o-auth-generate-application-secret.function';
+import { generateApplicationSecret } from './o-auth-generate-application-secret.function.js';
 
 describe('generateApplicationSecret', () => {
   it('should return a non-empty string', () => {

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-generate-application-secret.function.ts

@@ -5,8 +5,9 @@ import { randomBytes } from 'node:crypto';
  *
  * Produces 32 random bytes encoded as a 64-character lowercase hex string.
  * This plaintext is passed to `OAuthCreateApplicationHandler.main()` which carries
- * `@ApplySchema(OAuthApplicationFieldSchema)` — the password type handler bcrypt-hashes
- * the plaintext before storing it in `OAuthApplication.secret`.
+ * `@ApplySchema({ schema: OAuthApplicationFieldSchema, operation: 'create' })` — the
+ * password type handler bcrypt-hashes the plaintext before storing it in
+ * `OAuthApplication.secret`.
  *
  * The plaintext is returned ONCE in the one-time credential bundle (BR-HUB-APP-003
  * reinforced: delivered exactly once, never re-readable from the stored hash).

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-resolve-application-client.function.spec.ts

@@ -2,22 +2,23 @@
 // The real bcrypt.compare(plaintext, hash) would always fail with plaintext stored.
 // Stubbing it to return true only when presented value equals stored value preserves
 // the test semantics (match / mismatch) without requiring real hashes in fixtures.
-jest.mock('bcrypt', () => ({
-  compare: jest.fn((presented: string, stored: string) => Promise.resolve(presented === stored)),
+vi.mock('bcrypt', () => ({
+  compare: vi.fn((presented: string, stored: string) => Promise.resolve(presented === stored)),
 }));
 
-import { OAuthClientGrantTypeEnum } from '@api/graphql';
+import type { Mock } from 'vitest';
+import { OAuthClientGrantTypeEnum } from '@api/graphql.js';
 import { BadRequestException, InternalServerErrorException, Logger } from '@nestjs/common';
 import {
   InvalidClientError,
   InvalidRequestError,
   UnauthorizedClientError,
-} from '../../flows/domain/errors';
-import { type OAuthFindApplicationPort } from './o-auth-authenticate-application.function';
+} from '../../flows/domain/errors/index.js';
+import { type OAuthFindApplicationPort } from './o-auth-authenticate-application.function.js';
 import {
   oAuthResolveApplicationClient,
   oAuthResolveApplicationClientWithoutSecret,
-} from './o-auth-resolve-application-client.function';
+} from './o-auth-resolve-application-client.function.js';
 
 const APPLICATION_CODE = 'aurora';
 const APPLICATION_SECRET = 'top-secret-12345';
@@ -31,7 +32,7 @@ const buildApplication = (overrides: Record<string, unknown> = {}) => ({
   ...overrides,
 });
 
-const buildFind = (impl: jest.Mock): OAuthFindApplicationPort => ({ main: impl });
+const buildFind = (impl: Mock): OAuthFindApplicationPort => ({ main: impl });
 
 const args = (overrides: Partial<Parameters<typeof oAuthResolveApplicationClient>[1]> = {}) => ({
   clientId: APPLICATION_CODE,
@@ -42,7 +43,7 @@ const args = (overrides: Partial<Parameters<typeof oAuthResolveApplicationClient
 
 describe('oAuthResolveApplicationClient', () => {
   it('resolves the single client matching the grant type', async () => {
-    const findApplication = buildFind(jest.fn().mockResolvedValue(buildApplication()));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(buildApplication()));
 
     const client = await oAuthResolveApplicationClient(findApplication, args());
 
@@ -50,7 +51,7 @@ describe('oAuthResolveApplicationClient', () => {
   });
 
   it('queries the application by code with clients eager-loaded', async () => {
-    const main = jest.fn().mockResolvedValue(buildApplication());
+    const main = vi.fn().mockResolvedValue(buildApplication());
     await oAuthResolveApplicationClient(buildFind(main), args());
 
     expect(main).toHaveBeenCalledWith({
@@ -60,7 +61,7 @@ describe('oAuthResolveApplicationClient', () => {
   });
 
   it('throws InvalidClientError when the application is not found (repository throws)', async () => {
-    const findApplication = buildFind(jest.fn().mockRejectedValue(new Error('NotFound')));
+    const findApplication = buildFind(vi.fn().mockRejectedValue(new Error('NotFound')));
 
     await expect(oAuthResolveApplicationClient(findApplication, args())).rejects.toBeInstanceOf(
       InvalidClientError,
@@ -69,7 +70,7 @@ describe('oAuthResolveApplicationClient', () => {
 
   it('throws InvalidClientError when the application secret mismatches', async () => {
     const findApplication = buildFind(
-      jest.fn().mockResolvedValue(buildApplication({ secret: 'different' })),
+      vi.fn().mockResolvedValue(buildApplication({ secret: 'different' })),
     );
 
     await expect(oAuthResolveApplicationClient(findApplication, args())).rejects.toBeInstanceOf(
@@ -79,7 +80,7 @@ describe('oAuthResolveApplicationClient', () => {
 
   it('throws UnauthorizedClientError when no client matches the grant type', async () => {
     const findApplication = buildFind(
-      jest
+      vi
         .fn()
         .mockResolvedValue(
           buildApplication({ clients: [{ id: 'x', grantType: 'REFRESH_TOKEN' }] }),
@@ -93,7 +94,7 @@ describe('oAuthResolveApplicationClient', () => {
 
   it('throws UnauthorizedClientError when the application has no clients at all', async () => {
     const findApplication = buildFind(
-      jest.fn().mockResolvedValue(buildApplication({ clients: [] })),
+      vi.fn().mockResolvedValue(buildApplication({ clients: [] })),
     );
 
     await expect(oAuthResolveApplicationClient(findApplication, args())).rejects.toBeInstanceOf(
@@ -102,9 +103,9 @@ describe('oAuthResolveApplicationClient', () => {
   });
 
   it('throws InternalServerErrorException and logs when more than one client matches the grant', async () => {
-    const errorSpy = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => {});
+    const errorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => {});
     const findApplication = buildFind(
-      jest.fn().mockResolvedValue(
+      vi.fn().mockResolvedValue(
         buildApplication({
           clients: [
             { id: 'cli-a', grantType: 'PASSWORD' },
@@ -124,7 +125,7 @@ describe('oAuthResolveApplicationClient', () => {
 
   it('selects the REFRESH_TOKEN client when that grant is requested', async () => {
     const findApplication = buildFind(
-      jest.fn().mockResolvedValue(
+      vi.fn().mockResolvedValue(
         buildApplication({
           clients: [
             { id: 'cli-pwd', grantType: 'PASSWORD' },
@@ -172,7 +173,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
   it('resolves the AUTHORIZATION_CODE client even when the application has a NON-EMPTY secret (RFC 6749 §4.1.1)', async () => {
     const APPLICATION_WITH_REAL_SECRET = 'app-secret-123';
     const findApplication = buildFind(
-      jest
+      vi
         .fn()
         .mockResolvedValue(buildAppWithAuthCodeClient({ secret: APPLICATION_WITH_REAL_SECRET })),
     );
@@ -187,7 +188,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
   });
 
   it('resolves the client matching AUTHORIZATION_CODE grant', async () => {
-    const findApplication = buildFind(jest.fn().mockResolvedValue(buildAppWithAuthCodeClient()));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(buildAppWithAuthCodeClient()));
 
     const client = await oAuthResolveApplicationClientWithoutSecret(
       findApplication,
@@ -198,7 +199,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
   });
 
   it('queries the application by code with clients eager-loaded (no secret sent)', async () => {
-    const main = jest.fn().mockResolvedValue(buildAppWithAuthCodeClient());
+    const main = vi.fn().mockResolvedValue(buildAppWithAuthCodeClient());
     await oAuthResolveApplicationClientWithoutSecret(buildFind(main), argsWithoutSecret());
 
     expect(main).toHaveBeenCalledWith({
@@ -211,7 +212,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
     // Per Fix 3: only "not found" (null return) becomes InvalidClientError.
     // Transient DB faults (throws) propagate → 500, not invalid_client.
     const dbError = new Error('DB connection refused');
-    const findApplication = buildFind(jest.fn().mockRejectedValue(dbError));
+    const findApplication = buildFind(vi.fn().mockRejectedValue(dbError));
 
     await expect(
       oAuthResolveApplicationClientWithoutSecret(findApplication, argsWithoutSecret()),
@@ -225,7 +226,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
   // here — the /authorize endpoint does not authenticate the client, it only
   // identifies it. An unknown client_id is a bad-request, not an auth failure.
   it('throws a 400-class error (NOT 401) when the application query returns null — spec §4.1 regression guard', async () => {
-    const findApplication = buildFind(jest.fn().mockResolvedValue(null));
+    const findApplication = buildFind(vi.fn().mockResolvedValue(null));
 
     const rejection = oAuthResolveApplicationClientWithoutSecret(
       findApplication,
@@ -240,7 +241,7 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
 
   it('throws UnauthorizedClientError when no client has AUTHORIZATION_CODE grant', async () => {
     const findApplication = buildFind(
-      jest
+      vi
         .fn()
         .mockResolvedValue(buildApplication({ clients: [{ id: 'cli-x', grantType: 'PASSWORD' }] })),
     );
@@ -251,9 +252,9 @@ describe('oAuthResolveApplicationClientWithoutSecret', () => {
   });
 
   it('throws InternalServerErrorException when multiple AUTHORIZATION_CODE clients exist', async () => {
-    const errorSpy = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => {});
+    const errorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => {});
     const findApplication = buildFind(
-      jest.fn().mockResolvedValue(
+      vi.fn().mockResolvedValue(
         buildApplication({
           clients: [
             { id: 'cli-a', grantType: 'AUTHORIZATION_CODE' },

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/functions/o-auth-resolve-application-client.function.ts

@@ -1,11 +1,11 @@
-import { type OAuthClient, OAuthClientGrantTypeEnum } from '@api/graphql';
+import { type OAuthClient, OAuthClientGrantTypeEnum } from '@api/graphql.js';
 import type { QueryStatement } from '@aurorajs.dev/core-back';
 import { InternalServerErrorException, Logger } from '@nestjs/common';
-import { InvalidRequestError, UnauthorizedClientError } from '../../flows/domain/errors';
+import { InvalidRequestError, UnauthorizedClientError } from '../../flows/domain/errors/index.js';
 import {
   oAuthAuthenticateApplication,
   type OAuthFindApplicationPort,
-} from './o-auth-authenticate-application.function';
+} from './o-auth-authenticate-application.function.js';
 
 const logger = new Logger('oAuthResolveApplicationClient');
 

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/index.ts

@@ -1,6 +1,6 @@
-export * from './functions/o-auth-authenticate-application.function';
-export * from './functions/o-auth-generate-application-secret.function';
-export * from './functions/o-auth-parse-basic-auth.function';
-export * from './functions/o-auth-resolve-application-client.function';
-export * from './functions/o-auth-safe-string-compare.function';
-export * from './services/token-retention.service';
+export * from './functions/o-auth-authenticate-application.function.js';
+export * from './functions/o-auth-generate-application-secret.function.js';
+export * from './functions/o-auth-parse-basic-auth.function.js';
+export * from './functions/o-auth-resolve-application-client.function.js';
+export * from './functions/o-auth-safe-string-compare.function.js';
+export * from './services/token-retention.service.js';

package/dist/templates/backend/packages/o-auth/src/@app/o-auth/shared/services/token-retention.service.spec.ts

@@ -1,10 +1,11 @@
 // TDD RED phase (F3 Drizzle port) — rewrites the Sequelize-era spec to the raw-SQL
 // contract over DRIZZLE_CONNECTION (design D3c): advisory lock + 3 DELETEs run via
 // `tx.execute(sql...)` inside ONE `db.transaction`, counts read from pg's rowCount.
+import type { Mock } from 'vitest';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
 import { ConfigService } from '@nestjs/config';
 import { Test, TestingModule } from '@nestjs/testing';
-import { TokenRetentionService } from './token-retention.service';
+import { TokenRetentionService } from './token-retention.service.js';
 
 // Drizzle `sql` tagged templates produce queryChunks mixing StringChunk (static
 // text — its `value` is a string ARRAY) and the interpolated values themselves
@@ -26,8 +27,8 @@ const sqlText = (query: unknown): string => {
 
 describe('TokenRetentionService', () => {
   let service: TokenRetentionService;
-  let tx: { execute: jest.Mock };
-  let db: { transaction: jest.Mock };
+  let tx: { execute: Mock };
+  let db: { transaction: Mock };
 
   const buildModule = async (
     env: Record<string, string | number> = {},
@@ -35,7 +36,7 @@ describe('TokenRetentionService', () => {
   ): Promise<void> => {
     const lockAcquired = options.lockAcquired !== false;
 
-    tx = { execute: jest.fn() };
+    tx = { execute: vi.fn() };
     // Call 1 = advisory lock SELECT; calls 2..4 = the three DELETEs (access/refresh/credential).
     tx.execute
       .mockResolvedValueOnce({ rows: [{ acquired: lockAcquired }] })
@@ -43,10 +44,10 @@ describe('TokenRetentionService', () => {
       .mockResolvedValueOnce({ rows: [], rowCount: 5 })
       .mockResolvedValueOnce({ rows: [], rowCount: 12 });
 
-    db = { transaction: jest.fn().mockImplementation(async (cb) => cb(tx)) };
+    db = { transaction: vi.fn().mockImplementation(async (cb) => cb(tx)) };
 
     const config = {
-      get: jest.fn((key: string, fallback?: unknown) =>
+      get: vi.fn((key: string, fallback?: unknown) =>
         env[key] !== undefined ? env[key] : fallback,
       ),
     };

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/application/adapters/index.ts

@@ -1 +1 @@
-export * from './o-auth-application-provisioner.adapter';
+export * from './o-auth-application-provisioner.adapter.js';