@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/application/adapters/o-auth-application-provisioner.adapter.spec.ts

@@ -8,69 +8,69 @@
 //                    { transaction } })`; Operator.in/Op.in become DSL `{ in: [...] }`
 //                    (BR-HUB-APP-015 deprovision atomicity unchanged).
 //
-// NOTE: The o-auth module pulls in @aurorajs.dev/core-back which contains ESM
-// modules that ts-jest cannot transform (the Jest+@Auth ESM limitation documented
-// in project memory). We use jest.mock (hoisted) to replace those modules with
-// lightweight stubs before any real import loads.
+// NOTE: The o-auth module pulls in a heavy dependency graph (@aurorajs.dev/core-back and
+// the sibling o-auth submodules). We use vi.mock (hoisted) to replace those modules with
+// lightweight stubs before any real import loads, isolating the adapter under test.
 
-// — jest.mock calls must come before imports (hoisted by Babel/ts-jest) ————
-jest.mock('@api/graphql', () => ({
+// — vi.mock calls must come before imports (hoisted by Vitest) ————
+vi.mock('@api/graphql.js', () => ({
   OAuthClientGrantTypeEnum: { AUTHORIZATION_CODE: 'AUTHORIZATION_CODE' },
 }));
 // Each module mock includes both the handler/service AND the repository class,
 // so the same file serves provision() tests (handlers) and deprovision() tests (repos).
-jest.mock('@app/o-auth/application', () => ({
+vi.mock('@app/o-auth/application/index.js', () => ({
   OAuthCreateApplicationHandler: class OAuthCreateApplicationHandler {},
   OAuthFindApplicationByIdService: class OAuthFindApplicationByIdService {},
   OAuthDrizzleApplicationRepository: class OAuthDrizzleApplicationRepository {},
 }));
-jest.mock('@app/o-auth/client', () => ({
+vi.mock('@app/o-auth/client/index.js', () => ({
   OAuthCreateClientHandler: class OAuthCreateClientHandler {},
   OAuthDrizzleClientRepository: class OAuthDrizzleClientRepository {},
 }));
-jest.mock('@app/o-auth/application-client', () => ({
+vi.mock('@app/o-auth/application-client/index.js', () => ({
   OAuthCreateApplicationClientService: class OAuthCreateApplicationClientService {},
   OAuthDrizzleApplicationClientRepository: class OAuthDrizzleApplicationClientRepository {},
 }));
-jest.mock('@app/o-auth/access-token', () => ({
+vi.mock('@app/o-auth/access-token/index.js', () => ({
   OAuthDrizzleAccessTokenRepository: class OAuthDrizzleAccessTokenRepository {},
 }));
-jest.mock('@app/o-auth/refresh-token', () => ({
+vi.mock('@app/o-auth/refresh-token/index.js', () => ({
   OAuthDrizzleRefreshTokenRepository: class OAuthDrizzleRefreshTokenRepository {},
 }));
-jest.mock('@app/o-auth/shared', () => ({
-  generateApplicationSecret: jest.fn(),
+vi.mock('@app/o-auth/shared/index.js', () => ({
+  generateApplicationSecret: vi.fn(),
 }));
 
-// — imports (load after jest.mock hoisting resolves to stubs) ——————————————
-import { OAuthClientGrantTypeEnum } from '@api/graphql';
-import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token';
+// — imports (load after vi.mock hoisting resolves to stubs) ——————————————
+import type { Mock } from 'vitest';
+import { OAuthClientGrantTypeEnum } from '@api/graphql.js';
+import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token/index.js';
 import {
   OAuthCreateApplicationHandler,
   OAuthDrizzleApplicationRepository,
-} from '@app/o-auth/application';
+} from '@app/o-auth/application/index.js';
 import {
   OAuthCreateApplicationClientService,
   OAuthDrizzleApplicationClientRepository,
-} from '@app/o-auth/application-client';
-import { OAuthCreateClientHandler, OAuthDrizzleClientRepository } from '@app/o-auth/client';
-import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token';
-import { generateApplicationSecret } from '@app/o-auth/shared';
+} from '@app/o-auth/application-client/index.js';
+import { OAuthCreateClientHandler, OAuthDrizzleClientRepository } from '@app/o-auth/client/index.js';
+import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token/index.js';
+import { generateApplicationSecret } from '@app/o-auth/shared/index.js';
 import { InternalServerErrorException } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
-import { OAuthApplicationProvisionerAdapter } from './o-auth-application-provisioner.adapter';
+import { OAuthApplicationProvisionerAdapter } from './o-auth-application-provisioner.adapter.js';
 
 describe('OAuthApplicationProvisionerAdapter', () => {
   let adapter: OAuthApplicationProvisionerAdapter;
 
   const mockCreateApplicationHandler = {
-    main: jest.fn(),
+    main: vi.fn(),
   };
   const mockCreateClientHandler = {
-    main: jest.fn(),
+    main: vi.fn(),
   };
   const mockCreateApplicationClientService = {
-    main: jest.fn(),
+    main: vi.fn(),
   };
 
   const FIXED_SECRET = 'test-secret-hex-32chars-xxxxxxxxxxxx';
@@ -81,8 +81,8 @@ describe('OAuthApplicationProvisionerAdapter', () => {
   const FIXED_TX = { transaction: Symbol('provision-tx') as any };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
-    (generateApplicationSecret as jest.Mock).mockReturnValue(FIXED_SECRET);
+    vi.clearAllMocks();
+    (generateApplicationSecret as Mock).mockReturnValue(FIXED_SECRET);
 
     mockCreateApplicationHandler.main.mockImplementation(async (payload: any) => ({
       id: payload.id,
@@ -117,23 +117,23 @@ describe('OAuthApplicationProvisionerAdapter', () => {
         // Deprovision repositories — provided as no-ops so provision() tests compile
         {
           provide: OAuthDrizzleApplicationClientRepository,
-          useValue: { get: jest.fn(), delete: jest.fn() },
+          useValue: { get: vi.fn(), delete: vi.fn() },
         },
         {
           provide: OAuthDrizzleAccessTokenRepository,
-          useValue: { get: jest.fn(), delete: jest.fn() },
+          useValue: { get: vi.fn(), delete: vi.fn() },
         },
         {
           provide: OAuthDrizzleRefreshTokenRepository,
-          useValue: { get: jest.fn(), delete: jest.fn() },
+          useValue: { get: vi.fn(), delete: vi.fn() },
         },
         {
           provide: OAuthDrizzleClientRepository,
-          useValue: { get: jest.fn(), delete: jest.fn() },
+          useValue: { get: vi.fn(), delete: vi.fn() },
         },
         {
           provide: OAuthDrizzleApplicationRepository,
-          useValue: { get: jest.fn(), delete: jest.fn() },
+          useValue: { get: vi.fn(), delete: vi.fn() },
         },
       ],
     }).compile();
@@ -341,29 +341,29 @@ describe('OAuthApplicationProvisionerAdapter', () => {
     const ACCESS_TOKEN_ID_2 = 'at-uuid-2222';
 
     // Repository mocks — object literals with `.get` and `.delete`
-    let mockPivotRepo: { get: jest.Mock; delete: jest.Mock };
-    let mockAccessTokenRepo: { get: jest.Mock; delete: jest.Mock };
-    let mockRefreshTokenRepo: { get: jest.Mock; delete: jest.Mock };
-    let mockClientRepo: { get: jest.Mock; delete: jest.Mock };
-    let mockApplicationRepo: { get: jest.Mock; delete: jest.Mock };
+    let mockPivotRepo: { get: Mock; delete: Mock };
+    let mockAccessTokenRepo: { get: Mock; delete: Mock };
+    let mockRefreshTokenRepo: { get: Mock; delete: Mock };
+    let mockClientRepo: { get: Mock; delete: Mock };
+    let mockApplicationRepo: { get: Mock; delete: Mock };
 
     let deprovisionAdapter: OAuthApplicationProvisionerAdapter;
 
     beforeEach(async () => {
-      jest.clearAllMocks();
+      vi.clearAllMocks();
 
-      mockPivotRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-      mockAccessTokenRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-      mockRefreshTokenRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-      mockClientRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-      mockApplicationRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
+      mockPivotRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+      mockAccessTokenRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+      mockRefreshTokenRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+      mockClientRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+      mockApplicationRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
 
       const moduleRef = await Test.createTestingModule({
         providers: [
           OAuthApplicationProvisionerAdapter,
-          { provide: OAuthCreateApplicationHandler, useValue: { main: jest.fn() } },
-          { provide: OAuthCreateClientHandler, useValue: { main: jest.fn() } },
-          { provide: OAuthCreateApplicationClientService, useValue: { main: jest.fn() } },
+          { provide: OAuthCreateApplicationHandler, useValue: { main: vi.fn() } },
+          { provide: OAuthCreateClientHandler, useValue: { main: vi.fn() } },
+          { provide: OAuthCreateApplicationClientService, useValue: { main: vi.fn() } },
           { provide: OAuthDrizzleApplicationClientRepository, useValue: mockPivotRepo },
           { provide: OAuthDrizzleAccessTokenRepository, useValue: mockAccessTokenRepo },
           { provide: OAuthDrizzleRefreshTokenRepository, useValue: mockRefreshTokenRepo },
@@ -636,20 +636,20 @@ describe('OAuthApplicationProvisionerAdapter', () => {
       const OTHER_APP_ID = 'other-app-uuid';
 
       let sharedClientAdapter: OAuthApplicationProvisionerAdapter;
-      let sharedPivotRepo: { get: jest.Mock; delete: jest.Mock };
-      let sharedAccessTokenRepo: { get: jest.Mock; delete: jest.Mock };
-      let sharedRefreshTokenRepo: { get: jest.Mock; delete: jest.Mock };
-      let sharedClientRepo: { get: jest.Mock; delete: jest.Mock };
-      let sharedApplicationRepo: { get: jest.Mock; delete: jest.Mock };
+      let sharedPivotRepo: { get: Mock; delete: Mock };
+      let sharedAccessTokenRepo: { get: Mock; delete: Mock };
+      let sharedRefreshTokenRepo: { get: Mock; delete: Mock };
+      let sharedClientRepo: { get: Mock; delete: Mock };
+      let sharedApplicationRepo: { get: Mock; delete: Mock };
 
       beforeEach(async () => {
-        jest.clearAllMocks();
+        vi.clearAllMocks();
 
-        sharedPivotRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-        sharedAccessTokenRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-        sharedRefreshTokenRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-        sharedClientRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
-        sharedApplicationRepo = { get: jest.fn(), delete: jest.fn().mockResolvedValue(undefined) };
+        sharedPivotRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+        sharedAccessTokenRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+        sharedRefreshTokenRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+        sharedClientRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
+        sharedApplicationRepo = { get: vi.fn(), delete: vi.fn().mockResolvedValue(undefined) };
 
         // Pivot get is called twice:
         //   1st call: resolve this app's clientIds → [SHARED_CLIENT_ID, EXCLUSIVE_CLIENT_ID]
@@ -666,9 +666,9 @@ describe('OAuthApplicationProvisionerAdapter', () => {
         const moduleRef = await Test.createTestingModule({
           providers: [
             OAuthApplicationProvisionerAdapter,
-            { provide: OAuthCreateApplicationHandler, useValue: { main: jest.fn() } },
-            { provide: OAuthCreateClientHandler, useValue: { main: jest.fn() } },
-            { provide: OAuthCreateApplicationClientService, useValue: { main: jest.fn() } },
+            { provide: OAuthCreateApplicationHandler, useValue: { main: vi.fn() } },
+            { provide: OAuthCreateClientHandler, useValue: { main: vi.fn() } },
+            { provide: OAuthCreateApplicationClientService, useValue: { main: vi.fn() } },
             { provide: OAuthDrizzleApplicationClientRepository, useValue: sharedPivotRepo },
             { provide: OAuthDrizzleAccessTokenRepository, useValue: sharedAccessTokenRepo },
             { provide: OAuthDrizzleRefreshTokenRepository, useValue: sharedRefreshTokenRepo },

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/application/adapters/o-auth-application-provisioner.adapter.ts

@@ -22,26 +22,26 @@
  * See: openspec/changes/add-hub-oauth-provisioning/design.md, decision D2 + D3.
  * See: openspec/changes/add-hub-app-deprovisioning/design.md, decision D3 + D4.
  */
-import { OAuthClientGrantTypeEnum } from '@api/graphql';
-import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token';
+import { OAuthClientGrantTypeEnum } from '@api/graphql.js';
+import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token/index.js';
 import {
   OAuthCreateApplicationHandler,
   OAuthDrizzleApplicationRepository,
-} from '@app/o-auth/application';
+} from '@app/o-auth/application/index.js';
 import {
   OAuthCreateApplicationClientService,
   OAuthDrizzleApplicationClientRepository,
-} from '@app/o-auth/application-client';
-import { OAuthCreateClientHandler, OAuthDrizzleClientRepository } from '@app/o-auth/client';
-import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token';
-import { generateApplicationSecret } from '@app/o-auth/shared';
+} from '@app/o-auth/application-client/index.js';
+import { OAuthCreateClientHandler, OAuthDrizzleClientRepository } from '@app/o-auth/client/index.js';
+import { OAuthDrizzleRefreshTokenRepository } from '@app/o-auth/refresh-token/index.js';
+import { generateApplicationSecret } from '@app/o-auth/shared/index.js';
 import type { RepositoryOptions } from '@aurorajs.dev/core-back';
 import { Injectable, InternalServerErrorException } from '@nestjs/common';
 import type {
   IOAuthApplicationProvisioner,
   OAuthProvisionInput,
   OAuthProvisionResult,
-} from '../ports';
+} from '../ports/index.js';
 
 @Injectable()
 export class OAuthApplicationProvisionerAdapter implements IOAuthApplicationProvisioner {
@@ -84,10 +84,10 @@ export class OAuthApplicationProvisionerAdapter implements IOAuthApplicationProv
     const secret = generateApplicationSecret();
 
     // Step 1 — Create OAuthApplication (code = public client_id).
-    // The handler carries @ApplySchema(OAuthApplicationFieldSchema) which bcrypt-hashes
-    // `secret` via the password type handler before persisting. The plaintext is returned
-    // in the credential bundle (see `return` below) and is NEVER re-readable from the stored
-    // hash. BR-HUB-APP-003: one-time plaintext delivery reinforced.
+    // The handler carries @ApplySchema({ schema: OAuthApplicationFieldSchema, operation: 'create' })
+    // which bcrypt-hashes `secret` via the password type handler before persisting. The
+    // plaintext is returned in the credential bundle (see `return` below) and is NEVER
+    // re-readable from the stored hash. BR-HUB-APP-003: one-time plaintext delivery reinforced.
     await this.createApplicationHandler.main(
       {
         id: input.applicationId,

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/application/index.ts

@@ -1 +1 @@
-export * from './ports';
+export * from './ports/index.js';

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/application/ports/index.ts

@@ -1,2 +1,2 @@
-export * from './o-auth-application-provisioner.port';
-export * from './o-auth-application-provisioner.token';
+export * from './o-auth-application-provisioner.port.js';
+export * from './o-auth-application-provisioner.token.js';

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/client/adapters/index.ts

@@ -1 +1 @@
-export * from './o-auth-client-reader.adapter';
+export * from './o-auth-client-reader.adapter.js';

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/client/adapters/o-auth-client-reader.adapter.spec.ts

@@ -2,20 +2,21 @@
 // Pins the Aurora Query DSL constraint shape (relations.applications, not a
 // Sequelize include) and the port's mapping/not-found contract (HR-BRIDGES-001:
 // adapter under @bridges/, IIamClientReader port signature unchanged).
-import { OAuthFindClientByIdService } from '@app/o-auth/client';
+import type { Mock } from 'vitest';
+import { OAuthFindClientByIdService } from '@app/o-auth/client/index.js';
 import { NotFoundException } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
-import { OAuthClientReaderAdapter } from './o-auth-client-reader.adapter';
+import { OAuthClientReaderAdapter } from './o-auth-client-reader.adapter.js';
 
 const CLIENT_ID = 'cli-1111-1111-1111-111111111111';
 
 describe('OAuthClientReaderAdapter', () => {
   let adapter: OAuthClientReaderAdapter;
-  let findByIdService: { main: jest.Mock };
+  let findByIdService: { main: Mock };
 
   beforeEach(async () => {
     findByIdService = {
-      main: jest.fn().mockResolvedValue({
+      main: vi.fn().mockResolvedValue({
         id: CLIENT_ID,
         applications: [{ code: 'aurora' }, { code: null }, { code: 'satellite' }],
       }),

package/dist/templates/backend/packages/o-auth/src/@bridges/o-auth/client/adapters/o-auth-client-reader.adapter.ts

@@ -1,6 +1,6 @@
-import { OAuthFindClientByIdService } from '@app/o-auth/client';
+import { OAuthFindClientByIdService } from '@app/o-auth/client/index.js';
 import { QueryStatement } from '@aurorajs.dev/core-back';
-import { IamClientWithApplications, IIamClientReader } from '@bridges/iam/client';
+import { IamClientWithApplications, IIamClientReader } from '@bridges/iam/client/index.js';
 import { Injectable, NotFoundException } from '@nestjs/common';
 
 @Injectable()

package/dist/templates/backend/packages/o-auth/src/@bridges/providers/iam-client-reader.bridge.ts

@@ -1,5 +1,5 @@
-import { IAM_CLIENT_READER } from '@bridges/iam/client';
-import { OAuthClientReaderAdapter } from '@bridges/o-auth/client/adapters';
+import { IAM_CLIENT_READER } from '@bridges/iam/client/index.js';
+import { OAuthClientReaderAdapter } from '@bridges/o-auth/client/adapters/index.js';
 import { Provider } from '@nestjs/common';
 
 export const iamClientReaderBridge: Provider = {

package/dist/templates/backend/packages/o-auth/test/acceptance/o-auth/impersonate-token-guarded-transports.e2e-spec.ts

@@ -1,11 +1,10 @@
 /**
  * E2E — impersonate-token flow, guarded transports (Task Group 6, add-account-impersonation).
  *
- * Covers what unit tests (phase 4) cannot reach: ts-jest cannot load `@Auth`-decorated
- * transport classes in isolation (the `@aurora/modules` barrel pulls the jwks-rsa/jose ESM
- * chain), so the guard/permission behavior of `OAuthCreateImpersonateTokenController` and
- * `OAuthCreateImpersonateTokenResolver` is proven here instead, via a REAL, fully-booted
- * `AppModule` (real DB, real Drizzle, real RS256 signing) driven with `supertest`.
+ * Covers what a unit test with a faked `ExecutionContext` cannot: the guard/permission
+ * behavior of `OAuthCreateImpersonateTokenController` and `OAuthCreateImpersonateTokenResolver`
+ * as NestJS's own request pipeline actually wires it, via a REAL, fully-booted `AppModule`
+ * (real DB, real Drizzle, real RS256 signing) driven with `supertest`.
  *
  * The three anti-escalation vetoes (V1/V2/V3) and the not-found/inactive/no-client refusal are
  * ALREADY unit-tested against the composite handler directly (phase 4) — this suite does not
@@ -26,30 +25,13 @@
  *    `o_auth_credential`/`o_auth_access_token` FKs to `iam_account` are `avoidConstraint: true`
  *    in the YAML (no DB-level FK), so this suite's rows never risk orphaning a shared table.
  *  - Self-sufficient: random ids per run; full cleanup in afterAll.
- *
- * Jest + @Auth ESM limitation: `AuroraHubConsumerAdapter` is mocked BEFORE any import to avoid
- * the jwks-rsa ESM chain ts-jest cannot transform (same mock every full-AppModule e2e in this
- * repo uses).
  */
 
-// Mock AuroraHubConsumerAdapter BEFORE any imports (ESM / jwks-rsa blocker).
-jest.mock(
-  '@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter',
-  () => ({
-    AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {
-      getPassportOptions() {
-        return { jwtFromRequest: () => null, secretOrKey: 'mock' };
-      }
-      validate(): Promise<Record<string, never>> {
-        return Promise.resolve({});
-      }
-    },
-  }),
-);
-
-import { BOOTSTRAP_OAUTH_CLIENT_ID } from '@api/o-auth/o-auth-bootstrap.seeder';
-// Deep import (NOT the '@aurora/modules' barrel) — see the ESM note above.
-import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports';
+import { BOOTSTRAP_OAUTH_CLIENT_ID } from '@api/o-auth/o-auth-bootstrap.seeder.js';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
+import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports/index.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
 import { INestApplication } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -61,7 +43,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import request from 'supertest';
 import type { App } from 'supertest/types';
-import { AppModule } from '../../../src/app.module';
+import { AppModule } from '../../../src/app.module.js';
 
 const IMPERSONALIZE_PERMISSION = 'oAuth.credential.impersonalize';
 const CREDENTIAL_GET_PERMISSION = 'oAuth.credential.get';
@@ -74,7 +56,6 @@ describe('impersonate-token — guarded transports (e2e)', () => {
   let jwtSigner: IJwtSigner;
   let tmpKeysDir: string;
 
-  const RUN_ID = randomUUID().slice(0, 8);
   const REQUESTER_ID = randomUUID();
   const NO_PERMISSION_ID = randomUUID();
   const TARGET_ID_REST = randomUUID();
@@ -168,9 +149,7 @@ describe('impersonate-token — guarded transports (e2e)', () => {
     it('rejects an unauthenticated request with 401', async () => {
       await request(app.getHttpServer())
         .post('/o-auth/impersonate')
-        // Explicit Content-Type: the e2e harness's `mime` mock (jest-e2e moduleNameMapper) makes
-        // superagent's shorthand content-type lookup throw a byteLength TypeError on `.send({...})`
-        // — same documented constraint as user-sensitive-fields-masking.e2e-spec.ts.
+        // Explicit Content-Type, bypassing superagent's implicit `.type('json')` shorthand lookup.
         .set('Content-Type', 'application/json')
         .send({ targetAccountId: TARGET_ID_REST })
         .expect(401);

package/dist/templates/backend/packages/o-auth/test/acceptance/o-auth/masked-property-query-guard.e2e-spec.ts

@@ -20,12 +20,9 @@
  * a reader account holding ONLY the module's own `get` permission (never `dPermissions.all`), and
  * a sentinel value seeded by raw SQL so the assertions never depend on the create/update path.
  *
- * Jest + @Auth ESM limitation: `AuroraHubConsumerAdapter` is mocked BEFORE any import — same mock
- * every full-AppModule e2e uses.
- *
  * FIXTURE ISOLATION. The deploy pipeline runs `pnpm --filter aurora-back test:e2e` UNSCOPED, and
- * `jest-e2e.json` sets neither `maxWorkers` nor `runInBand`, so all 20 acceptance suites execute in
- * PARALLEL WORKERS against the one dev database. This suite therefore owns every row it touches:
+ * Vitest runs the acceptance suites in PARALLEL WORKERS against the one dev database. This suite
+ * therefore owns every row it touches:
  * its own `o_auth_application` / `o_auth_client` / pivot (never the shared bootstrap constants),
  * its own accounts, users and tokens, all keyed to ids generated per run and all deleted in
  * `afterAll` — including the credential and token rows the grant flows issue. Do not reintroduce a
@@ -33,23 +30,10 @@
  * mutating at the same instant.
  */
 
-// Mock AuroraHubConsumerAdapter BEFORE any imports (ESM / jwks-rsa blocker).
-jest.mock(
-  '@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter',
-  () => ({
-    AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {
-      getPassportOptions() {
-        return { jwtFromRequest: () => null, secretOrKey: 'mock' };
-      }
-      validate(): Promise<Record<string, never>> {
-        return Promise.resolve({});
-      }
-    },
-  }),
-);
-
-// Deep import (NOT the '@aurora/modules' barrel) — see the ESM note above.
-import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
+import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports/index.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
 import { INestApplication } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -62,7 +46,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import request from 'supertest';
 import type { App } from 'supertest/types';
-import { AppModule } from '../../../src/app.module';
+import { AppModule } from '../../../src/app.module.js';
 
 const ACCESS_TOKEN_GET_PERMISSION = 'oAuth.accessToken.get';
 const USER_GET_PERMISSION = 'iam.user.get';
@@ -85,10 +69,12 @@ const expectMaskedPropertyRejection = (
   expectedAggregate: string,
 ): void => {
   const originalError = body.errors?.[0]?.extensions?.originalError;
-  expect(originalError).toBeDefined();
-  expect(originalError?.statusCode).toBe(403);
-  expect(originalError?.translation).toBe('Errors.MaskedPropertyNotQueryable');
-  expect((originalError?.params as { aggregate?: string }).aggregate).toBe(expectedAggregate);
+  if (!originalError) {
+    throw new Error('Expected body.errors[0].extensions.originalError to be defined');
+  }
+  expect(originalError.statusCode).toBe(403);
+  expect(originalError.translation).toBe('Errors.MaskedPropertyNotQueryable');
+  expect((originalError.params as { aggregate?: string }).aggregate).toBe(expectedAggregate);
 };
 
 describe('masked-property query guard — the six measured attack shapes (e2e)', () => {

package/dist/templates/backend/packages/o-auth/test/acceptance/o-auth/oauth-bootstrap-seeder-idempotency.e2e-spec.ts

@@ -19,36 +19,18 @@
  *  - Simulate second boot by calling OAuthBootstrapSeeder.onApplicationBootstrap() again.
  *  - Clean up test-specific IAM rows in afterAll.
  *
- * Jest + @Auth ESM limitation: the AuroraHubConsumerAdapter is mocked to avoid
- * the jwks-rsa ESM import that ts-jest cannot transform.
- *
  * Cleanup: test-specific IAM rows are deleted in afterAll; bootstrap seed rows
  * (OAuthApplication + OAuthClient + pivot) are left intact (idempotent by design).
  */
 
-// Mock AuroraHubConsumerAdapter BEFORE any imports (ESM / jwks-rsa blocker).
-jest.mock(
-  '@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter',
-  () => ({
-    AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {
-      getPassportOptions() {
-        return { jwtFromRequest: () => null, secretOrKey: 'mock' };
-      }
-      validate(): Promise<Record<string, never>> {
-        return Promise.resolve({});
-      }
-    },
-  }),
-);
-
-import { IamBootstrapSeeder } from '@api/iam/iam-bootstrap.seeder';
+import { IamBootstrapSeeder } from '@api/iam/iam-bootstrap.seeder.js';
 import {
   BOOTSTRAP_OAUTH_APP_CODE,
   BOOTSTRAP_OAUTH_APP_SECRET,
   BOOTSTRAP_OAUTH_CLIENT_ID,
   OAuthBootstrapSeeder,
-} from '@api/o-auth/o-auth-bootstrap.seeder';
-import { OAuthCreateTokenHandler } from '@app/o-auth/flows/application/create-token/o-auth-create-token.handler';
+} from '@api/o-auth/o-auth-bootstrap.seeder.js';
+import { OAuthCreateTokenHandler } from '@app/o-auth/flows/application/create-token/o-auth-create-token.handler.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
 import { INestApplication } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -56,7 +38,7 @@ import * as bcrypt from 'bcrypt';
 import { sql } from 'drizzle-orm';
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { randomUUID } from 'node:crypto';
-import { AppModule } from '../../../src/app.module';
+import { AppModule } from '../../../src/app.module.js';
 
 // ---------------------------------------------------------------------------
 // Test-specific IAM credentials — inserted via raw SQL; cleaned in afterAll
@@ -89,7 +71,6 @@ describe('OAuthBootstrapSeeder — idempotency + bcrypt secret hashing (e2e)', (
 
   beforeAll(async () => {
     // local-provider enables JWT signing (OAUTH_STRATEGY=none disables it).
-    // AuroraHubConsumerAdapter is mocked to avoid the jwks-rsa ESM issue.
     process.env.OAUTH_STRATEGY = 'local-provider';
 
     const moduleRef: TestingModule = await Test.createTestingModule({
@@ -118,7 +99,9 @@ describe('OAuthBootstrapSeeder — idempotency + bcrypt secret hashing (e2e)', (
         VALUES (${TEST_ACCOUNT_ID}, 'USER', ${TEST_USER_EMAIL}, ${TEST_USER_EMAIL}, true, ${BOOTSTRAP_OAUTH_CLIENT_ID}, ARRAY[${BOOTSTRAP_OAUTH_APP_CODE}]::varchar[], '{}'::jsonb, ARRAY[]::uuid[], NOW())
       `);
     } catch (err: unknown) {
-      const message = err instanceof Error ? err.message : String(err);
+      // A non-Error throw stringifies to "[object Object]" via String(); JSON.stringify gives an
+      // actually readable diagnostic line for whatever the driver threw.
+      const message = err instanceof Error ? err.message : JSON.stringify(err);
       console.error('[e2e-crown-jewel] iam_account INSERT error:', message);
       throw err;
     }

package/dist/templates/backend/packages/o-auth/test/acceptance/o-auth/token-masking.e2e-spec.ts

@@ -24,29 +24,14 @@
  * `iam_account` and to each other are `avoidConstraint: true` in the YAML, so this suite's rows
  * never risk orphaning a shared table and need no real `OAuthClient`.
  *
- * Jest + @Auth ESM limitation: `AuroraHubConsumerAdapter` is mocked BEFORE any import to avoid
- * the jwks-rsa ESM chain ts-jest cannot transform (same mock every full-AppModule e2e uses).
  */
 
-// Mock AuroraHubConsumerAdapter BEFORE any imports (ESM / jwks-rsa blocker).
-jest.mock(
-  '@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter',
-  () => ({
-    AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {
-      getPassportOptions() {
-        return { jwtFromRequest: () => null, secretOrKey: 'mock' };
-      }
-      validate(): Promise<Record<string, never>> {
-        return Promise.resolve({});
-      }
-    },
-  }),
-);
-
-import { BOOTSTRAP_OAUTH_CLIENT_ID } from '@api/o-auth/o-auth-bootstrap.seeder';
-import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token';
-// Deep import (NOT the '@aurora/modules' barrel) — see the ESM note above.
-import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports';
+import { BOOTSTRAP_OAUTH_CLIENT_ID } from '@api/o-auth/o-auth-bootstrap.seeder.js';
+import { OAuthDrizzleAccessTokenRepository } from '@app/o-auth/access-token/index.js';
+// Sub-barrel import, not the '@aurora/modules' root barrel: the root barrel evaluates
+// AuthenticationModule, which HR-MODGRAPH-001 requires stay a leaf. `domain/ports` is
+// contracts-only (interfaces + Symbol tokens, zero side-effects).
+import { JWT_SIGNER, type IJwtSigner } from '@aurora/modules/authentication/domain/ports/index.js';
 import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
 import { INestApplication } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -58,7 +43,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import request from 'supertest';
 import type { App } from 'supertest/types';
-import { AppModule } from '../../../src/app.module';
+import { AppModule } from '../../../src/app.module.js';
 
 const ACCESS_TOKEN_GET_PERMISSION = 'oAuth.accessToken.get';
 const REFRESH_TOKEN_GET_PERMISSION = 'oAuth.refreshToken.get';

package/dist/templates/backend/packages/queue-manager/src/@api/queue-manager/flows/index.ts

@@ -7,7 +7,7 @@ import {
   QueueManagerDestroyResolver,
   QueueManagerOperateResolver,
   QueueManagerReadResolver,
-} from './resolvers/queue-manager.resolver';
+} from './resolvers/queue-manager.resolver.js';
 
 export {
   QueueManagerAuthorResolver,