@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/modules/audit/event-classifier.ts

@@ -1,155 +1,155 @@
-import type { AgentEventKind } from './audit.contract.js';
-
-/**
- * Pure classification of one UTCP tool call into what the Audit log records:
- * a hexis capability, a manual's tool, or a skill read. No I/O — the one
- * catalog it may need (the skill folders) is handed in by the caller, which
- * asks {@link skillReadPath} first whether that catalog is worth fetching.
- */
-
-/** What a call is logged as: the kind, the manual (or skill folder), and the bare name. */
-export interface ClassifiedCall {
-  kind: AgentEventKind;
-  manual: string | null;
-  name: string;
-}
-
-/** A skill as the classifier needs it: its name and its repo-relative folder. */
-export interface SkillFolder {
-  name: string;
-  path: string;
-}
-
-export interface ClassifierContext {
-  /** The registered name of the platform's own manual (`KNOWLEDGE_BASE`). */
-  kbManualName: string;
-  /** Registered (rewritten) manual name → catalog name, for pooled MCP manuals. */
-  catalogNames: ReadonlyMap<string, string>;
-}
-
-/**
- * The platform tools whose `path` argument may point INTO a skill folder — a
- * read of `Plugins/Sales/rfi/SKILL.md` or of a file bundled beside it is the
- * agent reading that skill, and is logged as such rather than as a file read.
- */
-const SKILL_FOLDER_READ_TOOLS: ReadonlySet<string> = new Set(['read_file', 'grep', 'list_files']);
-
-/** The platform tool that loads a skill by name. */
-const GET_SKILL = 'get_skill';
-
-/** `<manual>.<tool>` → its two halves; a bare name has no manual. */
-export function splitUtcpName(utcpName: string): { manual: string; tool: string } {
-  const dot = utcpName.indexOf('.');
-  return dot < 0
-    ? { manual: '', tool: utcpName }
-    : { manual: utcpName.slice(0, dot), tool: utcpName.slice(dot + 1) };
-}
-
-/**
- * The `path` a platform tool was called with, wherever the caller put it.
- * Bevel-hosted http tools take their arguments inside a `body` envelope
- * (`{ body: { path } }`); a caller that flattened it (`{ path }`) is read too.
- */
-function pathArgument(args: Record<string, unknown>): string | null {
-  const body = args.body;
-  const inner = body && typeof body === 'object' ? (body as Record<string, unknown>).path : undefined;
-  const candidate = typeof inner === 'string' ? inner : args.path;
-  return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
-}
-
-/** The `name` a `get_skill` call asked for, from the envelope or flattened. */
-function skillNameArgument(args: Record<string, unknown>): string | null {
-  const body = args.body;
-  const inner = body && typeof body === 'object' ? (body as Record<string, unknown>).name : undefined;
-  const candidate = typeof inner === 'string' ? inner : args.name;
-  return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
-}
-
-/**
- * When a platform read names a path, the path — the signal that the caller
- * should fetch the skill catalog before classifying (a folder match turns
- * the read into a skill event). Null for every other call, so the catalog is
- * never fetched for a `notion.search` or a `write_file`.
- */
-export function skillReadPath(utcpName: string, args: Record<string, unknown>, kbManualName: string): string | null {
-  const { manual, tool } = splitUtcpName(utcpName);
-  if (manual !== kbManualName) return null;
-  if (tool === GET_SKILL) return skillNameArgument(args) === null ? null : '';
-  if (!SKILL_FOLDER_READ_TOOLS.has(tool)) return null;
-  return pathArgument(args);
-}
-
-/**
- * The path as segments, resolved: forward slashes, `.` dropped, `..` taken
- * back a segment, no empty segments — so two spellings of one place compare
- * equal, and a path that climbs OUT of a folder is never matched to it. A
- * path that climbs above its own start has no place at all and resolves to
- * the empty string, which matches nothing. (The file tools refuse `..`
- * outright; the log must still not credit a refused read to a skill.)
- */
-function normalizePath(p: string): string {
-  const out: string[] = [];
-  for (const segment of p.replace(/\\/g, '/').split('/')) {
-    if (segment === '' || segment === '.') continue;
-    if (segment === '..') {
-      if (out.length === 0) return '';
-      out.pop();
-      continue;
-    }
-    out.push(segment);
-  }
-  return out.join('/');
-}
-
-/**
- * The skill whose folder contains `path`, if any. Matched on a segment
- * boundary anywhere in the path — a caller may spell the path from the
- * repository root (`Plugins/Sales/rfi/SKILL.md`) or from one level above it
- * (`knowledge-base/Plugins/Sales/rfi/SKILL.md`), and both are that skill.
- * The longest folder wins, so a skill nested under another's folder is not
- * mistaken for its parent.
- */
-export function skillContaining(path: string, skills: readonly SkillFolder[]): SkillFolder | null {
-  const normalized = normalizePath(path);
-  if (!normalized) return null;
-  const haystack = `/${normalized}/`;
-  let best: SkillFolder | null = null;
-  for (const skill of skills) {
-    const folder = normalizePath(skill.path);
-    if (!folder) continue;
-    if (haystack.includes(`/${folder}/`) && (!best || folder.length > normalizePath(best.path).length)) {
-      best = skill;
-    }
-  }
-  return best;
-}
-
-/**
- * Classify one call. `skills` is the catalog when {@link skillReadPath} asked
- * for it and the caller could fetch it; null otherwise (the read is then
- * logged as the capability it is, which is the honest fallback).
- */
-export function classifyToolCall(
-  utcpName: string,
-  args: Record<string, unknown>,
-  ctx: ClassifierContext,
-  skills: readonly SkillFolder[] | null,
-): ClassifiedCall {
-  const { manual, tool } = splitUtcpName(utcpName);
-  // A meta-tool (`call_tool_chain`, `list_tools`, …) has no manual: the platform's own.
-  if (manual === '' || manual === ctx.kbManualName) {
-    if (tool === GET_SKILL) {
-      const name = skillNameArgument(args);
-      if (name) {
-        const folder = skills?.find((s) => s.name === name)?.path ?? null;
-        return { kind: 'skill', manual: folder, name };
-      }
-    } else if (SKILL_FOLDER_READ_TOOLS.has(tool) && skills) {
-      const path = pathArgument(args);
-      const skill = path ? skillContaining(path, skills) : null;
-      if (skill) return { kind: 'skill', manual: skill.path, name: skill.name };
-    }
-    return { kind: 'capability', manual: null, name: tool };
-  }
-  return { kind: 'tool', manual: ctx.catalogNames.get(manual) ?? manual, name: tool };
-}
+import type { AgentEventKind } from './audit.contract.js';
+
+/**
+ * Pure classification of one UTCP tool call into what the Audit log records:
+ * a hexis capability, a manual's tool, or a skill read. No I/O — the one
+ * catalog it may need (the skill folders) is handed in by the caller, which
+ * asks {@link skillReadPath} first whether that catalog is worth fetching.
+ */
+
+/** What a call is logged as: the kind, the manual (or skill folder), and the bare name. */
+export interface ClassifiedCall {
+  kind: AgentEventKind;
+  manual: string | null;
+  name: string;
+}
+
+/** A skill as the classifier needs it: its name and its repo-relative folder. */
+export interface SkillFolder {
+  name: string;
+  path: string;
+}
+
+export interface ClassifierContext {
+  /** The registered name of the platform's own manual (`KNOWLEDGE_BASE`). */
+  kbManualName: string;
+  /** Registered (rewritten) manual name → catalog name, for pooled MCP manuals. */
+  catalogNames: ReadonlyMap<string, string>;
+}
+
+/**
+ * The platform tools whose `path` argument may point INTO a skill folder — a
+ * read of `Plugins/Sales/rfi/SKILL.md` or of a file bundled beside it is the
+ * agent reading that skill, and is logged as such rather than as a file read.
+ */
+const SKILL_FOLDER_READ_TOOLS: ReadonlySet<string> = new Set(['read_file', 'grep', 'list_files']);
+
+/** The platform tool that loads a skill by name. */
+const GET_SKILL = 'get_skill';
+
+/** `<manual>.<tool>` → its two halves; a bare name has no manual. */
+export function splitUtcpName(utcpName: string): { manual: string; tool: string } {
+  const dot = utcpName.indexOf('.');
+  return dot < 0
+    ? { manual: '', tool: utcpName }
+    : { manual: utcpName.slice(0, dot), tool: utcpName.slice(dot + 1) };
+}
+
+/**
+ * The `path` a platform tool was called with, wherever the caller put it.
+ * Bevel-hosted http tools take their arguments inside a `body` envelope
+ * (`{ body: { path } }`); a caller that flattened it (`{ path }`) is read too.
+ */
+function pathArgument(args: Record<string, unknown>): string | null {
+  const body = args.body;
+  const inner = body && typeof body === 'object' ? (body as Record<string, unknown>).path : undefined;
+  const candidate = typeof inner === 'string' ? inner : args.path;
+  return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+
+/** The `name` a `get_skill` call asked for, from the envelope or flattened. */
+function skillNameArgument(args: Record<string, unknown>): string | null {
+  const body = args.body;
+  const inner = body && typeof body === 'object' ? (body as Record<string, unknown>).name : undefined;
+  const candidate = typeof inner === 'string' ? inner : args.name;
+  return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+
+/**
+ * When a platform read names a path, the path — the signal that the caller
+ * should fetch the skill catalog before classifying (a folder match turns
+ * the read into a skill event). Null for every other call, so the catalog is
+ * never fetched for a `notion.search` or a `write_file`.
+ */
+export function skillReadPath(utcpName: string, args: Record<string, unknown>, kbManualName: string): string | null {
+  const { manual, tool } = splitUtcpName(utcpName);
+  if (manual !== kbManualName) return null;
+  if (tool === GET_SKILL) return skillNameArgument(args) === null ? null : '';
+  if (!SKILL_FOLDER_READ_TOOLS.has(tool)) return null;
+  return pathArgument(args);
+}
+
+/**
+ * The path as segments, resolved: forward slashes, `.` dropped, `..` taken
+ * back a segment, no empty segments — so two spellings of one place compare
+ * equal, and a path that climbs OUT of a folder is never matched to it. A
+ * path that climbs above its own start has no place at all and resolves to
+ * the empty string, which matches nothing. (The file tools refuse `..`
+ * outright; the log must still not credit a refused read to a skill.)
+ */
+function normalizePath(p: string): string {
+  const out: string[] = [];
+  for (const segment of p.replace(/\\/g, '/').split('/')) {
+    if (segment === '' || segment === '.') continue;
+    if (segment === '..') {
+      if (out.length === 0) return '';
+      out.pop();
+      continue;
+    }
+    out.push(segment);
+  }
+  return out.join('/');
+}
+
+/**
+ * The skill whose folder contains `path`, if any. Matched on a segment
+ * boundary anywhere in the path — a caller may spell the path from the
+ * repository root (`Plugins/Sales/rfi/SKILL.md`) or from one level above it
+ * (`knowledge-base/Plugins/Sales/rfi/SKILL.md`), and both are that skill.
+ * The longest folder wins, so a skill nested under another's folder is not
+ * mistaken for its parent.
+ */
+export function skillContaining(path: string, skills: readonly SkillFolder[]): SkillFolder | null {
+  const normalized = normalizePath(path);
+  if (!normalized) return null;
+  const haystack = `/${normalized}/`;
+  let best: SkillFolder | null = null;
+  for (const skill of skills) {
+    const folder = normalizePath(skill.path);
+    if (!folder) continue;
+    if (haystack.includes(`/${folder}/`) && (!best || folder.length > normalizePath(best.path).length)) {
+      best = skill;
+    }
+  }
+  return best;
+}
+
+/**
+ * Classify one call. `skills` is the catalog when {@link skillReadPath} asked
+ * for it and the caller could fetch it; null otherwise (the read is then
+ * logged as the capability it is, which is the honest fallback).
+ */
+export function classifyToolCall(
+  utcpName: string,
+  args: Record<string, unknown>,
+  ctx: ClassifierContext,
+  skills: readonly SkillFolder[] | null,
+): ClassifiedCall {
+  const { manual, tool } = splitUtcpName(utcpName);
+  // A meta-tool (`call_tool_chain`, `list_tools`, …) has no manual: the platform's own.
+  if (manual === '' || manual === ctx.kbManualName) {
+    if (tool === GET_SKILL) {
+      const name = skillNameArgument(args);
+      if (name) {
+        const folder = skills?.find((s) => s.name === name)?.path ?? null;
+        return { kind: 'skill', manual: folder, name };
+      }
+    } else if (SKILL_FOLDER_READ_TOOLS.has(tool) && skills) {
+      const path = pathArgument(args);
+      const skill = path ? skillContaining(path, skills) : null;
+      if (skill) return { kind: 'skill', manual: skill.path, name: skill.name };
+    }
+    return { kind: 'capability', manual: null, name: tool };
+  }
+  return { kind: 'tool', manual: ctx.catalogNames.get(manual) ?? manual, name: tool };
+}

package/src/modules/auth/__tests__/account-deactivation.test.ts

@@ -13,7 +13,7 @@ import {
   type IAccountAdmission,
 } from '../account-admission.js';
 import { hashPassword } from '../password-hash.js';
-import { RECOVERY_BOT_EMAIL } from '../../workflow/recovery-bot.js';
+import { RECOVERY_BOT_EMAIL } from '../../version-control/recovery-bot.js';
 
 /**
  * Drizzle chain stub, as in `auth.service.test.ts`: each db.select() /

package/src/modules/auth/__tests__/account-erasure.approval-gate.test.ts

@@ -4,7 +4,7 @@ import { PgDialect } from 'drizzle-orm/pg-core';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import { AccountErasureService, type IErasureParticipant } from '../account-erasure.service.js';
 import type { Database } from '../../database/connection.js';
-import { ReviewWorkflowService } from '../../workflow/review-workflow/review-workflow.service.js';
+import { ChangeRequestReviewService } from '../../version-control/change-request-review/change-request-review.service.js';
 
 /**
  * Erasing an account rewrites the person's name and address out of every
@@ -122,13 +122,13 @@ function harness(opts: { participants?: IErasureParticipant[] } = {}) {
     transaction: async <T,>(fn: (t: typeof tx) => Promise<T>) => fn(tx),
   } as unknown as Database;
   return {
-    // The REAL review workflow, so what is pinned below is the contract as
+    // The REAL change-request review, so what is pinned below is the contract as
     // wired: erasure asks it to rewrite the approvals inside the erasure's
-    // transaction, and it is the workflow that takes the lock. Its other
+    // transaction, and it is the version-control service that takes the lock. Its other
     // collaborators are never reached by `eraseApprover`.
     svc: new AccountErasureService(
       db,
-      new ReviewWorkflowService(db, {} as never, {} as never, {} as never),
+      new ChangeRequestReviewService(db, {} as never, {} as never, {} as never),
       opts.participants ?? [],
     ),
     order,

package/src/modules/auth/__tests__/account-erasure.participants.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import { AccountErasureService, type IErasureParticipant } from '../account-erasure.service.js';
+import type { Database } from '../../database/index.js';
+
+/**
+ * Whose slices an erasure runs, and in what order: core's own first (the
+ * vault's managed sign-ins, say), then the distribution's, read from the
+ * port's array as it IS at erasure time. The array is the root's and is held
+ * by reference (`CorePorts.erasureParticipants`): a root may fill it after
+ * construction, and core never writes into it — a root building a second
+ * graph over the same array must not inherit the first graph's slices.
+ */
+
+/** A database that answers the one read erasure makes and swallows every write, outside the transaction and in it. */
+function silentDb(): Database {
+  const done = Promise.resolve([]);
+  const tx = {
+    execute: async () => ({ rows: [] }),
+    select: () => ({ from: () => ({ where: async () => [] }) }),
+    delete: () => ({ where: () => done }),
+    update: () => ({ set: () => ({ where: () => done }) }),
+  };
+  return {
+    select: () => ({
+      from: () => ({
+        where: () => ({ limit: async () => [{ id: 'u1', email: 'bob@bevel.software', name: 'Bob' }] }),
+      }),
+    }),
+    update: () => ({ set: () => ({ where: async () => undefined }) }),
+    transaction: async <T,>(fn: (t: typeof tx) => Promise<T>) => fn(tx),
+  } as unknown as Database;
+}
+
+describe('AccountErasureService: whose slices run, and in what order', () => {
+  it('runs core’s own slices first, then the port’s array as it is at erasure time — the array held, never copied', async () => {
+    const steps: string[] = [];
+    const slice = (name: string): IErasureParticipant => ({
+      before: async () => {
+        steps.push(`before:${name}`);
+      },
+      inTransaction: async () => {
+        steps.push(`tx:${name}`);
+      },
+    });
+    // The port's array, as a root hands it over: one slice now …
+    const fromPort = [slice('distribution-1')];
+    const svc = new AccountErasureService(silentDb(), { eraseApprover: async () => undefined }, fromPort, [slice('vault')]);
+    // … and one it appends AFTER construction. Core's slice is not in that
+    // array, so the array holds exactly what the root put there.
+    fromPort.push(slice('distribution-2'));
+    expect(fromPort).toHaveLength(2);
+
+    await expect(svc.eraseUser('u1')).resolves.toBe(true);
+    expect(steps).toEqual(['before:vault', 'before:distribution-1', 'before:distribution-2', 'tx:vault', 'tx:distribution-1', 'tx:distribution-2']);
+  });
+});

package/src/modules/auth/__tests__/account-switch-lock.pg.test.ts

@@ -5,7 +5,7 @@ import { closeDb, createDb, type Database } from '../../database/connection.js';
 import { runCoreMigrations } from '../../database/migrate.js';
 import { coreMigrationsDir } from '../../../assets.js';
 import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, scratchDatabaseUrl } from '../../../__tests__/pg-scratch.js';
-import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../../shared/domain-errors.js';
 import { AuthService } from '../auth.service.js';
 import { ACCOUNT_BUSY_MESSAGE, takeAccountSwitchLock } from '../account-switch-lock.js';
 
@@ -51,7 +51,7 @@ describe.skipIf(!PG_ADMIN_URL)('the account switch lock under contention, on a r
       const { db, url } = await migratedDatabase();
       const holder = await holdLock(url, 'alice@acme.test');
       const refusal = db.transaction((tx) => takeAccountSwitchLock(tx, 'Alice@Acme.test', 200));
-      await expect(refusal).rejects.toBeInstanceOf(WorkflowDomainError);
+      await expect(refusal).rejects.toBeInstanceOf(VersionControlDomainError);
       await expect(refusal).rejects.toMatchObject({ status: 409, message: ACCOUNT_BUSY_MESSAGE, payload: { kind: 'account-busy' } });
       // Released, the lock is taken at once.
       await holder.query('commit');

package/src/modules/auth/__tests__/account-switch-lock.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest';
 import { PgDialect } from 'drizzle-orm/pg-core';
 import type { SQL } from 'drizzle-orm';
-import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../../shared/domain-errors.js';
 import { ACCOUNT_BUSY_MESSAGE, ACCOUNT_SWITCH_LOCK_WAIT_MS, takeAccountSwitchLock } from '../account-switch-lock.js';
 
 /** A transaction handle that records what it ran, and fails the lock statement when told to. */
@@ -32,7 +32,7 @@ describe('takeAccountSwitchLock', () => {
   it('answers a wait that ran out as a 409 account-busy, in the words the admin is told', async () => {
     const { tx } = fakeTx({ code: '55P03', message: 'canceling statement due to lock timeout' });
     const refusal = takeAccountSwitchLock(tx, 'alice@example.com');
-    await expect(refusal).rejects.toBeInstanceOf(WorkflowDomainError);
+    await expect(refusal).rejects.toBeInstanceOf(VersionControlDomainError);
     await expect(refusal).rejects.toMatchObject({ status: 409, message: ACCOUNT_BUSY_MESSAGE, payload: { kind: 'account-busy' } });
   });
 

package/src/modules/auth/__tests__/account.routes.test.ts

@@ -2,13 +2,13 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import type { Server } from 'node:http';
 import { createAccountRoutes } from '../account.routes.js';
-import type { AccountInvitedEvent } from '../account-hooks.js';
+import { AccountHooks, type AccountInvitedEvent } from '../account-hooks.js';
 import { AuthService } from '../auth.service.js';
 import { AccountAdmissionRefusedError, AccountChangeRefusedError } from '../account-admission.js';
-import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../../shared/domain-errors.js';
 import { hashPassword } from '../password-hash.js';
-import type { Database } from '../../database/connection.js';
-import type { IAdminAccessService } from '../../admin/admin.interface.js';
+import type { Database } from '../../database/index.js';
+import type { IAdminAccessService } from '../../admin/index.js';
 
 const authService = {
   listAccounts: vi.fn(async () => [
@@ -38,9 +38,10 @@ const accountErasure = {
 /** The invite listeners: nobody registered unless a test says so (see "an invite tells the listeners"). */
 const accountHooks = {
   runAccountInvited: vi.fn<(event: AccountInvitedEvent) => Promise<string[]>>(async () => []),
+  runAccountDeactivated: vi.fn<(event: { userId: string; email: string }) => Promise<string[]>>(async () => []),
 };
 
-function makeApp(opts: { admin: boolean; email?: string }) {
+function makeApp(opts: { admin: boolean; email?: string; hooks?: typeof accountHooks | AccountHooks }) {
   const adminAccess: IAdminAccessService = {
     isAdmin: vi.fn(async () => opts.admin),
   };
@@ -53,7 +54,7 @@ function makeApp(opts: { admin: boolean; email?: string }) {
     req.userEmail = opts.email ?? 'caller@example.com';
     next();
   });
-  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure, accountHooks));
+  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure, opts.hooks ?? accountHooks));
   return app;
 }
 
@@ -487,9 +488,9 @@ describe('account routes — removing the erased address from access files', ()
 
   it('the guards refuse up front: nothing is erased', async () => {
     const { app, accessRemoval } = makeRemovalApp();
-    const { WorkflowDomainError } = await import('../../../shared/domain-errors.js');
+    const { VersionControlDomainError } = await import('../../../shared/domain-errors.js');
     accessRemoval.assertRemovable.mockRejectedValueOnce(
-      new WorkflowDomainError('This is the last Admin; the Admin role must keep at least one direct email member.', 409),
+      new VersionControlDomainError('This is the last Admin; the Admin role must keep at least one direct email member.', 409),
     );
     const base = await listen(app);
     const res = await fetch(`${base}/api/admin/accounts/u2?removeFromAccess=1`, { method: 'DELETE' });
@@ -503,14 +504,75 @@ describe('account routes — removing the erased address from access files', ()
 describe('account routes — switching an account off and on', () => {
   const post = (base: string, path: string) => fetch(`${base}/api/admin/accounts/${path}`, { method: 'POST' });
 
-  it('switches another account off and back on', async () => {
+  it('switches another account off and back on, telling the deactivated listeners and waiting for them', async () => {
+    // The listeners settle when the test says: the answer must not come first.
+    let settle!: () => void;
+    const settled = new Promise<string[]>((resolve) => {
+      settle = () => resolve(['managed-connections']);
+    });
+    vi.mocked(accountHooks.runAccountDeactivated).mockReset().mockReturnValueOnce(settled);
     const base = await listen(makeApp({ admin: true }));
-    expect((await post(base, 'u2/deactivate')).status).toBe(204);
+    let answered = false;
+    const pending = post(base, 'u2/deactivate').then((res) => {
+      answered = true;
+      return res;
+    });
+    await vi.waitFor(() => expect(accountHooks.runAccountDeactivated).toHaveBeenCalledTimes(1));
+    expect(accountHooks.runAccountDeactivated).toHaveBeenCalledWith({ userId: 'u2', email: 'u2@example.com' });
+    expect(answered).toBe(false);
+    settle();
+    expect((await pending).status).toBe(204);
     expect(authService.deactivate).toHaveBeenCalledWith('u2');
+    vi.mocked(accountHooks.runAccountDeactivated).mockResolvedValue([]);
     expect((await post(base, 'u2/reactivate')).status).toBe(204);
     expect(authService.reactivate).toHaveBeenCalledWith('u2');
   });
 
+  it('reads the address again after the switch when the first read failed, and tells the listeners \'\' only when both do', async () => {
+    vi.mocked(accountHooks.runAccountDeactivated).mockReset().mockResolvedValue([]);
+    const base = await listen(makeApp({ admin: true }));
+    // First read away, second one back: the listeners get the address.
+    vi.mocked(authService.getUserById).mockRejectedValueOnce(new Error('users table is away'));
+    expect((await post(base, 'u2/deactivate')).status).toBe(204);
+    expect(accountHooks.runAccountDeactivated).toHaveBeenLastCalledWith({ userId: 'u2', email: 'u2@example.com' });
+    // Both reads away: the switch-off still happens, the listeners get ''.
+    vi.mocked(authService.getUserById)
+      .mockRejectedValueOnce(new Error('users table is away'))
+      .mockRejectedValueOnce(new Error('users table is still away'));
+    expect((await post(base, 'u2/deactivate')).status).toBe(204);
+    expect(accountHooks.runAccountDeactivated).toHaveBeenLastCalledWith({ userId: 'u2', email: '' });
+  });
+
+  it('a deactivation listener that throws is logged and skipped: the later listeners run and the switch-off still answers 204', async () => {
+    // The real seam, not the mock: the account is off whether or not a
+    // listener cleaned up after it, and one that fails must not keep the next
+    // from running or turn the admin's answer into an error.
+    const hooks = new AccountHooks();
+    const ran: string[] = [];
+    hooks.onAccountDeactivated(async () => {
+      ran.push('first');
+      throw new Error('the broker is down');
+    });
+    hooks.onAccountDeactivated(async (event) => {
+      ran.push(`second:${event.userId}`);
+      return 'managed-connections';
+    });
+    // Logged, so a listener that let go of nothing is diagnosable from the
+    // server's log (the seam writes through the default logger, which prints
+    // to the console) — the same way the invite seam's failures are pinned.
+    const logged = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      const base = await listen(makeApp({ admin: true, hooks }));
+      expect((await post(base, 'u2/deactivate')).status).toBe(204);
+      expect(authService.deactivate).toHaveBeenCalledWith('u2');
+      expect(ran).toEqual(['first', 'second:u2']);
+      const lines = logged.mock.calls.map((args) => args.map(String).join(' '));
+      expect(lines.some((l) => l.includes('an account-deactivated listener failed') && l.includes('the broker is down'))).toBe(true);
+    } finally {
+      logged.mockRestore();
+    }
+  });
+
   it('refuses an admin switching off their own account, so an admin who can sign in always remains', async () => {
     vi.mocked(authService.deactivate).mockClear();
     const base = await listen(makeApp({ admin: true }));
@@ -543,7 +605,7 @@ describe('account routes — switching an account off and on', () => {
 
   it('answers a switch lock that timed out with the 409 account-busy the lock promises, not a 500', async () => {
     vi.mocked(authService.deactivate).mockRejectedValueOnce(
-      new WorkflowDomainError('Another change to this account is still being saved; try again in a moment.', 409, {
+      new VersionControlDomainError('Another change to this account is still being saved; try again in a moment.', 409, {
         kind: 'account-busy',
       }),
     );

package/src/modules/auth/__tests__/auth.service.test.ts

@@ -7,7 +7,7 @@ import jwt from 'jsonwebtoken';
 import { AuthService, PasswordChangedMeanwhileError, PasswordRefusedError } from '../auth.service.js';
 import { AccountAdmissionRefusedError, SessionEndedError, type IAccountAdmission } from '../account-admission.js';
 import { hashPassword, verifyPassword } from '../password-hash.js';
-import { RECOVERY_BOT_EMAIL } from '../../workflow/index.js';
+import { RECOVERY_BOT_EMAIL } from '../../version-control/index.js';
 import { DIRECTORY_SYNC_BOT_EMAIL } from '../../access/index.js';
 
 /**