@bongos/core 1.17.0 → 1.17.2

package/tests/instance_mismatch_guard.mjs

@@ -0,0 +1,101 @@
+// tests/instance_mismatch_guard.mjs
+//
+// Unit test for the PURE fail-closed instance guard exported from
+// scripts/gds/cli-lib.js (task 2102):
+//   - instanceOriginHost(origin) → host string, or null if unparseable
+//   - detectInstanceMismatch({ session, brand, env }) → { mismatch, expected, actual }
+//
+// The guard stops the CLI from silently borrowing a DIFFERENT instance's session
+// (the 2026-07-08 demo-session failure, where a fresh demo clone used the
+// founder's amazonprimea.com session and offered to write into the wrong live
+// backlog). Both helpers are deterministic with no DB/network/fs, so they
+// unit-test standalone. Run: node tests/instance_mismatch_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cli = require('../scripts/gds/cli-lib.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const DEMO = { domains: { publicOrigin: 'https://demo.cloudbongos.com' } };
+const OTB = { domains: { publicOrigin: 'https://amazonprimea.com' } };
+const noEnv = {}; // no <PREFIX>_API_BASE override in scope
+
+test('instanceOriginHost: extracts host, tolerates trailing slash', () => {
+  assert.equal(cli.instanceOriginHost('https://amazonprimea.com'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://amazonprimea.com/'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://demo.cloudbongos.com/api/gds'), 'demo.cloudbongos.com');
+});
+
+test('instanceOriginHost: unparseable input → null (edge)', () => {
+  assert.equal(cli.instanceOriginHost('not a url'), null);
+  assert.equal(cli.instanceOriginHost(''), null);
+  assert.equal(cli.instanceOriginHost(null), null);
+});
+
+test('match: same-host session + branding → no mismatch (the OTB/normal case)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: OTB, env: noEnv });
+  assert.equal(r.mismatch, false);
+});
+
+test('match: scheme/trailing-slash differences still match on host', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com/' }, brand: OTB, env: noEnv });
+  assert.equal(r.mismatch, false);
+});
+
+test('mismatch: demo repo + founder amazonprimea session → REFUSE (the reported failure)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: noEnv });
+  assert.equal(r.mismatch, true);
+  assert.equal(r.expected, 'https://demo.cloudbongos.com');
+  assert.equal(r.actual, 'https://amazonprimea.com');
+});
+
+test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUSE', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://cloudbongos.com' }, brand: DEMO, env: noEnv });
+  assert.equal(r.mismatch, true);
+});
+
+test('env-override: an explicit *_API_BASE override wins (dev/staging) → no mismatch', () => {
+  const r = cli.detectInstanceMismatch({
+    session: { api_base: 'https://amazonprimea.com' }, brand: DEMO,
+    env: { GDS_API_BASE: 'http://localhost:3000' },
+  });
+  assert.equal(r.mismatch, false);
+});
+
+test('no-branding: repo declares no publicOrigin → cannot assert a mismatch → no mismatch', () => {
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: {}, env: noEnv }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: { domains: {} }, env: noEnv }).mismatch, false);
+});
+
+test('no-session: nothing to borrow → no mismatch (the no-session/401 path handles it)', () => {
+  assert.equal(cli.detectInstanceMismatch({ session: null, brand: DEMO, env: noEnv }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: {}, brand: DEMO, env: noEnv }).mismatch, false);
+});
+
+// task 2124 / demo-audit C2 — assertInstanceMatch is the exit-wrapper that RAW-fetch read
+// commands (status.js) call so they honor the same guard apiCall/cliClient already enforce.
+// Its decision reuses detectInstanceMismatch (covered above); here we lock the wrapper's
+// contract + its deterministic opt-out branch (the exiting branch would process.exit).
+test('assertInstanceMatch is exported (the guard raw-fetch reads must call)', () => {
+  assert.equal(typeof cli.assertInstanceMatch, 'function');
+});
+
+// Async opt-out branch — the sync test() helper can't await, so run it at top level.
+// { allowInstanceMismatch: true } returns BEFORE loadSession/detect (no fs, no exit).
+try {
+  await cli.assertInstanceMatch({ allowInstanceMismatch: true });
+  passed++; console.log('  ok  assertInstanceMatch({allowInstanceMismatch:true}) resolves without exiting');
+} catch (err) {
+  failed++; console.log('  FAIL assertInstanceMatch opt-out resolves without exiting'); console.log(`     ${err.message}`);
+}
+
+console.log(`\ninstance-mismatch guard (task 2102 + C2 raw-read wrapper) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/mirror_lineage_proof.mjs

@@ -22,6 +22,20 @@ test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbe
   assert.deepEqual([...set].sort((a, b) => a - b), [3, 44, 60]);
 });
 
+test('migrationNumbersFromPaths excludes migrations/instance/ seeds (task 2152)', () => {
+  // migrations/instance/*.sql are this instance's host seeds (ADR 0105), excluded from
+  // the publishable mirror (task 2140). Counting them as core put every instance seed in
+  // the PRIVATE set but not the MIRROR set → a false private⇄mirror divergence that
+  // red-lined the unit gate. Only the bare top-level core migration counts.
+  const set = migrationNumbersFromPaths([
+    'migrations/080_core_thing.sql',                    // bare core → counted
+    'migrations/instance/080_gds_v4_planning_seed.sql', // instance seed → NOT core
+    'migrations/instance/186_governance_seed.sql',      // instance seed → NOT core
+    'migrations/core_192_namespaced.sql',               // core_ prefix ≠ bare NNN_ form → not counted either
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [80]);
+});
+
 test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {
   const sql = `
     CREATE TABLE tasks (

package/tests/module_cli.mjs

@@ -268,6 +268,126 @@ test('cmdCheck: usage error (exit 2) when no key is given', () => {
   assert.equal(code, 2);
 });
 
+// ---------------------------------------------------------------------------
+// packageModuleForSubmission / readSignOff — the fs half of `module submit`
+// ---------------------------------------------------------------------------
+
+test('readSignOff: null when never signed off; the recorded record once it is', () => {
+  const root = tmpModulesRoot();
+  mod.scaffoldModule({ key: 'widget', modulesDir: root, core: '1.0.0' });
+  assert.equal(mod.readSignOff('widget', { modulesDir: root }), null);
+  mod.recordSignOff('widget', 'Ada Lovelace <ada@example.com>', { modulesDir: root });
+  const signOff = mod.readSignOff('widget', { modulesDir: root });
+  assert.equal(signOff.signOff.signedBy, 'Ada Lovelace <ada@example.com>');
+});
+
+test('packageModuleForSubmission: snapshots the manifest + every file (base64) + the sign-off', () => {
+  const root = tmpModulesRoot();
+  mod.scaffoldModule({ key: 'widget', modulesDir: root, core: '1.0.0' });
+  mod.recordSignOff('widget', 'Ada Lovelace <ada@example.com>', { modulesDir: root });
+
+  const pkg = mod.packageModuleForSubmission('widget', { modulesDir: root });
+  assert.equal(pkg.key, 'widget');
+  assert.equal(pkg.manifest.key, 'widget');
+  assert.equal(pkg.signOff.signOff.signedBy, 'Ada Lovelace <ada@example.com>');
+  assert.ok(pkg.totalBytes > 0);
+
+  const paths = pkg.files.map((f) => f.path).sort();
+  assert.deepEqual(paths, [...paths].sort(), 'files are sorted by path');
+  assert.ok(paths.includes('module.json'));
+  assert.ok(paths.includes('routes/widget.js'));
+  // the sign-off file itself travels in the snapshot too — it's part of the module tree
+  assert.ok(paths.includes('.upstream-signoff.json'));
+
+  const manifestFile = pkg.files.find((f) => f.path === 'module.json');
+  const roundTripped = JSON.parse(Buffer.from(manifestFile.contentBase64, 'base64').toString('utf8'));
+  assert.deepEqual(roundTripped, pkg.manifest);
+  assert.equal(manifestFile.bytes, Buffer.byteLength(JSON.stringify(pkg.manifest, null, 2) + '\n'));
+});
+
+// ---------------------------------------------------------------------------
+// bongos module submit <key> — ADR 0107 §1 (network call is always injected —
+// never hits cli-lib.js / the real API in a unit test)
+// ---------------------------------------------------------------------------
+
+test('cmdSubmit: refuses (exit 1) when the pre-check fails, without ever attempting the network call', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  let submitCalled = false;
+  const check = () => ({ key: 'game', ok: false, findings: [{ kind: 'content', detail: 'contains denied content' }], files: [], denied: [] });
+  const submit = async () => { submitCalled = true; return { ok: true, status: 201, data: { submission: { id: 1, status: 'pending' } } }; };
+
+  const code = await mod.cmdSubmit(['game'], { ...sink, check, submit });
+  assert.equal(code, 1);
+  assert.equal(submitCalled, false, 'a failing pre-check must never reach the network');
+  assert.ok(lines.some((l) => /REFUSING/.test(l)));
+});
+
+test('cmdSubmit: refuses (exit 1) when the pre-check passes but no sign-off is on file and none was given', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  let submitCalled = false;
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  const readSign = () => null;
+  const submit = async () => { submitCalled = true; return { ok: true, status: 201, data: {} }; };
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, readSign, submit });
+  assert.equal(code, 1);
+  assert.equal(submitCalled, false);
+  assert.ok(lines.some((l) => /REFUSING/.test(l) && /sign-off/.test(l)));
+});
+
+test('cmdSubmit: --sign-off records a NEW sign-off when none is on file, then submits', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  let signedCall = null;
+  const recorded = { signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: '2026-07-08T00:00:00.000Z' }, path: 'modules/widget/.upstream-signoff.json' };
+  const sign = (key, by) => { signedCall = { key, by }; return recorded; };
+  let readSignCalls = 0;
+  const readSign = () => { readSignCalls += 1; return readSignCalls === 1 ? null : recorded; };
+  let submitArgs = null;
+  const submit = async (key, body) => { submitArgs = { key, body }; return { ok: true, status: 201, data: { submission: { id: 7, status: 'pending' } } }; };
+
+  const code = await mod.cmdSubmit(['widget', '--sign-off', 'Ada Lovelace <ada@example.com>'], { ...sink, check, sign, readSign, submit });
+  assert.equal(code, 0);
+  assert.deepEqual(signedCall, { key: 'widget', by: 'Ada Lovelace <ada@example.com>' });
+  assert.deepEqual(submitArgs, { key: 'widget', body: { signed_by: 'Ada Lovelace <ada@example.com>' } });
+  assert.ok(lines.some((l) => /Filed — submission id 7/.test(l)));
+});
+
+test('cmdSubmit: an existing sign-off on file is reused — --sign-off is not required again', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  let signCalled = false;
+  const sign = () => { signCalled = true; };
+  const readSign = () => ({ signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: 'now' } });
+  const submit = async () => ({ ok: true, status: 201, data: { submission: { id: 9, status: 'pending' } } });
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, sign, readSign, submit });
+  assert.equal(code, 0);
+  assert.equal(signCalled, false, 'an existing sign-off is never re-recorded');
+});
+
+test('cmdSubmit: surfaces a rejected submission (e.g. the server-side pre-check disagrees) as exit 1', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  const readSign = () => ({ signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: 'now' } });
+  const submit = async () => ({ ok: false, status: 422, data: { error: 'precheck_failed', message: 'server disagrees' } });
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, readSign, submit });
+  assert.equal(code, 1);
+  assert.ok(lines.some((l) => /REFUSING/.test(l) && /server disagrees/.test(l)));
+});
+
+test('cmdSubmit: usage error (exit 2) when no key is given', async () => {
+  const lines = [];
+  const code = await mod.cmdSubmit([], { log: (s) => lines.push(s), errlog: (s) => lines.push(s) });
+  assert.equal(code, 2);
+});
+
 // ---------------------------------------------------------------------------
 // dispatch wiring (bin/bongos.js)
 // ---------------------------------------------------------------------------
@@ -283,10 +403,18 @@ test('the `module` verb dispatches to module.js, `upgrade` to upgrade.js', () =>
   assert.ok(h.includes('upgrade'));
 });
 
-test('`bongos module check` is documented in help / dispatches to module.js check subcommand', () => {
+test('`bongos module check` is documented in help / dispatches to module.js check subcommand', async () => {
   const lines = [];
   mod.printHelp((s) => lines.push(s));
   assert.ok(lines.some((l) => /module check/.test(l)));
   // module.js itself dispatches the "check" subcommand (bongos.js forwards args[1:] verbatim to module.js)
-  assert.equal(mod.main(['node', 'module.js', 'check']), 2, 'no key => usage error');
+  // main() is async (bongos module submit makes a network call) — every subcommand's exit code resolves via the same Promise.
+  assert.equal(await mod.main(['node', 'module.js', 'check']), 2, 'no key => usage error');
+});
+
+test('`bongos module submit` is documented in help / dispatches to module.js submit subcommand', async () => {
+  const lines = [];
+  mod.printHelp((s) => lines.push(s));
+  assert.ok(lines.some((l) => /module submit/.test(l)));
+  assert.equal(await mod.main(['node', 'module.js', 'submit']), 2, 'no key => usage error');
 });

package/tests/module_loader.mjs

@@ -84,6 +84,48 @@ test('discoverModules: a missing modules/ root is empty, not an error', () => {
   assert.deepEqual(r, { loaded: [], skipped: [], errors: [] });
 });
 
+// --- task 2133 (R89-prereq): TWO-ROOT discovery. DEFAULT_ROOTS spans the core
+//     package's modules/ AND the consumer/instance's modules/, deduped by
+//     resolved path so a single checkout (roots coincide) never double-scans. ---
+
+test('discoverModules: UNIONs modules across two diverged roots (the post-split shape)', () => {
+  const core = fixtureRoot({ 'core-mod': { manifest: validManifest('core-mod') } });
+  const instance = fixtureRoot({ 'inst-mod': { manifest: validManifest('inst-mod') } });
+  const { loaded, errors, skipped } = loader.discoverModules({ roots: [core, instance], core: '1.0.0' });
+  assert.deepEqual(loaded.map((m) => m.key).sort(), ['core-mod', 'inst-mod'], 'both roots contribute');
+  assert.deepEqual(errors, []);
+  assert.deepEqual(skipped, []);
+});
+
+test('discoverModules: scanning the SAME root twice makes every key a duplicate-key ERROR (why dedupeRoots exists)', () => {
+  const root = fixtureRoot({ 'only-mod': { manifest: validManifest('only-mod') } });
+  const { loaded, errors } = loader.discoverModules({ roots: [root, root], core: '1.0.0' });
+  assert.equal(loaded.length, 1, 'the first scan loads it');
+  assert.equal(errors.length, 1, 'the second scan of the identical root is a duplicate-key error');
+  assert.match(errors[0].errors[0], /duplicate module key/);
+});
+
+test('dedupeRoots: collapses roots that resolve to the same path, preserving order', () => {
+  assert.deepEqual(
+    loader.dedupeRoots(['/a/modules', '/a/modules', '/b/modules']),
+    ['/a/modules', '/b/modules'],
+  );
+  assert.deepEqual(loader.dedupeRoots(['/a/modules', '/a/./modules']), ['/a/modules'], 'normalizes before comparing');
+  assert.equal(loader.dedupeRoots(['/a/modules', '/b/modules']).length, 2, 'a genuinely diverged pair is kept');
+});
+
+test('DEFAULT_ROOTS is deduped → the single checkout scans no root twice (zero dup-key errors)', () => {
+  // In a single checkout resolveInstanceRoot() falls back to cwd === resolveCoreRoot(),
+  // so the two candidate roots are identical and MUST collapse to one (a diverged
+  // consumer repo keeps both). The invariant: no resolved path appears twice.
+  const resolved = loader.DEFAULT_ROOTS.map((r) => path.resolve(r));
+  assert.equal(new Set(resolved).size, resolved.length, 'DEFAULT_ROOTS has no duplicate resolved paths');
+  loader._reset();
+  const snap = loader.loaderSnapshot();
+  assert.deepEqual(snap.errors, [], 'default-root discovery yields zero errors (no duplicate-key)');
+  loader._reset();
+});
+
 test('discoveredRegistry: shapes a loaded manifest like a MODULE_REGISTRY entry', () => {
   loader._reset();
   const root = fixtureRoot({ econ: { manifest: validManifest('econ', { default: true, provides: ['reward'], contributes: { disciplines: ['x'] } }) } });

package/tests/module_manifest.mjs

@@ -192,3 +192,22 @@ test('an empty-string attribution field is rejected', () => {
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.startsWith('author')));
 });
+
+// --- optional runtime dependencies (ADR 0138 / task 2160) ---
+
+test('dependencies: a valid { name: range } object passes', () => {
+  const r = validateManifest({ ...baseManifest(), dependencies: { 'discord.js': '^14.26.4' } });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('dependencies: omitted is fine (optional)', () => {
+  assert.equal(validateManifest(baseManifest()).valid, true);
+});
+
+test('dependencies: a non-object, or a non-string range, is rejected', () => {
+  for (const bad of [['discord.js'], 'discord.js@14', { 'discord.js': 14 }, { '': '^1' }]) {
+    const r = validateManifest({ ...baseManifest(), dependencies: bad });
+    assert.equal(r.valid, false, `should reject ${JSON.stringify(bad)}`);
+    assert.ok(r.errors.some((e) => e.startsWith('dependencies')), `error should mention dependencies: ${r.errors}`);
+  }
+});

package/tests/module_submissions.mjs

@@ -0,0 +1,135 @@
+// tests/module_submissions.mjs
+//
+// Unit smoke for the ADR 0107 §1 upstreaming review queue (task 1770,
+// migration core_191_module_submissions). Proves, with NO live Postgres:
+//
+//   DB helpers (against a stubbed pool seam):
+//     - createModuleSubmission() INSERTs, jsonb-casting + JSON.stringify'ing
+//       manifest/files/sign_off, parameterized
+//     - listModuleSubmissions() SELECTs metadata only (no `files` — the file
+//       snapshot can run to hundreds of KB and no list consumer needs it),
+//       newest-first, optionally filtered by status and/or module_key
+//
+// We stub the pool by pre-seeding the require cache for src/bongos/pool.js
+// BEFORE requiring src/bongos/module-submissions.js — the same monkeypatch
+// seam tests/security_docs.mjs uses.
+//
+// Run:  node tests/module_submissions.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  return Promise.resolve()
+    .then(fn)
+    .then(() => { passed++; console.log(`  ok  ${name}`); })
+    .catch((e) => { failed++; console.error(`  FAIL ${name}\n        ${e.message}`); });
+}
+
+const calls = [];
+let nextRows = [];
+const fakePool = {
+  query: async (text, params) => {
+    calls.push({ text, params });
+    return { rows: nextRows };
+  },
+};
+const poolPath = require.resolve(path.join(ROOT, 'src', 'bongos', 'pool.js'));
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: fakePool, instanceDbName: () => undefined } };
+
+const moduleSubmissions = require(path.join(ROOT, 'src', 'bongos', 'module-submissions.js'));
+
+function lastCall() { return calls[calls.length - 1]; }
+
+console.log('module_submissions — DB helpers (stubbed pool):');
+
+await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_off, parameterized', async () => {
+  calls.length = 0;
+  const manifest = { key: 'widget', title: 'Widget', license: 'AGPL-3.0' };
+  const files = [{ path: 'module.json', contentBase64: 'e30=', bytes: 2 }];
+  const signOff = { module: 'widget', signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: '2026-07-08T00:00:00.000Z' } };
+  const precheckPassedAt = new Date('2026-07-08T00:00:00.000Z');
+  nextRows = [{
+    id: 1, module_key: 'widget', submitted_by: 42, manifest, sign_off: signOff,
+    precheck_passed_at: precheckPassedAt, source_repo: 'lars589/amazonprimea',
+    status: 'pending', reviewed_by: null, reviewed_at: null, review_notes: null,
+    submitted_at: '2026-07-08T00:00:01.000Z',
+  }];
+
+  const row = await moduleSubmissions.createModuleSubmission({
+    moduleKey: 'widget', submittedBy: 42, manifest, files, signOff, precheckPassedAt,
+    sourceRepo: 'lars589/amazonprimea',
+  });
+
+  const { text, params } = lastCall();
+  assert.ok(/INSERT INTO module_submissions/i.test(text));
+  assert.ok(/RETURNING/i.test(text), 'must return the inserted row');
+  // files IS written (params[3] below) but is NOT in the RETURNING list — the
+  // write path never echoes the (possibly large) snapshot back.
+  const returningClause = text.slice(text.search(/RETURNING/i));
+  assert.ok(!/\bfiles\b/i.test(returningClause), 'RETURNING must not include files');
+
+  assert.equal(params[0], 'widget');
+  assert.equal(params[1], 42);
+  assert.equal(params[2], JSON.stringify(manifest));
+  assert.equal(params[3], JSON.stringify(files));
+  assert.equal(params[4], JSON.stringify(signOff));
+  assert.equal(params[5], precheckPassedAt);
+  assert.equal(params[6], 'lars589/amazonprimea');
+
+  assert.equal(row.id, 1);
+  assert.equal(row.status, 'pending');
+});
+
+await test('createModuleSubmission() defaults a missing sourceRepo to null (parameterized, not the string "undefined")', async () => {
+  calls.length = 0;
+  nextRows = [{ id: 2, module_key: 'widget', status: 'pending' }];
+  await moduleSubmissions.createModuleSubmission({
+    moduleKey: 'widget', submittedBy: 1, manifest: {}, files: [], signOff: {}, precheckPassedAt: new Date(),
+  });
+  const { params } = lastCall();
+  assert.equal(params[6], null);
+});
+
+await test('listModuleSubmissions(): no filters => SELECT with no WHERE, newest-first, no files column', async () => {
+  calls.length = 0;
+  nextRows = [{ id: 2, module_key: 'b', status: 'pending' }, { id: 1, module_key: 'a', status: 'pending' }];
+  const rows = await moduleSubmissions.listModuleSubmissions();
+  const { text, params } = lastCall();
+  assert.ok(/SELECT/i.test(text));
+  assert.ok(!/WHERE/i.test(text));
+  assert.ok(/ORDER BY\s+submitted_at\s+DESC/i.test(text));
+  const selectClause = text.slice(0, text.search(/FROM/i));
+  assert.ok(!/\bfiles\b/i.test(selectClause), 'list SELECT must not include the files column');
+  assert.deepEqual(params, []);
+  assert.deepEqual(rows, nextRows);
+});
+
+await test('listModuleSubmissions({status}): filters by status, parameterized', async () => {
+  calls.length = 0;
+  nextRows = [];
+  await moduleSubmissions.listModuleSubmissions({ status: 'pending' });
+  const { text, params } = lastCall();
+  assert.ok(/WHERE\s+status\s*=\s*\$1/i.test(text));
+  assert.deepEqual(params, ['pending']);
+});
+
+await test('listModuleSubmissions({status, moduleKey}): both filters AND together, parameterized in order', async () => {
+  calls.length = 0;
+  nextRows = [];
+  await moduleSubmissions.listModuleSubmissions({ status: 'accepted', moduleKey: 'widget' });
+  const { text, params } = lastCall();
+  assert.ok(/WHERE\s+status\s*=\s*\$1\s+AND\s+module_key\s*=\s*\$2/i.test(text));
+  assert.deepEqual(params, ['accepted', 'widget']);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/npmrc.mjs

@@ -0,0 +1,105 @@
+// tests/npmrc.mjs
+//
+// Unit tests for scripts/gds/npmrc.js (ADR 0134, task 2090) — the single source of the
+// env-fed `.npmrc` used to install the PRIVATE @bongos/core from the npm registry, plus
+// the opt-in / token gates that keep the vendored-tarball path the default/fallback.
+//
+// Run:  node tests/npmrc.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const n = require('../scripts/gds/npmrc.js');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---- npmrcContent ----------------------------------------------------------
+test('npmrcContent: scopes @bongos to the registry + auth token EXPANDS from the env (literal ${NPM_TOKEN})', () => {
+  const body = n.npmrcContent();
+  assert.match(body, /@bongos:registry=https:\/\/registry\.npmjs\.org\//);
+  assert.match(body, /\/\/registry\.npmjs\.org\/:_authToken=\$\{NPM_TOKEN\}/);
+});
+
+test('npmrcContent: carries NO real secret — only the ${NPM_TOKEN} placeholder', () => {
+  const body = n.npmrcContent();
+  // the only _authToken= assignment must be the env placeholder, never a concrete value
+  const tokenLines = body.split('\n').filter((l) => /_authToken=/.test(l));
+  assert.equal(tokenLines.length, 1);
+  assert.equal(tokenLines[0].trim(), '//registry.npmjs.org/:_authToken=${NPM_TOKEN}');
+});
+
+test('npmrcContent: comment lines use the ini `;` comment char', () => {
+  const comments = n.npmrcContent().split('\n').filter((l) => l.startsWith(';'));
+  assert.ok(comments.length >= 3, 'has explanatory comments');
+});
+
+test('npmrcContent: honors custom scope/host/tokenEnv', () => {
+  const body = n.npmrcContent({ scope: '@acme', host: 'npm.acme.dev', tokenEnv: 'ACME_TOKEN' });
+  assert.match(body, /@acme:registry=https:\/\/npm\.acme\.dev\//);
+  assert.match(body, /\/\/npm\.acme\.dev\/:_authToken=\$\{ACME_TOKEN\}/);
+});
+
+// ---- gates -----------------------------------------------------------------
+test('hasNpmToken: true only when NPM_TOKEN is a non-empty string', () => {
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: 'npm_abc' }), true);
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: '' }), false);
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: '   ' }), false);
+  assert.equal(n.hasNpmToken({}), false);
+});
+
+test('registryCoreRequested: 1/true/yes/on → true; everything else → false', () => {
+  for (const v of ['1', 'true', 'TRUE', 'yes', 'on']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), true, v);
+  for (const v of ['0', 'false', 'no', '', 'off', 'garbage']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), false, v);
+  assert.equal(n.registryCoreRequested({}), false, 'unset');
+});
+
+// ---- writeNpmrc ------------------------------------------------------------
+test('writeNpmrc: writes the env-fed .npmrc + returns its path', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const p = n.writeNpmrc(dir, { log: () => {} });
+    assert.equal(p, join(dir, '.npmrc'));
+    assert.equal(readFileSync(p, 'utf8'), n.npmrcContent());
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: dry-run writes nothing but returns the intended path', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const p = n.writeNpmrc(dir, { dryRun: true, log: () => {} });
+    assert.equal(p, join(dir, '.npmrc'));
+    assert.equal(existsSync(join(dir, '.npmrc')), false, 'dry-run must not write');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: overwrite:false leaves a pre-existing .npmrc untouched (returns null)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const existing = '@other:registry=https://npm.other.dev/\n';
+    writeFileSync(join(dir, '.npmrc'), existing);
+    const p = n.writeNpmrc(dir, { overwrite: false, log: () => {} });
+    assert.equal(p, null, 'skipped');
+    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), existing, 'existing content preserved');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: overwrite:true (default) replaces an existing .npmrc', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    writeFileSync(join(dir, '.npmrc'), 'stale\n');
+    n.writeNpmrc(dir, { log: () => {} });
+    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), n.npmrcContent());
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+console.log('');
+console.log(`npmrc tests: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);