@bongos/core 1.23.22 → 1.24.2

package/tests/ai_studio_requests.mjs

@@ -0,0 +1,319 @@
+// tests/ai_studio_requests.mjs — THE WHOLE PATH of an AI studio request through
+// the real router (task 1004917, goal 1000136, ADR 0392): upload a sketch, send
+// a request naming it, wait for it to finish, read the reply, the image and the
+// exact price, and fetch the image back. Also: a builder can only send and see
+// their own files, and our key appears in no response.
+//
+// Drives the real router over an in-memory db, the fake payments backend and a
+// stubbed fetch standing in for OpenRouter, so it needs no Postgres and no network.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/ai-studio/db.js');
+const payments = require('../modules/ai-studio/payments.js');
+const P = require('../modules/ai-studio/pricing.js');
+const api = require('../src/module-api.js');
+
+const OUR_KEY = 'sk-or-v1-OUR-SERVER-KEY-0123456789abcdef';
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13]);
+const OUT_PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1, 2, 3, 4]);
+
+// ---- an in-memory db with the same ownership rules as the SQL ---------------
+
+const files = new Map();
+const requests = new Map();
+let seq = 100;
+const meta = (f) => ({ id: f.id, request_id: f.request_id, role: f.role, name: f.name, content_type: f.content_type, size_bytes: f.bytes.length, created_at: f.created_at });
+Object.assign(db, {
+  appendLedger: async () => ({}),
+  addUpload: async (builderId, f) => {
+    const row = { id: String(++seq), builder_id: builderId, request_id: null, role: 'upload', name: f.name, content_type: f.content_type, bytes: f.bytes, created_at: 'now' };
+    files.set(row.id, row);
+    return meta(row);
+  },
+  createRequest: async (builderId, prompt, ids) => {
+    const own = ids.map((id) => files.get(id)).filter((f) => f && f.builder_id === builderId && f.role === 'upload' && !f.request_id);
+    if (own.length !== ids.length) return null;
+    const r = { id: String(++seq), builder_id: builderId, prompt, status: 'queued', key_source: null, created_at: 'now' };
+    requests.set(r.id, r);
+    own.forEach((f) => { f.request_id = r.id; });
+    return { ...r, attached: own.length };
+  },
+  markRunning: async (id, src) => Object.assign(requests.get(String(id)), { status: 'running', key_source: src }),
+  finishRequest: async (id, f) => Object.assign(requests.get(String(id)), f, { finished_at: 'now' }),
+  addOutput: async (requestId, builderId, img) => {
+    const row = { id: String(++seq), builder_id: builderId, request_id: String(requestId), role: 'output', name: 'generated.png', content_type: img.content_type, bytes: Buffer.from(img.base64, 'base64'), created_at: 'now' };
+    files.set(row.id, row);
+    return meta(row);
+  },
+  getRequest: async (builderId, id) => {
+    const r = requests.get(String(id));
+    if (!r || r.builder_id !== builderId) return null;
+    return { ...r, files: [...files.values()].filter((f) => f.request_id === r.id).map(meta) };
+  },
+  listRequests: async (builderId) => [...requests.values()].filter((r) => r.builder_id === builderId),
+  getFile: async (builderId, id) => { const f = files.get(String(id)); return f && f.builder_id === builderId ? f : null; },
+  requestUploads: async (id) => [...files.values()].filter((f) => f.request_id === String(id) && f.role === 'upload'),
+  countActiveRequests: async (builderId) => [...requests.values()].filter((r) => r.builder_id === builderId && ['queued', 'running'].includes(r.status)).length,
+  listKeyMeta: async (builderId) => [...ownKeys.entries()].filter(([k]) => k.startsWith(`${builderId}/`)).map(([k]) => ({ provider: k.split('/')[1], key_enc: true })),
+  getKeyEnc: async (builderId, provider) => ownKeys.get(`${builderId}/${provider}`) || null,
+});
+
+// A builder's own saved keys, as the secret box would store them.
+const ownKeys = new Map();
+const box = { isConfigured: () => true, encrypt: (p) => `v1.${Buffer.from(p).toString('base64url')}`, decrypt: (b) => Buffer.from(String(b).slice(3), 'base64url').toString() };
+Object.defineProperty(api, 'secretBox', { value: box, configurable: true, writable: true });
+
+// ---- OpenRouter stand-in: a reply, then an image, each with its cost --------
+
+const providerCalls = [];
+globalThis.fetch = async (url, init) => {
+  const body = JSON.parse(init.body);
+  providerCalls.push({ url, auth: init.headers.authorization, googKey: init.headers['x-goog-api-key'], body });
+  if (url.includes('generativelanguage.googleapis.com')) {
+    const part = body.generationConfig
+      ? { inlineData: { mimeType: 'image/png', data: OUT_PNG.toString('base64') } }
+      : { text: 'From Gemini direct: lovely.' };
+    return { ok: true, status: 200, json: async () => ({ candidates: [{ content: { parts: [part] } }] }) };
+  }
+  const json = body.modalities
+    ? { choices: [{ message: { images: [{ image_url: { url: `data:image/png;base64,${OUT_PNG.toString('base64')}` } }] } }], usage: { cost: 0.039 } }
+    : { choices: [{ message: { content: 'The tower reads well; push the dusk light.' } }], usage: { cost: 0.0114 } };
+  return { ok: true, status: 200, json: async () => json };
+};
+process.env.OPENROUTER_API_KEY = OUR_KEY;
+const pay = payments.createFakeBackend();
+payments._setBackend(pay);
+await pay.topUp(7, { chargeMicro: 10 * P.MICRO_PER_USD + 1, creditedMicro: 10 * P.MICRO_PER_USD });
+
+// ---- the app -----------------------------------------------------------------
+
+const logged = [];
+const capture = (...args) => logged.push(JSON.stringify(args));
+const fakeLog = { info: capture, warn: capture, error: capture, debug: capture, child: () => fakeLog };
+let viewer = { id: 7, rank: 'xenos' };
+for (const [name, value] of Object.entries({
+  logger: () => fakeLog,
+  requireBuilder: (req, res, next) => { req.builder = viewer; next(); },
+})) Object.defineProperty(api, name, { value, configurable: true, writable: true });
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code, message: opts && opts.message } });
+  next();
+});
+// Like src/bongos/routes.js: the tight global parser skips the upload path.
+const small = express.json({ limit: '64kb' });
+app.use((req, res, next) => (req.path === '/api/bongos/ai-studio/uploads' ? next() : small(req, res, next)));
+app.use('/api/bongos', require('../modules/ai-studio/routes/ai-studio.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const buf = Buffer.concat(chunks);
+        const raw = buf.toString('latin1');
+        let json = null;
+        try { json = JSON.parse(buf.toString()); } catch (_) { /* a file */ }
+        resolve({ status: res.statusCode, headers: res.headers, raw, buf, body: json });
+      });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+async function waitDone(id) {
+  for (let i = 0; i < 100; i++) {
+    const r = await call('GET', `/ai-studio/requests/${id}`);
+    if (!['queued', 'running'].includes(r.body.request.status)) return r;
+    await new Promise((res) => setTimeout(res, 10));
+  }
+  throw new Error('the request never finished');
+}
+
+test('THE WHOLE PATH: upload a sketch, send it, get a reply, an image and the exact price', async () => {
+  // A sketch bigger than the 64 KB global cap still goes up.
+  const sketch = Buffer.concat([PNG, Buffer.alloc(200 * 1024)]);
+  const up = await call('POST', '/ai-studio/uploads', { name: 'tower.png', content_type: 'image/png', data: sketch.toString('base64') });
+  assert.equal(up.status, 201, up.raw);
+  assert.equal(up.body.file.size_bytes, sketch.length);
+
+  const sent = await call('POST', '/ai-studio/requests', { prompt: 'Finish this tower at dusk', file_ids: [up.body.file.id] });
+  assert.equal(sent.status, 202, sent.raw);
+
+  const done = await waitDone(sent.body.request.id);
+  const r = done.body.request;
+  assert.equal(r.status, 'done', r.error);
+  assert.equal(r.key_source, 'ours');
+  assert.equal(r.reply_md, 'The tower reads well; push the dusk light.');
+  // 0.0114 + 0.039 = $0.0504 cost; x 1.08 = $0.054432.
+  assert.deepEqual([r.provider_cost_micro, r.markup_micro, r.price_micro], [50400, 4032, 54432]);
+  assert.deepEqual((await pay.balance(7)).available_micro, 10 * P.MICRO_PER_USD - 54432);
+
+  const out = r.files.find((f) => f.role === 'output');
+  assert.ok(out, 'the generated image is on the request');
+  const img = await call('GET', out.url.replace('/api/bongos', ''));
+  assert.equal(img.status, 200);
+  assert.equal(img.headers['content-type'], 'image/png');
+  assert.equal(img.headers['x-content-type-options'], 'nosniff');
+  assert.ok(img.buf.equals(OUT_PNG));
+
+  // The provider got our key as a header, the sketch, and the server-built context.
+  assert.equal(providerCalls.length, 2);
+  assert.ok(providerCalls.every((c) => c.auth === `Bearer ${OUR_KEY}`));
+  assert.match(providerCalls[0].body.messages[0].content, /art director's assistant/);
+  assert.equal(providerCalls[0].body.messages[1].content[1].type, 'image_url');
+
+  // Our key is in nothing a builder can see, and in no log line.
+  for (const res of [up, sent, done]) assert.ok(!res.raw.includes(OUR_KEY));
+  assert.ok(logged.length > 0);
+  assert.ok(logged.every((l) => !l.includes(OUR_KEY)));
+});
+
+test('a builder can neither send nor read another builder\'s files or requests', async () => {
+  const up = await call('POST', '/ai-studio/uploads', { name: 'mine.png', content_type: 'image/png', data: PNG.toString('base64') });
+  const sent = await call('POST', '/ai-studio/requests', { prompt: 'my own request', file_ids: [up.body.file.id] });
+  await waitDone(sent.body.request.id);
+
+  viewer = { id: 8, rank: 'xenos' };
+  try {
+    const up2 = await call('POST', '/ai-studio/uploads', { name: 'other.png', content_type: 'image/png', data: PNG.toString('base64') });
+    const borrow = await call('POST', '/ai-studio/requests', { prompt: 'borrow it', file_ids: [up.body.file.id, up2.body.file.id] });
+    assert.equal(borrow.status, 404);
+    assert.equal((await call('GET', `/ai-studio/requests/${sent.body.request.id}`)).status, 404);
+    assert.equal((await call('GET', `/ai-studio/files/${up.body.file.id}`)).status, 404);
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+  // A file already sent cannot be sent again.
+  const again = await call('POST', '/ai-studio/requests', { prompt: 'again please', file_ids: [up.body.file.id] });
+  assert.equal(again.status, 404);
+});
+
+test('refusals: a disguised file, a missing prompt, too many files', async () => {
+  const fake = await call('POST', '/ai-studio/uploads', { name: 'x.jpg', content_type: 'image/jpeg', data: PNG.toString('base64') });
+  assert.equal(fake.status, 400);
+  assert.equal(fake.body.error.code, 'type_mismatch');
+  const svg = await call('POST', '/ai-studio/uploads', { name: 'x.svg', content_type: 'image/svg+xml', data: Buffer.from('<svg/>').toString('base64') });
+  assert.equal(svg.body.error.code, 'unsupported_type');
+  assert.equal((await call('POST', '/ai-studio/requests', { prompt: '', file_ids: ['1'] })).body.error.code, 'prompt_required');
+  assert.equal((await call('POST', '/ai-studio/requests', { prompt: 'seven', file_ids: ['1', '2', '3', '4', '5', '6', '7'] })).status, 400);
+});
+
+// ---- the builder's own key (task 1004918) ------------------------------------
+
+const BUILDER_OR_KEY = 'sk-or-v1-BUILDER-OWN-KEY-fedcba9876543210';
+const BUILDER_GOOGLE_KEY = 'test-builder-google-key-0123456789abcdef';
+
+async function sendSketch(body = {}) {
+  const up = await call('POST', '/ai-studio/uploads', { name: 'own.png', content_type: 'image/png', data: PNG.toString('base64') });
+  return call('POST', '/ai-studio/requests', { prompt: 'Finish on my key', file_ids: [up.body.file.id], ...body });
+}
+
+test('OWN KEY: with an OpenRouter key saved, it runs on that key and charges nothing', async () => {
+  ownKeys.set('9/openrouter', box.encrypt(BUILDER_OR_KEY));
+  viewer = { id: 9, rank: 'xenos' };
+  const balanceBefore = await pay.balance(9);
+  const callsBefore = providerCalls.length;
+  try {
+    const sent = await sendSketch();
+    assert.equal(sent.status, 202, sent.raw);
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.status, 'done', r.error);
+    assert.equal(r.key_source, 'own');
+    assert.equal(r.price_micro, 0, 'we charge nothing on their key');
+    assert.equal(r.markup_micro, 0);
+    assert.equal(r.provider_cost_micro, 50400, 'what it cost them is still shown');
+    assert.deepEqual(await pay.balance(9), balanceBefore, 'no money moved');
+    const used = providerCalls.slice(callsBefore);
+    assert.equal(used.length, 2);
+    assert.ok(used.every((c) => c.auth === `Bearer ${BUILDER_OR_KEY}`), 'their key, not ours');
+    // Their key appears in no response and no log line.
+    assert.ok(!sent.raw.includes(BUILDER_OR_KEY));
+    assert.ok(logged.every((l) => !l.includes(BUILDER_OR_KEY)));
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('OWN KEY: a Google key goes to Gemini directly, as a header, and its unknown cost is shown as unknown', async () => {
+  ownKeys.set('10/gemini', box.encrypt(BUILDER_GOOGLE_KEY));
+  viewer = { id: 10, rank: 'xenos' };
+  const callsBefore = providerCalls.length;
+  try {
+    const sent = await sendSketch();
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.status, 'done', r.error);
+    assert.equal(r.reply_md, 'From Gemini direct: lovely.');
+    assert.equal(r.provider_cost_micro, null);
+    assert.equal(r.price_micro, 0);
+    assert.ok(r.files.some((f) => f.role === 'output'));
+    const used = providerCalls.slice(callsBefore);
+    assert.equal(used.length, 2);
+    assert.ok(used.every((c) => c.url.startsWith('https://generativelanguage.googleapis.com/') && c.googKey === BUILDER_GOOGLE_KEY));
+    assert.ok(used.every((c) => !c.url.includes(BUILDER_GOOGLE_KEY)), 'the key is never in the URL');
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('OWN KEY: pay_with ours uses the balance even with a key saved; own with none saved is refused', async () => {
+  viewer = { id: 9, rank: 'xenos' };
+  await pay.topUp(9, { chargeMicro: 5 * P.MICRO_PER_USD + 1, creditedMicro: 5 * P.MICRO_PER_USD });
+  try {
+    const sent = await sendSketch({ pay_with: 'ours' });
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.key_source, 'ours');
+    assert.equal(r.price_micro, 54432);
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+  const none = await sendSketch({ pay_with: 'own' });
+  assert.equal(none.status, 409);
+  assert.equal(none.body.error.code, 'no_own_key');
+});
+
+test('a builder may have only two requests running at once', async () => {
+  viewer = { id: 11, rank: 'xenos' };
+  const realFetch = globalThis.fetch;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  globalThis.fetch = async (...a) => { await gate; return realFetch(...a); };
+  try {
+    ownKeys.set('11/openrouter', box.encrypt(BUILDER_OR_KEY));
+    const a = await sendSketch();
+    const b = await sendSketch();
+    const c = await sendSketch();
+    assert.deepEqual([a.status, b.status, c.status], [202, 202, 429]);
+    assert.equal(c.body.error.code, 'too_many_running');
+    release();
+    await waitDone(a.body.request.id);
+    await waitDone(b.body.request.id);
+  } finally {
+    globalThis.fetch = realFetch;
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('an uploaded PDF downloads rather than opening in the page', async () => {
+  const pdf = Buffer.from('%PDF-1.7\n%test\n');
+  const up = await call('POST', '/ai-studio/uploads', { name: 'brief.pdf', content_type: 'application/pdf', data: pdf.toString('base64') });
+  const got = await call('GET', `/ai-studio/files/${up.body.file.id}`);
+  assert.match(got.headers['content-disposition'], /^attachment;/);
+  const img = await call('POST', '/ai-studio/uploads', { name: 'i.png', content_type: 'image/png', data: PNG.toString('base64') });
+  assert.match((await call('GET', `/ai-studio/files/${img.body.file.id}`)).headers['content-disposition'], /^inline;/);
+});

package/tests/auth_backchannel_logout_route.mjs

@@ -0,0 +1,201 @@
+// tests/auth_backchannel_logout_route.mjs — POST /auth/backchannel-logout, executed
+// for real (task 1004987, goal 1000094).
+//
+// This route needs no sign-in: the hub-signed logout token is the ONLY credential,
+// and a valid one revokes every session the named builder holds. Until this file only
+// the verifier (verifyHubLogoutToken) was tested, in tests/idp_device_exchange.mjs; the
+// route around it — the not-federated 404, the missing-key 503, the 401 on a bad token,
+// the single-use jti, and the no-leak answer for an unknown builder — was not.
+//
+// What is real: the router (src/bongos/routes/auth.js), verifyHubLogoutToken and its
+// signature check, the logout jti store, the body validator and the error envelope.
+// Tokens are minted by the REAL hub minter (modules/platform-identity/hub-keys.js) with
+// a keypair generated here, the tests/idp_device_exchange.mjs keypair recipe. What is
+// faked: auth.loadIdpConfig / auth.loadHubPublicKey (the instance's configuration),
+// db.getBuilderByGithubId (who exists) and db.revokeAllSessionsForBuilder, which
+// RECORDS instead of revoking. Every refusal asserts that nothing was revoked.
+//
+// Run:  node --test tests/auth_backchannel_logout_route.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after, beforeEach } from 'node:test';
+import http from 'node:http';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const auth = require('../src/bongos/auth.js');
+const db = require('../src/bongos/db.js');
+const hubKeys = require('../modules/platform-identity/hub-keys.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ── keys: the hub's, and a forger's ──────────────────────────────────────────
+const { privateKeyB64, publicKeyB64 } = hubKeys.generateHubKeypair();
+const hubSigningKey = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, 'base64'), format: 'der', type: 'pkcs8' });
+const hubPublicKey = crypto.createPublicKey({ key: Buffer.from(publicKeyB64, 'base64'), format: 'der', type: 'spki' });
+const forgerSigningKey = crypto.generateKeyPairSync('ed25519').privateKey;
+
+const CLIENT_ID = 'client-under-test';
+const KNOWN_GITHUB_ID = 4242;
+const KNOWN_BUILDER = { id: 77, github_id: String(KNOWN_GITHUB_ID), github_login: 'known-builder' };
+
+const mintLogout = ({ githubId = KNOWN_GITHUB_ID, clientId = CLIENT_ID } = {}, opts = {}) =>
+  hubKeys.mintHubLogoutToken({ clientId, githubId }, { signingKey: hubSigningKey, ...opts });
+
+// ── the instance's configuration and data, per case ──────────────────────────
+let idp = { clientId: CLIENT_ID };
+let publicKey = hubPublicKey;
+let revokes = [];
+let lookups = [];
+
+beforeEach(() => { idp = { clientId: CLIENT_ID }; publicKey = hubPublicKey; revokes = []; lookups = []; });
+
+auth.loadIdpConfig = () => idp;
+auth.loadHubPublicKey = () => publicKey;
+db.getBuilderByGithubId = async (githubId) => {
+  lookups.push(String(githubId));
+  return String(githubId) === String(KNOWN_GITHUB_ID) ? { ...KNOWN_BUILDER } : null;
+};
+db.revokeAllSessionsForBuilder = async (builderId) => { revokes.push(builderId); return 3; };
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAuthRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function logout(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: '/api/gds/auth/backchannel-logout', method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let raw = '';
+      res.on('data', (c) => { raw += c; });
+      res.on('end', () => { let json = null; try { json = JSON.parse(raw); } catch { /* text */ } resolve({ status: res.statusCode, json, raw }); });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+// ── not a public surface unless the instance federates ───────────────────────
+
+test('idp not configured → 404, no lookup, no revoke — even for a perfectly valid token', async () => {
+  idp = null;
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 404);
+  assert.equal(r.raw, 'not found', 'indistinguishable from a route that does not exist');
+  assert.deepEqual(lookups, []);
+  assert.deepEqual(revokes, []);
+});
+
+test('no hub public key set → 503 idp_unconfigured and no revoke', async () => {
+  publicKey = null;
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 503);
+  assert.equal(r.json.error.code, 'idp_unconfigured');
+  assert.deepEqual(lookups, []);
+  assert.deepEqual(revokes, []);
+});
+
+// ── forged and wrong tokens: 401, nothing revoked ────────────────────────────
+
+test('a forged token (signed by a key that is not the hub’s) → 401 and no revoke', async () => {
+  const forged = hubKeys.mintHubLogoutToken({ clientId: CLIENT_ID, githubId: KNOWN_GITHUB_ID }, { signingKey: forgerSigningKey });
+  const r = await logout({ logout_token: forged });
+  assert.equal(r.status, 401);
+  assert.equal(r.json.error.code, 'invalid_logout_token');
+  assert.match(r.json.error.message, /signature invalid/);
+  assert.deepEqual(lookups, [], 'the subject of an unverified token is never even looked up');
+  assert.deepEqual(revokes, []);
+});
+
+test('a genuine token with its subject swapped (payload re-encoded, signature kept) → 401 and no revoke', async () => {
+  const [h, p, s] = mintLogout({ githubId: 1 }).split('.');
+  const claims = JSON.parse(Buffer.from(p, 'base64url').toString('utf8'));
+  claims.sub = String(KNOWN_GITHUB_ID);
+  const tampered = `${h}.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.${s}`;
+  const r = await logout({ logout_token: tampered });
+  assert.equal(r.status, 401);
+  assert.deepEqual(revokes, []);
+});
+
+test('a hub-signed token minted for ANOTHER instance → 401 and no revoke', async () => {
+  const r = await logout({ logout_token: mintLogout({ clientId: 'some-other-project' }) });
+  assert.equal(r.status, 401);
+  assert.match(r.json.error.message, /audience/);
+  assert.deepEqual(revokes, []);
+});
+
+test('a hub LOGIN assertion (no logout purpose) cannot log anyone out → 401 and no revoke', async () => {
+  const assertion = hubKeys.mintHubAssertion(
+    { clientId: CLIENT_ID, githubId: KNOWN_GITHUB_ID, githubLogin: 'known-builder', displayName: null, avatarUrl: null },
+    { signingKey: hubSigningKey },
+  );
+  const r = await logout({ logout_token: assertion });
+  assert.equal(r.status, 401);
+  assert.deepEqual(revokes, []);
+});
+
+test('an expired token → 401 and no revoke', async () => {
+  const r = await logout({ logout_token: mintLogout({}, { nowMs: Date.now() - 10 * 60 * 1000 }) });
+  assert.equal(r.status, 401);
+  assert.match(r.json.error.message, /expired/);
+  assert.deepEqual(revokes, []);
+});
+
+test('no token at all → 400 and no revoke', async () => {
+  const r = await logout({});
+  assert.equal(r.status, 400);
+  assert.deepEqual(revokes, []);
+});
+
+// ── a valid token: once, and only once ───────────────────────────────────────
+
+test('a valid token for a known builder → 200 and exactly one revoke, of that builder', async () => {
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json, { ok: true });
+  assert.deepEqual(lookups, [String(KNOWN_GITHUB_ID)]);
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id]);
+});
+
+test('the same token again (same jti) → 200, and still only the one revoke', async () => {
+  const token = mintLogout();
+  const first = await logout({ logout_token: token });
+  const replay = await logout({ logout_token: token });
+  const replayAgain = await logout({ logout_token: token });
+  assert.equal(first.status, 200);
+  assert.equal(replay.status, 200, 'a replay is an idempotent no-op, not an error');
+  assert.equal(replay.raw, first.raw, 'and answers the same bytes');
+  assert.equal(replayAgain.status, 200);
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id], 'a captured token cannot keep killing sessions made after it');
+});
+
+test('a fresh token for the same builder (a new jti) revokes again — the guard is per token, not per builder', async () => {
+  await logout({ logout_token: mintLogout() });
+  await logout({ logout_token: mintLogout() });
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id, KNOWN_BUILDER.id]);
+});
+
+test('a valid token for an unknown sub → 200, zero revokes, and the same body as the known case', async () => {
+  const known = await logout({ logout_token: mintLogout() });
+  revokes = [];
+  const unknown = await logout({ logout_token: mintLogout({ githubId: 999001 }) });
+  assert.equal(unknown.status, 200);
+  assert.deepEqual(revokes, []);
+  assert.equal(unknown.raw, known.raw, 'whether this builder exists here is never leaked');
+});

package/tests/auto_satisfy_criteria.mjs

@@ -223,7 +223,16 @@ await test('the ship hook cannot fail a ship, and the sweep exists to retry it',
   assert.match(line, /auto-satisfy skipped \(sweep retries\)/, 'the failure is reported, not thrown');
   assert.match(logged.join('\n'), /shipTask 5/, 'and it names the ship it happened on');
   const rec = readFileSync(new URL('../modules/lifecycle/publish-reconciler.js', import.meta.url), 'utf8');
-  assert.match(rec, /runCriterionSweep\(deps\)\.catch\(/, 'the sweep is fire-and-forget on the tick, like runCostSweep');
+  // task 1004924: the tick runs the guarded SWEEPS list (fire-and-forget, a
+  // sweep still in flight is skipped), so the wiring is an entry there.
+  // task 1004965: an entry's third element is its cadence; these two have none, so
+  // they keep the every-tick cadence while promotion and the craft backfill go hourly.
+  assert.match(rec, /\['criterion sweep', runCriterionSweep\]/, 'the sweep is fire-and-forget on EVERY tick, like runCostSweep');
+  assert.match(rec, /\['cost sweep', runCostSweep\]/);
+  const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+  const cadence = new Map(reconciler.SWEEPS.map(([name, , everyMs]) => [name, everyMs]));
+  assert.equal(cadence.get('criterion sweep'), undefined, 'the criterion sweep is not slowed to hourly');
+  assert.equal(cadence.get('cost sweep'), undefined, 'nor the cost sweep');
   assert.match(rec, /BACKLOG DRAIN/, 'and documents why it is not merely belt-and-braces');
 });