@bugmole/cli 0.4.0

package/src/registry-worker/sso/sso.test.ts

@@ -0,0 +1,344 @@
+import assert from "node:assert/strict";
+import { createHmac, randomUUID } from "node:crypto";
+import test from "node:test";
+import type { Env } from "../core.js";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+import { drainOutbox } from "../notifications/outbox.js";
+import { resetAegisTokenCache, verifyAegisEvent } from "./aegis.js";
+import { pickRole } from "./membership.js";
+import { SSO_GRACE_DAYS, syncSsoEntitlements } from "./routes.js";
+
+const EVENTS_SECRET = "e".repeat(40);
+const ORG_ID = "0b6c8a4e-1f0e-4a3e-9d0a-3c1f2e5d6a7b";
+
+type AegisCall = { method: string; path: string; body: any };
+
+function fakeAegis() {
+  const calls: AegisCall[] = [];
+  const org = {
+    id: ORG_ID,
+    name: "Acme",
+    externalRef: "acme",
+    entitlements: { sso: false, scim: false },
+    ssoRequired: false,
+  };
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const method = init?.method ?? "GET";
+    if (url.pathname === "/token") {
+      assert.equal(new Headers(init?.headers).get("authorization"), `Basic ${btoa("bugmole-orgs:org-secret")}`);
+      assert.match(String(init?.body), /scope=organizations%3Amanage/);
+      return Response.json({ access_token: "aegis-token", expires_in: 300 });
+    }
+    assert.equal(new Headers(init?.headers).get("authorization"), "Bearer aegis-token");
+    const body = init?.body ? JSON.parse(String(init.body)) : undefined;
+    calls.push({ method, path: url.pathname, body });
+    if (method === "POST" && url.pathname === "/organizations") return Response.json({ ...org, name: body.name }, { status: 201 });
+    if (method === "PUT" && url.pathname === `/organizations/${ORG_ID}/entitlements`) {
+      org.entitlements = body;
+      return Response.json(org);
+    }
+    if (method === "GET" && url.pathname === `/organizations/${ORG_ID}`) {
+      return Response.json({ ...org, domains: [], connections: [], scimTokens: [], scimBaseUrl: "https://id.test/scim/v2/x", memberCount: 0, groupCount: 0 });
+    }
+    if (method === "PATCH" && url.pathname === `/organizations/${ORG_ID}`) return Response.json({ ...org, ...body });
+    if (method === "POST" && url.pathname === `/organizations/${ORG_ID}/connections`) {
+      return Response.json({ id: randomUUID(), ...body, oidcClientSecret: undefined, hasOidcClientSecret: Boolean(body.oidcClientSecret) }, { status: 201 });
+    }
+    if (method === "POST" && url.pathname === `/organizations/${ORG_ID}/scim-tokens`) {
+      if (!org.entitlements.scim) return Response.json({ error: "not_entitled", message: "no scim" }, { status: 403 });
+      return Response.json({ id: randomUUID(), token: "scim_secret", prefix: "scim_sec" }, { status: 201 });
+    }
+    if (method === "POST" && url.pathname.endsWith("/verify")) {
+      return Response.json({ error: "dns_verification_failed", message: "Add a TXT record" }, { status: 400 });
+    }
+    return Response.json({ error: "not_found" }, { status: 404 });
+  }) as unknown as typeof fetch;
+  return { calls, org, doFetch };
+}
+
+async function workspace(plan: string | null, aegis = fakeAegis()) {
+  resetAegisTokenCache();
+  const setup = createTestEnv({
+    FEATURE_SSO: "on",
+    AEGIS_ISSUER: "https://id.test",
+    AEGIS_ORG_CLIENT_ID: "bugmole-orgs",
+    AEGIS_ORG_CLIENT_SECRET: "org-secret",
+    AEGIS_EVENTS_SECRET: EVENTS_SECRET,
+    AEGIS_FETCH: aegis.doFetch,
+    REGISTRY_PUBLIC_URL: "https://registry.test",
+  } as Partial<Env>);
+  const project = await seedProject(setup.env);
+  if (plan) setup.db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, ?)").run(project.workspaceId, plan);
+  return { ...setup, ...project, aegis };
+}
+
+function setPlan(db: any, workspaceId: string, plan: string) {
+  db.db.prepare("DELETE FROM workspace_plans WHERE workspace_id = ?").run(workspaceId);
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, ?)").run(workspaceId, plan);
+}
+
+function orgHeaders(groups: string[] | null) {
+  return {
+    "x-aegis-org": ORG_ID,
+    ...(groups ? { "x-aegis-groups": encodeURIComponent(JSON.stringify(groups)) } : {}),
+    "x-aegis-email": "grace@acme.test",
+    "x-aegis-email-verified": "true",
+  };
+}
+
+function signedEvent(event: Record<string, unknown>, secret = EVENTS_SECRET, at = Math.floor(Date.now() / 1000)) {
+  const body = JSON.stringify({ id: randomUUID(), organizationId: ORG_ID, externalRef: "acme", occurredAt: new Date().toISOString(), ...event });
+  const signature = `t=${at},v1=${createHmac("sha256", secret).update(`${at}.${body}`).digest("hex")}`;
+  return { body, headers: { "x-aegis-signature": signature, "content-type": "application/json" } };
+}
+
+test("SSO needs Business, and only owners and admins manage it", async () => {
+  const { env, owner, workspaceId, db } = await workspace("team");
+  const overview = await call(env, "GET", `/api/workspaces/${workspaceId}/sso`, { as: owner });
+  assert.equal(overview.status, 200);
+  assert.equal(overview.json.available, false);
+  assert.match(overview.json.reason, /Business and Enterprise/);
+  assert.equal((await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner })).status, 402);
+
+  db.db.prepare("INSERT INTO aegis_users (id) VALUES ('user_member')").run();
+  db.db.prepare("INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status) VALUES (?, 'user_member', 'member', 'active')").run(workspaceId);
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/sso`, { as: "user_member" })).status, 403);
+});
+
+test("turning SSO on links an Aegis organization with the plan's entitlements", async () => {
+  const { env, owner, workspaceId, aegis, db } = await workspace("business");
+  const enabled = await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  assert.equal(enabled.status, 201);
+  assert.deepEqual(aegis.calls[0], {
+    method: "POST",
+    path: "/organizations",
+    body: { name: "Acme", externalRef: workspaceId, eventsUrl: "https://registry.test/api/aegis/events" },
+  });
+  assert.deepEqual(aegis.calls[1].body, { sso: true, scim: false });
+  const row = db.db.prepare("SELECT aegis_org_id AS org, sso_entitlement AS ent FROM workspaces WHERE id = ?").get(workspaceId) as any;
+  assert.deepEqual({ ...row }, { org: ORG_ID, ent: "sso" });
+
+  const overview = await call(env, "GET", `/api/workspaces/${workspaceId}/sso`, { as: owner });
+  assert.equal(overview.json.linked, true);
+  assert.equal(overview.json.organization.id, ORG_ID);
+
+  // Only known fields go to Aegis, and the audit log never holds the secret.
+  const created = await call(env, "POST", `/api/workspaces/${workspaceId}/sso/connections`, {
+    as: owner,
+    body: { name: "Okta", protocol: "OIDC", oidcIssuer: "https://acme.okta.com", oidcClientId: "c", oidcClientSecret: "top-secret", tenantId: "someone-else" },
+  });
+  assert.equal(created.status, 201);
+  const sent = aegis.calls.find((c) => c.path.endsWith("/connections"))!;
+  assert.equal("tenantId" in sent.body, false);
+  assert.equal(sent.body.oidcClientSecret, "top-secret");
+  const audit = db.db.prepare("SELECT data_json FROM audit_log WHERE action = 'sso.connection.created'").get() as any;
+  assert.ok(audit);
+  assert.doesNotMatch(audit.data_json, /top-secret/);
+
+  // Aegis errors reach the admin as they are.
+  const verify = await call(env, "POST", `/api/workspaces/${workspaceId}/sso/domains/${randomUUID()}/verify`, { as: owner });
+  assert.equal(verify.status, 400);
+  assert.equal(verify.json.error, "Add a TXT record");
+
+  // Business has no SCIM.
+  assert.equal((await call(env, "POST", `/api/workspaces/${workspaceId}/sso/scim-tokens`, { as: owner, body: { name: "Okta" } })).status, 402);
+  // Path parameters must be ids.
+  assert.equal((await call(env, "DELETE", `/api/workspaces/${workspaceId}/sso/connections/..%2F..%2Fentitlements`, { as: owner })).status, 404);
+});
+
+test("Enterprise workspaces can create SCIM tokens", async () => {
+  const { env, owner, workspaceId } = await workspace("enterprise");
+  assert.equal((await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner })).status, 201);
+  const token = await call(env, "POST", `/api/workspaces/${workspaceId}/sso/scim-tokens`, { as: owner, body: { name: "Okta" } });
+  assert.equal(token.status, 201);
+  assert.equal(token.json.token, "scim_secret");
+});
+
+test("IdP groups decide the role of SSO members, and invited members keep theirs", async () => {
+  const { env, owner, workspaceId, db } = await workspace("business");
+  await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  const mapped = await call(env, "PUT", `/api/workspaces/${workspaceId}/sso/group-roles`, {
+    as: owner,
+    body: { mappings: [{ group: "QA Leads", role: "admin" }, { group: "Finance", role: "billing" }] },
+  });
+  assert.equal(mapped.status, 200);
+  assert.equal(mapped.json.mappings.length, 2);
+  assert.equal((await call(env, "PUT", `/api/workspaces/${workspaceId}/sso/group-roles`, {
+    as: owner, body: { mappings: [{ group: "Root", role: "owner" }] },
+  })).status, 422, "groups never grant ownership");
+
+  const role = (id: string) => (db.db.prepare("SELECT role, source FROM workspace_memberships WHERE workspace_id = ? AND aegis_id = ?").get(workspaceId, id) as any);
+
+  // First request from a new SSO member creates their membership.
+  const first = await call(env, "GET", `/api/workspaces/${workspaceId}/members`, { as: "user_grace", headers: orgHeaders(["Finance", "QA Leads"]) });
+  assert.equal(first.status, 200);
+  assert.deepEqual({ ...role("user_grace") }, { role: "admin", source: "sso" });
+
+  // Group changes follow on the next request.
+  await call(env, "GET", "/api/workspaces", { as: "user_grace", headers: orgHeaders(["Finance"]) });
+  assert.equal(role("user_grace").role, "billing");
+  await call(env, "GET", "/api/workspaces", { as: "user_grace", headers: orgHeaders([]) });
+  assert.equal(role("user_grace").role, "member", "no matching group falls back to the default role");
+
+  // With no default role, people outside the mapped groups get no access.
+  assert.equal((await call(env, "PATCH", `/api/workspaces/${workspaceId}/sso`, { as: owner, body: { defaultRole: "none" } })).status, 200);
+  await call(env, "GET", "/api/workspaces", { as: "user_grace", headers: orgHeaders(["Sales"]) });
+  assert.equal(role("user_grace"), undefined);
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/members`, { as: "user_grace", headers: orgHeaders(["Sales"]) })).status, 403);
+
+  // The owner signed up normally; their groups don't change anything.
+  await call(env, "GET", "/api/workspaces", { as: owner, headers: orgHeaders(["Sales"]) });
+  assert.equal(role(owner).role, "owner");
+
+  // Requests after sign-in carry no groups and leave the role alone.
+  await call(env, "GET", "/api/workspaces", { as: "user_ada", headers: orgHeaders(["QA Leads"]) });
+  assert.equal(role("user_ada").role, "admin");
+  await call(env, "GET", "/api/workspaces", { as: "user_ada", headers: orgHeaders(null) });
+  assert.equal(role("user_ada").role, "admin");
+
+  // Someone who isn't in a linked organization is unaffected.
+  const other = { ...orgHeaders(["QA Leads"]), "x-aegis-org": randomUUID() };
+  await call(env, "GET", "/api/workspaces", { as: "user_stranger", headers: other });
+  assert.equal(role("user_stranger"), undefined);
+});
+
+test("Aegis events are verified, applied once, and deprovisioning removes access", async () => {
+  const { env, owner, workspaceId, db } = await workspace("business");
+  await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  await call(env, "GET", "/api/workspaces", { as: "user_grace", headers: orgHeaders([]) });
+  db.db.prepare("INSERT INTO api_keys (id, aegis_id, name, token_hash, scopes_json) VALUES ('key_1', 'user_grace', 'ci', 'hash', '[]')").run();
+
+  const forged = signedEvent({ type: "user.deprovisioned", data: { userId: "user_grace" } }, "wrong-secret");
+  assert.equal((await call(env, "POST", "/api/aegis/events", { body: forged.body, headers: forged.headers })).status, 401);
+  const stale = signedEvent({ type: "user.deprovisioned", data: { userId: "user_grace" } }, EVENTS_SECRET, Math.floor(Date.now() / 1000) - 600);
+  assert.equal((await call(env, "POST", "/api/aegis/events", { body: stale.body, headers: stale.headers })).status, 401);
+  const otherWorkspace = signedEvent({ type: "user.deprovisioned", externalRef: "someone-else", data: { userId: "user_grace" } });
+  assert.equal((await call(env, "POST", "/api/aegis/events", { body: otherWorkspace.body, headers: otherWorkspace.headers })).json.ignored, true);
+
+  const event = signedEvent({ type: "user.deprovisioned", data: { userId: "user_grace", email: "grace@acme.test" } });
+  const handled = await call(env, "POST", "/api/aegis/events", { body: event.body, headers: event.headers });
+  assert.equal(handled.status, 202);
+  assert.equal((db.db.prepare("SELECT COUNT(*) AS n FROM workspace_memberships WHERE aegis_id = 'user_grace'").get() as any).n, 0);
+  assert.ok((db.db.prepare("SELECT revoked_at FROM api_keys WHERE id = 'key_1'").get() as any).revoked_at);
+  const again = await call(env, "POST", "/api/aegis/events", { body: event.body, headers: event.headers });
+  assert.equal(again.json.duplicate, true);
+
+  // A leftover dashboard session can't bring them back.
+  const blocked = await call(env, "GET", "/api/workspaces", { as: "user_grace", headers: orgHeaders(null) });
+  assert.equal(blocked.status, 401);
+  assert.equal(blocked.json.code, "account_deprovisioned");
+  const audit = db.db.prepare("SELECT actor_type FROM audit_log WHERE action = 'sso.member.deprovisioned'").get() as any;
+  assert.equal(audit.actor_type, "scim");
+
+  // Reactivation lets them in again at their next sign-in.
+  const back = signedEvent({ type: "user.reactivated", data: { userId: "user_grace" } });
+  await call(env, "POST", "/api/aegis/events", { body: back.body, headers: back.headers });
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/members`, { as: "user_grace", headers: orgHeaders([]) })).status, 200);
+
+  // Group changes from SCIM apply without a sign-in.
+  await call(env, "PUT", `/api/workspaces/${workspaceId}/sso/group-roles`, { as: owner, body: { mappings: [{ group: "Admins", role: "admin" }] } });
+  const groups = signedEvent({ type: "user.groups_changed", data: { userId: "user_grace", groups: ["Admins"] } });
+  await call(env, "POST", "/api/aegis/events", { body: groups.body, headers: groups.headers });
+  assert.equal((db.db.prepare("SELECT role FROM workspace_memberships WHERE aegis_id = 'user_grace'").get() as any).role, "admin");
+});
+
+test("losing SSO starts a 14-day notice before Aegis turns it off", async () => {
+  const { env, owner, workspaceId, db, aegis, email } = await workspace("business");
+  await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  db.db.prepare("UPDATE aegis_users SET email = 'owner@acme.test' WHERE id = ?").run(owner);
+  const now = new Date("2026-10-01T00:00:00Z");
+
+  setPlan(db, workspaceId, "team");
+  await syncSsoEntitlements(env, workspaceId, now);
+  const row = () => db.db.prepare("SELECT sso_entitlement AS ent, sso_grace_until AS grace FROM workspaces WHERE id = ?").get(workspaceId) as any;
+  assert.equal(row().ent, "sso");
+  assert.equal(row().grace, new Date(now.getTime() + SSO_GRACE_DAYS * 86_400_000).toISOString());
+  assert.deepEqual(aegis.org.entitlements, { sso: true, scim: false }, "still on during the notice");
+  await drainOutbox(env, now);
+  assert.equal(email.sent.length, 1);
+  assert.match(email.sent[0].subject, /Single sign-on for Acme ends on 2026-10-15/);
+
+  // A daily re-sync during the notice changes nothing and sends no second email.
+  await syncSsoEntitlements(env, workspaceId, new Date("2026-10-05T00:00:00Z"));
+  assert.equal(aegis.org.entitlements.sso, true);
+  await drainOutbox(env, new Date("2026-10-05T00:00:00Z"));
+  assert.equal(email.sent.length, 1);
+
+  await syncSsoEntitlements(env, workspaceId, new Date("2026-10-16T00:00:00Z"));
+  assert.deepEqual(aegis.org.entitlements, { sso: false, scim: false });
+  assert.deepEqual({ ...row() }, { ent: "off", grace: null });
+
+  // Upgrading again turns it straight back on.
+  setPlan(db, workspaceId, "business");
+  await syncSsoEntitlements(env, workspaceId, new Date("2026-10-20T00:00:00Z"));
+  assert.deepEqual(aegis.org.entitlements, { sso: true, scim: false });
+  assert.deepEqual({ ...row() }, { ent: "sso", grace: null });
+});
+
+test("moving from Enterprise to Business keeps SCIM through the notice", async () => {
+  const { env, owner, workspaceId, db, aegis } = await workspace("enterprise");
+  await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  assert.deepEqual(aegis.org.entitlements, { sso: true, scim: true });
+  setPlan(db, workspaceId, "business");
+  const now = new Date("2026-10-01T00:00:00Z");
+  await syncSsoEntitlements(env, workspaceId, now);
+  assert.deepEqual(aegis.org.entitlements, { sso: true, scim: true });
+  await syncSsoEntitlements(env, workspaceId, new Date("2026-10-16T00:00:00Z"));
+  assert.deepEqual(aegis.org.entitlements, { sso: true, scim: false });
+});
+
+test("a plan change queues an entitlement sync for linked workspaces", async () => {
+  const { env, owner, workspaceId, aegis } = await workspace("business");
+  const { planChangedHooks } = await import("../hooks.js");
+  for (const hook of planChangedHooks) await hook(env, { workspaceId, from: "business", to: "team" });
+  assert.equal(aegis.calls.length, 0, "not linked yet: nothing to sync");
+  await call(env, "POST", `/api/workspaces/${workspaceId}/sso/enable`, { as: owner });
+  const before = aegis.calls.length;
+  for (const hook of planChangedHooks) await hook(env, { workspaceId, from: "business", to: "team" });
+  await drainOutbox(env, new Date());
+  assert.ok(aegis.calls.slice(before).some((c) => c.path.endsWith("/entitlements")));
+});
+
+test("without a separate org client, the Bugmole client is used", async () => {
+  const aegis = fakeAegis();
+  resetAegisTokenCache();
+  const tokenAuth: string[] = [];
+  const setup = createTestEnv({
+    FEATURE_SSO: "on",
+    AEGIS_ISSUER: "https://id.test",
+    AEGIS_EVENTS_SECRET: EVENTS_SECRET,
+    REGISTRY_PUBLIC_URL: "https://registry.test",
+    AEGIS_FETCH: (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (new URL(String(input)).pathname === "/token") {
+        tokenAuth.push(new Headers(init?.headers).get("authorization") ?? "");
+        return Response.json({ access_token: "aegis-token", expires_in: 300 });
+      }
+      return aegis.doFetch(input, init);
+    }) as typeof fetch,
+  } as Partial<Env>);
+  const project = await seedProject(setup.env);
+  setup.db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, ?)").run(project.workspaceId, "business");
+  const enabled = await call(setup.env, "POST", `/api/workspaces/${project.workspaceId}/sso/enable`, { as: project.owner });
+  assert.equal(enabled.status, 201);
+  assert.deepEqual(tokenAuth, [`Basic ${btoa(`valkyrie-qa-platform:${setup.env.AEGIS_CLIENT_SECRET}`)}`]);
+});
+
+test("role picking prefers the most privileged match", () => {
+  const mappings = [{ group: "a", role: "member" }, { group: "b", role: "admin" }, { group: "c", role: "billing" }];
+  assert.equal(pickRole(mappings, ["c", "a", "b"], "none"), "admin");
+  assert.equal(pickRole(mappings, ["c"], "member"), "billing");
+  assert.equal(pickRole(mappings, ["z"], "member"), "member");
+  assert.equal(pickRole(mappings, ["z"], "none"), null);
+  assert.equal(pickRole([{ group: "a", role: "owner" }], ["a"], "none"), null);
+});
+
+test("event signatures must match and be recent", async () => {
+  const body = '{"a":1}';
+  const at = 1_800_000_000;
+  const good = `t=${at},v1=${createHmac("sha256", EVENTS_SECRET).update(`${at}.${body}`).digest("hex")}`;
+  assert.equal(await verifyAegisEvent(EVENTS_SECRET, good, body, at * 1000), true);
+  assert.equal(await verifyAegisEvent(EVENTS_SECRET, good, '{"a":2}', at * 1000), false);
+  assert.equal(await verifyAegisEvent(EVENTS_SECRET, good, body, (at + 301) * 1000), false);
+  assert.equal(await verifyAegisEvent(EVENTS_SECRET, null, body, at * 1000), false);
+});

package/src/registry-worker/testing/d1-shim.ts

@@ -0,0 +1,180 @@
+// In-memory stand-ins for the registry's Cloudflare bindings, so route tests
+// run under `tsx --test` against the real migrations instead of mocks of SQL.
+import fs from "node:fs";
+import path from "node:path";
+import { DatabaseSync, type SQLInputValue } from "node:sqlite";
+
+const migrationsDir = path.resolve(import.meta.dirname, "../../registry/migrations");
+
+type Row = Record<string, unknown>;
+
+function bindable(value: unknown): SQLInputValue {
+  // D1 refuses undefined; mirror that so tests catch the same bug production would.
+  if (value === undefined) throw new Error("D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'");
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  return value as SQLInputValue;
+}
+
+class ShimStatement {
+  constructor(
+    private readonly db: DatabaseSync,
+    readonly sql: string,
+    private readonly params: SQLInputValue[] = [],
+  ) {}
+
+  bind(...values: unknown[]): ShimStatement {
+    return new ShimStatement(this.db, this.sql, values.map(bindable));
+  }
+
+  private statement() {
+    return this.db.prepare(this.sql);
+  }
+
+  async first<T = Row>(column?: string): Promise<T | null> {
+    const row = this.statement().get(...this.params) as Row | undefined;
+    if (!row) return null;
+    return (column ? (row[column] as T) : ({ ...row } as T)) ?? null;
+  }
+
+  async all<T = Row>(): Promise<{ results: T[]; success: true; meta: { changes: number } }> {
+    const rows = this.statement().all(...this.params) as Row[];
+    return { results: rows.map((row) => ({ ...row }) as T), success: true, meta: { changes: 0 } };
+  }
+
+  async run<T = Row>(): Promise<{ results: T[]; success: true; meta: { changes: number; last_row_id: number } }> {
+    return this.runSync<T>();
+  }
+
+  runSync<T = Row>() {
+    const statement = this.statement();
+    if (statement.columns().length > 0) {
+      const rows = statement.all(...this.params) as Row[];
+      const changes = Number((this.db.prepare("SELECT changes() AS c").get() as { c: number }).c);
+      return { results: rows as T[], success: true as const, meta: { changes, last_row_id: 0 } };
+    }
+    const info = statement.run(...this.params);
+    return {
+      results: [] as T[],
+      success: true as const,
+      meta: { changes: Number(info.changes), last_row_id: Number(info.lastInsertRowid) },
+    };
+  }
+
+  async raw<T = unknown[]>(): Promise<T[]> {
+    const statement = this.statement();
+    statement.setReturnArrays(true);
+    return statement.all(...this.params) as T[];
+  }
+}
+
+export class D1Shim {
+  readonly db = new DatabaseSync(":memory:");
+
+  constructor({ migrate = true }: { migrate?: boolean } = {}) {
+    this.db.exec("PRAGMA foreign_keys = ON");
+    if (migrate) this.migrate();
+  }
+
+  migrate(): void {
+    const files = fs.readdirSync(migrationsDir).filter((name) => name.endsWith(".sql")).sort();
+    for (const file of files) this.db.exec(fs.readFileSync(path.join(migrationsDir, file), "utf8"));
+  }
+
+  prepare(sql: string): ShimStatement {
+    return new ShimStatement(this.db, sql);
+  }
+
+  async batch(statements: ShimStatement[]) {
+    // D1 runs a batch as one transaction: all statements apply or none do.
+    this.db.exec("BEGIN");
+    try {
+      const results = statements.map((statement) => statement.runSync());
+      this.db.exec("COMMIT");
+      return results;
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  async exec(sql: string) {
+    this.db.exec(sql);
+    return { count: 1, duration: 0 };
+  }
+}
+
+type StoredObject = { body: Uint8Array; contentType?: string; uploaded: Date };
+
+export class R2Shim {
+  readonly objects = new Map<string, StoredObject>();
+
+  async put(key: string, value: string | ArrayBuffer | Uint8Array | ReadableStream | null, options?: { httpMetadata?: { contentType?: string } }) {
+    const body = typeof value === "string"
+      ? new TextEncoder().encode(value)
+      : value instanceof ReadableStream || value === null
+        ? new Uint8Array(await new Response(value).arrayBuffer())
+        : new Uint8Array(value as ArrayBuffer);
+    this.objects.set(key, { body, contentType: options?.httpMetadata?.contentType, uploaded: new Date() });
+    return { key, size: body.byteLength };
+  }
+
+  async get(key: string) {
+    const object = this.objects.get(key);
+    if (!object) return null;
+    return {
+      key,
+      size: object.body.byteLength,
+      uploaded: object.uploaded,
+      httpMetadata: { contentType: object.contentType },
+      body: new Blob([object.body]).stream(),
+      arrayBuffer: async () => object.body.slice().buffer,
+      text: async () => new TextDecoder().decode(object.body),
+      writeHttpMetadata(headers: Headers) {
+        if (object.contentType) headers.set("content-type", object.contentType);
+      },
+    };
+  }
+
+  async head(key: string) {
+    const object = this.objects.get(key);
+    return object ? { key, size: object.body.byteLength, uploaded: object.uploaded } : null;
+  }
+
+  async delete(keys: string | string[]) {
+    for (const key of Array.isArray(keys) ? keys : [keys]) this.objects.delete(key);
+  }
+
+  async list(options: { prefix?: string; cursor?: string; limit?: number } = {}) {
+    const limit = options.limit ?? 1000;
+    const all = [...this.objects.keys()].filter((key) => key.startsWith(options.prefix ?? "")).sort();
+    const start = options.cursor ? Number(options.cursor) : 0;
+    const page = all.slice(start, start + limit);
+    const truncated = start + limit < all.length;
+    return {
+      objects: page.map((key) => ({ key, size: this.objects.get(key)!.body.byteLength, uploaded: this.objects.get(key)!.uploaded })),
+      truncated,
+      cursor: truncated ? String(start + limit) : undefined,
+      delimitedPrefixes: [],
+    };
+  }
+}
+
+/** Records what the registry broadcasts over the live-updates Durable Object. */
+export class CoordinatorShim {
+  readonly broadcasts: Array<{ name: string; event: unknown }> = [];
+
+  idFromName(name: string) {
+    return { name, toString: () => name };
+  }
+
+  get(id: { name: string }) {
+    return {
+      fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
+        const request = input instanceof Request ? input : new Request(input, init);
+        if (request.method === "POST") this.broadcasts.push({ name: id.name, event: JSON.parse(await request.text()) });
+        return new Response("ok");
+      },
+    };
+  }
+}

package/src/registry-worker/testing/harness.ts

@@ -0,0 +1,137 @@
+// Drives the real registry Worker in-process: requests go through its router,
+// storage is the in-memory D1/R2 shims with every migration applied.
+import worker from "../index.js";
+import type { Env } from "../core.js";
+import { CoordinatorShim, D1Shim, R2Shim } from "./d1-shim.js";
+import type { EmailMessage, EmailSender } from "../email/sender.js";
+
+export const TEST_SERVICE_SECRET = "test-service-secret";
+
+export class RecordingEmailSender implements EmailSender {
+  readonly sent: EmailMessage[] = [];
+  async send(message: EmailMessage): Promise<void> {
+    this.sent.push(message);
+  }
+}
+
+export type TestEnv = Env & {
+  DB: D1Database;
+  ARTIFACTS: R2Bucket;
+  RUNS_COORDINATOR: DurableObjectNamespace;
+};
+
+export function createTestEnv(overrides: Partial<Env> = {}) {
+  const db = new D1Shim();
+  const artifacts = new R2Shim();
+  const coordinator = new CoordinatorShim();
+  const email = new RecordingEmailSender();
+  const env = {
+    DB: db as unknown as D1Database,
+    ARTIFACTS: artifacts as unknown as R2Bucket,
+    RUNS_COORDINATOR: coordinator as unknown as DurableObjectNamespace,
+    AEGIS_CLIENT_ID: "valkyrie-qa-platform",
+    AEGIS_CLIENT_SECRET: TEST_SERVICE_SECRET,
+    EMAIL_SENDER: email,
+    ...overrides,
+  } as TestEnv;
+  return { env, db, artifacts, coordinator, email };
+}
+
+export function createContext() {
+  const pending: Promise<unknown>[] = [];
+  const ctx = {
+    waitUntil(promise: Promise<unknown>) {
+      pending.push(promise);
+    },
+    passThroughOnException() {},
+    props: {},
+  } as unknown as ExecutionContext;
+  return {
+    ctx,
+    async flush() {
+      while (pending.length) await Promise.all(pending.splice(0));
+    },
+  };
+}
+
+export type CallOptions = {
+  /** Acts as this user through the dashboard's service credential. */
+  as?: string;
+  /** Uses a bearer token (API key or runner token) instead. */
+  token?: string;
+  body?: unknown;
+  headers?: Record<string, string>;
+};
+
+/** Calls the registry and returns status plus parsed JSON. */
+export async function call(env: Env, method: string, path: string, options: CallOptions = {}) {
+  const headers = new Headers(options.headers);
+  if (options.token) headers.set("authorization", `Bearer ${options.token}`);
+  else if (options.as) {
+    headers.set("x-aegis-id", options.as);
+    headers.set("x-aegis-secret", TEST_SERVICE_SECRET);
+  }
+  let body: string | undefined;
+  if (options.body !== undefined) {
+    body = typeof options.body === "string" ? options.body : JSON.stringify(options.body);
+    if (!headers.has("content-type")) headers.set("content-type", "application/json");
+  }
+  const { ctx, flush } = createContext();
+  const response = await worker.fetch(new Request(`https://registry.test${path}`, { method, headers, body }), env, ctx);
+  await flush();
+  const text = await response.text();
+  let json: any = null;
+  try {
+    json = text ? JSON.parse(text) : null;
+  } catch {
+    json = text;
+  }
+  return { status: response.status, json, headers: response.headers };
+}
+
+/** Runs one cron tick the way Cloudflare would. */
+export async function runScheduled(env: Env, cron: string, scheduledTime = Date.now()) {
+  const { ctx, flush } = createContext();
+  await worker.scheduled({ cron, scheduledTime, noRetry() {} } as ScheduledController, env, ctx);
+  await flush();
+}
+
+/** A workspace with one project owned by `owner`, created through the real routes. */
+export async function seedProject(env: Env, {
+  owner = "user_owner",
+  workspaceId = "acme",
+  projectId = "shop",
+  storageProvider = "r2",
+}: { owner?: string; workspaceId?: string; projectId?: string; storageProvider?: string } = {}) {
+  const workspace = await call(env, "POST", "/api/workspaces", { as: owner, body: { id: workspaceId, name: "Acme" } });
+  if (workspace.status !== 201) throw new Error(`workspace seed failed: ${workspace.status} ${JSON.stringify(workspace.json)}`);
+  const project = await call(env, "POST", "/api/projects/register", {
+    as: owner,
+    body: { id: projectId, name: "Shop", workspaceId, environment: "staging", storageProvider },
+  });
+  if (project.status !== 201) throw new Error(`project seed failed: ${project.status} ${JSON.stringify(project.json)}`);
+  return { owner, workspaceId, projectId };
+}
+
+/** Publishes a plan draft so runs can be created against it. */
+export async function seedPlan(env: Env, projectId: string, owner: string, planId = "checkout") {
+  const result = await call(env, "POST", `/api/projects/${projectId}/plans`, {
+    as: owner,
+    body: { planId, journeyId: "checkout", objectKey: `projects/${projectId}/plans/${planId}.flow.yaml` },
+  });
+  if (result.status >= 300) throw new Error(`plan seed failed: ${result.status} ${JSON.stringify(result.json)}`);
+  return planId;
+}
+
+/**
+ * Marks a domain verified for a workspace directly, skipping the DNS lookup —
+ * for tests whose cloud run or discovery task targets that domain and isn't
+ * itself testing domain verification (see domains/domains.test.ts for that).
+ */
+export function seedVerifiedDomain(db: D1Shim, workspaceId: string, domain: string): void {
+  db.db.prepare(`
+    INSERT INTO workspace_domains (id, workspace_id, domain, verification_token, status, verified_at)
+    VALUES (?, ?, ?, 'seeded-for-tests', 'verified', CURRENT_TIMESTAMP)
+    ON CONFLICT(workspace_id, domain) DO UPDATE SET status = 'verified', verified_at = CURRENT_TIMESTAMP
+  `).run(`dom_${workspaceId}_${domain}`.replace(/[^a-z0-9_]/gi, "_"), workspaceId, domain);
+}