@celilo/e2e 0.20.1 → 0.20.2

package/registry-server/src/server.test.ts

@@ -1,991 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { ADMIN_SCOPE, TokenAuth } from './auth';
-import { IntrospectionVerifier } from './introspection';
-import { createRateLimiter } from './rate-limit';
-import { startServer } from './server';
-
-let dataDir: string;
-let server: ReturnType<typeof startServer> | null = null;
-let baseUrl: string;
-
-beforeEach(() => {
-  dataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-server-test-'));
-  server = startServer({
-    dataDir,
-    port: 0, // let Bun pick an ephemeral port
-    pathPrefix: '',
-    publicUrl: 'https://example.test',
-    auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
-  });
-  baseUrl = `http://localhost:${server.port}`;
-});
-
-afterEach(() => {
-  server?.stop();
-  server = null;
-  rmSync(dataDir, { recursive: true, force: true });
-});
-
-// ── landing-page polite-301 ──────────────────────────────────────────────────
-// See apps/celilo/designs/REGISTRY_BROWSE_UI.md (decision D2). The bare
-// registry root redirects to /modules/ on the same origin (the celilo.computer
-// site), with a minimal HTML body for clients that don't follow redirects.
-
-describe('GET / (landing page)', () => {
-  test('returns 301 with Location → /modules/ and HTML body', async () => {
-    const res = await fetch(`${baseUrl}/`, { redirect: 'manual' });
-    expect(res.status).toBe(301);
-    expect(res.headers.get('location')).toBe('https://example.test/modules/');
-    expect(res.headers.get('content-type')).toMatch(/text\/html/);
-    const body = await res.text();
-    expect(body).toContain('Celilo Module Registry');
-    expect(body).toContain('https://example.test/modules/');
-    expect(body).toContain('curl -fsSL https://example.test/install.sh | bash');
-  });
-
-  test('/index.html behaves the same as /', async () => {
-    const res = await fetch(`${baseUrl}/index.html`, { redirect: 'manual' });
-    expect(res.status).toBe(301);
-    expect(res.headers.get('location')).toBe('https://example.test/modules/');
-  });
-});
-
-// ── sparse index config ──────────────────────────────────────────────────────
-
-describe('GET /index/config.json', () => {
-  test('returns dl + api pointing at publicUrl', async () => {
-    const res = await fetch(`${baseUrl}/index/config.json`);
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { dl: string; api: string };
-    expect(body.dl).toBe('https://example.test/api/v1/modules/{name}/{version}/download');
-    expect(body.api).toBe('https://example.test');
-  });
-});
-
-// ── sparse index path routing ─────────────────────────────────────────────────
-
-describe('GET /index/{path}/{name}', () => {
-  test('404 for unknown module', async () => {
-    const res = await fetch(`${baseUrl}/index/ho/me/homebridge`);
-    expect(res.status).toBe(404);
-  });
-
-  test('returns NDJSON for a published module', async () => {
-    // Publish first so we have something in the index
-    const publishRes = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(publishRes.status).toBe(200);
-
-    const res = await fetch(`${baseUrl}/index/ho/me/homebridge`);
-    expect(res.status).toBe(200);
-    expect(res.headers.get('content-type')).toContain('text/plain');
-    const body = await res.text();
-    const lines = body.trim().split('\n');
-    expect(lines).toHaveLength(1);
-    const entry = JSON.parse(lines[0]) as { name: string; vers: string; cksum: string };
-    expect(entry.name).toBe('homebridge');
-    expect(entry.vers).toBe('1.0.0+1');
-    expect(entry.cksum).toMatch(/^sha256:[0-9a-f]{64}$/);
-  });
-});
-
-// ── publish ──────────────────────────────────────────────────────────────────
-
-describe('PUT /api/v1/modules/new', () => {
-  test('401 without token', async () => {
-    const res = await publish('homebridge', '1.0.0+1', '');
-    expect(res.status).toBe(401);
-  });
-
-  test('401 with wrong token', async () => {
-    const res = await publish('homebridge', '1.0.0+1', 'wrong');
-    expect(res.status).toBe(401);
-  });
-
-  test('200 with valid token, stores + indexes', async () => {
-    const res = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(res.status).toBe(200);
-
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
-      name: string;
-      versions: { num: string }[];
-    };
-    expect(meta.name).toBe('homebridge');
-    expect(meta.versions).toHaveLength(1);
-    expect(meta.versions[0].num).toBe('1.0.0+1');
-  });
-
-  test('409 on duplicate version', async () => {
-    const first = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(first.status).toBe(200);
-    const second = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(second.status).toBe(409);
-  });
-
-  test('400 on invalid module name (uppercase / underscore)', async () => {
-    const res1 = await publish('MyModule', '1.0.0+1', 'valid-token');
-    expect(res1.status).toBe(400);
-    const res2 = await publish('my_module', '1.0.0+1', 'valid-token');
-    expect(res2.status).toBe(400);
-  });
-
-  test('400 on path-traversal name', async () => {
-    const res = await publish('../etc', '1.0.0+1', 'valid-token');
-    expect(res.status).toBe(400);
-  });
-
-  test('400 on invalid version (freeform string)', async () => {
-    const res = await publish('homebridge', '1.0.0', 'valid-token');
-    expect(res.status).toBe(400);
-  });
-
-  test('400 on path-traversal version', async () => {
-    // Blocks the #1 CRITICAL attack: token-holder with malicious vers trying
-    // to escape the data dir via fs.writeFileSync path normalization.
-    const res = await publish('homebridge', '../../../etc/cron.d/evil', 'valid-token');
-    expect(res.status).toBe(400);
-  });
-
-  test('413 when metadata length exceeds the cap', async () => {
-    // Craft a body that declares a huge metadata length (120KB > 64KB cap).
-    const name = 'homebridge';
-    const vers = '1.0.0+1';
-    const fattenedMeta = JSON.stringify({ name, vers, pad: 'x'.repeat(120_000) });
-    const meta = Buffer.from(fattenedMeta, 'utf-8');
-    const file = Buffer.from('fake netapp bytes');
-    const metaLen = Buffer.alloc(4);
-    metaLen.writeUInt32LE(meta.length, 0);
-    const fileLen = Buffer.alloc(4);
-    fileLen.writeUInt32LE(file.length, 0);
-    const body = Buffer.concat([metaLen, meta, fileLen, file]);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules/new`, {
-      method: 'PUT',
-      headers: { Authorization: 'valid-token' },
-      body,
-    });
-    expect(res.status).toBe(413);
-  });
-
-  // Not exercising the Content-Length header check in a unit test — Bun's
-  // fetch computes its own Content-Length and ignores the caller's override,
-  // so we can't realistically lie about body size from the client side here.
-  // The header-based early rejection still helps against clients that honor
-  // user-supplied headers (curl, Python requests, etc.) and is covered by
-  // manual verification / reading the code.
-});
-
-// ── search ───────────────────────────────────────────────────────────────────
-
-describe('GET /api/v1/modules (search)', () => {
-  test('returns published modules with their captured description', async () => {
-    // Phase 2 step 0 — description from manifest is round-tripped through
-    // the publish payload into storage, then surfaced in the search response.
-    const pub = await publish(
-      'homebridge',
-      '1.0.0+1',
-      'valid-token',
-      'Apple HomeKit bridge for non-HomeKit devices',
-    );
-    expect(pub.status).toBe(200);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules`);
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as {
-      modules: Array<{ name: string; max_version: string; description: string }>;
-      total: number;
-    };
-    const found = body.modules.find((m) => m.name === 'homebridge');
-    expect(found).toBeTruthy();
-    expect(found?.max_version).toBe('1.0.0+1');
-    expect(found?.description).toBe('Apple HomeKit bridge for non-HomeKit devices');
-  });
-
-  test('returns empty description for publishes that omit it', async () => {
-    // Backwards-compat — pre-Phase-2 publishes don't include description
-    // and must still round-trip cleanly with description: ''.
-    const pub = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(pub.status).toBe(200);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules`);
-    const body = (await res.json()) as {
-      modules: Array<{ name: string; description: string }>;
-    };
-    const found = body.modules.find((m) => m.name === 'homebridge');
-    expect(found?.description).toBe('');
-  });
-
-  test('icon survives publish, the sparse index and a search read', async () => {
-    // openspec/changes/module-icons D4 — the icon rides the same path
-    // `description` does: publish metadata → index entry → browse endpoints.
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
-      200,
-    );
-
-    const index = await fetch(`${baseUrl}/index/ho/me/homebridge`);
-    expect(index.status).toBe(200);
-    const line = JSON.parse((await index.text()).trim()) as { icon?: string };
-    expect(line.icon).toBe('\u22c8');
-
-    const res = await fetch(`${baseUrl}/api/v1/modules`);
-    const body = (await res.json()) as { modules: Array<{ name: string; icon?: string }> };
-    expect(body.modules.find((m) => m.name === 'homebridge')?.icon).toBe('\u22c8');
-
-    const detail = await fetch(`${baseUrl}/api/v1/modules/homebridge`);
-    expect(((await detail.json()) as { icon?: string }).icon).toBe('\u22c8');
-  });
-
-  test('an entry published without an icon reads back as undefined, not a throw', async () => {
-    // The old-entry case D4 depends on: index lines written before the field
-    // existed carry no `icon`, and a consumer falls back rather than failing.
-    //
-    // This test passes with or without the icon feature, so it is NOT a gate on
-    // it — verified by running it against the pre-#1147 tree. It is here to
-    // catch a future change that makes a missing `icon` throw or coerce to '',
-    // which is what D4's fallback chain would break on. Do not count it as
-    // coverage of the capture path; that is the test above.
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token')).status).toBe(200);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules`);
-    const body = (await res.json()) as { modules: Array<{ name: string; icon?: string }> };
-    const found = body.modules.find((m) => m.name === 'homebridge');
-    expect(found).toBeTruthy();
-    expect(found?.icon).toBeUndefined();
-  });
-
-  test('a multi-character icon is dropped while a valid one beside it is kept', async () => {
-    // Publish metadata is arbitrary client JSON. The CLI refines the value at
-    // manifest-parse time; the server keeps the index from carrying a string
-    // that would blow out a fixed-width slot on the browse page.
-    //
-    // Both halves are asserted deliberately. Checking only that the bad value
-    // is absent would pass just as well if the capture path were deleted
-    // outright — the guard and the capture would cancel out and the test would
-    // stay green having lost the feature. The kept glyph is what stops that.
-    expect(
-      (await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', 'not-a-glyph')).status,
-    ).toBe(200);
-    expect((await publish('caddy', '1.0.0+1', 'valid-token', 'Proxy', '\u25cd')).status).toBe(200);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules`);
-    const body = (await res.json()) as { modules: Array<{ name: string; icon?: string }> };
-    expect(body.modules.find((m) => m.name === 'homebridge')?.icon).toBeUndefined();
-    expect(body.modules.find((m) => m.name === 'caddy')?.icon).toBe('\u25cd');
-  });
-
-  test('409 when a second module declares a glyph the first holds, naming the holder', async () => {
-    // module-icons D8 — the registry refuses a duplicate glyph. The error must
-    // name the holding module: that is everything the author needs to pick a
-    // distinct glyph, and it is what the design decided a refusal carries
-    // instead of a server-suggested replacement.
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
-      200,
-    );
-    const res = await publish('caddy', '1.0.0+1', 'valid-token', 'Proxy', '\u22c8');
-    expect(res.status).toBe(409);
-    const body = (await res.json()) as { errors: Array<{ detail: string }> };
-    expect(body.errors[0]?.detail).toContain('homebridge');
-    // The refusal fired before any state was written: no payload, no index line.
-    expect((await fetch(`${baseUrl}/index/ca/dd/caddy`)).status).toBe(404);
-  });
-
-  test('a module republishing its own glyph across versions is allowed', async () => {
-    // The holder is excluded from its own check — keeping your icon across
-    // versions is the normal case, not a collision.
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
-      200,
-    );
-    expect((await publish('homebridge', '1.0.1+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
-      200,
-    );
-  });
-
-  test('a module whose latest version drops the icon frees the glyph', async () => {
-    // A module holds the glyph its LATEST non-yanked entry declares — the same
-    // selection the browse endpoints read. Once its newest version declares
-    // none, the glyph is free for the next publisher.
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
-      200,
-    );
-    expect((await publish('homebridge', '1.0.1+1', 'valid-token', 'Bridge')).status).toBe(200);
-    expect((await publish('caddy', '1.0.0+1', 'valid-token', 'Proxy', '\u22c8')).status).toBe(200);
-  });
-
-  test('total_downloads reflects actual download count, sort=downloads orders by it', async () => {
-    // Publish two modules, hit one's download endpoint several times.
-    // The search response should show those counts and sort=downloads
-    // should put the more-downloaded one first.
-    expect((await publish('alpha', '1.0.0+1', 'valid-token')).status).toBe(200);
-    expect((await publish('bravo', '1.0.0+1', 'valid-token')).status).toBe(200);
-
-    for (let i = 0; i < 3; i++) {
-      const r = await fetch(`${baseUrl}/api/v1/modules/alpha/1.0.0+1/download`);
-      expect(r.status).toBe(200);
-    }
-    const r = await fetch(`${baseUrl}/api/v1/modules/bravo/1.0.0+1/download`);
-    expect(r.status).toBe(200);
-
-    // Default sort: alphabetical; counts reflect downloads.
-    const def = (await fetch(`${baseUrl}/api/v1/modules`).then((r) => r.json())) as {
-      modules: Array<{ name: string; total_downloads: number }>;
-    };
-    const alpha = def.modules.find((m) => m.name === 'alpha');
-    const bravo = def.modules.find((m) => m.name === 'bravo');
-    expect(alpha?.total_downloads).toBe(3);
-    expect(bravo?.total_downloads).toBe(1);
-
-    // sort=downloads: alpha (3) before bravo (1).
-    const byDl = (await fetch(`${baseUrl}/api/v1/modules?sort=downloads`).then((r) =>
-      r.json(),
-    )) as { modules: Array<{ name: string }> };
-    const idxAlpha = byDl.modules.findIndex((m) => m.name === 'alpha');
-    const idxBravo = byDl.modules.findIndex((m) => m.name === 'bravo');
-    expect(idxAlpha).toBeGreaterThanOrEqual(0);
-    expect(idxBravo).toBeGreaterThanOrEqual(0);
-    expect(idxAlpha).toBeLessThan(idxBravo);
-  });
-});
-
-// ── per-module metadata download count ───────────────────────────────────────
-
-describe('GET /api/v1/modules/{name} (metadata) — total_downloads', () => {
-  test('returns the same count as the search endpoint', async () => {
-    expect((await publish('homebridge', '1.0.0+1', 'valid-token')).status).toBe(200);
-    await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
-    await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
-
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
-      name: string;
-      total_downloads: number;
-    };
-    expect(meta.total_downloads).toBe(2);
-  });
-});
-
-// ── path-traversal on GET endpoints ──────────────────────────────────────────
-
-describe('GET endpoints reject traversal attempts', () => {
-  // These verify the HIGH-severity fix: `name` / `version` from URL segments
-  // can't reach the storage layer if they aren't valid module identifiers.
-
-  test.each([
-    '/index/..%2F..%2Fetc',
-    '/index/ho/me/..%2Fpasswd',
-    '/api/v1/modules/..%2F..%2Fetc',
-    '/api/v1/modules/..%2F..%2Fetc/1.0.0+1/download',
-    '/api/v1/modules/homebridge/..%2F..%2Fetc/download',
-    '/api/v1/modules/homebridge/1.0.0+1%2F..%2F..%2Fetc/download',
-  ])('404 for %s', async (path) => {
-    const res = await fetch(`${baseUrl}${path}`);
-    expect(res.status).toBe(404);
-  });
-
-  test('DELETE yank with traversal is rejected (401 before 404 is fine)', async () => {
-    const res = await fetch(`${baseUrl}/api/v1/modules/..%2Fetc/1.0.0+1/yank`, {
-      method: 'DELETE',
-      headers: { Authorization: 'valid-token' },
-    });
-    expect([401, 404]).toContain(res.status);
-    expect(res.status).not.toBe(200);
-  });
-});
-
-// ── download ─────────────────────────────────────────────────────────────────
-
-describe('GET /api/v1/modules/{name}/{version}/download', () => {
-  test('returns stored bytes after publish', async () => {
-    await publish('homebridge', '1.0.0+1', 'valid-token');
-    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
-    expect(res.status).toBe(200);
-    expect(res.headers.get('content-type')).toBe('application/octet-stream');
-    const body = await res.arrayBuffer();
-    expect(Buffer.from(body).toString()).toBe('fake netapp bytes');
-  });
-
-  test('404 for unknown version', async () => {
-    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/9.9.9+1/download`);
-    expect(res.status).toBe(404);
-  });
-});
-
-// ── yank / unyank ────────────────────────────────────────────────────────────
-
-describe('DELETE /yank, PUT /unyank', () => {
-  test('yank requires auth and flips the yanked flag', async () => {
-    await publish('homebridge', '1.0.0+1', 'valid-token');
-
-    const unauth = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/yank`, {
-      method: 'DELETE',
-    });
-    expect(unauth.status).toBe(401);
-
-    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/yank`, {
-      method: 'DELETE',
-      headers: { Authorization: 'valid-token' },
-    });
-    expect(res.status).toBe(200);
-
-    const indexRes = await fetch(`${baseUrl}/index/ho/me/homebridge`);
-    const entry = JSON.parse((await indexRes.text()).trim()) as { yanked: boolean };
-    expect(entry.yanked).toBe(true);
-  });
-});
-
-// ── rate limiting ────────────────────────────────────────────────────────────
-
-describe('write endpoints are rate limited', () => {
-  test('429 with Retry-After once the per-IP budget is spent', async () => {
-    const tightDataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-rl-'));
-    const tight = startServer({
-      dataDir: tightDataDir,
-      port: 0,
-      pathPrefix: '',
-      publicUrl: 'https://example.test',
-      auth: new TokenAuth([{ token: 'tok', scope: ADMIN_SCOPE }]),
-      rateLimiter: createRateLimiter({ max: 2, windowMs: 60_000 }),
-    });
-    try {
-      const b = `http://localhost:${tight.port}`;
-      // Send 3 unauthenticated publishes — first two return 401 (past the
-      // rate-limit gate), third trips the limiter → 429. Using 401 here is
-      // fine because the rate-limiter runs BEFORE auth, by design.
-      const mkBody = () => {
-        const meta = Buffer.from(JSON.stringify({ name: 'x', vers: '1.0.0+1' }), 'utf-8');
-        const file = Buffer.from('f');
-        const metaLen = Buffer.alloc(4);
-        metaLen.writeUInt32LE(meta.length, 0);
-        const fileLen = Buffer.alloc(4);
-        fileLen.writeUInt32LE(file.length, 0);
-        return Buffer.concat([metaLen, meta, fileLen, file]);
-      };
-      const call = () => fetch(`${b}/api/v1/modules/new`, { method: 'PUT', body: mkBody() });
-
-      const r1 = await call();
-      expect(r1.status).toBe(401);
-      const r2 = await call();
-      expect(r2.status).toBe(401);
-      const r3 = await call();
-      expect(r3.status).toBe(429);
-      expect(r3.headers.get('Retry-After')).not.toBeNull();
-    } finally {
-      tight.stop();
-      rmSync(tightDataDir, { recursive: true, force: true });
-    }
-  });
-});
-
-// ── path prefix ──────────────────────────────────────────────────────────────
-
-describe('path prefix routing', () => {
-  test('requests under /registry are accepted when pathPrefix is /registry', async () => {
-    const prefixed = startServer({
-      dataDir: mkdtempSync(join(tmpdir(), 'celilo-registry-prefix-')),
-      port: 0,
-      pathPrefix: '/registry',
-      publicUrl: 'https://example.test/registry',
-      auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
-    });
-    try {
-      const base = `http://localhost:${prefixed.port}`;
-      const res = await fetch(`${base}/registry/index/config.json`);
-      expect(res.status).toBe(200);
-      const nope = await fetch(`${base}/index/config.json`);
-      expect(nope.status).toBe(404);
-    } finally {
-      prefixed.stop();
-    }
-  });
-});
-
-// ── scoped publish tokens (ISS-0140) ──────────────────────────────────────────
-
-describe('POST /api/v1/modules/tokens/mint + scoped publish', () => {
-  async function mint(repo: string, scope: string, token: string): Promise<Response> {
-    return fetch(`${baseUrl}/api/v1/modules/tokens/mint`, {
-      method: 'POST',
-      headers: token ? { Authorization: token, 'Content-Type': 'application/json' } : {},
-      body: JSON.stringify({ repo, scope }),
-    });
-  }
-
-  test('admin token mints a scoped token; non-admin / no token is 401', async () => {
-    const noTok = await mint('celilo/lunacycle', 'lunacycle', '');
-    expect(noTok.status).toBe(401);
-
-    const ok = await mint('celilo/lunacycle', 'lunacycle', 'valid-token');
-    expect(ok.status).toBe(200);
-    const body = (await ok.json()) as { ok: boolean; token: string; scope: string };
-    expect(body.ok).toBe(true);
-    expect(body.scope).toBe('lunacycle');
-    expect(body.token.length).toBeGreaterThan(10);
-  });
-
-  test('a minted scoped token publishes ONLY its package', async () => {
-    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
-      token: string;
-    };
-
-    // Can publish its own package…
-    const ok = await publish('lunacycle', '1.0.0+1', minted.token);
-    expect(ok.status).toBe(200);
-
-    // …but NOT another module.
-    const denied = await publish('caddy', '1.0.0+1', minted.token);
-    expect(denied.status).toBe(401);
-  });
-
-  test('a scoped token cannot mint (not admin)', async () => {
-    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
-      token: string;
-    };
-    const reMint = await mint('celilo/caddy', 'caddy', minted.token);
-    expect(reMint.status).toBe(401);
-  });
-
-  test('re-minting rotates: the old token stops working, the new one publishes', async () => {
-    const first = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
-      token: string;
-    };
-    const second = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
-      token: string;
-    };
-    expect(second.token).not.toBe(first.token);
-
-    const oldDenied = await publish('lunacycle', '2.0.0+1', first.token);
-    expect(oldDenied.status).toBe(401);
-    const newOk = await publish('lunacycle', '2.0.0+1', second.token);
-    expect(newOk.status).toBe(200);
-  });
-
-  test('revoke disables the token', async () => {
-    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
-      token: string;
-    };
-    const revoke = await fetch(`${baseUrl}/api/v1/modules/tokens/revoke`, {
-      method: 'POST',
-      headers: { Authorization: 'valid-token', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ repo: 'celilo/lunacycle' }),
-    });
-    expect(revoke.status).toBe(200);
-    const denied = await publish('lunacycle', '1.0.0+1', minted.token);
-    expect(denied.status).toBe(401);
-  });
-
-  test('mint rejects an invalid scope (not a valid package name)', async () => {
-    const res = await mint('celilo/lunacycle', 'Bad_Scope', 'valid-token');
-    expect(res.status).toBe(400);
-  });
-});
-
-// ─── helpers ──────────────────────────────────────────────────────────────────
-
-async function publish(
-  name: string,
-  vers: string,
-  token: string,
-  description?: string,
-  icon?: string,
-): Promise<Response> {
-  const meta = Buffer.from(
-    JSON.stringify({
-      name,
-      vers,
-      ...(description ? { description } : {}),
-      ...(icon ? { icon } : {}),
-    }),
-    'utf-8',
-  );
-  const file = Buffer.from('fake netapp bytes');
-  const metaLen = Buffer.alloc(4);
-  metaLen.writeUInt32LE(meta.length, 0);
-  const fileLen = Buffer.alloc(4);
-  fileLen.writeUInt32LE(file.length, 0);
-  const body = Buffer.concat([metaLen, meta, fileLen, file]);
-
-  return fetch(`${baseUrl}/api/v1/modules/new`, {
-    method: 'PUT',
-    headers: token ? { Authorization: token } : {},
-    body,
-  });
-}
-
-// ── idp introspection verify-bridge (ce-s7e) ─────────────────────────────────
-// The real publish path with an idp identity token: the token is unknown to
-// the opaque set, so authorizePackage() verifies it via RFC 7662 introspection
-// against the idp. A fake idp server stands in for authentik; revoking a token
-// there (active:false) denies the next publish.
-
-describe('publish via idp introspection (ce-s7e)', () => {
-  let idp: ReturnType<typeof Bun.serve> | null = null;
-  let idpServer: ReturnType<typeof startServer> | null = null;
-  let idpDataDir: string;
-  let idpBaseUrl: string;
-  // token → introspection claims the fake idp reports for it.
-  const claimsByToken = new Map<string, Record<string, unknown>>();
-
-  beforeEach(() => {
-    claimsByToken.clear();
-    idp = Bun.serve({
-      port: 0,
-      async fetch(req) {
-        const form = new URLSearchParams(await req.text());
-        const token = form.get('token') ?? '';
-        const claims = claimsByToken.get(token) ?? { active: false };
-        return Response.json(claims);
-      },
-    });
-    idpDataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-idp-test-'));
-    idpServer = startServer({
-      dataDir: idpDataDir,
-      port: 0,
-      pathPrefix: '',
-      publicUrl: 'https://example.test',
-      // Opaque admin token still works → backward-compat coverage below.
-      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
-      introspection: new IntrospectionVerifier({
-        endpoint: `http://localhost:${idp.port}/introspect`,
-        clientId: 'celilo-registry',
-        clientSecret: 'sec',
-        adminGroup: 'celilo-admins',
-        publisherGroup: 'celilo-authors',
-      }),
-    });
-    idpBaseUrl = `http://localhost:${idpServer.port}`;
-  });
-
-  afterEach(() => {
-    idpServer?.stop();
-    idpServer = null;
-    idp?.stop();
-    idp = null;
-    rmSync(idpDataDir, { recursive: true, force: true });
-  });
-
-  function publishTo(token: string, name = 'homebridge', vers = '1.0.0+1'): Promise<Response> {
-    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
-    const file = Buffer.from('fake netapp bytes');
-    const metaLen = Buffer.alloc(4);
-    metaLen.writeUInt32LE(meta.length, 0);
-    const fileLen = Buffer.alloc(4);
-    fileLen.writeUInt32LE(file.length, 0);
-    const body = Buffer.concat([metaLen, meta, fileLen, file]);
-    return fetch(`${idpBaseUrl}/api/v1/modules/new`, {
-      method: 'PUT',
-      headers: { Authorization: `Bearer ${token}` },
-      body,
-    });
-  }
-
-  test('active idp token (admin group) authorizes publish', async () => {
-    claimsByToken.set('idp-tok', { active: true, sub: 'alice', groups: ['celilo-admins'] });
-    const res = await publishTo('idp-tok');
-    expect(res.status).toBe(200);
-  });
-
-  test('active idp token not in admin group → 401', async () => {
-    claimsByToken.set('idp-tok', { active: true, sub: 'bob', groups: ['users'] });
-    const res = await publishTo('idp-tok');
-    expect(res.status).toBe(401);
-  });
-
-  test('revoked-at-idp (active:false) → next publish denied 401', async () => {
-    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
-    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
-    // Revoke at the idp — the token is now inactive.
-    claimsByToken.set('idp-tok', { active: false });
-    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
-  });
-
-  test('opaque publish token still works (backward compat)', async () => {
-    const res = await publishTo('opaque-admin');
-    // 'opaque-admin' is the raw token; it authorizes via the local set,
-    // never touching introspection.
-    expect(res.status).toBe(200);
-  });
-
-  test('idp down (introspection throws) → fails closed 401', async () => {
-    idp?.stop();
-    idp = null;
-    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
-    const res = await publishTo('idp-tok');
-    expect(res.status).toBe(401);
-  });
-});
-
-// ── module-owner table: hybrid group + owner authorization (ce-1ch) ──────────
-// A verified idp publisher may publish only module names it owns. The first
-// verified publisher of an unclaimed name claims it (first-publish-claims);
-// another publisher is then DENIED (confused-deputy defense). Admins publish or
-// reassign anything.
-
-describe('module-owner authorization (ce-1ch)', () => {
-  let idp: ReturnType<typeof Bun.serve> | null = null;
-  let srv: ReturnType<typeof startServer> | null = null;
-  let dir: string;
-  let url: string;
-  const claimsByToken = new Map<string, Record<string, unknown>>();
-
-  beforeEach(() => {
-    claimsByToken.clear();
-    idp = Bun.serve({
-      port: 0,
-      async fetch(req) {
-        const form = new URLSearchParams(await req.text());
-        const token = form.get('token') ?? '';
-        return Response.json(claimsByToken.get(token) ?? { active: false });
-      },
-    });
-    dir = mkdtempSync(join(tmpdir(), 'celilo-registry-owner-test-'));
-    srv = startServer({
-      dataDir: dir,
-      port: 0,
-      pathPrefix: '',
-      publicUrl: 'https://example.test',
-      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
-      introspection: new IntrospectionVerifier({
-        endpoint: `http://localhost:${idp.port}/introspect`,
-        clientId: 'celilo-registry',
-        clientSecret: 'sec',
-        adminGroup: 'celilo-admins',
-        publisherGroup: 'celilo-authors',
-      }),
-    });
-    url = `http://localhost:${srv.port}`;
-  });
-
-  afterEach(() => {
-    srv?.stop();
-    srv = null;
-    idp?.stop();
-    idp = null;
-    rmSync(dir, { recursive: true, force: true });
-  });
-
-  function publish(token: string, name: string, vers: string): Promise<Response> {
-    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
-    const file = Buffer.from('fake netapp bytes');
-    const metaLen = Buffer.alloc(4);
-    metaLen.writeUInt32LE(meta.length, 0);
-    const fileLen = Buffer.alloc(4);
-    fileLen.writeUInt32LE(file.length, 0);
-    const body = Buffer.concat([metaLen, meta, fileLen, file]);
-    return fetch(`${url}/api/v1/modules/new`, {
-      method: 'PUT',
-      headers: { Authorization: `Bearer ${token}` },
-      body,
-    });
-  }
-
-  test('publisher claims an unclaimed name on first publish', async () => {
-    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
-    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
-    // The owner endpoint (admin) now shows alice owns it.
-    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
-      headers: { Authorization: 'Bearer opaque-admin' },
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { owner: { ownerSub: string; sourceGroup: string } };
-    expect(body.owner.ownerSub).toBe('alice');
-    expect(body.owner.sourceGroup).toBe('celilo-authors');
-  });
-
-  test('owner may publish more versions of a name it owns', async () => {
-    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
-    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
-    expect((await publish('alice-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
-  });
-
-  test('CONFUSED DEPUTY: a different publisher cannot publish someone else’s name', async () => {
-    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
-    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
-    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
-    // Bob is a valid publisher but does NOT own homebridge → denied.
-    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
-  });
-
-  test('an identity in neither publish group is denied even when verified', async () => {
-    claimsByToken.set('carol-tok', { active: true, sub: 'carol', groups: ['users'] });
-    expect((await publish('carol-tok', 'anything', '1.0.0+1')).status).toBe(401);
-  });
-
-  test('admin group may publish any name and claims it', async () => {
-    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
-    expect((await publish('admin-tok', 'caddy', '1.0.0+1')).status).toBe(200);
-    const res = await fetch(`${url}/api/v1/modules/owners/caddy`, {
-      headers: { Authorization: 'Bearer opaque-admin' },
-    });
-    expect(((await res.json()) as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
-  });
-
-  test('admin reassign lets a new owner publish the name', async () => {
-    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
-    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
-    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
-    // Bob denied before reassignment.
-    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
-    // Admin reassigns homebridge to bob.
-    const reassign = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
-      method: 'POST',
-      headers: { Authorization: 'Bearer opaque-admin', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ ownerSub: 'bob' }),
-    });
-    expect(reassign.status).toBe(200);
-    // Now bob may publish.
-    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
-  });
-
-  test('owner list endpoint requires admin', async () => {
-    const anon = await fetch(`${url}/api/v1/modules/owners`);
-    expect(anon.status).toBe(401);
-    const ok = await fetch(`${url}/api/v1/modules/owners`, {
-      headers: { Authorization: 'Bearer opaque-admin' },
-    });
-    expect(ok.status).toBe(200);
-    expect(((await ok.json()) as { owners: unknown[] }).owners).toEqual([]);
-  });
-
-  test('owner reassign requires admin (a plain publisher cannot)', async () => {
-    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
-    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
-      method: 'POST',
-      headers: { Authorization: 'Bearer alice-tok', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ ownerSub: 'alice' }),
-    });
-    expect(res.status).toBe(401);
-  });
-
-  test('owner show for an unclaimed name → 404', async () => {
-    const res = await fetch(`${url}/api/v1/modules/owners/never-claimed`, {
-      headers: { Authorization: 'Bearer opaque-admin' },
-    });
-    expect(res.status).toBe(404);
-  });
-
-  test('an idp admin token may drive the owner endpoints too', async () => {
-    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
-    const res = await fetch(`${url}/api/v1/modules/owners`, {
-      headers: { Authorization: 'Bearer admin-tok' },
-    });
-    expect(res.status).toBe(200);
-  });
-});
-
-// ── sweep (reclaiming disk from superseded build revisions) ──────────────────
-
-describe('POST /api/v1/modules/sweep', () => {
-  function requestSweep(token: string, body: unknown = {}): Promise<Response> {
-    return fetch(`${baseUrl}/api/v1/modules/sweep`, {
-      method: 'POST',
-      headers: token ? { Authorization: token, 'Content-Type': 'application/json' } : {},
-      body: JSON.stringify(body),
-    });
-  }
-
-  test('no token is 401 — a sweep deletes, so it is admin-only', async () => {
-    const res = await requestSweep('');
-    expect(res.status).toBe(401);
-  });
-
-  test('a scoped (non-admin) token is 401', async () => {
-    const mint = await fetch(`${baseUrl}/api/v1/modules/tokens/mint`, {
-      method: 'POST',
-      headers: { Authorization: 'valid-token', 'Content-Type': 'application/json' },
-      body: JSON.stringify({ repo: 'celilo/homebridge', scope: 'homebridge' }),
-    });
-    const { token } = (await mint.json()) as { token: string };
-
-    const res = await requestSweep(token);
-    expect(res.status).toBe(401);
-  });
-
-  test('removes superseded revisions and leaves the download path working', async () => {
-    for (const rev of [1, 2, 3]) await publish('homebridge', `1.0.0+${rev}`, 'valid-token');
-
-    const res = await requestSweep('valid-token');
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { ok: boolean; removedCount: number };
-    expect(body.ok).toBe(true);
-    expect(body.removedCount).toBe(2);
-
-    // The surviving revision downloads; a swept one is gone from BOTH the
-    // index and the store, so nothing advertises a 404.
-    expect((await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+3/download`)).status).toBe(200);
-    expect((await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`)).status).toBe(404);
-
-    const index = await fetch(`${baseUrl}/index/ho/me/homebridge`);
-    const versions = (await index.text())
-      .split('\n')
-      .filter(Boolean)
-      .map((line) => (JSON.parse(line) as { vers: string }).vers);
-    expect(versions).toEqual(['1.0.0+3']);
-  });
-
-  test('dry_run reports the plan without deleting anything', async () => {
-    for (const rev of [1, 2]) await publish('homebridge', `1.0.0+${rev}`, 'valid-token');
-
-    const res = await requestSweep('valid-token', { dry_run: true });
-    const body = (await res.json()) as { removedCount: number; dryRun: boolean };
-    expect(body.removedCount).toBe(1);
-    expect(body.dryRun).toBe(true);
-    expect((await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`)).status).toBe(200);
-  });
-
-  test('rejects a keep_build_revisions that would delete a whole release', async () => {
-    const res = await requestSweep('valid-token', { keep_build_revisions: 0 });
-    expect(res.status).toBe(400);
-  });
-
-  test('honours a larger keep_build_revisions', async () => {
-    for (const rev of [1, 2, 3, 4]) await publish('homebridge', `1.0.0+${rev}`, 'valid-token');
-    const res = await requestSweep('valid-token', { keep_build_revisions: 2 });
-    const body = (await res.json()) as { removedCount: number };
-    expect(body.removedCount).toBe(2);
-  });
-
-  test('coexists with a module actually named "sweep"', async () => {
-    await publish('sweep', '1.0.0+1', 'valid-token');
-    const res = await requestSweep('valid-token');
-    expect(res.status).toBe(200);
-    // …and the module is still reachable by its own GET route.
-    expect((await fetch(`${baseUrl}/api/v1/modules/sweep`)).status).toBe(200);
-  });
-});
-
-describe('POST /api/v1/modules/sweep — a damaged store', () => {
-  function requestSweep(token: string, body: unknown = {}): Promise<Response> {
-    return fetch(`${baseUrl}/api/v1/modules/sweep`, {
-      method: 'POST',
-      headers: { Authorization: token, 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-    });
-  }
-
-  test('reclaims a half-written publish, freeing the version to be published again', async () => {
-    // handlePublish stores the package and appends the index with no rollback
-    // between them, so an ENOSPC or EACCES in the gap leaves an orphan. The
-    // immutability check reads the filesystem, so that version then cannot be
-    // published at all — this is the only repair path in the product.
-    await publish('homebridge', '1.0.0+1', 'valid-token');
-    const rmIndex = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/yank`, {
-      method: 'DELETE',
-      headers: { Authorization: 'valid-token' },
-    });
-    expect(rmIndex.status).toBe(200);
-
-    // Simulate the crash: index line gone, payload left behind.
-    rmSync(join(dataDir, 'index'), { recursive: true, force: true });
-
-    const blocked = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(blocked.status).toBe(409);
-
-    const swept = await requestSweep('valid-token');
-    const body = (await swept.json()) as { orphanCount: number };
-    expect(body.orphanCount).toBe(1);
-
-    // The version is publishable again.
-    const retry = await publish('homebridge', '1.0.0+1', 'valid-token');
-    expect(retry.status).toBe(200);
-  });
-});