@cldmv/gh-broker 0.8.0 → 0.10.0

package/tests/catalog.test.vitest.mts

@@ -1,234 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { buildCatalog } from "../src/catalog.ts";
-
-function makeConfig(tools: any[], owners: Record<string, unknown> = { cldmv: { read: "cred:r", write: "cred:w" } }): any {
-	return { listen: "unix:/x", upstream: "https://api.githubcopilot.com/mcp/", tools, owners };
-}
-
-describe("buildCatalog", () => {
-	let secrets: { resolve: ReturnType<typeof vi.fn> };
-	let upstream: { listToolsFor: ReturnType<typeof vi.fn> };
-	let errSpy: ReturnType<typeof vi.spyOn>;
-
-	beforeEach(() => {
-		secrets = { resolve: vi.fn(() => "tok"), has: vi.fn(() => true) };
-		upstream = { listToolsFor: vi.fn() };
-		errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		delete process.env.GH_BROKER_CATALOG_TIMEOUT_MS;
-	});
-
-	it("uses upstream schemas, emits local schemas for custom verbs, and skips unexposed proxied tools", async () => {
-		const upstreamTool = { name: "get_me", description: "real", inputSchema: { type: "object", properties: {} } };
-		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
-		const config = makeConfig([
-			{ name: "get_me", mode: "read" },
-			{ name: "not_exposed", mode: "read" },
-			{ name: "link_issue", mode: "write", custom: true },
-			{ name: "resolve_review_thread", mode: "write", custom: true },
-			{ name: "reply_review_thread", mode: "write", custom: true },
-			{ name: "mystery_custom", mode: "read", custom: true }
-		]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-
-		expect(secrets.resolve).toHaveBeenCalledWith("cred:r");
-		const names = catalog.map((t) => t.name);
-		// get_me is served from upstream; not_exposed is dropped (fetched but absent);
-		// the two wired custom verbs get local schemas; link_issue is DEFERRED (its
-		// catalog branch is commented out) and mystery_custom matches no branch — both
-		// are silently skipped even when allowlisted.
-		expect(names).toEqual(["get_me", "resolve_review_thread", "reply_review_thread"]);
-		expect(names).not.toContain("link_issue");
-		expect(catalog[0]).toBe(upstreamTool);
-		expect(catalog.find((t) => t.name === "resolve_review_thread")?.inputSchema).toMatchObject({ type: "object" });
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/allowlisted tool "not_exposed" is NOT exposed/));
-	});
-
-	it("advertises report_unlabeled with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const config = makeConfig([{ name: "report_unlabeled", mode: "read", custom: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "report_unlabeled" });
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
-	});
-
-	it("advertises report_security_alerts with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const config = makeConfig([{ name: "report_security_alerts", mode: "read", custom: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "report_security_alerts" });
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
-	});
-
-	it("advertises report_release_prs with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const config = makeConfig([{ name: "report_release_prs", mode: "read", custom: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "report_release_prs" });
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
-	});
-
-	it("does not expose npm_scaffold without an npm block, or when its token is not stored", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const rules = [{ name: "npm_scaffold", mode: "write", custom: true }];
-		expect(await buildCatalog(makeConfig(rules), secrets as any, upstream as any)).toEqual([]);
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/"npm_scaffold" is not exposed: the npm integration is not configured/));
-		secrets.has.mockReturnValue(false);
-		const noToken = { ...makeConfig(rules), npm: { token: "cred:npm-token", scopes: ["@cldmv"] } };
-		expect(await buildCatalog(noToken, secrets as any, upstream as any)).toEqual([]);
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/"npm_scaffold" is not exposed: its credential "npm-token" is not stored/));
-	});
-
-	it("advertises npm_scaffold with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const catalog = await buildCatalog({ ...makeConfig([{ name: "npm_scaffold", mode: "write", custom: true }]), npm: { token: "cred:npm-token", scopes: ["@cldmv"] } }, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "npm_scaffold" });
-		expect(catalog[0]?.description).toMatch(/one-time password/);
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner", "repo", "package", "otp"] });
-	});
-
-	it("advertises issue_labels with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const config = makeConfig([{ name: "issue_labels", mode: "write", custom: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "issue_labels" });
-		expect(catalog[0]?.description).toMatch(/swap/);
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner", "repo", "issue_number"] });
-	});
-
-	it("warns on issue_write that labels replaces the set, pointing at issue_labels when it is allowlisted", async () => {
-		const upstreamTool = { name: "issue_write", description: "Create or update an issue.", inputSchema: { type: "object", properties: { labels: {} } } };
-		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
-		const withVerb = await buildCatalog(
-			makeConfig([{ name: "issue_write", mode: "write" }, { name: "issue_labels", mode: "write", custom: true }]),
-			secrets as any,
-			upstream as any
-		);
-		const iw = withVerb.find((t) => t.name === "issue_write")!;
-		expect(iw.description).toMatch(/^Create or update an issue\. WARNING \(gh-broker\): "labels" REPLACES the issue's whole label set/);
-		expect(iw.description).toMatch(/use issue_labels instead/);
-		expect(iw.inputSchema).toBe(upstreamTool.inputSchema);
-		expect(upstreamTool.description).toBe("Create or update an issue."); // the fetched tool is not mutated
-
-		const without = await buildCatalog(makeConfig([{ name: "issue_write", mode: "write" }]), secrets as any, upstream as any);
-		expect(without[0]?.description).toMatch(/REPLACES/);
-		expect(without[0]?.description).not.toMatch(/issue_labels/);
-		expect(without[0]?.description).toMatch(/pass the full set/);
-	});
-
-	it("warns on issue_write even when the upstream tool carries no description", async () => {
-		upstream.listToolsFor.mockResolvedValue([{ name: "issue_write", inputSchema: { type: "object" } }]);
-		const catalog = await buildCatalog(makeConfig([{ name: "issue_write", mode: "write" }]), secrets as any, upstream as any);
-		expect(catalog[0]?.description).toMatch(/^WARNING \(gh-broker\): "labels" REPLACES/);
-	});
-
-	it("still warns on issue_write when the upstream fetch fails (minimal schema)", async () => {
-		upstream.listToolsFor.mockRejectedValue(new Error("down"));
-		const catalog = await buildCatalog(makeConfig([{ name: "issue_write", mode: "write" }]), secrets as any, upstream as any);
-		expect(catalog[0]?.description).toMatch(/^\(write\) proxied to the GitHub MCP WARNING/);
-	});
-
-	it("advertises report_ci_status with its local schema", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const config = makeConfig([{ name: "report_ci_status", mode: "read", custom: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect(catalog[0]).toMatchObject({ name: "report_ci_status" });
-		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner", "repo"] });
-	});
-
-	it("layers ciVerbosity/logLines onto pull_request_read's real upstream schema without dropping its own params", async () => {
-		const upstreamTool = {
-			name: "pull_request_read",
-			description: "Get information on a specific pull request.",
-			inputSchema: { type: "object", required: ["owner", "repo", "pullNumber", "method"], properties: { method: { type: "string" }, pullNumber: { type: "number" } } }
-		};
-		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
-		const config = makeConfig([{ name: "pull_request_read", mode: "read", augment: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		const tool = catalog[0]!;
-		expect(tool.description).toContain("gh-broker extension");
-		expect((tool.inputSchema as any).required).toEqual(["owner", "repo", "pullNumber", "method"]);
-		expect((tool.inputSchema as any).properties.pullNumber).toEqual({ type: "number" });
-		expect((tool.inputSchema as any).properties.ciVerbosity).toMatchObject({ type: "number", enum: [0, 1, 2, 3] });
-		expect((tool.inputSchema as any).properties.logLines).toMatchObject({ type: "number" });
-	});
-
-	it("still adds ciVerbosity/logLines to pull_request_read when the upstream fetch fails entirely", async () => {
-		upstream.listToolsFor.mockRejectedValue(new Error("network down"));
-		const config = makeConfig([{ name: "pull_request_read", mode: "read", augment: true }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog).toHaveLength(1);
-		expect((catalog[0]!.inputSchema as any).properties).toEqual({
-			ciVerbosity: { type: "number", enum: [0, 1, 2, 3], description: expect.any(String) },
-			logLines: { type: "number", description: expect.any(String) }
-		});
-	});
-
-	it("falls back to minimal schemas when the upstream fetch fails", async () => {
-		upstream.listToolsFor.mockRejectedValue(new Error("401 bad token"));
-		const config = makeConfig([
-			{ name: "get_me", mode: "read" },
-			{ name: "resolve_review_thread", mode: "write", custom: true }
-		]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-
-		const getMe = catalog.find((t) => t.name === "get_me");
-		expect(getMe).toEqual({ name: "get_me", description: "(read) proxied to the GitHub MCP", inputSchema: { type: "object" } });
-		expect(catalog.map((t) => t.name)).toContain("resolve_review_thread");
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/could not fetch upstream tool schemas/));
-	});
-
-	it("skips the upstream fetch entirely when there are no owners", async () => {
-		const config = makeConfig([{ name: "get_me", mode: "read" }], {});
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(upstream.listToolsFor).not.toHaveBeenCalled();
-		expect(catalog).toEqual([{ name: "get_me", description: "(read) proxied to the GitHub MCP", inputSchema: { type: "object" } }]);
-	});
-
-	it("times out a slow upstream and advertises minimal schemas", async () => {
-		process.env.GH_BROKER_CATALOG_TIMEOUT_MS = "15";
-		upstream.listToolsFor.mockReturnValue(new Promise(() => {})); // never resolves
-		const config = makeConfig([{ name: "get_me", mode: "read" }]);
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog.map((t) => t.name)).toEqual(["get_me"]);
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/timed out after 15ms/));
-	});
-
-	it("advertises ghcr_push / ghcr_push_status / ghcr_tags with their local schemas", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const ghcrTools = [
-			{ name: "ghcr_push", mode: "write", custom: true },
-			{ name: "ghcr_push_status", mode: "read", custom: true },
-			{ name: "ghcr_tags", mode: "read", custom: true }
-		];
-		const ghcr = { owners: { cldmv: { credential: "cred:cldmv-packages" }, other: { credential: "cred:other-packages" } } };
-		const config = { ...makeConfig(ghcrTools), ghcr };
-		// Exposed as soon as any one GHCR owner's credential is stored.
-		secrets.has.mockImplementation((ref: string) => ref === "cred:other-packages");
-		const catalog = await buildCatalog(config, secrets as any, upstream as any);
-		expect(catalog.map((t) => t.name)).toEqual(["ghcr_push", "ghcr_push_status", "ghcr_tags"]);
-		expect(catalog[0]?.inputSchema).toMatchObject({ required: ["owner", "image", "tag", "archive"], additionalProperties: false });
-		expect(catalog[0]?.description).toMatch(/background job/);
-	});
-
-	it("does not expose the GHCR tools without config.ghcr, or while no GHCR credential is stored", async () => {
-		upstream.listToolsFor.mockResolvedValue([]);
-		const rules = [{ name: "ghcr_push", mode: "write", custom: true }];
-		expect(await buildCatalog(makeConfig(rules), secrets as any, upstream as any)).toEqual([]);
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/"ghcr_push" is not exposed: GHCR pushes are not configured/));
-		secrets.has.mockReturnValue(false);
-		const config = { ...makeConfig(rules), ghcr: { owners: { cldmv: { credential: "cred:cldmv-packages" } } } };
-		expect(await buildCatalog(config, secrets as any, upstream as any)).toEqual([]);
-		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/no GHCR credential is stored \("cldmv-packages"; re-run the installer/));
-	});
-});

package/tests/config-merge.test.vitest.mts

@@ -1,325 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { mergeConfig, layerConfig, overlayFromFlags, readOperatorConfig, buildConfig, secretsBlock, DEFAULT_GHCR_DROP_DIR } from "../deploy/lib/config-merge.mjs";
-
-const example = {
-	listen: "unix:/run/gh-broker/gh-broker.sock",
-	upstream: "https://api.githubcopilot.com/mcp/x/all",
-	tools: [
-		{ name: "get_me", mode: "read" },
-		{ name: "list_issues", mode: "read" }
-	],
-	owners: { acme: { read: "cred:acme-read", write: "cred:acme-write" } },
-	defaultOwner: "acme"
-};
-
-describe("mergeConfig", () => {
-	it("uses the example as-is on first install (no current)", () => {
-		expect(mergeConfig(example, null)).toEqual(example);
-	});
-
-	it("takes tools from the example so allowlist removals/tightenings apply", () => {
-		const current = { ...example, tools: [{ name: "get_me", mode: "read" }, { name: "removed_tool", mode: "write" }] };
-		const merged = mergeConfig(example, current);
-		expect(merged.tools).toEqual(example.tools);
-		expect(merged.tools.find((t: { name: string }) => t.name === "removed_tool")).toBeUndefined();
-	});
-
-	it("preserves current owner data and adds example-only owners on upgrade", () => {
-		const current = { ...example, owners: { acme: { read: "cred:acme-read", write: "cred:acme-write", installationId: 123 } } };
-		const example2 = {
-			...example,
-			owners: {
-				acme: { read: "cred:acme-read", write: "cred:acme-write" },
-				beta: { read: "cred:beta-read", write: "cred:beta-write" }
-			}
-		};
-		const merged = mergeConfig(example2, current);
-		expect(merged.owners.acme.installationId).toBe(123); // current wins
-		expect(merged.owners.beta).toBeDefined(); // new example owner appears
-	});
-
-	it("lets current win for listen/upstream/defaultOwner/app/secrets", () => {
-		const current = { ...example, listen: "unix:/tmp/custom.sock", app: { appId: 1, privateKey: "cred:k" } };
-		const merged = mergeConfig(example, current);
-		expect(merged.listen).toBe("unix:/tmp/custom.sock");
-		expect(merged.app).toEqual({ appId: 1, privateKey: "cred:k" });
-	});
-
-	it("keeps the current npm block on upgrade (the example has none)", () => {
-		const npm = { token: "cred:npm-token", scopes: ["@cldmv"] };
-		expect(mergeConfig(example, { ...example, npm }).npm).toEqual(npm);
-		expect(mergeConfig(example, { ...example }).npm).toBeUndefined();
-	});
-
-	it("keeps the example's scalars when current omits them, and tolerates configs with no owners", () => {
-		const merged = mergeConfig({ tools: [], listen: "unix:/a" }, { tools: [] });
-		expect(merged.listen).toBe("unix:/a");
-		expect(merged.owners).toEqual({});
-	});
-
-	it("does not mutate its inputs", () => {
-		const ex = structuredClone(example);
-		mergeConfig(ex, { ...example, listen: "unix:/z" });
-		expect(ex).toEqual(example);
-	});
-
-	it("rejects an array as example or current (typeof reports 'object')", () => {
-		expect(() => mergeConfig([], null)).toThrow(/example config must be an object/);
-		expect(() => mergeConfig(example, [])).toThrow(/current config must be an object/);
-	});
-
-	describe("ghcr", () => {
-		const ghcr = { dropDir: "/srv/gh-broker/ghcr-drop", owners: { cldmv: { username: "u", credential: "cred:p", images: ["hoot"] } } };
-
-		it("keeps the deployed ghcr block (operator data); the example ships none", () => {
-			expect(mergeConfig(example, { ...example, ghcr }).ghcr).toEqual(ghcr);
-			expect(mergeConfig(example, { ...example }).ghcr).toBeUndefined();
-		});
-
-		it("lets the deployed ghcr win over one the example carries", () => {
-			const edited = { ...ghcr, dropDir: "/srv/other/drop" };
-			expect(mergeConfig({ ...example, ghcr }, { ...example, ghcr: edited }).ghcr).toEqual(edited);
-			expect(mergeConfig({ ...example, ghcr }, example).ghcr).toEqual(ghcr);
-		});
-	});
-});
-
-const shipped = {
-	listen: "unix:/run/gh-broker/gh-broker.sock",
-	upstream: "https://api.githubcopilot.com/mcp/x/all",
-	tools: [{ name: "get_me", mode: "read" }]
-};
-const noOpts = {};
-const ask = async () => {
-	throw new Error("unexpected prompt");
-};
-
-describe("layerConfig", () => {
-	it("replaces scalars and merges owners per owner and per field", () => {
-		const base = { listen: "unix:/a", upstream: "https://a", owners: { acme: { read: "cred:acme-read", write: "cred:acme-write", installationId: 7 } } };
-		const out = layerConfig(base, { listen: "unix:/b", defaultOwner: "acme", owners: { acme: { write: "cred:w2" }, beta: { read: "cred:r", write: "cred:w" } } });
-		expect(out.listen).toBe("unix:/b");
-		expect(out.upstream).toBe("https://a");
-		expect(out.defaultOwner).toBe("acme");
-		expect(out.owners.acme).toEqual({ read: "cred:acme-read", write: "cred:w2", installationId: 7 });
-		expect(out.owners.beta).toEqual({ read: "cred:r", write: "cred:w" });
-		expect(base.owners.acme.write).toBe("cred:acme-write"); // input untouched
-	});
-
-	it("merges app/secrets/npm per field and creates them when absent", () => {
-		const out = layerConfig({ npm: { token: "cred:t", scopes: ["@a"] } }, { npm: { registry: "https://r" }, secrets: { path: "/p" }, app: { appId: 1, privateKey: "cred:k" } });
-		expect(out.npm).toEqual({ token: "cred:t", scopes: ["@a"], registry: "https://r" });
-		expect(out.secrets).toEqual({ path: "/p" });
-		expect(out.app).toEqual({ appId: 1, privateKey: "cred:k" });
-	});
-
-	it("merges ghcr scalars and ghcr owners per owner", () => {
-		const base = { owners: {}, ghcr: { dropDir: "/srv/a/b", owners: { acme: { username: "u", credential: "cred:acme-packages", images: ["x"] } } } };
-		const out = layerConfig(base, { ghcr: { protectReleaseTags: false, owners: { acme: { images: ["y"] }, beta: { username: "b", credential: "cred:beta-packages", images: ["z"] } } } });
-		expect(out.ghcr.dropDir).toBe("/srv/a/b");
-		expect(out.ghcr.protectReleaseTags).toBe(false);
-		expect(out.ghcr.owners.acme).toEqual({ username: "u", credential: "cred:acme-packages", images: ["y"] });
-		expect(Object.keys(out.ghcr.owners)).toEqual(["acme", "beta"]);
-		expect(layerConfig({}, { ghcr: { dropDir: "/srv/a/b" } }).ghcr).toEqual({ dropDir: "/srv/a/b" });
-	});
-
-	it("leaves a base without overlay data alone", () => {
-		expect(layerConfig({ listen: "unix:/a" }, {})).toEqual({ listen: "unix:/a" });
-	});
-});
-
-describe("overlayFromFlags", () => {
-	it("is empty with no flags", () => {
-		expect(overlayFromFlags(noOpts)).toEqual({});
-	});
-
-	it("maps every flag to its config field", () => {
-		const o = overlayFromFlags({
-			listen: "unix:/x.sock",
-			upstream: "https://u",
-			defaultOwner: "acme",
-			owners: ["acme", "beta"],
-			installationIds: { acme: 42, gamma: 9 },
-			appId: 5,
-			appPrivateKey: "my-key",
-			secretsPath: "/s.json",
-			ghcrOwner: "acme",
-			ghcrUsername: "me",
-			ghcrImages: ["app", "app-*"],
-			ghcrDropDir: "/srv/x/drop",
-			ghcrMaxArchiveBytes: 1024,
-			protectReleaseTags: false
-		});
-		expect(o).toEqual({
-			listen: "unix:/x.sock",
-			upstream: "https://u",
-			defaultOwner: "acme",
-			owners: {
-				acme: { read: "cred:acme-read", write: "cred:acme-write", installationId: 42 },
-				beta: { read: "cred:beta-read", write: "cred:beta-write" },
-				gamma: { installationId: 9 }
-			},
-			app: { appId: 5, privateKey: "cred:my-key" },
-			secrets: { path: "/s.json" },
-			ghcr: {
-				dropDir: "/srv/x/drop",
-				maxArchiveBytes: 1024,
-				protectReleaseTags: false,
-				owners: { acme: { username: "me", credential: "cred:acme-packages", images: ["app", "app-*"] } }
-			}
-		});
-	});
-
-	it("derives the App key name when only --app-id is given and handles --protect-release-tags", () => {
-		expect(overlayFromFlags({ appId: 5 }).app).toEqual({ appId: 5, privateKey: "cred:gh-app-key" });
-		expect(overlayFromFlags({ protectReleaseTags: true }).ghcr).toEqual({ protectReleaseTags: true });
-	});
-});
-
-describe("readOperatorConfig", () => {
-	const read = (text: string) => () => text;
-
-	it("returns a valid operator config", () => {
-		const cfg = { listen: "unix:/a", owners: { acme: { read: "cred:acme-read", write: "cred:acme-write" } } };
-		expect(readOperatorConfig("/c.json", read(JSON.stringify(cfg)))).toEqual(cfg);
-	});
-
-	it("reports an unreadable file and bad JSON", () => {
-		expect(() =>
-			readOperatorConfig("/missing.json", () => {
-				throw new Error("ENOENT: no such file");
-			})
-		).toThrow(/--config: cannot read\/parse \/missing.json: ENOENT/);
-		expect(() => readOperatorConfig("/c.json", read("{ nope"))).toThrow(/--config: cannot read\/parse/);
-	});
-
-	it("refuses a non-object root, tools, and unknown keys", () => {
-		expect(() => readOperatorConfig("/c.json", read("[]"))).toThrow(/must be a JSON object/);
-		expect(() => readOperatorConfig("/c.json", read("null"))).toThrow(/must be a JSON object/);
-		expect(() => readOperatorConfig("/c.json", read('{"tools":[]}'))).toThrow(/`tools` is the shipped allowlist/);
-		expect(() => readOperatorConfig("/c.json", read('{"lisen":"x","owners":{}}'))).toThrow(/unknown key\(s\) lisen/);
-	});
-
-	it.each([
-		["a classic PAT", { owners: { acme: { read: "ghp_" + "a".repeat(36), write: "cred:w" } } }, "owners.acme.read"],
-		["a fine-grained PAT", { ghcr: { owners: { a: { images: ["github_pat_" + "A1".repeat(20)] } } } }, "ghcr.owners.a.images[0]"],
-		["an npm token", { npm: { token: "npm_" + "b".repeat(36), scopes: [] } }, "npm.token"],
-		["a token as a list entry", { npm: { scopes: ["ok", "ghs_" + "c".repeat(30)] } }, "npm.scopes[1]"]
-	])("refuses %s", (_name, cfg, where) => {
-		expect(() => readOperatorConfig("/c.json", read(JSON.stringify(cfg)))).toThrow(new RegExp(`--config: ${where.replace(/[[\]]/g, "\\$&")} looks like a token`));
-	});
-
-	it("accepts cred refs, numbers and booleans alongside strings", () => {
-		const cfg = { app: { appId: 1, privateKey: "cred:gh-app-key" }, ghcr: { protectReleaseTags: true } };
-		expect(readOperatorConfig("/c.json", read(JSON.stringify(cfg)))).toEqual(cfg);
-	});
-});
-
-describe("buildConfig", () => {
-	const acme = { read: "cred:acme-read", write: "cred:acme-write" };
-	const build = (o: Record<string, unknown>) => buildConfig({ example: shipped, current: null, file: undefined, opts: noOpts, nonInteractive: true, ask, ...o } as never);
-
-	it("a first install takes owners from flags, defaults defaultOwner and sets ghcr.dropDir", async () => {
-		const { config, notes } = await build({
-			opts: { owners: ["acme"], ghcrOwner: "acme", ghcrUsername: "me", ghcrImages: ["app"] }
-		});
-		expect(config.tools).toEqual(shipped.tools);
-		expect(config.owners).toEqual({ acme });
-		expect(config.defaultOwner).toBe("acme");
-		expect(config.ghcr).toEqual({ dropDir: DEFAULT_GHCR_DROP_DIR, owners: { acme: { username: "me", credential: "cred:acme-packages", images: ["app"] } } });
-		expect(notes).toHaveLength(2);
-	});
-
-	it("does not pick a defaultOwner with several owners, or when one is set", async () => {
-		expect((await build({ opts: { owners: ["acme", "beta"] } })).config.defaultOwner).toBeUndefined();
-		expect((await build({ opts: { owners: ["acme", "beta"], defaultOwner: "beta" } })).config.defaultOwner).toBe("beta");
-	});
-
-	it("layers example < deployed < --config < flags", async () => {
-		const current = { ...shipped, listen: "unix:/deployed", upstream: "https://deployed", owners: { acme }, defaultOwner: "acme" };
-		const file = { listen: "unix:/file", upstream: "https://file" };
-		const flags = { listen: "unix:/flag" };
-		const { config } = await build({ current, file, opts: flags });
-		expect(config.listen).toBe("unix:/flag"); // flag beats file
-		expect(config.upstream).toBe("https://file"); // file beats deployed
-		const deployedOnly = await build({ current });
-		expect(deployedOnly.config.listen).toBe("unix:/deployed"); // deployed beats example
-		expect(deployedOnly.config.upstream).toBe("https://deployed");
-		expect((await build({ current: { tools: [], owners: { acme } } })).config.listen).toBe(shipped.listen); // example fills gaps
-	});
-
-	it("keeps the deployed owners, ghcr and tools on an upgrade with no flags", async () => {
-		const ghcr = { dropDir: "/srv/old/drop", protectReleaseTags: false, maxArchiveBytes: 5, owners: { acme: { username: "me", credential: "cred:acme-packages", images: ["x"] } } };
-		const current = { ...shipped, tools: [{ name: "gone", mode: "write" }], owners: { acme: { ...acme, installationId: 3 } }, ghcr };
-		const { config, notes } = await build({ current });
-		expect(config.owners).toEqual({ acme: { ...acme, installationId: 3 } });
-		expect(config.ghcr).toEqual(ghcr);
-		expect(config.tools).toEqual(shipped.tools); // allowlist from the example
-		expect(config.defaultOwner).toBeUndefined();
-		expect(notes).toEqual([]);
-	});
-
-	it("adds an owner on top of a deployed one without losing it", async () => {
-		const { config } = await build({ current: { ...shipped, owners: { acme: { ...acme, installationId: 3 } } }, opts: { owners: ["acme", "beta"] } });
-		expect(config.owners.acme.installationId).toBe(3);
-		expect(config.owners.beta).toEqual({ read: "cred:beta-read", write: "cred:beta-write" });
-	});
-
-	it("takes owners, ghcr and defaultOwner from a --config file", async () => {
-		const file = { owners: { acme }, defaultOwner: "acme", ghcr: { dropDir: "/srv/f/drop", owners: { acme: { username: "me", credential: "cred:acme-packages", images: ["a"] } } } };
-		const { config } = await build({ file });
-		expect(config.owners).toEqual({ acme });
-		expect(config.ghcr.dropDir).toBe("/srv/f/drop");
-	});
-
-	it("fails non-interactively when no owner exists anywhere, naming --owner and --config", async () => {
-		await expect(build({})).rejects.toThrow(/--owner <org>.*--config/);
-		await expect(build({ current: { ...shipped } })).rejects.toThrow(/no GitHub owner configured/);
-	});
-
-	it("asks for the owner on an interactive first install", async () => {
-		const asked: string[] = [];
-		const { config } = await build({
-			nonInteractive: false,
-			ask: async (q: string) => {
-				asked.push(q);
-				return "  Acme-Corp \n";
-			}
-		});
-		expect(asked).toHaveLength(1);
-		expect(config.owners).toEqual({ "acme-corp": { read: "cred:acme-corp-read", write: "cred:acme-corp-write" } });
-		expect(config.defaultOwner).toBe("acme-corp");
-	});
-
-	it("rejects an invalid owner typed at the prompt", async () => {
-		await expect(build({ nonInteractive: false, ask: async () => "not an org!" })).rejects.toThrow(/not a valid GitHub owner name/);
-		await expect(build({ nonInteractive: false, ask: async () => "" })).rejects.toThrow(/not a valid GitHub owner name/);
-	});
-
-	it("does not prompt when owners are already configured", async () => {
-		const { config } = await build({ nonInteractive: false, current: { ...shipped, owners: { acme } } });
-		expect(Object.keys(config.owners)).toEqual(["acme"]);
-	});
-
-	it("refuses an owner that has no credentials (e.g. --installation-id for an unknown owner)", async () => {
-		await expect(build({ opts: { owners: ["acme"], installationIds: { gamma: 9 } } })).rejects.toThrow(/owner "gamma" has no credentials.*--owner gamma/);
-	});
-
-	it("keeps an explicit ghcr.dropDir instead of the default", async () => {
-		const { config, notes } = await build({ opts: { owners: ["acme"], ghcrOwner: "acme", ghcrUsername: "me", ghcrImages: ["a"], ghcrDropDir: "/srv/mine/drop" } });
-		expect(config.ghcr.dropDir).toBe("/srv/mine/drop");
-		expect(notes.some((n: string) => n.includes("dropDir"))).toBe(false);
-	});
-});
-
-describe("secretsBlock", () => {
-	it("returns just the provider, keeping a path only for the file provider", () => {
-		expect(secretsBlock("systemd-creds", undefined)).toEqual({ provider: "systemd-creds" });
-		expect(secretsBlock("file", { path: "/s.json" })).toEqual({ provider: "file", path: "/s.json" });
-		expect(secretsBlock("file", {})).toEqual({ provider: "file" });
-	});
-
-	it("refuses a path with the systemd-creds provider", () => {
-		expect(() => secretsBlock("systemd-creds", { path: "/s.json" })).toThrow(/only used by the "file" provider/);
-	});
-});