@cldmv/gh-broker 0.8.0 → 0.10.0

package/tests/config.test.vitest.mts

@@ -1,388 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll, beforeEach } from "vitest";
-import { mkdirSync, writeFileSync, rmSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { loadConfig, indexTools } from "../src/config.ts";
-
-// loadConfig reads a real file off disk, so we materialize each fixture into the
-// repo's gitignored tmp/ and pass the path.
-const DIR = join(process.cwd(), "tmp", "config-tests");
-let counter = 0;
-
-/** Write `contents` (string or object) to a unique tmp file and return its path. */
-function writeConfig(contents: unknown): string {
-	const path = join(DIR, `cfg-${counter++}.json`);
-	writeFileSync(path, typeof contents === "string" ? contents : JSON.stringify(contents));
-	return path;
-}
-
-function baseConfig(): Record<string, unknown> {
-	return {
-		listen: "unix:/run/gh-broker/gh-broker.sock",
-		upstream: "https://api.githubcopilot.com/mcp/",
-		tools: [{ name: "get_me", mode: "read" }],
-		owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } }
-	};
-}
-
-beforeAll(() => {
-	mkdirSync(DIR, { recursive: true });
-});
-
-afterAll(() => {
-	rmSync(DIR, { recursive: true, force: true });
-});
-
-describe("loadConfig — file/parse errors", () => {
-	it("throws when the file cannot be read", () => {
-		expect(() => loadConfig(join(DIR, "does-not-exist.json"))).toThrow(/cannot read\/parse/);
-	});
-
-	it("throws on malformed JSON", () => {
-		const p = writeConfig("{ not json ");
-		expect(() => loadConfig(p)).toThrow(/cannot read\/parse/);
-	});
-
-	it("throws when the root is not an object", () => {
-		const p = writeConfig("123");
-		expect(() => loadConfig(p)).toThrow(/root must be an object/);
-	});
-
-	it("throws when the root is JSON null", () => {
-		const p = writeConfig("null");
-		expect(() => loadConfig(p)).toThrow(/root must be an object/);
-	});
-});
-
-describe("loadConfig — listen / upstream", () => {
-	it("rejects a non-string listen", () => {
-		const c = baseConfig();
-		delete c.listen;
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.listen/);
-	});
-
-	it("rejects a listen without the unix: prefix", () => {
-		const c = baseConfig();
-		c.listen = "tcp:0.0.0.0:9000";
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.listen/);
-	});
-
-	it("rejects a non-http upstream", () => {
-		const c = baseConfig();
-		c.upstream = "ftp://example.com";
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.upstream/);
-	});
-
-	it("rejects a non-string upstream", () => {
-		const c = baseConfig();
-		c.upstream = 42;
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.upstream/);
-	});
-});
-
-describe("loadConfig — tools", () => {
-	it("rejects a missing tools array", () => {
-		const c = baseConfig();
-		delete c.tools;
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools: must be a non-empty array/);
-	});
-
-	it("rejects an empty tools array", () => {
-		const c = baseConfig();
-		c.tools = [];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools: must be a non-empty array/);
-	});
-
-	it("rejects a tool with no name", () => {
-		const c = baseConfig();
-		c.tools = [{ mode: "read" }];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools\[0\]\.name: required/);
-	});
-
-	it("rejects a tool with a bad mode", () => {
-		const c = baseConfig();
-		c.tools = [{ name: "get_me", mode: "admin" }];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools\[0\]\.mode: must be read\|write/);
-	});
-
-	it("rejects duplicate tool names", () => {
-		const c = baseConfig();
-		c.tools = [
-			{ name: "get_me", mode: "read" },
-			{ name: "get_me", mode: "write" }
-		];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/duplicate tool "get_me"/);
-	});
-
-	it("carries the custom flag through, defaulting to false", () => {
-		const c = baseConfig();
-		c.tools = [
-			{ name: "get_me", mode: "read" },
-			{ name: "link_issue", mode: "write", custom: true }
-		];
-		const out = loadConfig(writeConfig(c));
-		expect(out.tools).toEqual([
-			{ name: "get_me", mode: "read", custom: false, augment: false },
-			{ name: "link_issue", mode: "write", custom: true, augment: false }
-		]);
-	});
-
-	it("carries the augment flag through, defaulting to false", () => {
-		const c = baseConfig();
-		c.tools = [
-			{ name: "get_me", mode: "read" },
-			{ name: "pull_request_read", mode: "read", augment: true }
-		];
-		const out = loadConfig(writeConfig(c));
-		expect(out.tools).toEqual([
-			{ name: "get_me", mode: "read", custom: false, augment: false },
-			{ name: "pull_request_read", mode: "read", custom: false, augment: true }
-		]);
-	});
-
-	it("rejects a tool marked both custom and augment", () => {
-		const c = baseConfig();
-		c.tools = [{ name: "weird", mode: "read", custom: true, augment: true }];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/custom and augment are mutually exclusive/);
-	});
-});
-
-describe("loadConfig — owners", () => {
-	it("rejects a non-object owners", () => {
-		const c = baseConfig();
-		c.owners = "cldmv";
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners: must be an object/);
-	});
-
-	it("rejects an owner missing read/write", () => {
-		const c = baseConfig();
-		c.owners = { cldmv: { read: "cred:x" } };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners\.cldmv: needs "read" and "write"/);
-	});
-
-	it("rejects a non-numeric installationId", () => {
-		const c = baseConfig();
-		c.owners = { cldmv: { read: "cred:r", write: "cred:w", installationId: "42" } };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners\.cldmv\.installationId: must be a number/);
-	});
-
-	it("rejects an empty owners object", () => {
-		const c = baseConfig();
-		c.owners = {};
-		expect(() => loadConfig(writeConfig(c))).toThrow(/at least one owner required/);
-	});
-
-	it("lowercases owner keys and carries installationId", () => {
-		const c = baseConfig();
-		c.owners = { CLDMV: { read: "cred:r", write: "cred:w", installationId: 99 } };
-		const out = loadConfig(writeConfig(c));
-		expect(out.owners).toEqual({ cldmv: { read: "cred:r", write: "cred:w", installationId: 99 } });
-	});
-
-	it("omits installationId when absent", () => {
-		const out = loadConfig(writeConfig(baseConfig()));
-		expect(out.owners.cldmv).toEqual({ read: "cred:cldmv-read", write: "cred:cldmv-write" });
-		expect(out.owners.cldmv).not.toHaveProperty("installationId");
-	});
-});
-
-describe("loadConfig — defaultOwner", () => {
-	it("is undefined when omitted", () => {
-		const out = loadConfig(writeConfig(baseConfig()));
-		expect(out.defaultOwner).toBeUndefined();
-	});
-
-	it("lowercases a valid defaultOwner and carries it through", () => {
-		const c = baseConfig();
-		c.defaultOwner = "CLDMV";
-		const out = loadConfig(writeConfig(c));
-		expect(out.defaultOwner).toBe("cldmv");
-	});
-
-	it("rejects a non-string / empty defaultOwner", () => {
-		const c = baseConfig();
-		c.defaultOwner = "";
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.defaultOwner: must be a non-empty string/);
-	});
-
-	it("rejects a defaultOwner that is not a configured owner", () => {
-		const c = baseConfig();
-		c.defaultOwner = "nobody";
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.defaultOwner "nobody" is not a key of config\.owners/);
-	});
-});
-
-describe("loadConfig — app", () => {
-	it("rejects a non-numeric appId", () => {
-		const c = baseConfig();
-		c.app = { appId: "1", privateKey: "cred:app" };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.app\.appId: must be a number/);
-	});
-
-	it("rejects a non-string privateKey", () => {
-		const c = baseConfig();
-		c.app = { appId: 1, privateKey: 5 };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.app\.privateKey/);
-	});
-
-	it("carries a valid app config through", () => {
-		const c = baseConfig();
-		c.app = { appId: 12345, privateKey: "cred:gh-app-key" };
-		const out = loadConfig(writeConfig(c));
-		expect(out.app).toEqual({ appId: 12345, privateKey: "cred:gh-app-key" });
-	});
-
-	it("omits app when absent", () => {
-		const out = loadConfig(writeConfig(baseConfig()));
-		expect(out.app).toBeUndefined();
-	});
-});
-
-describe("loadConfig — secrets", () => {
-	it("rejects an array (which typeof reports as 'object')", () => {
-		const c = baseConfig();
-		c.secrets = [];
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets: must be an object/);
-	});
-
-	it("rejects null", () => {
-		const c = baseConfig();
-		c.secrets = null;
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets: must be an object/);
-	});
-
-	it("rejects an unknown provider", () => {
-		const c = baseConfig();
-		c.secrets = { provider: "vault" };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.provider/);
-	});
-
-	it("carries a valid secrets block through", () => {
-		const c = baseConfig();
-		c.secrets = { provider: "file", path: "/etc/gh-broker/secrets.json" };
-		const out = loadConfig(writeConfig(c));
-		expect(out.secrets).toEqual({ provider: "file", path: "/etc/gh-broker/secrets.json" });
-	});
-
-	it("carries an empty secrets block, and a provider without a path, through", () => {
-		const c = baseConfig();
-		c.secrets = {};
-		expect(loadConfig(writeConfig(c)).secrets).toEqual({});
-		c.secrets = { provider: "file" };
-		expect(loadConfig(writeConfig(c)).secrets).toEqual({ provider: "file" });
-		c.secrets = { provider: "systemd-creds" };
-		expect(loadConfig(writeConfig(c)).secrets).toEqual({ provider: "systemd-creds" });
-	});
-
-	it("rejects a path without the file provider (omitted → systemd-creds default)", () => {
-		const c = baseConfig();
-		c.secrets = { path: "/etc/gh-broker/secrets.json" };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path is only used by the "file" provider/);
-	});
-
-	it("rejects a path with the systemd-creds provider", () => {
-		const c = baseConfig();
-		c.secrets = { provider: "systemd-creds", path: "/etc/gh-broker/secrets.json" };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path is only used by the "file" provider/);
-	});
-
-	it("rejects an empty path (would be silently ignored by resolveSecretsPath)", () => {
-		const c = baseConfig();
-		c.secrets = { provider: "file", path: "" };
-		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path: must be a non-empty string/);
-	});
-});
-
-describe("loadConfig — full valid config", () => {
-	it("returns the normalized shape", () => {
-		const c = baseConfig();
-		c.defaultOwner = "cldmv";
-		c.app = { appId: 7, privateKey: "cred:app" };
-		const out = loadConfig(writeConfig(c));
-		expect(out).toEqual({
-			listen: "unix:/run/gh-broker/gh-broker.sock",
-			upstream: "https://api.githubcopilot.com/mcp/",
-			tools: [{ name: "get_me", mode: "read", custom: false, augment: false }],
-			owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
-			app: { appId: 7, privateKey: "cred:app" },
-			defaultOwner: "cldmv"
-		});
-	});
-});
-
-describe("indexTools", () => {
-	it("builds a name→rule map", () => {
-		const rules = [
-			{ name: "get_me", mode: "read" as const },
-			{ name: "create_pull_request", mode: "write" as const, custom: false }
-		];
-		const map = indexTools(rules);
-		expect(map.size).toBe(2);
-		expect(map.get("get_me")).toEqual({ name: "get_me", mode: "read" });
-		expect(map.get("create_pull_request")).toEqual({ name: "create_pull_request", mode: "write", custom: false });
-		expect(map.get("missing")).toBeUndefined();
-	});
-});
-
-describe("loadConfig — npm", () => {
-	it("is absent unless configured", () => {
-		expect(loadConfig(writeConfig(baseConfig())).npm).toBeUndefined();
-	});
-
-	it("leaves registry out when it is not set", () => {
-		expect(loadConfig(writeConfig({ ...baseConfig(), npm: { token: "cred:npm-token", scopes: ["@cldmv"] } })).npm).toEqual({ token: "cred:npm-token", scopes: ["@cldmv"] });
-	});
-
-	it("accepts a token ref, scopes, an https registry and token orgs", () => {
-		const npm = { token: "cred:npm-token", scopes: ["@cldmv"], registry: "https://registry.npmjs.org", tokenOrgs: ["cldmv"] };
-		expect(loadConfig(writeConfig({ ...baseConfig(), npm })).npm).toEqual(npm);
-	});
-
-	it.each([
-		[[], /config.npm: must be an object/],
-		[{ scopes: ["@cldmv"] }, /config.npm.token/],
-		[{ token: "npm_inline_secret", scopes: ["@cldmv"] }, /config.npm.token/],
-		[{ token: "cred:npm-token" }, /config.npm.scopes: must be a non-empty array/],
-		[{ token: "cred:npm-token", scopes: [] }, /config.npm.scopes: must be a non-empty array/],
-		[{ token: "cred:npm-token", scopes: ["cldmv"] }, /config.npm.scopes\[0\]/],
-		[{ token: "cred:npm-token", scopes: ["@CLDMV"] }, /config.npm.scopes\[0\]/],
-		[{ token: "cred:npm-token", scopes: ["@cldmv"], registry: "http://registry.npmjs.org" }, /config.npm.registry: must be an https URL/],
-		[{ token: "cred:npm-token", scopes: ["@cldmv"], tokenOrgs: "cldmv" }, /config.npm.tokenOrgs/],
-		[{ token: "cred:npm-token", scopes: ["@cldmv"], tokenOrgs: ["@cldmv"] }, /config.npm.tokenOrgs/]
-	] as Array<[unknown, RegExp]>)("rejects an invalid npm block (%#)", (npm, msg) => {
-		expect(() => loadConfig(writeConfig({ ...baseConfig(), npm }))).toThrow(msg);
-	});
-});
-
-describe("loadConfig — ghcr", () => {
-	const ghcr = { dropDir: "/srv/gh-broker/ghcr-drop", owners: { cldmv: { username: "Shinrai", credential: "cred:cldmv-packages", images: ["hoot"] } } };
-
-	it("parses a ghcr block", () => {
-		const c = loadConfig(writeConfig({ ...baseConfig(), ghcr }));
-		expect(c.ghcr?.owners.cldmv?.credential).toBe("cred:cldmv-packages");
-		expect(c.ghcr?.protectReleaseTags).toBe(true);
-	});
-
-	it("omits ghcr when absent and rejects a malformed block", () => {
-		expect(loadConfig(writeConfig(baseConfig())).ghcr).toBeUndefined();
-		expect(() => loadConfig(writeConfig({ ...baseConfig(), ghcr: { ...ghcr, dropDir: "/etc/x/y" } }))).toThrow(/config.ghcr.dropDir: may not be under \/etc/);
-	});
-
-	it("ships no owner-specific data in config.example.json, and it loads once an owner is added", () => {
-		const raw = JSON.parse(readFileSync(join(process.cwd(), "config.example.json"), "utf8"));
-		expect(Object.keys(raw).sort()).toEqual(["listen", "tools", "upstream"]);
-		const c = loadConfig(writeConfig({ ...raw, owners: { acme: { read: "cred:acme-read", write: "cred:acme-write" } } }));
-		expect(c.tools.filter((t) => t.name.startsWith("ghcr_")).map((t) => [t.name, t.mode, t.custom])).toEqual([
-			["ghcr_push", "write", true],
-			["ghcr_push_status", "read", true],
-			["ghcr_tags", "read", true]
-		]);
-	});
-
-	it("accepts the documentation-only config.sample.json merged onto the example tools", () => {
-		const raw = JSON.parse(readFileSync(join(process.cwd(), "config.example.json"), "utf8"));
-		const sample = JSON.parse(readFileSync(join(process.cwd(), "config.sample.json"), "utf8"));
-		const c = loadConfig(writeConfig({ ...sample, tools: raw.tools }));
-		expect(c.ghcr?.dropDir).toBe("/srv/gh-broker/ghcr-drop");
-		expect(c.defaultOwner).toBe("your-org");
-	});
-});

package/tests/credentials.test.vitest.mts

@@ -1,127 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { credentialPlan } from "../deploy/lib/credentials.mjs";
-
-type Opts = Parameters<typeof credentialPlan>[0];
-
-function plan(over: Partial<Opts> = {}, answers: string[] = []) {
-	const logs: string[] = [];
-	const promptHidden = vi.fn(async () => answers.shift() ?? "");
-	const mint = vi.fn(async () => "npm_MINTED");
-	const p = credentialPlan({
-		needed: ["cldmv-read", "cldmv-write", "npm-token"],
-		optional: new Set(["npm-token"]),
-		cliSecrets: {},
-		imported: {},
-		env: {},
-		existingFile: {},
-		decrypt: () => undefined,
-		mints: () => false,
-		mint,
-		appKeyName: undefined,
-		nonInteractive: false,
-		promptHidden,
-		log: (m: string) => logs.push(m),
-		...over
-	});
-	return { p, logs, promptHidden, mint };
-}
-
-/** A fake systemd-creds store: which .cred files exist, and what was encrypted. */
-function creds(existing: string[] = []) {
-	const files = new Set(existing);
-	const written: Record<string, string> = {};
-	return {
-		written,
-		io: {
-			exists: (n: string) => files.has(n),
-			encrypt: (n: string, v: string) => {
-				files.add(n);
-				written[n] = v;
-			}
-		}
-	};
-}
-
-describe("credentialPlan", () => {
-	it("refuses a --secret name the config does not use", () => {
-		expect(() => plan({ cliSecrets: { "cldmv-raed": "x" } })).toThrow(/--secret names no credential this config uses: cldmv-raed \(it uses: cldmv-read, cldmv-write, npm-token\)/);
-	});
-
-	it("takes an explicit value from --secret, then --secrets-file, then env", () => {
-		const env = { GH_BROKER_SECRET_CLDMV_READ: "from-env" };
-		expect(plan({ env }).p.explicit("cldmv-read")).toBe("from-env");
-		expect(plan({ env, imported: { "cldmv-read": "from-file" } }).p.explicit("cldmv-read")).toBe("from-file");
-		expect(plan({ env, imported: { "cldmv-read": "from-file" }, cliSecrets: { "cldmv-read": "from-cli" } }).p.explicit("cldmv-read")).toBe("from-cli");
-		expect(plan({ imported: { "cldmv-read": "" }, env: { GH_BROKER_SECRET_CLDMV_READ: "" } }).p.explicit("cldmv-read")).toBeUndefined();
-	});
-
-	it("resolves explicit → stored file → decrypt → prompt", async () => {
-		expect(await plan({ cliSecrets: { "cldmv-read": "cli" }, existingFile: { "cldmv-read": "old" } }).p.resolve("cldmv-read")).toBe("cli");
-		expect(await plan({ existingFile: { "cldmv-read": "old" }, decrypt: () => "dec" }).p.resolve("cldmv-read")).toBe("old");
-		const d = plan({ decrypt: () => "dec" });
-		expect(await d.p.resolve("cldmv-read")).toBe("dec");
-		expect(d.logs).toContain("  cldmv-read: migrated from systemd-creds");
-		const prompted = plan({}, ["typed"]);
-		expect(await prompted.p.resolve("cldmv-read")).toBe("typed");
-		expect(prompted.promptHidden).toHaveBeenCalledWith("  cldmv-read (input hidden): ");
-	});
-
-	it("fails a required credential that is missing or left empty", async () => {
-		await expect(plan({ nonInteractive: true }).p.resolve("cldmv-read")).rejects.toThrow(/missing credential "cldmv-read" — provide via --secret, --secrets-file or env GH_BROKER_SECRET_CLDMV_READ/);
-		await expect(plan({}, [""]).p.resolve("cldmv-read")).rejects.toThrow(/empty value for "cldmv-read"/);
-		await expect(plan({ appKeyName: "gh-app-key", needed: ["gh-app-key"] }).p.resolve("gh-app-key")).rejects.toThrow(/GitHub App private key/);
-	});
-
-	it("lets an optional credential be skipped, never failing", async () => {
-		expect(await plan({ nonInteractive: true }).p.resolve("npm-token")).toBeUndefined();
-		const i = plan({}, [""]);
-		expect(await i.p.resolve("npm-token")).toBeUndefined();
-		expect(i.promptHidden).toHaveBeenCalledWith(expect.stringMatching(/Enter to skip/));
-		expect(await plan({}, ["npm_typed"]).p.resolve("npm-token")).toBe("npm_typed");
-	});
-
-	it("creates the npm token when this run mints it, unless one is supplied", async () => {
-		const m = plan({ mints: (n) => n === "npm-token" });
-		expect(await m.p.resolve("npm-token")).toBe("npm_MINTED");
-		expect(m.p.replaces("npm-token")).toBe(true);
-		const given = plan({ mints: (n) => n === "npm-token", cliSecrets: { "npm-token": "npm_given" } });
-		expect(await given.p.resolve("npm-token")).toBe("npm_given");
-		expect(given.mint).not.toHaveBeenCalled();
-		await expect(plan({ mints: () => true, nonInteractive: true }).p.resolve("npm-token")).rejects.toThrow(/needs a browser login/);
-	});
-
-	describe("storeSystemd", () => {
-		it("keeps existing creds, encrypts new ones, and lists only what is stored", async () => {
-			const c = creds(["cldmv-read"]);
-			const { p, logs } = plan({}, ["write-typed", ""]);
-			const stored = await p.storeSystemd(c.io);
-			expect(stored).toEqual(["cldmv-read", "cldmv-write"]);
-			expect(c.written).toEqual({ "cldmv-write": "write-typed" });
-			expect(logs).toEqual(["  cldmv-read: existing systemd-creds kept", "  cldmv-write: encrypted (systemd-creds)", "  npm-token: not stored — its tools stay hidden until it is (re-run the installer to add it)"]);
-		});
-
-		it("rotates on an explicit value or a plaintext entry, and notes a replaced npm token", async () => {
-			const c = creds(["cldmv-read", "cldmv-write", "npm-token"]);
-			const { p, logs } = plan({ cliSecrets: { "cldmv-read": "new-read" }, existingFile: { "cldmv-write": "file-write" }, mints: (n) => n === "npm-token" });
-			expect(await p.storeSystemd(c.io)).toEqual(["cldmv-read", "cldmv-write", "npm-token"]);
-			expect(c.written).toEqual({ "cldmv-read": "new-read", "cldmv-write": "file-write", "npm-token": "npm_MINTED" });
-			expect(logs).toContain("  cldmv-read: rotated (systemd-creds)");
-			expect(logs.some((l) => /previous npm-token is still valid/.test(l))).toBe(true);
-			expect(logs.filter((l) => /previous/.test(l))).toHaveLength(1);
-		});
-	});
-
-	describe("storeFile", () => {
-		it("keeps stored values, fills missing ones, rotates on an explicit value, and skips an optional one", async () => {
-			const { p, logs } = plan({ needed: ["cldmv-read", "cldmv-write", "cldmv-new", "npm-token"], existingFile: { "cldmv-read": "old-read", "cldmv-write": "old-write" }, cliSecrets: { "cldmv-write": "new-write", "cldmv-new": "fresh" }, nonInteractive: true });
-			expect(await p.storeFile()).toEqual({ "cldmv-read": "old-read", "cldmv-write": "new-write", "cldmv-new": "fresh" });
-			expect(logs).toEqual(["  npm-token: not stored — its tools stay hidden until it is (re-run the installer to add it)"]);
-		});
-
-		it("replaces a stored npm token with a newly created one and says the old one is still live", async () => {
-			const { p, logs } = plan({ existingFile: { "cldmv-read": "r", "cldmv-write": "w", "npm-token": "npm_old" }, mints: (n) => n === "npm-token" });
-			expect(await p.storeFile()).toEqual({ "cldmv-read": "r", "cldmv-write": "w", "npm-token": "npm_MINTED" });
-			expect(logs.some((l) => /previous npm-token is still valid/.test(l))).toBe(true);
-		});
-	});
-});