@cldmv/gh-broker 0.8.0 → 0.10.0

package/tests/npm-setup.test.vitest.mts

@@ -1,196 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { createNpmToken, wantsOtp } from "../deploy/lib/npm-setup.mjs";
-
-const SESSION = "npm_SESSIONTOKEN";
-const NEW_TOKEN = "npm_NEWGRANULARTOKEN";
-const PASSWORD = "hunter2-secret";
-
-type Reply = { status: number; body?: unknown; headers?: Record<string, string> };
-const reply = (r: Reply) => ({
-	status: r.status,
-	headers: { get: (n: string) => r.headers?.[n.toLowerCase()] ?? null },
-	text: async () => (typeof r.body === "string" ? r.body : JSON.stringify(r.body ?? {}))
-});
-
-/** A scripted registry: each route pops its next reply. */
-function fakeNpm(script: { login?: Reply; polls?: Reply[]; tokens?: Reply[]; logout?: Reply | Error }) {
-	const calls: Array<{ method: string; url: string; headers: Record<string, string>; body?: any }> = [];
-	const polls = [...(script.polls ?? [{ status: 200, body: { token: SESSION } }])];
-	const tokens = [...(script.tokens ?? [{ status: 201, body: { token: NEW_TOKEN, expires: "2027-01-29T00:00:00.000Z", key: "k" } }])];
-	const fetch = vi.fn(async (url: string, init: any) => {
-		calls.push({ method: init.method, url, headers: init.headers, ...(init.body ? { body: JSON.parse(init.body) } : {}) });
-		const path = new URL(url).pathname;
-		if (path === "/-/v1/login") return reply(script.login ?? { status: 200, body: { loginUrl: "https://www.npmjs.com/login?next=/login/cli/abc", doneUrl: "https://registry.npmjs.org/-/v1/done?authId=abc" } });
-		if (path === "/-/v1/done") return reply(polls.shift() ?? { status: 500 });
-		if (path === "/-/npm/v1/tokens") return reply(tokens.shift() ?? { status: 500 });
-		if (path.startsWith("/-/user/token/")) {
-			if (script.logout instanceof Error) throw script.logout;
-			return reply(script.logout ?? { status: 200, body: { ok: true } });
-		}
-		throw new Error(`unexpected ${init.method} ${url}`);
-	});
-	return { fetch, calls };
-}
-
-/** Every answer, the OTP included, is read through the hidden prompt, in call order. */
-function prompts(answers: string[]) {
-	return { promptHidden: vi.fn(async () => answers.shift() ?? "") };
-}
-
-const run = (npm: ReturnType<typeof fakeNpm>, p = prompts([PASSWORD, "111111"]), extra: Record<string, unknown> = {}) => {
-	const logs: string[] = [];
-	const done = createNpmToken({ scopes: ["@cldmv"], tokenName: "gh-broker test", fetch: npm.fetch as any, log: (m: string) => logs.push(m), ...p, ...extra });
-	return { done, logs, p };
-};
-
-describe("createNpmToken", () => {
-	it("logs in through the web flow, creates a scoped read-write token without 2FA bypass, and revokes the session", async () => {
-		const npm = fakeNpm({});
-		const { done, logs } = run(npm);
-		await expect(done).resolves.toEqual({ token: NEW_TOKEN, expires: "2027-01-29T00:00:00.000Z" });
-		expect(logs.join("\n")).toContain("https://www.npmjs.com/login?next=/login/cli/abc");
-
-		const create = npm.calls.find((c) => c.url.endsWith("/-/npm/v1/tokens"))!;
-		expect(create.headers.authorization).toBe(`Bearer ${SESSION}`);
-		expect(create.headers["npm-otp"]).toBe("111111");
-		expect(create.body).toEqual({ name: "gh-broker test", scopes: ["@cldmv"], packages_and_scopes_permission: "read-write", expires: 90, password: PASSWORD });
-		expect(create.body).not.toHaveProperty("bypass_2fa");
-
-		const logout = npm.calls.at(-1)!;
-		expect(logout.method).toBe("DELETE");
-		expect(logout.url).toBe(`https://registry.npmjs.org/-/user/token/${SESSION}`);
-		expect(logs).toContain("  npm login session revoked");
-	});
-
-	it("waits while the login is pending, honouring retry-after", async () => {
-		vi.useFakeTimers();
-		try {
-			const npm = fakeNpm({ polls: [{ status: 202, headers: { "retry-after": "2" } }, { status: 202 }, { status: 200, body: { token: SESSION } }] });
-			const { done } = run(npm);
-			await vi.advanceTimersByTimeAsync(3000);
-			await expect(done).resolves.toMatchObject({ token: NEW_TOKEN });
-			expect(npm.calls.filter((c) => c.url.includes("/-/v1/done"))).toHaveLength(3);
-		} finally {
-			vi.useRealTimers();
-		}
-	});
-
-	it("gives up when the login is never approved", async () => {
-		const npm = fakeNpm({ polls: Array.from({ length: 5 }, () => ({ status: 202, headers: { "retry-after": "0.001" } })) });
-		await expect(run(npm, undefined, { pollTimeoutMs: -1 }).done).rejects.toThrow(/timed out waiting for approval/);
-	});
-
-	it("re-prompts for the OTP when npm rejects it", async () => {
-		const npm = fakeNpm({ tokens: [{ status: 401, headers: { "www-authenticate": "OTP" } }, { status: 201, body: { token: NEW_TOKEN } }] });
-		const p = prompts([PASSWORD, "111111", "222222"]);
-		await expect(run(npm, p).done).resolves.toEqual({ token: NEW_TOKEN });
-		const creates = npm.calls.filter((c) => c.url.endsWith("/-/npm/v1/tokens"));
-		expect(creates.map((c) => c.headers["npm-otp"])).toEqual(["111111", "222222"]);
-		// password + first OTP + the replacement OTP: the password is not asked for again
-		expect(p.promptHidden).toHaveBeenCalledTimes(3);
-	});
-
-	it("re-prompts for the password (and a new OTP) when npm rejects it", async () => {
-		const npm = fakeNpm({ tokens: [{ status: 401, body: { error: "invalid password" } }, { status: 201, body: { token: NEW_TOKEN } }] });
-		const p = prompts([PASSWORD, "111111", "right-password", "222222"]);
-		await expect(run(npm, p).done).resolves.toEqual({ token: NEW_TOKEN });
-		expect(npm.calls.filter((c) => c.url.endsWith("/-/npm/v1/tokens")).map((c) => c.body.password)).toEqual([PASSWORD, "right-password"]);
-	});
-
-	it("stops after three attempts and still revokes the session", async () => {
-		const otpNo = { status: 401, headers: { "www-authenticate": "OTP" } };
-		const npm = fakeNpm({ tokens: [otpNo, otpNo, { status: 401, body: { error: "You must provide a one-time pass." } }] });
-		const { done, logs } = run(npm, prompts([PASSWORD, "1", "2", "3"]));
-		await expect(done).rejects.toThrow(/npm token creation failed \(HTTP 401\)/);
-		expect(npm.calls.at(-1)!.method).toBe("DELETE");
-		expect(logs).toContain("  npm login session revoked");
-	});
-
-	it("fails on an unexpected registry error, revoking the session", async () => {
-		const npm = fakeNpm({ tokens: [{ status: 400, body: { message: "expires must be at most 90 days" } }] });
-		await expect(run(npm).done).rejects.toThrow(/HTTP 400\): expires must be at most 90 days/);
-		expect(npm.calls.at(-1)!.method).toBe("DELETE");
-	});
-
-	it("fails when npm returns no token", async () => {
-		await expect(run(fakeNpm({ tokens: [{ status: 201, body: {} }] })).done).rejects.toThrow(/did not return it/);
-	});
-
-	it("reports an unrevokable session as a note, not a failure", async () => {
-		const a = run(fakeNpm({ logout: { status: 500 } }));
-		await expect(a.done).resolves.toMatchObject({ token: NEW_TOKEN });
-		expect(a.logs.at(-1)).toMatch(/could not revoke the npm login session \(HTTP 500\)/);
-		const b = run(fakeNpm({ logout: new Error("socket hang up") }));
-		await expect(b.done).resolves.toMatchObject({ token: NEW_TOKEN });
-		expect(b.logs.at(-1)).toMatch(/could not revoke the npm login session \(socket hang up\)/);
-	});
-
-	it.each([
-		[{ status: 404, body: "Not Found" }, /could not start \(HTTP 404\): Not Found/],
-		[{ status: 200, body: { loginUrl: "http://insecure", doneUrl: "https://x" } }, /could not start/]
-	] as Array<[Reply, RegExp]>)("fails when the web login cannot start (%#)", async (login, msg) => {
-		const npm = fakeNpm({ login });
-		await expect(run(npm).done).rejects.toThrow(msg);
-		expect(npm.calls).toHaveLength(1);
-	});
-
-	it.each([
-		[{ status: 200, body: {} }, /finished without a session/],
-		[{ status: 403, body: { error: "denied" } }, /web login failed \(HTTP 403\): denied/]
-	] as Array<[Reply, RegExp]>)("fails when the login poll goes wrong (%#)", async (poll, msg) => {
-		await expect(run(fakeNpm({ polls: [poll] })).done).rejects.toThrow(msg);
-	});
-
-	it("never logs the password, the OTP or any token", async () => {
-		const { done, logs } = run(fakeNpm({}));
-		await done;
-		const all = logs.join("\n");
-		for (const secret of [PASSWORD, "111111", SESSION, NEW_TOKEN]) expect(all).not.toContain(secret);
-	});
-
-	it("adds org read-write only when orgs are given", async () => {
-		const npm = fakeNpm({});
-		await run(npm, undefined, { orgs: ["cldmv"] }).done;
-		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.body).toMatchObject({ scopes: ["@cldmv"], orgs: ["cldmv"], orgs_permission: "read-write" });
-	});
-
-	it("rejects a login URL that does not parse", async () => {
-		const npm = fakeNpm({ login: { status: 200, body: { loginUrl: "not a url", doneUrl: "https://registry.npmjs.org/-/v1/done" } } });
-		await expect(run(npm).done).rejects.toThrow(/could not start/);
-	});
-
-	it("sends no npm-otp header when the code is left empty", async () => {
-		const npm = fakeNpm({});
-		await run(npm, prompts([PASSWORD, ""])).done;
-		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.headers).not.toHaveProperty("npm-otp");
-	});
-
-	it("uses the global fetch when none is passed", async () => {
-		const npm = fakeNpm({});
-		vi.stubGlobal("fetch", npm.fetch);
-		try {
-			const logs: string[] = [];
-			await expect(createNpmToken({ scopes: ["@cldmv"], tokenName: "t", log: (m: string) => logs.push(m), ...prompts([PASSWORD, "111111"]) })).resolves.toMatchObject({ token: NEW_TOKEN });
-		} finally {
-			vi.unstubAllGlobals();
-		}
-	});
-
-	it("uses a custom registry and token lifetime", async () => {
-		const npm = fakeNpm({ login: { status: 200, body: { loginUrl: "https://npm.example.test/login", doneUrl: "https://npm.example.test/-/v1/done?x" } } });
-		await run(npm, undefined, { registry: "https://npm.example.test/", days: 30 }).done;
-		expect(npm.calls[0]!.url).toBe("https://npm.example.test/-/v1/login");
-		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.body.expires).toBe(30);
-	});
-});
-
-describe("wantsOtp", () => {
-	const res = (status: number, h: Record<string, string> = {}) => ({ status, headers: { get: (n: string) => h[n] ?? null } });
-	it("recognises npm's OTP signals and nothing else", () => {
-		expect(wantsOtp(res(401, { "www-authenticate": "OTP" }), {})).toBe(true);
-		expect(wantsOtp(res(401), { error: "You must provide a one-time pass." })).toBe(true);
-		expect(wantsOtp(res(401), { error: "bad password" })).toBe(false);
-		expect(wantsOtp(res(401), undefined)).toBe(false);
-		expect(wantsOtp(res(403, { "www-authenticate": "OTP" }), {})).toBe(false);
-	});
-});

package/tests/paths.test.vitest.mts

@@ -1,57 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import { configDir, resolveConfigPath, resolveSecretsPath } from "../src/paths.ts";
-
-describe("paths", () => {
-	beforeEach(() => {
-		// The imported `env` binding is the live process.env object, so mutating keys
-		// (not reassigning) is reflected. Clear the ones under test.
-		delete process.env.GH_BROKER_CONFIG;
-		delete process.env.GH_BROKER_SECRETS;
-		delete process.env.GH_BROKER_CONFIG_DIR;
-	});
-
-	it("configDir defaults to /etc/gh-broker on linux (the test host)", () => {
-		expect(configDir()).toBe("/etc/gh-broker");
-	});
-
-	it("configDir honors the GH_BROKER_CONFIG_DIR override", () => {
-		process.env.GH_BROKER_CONFIG_DIR = "/opt/cfg";
-		expect(configDir()).toBe("/opt/cfg");
-	});
-
-	it("resolveConfigPath precedence: explicit > env > default", () => {
-		expect(resolveConfigPath("/explicit.json")).toBe("/explicit.json");
-		process.env.GH_BROKER_CONFIG = "/env.json";
-		expect(resolveConfigPath()).toBe("/env.json");
-		delete process.env.GH_BROKER_CONFIG;
-		expect(resolveConfigPath()).toBe("/etc/gh-broker/config.json");
-	});
-
-	it("resolveSecretsPath precedence: explicit > env > default", () => {
-		expect(resolveSecretsPath("/explicit-s.json")).toBe("/explicit-s.json");
-		process.env.GH_BROKER_SECRETS = "/env-s.json";
-		expect(resolveSecretsPath()).toBe("/env-s.json");
-		delete process.env.GH_BROKER_SECRETS;
-		expect(resolveSecretsPath()).toBe("/etc/gh-broker/secrets.json");
-	});
-
-	it("configDir maps darwin and win32 platforms", async () => {
-		vi.resetModules();
-		vi.doMock("node:process", () => ({ platform: "darwin", env: {} }));
-		const mac = await import("../src/paths.ts");
-		expect(mac.configDir()).toBe("/Library/Application Support/gh-broker");
-
-		vi.resetModules();
-		vi.doMock("node:process", () => ({ platform: "win32", env: { ProgramData: "C:/PD" } }));
-		const win = await import("../src/paths.ts");
-		expect(win.configDir()).toContain("gh-broker");
-
-		vi.resetModules();
-		vi.doMock("node:process", () => ({ platform: "win32", env: {} }));
-		const winDefault = await import("../src/paths.ts");
-		expect(winDefault.configDir()).toContain("C:\\ProgramData");
-
-		vi.doUnmock("node:process");
-		vi.resetModules();
-	});
-});

package/tests/prompt.test.vitest.mts

@@ -1,128 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-// Stand-ins for process.stdin / process.stdout so the raw-mode reader can be driven by hand.
-const h = vi.hoisted(() => ({ stdin: null as any, stdout: null as any }));
-vi.mock("node:process", async () => {
-	const { EventEmitter } = await import("node:events");
-	class FakeStdin extends EventEmitter {
-		isTTY = true;
-		raw: boolean[] = [];
-		paused = false;
-		setRawMode(v: boolean) {
-			this.raw.push(v);
-		}
-		resume() {
-			this.paused = false;
-		}
-		pause() {
-			this.paused = true;
-		}
-	}
-	h.stdin = new FakeStdin();
-	h.stdout = { out: "", write(s: string) { this.out += s; return true; } };
-	return { stdin: h.stdin, stdout: h.stdout };
-});
-
-import { promptLine, promptHidden, confirm, choose } from "../deploy/lib/prompt.mjs";
-
-const type = (s: string) => h.stdin.emit("data", Buffer.from(s, "utf8"));
-
-beforeEach(() => {
-	h.stdout.out = "";
-	h.stdin.removeAllListeners("data");
-	h.stdin.raw = [];
-	h.stdin.isTTY = true;
-});
-
-describe("promptLine / promptHidden", () => {
-	it("echoes typed characters and returns the trimmed line on Enter", async () => {
-		const p = promptLine("name? ");
-		type("  ab");
-		type("c \r");
-		expect(await p).toBe("abc");
-		expect(h.stdout.out).toBe("name?   abc \n");
-		expect(h.stdin.raw).toEqual([true, false]);
-		expect(h.stdin.paused).toBe(true);
-		expect(h.stdin.listenerCount("data")).toBe(0);
-	});
-
-	it("does not echo hidden input", async () => {
-		const p = promptHidden("secret: ");
-		type("hunter2\n");
-		expect(await p).toBe("hunter2");
-		expect(h.stdout.out).toBe("secret: \n");
-	});
-
-	it("handles Backspace (DEL and BS), including on empty input", async () => {
-		const p = promptLine("? ");
-		type("\x7f"); // nothing to delete
-		type("abc\x7f\x08d\n");
-		expect(await p).toBe("ad");
-		expect(h.stdout.out).toContain("\b \b");
-
-		const q = promptHidden("? ");
-		h.stdout.out = "";
-		type("ab\x7f\n");
-		expect(await q).toBe("a");
-		expect(h.stdout.out).not.toContain("\b \b");
-	});
-
-	it("returns what was typed on Ctrl-D, and rejects on Ctrl-C", async () => {
-		const p = promptLine("? ");
-		type("xy\x04");
-		expect(await p).toBe("xy");
-
-		const q = promptLine("? ");
-		type("xy\x03");
-		await expect(q).rejects.toThrow("aborted");
-	});
-
-	it("skips raw mode when stdin is not a TTY", async () => {
-		h.stdin.isTTY = false;
-		const p = promptLine("? ");
-		type("ok\n");
-		expect(await p).toBe("ok");
-		expect(h.stdin.raw).toEqual([]);
-	});
-});
-
-describe("confirm", () => {
-	it.each([
-		["y\n", true],
-		["YES\n", true],
-		["n\n", false],
-		["\n", false],
-		["yeah\n", false]
-	])("%j -> %s", async (input, expected) => {
-		const p = confirm("sure?");
-		type(input);
-		expect(await p).toBe(expected);
-		expect(h.stdout.out).toContain("sure? [y/N] ");
-	});
-});
-
-describe("choose", () => {
-	const opts = [
-		{ key: "a", label: "Alpha" },
-		{ key: "b", label: "Beta" }
-	];
-
-	it("lists the options and returns the chosen key", async () => {
-		const p = choose("pick", opts);
-		type("2\n");
-		expect(await p).toBe("b");
-		expect(h.stdout.out).toContain("pick\n  1) Alpha\n  2) Beta\n");
-	});
-
-	it("uses the default on empty input, and falls back to it on invalid input", async () => {
-		let p = choose("pick", opts, 2);
-		type("\n");
-		expect(await p).toBe("b");
-		p = choose("pick", opts);
-		type("9\n");
-		expect(await p).toBe("a");
-		p = choose("pick", opts);
-		type("zz\n");
-		expect(await p).toBe("a");
-	});
-});

package/tests/release-prs.test.vitest.mts

@@ -1,247 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { reportReleasePrs, parseReleaseVersion, changelogPaths, REPORT_RELEASE_PRS_SCHEMA } from "../src/verbs/report_release_prs.ts";
-
-type Handler = (route: string, params: any) => Promise<{ data: unknown; headers?: Record<string, string> }>;
-
-function octokitWith(handler: Handler): any {
-	return { request: vi.fn(handler) };
-}
-
-const status = (code: number, message = "x") => Object.assign(new Error(message), { status: code });
-
-const hit = (repo: string, number: number, title: string, over: Record<string, unknown> = {}) => ({
-	number,
-	title,
-	html_url: `https://github.com/CLDMV/${repo}/pull/${number}`,
-	repository_url: `https://api.github.com/repos/CLDMV/${repo}`,
-	...over
-});
-
-const search = (items: unknown[], over: Record<string, unknown> = {}) => ({ data: { total_count: items.length, incomplete_results: false, items, ...over }, headers: {} });
-
-const pull = (head = "next", base = "master", draft = false) => ({ data: { head: { ref: head }, base: { ref: base }, draft }, headers: {} });
-
-describe("parseReleaseVersion", () => {
-	it("reads the version out of a release title, with or without the v", () => {
-		expect(parseReleaseVersion("release: v0.4.2 - bump the patch group")).toBe("0.4.2");
-		expect(parseReleaseVersion("release: 1.0.0")).toBe("1.0.0");
-		expect(parseReleaseVersion("Release: v2.10.13-rc.1 - x")).toBe("2.10.13-rc.1");
-	});
-
-	it("returns null when the title carries no version", () => {
-		expect(parseReleaseVersion("chore: tidy up")).toBeNull();
-		expect(parseReleaseVersion("release: soon")).toBeNull();
-	});
-});
-
-describe("changelogPaths", () => {
-	it("lists both changelog/ and changelogs/ under the major folder", () => {
-		expect(changelogPaths("0.4.2")).toEqual(["docs/changelog/v0/v0.4.2.md", "docs/changelogs/v0/v0.4.2.md"]);
-		expect(changelogPaths("12.3.4")).toEqual(["docs/changelog/v12/v12.3.4.md", "docs/changelogs/v12/v12.3.4.md"]);
-	});
-});
-
-describe("reportReleasePrs", () => {
-	it("searches the org once for open release-labelled PRs", async () => {
-		const octokit = octokitWith(async () => search([]));
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(octokit.request).toHaveBeenCalledTimes(1);
-		expect(octokit.request).toHaveBeenCalledWith("GET /search/issues", { q: "org:cldmv is:pr is:open label:release", per_page: 100 });
-		expect(out).toEqual({ scanned: { releasePrs: 0 }, summary: { ready: 0, needsChangelog: 0, unknownVersion: 0 }, releasePrs: [] });
-	});
-
-	it("scopes the search to one repo when repo is given", async () => {
-		const octokit = octokitWith(async () => search([]));
-		await reportReleasePrs(octokit, { owner: "cldmv", repo: "gh-broker" });
-		expect(octokit.request.mock.calls[0]![1].q).toBe("repo:cldmv/gh-broker is:pr is:open label:release");
-	});
-
-	it("marks a PR ready when the changelog exists at the PR head commit, and stops at the first path found", async () => {
-		const octokit = octokitWith(async (route, params) => {
-			if (route === "GET /search/issues") return search([hit("gh-broker", 88, "release: v0.4.2 - stuff")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull("next", "master");
-			if (route === "GET /repos/{owner}/{repo}/contents/{path}") {
-				expect(params).toMatchObject({ owner: "CLDMV", repo: "gh-broker", ref: "next", path: "docs/changelog/v0/v0.4.2.md" });
-				return { data: { type: "file" }, headers: {} };
-			}
-			throw new Error(`unexpected route ${route}`);
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.releasePrs).toEqual([
-			{
-				repo: "CLDMV/gh-broker",
-				pull: 88,
-				url: "https://github.com/CLDMV/gh-broker/pull/88",
-				title: "release: v0.4.2 - stuff",
-				version: "0.4.2",
-				head: "next",
-				base: "master",
-				draft: false,
-				status: "ready",
-				changelogPath: "docs/changelog/v0/v0.4.2.md"
-			}
-		]);
-		expect(out.summary).toEqual({ ready: 1, needsChangelog: 0, unknownVersion: 0 });
-		expect(octokit.request).toHaveBeenCalledTimes(3);
-	});
-
-	it("falls through to docs/changelogs/ when docs/changelog/ 404s", async () => {
-		const octokit = octokitWith(async (route, params) => {
-			if (route === "GET /search/issues") return search([hit("r", 1, "release: v1.2.3")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			if (params.path === "docs/changelog/v1/v1.2.3.md") throw status(404, "Not Found");
-			return { data: {}, headers: {} };
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.releasePrs[0]).toMatchObject({ status: "ready", changelogPath: "docs/changelogs/v1/v1.2.3.md" });
-	});
-
-	it("marks a PR needs-changelog and lists the paths it checked when neither exists", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("r", 4, "release: v0.1.0 - x")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			throw status(404, "Not Found");
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.releasePrs[0]).toMatchObject({ status: "needs-changelog", version: "0.1.0", checkedPaths: ["docs/changelog/v0/v0.1.0.md", "docs/changelogs/v0/v0.1.0.md"] });
-		expect(out.releasePrs[0]).not.toHaveProperty("changelogPath");
-		expect(out.summary).toEqual({ ready: 0, needsChangelog: 1, unknownVersion: 0 });
-	});
-
-	it("marks a PR unknown-version, without looking for a changelog, when the title has no version", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("r", 6, "Release candidate")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull("hotfixes", "master");
-			throw new Error(`unexpected route ${route}`);
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.releasePrs[0]).toMatchObject({ status: "unknown-version", version: null, head: "hotfixes" });
-		expect(octokit.request).toHaveBeenCalledTimes(2);
-	});
-
-	it("covers hotfixes release PRs across several repos and counts each status", async () => {
-		const octokit = octokitWith(async (route, params) => {
-			if (route === "GET /search/issues") {
-				return search([hit("a", 1, "release: v1.0.1 - x"), hit("b", 2, "release: v2.0.0 - y"), hit("c", 3, "no version here")]);
-			}
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull(params.repo === "a" ? "hotfixes" : "next");
-			if (params.repo === "a") return { data: {}, headers: {} };
-			throw status(404);
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.summary).toEqual({ ready: 1, needsChangelog: 1, unknownVersion: 1 });
-		expect(out.releasePrs.map((p) => `${p.repo}:${p.head}:${p.status}`)).toEqual(["CLDMV/a:hotfixes:ready", "CLDMV/b:next:needs-changelog", "CLDMV/c:next:unknown-version"]);
-	});
-
-	it("onlyMissing drops ready PRs from the list but keeps the summary counts", async () => {
-		const octokit = octokitWith(async (route, params) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.1"), hit("b", 2, "release: v2.0.0")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			if (params.repo === "a") return { data: {}, headers: {} };
-			throw status(404);
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv", onlyMissing: true });
-		expect(out.releasePrs.map((p) => p.repo)).toEqual(["CLDMV/b"]);
-		expect(out.summary).toEqual({ ready: 1, needsChangelog: 1, unknownVersion: 0 });
-	});
-
-	it("reports draft from the pull, falling back to the search hit", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0", { draft: true })]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return { data: { head: { ref: "next" }, base: { ref: "master" } }, headers: {} };
-			return { data: {}, headers: {} };
-		});
-		expect((await reportReleasePrs(octokit, { owner: "cldmv" })).releasePrs[0]!.draft).toBe(true);
-		const plain = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return { data: { head: { ref: "next" }, base: { ref: "master" } }, headers: {} };
-			return { data: {}, headers: {} };
-		});
-		expect((await reportReleasePrs(plain, { owner: "cldmv" })).releasePrs[0]!.draft).toBe(false);
-	});
-
-	it("flags max-results when the search has more hits than one page returned", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")], { total_count: 150 });
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			return { data: {}, headers: {} };
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.truncated).toBe(true);
-		expect(out.truncatedReason).toBe("max-results");
-		expect(out.releasePrs).toHaveLength(1);
-	});
-
-	it("flags incomplete-search when GitHub says the search timed out", async () => {
-		const octokit = octokitWith(async () => search([], { incomplete_results: true }));
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.truncatedReason).toBe("incomplete-search");
-	});
-
-	it("returns what it has, flagged max-api-calls, when the call budget runs out", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0"), hit("b", 2, "release: v2.0.0")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			return { data: {}, headers: {} };
-		});
-		// search (1) + pull (2) + contents (3) for the first PR, then the second PR's pull lookup is over budget.
-		const out = await reportReleasePrs(octokit, { owner: "cldmv", maxApiCalls: 3 });
-		expect(out.truncated).toBe(true);
-		expect(out.truncatedReason).toBe("max-api-calls");
-		expect(out.releasePrs).toHaveLength(1);
-		expect(out.scanned).toEqual({ releasePrs: 2 });
-	});
-
-	it("returns partial results with retryAfterSeconds when rate limited", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")]);
-			throw Object.assign(new Error("Forbidden"), { status: 403, response: { headers: { "retry-after": "20" } } });
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.truncatedReason).toBe("rate-limited");
-		expect(out.retryAfterSeconds).toBe(20);
-		expect(out.releasePrs).toEqual([]);
-	});
-
-	it("stops with rate-limited when the changelog lookup itself is rate limited", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			throw status(429, "Too Many Requests");
-		});
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.truncatedReason).toBe("rate-limited");
-	});
-
-	it("omits retryAfterSeconds when GitHub sent none", async () => {
-		const octokit = octokitWith(async () => { throw status(429, "Too Many Requests"); });
-		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
-		expect(out.truncatedReason).toBe("rate-limited");
-		expect(out).not.toHaveProperty("retryAfterSeconds");
-	});
-
-	it("propagates a non-404 error from the changelog lookup instead of calling it missing", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")]);
-			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
-			throw status(500, "server exploded");
-		});
-		await expect(reportReleasePrs(octokit, { owner: "cldmv" })).rejects.toThrow("server exploded");
-	});
-
-	it("propagates a plain permission 403 on the search", async () => {
-		const octokit = octokitWith(async () => { throw status(403, "Resource not accessible by personal access token"); });
-		await expect(reportReleasePrs(octokit, { owner: "cldmv" })).rejects.toThrow("Resource not accessible");
-	});
-
-	it("clamps maxApiCalls to the hard cap", async () => {
-		const octokit = octokitWith(async () => search([]));
-		await reportReleasePrs(octokit, { owner: "cldmv", maxApiCalls: 999999 });
-		expect(octokit.request).toHaveBeenCalledTimes(1);
-	});
-
-	it("advertises a valid schema", () => {
-		expect(REPORT_RELEASE_PRS_SCHEMA.required).toEqual(["owner"]);
-		expect(REPORT_RELEASE_PRS_SCHEMA.additionalProperties).toBe(false);
-	});
-});