@decohere/ci-tools 0.0.1-dev.125 → 0.0.1-dev.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.125",
+  "version": "0.0.1-dev.127",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -43,7 +43,6 @@
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
     "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
-    "./github/credential-nudge": "./src/github/credential-nudge.mjs",
     "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs",
     "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs",
     "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"

package/src/bench/bench.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * bench.mjs — run the benchmark suites and compare against the last saved run (#660).
+ * bench.mjs — run the benchmark suites and compare against the last saved run.
  *
  * Usage:
  *   pnpm bench                          — run every suite and compare, do not save
@@ -41,7 +41,7 @@ import {
 } from "./history.mjs";
 
 const WORKSPACE_ROOT = process.cwd();
-// BENCH_HISTORY_FILE lets the nightly job save each comparison round to its own file (#667).
+// BENCH_HISTORY_FILE lets the nightly job save each comparison round to its own file.
 const HISTORY_FILE =
 	process.env.BENCH_HISTORY_FILE ??
 	join(WORKSPACE_ROOT, "projects/ci-tools/dist/ci/bench/bench-history.json");

package/src/bench/history.mjs

@@ -1,6 +1,6 @@
 /**
  * Benchmark history: the results of each `pnpm bench` run, kept per machine so runs are only
- * compared like for like (#660). Pure functions over plain data; bench.mjs does the I/O.
+ * compared like for like. Pure functions over plain data; bench.mjs does the I/O.
  *
  * Shape (version 2):
  *   { version: 2, contexts: { [contextId]: { context, runs: [{ date, sha, results }] } } }
@@ -118,7 +118,7 @@ export function previousRun(history, id) {
 	return history.contexts[id]?.runs[0];
 }
 
-/** Machine types with no run for this long are dropped: CI runner types come and go (#667). */
+/** Machine types with no run for this long are dropped: CI runner types come and go. */
 export const STALE_AFTER_DAYS = 30;
 
 /** The history without machine types whose newest run is older than `days` before `now`. */
@@ -205,7 +205,7 @@ export function formatComparison(rows) {
 }
 
 /**
- * When a benchmark counts as slower (#667): the nightly job benchmarks tonight's commit (head)
+ * When a benchmark counts as slower: the nightly job benchmarks tonight's commit (head)
  * and the one the previous nightly measured (base) on the same runner, alternating head, base,
  * head, base. A benchmark regressed when head's median beats base's by more than `threshold`
  * in every round, so one noisy round files nothing.

package/src/bench/nightly.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * nightly.mjs — the nightly benchmark run (#667). Benchmarks tonight's commit (head) and the
+ * nightly.mjs — the nightly benchmark run. Benchmarks tonight's commit (head) and the
  * commit the previous nightly measured (base) on this runner, alternating head, base, head,
  * base, so the comparison never mixes CPU models. Then:
  *

package/src/bench/regression-issue.mjs

@@ -1,5 +1,5 @@
 /**
- * The GitHub issue for a benchmark that got slower (#660, #667): one open issue per benchmark,
+ * The GitHub issue for a benchmark that got slower: one open issue per benchmark,
  * found again by its exact title and updated in place while the regression lasts.
  */
 

package/src/github/smoke-create-launcher.mjs

@@ -9,10 +9,10 @@ import { pathToFileURL } from "node:url";
  * Run `npx @decohere/create@version --help` from an empty temp directory.
  * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
  * `@decohere/create` into the workspace tree and npm's npx misses the bin.
+ * No token: the packages are public, so this installs the launcher the way a user does.
  *
  * @param {{
  *   createVersion: string,
- *   authToken: string,
  *   mkdtempSync?: typeof mkdtempSync,
  *   writeFileSync?: typeof writeFileSync,
  *   spawnSync?: typeof spawnSync,
@@ -22,13 +22,9 @@ import { pathToFileURL } from "node:url";
  */
 export function runCreateLauncherSmoke(options) {
 	const version = options.createVersion?.trim() ?? "";
-	const token = options.authToken?.trim() ?? "";
 	if (!version) {
 		throw new Error("CREATE_VERSION is required");
 	}
-	if (!token) {
-		throw new Error("NODE_AUTH_TOKEN is required");
-	}
 
 	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
 	const writeFile = options.writeFileSync ?? writeFileSync;
@@ -37,18 +33,11 @@ export function runCreateLauncherSmoke(options) {
 
 	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
 	const npmrc = join(workDir, ".npmrc");
-	writeFile(
-		npmrc,
-		`@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`,
-	);
+	writeFile(npmrc, "@decohere:registry=https://registry.npmjs.org/\n");
 
 	const result = spawn("npx", ["--yes", `@decohere/create@${version}`, "--help"], {
 		cwd: workDir,
-		env: {
-			...process.env,
-			NPM_CONFIG_USERCONFIG: npmrc,
-			NODE_AUTH_TOKEN: token,
-		},
+		env: { ...process.env, NPM_CONFIG_USERCONFIG: npmrc },
 		stdio: options.stdio ?? "inherit",
 	});
 
@@ -64,7 +53,6 @@ const isCli =
 if (isCli) {
 	const { status } = runCreateLauncherSmoke({
 		createVersion: process.env.CREATE_VERSION ?? "",
-		authToken: process.env.NODE_AUTH_TOKEN ?? "",
 	});
 	process.exit(status);
 }

package/src/lib/github-issue.mjs

@@ -47,7 +47,7 @@ export function upsertIssue(options, run = gh) {
 			"--limit",
 			"200",
 			"--search",
-			// Quoted: GitHub's search can't match a title like `security(ci): …` unquoted (#681).
+			// Quoted: GitHub's search can't match a title like `security(ci): …` unquoted.
 			// The exact-title match in pickIssue still decides.
 			`"${title.replaceAll('"', "")}" in:title`,
 			"--json",

package/src/pages/bench-page.mjs

@@ -1,5 +1,5 @@
 /**
- * The benchmark page on Pages (#660): a trend chart per benchmark and a table of the latest
+ * The benchmark page on Pages: a trend chart per benchmark and a table of the latest
  * results, from the version 2 history (../bench/history.mjs). Static HTML and inline SVG, so the
  * page needs no script and no third-party chart library.
  */
@@ -51,7 +51,7 @@ function machineName(context) {
 
 /**
  * Contexts with a run within STALE_AFTER_DAYS of the newest run anywhere, most recently run first:
- * CI runner types come and go, and one that stopped appearing would otherwise keep a line (#667).
+ * CI runner types come and go, and one that stopped appearing would otherwise keep a line.
  */
 function activeContexts(history) {
 	const newest = Math.max(

package/tests/github/npm-bootstrap.test.mjs

@@ -86,7 +86,7 @@ describe("npm-bootstrap", () => {
 		expect(registry.calls).toEqual(["whoami", "trust list @decohere/scribe-console --json"]);
 	});
 
-	/** #700 — `npm trust` rejects `--otp`: the code goes through the environment. */
+	/** `npm trust` rejects `--otp`: the code goes through the environment. */
 	it("never passes the code as an argument, and lets npm ask when none is given", async () => {
 		seedWorkspace();
 		const withCode = fakeNpm({ published: ["@decohere/scribe"] });

package/tests/github/smoke-create-launcher.test.mjs

@@ -15,7 +15,6 @@ describe("runCreateLauncherSmoke", () => {
 
 		const result = runCreateLauncherSmoke({
 			createVersion: "0.0.1-dev.80",
-			authToken: "tok",
 			tmpdir: () => "/tmp",
 			mkdtempSync: (prefix) => `${prefix}abc`,
 			writeFileSync: (path, body) => {
@@ -38,18 +37,17 @@ describe("runCreateLauncherSmoke", () => {
 		expect(written).toEqual([
 			{
 				path: "/tmp/decohere-create-smoke-abc/.npmrc",
-				body: "@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=tok\n",
+				body: "@decohere:registry=https://registry.npmjs.org/\n",
 			},
 		]);
+		// The packages are public: the smoke installs them the way a user does, with no token.
+		expect(calls[0].opts.env.NODE_AUTH_TOKEN).toBeUndefined();
 	});
 
-	it("fails closed without version or token", () => {
-		expect(() => runCreateLauncherSmoke({ createVersion: "", authToken: "tok" })).toThrow(
+	it("fails closed without a version", () => {
+		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
 			"CREATE_VERSION is required",
 		);
-		expect(() =>
-			runCreateLauncherSmoke({ createVersion: "0.0.1-dev.80", authToken: "" }),
-		).toThrow("NODE_AUTH_TOKEN is required");
 	});
 });
 
@@ -62,6 +60,19 @@ describe("publish.yml create smoke + tag", () => {
 		expect(yml).not.toContain("npx --yes");
 	});
 
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
 	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
 		const tag = yml.slice(yml.indexOf("\n  tag:"));
 		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));

package/tests/lib/github-issue.test.mjs

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { pickIssue, upsertIssue } from "../../src/lib/github-issue.mjs";
 
-const TITLE = "chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)";
+const TITLE = "security(ci): high or critical npm audit findings";
 
 /** A fake `gh` that answers `issue list` with `issues` and records every call. */
 function fakeGh(issues) {
@@ -28,7 +28,7 @@ describe("github-issue", () => {
 		expect(pickIssue([], TITLE)).toBeNull();
 	});
 
-	// #681: GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
+	// GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
 	// and a new issue was opened on every run.
 	it("searches for the title as a quoted phrase", () => {
 		const { run, calls } = fakeGh([]);

package/src/github/credential-nudge.mjs

@@ -1,226 +0,0 @@
-import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { upsertIssue } from "../lib/github-issue.mjs";
-
-const WARN_DAYS = 14;
-const MS_PER_DAY = 86_400_000;
-const DEFAULT_REPO = "typesmiths/decohere";
-
-/**
- * One profile per credential (repo secret + repo variable). Date math, GitHub issue
- * upsert, and fail-closed live below.
- *
- * @typedef {{
- *   id: string,
- *   secret: string,
- *   expiresVar: string,
- *   mint: string,
- *   failImpact: string,
- *   rejectedWhy: string,
- *   revokeUrl: string,
- * }} CredentialProfile
- */
-
-/** @type {Record<string, CredentialProfile>} */
-export const CREDENTIALS = {
-	npm: {
-		id: "npm",
-		secret: "NODE_AUTH_TOKEN",
-		expiresVar: "NODE_AUTH_TOKEN_EXPIRES_AT",
-		mint: "Create an npm **read** token (granular/classic) at https://www.npmjs.com/settings/~/tokens — Publish PUTs are OIDC; this token is only for private `npm view` and create smoke.",
-		failImpact:
-			"Verify cannot see private packages, so skipIfPublished and create smoke are unsafe. Publish **fails closed** before OIDC/Docker. After you rotate, re-run the failed Publish jobs.",
-		rejectedWhy: "`npm whoami` failed (expired, revoked, or missing `NODE_AUTH_TOKEN`).",
-		revokeUrl: "https://www.npmjs.com/settings/~/tokens",
-	},
-};
-
-export function utcDayMs(date) {
-	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
-}
-
-/** @param {string | undefined} raw */
-export function parseExpiresAt(raw) {
-	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(raw ?? "").trim());
-	if (!match) {
-		return null;
-	}
-	return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
-}
-
-/**
- * @param {{ now?: number, expiresAtMs: number | null, warnDays?: number }} options
- * @returns {{ kind: "missing" | "ok" | "warn" | "expired", daysLeft: number | null }}
- */
-export function assessTokenLifetime(options) {
-	const { expiresAtMs, warnDays = WARN_DAYS } = options;
-	if (expiresAtMs == null) {
-		return { kind: "missing", daysLeft: null };
-	}
-	const today = utcDayMs(new Date(options.now ?? Date.now()));
-	const daysLeft = Math.round((expiresAtMs - today) / MS_PER_DAY);
-	if (daysLeft <= 0) {
-		return { kind: "expired", daysLeft };
-	}
-	if (daysLeft <= warnDays) {
-		return { kind: "warn", daysLeft };
-	}
-	return { kind: "ok", daysLeft };
-}
-
-/** @param {CredentialProfile} credential */
-export function resolveRepo() {
-	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-}
-
-/** @param {string} id */
-export function credentialProfile(id) {
-	const credential = CREDENTIALS[id];
-	if (!credential) {
-		throw new Error(
-			`Unknown NUDGE_CREDENTIAL=${id}. Expected one of: ${Object.keys(CREDENTIALS).join(", ")}`,
-		);
-	}
-	return credential;
-}
-
-/** @param {CredentialProfile} credential */
-export function issueTitle(credential, expiresYmd) {
-	return `chore(security): rotate ${credential.secret} (expires ${expiresYmd})`;
-}
-
-/** @param {CredentialProfile} credential */
-export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
-	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	return [
-		credential.mint,
-		"",
-		"Then from a trusted machine (do not paste the token into Actions or this issue):",
-		"",
-		"```bash",
-		`gh secret set ${credential.secret} --repo ${repo}`,
-		`gh variable set ${credential.expiresVar} --repo ${repo} --body ${next}`,
-		"```",
-		"",
-		`Revoke the old token: ${credential.revokeUrl}`,
-		"Close this issue, then retry Publish:",
-		"",
-		"```bash",
-		`gh run list --repo ${repo} --workflow Publish --limit 5`,
-		`gh run rerun --failed <run-id> --repo ${repo}`,
-		"```",
-	].join("\n");
-}
-
-export function suggestedNextExpiry(fromMs, days = 90) {
-	const start = utcDayMs(new Date(fromMs));
-	const next = new Date(start + days * MS_PER_DAY);
-	const y = next.getUTCFullYear();
-	const m = String(next.getUTCMonth() + 1).padStart(2, "0");
-	const d = String(next.getUTCDate()).padStart(2, "0");
-	return `${y}-${m}-${d}`;
-}
-
-/** @param {CredentialProfile} credential */
-export function buildDescription(credential, options) {
-	const { kind, expiresYmd, daysLeft, rejected, runUrl } = options;
-	const next = suggestedNextExpiry(Date.now());
-	const why = rejected
-		? credential.rejectedWhy
-		: kind === "expired"
-			? `${credential.expiresVar} (${expiresYmd}) is today or in the past. Rotate ${credential.secret} and this date before Publish can continue.`
-			: `${credential.secret} expires on ${expiresYmd} (${daysLeft} day(s) left). Rotate before that date so Publish does not fail closed.`;
-	return [
-		"## Summary",
-		"",
-		why,
-		"",
-		"## If this is not done in time",
-		"",
-		credential.failImpact,
-		"",
-		"## Commands",
-		"",
-		rotationCommands(credential, next),
-		"",
-		runUrl ? `- Workflow run: ${runUrl}` : null,
-	]
-		.filter((line) => line != null)
-		.join("\n");
-}
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "";
-}
-
-/** @param {CredentialProfile} credential */
-export function upsertRotationIssue(credential, options, upsert = upsertIssue) {
-	const { expiresYmd, kind, daysLeft, rejected } = options;
-	return upsert({
-		title: issueTitle(credential, expiresYmd ?? "unknown"),
-		body: buildDescription(credential, {
-			kind,
-			expiresYmd,
-			daysLeft,
-			rejected,
-			runUrl: runUrl(),
-		}),
-	});
-}
-
-export async function runNudge(env = process.env, upsert = upsertIssue) {
-	const credential = credentialProfile(String(env.NUDGE_CREDENTIAL ?? "").trim());
-	const rejected = env.NUDGE_REJECTED === "1";
-	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
-	const expiresAtMs = parseExpiresAt(expiresYmd);
-	const assessment = assessTokenLifetime({ expiresAtMs });
-	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-
-	if (assessment.kind === "missing" && !rejected) {
-		process.stderr.write(
-			`repository variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} --repo ${repo} --body YYYY-MM-DD\n`,
-		);
-		return 1;
-	}
-
-	if (rejected || assessment.kind === "warn" || assessment.kind === "expired") {
-		const result = upsertRotationIssue(
-			credential,
-			{
-				expiresYmd: expiresYmd || "unknown",
-				kind: assessment.kind,
-				daysLeft: assessment.daysLeft,
-				rejected,
-			},
-			upsert,
-		);
-		process.stdout.write(
-			`${result.created ? "Opened" : "Updated"} issue #${result.number} ${result.url}\n`,
-		);
-	}
-
-	if (rejected || assessment.kind === "expired" || assessment.kind === "missing") {
-		if (assessment.kind === "expired") {
-			process.stderr.write(
-				`${credential.secret} calendar expiry ${expiresYmd} has been reached — refusing to continue\n`,
-			);
-		}
-		return 1;
-	}
-	return 0;
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	process.exit(await runNudge());
-}

package/tests/github/credential-nudge.test.mjs

@@ -1,112 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	assessTokenLifetime,
-	buildDescription,
-	CREDENTIALS,
-	credentialProfile,
-	issueTitle,
-	parseExpiresAt,
-	rotationCommands,
-	runNudge,
-	suggestedNextExpiry,
-} from "../../src/github/credential-nudge.mjs";
-
-/** Records each upsert and answers like a newly opened issue. */
-function recordUpserts() {
-	/** @type {{ title: string, body: string }[]} */
-	const upserts = [];
-	const upsert = (options) => {
-		upserts.push(options);
-		return {
-			number: 9,
-			url: "https://github.com/typesmiths/decohere/issues/9",
-			created: true,
-		};
-	};
-	return { upserts, upsert };
-}
-
-function inDays(days) {
-	return suggestedNextExpiry(Date.now(), days);
-}
-
-describe("credential-nudge", () => {
-	it("parses YYYY-MM-DD as a UTC day", () => {
-		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
-		expect(parseExpiresAt("")).toBeNull();
-	});
-
-	it("is ok more than 14 days out, warns inside the window, expires on the day", () => {
-		const expiresAtMs = Date.UTC(2026, 10, 19);
-		const now = (day) => Date.UTC(2026, 10, day, 15);
-		expect(assessTokenLifetime({ now: now(1), expiresAtMs }).kind).toBe("ok");
-		expect(assessTokenLifetime({ now: now(5), expiresAtMs })).toEqual({
-			kind: "warn",
-			daysLeft: 14,
-		});
-		expect(assessTokenLifetime({ now: now(18), expiresAtMs }).kind).toBe("warn");
-		expect(assessTokenLifetime({ now: now(19), expiresAtMs })).toEqual({
-			kind: "expired",
-			daysLeft: 0,
-		});
-		expect(assessTokenLifetime({ now: now(20), expiresAtMs }).kind).toBe("expired");
-		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
-	});
-
-	it("builds the rotation issue for a credential profile", () => {
-		const npm = credentialProfile("npm");
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
-		);
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
-		);
-		expect(issueTitle(npm, "2026-11-19")).toBe(
-			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
-		);
-		const body = buildDescription(npm, {
-			kind: "warn",
-			expiresYmd: "2026-11-19",
-			daysLeft: 14,
-			rejected: false,
-		});
-		expect(body).toContain(CREDENTIALS.npm.failImpact);
-		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("ghcr")).toThrow(/Unknown NUDGE_CREDENTIAL/);
-	});
-
-	it("files nothing and passes while the token has more than 14 days left", async () => {
-		const { upserts, upsert } = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(30) };
-		expect(await runNudge(env, upsert)).toBe(0);
-		expect(upserts).toEqual([]);
-	});
-
-	it("files a rotation issue but lets Publish continue inside the warning window", async () => {
-		const { upserts, upsert } = recordUpserts();
-		const expires = inDays(10);
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: expires };
-		expect(await runNudge(env, upsert)).toBe(0);
-		expect(upserts).toHaveLength(1);
-		expect(upserts[0].title).toBe(
-			`chore(security): rotate NODE_AUTH_TOKEN (expires ${expires})`,
-		);
-		expect(upserts[0].body).toContain("Close this issue, then retry Publish");
-	});
-
-	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
-		const expired = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(0) };
-		expect(await runNudge(env, expired.upsert)).toBe(1);
-		expect(expired.upserts).toHaveLength(1);
-
-		const rejected = recordUpserts();
-		const rejectedEnv = {
-			...env,
-			NODE_AUTH_TOKEN_EXPIRES_AT: inDays(60),
-			NUDGE_REJECTED: "1",
-		};
-		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
-		expect(rejected.upserts[0].body).toContain(CREDENTIALS.npm.rejectedWhy);
-	});
-});