@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/publish.test.ts

@@ -1,650 +0,0 @@
-/**
- * US-004 — `hq publish` packer + authenticated upload.
- *
- * All network is mocked (deps.upload / deps.getAccessToken) and all filesystem
- * writes land in per-test tmp dirs — these tests never hit the real API and
- * never mutate the working tree.
- *
- * E2E behaviors covered:
- *   - Logged-in verified creator + valid skill dir → pending_review listing id.
- *   - Not-logged-in user → errors with a login prompt, uploads nothing.
- *   - Invalid package.yaml → validation errors, uploads nothing.
- *   - Re-publishing the same version (409) → clear duplicate error.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import * as yaml from 'js-yaml';
-
-import * as zlib from 'node:zlib';
-
-import {
-  peekIdToken,
-  resolveAuthor,
-  stampAuthorYaml,
-  upsertPackProvenance,
-  buildListingNotice,
-  unwrapListing,
-  inferListingType,
-  deriveSlug,
-  summarizeContributes,
-  runPublish,
-  type PublishDeps,
-  type ListingRequest,
-} from './publish.js';
-import { readManifest } from '../utils/manifest.js';
-import type { ModulesManifest, PackManifest, PackModuleDefinition } from '../types.js';
-
-// ---------------------------------------------------------------------------
-// Fixtures
-// ---------------------------------------------------------------------------
-
-/** Build a base64url-encoded JWT-shaped string with the given payload claims. */
-function fakeIdToken(claims: Record<string, unknown>): string {
-  const b64 = (o: unknown) =>
-    Buffer.from(JSON.stringify(o))
-      .toString('base64')
-      .replace(/\+/g, '-')
-      .replace(/\//g, '_')
-      .replace(/=+$/, '');
-  return `${b64({ alg: 'none' })}.${b64(claims)}.sig`;
-}
-
-const VALID_MANIFEST = {
-  name: 'hq-pack-demo',
-  version: '1.0.0',
-  publisher: '@indigo',
-  access: 'public',
-  requires: { hqCore: '>=1.0.0' },
-  contributes: { skills: ['demo'] },
-};
-
-/** Write a valid skill pack dir under `root` and return its path. */
-function writeValidPack(root: string, manifest: Record<string, unknown> = VALID_MANIFEST): string {
-  const dir = path.join(root, 'pack');
-  fs.mkdirSync(path.join(dir, 'skills', 'demo'), { recursive: true });
-  fs.writeFileSync(path.join(dir, 'skills', 'demo', 'SKILL.md'), '# demo skill\n');
-  fs.writeFileSync(path.join(dir, 'package.yaml'), yaml.dump(manifest));
-  return dir;
-}
-
-let tmpRoot: string;
-let hqRoot: string;
-
-beforeEach(() => {
-  tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-publish-test-'));
-  // A minimal HQ root so recordProvenance has somewhere to write modules.yaml.
-  hqRoot = path.join(tmpRoot, 'hq');
-  fs.mkdirSync(hqRoot, { recursive: true });
-});
-
-afterEach(() => {
-  fs.rmSync(tmpRoot, { recursive: true, force: true });
-  vi.restoreAllMocks();
-});
-
-// ---------------------------------------------------------------------------
-// Pure helpers
-// ---------------------------------------------------------------------------
-
-describe('peekIdToken', () => {
-  it('decodes sub + email from a JWT-shaped token', () => {
-    const tok = fakeIdToken({ sub: 'usr_123', email: 'a@b.com', name: 'Ada' });
-    expect(peekIdToken(tok)).toMatchObject({ sub: 'usr_123', email: 'a@b.com', name: 'Ada' });
-  });
-  it('returns {} on a malformed token', () => {
-    expect(peekIdToken('garbage')).toEqual({});
-  });
-});
-
-describe('resolveAuthor', () => {
-  it('uses sub as uid and derives handle/displayName', () => {
-    const a = resolveAuthor({ sub: 'usr_1', email: 'ada@b.com', name: 'Ada Lovelace' });
-    expect(a).toEqual({ uid: 'usr_1', handle: 'ada', displayName: 'Ada Lovelace' });
-  });
-  it('prefers preferred_username for the handle', () => {
-    const a = resolveAuthor({ sub: 'usr_1', preferred_username: 'countess', email: 'ada@b.com' });
-    expect(a.handle).toBe('countess');
-  });
-  it('throws when there is no sub (treated as logged out)', () => {
-    expect(() => resolveAuthor({ email: 'a@b.com' })).toThrow(/sub/);
-  });
-});
-
-describe('stampAuthorYaml', () => {
-  it('adds an author block that round-trips through YAML', () => {
-    const out = stampAuthorYaml(
-      { ...VALID_MANIFEST },
-      { uid: 'usr_1', handle: 'ada', displayName: 'Ada' },
-    );
-    const parsed = yaml.load(out) as Record<string, unknown>;
-    expect(parsed.author).toEqual({ uid: 'usr_1', handle: 'ada', displayName: 'Ada' });
-    expect(parsed.name).toBe('hq-pack-demo');
-  });
-  it('overwrites a pre-existing author with the publisher identity', () => {
-    const out = stampAuthorYaml(
-      { ...VALID_MANIFEST, author: { uid: 'someone-else', handle: 'x', displayName: 'X' } },
-      { uid: 'usr_1', handle: 'ada', displayName: 'Ada' },
-    );
-    const parsed = yaml.load(out) as { author: { uid: string } };
-    expect(parsed.author.uid).toBe('usr_1');
-  });
-});
-
-describe('upsertPackProvenance', () => {
-  const entry: PackModuleDefinition = {
-    name: 'hq-pack-demo',
-    strategy: 'package',
-    source: '/abs/pack',
-    version: '1.0.0',
-    access: 'public',
-  };
-  it('appends a new entry when none exists', () => {
-    const out = upsertPackProvenance(null, entry);
-    expect(out.modules).toHaveLength(1);
-    expect(out.modules[0]).toEqual(entry);
-  });
-  it('replaces an existing entry by name (no duplicate)', () => {
-    const initial: ModulesManifest = { version: '1', modules: [entry] };
-    const updated = upsertPackProvenance(initial, { ...entry, version: '2.0.0' });
-    expect(updated.modules).toHaveLength(1);
-    expect((updated.modules[0] as PackModuleDefinition).version).toBe('2.0.0');
-  });
-});
-
-describe('buildListingNotice', () => {
-  it('formats a pending_review success notice with the listing id', () => {
-    const notice = buildListingNotice(201, { id: 'lst_42', status: 'pending_review' }, 'hq-pack-demo', '1.0.0');
-    expect(notice).toContain('lst_42');
-    expect(notice).toContain('pending_review');
-  });
-  it('surfaces a 409 as a clear duplicate-version error', () => {
-    expect(() => buildListingNotice(409, {}, 'hq-pack-demo', '1.0.0')).toThrow(/already published|duplicate/i);
-  });
-  it('maps 401/403 to an auth error', () => {
-    expect(() => buildListingNotice(401, {}, 'hq-pack-demo', '1.0.0')).toThrow(/Not authorized|login/i);
-  });
-  it('maps a 403 NOT_VERIFIED_CREATOR to the apply guidance', () => {
-    expect(() =>
-      buildListingNotice(403, { code: 'NOT_VERIFIED_CREATOR' }, 'hq-pack-demo', '1.0.0'),
-    ).toThrow(/hq creators apply/i);
-  });
-  it('maps a 400 ON_BEHALF_DISABLED to a clear "not enabled" message', () => {
-    expect(() =>
-      buildListingNotice(400, { code: 'ON_BEHALF_DISABLED' }, 'hq-pack-demo', '1.0.0'),
-    ).toThrow(/on behalf|not enabled/i);
-  });
-  it('maps a 403 staff-gate (FORBIDDEN) on an --as publish to a "staff only" message', () => {
-    expect(() =>
-      buildListingNotice(403, { code: 'FORBIDDEN' }, 'hq-pack-demo', '1.0.0'),
-    ).toThrow(/HQ staff|on behalf/i);
-  });
-  it('surfaces a generic server error body', () => {
-    expect(() => buildListingNotice(500, { error: 'boom' }, 'hq-pack-demo', '1.0.0')).toThrow(/boom/);
-  });
-
-  it('uses the SERVER-resolved creatorHandle for attribution (Bug 2)', () => {
-    const notice = buildListingNotice(
-      201,
-      { id: 'lst_99', status: 'pending_review', creatorHandle: 'ada-lovelace' },
-      'hq-pack-demo',
-      '1.0.0',
-    );
-    expect(notice).toContain('lst_99');
-    expect(notice).toContain('Attributed to @ada-lovelace.');
-  });
-
-  it('omits the attribution clause when the server returns no creatorHandle', () => {
-    const notice = buildListingNotice(201, { id: 'lst_99' }, 'hq-pack-demo', '1.0.0');
-    expect(notice).toContain('lst_99');
-    expect(notice).not.toMatch(/Attributed to/);
-  });
-
-  it('unwraps the real server { listing } envelope → real id + status + @handle (prod bug)', () => {
-    // This is the EXACT shape prod returns: a `{ listing: { listingId,
-    // creatorHandle, status } }` envelope. Reading the top level (the old
-    // behavior) produced "(unknown id)" + a local federated handle.
-    const notice = buildListingNotice(
-      201,
-      {
-        listing: {
-          listingId: 'lst_prod_123',
-          creatorHandle: 'corey',
-          status: 'pending_review',
-        },
-      },
-      'hq-pack-demo',
-      '1.0.0',
-    );
-    expect(notice).toContain('lst_prod_123');
-    expect(notice).toContain('pending_review');
-    expect(notice).toContain('Attributed to @corey.');
-    expect(notice).not.toContain('(unknown id)');
-  });
-
-  it('prefers listingId over id inside a wrapped envelope', () => {
-    const notice = buildListingNotice(
-      201,
-      { listing: { listingId: 'lst_real', id: 'lst_legacy', status: 'pending_review' } },
-      'hq-pack-demo',
-      '1.0.0',
-    );
-    expect(notice).toContain('lst_real');
-    expect(notice).not.toContain('lst_legacy');
-  });
-});
-
-describe('unwrapListing', () => {
-  it('reads listing fields out of a { listing } envelope', () => {
-    expect(
-      unwrapListing({ listing: { listingId: 'lst_1', creatorHandle: 'corey' } }),
-    ).toMatchObject({ listingId: 'lst_1', creatorHandle: 'corey' });
-  });
-  it('falls back to the top-level body when there is no envelope (compat)', () => {
-    expect(unwrapListing({ id: 'lst_2', creatorHandle: 'ada' })).toMatchObject({
-      id: 'lst_2',
-      creatorHandle: 'ada',
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Server-contract field derivation
-// ---------------------------------------------------------------------------
-
-function pack(overrides: Partial<PackManifest> = {}): PackManifest {
-  return {
-    name: 'hq-pack-demo',
-    version: '1.0.0',
-    publisher: '@indigo',
-    access: 'public',
-    requires: { hqCore: '>=1.0.0' },
-    contributes: { skills: ['demo'] },
-    ...overrides,
-  } as PackManifest;
-}
-
-describe('inferListingType', () => {
-  it('returns "worker" when the pack contributes only workers', () => {
-    expect(inferListingType(pack({ contributes: { workers: ['x'] } }))).toBe('worker');
-  });
-  it('returns "skill" when the pack contributes only skills', () => {
-    expect(inferListingType(pack({ contributes: { skills: ['demo'] } }))).toBe('skill');
-  });
-  it('prefers "skill" when the pack contributes both (ambiguous)', () => {
-    expect(
-      inferListingType(pack({ contributes: { skills: ['a'], workers: ['b'] } })),
-    ).toBe('skill');
-  });
-  it('defaults to "skill" when neither skills nor workers are present', () => {
-    expect(inferListingType(pack({ contributes: { knowledge: ['k'] } }))).toBe('skill');
-  });
-  it('honors an explicit valid type hint in package.yaml over inference', () => {
-    const withHint = { ...pack({ contributes: { skills: ['demo'] } }), type: 'worker' } as PackManifest;
-    expect(inferListingType(withHint)).toBe('worker');
-  });
-  it('ignores an invalid type hint and falls back to inference', () => {
-    const withBadHint = { ...pack({ contributes: { workers: ['x'] } }), type: 'plugin' } as unknown as PackManifest;
-    expect(inferListingType(withBadHint)).toBe('worker');
-  });
-});
-
-describe('deriveSlug', () => {
-  it('strips the hq-pack- prefix', () => {
-    expect(deriveSlug('hq-pack-demo')).toBe('demo');
-  });
-  it('falls back to the full name when there is no hq-pack- prefix', () => {
-    expect(deriveSlug('demo')).toBe('demo');
-  });
-  it('never returns an empty slug', () => {
-    expect(deriveSlug('hq-pack-').length).toBeGreaterThan(0);
-  });
-});
-
-describe('summarizeContributes', () => {
-  it('produces a string summary of non-empty categories', () => {
-    const out = summarizeContributes({ workers: ['a', 'b'], skills: ['demo'] });
-    expect(typeof out).toBe('string');
-    expect(out).toContain('workers: a, b');
-    expect(out).toContain('skills: demo');
-  });
-  it('skips empty categories and returns an empty string for none', () => {
-    expect(summarizeContributes({ skills: [] })).toBe('');
-    expect(summarizeContributes({})).toBe('');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// runPublish — full flow with mocked deps + tmp fs
-// ---------------------------------------------------------------------------
-
-function makeDeps(overrides: Partial<PublishDeps> = {}): {
-  deps: PublishDeps;
-  uploadSpy: ReturnType<typeof vi.fn>;
-} {
-  const uploadSpy = vi.fn(async () => ({
-    status: 201,
-    body: { id: 'lst_42', status: 'pending_review' } as Record<string, unknown>,
-  }));
-  const deps: PublishDeps = {
-    loadIdToken: () => fakeIdToken({ sub: 'usr_1', email: 'ada@b.com', name: 'Ada' }),
-    getAccessToken: async () => 'access-token',
-    getIdToken: async () => 'id-token',
-    upload: uploadSpy,
-    hqRoot,
-    hqVersion: null,
-    ...overrides,
-  };
-  return { deps, uploadSpy };
-}
-
-describe('runPublish', () => {
-  it('logged-in + valid pack → uploads JSON listing and returns pending_review notice', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps();
-
-    const result = await runPublish(packDir, deps);
-
-    expect(uploadSpy).toHaveBeenCalledOnce();
-    const call = uploadSpy.mock.calls[0][0];
-    expect(call.token).toBe('access-token');
-
-    // The new contract sends a JSON listing object (not raw bytes).
-    const listing = call.listing as ListingRequest;
-    expect(listing.name).toBe('hq-pack-demo');
-    expect(listing.slug).toBe('demo');
-    expect(listing.version).toBe('1.0.0');
-    expect(listing.type).toBe('skill');
-    expect(['skill', 'worker']).toContain(listing.type);
-    expect(typeof listing.contributes).toBe('string');
-    expect(listing.contributes).toContain('skills: demo');
-
-    expect(result.notice).toContain('lst_42');
-    expect(result.notice).toContain('pending_review');
-    expect(result.author.uid).toBe('usr_1');
-  });
-
-  it('sends a body that is valid JSON with a base64 tarball that decodes to gzip bytes', async () => {
-    const packDir = writeValidPack(tmpRoot);
-
-    // Capture exactly what the command wiring would serialize: JSON.stringify
-    // the listing, then prove it parses and the tarball decodes to gzip.
-    let serialized = '';
-    const uploadSpy = vi.fn(async ({ listing }: { listing: ListingRequest }) => {
-      serialized = JSON.stringify(listing);
-      return {
-        status: 201,
-        body: { id: 'lst_42', status: 'pending_review' } as Record<string, unknown>,
-      };
-    });
-    const { deps } = makeDeps({ upload: uploadSpy });
-
-    await runPublish(packDir, deps);
-
-    // Body is valid JSON.
-    const parsed = JSON.parse(serialized) as ListingRequest;
-    expect(parsed.type).toBe('skill');
-    expect(typeof parsed.name).toBe('string');
-    expect(typeof parsed.slug).toBe('string');
-    expect(typeof parsed.version).toBe('string');
-    expect(typeof parsed.tarball).toBe('string');
-    expect(parsed.tarball.length).toBeGreaterThan(0);
-
-    // Required fields present + non-empty.
-    expect(parsed.name).not.toBe('');
-    expect(parsed.slug).not.toBe('');
-    expect(parsed.version).not.toBe('');
-
-    // Base64 tarball decodes to gzip bytes (gzip magic 0x1f 0x8b).
-    const bytes = Buffer.from(parsed.tarball, 'base64');
-    expect(bytes.length).toBeGreaterThan(0);
-    expect(bytes[0]).toBe(0x1f);
-    expect(bytes[1]).toBe(0x8b);
-    // And it actually gunzips without throwing.
-    expect(() => zlib.gunzipSync(bytes)).not.toThrow();
-  });
-
-  it('success notice uses the SERVER listing id + creatorHandle, not the local author handle (Bug 2)', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    // The local idToken resolves to an ugly federated handle; the server stores
-    // the real id + a clean creatorHandle. The notice must show the server's.
-    const { deps } = makeDeps({
-      loadIdToken: () =>
-        fakeIdToken({
-          sub: 'Google_114624000000000000000',
-          preferred_username: 'Google_114624000000000000000',
-          name: 'Ada Lovelace',
-        }),
-      upload: vi.fn(async () => ({
-        status: 201,
-        body: {
-          id: 'lst_real_777',
-          status: 'pending_review',
-          creatorHandle: 'ada',
-        } as Record<string, unknown>,
-      })),
-    });
-
-    const result = await runPublish(packDir, deps);
-
-    // Server-supplied id + handle appear; the ugly local federated handle does not.
-    expect(result.notice).toContain('lst_real_777');
-    expect(result.notice).toContain('Attributed to @ada.');
-    expect(result.notice).not.toContain('Google_114624');
-    expect(result.serverAttributed).toBe(true);
-  });
-
-  it('unwraps the real prod { listing } envelope → real id + server @handle, not the local one (prod bug)', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    // Local idToken resolves to an ugly federated handle; the server returns the
-    // real listing WRAPPED in a { listing } envelope with listingId + a clean
-    // creatorHandle. The notice must show the server's values, not the local ones.
-    const { deps } = makeDeps({
-      loadIdToken: () =>
-        fakeIdToken({
-          sub: 'Google_114624000000000000000',
-          preferred_username: 'Google_114624000000000000000',
-          name: 'Corey Epstein',
-        }),
-      upload: vi.fn(async () => ({
-        status: 201,
-        body: {
-          listing: {
-            listingId: 'lst_prod_777',
-            creatorHandle: 'corey',
-            status: 'pending_review',
-          },
-        } as Record<string, unknown>,
-      })),
-    });
-
-    const result = await runPublish(packDir, deps);
-
-    expect(result.notice).toContain('lst_prod_777');
-    expect(result.notice).toContain('pending_review');
-    expect(result.notice).toContain('Attributed to @corey.');
-    expect(result.notice).not.toContain('(unknown id)');
-    expect(result.notice).not.toContain('Google_114624');
-    expect(result.serverAttributed).toBe(true);
-  });
-
-  it('falls back to the local author attribution when the server omits creatorHandle', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps } = makeDeps({
-      upload: vi.fn(async () => ({
-        status: 201,
-        body: { id: 'lst_42', status: 'pending_review' } as Record<string, unknown>,
-      })),
-    });
-
-    const result = await runPublish(packDir, deps);
-
-    expect(result.serverAttributed).toBe(false);
-    expect(result.notice).not.toMatch(/Attributed to/);
-  });
-
-  it('stamps author (from sub) into the uploaded pack and records provenance', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps } = makeDeps();
-
-    await runPublish(packDir, deps);
-
-    // Provenance written to modules.yaml under the hq root.
-    const manifest = readManifest(hqRoot);
-    expect(manifest?.modules).toHaveLength(1);
-    const entry = manifest!.modules[0] as PackModuleDefinition;
-    expect(entry.name).toBe('hq-pack-demo');
-    expect(entry.strategy).toBe('package');
-    expect(entry.source).toBe(packDir);
-    expect(entry.version).toBe('1.0.0');
-
-    // The user's working-tree package.yaml is NOT mutated (we stamp a copy).
-    const onDisk = yaml.load(
-      fs.readFileSync(path.join(packDir, 'package.yaml'), 'utf-8'),
-    ) as Record<string, unknown>;
-    expect(onDisk.author).toBeUndefined();
-  });
-
-  it('not logged in → errors with a login prompt and uploads nothing', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps({ loadIdToken: () => null });
-
-    await expect(runPublish(packDir, deps)).rejects.toThrow(/Not logged in|hq login/);
-    expect(uploadSpy).not.toHaveBeenCalled();
-    // No provenance recorded.
-    expect(readManifest(hqRoot)).toBeNull();
-  });
-
-  it('invalid package.yaml → validation error, uploads nothing', async () => {
-    // Missing required `version` → validateManifest rejects.
-    const bad = { ...VALID_MANIFEST };
-    delete (bad as Record<string, unknown>).version;
-    const packDir = writeValidPack(tmpRoot, bad);
-    const { deps, uploadSpy } = makeDeps();
-
-    await expect(runPublish(packDir, deps)).rejects.toThrow(/version/i);
-    expect(uploadSpy).not.toHaveBeenCalled();
-    expect(readManifest(hqRoot)).toBeNull();
-  });
-
-  it('missing package.yaml → errors, uploads nothing', async () => {
-    const dir = path.join(tmpRoot, 'nope');
-    fs.mkdirSync(dir, { recursive: true });
-    const { deps, uploadSpy } = makeDeps();
-
-    await expect(runPublish(dir, deps)).rejects.toThrow(/package\.yaml missing/);
-    expect(uploadSpy).not.toHaveBeenCalled();
-  });
-
-  it('re-publishing the same version (409) → clear duplicate error', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps({
-      upload: vi.fn(async () => ({ status: 409, body: {} as Record<string, unknown> })),
-    });
-
-    await expect(runPublish(packDir, deps)).rejects.toThrow(/already published|duplicate/i);
-    // The upload WAS attempted (server is the duplicate authority), but no
-    // provenance is recorded for a rejected publish.
-    expect((deps.upload as ReturnType<typeof vi.fn>)).toHaveBeenCalledOnce();
-    void uploadSpy;
-    expect(readManifest(hqRoot)).toBeNull();
-  });
-});
-
-describe('runPublish — publish on behalf (--as <handle>)', () => {
-  it('sends publishAsHandle + attributes the body to the TARGET handle (not the caller)', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps();
-
-    const result = await runPublish(packDir, deps, { publishAsHandle: 'garrytan' });
-
-    const call = uploadSpy.mock.calls[0][0];
-    const listing = call.listing as ListingRequest;
-    // The on-behalf signal is sent to the server.
-    expect(listing.publishAsHandle).toBe('garrytan');
-    // Body attribution is the TARGET handle, never the caller's resolved handle.
-    expect(listing.creatorHandle).toBe('garrytan');
-    expect(listing.creatorHandle).not.toBe(result.author.handle);
-    // CRITICAL: on-behalf must authenticate with the ID token (staff gate reads
-    // the email claim, which the access token lacks → would 403 NO_EMAIL_CLAIM).
-    expect(call.token).toBe('id-token');
-  });
-
-  it('on-behalf uses the ID token, normal publish uses the access token', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const onBehalf = makeDeps();
-    await runPublish(packDir, onBehalf.deps, { publishAsHandle: 'garrytan' });
-    expect(onBehalf.uploadSpy.mock.calls[0][0].token).toBe('id-token');
-
-    const normal = makeDeps();
-    await runPublish(packDir, normal.deps);
-    expect(normal.uploadSpy.mock.calls[0][0].token).toBe('access-token');
-  });
-
-  it('preserves a pre-existing manifest author (does NOT stamp the caller) on the --as path', async () => {
-    // A ported pack already names the upstream creator. With --as we must NOT
-    // overwrite that author with the publishing staff caller — validation must
-    // pass against the manifest's own author block.
-    const packDir = writeValidPack(tmpRoot, {
-      ...VALID_MANIFEST,
-      author: { uid: 'cmt_garrytan', handle: 'garrytan', displayName: 'Garry Tan' },
-    });
-    const { deps, uploadSpy } = makeDeps();
-
-    const result = await runPublish(packDir, deps, { publishAsHandle: 'garrytan' });
-
-    expect(uploadSpy).toHaveBeenCalledOnce();
-    expect(result.notice).toContain('pending_review');
-  });
-
-  it('normal publish (no --as) sends NO publishAsHandle and keeps caller attribution', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps();
-
-    const result = await runPublish(packDir, deps);
-
-    const listing = uploadSpy.mock.calls[0][0].listing as ListingRequest;
-    expect(listing.publishAsHandle).toBeUndefined();
-    expect(listing.creatorHandle).toBe(result.author.handle);
-  });
-
-  it('an empty --as handle is treated as a normal self-publish', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps, uploadSpy } = makeDeps();
-
-    await runPublish(packDir, deps, { publishAsHandle: '' });
-
-    const listing = uploadSpy.mock.calls[0][0].listing as ListingRequest;
-    expect(listing.publishAsHandle).toBeUndefined();
-  });
-
-  it('server kill-switch off (400 ON_BEHALF_DISABLED) surfaces a clear error', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps } = makeDeps({
-      upload: vi.fn(async () => ({
-        status: 400,
-        body: { code: 'ON_BEHALF_DISABLED' } as Record<string, unknown>,
-      })),
-    });
-
-    await expect(
-      runPublish(packDir, deps, { publishAsHandle: 'garrytan' }),
-    ).rejects.toThrow(/on behalf|not enabled/i);
-  });
-
-  it('non-staff caller (403 FORBIDDEN) surfaces a "staff only" error', async () => {
-    const packDir = writeValidPack(tmpRoot);
-    const { deps } = makeDeps({
-      upload: vi.fn(async () => ({
-        status: 403,
-        body: { code: 'FORBIDDEN' } as Record<string, unknown>,
-      })),
-    });
-
-    await expect(
-      runPublish(packDir, deps, { publishAsHandle: 'garrytan' }),
-    ).rejects.toThrow(/HQ staff|on behalf/i);
-  });
-});