@learncard/cli 3.6.7 → 4.0.0

package/src/project.ts

@@ -1,489 +0,0 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { createInterface } from 'node:readline/promises';
-import { randomUUID } from 'node:crypto';
-import {
-    initLearnCard,
-    type DidWebNetworkLearnCardFromSeed,
-    type NetworkLearnCardFromSeed,
-} from '@learncard/init';
-import { getLCAPlugin, initLCALearnCard, type LCALearnCard } from '@learncard/lca-api-plugin';
-import { generateRandomSeed } from './random';
-import { out } from './out';
-
-export const KEYS = {
-    SECURE_SEED: 'SECURE_SEED', // Private issuer seed; never regenerate or print.
-    PROFILE_ID: 'PROFILE_ID', // Public issuer handle shared by all commands.
-    DISPLAY_NAME: 'DISPLAY_NAME', // Issuer display name; set at creation, then synced from the network.
-    NETWORK_URL: 'NETWORK_URL', // Non-default network tRPC endpoint.
-    SIGNING_AUTHORITY_NAME: 'SIGNING_AUTHORITY_NAME', // Registered primary signer name.
-    SIGNING_AUTHORITY_ENDPOINT: 'SIGNING_AUTHORITY_ENDPOINT', // Hosted signing endpoint.
-    API_TOKEN: 'API_TOKEN', // Secret bearer token for REST requests.
-    API_TOKEN_SCOPE: 'API_TOKEN_SCOPE', // Space-separated permissions granted to the token.
-    TEMPLATE_URI: 'TEMPLATE_URI', // Reusable Boost template on this network.
-    CONTRACT_URI: 'CONTRACT_URI', // Consent contract for later commands.
-    PUBLISHABLE_KEY: 'PUBLISHABLE_KEY', // Public integration client key.
-    INTEGRATION_ID: 'INTEGRATION_ID', // Developer integration identifier.
-} as const;
-
-export interface Project {
-    env: Record<string, string>;
-    envPath: string;
-    existing: string;
-}
-
-export interface ProjectOptions {
-    yes?: boolean;
-    name?: string;
-    profileId?: string;
-    network?: string;
-    didkit?: Promise<Buffer>;
-    json?: boolean;
-    readOnly?: boolean;
-}
-
-export type NetworkCard = NetworkLearnCardFromSeed['returnValue'];
-export type DidWebCard = DidWebNetworkLearnCardFromSeed['returnValue'];
-
-export const parseEnv = (text: string): Record<string, string> => {
-    const env: Record<string, string> = {};
-    for (const line of text.split('\n')) {
-        const match = line.match(/^\s*(?:export\s+)?([\w]+)\s*=\s*(.*)$/);
-        if (!match) continue;
-        const key = match[1]!;
-        let value = match[2]!.trim();
-        if (value.startsWith('"') || value.startsWith("'")) {
-            const end = value.indexOf(value[0]!, 1);
-            if (end < 0) throw new Error(`Unclosed quote in .env for ${key}.`);
-            value = value.slice(1, end);
-        } else value = value.split('#')[0]!.trim();
-        if (key === 'SECURE_SEED' && env[key] !== undefined && env[key] !== value) {
-            throw new Error('Conflicting SECURE_SEED entries in .env. Keep the original identity.');
-        }
-        Object.defineProperty(env, key, {
-            value,
-            enumerable: true,
-            configurable: true,
-            writable: true,
-        });
-    }
-    return env;
-};
-
-export const upsertEnv = (text: string, values: Record<string, string>): string => {
-    const lines = text ? text.replace(/\n$/, '').split('\n') : [];
-    const seen = new Set<string>();
-    const out = lines.map(line => {
-        const key = line.match(/^\s*(?:export\s+)?([\w]+)\s*=/)?.[1];
-        if (key && Object.prototype.hasOwnProperty.call(values, key)) {
-            seen.add(key);
-            // Quotes make multi-scope values safe in both dotenv and shell scripts.
-            const value = values[key]!;
-            if (/[\r\n]/.test(value)) throw new Error(`Invalid multiline value for ${key}`);
-            return `${key}=${/^[a-zA-Z0-9_./:@*=%+-]*$/.test(value) ? value : JSON.stringify(value)}`;
-        }
-        return line;
-    });
-    for (const [key, value] of Object.entries(values)) {
-        if (!seen.has(key)) out.push(upsertEnv(`${key}=\n`, { [key]: value }).trimEnd());
-    }
-    return `${out.join('\n')}\n`;
-};
-
-export const toProfileId = (displayName: string): string => {
-    const base = displayName
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-        .slice(0, 30);
-    return `${base || 'issuer'}-${Math.random().toString(36).slice(2, 6)}`;
-};
-
-const readOptional = async (file: string): Promise<string> => {
-    try {
-        return await fs.readFile(file, 'utf8');
-    } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return '';
-        throw error;
-    }
-};
-
-export const loadProject = async (cwd: string): Promise<Project> => {
-    const envPath = path.join(cwd, '.env');
-    await assertRegularEnv(envPath);
-    const existing = await readOptional(envPath);
-    return { env: parseEnv(existing), envPath, existing };
-};
-
-const assertRegularEnv = async (envPath: string): Promise<void> => {
-    const info = await fs.lstat(envPath).catch((error: NodeJS.ErrnoException) => {
-        if (error.code === 'ENOENT') return undefined;
-        throw error;
-    });
-    if (info && !info.isFile()) throw new Error('.env must be a regular file, not a symlink.');
-};
-
-export const saveProject = async (
-    project: Project,
-    updates: Record<string, string>
-): Promise<void> => {
-    // Serialize CLI writers and atomically replace the file so a failed write cannot lose a seed.
-    const lockPath = `${project.envPath}.lock`;
-    const lock = await fs.open(lockPath, 'wx', 0o600).catch((error: NodeJS.ErrnoException) => {
-        if (error.code === 'EEXIST')
-            throw new Error(
-                'Another command is updating .env. Retry when it finishes; remove a stale .env.lock only if no command is running.'
-            );
-        throw error;
-    });
-    const temporary = `${project.envPath}.${randomUUID()}.tmp`;
-    try {
-        await assertRegularEnv(project.envPath);
-        const existing = await readOptional(project.envPath);
-        const env = parseEnv(existing);
-        if (
-            env.SECURE_SEED &&
-            updates.SECURE_SEED !== undefined &&
-            env.SECURE_SEED !== updates.SECURE_SEED
-        ) {
-            throw new Error('Cannot replace an existing SECURE_SEED.');
-        }
-        const changed = Object.fromEntries(
-            Object.entries(updates).filter(([key, value]) => env[key] !== value)
-        );
-        project.existing = existing;
-        project.env = env;
-        if (!Object.keys(changed).length) return;
-        const next = upsertEnv(existing, changed);
-        await fs.writeFile(temporary, next, { mode: 0o600, flag: 'wx' });
-        await fs.rename(temporary, project.envPath);
-        project.existing = next;
-        Object.assign(project.env, changed);
-        const keys = Object.keys(changed);
-        const list =
-            keys.length > 2
-                ? `${keys.slice(0, -1).join(', ')}, and ${keys.at(-1)}`
-                : keys.join(' and ');
-        out.log(`Wrote ${list} to .env`);
-    } finally {
-        await fs.rm(temporary, { force: true });
-        await lock.close();
-        await fs.unlink(lockPath);
-    }
-};
-
-/** Never block on input from a script, CI job, or agent: only prompt when a human is at a real TTY. */
-export const createPrompts = (yes?: boolean) => {
-    const interactive = !yes && !!process.stdin.isTTY && process.env.LC_YES !== '1';
-    const rl = interactive
-        ? createInterface({ input: process.stdin, output: process.stdout })
-        : null;
-    return {
-        interactive,
-        ask: async (question: string, fallback: string): Promise<string> => {
-            if (rl) return (await rl.question(`${question} [${fallback}] `)).trim() || fallback;
-            if (!fallback)
-                throw new Error(
-                    `${question} is required when running non-interactively. Pass it as an argument or flag.`
-                );
-            return fallback;
-        },
-        close: (): void => {
-            rl?.close();
-        },
-    };
-};
-
-export const ensureIdentity = async (project: Project, options: ProjectOptions) => {
-    if (
-        project.env.PROFILE_ID &&
-        options.profileId &&
-        options.profileId !== project.env.PROFILE_ID
-    ) {
-        throw new Error(
-            `This folder's .env is already the profile "${project.env.PROFILE_ID}"; --profile-id ${options.profileId} would not change that. ` +
-                `To act as a profile you manage from here, use --as ${options.profileId}. To create a separate identity, run from a new folder.`
-        );
-    }
-    const existingProfileId = project.env.PROFILE_ID || options.profileId;
-    let displayName = options.name ?? project.env.DISPLAY_NAME ?? '';
-    if (!existingProfileId && !displayName) {
-        const prompts = createPrompts(options.yes);
-        try {
-            displayName = await prompts.ask(
-                'Display name for your issuer profile',
-                'My Organization'
-            );
-        } finally {
-            prompts.close();
-        }
-    }
-    if (!displayName) displayName = 'My Organization';
-    if (!project.env.SECURE_SEED) {
-        const { network } = resolveServices(project.env, options.network);
-        const where =
-            network === PRODUCTION_NETWORK
-                ? 'production'
-                : network === STAGING_NETWORK
-                  ? 'staging'
-                  : network;
-        out.log(`No .env here — creating a new ${where} identity in ${process.cwd()}`);
-    }
-    const seed = project.env.SECURE_SEED || generateRandomSeed();
-    const profileId = project.env.PROFILE_ID || options.profileId || toProfileId(displayName);
-    await saveProject(project, {
-        SECURE_SEED: seed,
-        PROFILE_ID: profileId,
-        ...(existingProfileId ? {} : { DISPLAY_NAME: displayName }),
-    });
-    await ensureGitignored(path.dirname(project.envPath), '.env');
-    return { seed, profileId, displayName };
-};
-
-export const ensureGitignored = async (dir: string, entry: string): Promise<void> => {
-    const gitignorePath = path.join(dir, '.gitignore');
-    const gitignore = await readOptional(gitignorePath);
-    if (await fs.stat(gitignorePath).catch(() => null)) {
-        if (!gitignore.split('\n').some(line => line.trim() === entry)) {
-            await fs.writeFile(gitignorePath, `${gitignore.replace(/\n?$/, '\n')}${entry}\n`);
-            out.log(`Added ${entry} to .gitignore`);
-        }
-    } else {
-        await fs.writeFile(gitignorePath, `${entry}\n`);
-        out.log(`Created .gitignore with ${entry}`);
-    }
-};
-
-export const PRODUCTION_NETWORK = 'https://network.learncard.com/trpc';
-export const STAGING_NETWORK = 'https://staging.network.learncard.com/trpc';
-
-/** Network-bound resources must not be silently reused on another deployment. */
-export const assertProjectNetwork = (project: Project, network: string): void => {
-    const previous =
-        project.env.NETWORK_URL === 'staging'
-            ? STAGING_NETWORK
-            : project.env.NETWORK_URL || PRODUCTION_NETWORK;
-    const hasResources = [
-        'SIGNING_AUTHORITY_NAME',
-        'API_TOKEN',
-        'TEMPLATE_URI',
-        'CONTRACT_URI',
-        'PUBLISHABLE_KEY',
-        'INTEGRATION_ID',
-    ].some(key => project.env[key]);
-    if (previous !== network && hasResources) {
-        throw new Error(
-            'This project has resources on another network. Use a separate folder for staging or another network.'
-        );
-    }
-};
-
-/** Resolve matching staging services; explicit process variables override project values. */
-export const resolveServices = (
-    env: Record<string, string>,
-    network?: string,
-    runtime: Record<string, string | undefined> = process.env
-) => {
-    const requested = network || runtime.NETWORK_URL || env.NETWORK_URL || PRODUCTION_NETWORK;
-    const url = requested === 'staging' ? STAGING_NETWORK : requested;
-    const parsed = new URL(url);
-    if (!['http:', 'https:'].includes(parsed.protocol))
-        throw new Error('Network must be an HTTP(S) tRPC URL or staging.');
-    const staging = url === STAGING_NETWORK;
-    return {
-        network: url,
-        cloud:
-            runtime.CLOUD_URL ||
-            env.CLOUD_URL ||
-            (staging ? 'https://staging.cloud.learncard.com/trpc' : undefined),
-        lcaAPI:
-            runtime.LCA_API_URL ||
-            env.LCA_API_URL ||
-            (staging ? 'https://staging.api.learncard.app/trpc' : undefined),
-    };
-};
-
-/**
- * Docs snippets target production (`network: true`). When a project points at
- * another network, rewrite that one line in the generated file so the code a
- * developer keeps matches the network their .env is on.
- */
-export const PRODUCTION_APP = 'https://learncard.app';
-export const STAGING_APP = 'https://staging.learncard.ai';
-
-/** The LearnCard app that pairs with a network. Local networks have no hosted app; callers pass --app-url. */
-export const appUrlFor = (network: string, override?: string): string => {
-    if (override) return override.replace(/\/$/, '');
-    if (network === STAGING_NETWORK) return STAGING_APP;
-    if (network === PRODUCTION_NETWORK) return PRODUCTION_APP;
-    return PRODUCTION_APP;
-};
-
-export const localizeSnippet = (
-    source: string,
-    services: ReturnType<typeof resolveServices>
-): string => {
-    if (services.network === PRODUCTION_NETWORK) return source;
-    const cloud = services.cloud ? `, cloud: { url: '${services.cloud}' }` : '';
-    return source
-        .replace(
-            /initLearnCard\(\{ seed: process\.env\.SECURE_SEED, network: true \}\)/g,
-            `initLearnCard({ seed: process.env.SECURE_SEED, network: '${services.network}'${cloud} })`
-        )
-        .replace(
-            'https://network.learncard.com/api/send',
-            `${services.network.replace(/\/trpc$/, '')}/api/send`
-        );
-};
-
-/**
- * The docs' send.sh reads $TOKEN from the environment, which is right for a
- * doc. The file the CLI writes should just work, so prepend a loader that reads
- * API_TOKEN from .env without sourcing (executing) the file.
- */
-export const ENV_TOKEN_LOADER = `#!/bin/sh
-set -eu
-# Read API_TOKEN from .env without executing it (strips optional quotes).
-if [ -f .env ]; then
-  API_TOKEN=$(sed -n 's/^API_TOKEN=//p' .env | sed 's/^["'"'"']//; s/["'"'"']$//')
-fi
-TOKEN=\${TOKEN:-\${API_TOKEN:-}}
-: "\${TOKEN:?Run npx @learncard/cli token first}"
-
-`;
-
-export const withEnvTokenLoader = (sendSh: string): string => ENV_TOKEN_LOADER + sendSh;
-
-export function connect(
-    project: Project,
-    options: ProjectOptions & { lca: true }
-): Promise<LCALearnCard>;
-export function connect(
-    project: Project,
-    options: ProjectOptions & { lca?: false }
-): Promise<NetworkCard>;
-export async function connect(
-    project: Project,
-    options: ProjectOptions & { lca?: boolean }
-): Promise<NetworkCard | LCALearnCard> {
-    const seed = project.env.SECURE_SEED;
-    if (!seed) throw new Error('Create an identity before connecting.');
-    const services = resolveServices(project.env, options.network);
-    assertProjectNetwork(project, services.network);
-    if (!options.readOnly && (services.network !== PRODUCTION_NETWORK || project.env.NETWORK_URL)) {
-        await saveProject(project, {
-            NETWORK_URL: services.network === PRODUCTION_NETWORK ? '' : services.network,
-        });
-    }
-    out.log('Connecting to the LearnCard Network...');
-    const config = {
-        seed,
-        network: services.network,
-        ...(services.cloud && { cloud: { url: services.cloud } }),
-        ...(options.didkit && { didkit: options.didkit }),
-    };
-    return options.lca
-        ? initLCALearnCard({
-              ...config,
-              ...(services.lcaAPI && { lcaAPI: services.lcaAPI.replace(/\/api\/?$/, '/trpc') }),
-          })
-        : initLearnCard({
-              ...config,
-              network: services.network === PRODUCTION_NETWORK ? true : services.network,
-          });
-}
-
-/**
- * Open a second wallet on the same seed that authenticates as a `did:web` the
- * network issued to this seed (e.g. a profile manager). Manager-only routes
- * reject the seed's base did:key, so `connect()` alone cannot call them.
- */
-export const connectAsDidWeb = async (
-    project: Project,
-    options: ProjectOptions,
-    didWeb: string
-): Promise<DidWebCard> => {
-    const seed = project.env.SECURE_SEED;
-    if (!seed) throw new Error('Create an identity before connecting.');
-    const services = resolveServices(project.env, options.network);
-    return initLearnCard({
-        seed,
-        network: services.network === PRODUCTION_NETWORK ? true : services.network,
-        didWeb,
-        ...(services.cloud && { cloud: { url: services.cloud } }),
-        ...(options.didkit && { didkit: options.didkit }),
-    });
-};
-
-/**
- * Like `connectAsDidWeb`, plus the LCA plugin so the managed profile can create and
- * register its own hosted signing authority (tokens acting as it have no key to sign with).
- */
-export const connectAsDidWebSigner = async (
-    project: Project,
-    options: ProjectOptions,
-    didWeb: string
-): Promise<LCALearnCard> => {
-    const seed = project.env.SECURE_SEED;
-    if (!seed) throw new Error('Create an identity before connecting.');
-    const services = resolveServices(project.env, options.network);
-    const learnCard = await initLearnCard({
-        seed,
-        network: services.network === PRODUCTION_NETWORK ? true : services.network,
-        didWeb,
-        ...(services.cloud && { cloud: { url: services.cloud } }),
-        ...(options.didkit && { didkit: options.didkit }),
-    });
-    const lcaAPI = services.lcaAPI?.replace(/\/api\/?$/, '/trpc');
-    return learnCard.addPlugin(
-        await getLCAPlugin(
-            learnCard as unknown as Parameters<typeof getLCAPlugin>[0],
-            lcaAPI ?? 'https://api.learncard.app/trpc'
-        )
-    ) as unknown as LCALearnCard;
-};
-
-export const connectAsManaged = async (
-    project: Project,
-    options: ProjectOptions,
-    managedProfileId: string
-): Promise<DidWebCard> => {
-    const managerDid = project.env.ORG_PROFILE_MANAGER_DID;
-    if (!managerDid) {
-        throw new Error(
-            `--as ${managedProfileId} needs a profile manager in this folder. Run \`org apply\` with a profileManager section first.`
-        );
-    }
-    const manager = await connectAsDidWeb(project, options, managerDid);
-    let cursor: string | undefined;
-    do {
-        const page = await manager.invoke.getManagedProfiles({ limit: 100, cursor });
-        const match = page.records.find(record => record.profileId === managedProfileId);
-        if (match) return connectAsDidWeb(project, options, match.did);
-        cursor = page.hasMore ? (page.cursor ?? undefined) : undefined;
-    } while (cursor);
-    throw new Error(
-        `"${managedProfileId}" is not a profile managed from this folder. Add it under profileManager.managed in your org spec and run \`org apply\`.`
-    );
-};
-
-export const ensureProfile = async (
-    learnCard: { invoke: Pick<NetworkCard['invoke'], 'getProfile' | 'createProfile'> },
-    identity: { profileId: string; displayName: string },
-    project?: Project
-): Promise<void> => {
-    const existing = await learnCard.invoke.getProfile();
-    if (existing) {
-        out.log(`Signed in as "${existing.displayName}" (${existing.profileId})`);
-        if (project && project.env.DISPLAY_NAME !== existing.displayName)
-            await saveProject(project, { DISPLAY_NAME: existing.displayName });
-        return;
-    }
-    await learnCard.invoke.createProfile({
-        profileId: identity.profileId,
-        displayName: identity.displayName,
-        bio: '',
-        shortBio: '',
-    });
-    out.log(`Created profile "${identity.displayName}" (${identity.profileId})`);
-};

package/src/promote.test.ts

@@ -1,142 +0,0 @@
-import path from 'node:path';
-import { describe, expect, it } from 'vitest';
-import { PRODUCTION_NETWORK, STAGING_NETWORK } from './project';
-import { assertSourceNetwork, assertTargetSeed, planPromotion, PROMOTE_CHECKLIST } from './promote';
-
-describe('planPromotion', () => {
-    it('places the target under the supplied working directory', () => {
-        expect(planPromotion('staging', 'production', '/tmp/source-project').targetDir).toBe(
-            path.join('/tmp/source-project', '.learncard', 'production')
-        );
-    });
-    it('defaults the working directory to process.cwd()', () => {
-        expect(planPromotion('staging', 'production').targetDir).toBe(
-            path.join(process.cwd(), '.learncard', 'production')
-        );
-    });
-    it('resolves staging -> production and targets a project folder named after it', () => {
-        const plan = planPromotion('staging', 'production');
-        expect(plan.fromNetwork).toBe(STAGING_NETWORK);
-        expect(plan.toNetwork).toBe(PRODUCTION_NETWORK);
-        expect(plan.targetDir.endsWith(`${path.sep}production`)).toBe(true);
-    });
-
-    it('names the target folder after the hostname for a custom network URL', () => {
-        const plan = planPromotion('staging', 'https://network.example.org:8443/trpc');
-        expect(plan.toNetwork).toBe('https://network.example.org:8443/trpc');
-        expect(plan.targetDir.endsWith(`${path.sep}network.example.org`)).toBe(true);
-    });
-
-    it('throws when --from and --to resolve to the same network', () => {
-        expect(() => planPromotion('staging', 'staging')).toThrow('same network');
-        expect(() => planPromotion('production', PRODUCTION_NETWORK)).toThrow('same network');
-    });
-});
-
-describe('PROMOTE_CHECKLIST', () => {
-    it('lists the per-network resources that must be recreated on the target', () => {
-        expect(PROMOTE_CHECKLIST).toContain('API tokens');
-        expect(PROMOTE_CHECKLIST).toContain('Signing authority registrations');
-    });
-});
-
-describe('assertSourceNetwork', () => {
-    it('accepts a staging .env for --from staging (alias or full URL)', () => {
-        expect(() =>
-            assertSourceNetwork({ NETWORK_URL: 'staging' }, 'staging', STAGING_NETWORK)
-        ).not.toThrow();
-        expect(() =>
-            assertSourceNetwork({ NETWORK_URL: STAGING_NETWORK }, 'staging', STAGING_NETWORK)
-        ).not.toThrow();
-    });
-
-    it('accepts an .env with no NETWORK_URL for --from production', () => {
-        expect(() => assertSourceNetwork({}, 'production', PRODUCTION_NETWORK)).not.toThrow();
-    });
-
-    it('throws when the source folder is on a different network than --from', () => {
-        expect(() => assertSourceNetwork({}, 'staging', STAGING_NETWORK)).toThrow(
-            `--from staging does not match this folder's network (${PRODUCTION_NETWORK})`
-        );
-    });
-});
-
-describe('assertTargetSeed', () => {
-    const seed = 'a'.repeat(64);
-
-    it('accepts an empty target or one already bound to the same seed', () => {
-        expect(() => assertTargetSeed({}, seed, '/t')).not.toThrow();
-        expect(() => assertTargetSeed({ SECURE_SEED: seed }, seed, '/t')).not.toThrow();
-    });
-
-    it('rejects a target already bound to a different seed', () => {
-        expect(() => assertTargetSeed({ SECURE_SEED: 'b'.repeat(64) }, seed, '/t')).toThrow(
-            `${path.join('/t', '.env')} already holds a different SECURE_SEED`
-        );
-    });
-});
-
-describe('runPromote --dry-run', () => {
-    it('uses options.cwd without changing process.cwd and leaves the source untouched', async () => {
-        const fs = await import('node:fs/promises');
-        const os = await import('node:os');
-        const { vi } = await import('vitest');
-        const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'lc-promote-'));
-        const previousCwd = process.cwd();
-        const before = `SECURE_SEED=${'a'.repeat(64)}\nPROFILE_ID=exde\nNETWORK_URL=http://localhost:4000/trpc\n`;
-        const runOrgApply = vi.fn().mockResolvedValue(undefined);
-        vi.doMock('./org', () => ({ runOrgApply }));
-        vi.doMock('./doctor', () => ({ runDoctor: vi.fn() }));
-        vi.resetModules();
-        try {
-            await fs.writeFile(path.join(cwd, '.env'), before);
-            const org = path.join(cwd, 'org.yaml');
-            await fs.writeFile(
-                org,
-                'issuer:\n  profileId: exde\n  displayName: Ex\n  signingAuthority: { type: learncard-hosted, name: ex }\n'
-            );
-            const { runPromote } = await import('./promote');
-            await runPromote({
-                cwd,
-                from: 'http://localhost:4000/trpc',
-                to: 'staging',
-                org,
-                dryRun: true,
-            });
-            const targetDir = path.join(cwd, '.learncard', 'staging');
-            expect(runOrgApply).toHaveBeenCalledWith(
-                org,
-                expect.objectContaining({
-                    project: expect.objectContaining({ envPath: path.join(targetDir, '.env') }),
-                    secretsOut: path.join(targetDir, 'secrets.env'),
-                })
-            );
-            expect(process.cwd()).toBe(previousCwd);
-            expect(await fs.readFile(path.join(cwd, '.env'), 'utf8')).toBe(before);
-            expect(await fs.readdir(cwd)).toEqual(['.env', 'org.yaml']);
-
-            runOrgApply.mockClear();
-            await fs.mkdir(targetDir, { recursive: true });
-            await fs.writeFile(path.join(targetDir, '.env'), `SECURE_SEED=${'b'.repeat(64)}\n`);
-            for (const dryRun of [true, false]) {
-                await expect(
-                    runPromote({
-                        cwd,
-                        from: 'http://localhost:4000/trpc',
-                        to: 'staging',
-                        org,
-                        dryRun,
-                    })
-                ).rejects.toThrow('already holds a different SECURE_SEED');
-            }
-            expect(runOrgApply).not.toHaveBeenCalled();
-        } finally {
-            vi.doUnmock('./org');
-            vi.doUnmock('./doctor');
-            vi.resetModules();
-            log.mockRestore();
-            await fs.rm(cwd, { recursive: true, force: true });
-        }
-    }, 20_000);
-});