@peers-app/peers-sdk 0.18.8 → 0.19.6

package/dist/package-installer/package-propagation.test.js

@@ -0,0 +1,1145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const package_versions_1 = require("../data/package-versions");
+const keys_1 = require("../keys");
+const utils_1 = require("../utils");
+const package_author_signing_1 = require("./package-author-signing");
+const package_propagation_1 = require("./package-propagation");
+// --- Mocks ---
+const mockGetUserRole = jest.fn();
+jest.mock("../data/group-permissions", () => ({
+    getUserRole: (...args) => mockGetUserRole(...args),
+}));
+let mockScenario;
+const mockPackagesList = jest.fn();
+const mockPackagesGet = jest.fn();
+const mockPackagesSignAndSave = jest.fn();
+jest.mock("../data/packages", () => ({
+    Packages: (ctx) => ({
+        list: () => {
+            mockPackagesList(ctx);
+            return Promise.resolve(mockScenario?.packages.get(ctx?.dataContextId) ?? []);
+        },
+        get: (pkgId) => {
+            mockPackagesGet(ctx, pkgId);
+            const pkg = mockScenario?.packages
+                .get(ctx?.dataContextId)
+                ?.find((candidate) => candidate.packageId === pkgId);
+            if (pkg)
+                return Promise.resolve(pkg);
+            const pkgsForCtx = mockScenario?.sourcePackages?.get(ctx?.dataContextId);
+            return Promise.resolve(pkgsForCtx?.get(pkgId) ?? undefined);
+        },
+        signAndSave: (pkg, opts) => {
+            if (opts === undefined) {
+                mockPackagesSignAndSave(pkg);
+            }
+            else {
+                mockPackagesSignAndSave(pkg, opts);
+            }
+            const contextId = ctx?.dataContextId;
+            const packages = mockScenario?.packages.get(contextId);
+            if (packages) {
+                const index = packages.findIndex((candidate) => candidate.packageId === pkg.packageId);
+                if (index >= 0) {
+                    packages[index] = pkg;
+                }
+                else {
+                    packages.push(pkg);
+                }
+            }
+            return Promise.resolve(pkg);
+        },
+    }),
+}));
+const mockPvList = jest.fn();
+const mockPvGet = jest.fn();
+const mockPvSignAndSave = jest.fn();
+const packageVersionDataChangedHandlers = new Map();
+jest.mock("../data/package-versions", () => {
+    const actual = jest.requireActual("../data/package-versions");
+    return {
+        ...actual,
+        PackageVersions: (ctx) => ({
+            list: (filter) => {
+                mockPvList(ctx, filter);
+                const allPvs = mockScenario?.pvs.get(ctx?.dataContextId) ?? [];
+                if (filter?.packageId) {
+                    return Promise.resolve(allPvs.filter((pv) => pv.packageId === filter.packageId));
+                }
+                return Promise.resolve(allPvs);
+            },
+            get: (pvId) => {
+                mockPvGet(ctx, pvId);
+                const allPvs = mockScenario?.pvs.get(ctx?.dataContextId) ?? [];
+                const pv = allPvs.find((candidate) => candidate.packageVersionId === pvId);
+                if (pv) {
+                    return Promise.resolve(pv);
+                }
+                const existing = mockScenario?.existingPvIds?.get(ctx?.dataContextId);
+                if (existing?.has(pvId)) {
+                    return Promise.resolve({ packageVersionId: pvId });
+                }
+                return Promise.resolve(undefined);
+            },
+            signAndSave: (pv, opts) => {
+                if (opts === undefined) {
+                    mockPvSignAndSave(pv);
+                }
+                else {
+                    mockPvSignAndSave(pv, opts);
+                }
+                const contextId = ctx?.dataContextId;
+                const pvs = mockScenario?.pvs.get(contextId);
+                if (pvs) {
+                    const index = pvs.findIndex((candidate) => candidate.packageVersionId === pv.packageVersionId);
+                    if (index >= 0) {
+                        pvs[index] = pv;
+                    }
+                    else {
+                        pvs.push(pv);
+                    }
+                }
+                mockScenario?.existingPvIds?.get(contextId)?.add(pv.packageVersionId);
+                return Promise.resolve(pv);
+            },
+            dataChanged: {
+                subscribe: (handler) => {
+                    const contextId = ctx?.dataContextId;
+                    let handlers = packageVersionDataChangedHandlers.get(contextId);
+                    if (!handlers) {
+                        handlers = new Set();
+                        packageVersionDataChangedHandlers.set(contextId, handlers);
+                    }
+                    handlers.add(handler);
+                    return { unsubscribe: () => handlers?.delete(handler) ?? false };
+                },
+            },
+        }),
+    };
+});
+const mockFilesGet = jest.fn();
+const mockFilesSaveFileRecord = jest.fn();
+const filesDataChangedHandlers = new Map();
+jest.mock("../data/files/files", () => ({
+    Files: (ctx) => ({
+        get: (fileId) => {
+            mockFilesGet(ctx, fileId);
+            const filesForCtx = mockScenario?.filesByContext.get(ctx?.dataContextId);
+            return Promise.resolve(filesForCtx?.get(fileId));
+        },
+        saveFileRecord: (f) => {
+            mockFilesSaveFileRecord(f);
+            return Promise.resolve(f);
+        },
+        loadChunkHashesRecursively: (fileId) => {
+            const filesForCtx = mockScenario?.filesByContext.get(ctx?.dataContextId);
+            const file = filesForCtx?.get(fileId);
+            if (!file) {
+                return Promise.reject(new Error(`Index file not found: ${fileId}`));
+            }
+            if (file.loadedChunkHashes) {
+                return Promise.resolve(file.loadedChunkHashes);
+            }
+            if (file.chunkHashes) {
+                return Promise.resolve(file.chunkHashes);
+            }
+            if (file.indexFileId) {
+                const nested = filesForCtx?.get(file.indexFileId);
+                if (nested?.chunkHashes) {
+                    return Promise.resolve(nested.chunkHashes);
+                }
+            }
+            return Promise.reject(new Error(`Index file has no chunk hashes: ${fileId}`));
+        },
+        dataChanged: {
+            subscribe: (handler) => {
+                const contextId = ctx?.dataContextId;
+                let handlers = filesDataChangedHandlers.get(contextId);
+                if (!handlers) {
+                    handlers = new Set();
+                    filesDataChangedHandlers.set(contextId, handlers);
+                }
+                handlers.add(handler);
+                return { unsubscribe: () => handlers?.delete(handler) ?? false };
+            },
+        },
+    }),
+}));
+// --- Helpers ---
+const authorKeys = (0, keys_1.newKeys)();
+function hashChunkHashes(chunkHashes) {
+    return (0, keys_1.hashBytes)(new TextEncoder().encode(JSON.stringify(chunkHashes)));
+}
+function testChunkHashes(fileId) {
+    return [`chunk-${fileId}`];
+}
+function makeFileRecord(fileId, overrides) {
+    const chunkHashes = overrides?.chunkHashes ?? testChunkHashes(fileId);
+    return {
+        fileId,
+        name: "file",
+        fileSize: 100,
+        fileHash: hashChunkHashes(chunkHashes),
+        chunkHashes,
+        ...overrides,
+    };
+}
+function makePkg(overrides) {
+    return {
+        packageId: (0, utils_1.newid)(),
+        name: "test-package",
+        description: "A test package",
+        createdBy: (0, utils_1.newid)(),
+        publishPublicKey: authorKeys.publicKey,
+        versionFollowRange: "latest",
+        followVersionTags: "stable",
+        signature: "fake-sig",
+        ...overrides,
+    };
+}
+function makePV(packageId, overrides) {
+    const packageBundleFileId = (0, utils_1.newid)();
+    const routesBundleFileId = (0, utils_1.newid)();
+    const uiBundleFileId = (0, utils_1.newid)();
+    const packageBundleFileHash = makeFileRecord(packageBundleFileId).fileHash;
+    const routesBundleFileHash = makeFileRecord(routesBundleFileId).fileHash;
+    const uiBundleFileHash = makeFileRecord(uiBundleFileId).fileHash;
+    const pv = {
+        packageVersionId: (0, utils_1.newid)(),
+        packageId,
+        version: "1.0.0",
+        versionTag: "stable",
+        packageVersionHash: (0, package_versions_1.computePackageVersionHash)("1.0.0", "stable", packageBundleFileHash, routesBundleFileHash, uiBundleFileHash),
+        packageBundleFileId,
+        packageBundleFileHash,
+        routesBundleFileId,
+        routesBundleFileHash,
+        uiBundleFileId,
+        uiBundleFileHash,
+        packageAuthorSignature: undefined,
+        signature: "fake-pv-sig",
+        createdBy: (0, utils_1.newid)(),
+        createdAt: new Date().toISOString(),
+        ...overrides,
+    };
+    return pv;
+}
+function makeSignedPV(packageId, overrides) {
+    const pv = makePV(packageId, overrides);
+    pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, authorKeys.secretKey);
+    return pv;
+}
+function makeSignedPVWithSecretKey(packageId, secretKey, overrides) {
+    const pv = makePV(packageId, overrides);
+    pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, secretKey);
+    return pv;
+}
+function makeDataContext(groupId) {
+    return { groupId, dataContextId: groupId ?? "user-ctx" };
+}
+function makeUserContext(opts) {
+    const subscribers = new Set();
+    const groupIds = (() => Array.from(opts.groups.keys()));
+    groupIds.subscribe = (handler) => {
+        subscribers.add(handler);
+        return { dispose: () => subscribers.delete(handler) };
+    };
+    groupIds.notifySubscribers = () => {
+        for (const subscriber of subscribers)
+            subscriber();
+    };
+    return {
+        userId: opts.userId,
+        userDataContext: opts.userDataContext ?? makeDataContext(undefined),
+        groupDataContexts: opts.groups,
+        groupIds,
+    };
+}
+beforeEach(() => {
+    jest.clearAllMocks();
+    packageVersionDataChangedHandlers.clear();
+    filesDataChangedHandlers.clear();
+    mockScenario = undefined;
+});
+/**
+ * Since jest.mock replaces module-level exports, we need a way to make the
+ * mocked Packages/PackageVersions/Files return different data per DataContext.
+ * We achieve this by having the mock implementations check which context
+ * they were "called for" via a tracking variable set before each call.
+ *
+ * The propagation module calls `Packages(dataContext)`, `PackageVersions(dataContext)`,
+ * etc. — so we re-mock them to capture the dataContext arg.
+ */
+// Override mocks to be context-aware
+function setupMocksForScenario(scenario) {
+    const filesByContext = new Map();
+    for (const [contextId, files] of scenario.files ?? []) {
+        filesByContext.set(contextId, new Map(files));
+    }
+    for (const [contextId, pvs] of scenario.pvs) {
+        const files = filesByContext.get(contextId) ?? new Map();
+        filesByContext.set(contextId, files);
+        for (const pv of pvs) {
+            if (!files.has(pv.packageBundleFileId)) {
+                files.set(pv.packageBundleFileId, makeFileRecord(pv.packageBundleFileId));
+            }
+            if (pv.routesBundleFileId && !files.has(pv.routesBundleFileId)) {
+                files.set(pv.routesBundleFileId, makeFileRecord(pv.routesBundleFileId));
+            }
+            if (pv.uiBundleFileId && !files.has(pv.uiBundleFileId)) {
+                files.set(pv.uiBundleFileId, makeFileRecord(pv.uiBundleFileId));
+            }
+        }
+    }
+    mockScenario = { ...scenario, filesByContext };
+    // getUserRole mock
+    mockGetUserRole.mockImplementation((groupId) => {
+        const role = scenario.roles?.get(groupId);
+        return Promise.resolve(role ?? 0);
+    });
+}
+// --- Tests ---
+describe("discoverAndPropagateVersions", () => {
+    const userId = (0, utils_1.newid)();
+    it("propagates a valid author-signed PV from group A to group B (happy path)", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([
+                [groupB, [pkg]], // target group has the package
+            ]),
+            pvs: new Map([
+                [groupA, [signedPv]], // source group has the signed PV
+                [groupB, []], // target has nothing
+            ]),
+            roles: new Map([
+                [groupA, 60], // Admin
+                [groupB, 60], // Admin
+            ]),
+            sourcePackages: new Map([[groupA, new Map([[pkg.packageId, pkg]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        expect(results[0]).toMatchObject({
+            groupId: groupB,
+            packageId: pkg.packageId,
+            packageVersionId: signedPv.packageVersionId,
+            version: "2.0.0",
+            versionTag: "stable",
+            activated: true,
+        });
+        expect(mockPvSignAndSave).toHaveBeenCalled();
+        expect(mockFilesSaveFileRecord).toHaveBeenCalled();
+    });
+    it("skips groups where user is not admin", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 40], // Writer — not admin
+                [groupB, 40], // Writer — not admin
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        expect(mockPvSignAndSave).not.toHaveBeenCalled();
+    });
+    it("skips unsigned PVs (no packageAuthorSignature)", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const unsignedPv = makePV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [unsignedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+    });
+    it("installs older signed versions without activating them over a newer active version", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const localPv = makePV(pkg.packageId, { version: "3.0.0", versionTag: "stable" });
+        const targetPkg = makePkg({
+            packageId: pkg.packageId,
+            publishPublicKey: pkg.publishPublicKey,
+            activePackageVersionId: localPv.packageVersionId,
+        });
+        const olderSignedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [targetPkg]]]),
+            pvs: new Map([
+                [groupA, [olderSignedPv]],
+                [groupB, [localPv]], // target already has 3.0.0
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        expect(results[0]).toMatchObject({
+            packageVersionId: olderSignedPv.packageVersionId,
+            activated: false,
+        });
+        expect(mockPvSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageVersionId: olderSignedPv.packageVersionId,
+        }), { saveAsSnapshot: true });
+    });
+    it("installs beta PVs in stable-only groups without activating them", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg({ followVersionTags: "stable" });
+        const betaPv = makeSignedPV(pkg.packageId, {
+            version: "2.0.0",
+            versionTag: "beta",
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [betaPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        expect(results[0]).toMatchObject({
+            packageVersionId: betaPv.packageVersionId,
+            activated: false,
+        });
+    });
+    it("establishes TOFU when target has empty publishPublicKey", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkgWithKey = makePkg();
+        const pkgNoKey = makePkg({
+            packageId: pkgWithKey.packageId,
+            publishPublicKey: "", // no TOFU anchor yet
+        });
+        const signedPv = makeSignedPV(pkgWithKey.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkgNoKey]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            sourcePackages: new Map([[groupA, new Map([[pkgWithKey.packageId, pkgWithKey]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        // Should have called signAndSave on Packages to set publishPublicKey
+        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageId: pkgWithKey.packageId,
+            publishPublicKey: authorKeys.publicKey,
+        }));
+    });
+    it("uses deterministic source ordering when establishing TOFU", async () => {
+        const groupA = "group-a";
+        const groupZ = "group-z";
+        const groupTarget = "group-target";
+        const ctxA = makeDataContext(groupA);
+        const ctxZ = makeDataContext(groupZ);
+        const ctxTarget = makeDataContext(groupTarget);
+        const groups = new Map([
+            [groupZ, ctxZ],
+            [groupTarget, ctxTarget],
+            [groupA, ctxA],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const keyA = (0, keys_1.newKeys)();
+        const keyZ = (0, keys_1.newKeys)();
+        const packageId = (0, utils_1.newid)();
+        const packageVersionId = (0, utils_1.newid)();
+        const pkgA = makePkg({ packageId, publishPublicKey: keyA.publicKey });
+        const pkgZ = makePkg({ packageId, publishPublicKey: keyZ.publicKey });
+        const targetPkg = makePkg({ packageId, publishPublicKey: "" });
+        const pvA = makeSignedPVWithSecretKey(packageId, keyA.secretKey, {
+            packageVersionId,
+            version: "2.0.0",
+            createdAt: "2026-01-01T00:00:00.000Z",
+        });
+        const pvZ = {
+            ...pvA,
+            packageAuthorSignature: (0, package_author_signing_1.signPackageAuthor)(pvA, keyZ.secretKey),
+        };
+        setupMocksForScenario({
+            packages: new Map([
+                [groupA, []],
+                [groupZ, []],
+                [groupTarget, [targetPkg]],
+            ]),
+            pvs: new Map([
+                [groupA, [pvA]],
+                [groupZ, [pvZ]],
+                [groupTarget, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupZ, 60],
+                [groupTarget, 60],
+            ]),
+            sourcePackages: new Map([
+                [groupA, new Map([[packageId, pkgA]])],
+                [groupZ, new Map([[packageId, pkgZ]])],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageId,
+            publishPublicKey: keyA.publicKey,
+        }));
+    });
+    it("rejects PV when target publishPublicKey differs from signer", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const differentKeys = (0, keys_1.newKeys)();
+        const pkg = makePkg({ publishPublicKey: differentKeys.publicKey });
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        // signedPv is signed with authorKeys, but pkg has differentKeys
+        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        consoleError.mockRestore();
+    });
+    it("skips PV when packageVersionId already exists in target (dedup)", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            existingPvIds: new Map([[groupB, new Set([signedPv.packageVersionId])]]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        expect(mockPvSignAndSave).not.toHaveBeenCalled();
+    });
+    it("copies all bundle file records (package, routes, ui)", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        const packageFile = makeFileRecord(signedPv.packageBundleFileId, {
+            name: "package.bundle.js",
+            fileSize: 1000,
+        });
+        const routesFile = makeFileRecord(signedPv.routesBundleFileId, {
+            name: "routes.bundle.js",
+            fileSize: 500,
+        });
+        const uiFile = makeFileRecord(signedPv.uiBundleFileId, {
+            name: "uis.bundle.js",
+            fileSize: 300,
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            files: new Map([
+                [
+                    groupA,
+                    new Map([
+                        [signedPv.packageBundleFileId, packageFile],
+                        [signedPv.routesBundleFileId, routesFile],
+                        [signedPv.uiBundleFileId, uiFile],
+                    ]),
+                ],
+            ]),
+        });
+        await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledTimes(3);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(packageFile);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(routesFile);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(uiFile);
+    });
+    it("rejects propagation when the required package bundle file record is missing", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, undefined]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        expect(mockPvSignAndSave).not.toHaveBeenCalled();
+        consoleError.mockRestore();
+    });
+    it("rejects file metadata when fileHash does not match the signed PV hash", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        const badFile = makeFileRecord(signedPv.packageBundleFileId, { fileHash: "wrong-hash" });
+        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, badFile]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        expect(mockPvSignAndSave).not.toHaveBeenCalled();
+        consoleError.mockRestore();
+    });
+    it("propagates file with tampered chunkHashes if fileHash matches PV (integrity deferred to FileReadStream)", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        const badFile = makeFileRecord(signedPv.packageBundleFileId, {
+            fileHash: signedPv.packageBundleFileHash,
+            chunkHashes: ["tampered-chunk"],
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, badFile]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        // Propagation trusts fileHash match; FileReadStream catches chunk tampering at read time
+        expect(results).toHaveLength(1);
+        expect(mockPvSignAndSave).toHaveBeenCalled();
+    });
+    it("copies indexed file metadata recursively for large package bundles", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const packageBundleFileId = (0, utils_1.newid)();
+        const indexFileId = (0, utils_1.newid)();
+        const bundleChunkHashes = ["bundle-chunk-a", "bundle-chunk-b"];
+        const packageBundleFileHash = hashChunkHashes(bundleChunkHashes);
+        const signedPv = makeSignedPV(pkg.packageId, {
+            version: "2.0.0",
+            packageBundleFileId,
+            packageBundleFileHash,
+        });
+        const packageFile = {
+            fileId: packageBundleFileId,
+            name: "package.bundle.js",
+            fileSize: 1024 * 1024 * 1024 + 1,
+            fileHash: packageBundleFileHash,
+            indexFileId,
+        };
+        const indexFile = makeFileRecord(indexFileId, {
+            name: `index-${indexFileId}.json`,
+            isIndexFile: true,
+            loadedChunkHashes: bundleChunkHashes,
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+            files: new Map([
+                [
+                    groupA,
+                    new Map([
+                        [packageBundleFileId, packageFile],
+                        [indexFileId, indexFile],
+                    ]),
+                ],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(1);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(indexFile);
+        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(packageFile);
+    });
+    it("rejects malformed optional bundle references", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const missingHashPv = makeSignedPV(pkg.packageId, {
+            version: "2.0.0",
+            routesBundleFileHash: undefined,
+        });
+        const missingIdPv = makeSignedPV(pkg.packageId, {
+            version: "3.0.0",
+            routesBundleFileId: undefined,
+        });
+        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [missingHashPv, missingIdPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+        expect(mockPvSignAndSave).not.toHaveBeenCalled();
+        consoleError.mockRestore();
+    });
+    it("recomputes packageVersionHash instead of trusting the source PV value", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, {
+            version: "2.0.0",
+            packageVersionHash: "untrusted-source-value",
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(mockPvSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageVersionHash: (0, package_versions_1.computePackageVersionHash)(signedPv.version, signedPv.versionTag ?? "", signedPv.packageBundleFileHash, signedPv.routesBundleFileHash, signedPv.uiBundleFileHash),
+        }), { saveAsSnapshot: true });
+        expect(mockPvSignAndSave).not.toHaveBeenCalledWith(expect.objectContaining({ packageVersionHash: "untrusted-source-value" }), expect.anything());
+    });
+    it("auto-activates with versionFollowRange 'latest', does not activate with 'pinned'", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const groupC = "group-c";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const ctxC = makeDataContext(groupC);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+            [groupC, ctxC],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkgLatest = makePkg({ versionFollowRange: "latest" });
+        const pkgPinned = makePkg({
+            packageId: pkgLatest.packageId,
+            publishPublicKey: pkgLatest.publishPublicKey,
+            versionFollowRange: "pinned",
+        });
+        const signedPv = makeSignedPV(pkgLatest.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([
+                [groupB, [pkgLatest]],
+                [groupC, [pkgPinned]],
+            ]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+                [groupC, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+                [groupC, 60],
+            ]),
+            sourcePackages: new Map([[groupA, new Map([[pkgLatest.packageId, pkgLatest]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        const activatedResult = results.find((r) => r.groupId === groupB);
+        const pinnedResult = results.find((r) => r.groupId === groupC);
+        expect(activatedResult?.activated).toBe(true);
+        expect(pinnedResult?.activated).toBe(false);
+    });
+    it("auto-activates patch and minor ranges using the real active PV version", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const groupC = "group-c";
+        const groupD = "group-d";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const ctxC = makeDataContext(groupC);
+        const ctxD = makeDataContext(groupD);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+            [groupC, ctxC],
+            [groupD, ctxD],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const patchBasePkg = makePkg();
+        const minorBasePkg = makePkg();
+        const patchRejectBasePkg = makePkg();
+        const patchActive = makePV(patchBasePkg.packageId, { version: "1.2.0" });
+        const minorActive = makePV(minorBasePkg.packageId, { version: "1.2.0" });
+        const patchRejectActive = makePV(patchRejectBasePkg.packageId, { version: "1.2.0" });
+        const patchPkg = makePkg({
+            packageId: patchBasePkg.packageId,
+            publishPublicKey: patchBasePkg.publishPublicKey,
+            versionFollowRange: "patch",
+            activePackageVersionId: patchActive.packageVersionId,
+        });
+        const minorPkg = makePkg({
+            packageId: minorBasePkg.packageId,
+            publishPublicKey: minorBasePkg.publishPublicKey,
+            versionFollowRange: "minor",
+            activePackageVersionId: minorActive.packageVersionId,
+        });
+        const patchRejectPkg = makePkg({
+            packageId: patchRejectBasePkg.packageId,
+            publishPublicKey: patchRejectBasePkg.publishPublicKey,
+            versionFollowRange: "patch",
+            activePackageVersionId: patchRejectActive.packageVersionId,
+        });
+        const patchPv = makeSignedPV(patchBasePkg.packageId, { version: "1.2.1" });
+        const minorPv = makeSignedPV(minorBasePkg.packageId, { version: "1.3.0" });
+        const patchRejectPv = makeSignedPV(patchRejectBasePkg.packageId, { version: "1.3.0" });
+        setupMocksForScenario({
+            packages: new Map([
+                [groupB, [patchPkg]],
+                [groupC, [minorPkg]],
+                [groupD, [patchRejectPkg]],
+            ]),
+            pvs: new Map([
+                [groupA, [patchPv, minorPv, patchRejectPv]],
+                [groupB, [patchActive]],
+                [groupC, [minorActive]],
+                [groupD, [patchRejectActive]],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+                [groupC, 60],
+                [groupD, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results.find((r) => r.groupId === groupB)?.activated).toBe(true);
+        expect(results.find((r) => r.groupId === groupC)?.activated).toBe(true);
+        expect(results.find((r) => r.groupId === groupD)?.activated).toBe(false);
+    });
+    it("installs all valid candidates and leaves the newest eligible version active", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const olderPv = makeSignedPV(pkg.packageId, {
+            version: "2.0.0",
+            createdAt: "2026-01-01T00:00:00.000Z",
+        });
+        const newerPv = makeSignedPV(pkg.packageId, {
+            version: "3.0.0",
+            createdAt: "2026-01-02T00:00:00.000Z",
+        });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [pkg]]]),
+            pvs: new Map([
+                [groupA, [olderPv, newerPv]],
+                [groupB, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(2);
+        expect(results.find((result) => result.packageVersionId === newerPv.packageVersionId)).toMatchObject({
+            packageVersionId: newerPv.packageVersionId,
+            version: "3.0.0",
+            activated: true,
+        });
+        expect(results.find((result) => result.packageVersionId === olderPv.packageVersionId)).toMatchObject({
+            packageVersionId: olderPv.packageVersionId,
+            version: "2.0.0",
+            activated: false,
+        });
+        expect(mockPvSignAndSave).toHaveBeenCalledTimes(2);
+        expect(mockPackagesSignAndSave).toHaveBeenLastCalledWith(expect.objectContaining({ activePackageVersionId: newerPv.packageVersionId }));
+    });
+    it("uses the active PV tag when followVersionTags is undefined", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg({ followVersionTags: undefined });
+        const activeBetaPv = makePV(pkg.packageId, { version: "1.0.0", versionTag: "beta" });
+        const targetPkg = makePkg({
+            packageId: pkg.packageId,
+            publishPublicKey: pkg.publishPublicKey,
+            followVersionTags: undefined,
+            activePackageVersionId: activeBetaPv.packageVersionId,
+        });
+        const stablePv = makeSignedPV(pkg.packageId, { version: "3.0.0", versionTag: "stable" });
+        const betaPv = makeSignedPV(pkg.packageId, { version: "2.0.0", versionTag: "beta" });
+        setupMocksForScenario({
+            packages: new Map([[groupB, [targetPkg]]]),
+            pvs: new Map([
+                [groupA, [stablePv, betaPv]],
+                [groupB, [activeBetaPv]],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(2);
+        expect(results.find((result) => result.packageVersionId === stablePv.packageVersionId)).toMatchObject({
+            packageVersionId: stablePv.packageVersionId,
+            versionTag: "stable",
+            activated: false,
+        });
+        expect(results.find((result) => result.packageVersionId === betaPv.packageVersionId)).toMatchObject({
+            packageVersionId: betaPv.packageVersionId,
+            versionTag: "beta",
+            activated: true,
+        });
+    });
+    it("propagates from one source to multiple admin groups", async () => {
+        const groupA = "group-a";
+        const groupB = "group-b";
+        const groupC = "group-c";
+        const ctxA = makeDataContext(groupA);
+        const ctxB = makeDataContext(groupB);
+        const ctxC = makeDataContext(groupC);
+        const groups = new Map([
+            [groupA, ctxA],
+            [groupB, ctxB],
+            [groupC, ctxC],
+        ]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg();
+        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
+        setupMocksForScenario({
+            packages: new Map([
+                [groupB, [pkg]],
+                [groupC, [pkg]],
+            ]),
+            pvs: new Map([
+                [groupA, [signedPv]],
+                [groupB, []],
+                [groupC, []],
+            ]),
+            roles: new Map([
+                [groupA, 60],
+                [groupB, 60],
+                [groupC, 60],
+            ]),
+            sourcePackages: new Map([[groupA, new Map([[pkg.packageId, pkg]])]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(2);
+        expect(results.map((r) => r.groupId).sort()).toEqual(["group-b", "group-c"]);
+    });
+    it("returns empty results when no packages have publishPublicKey", async () => {
+        const groupA = "group-a";
+        const ctxA = makeDataContext(groupA);
+        const groups = new Map([[groupA, ctxA]]);
+        const userContext = makeUserContext({ userId, groups });
+        const pkg = makePkg({ publishPublicKey: "" });
+        setupMocksForScenario({
+            packages: new Map([[groupA, [pkg]]]),
+            pvs: new Map([[groupA, []]]),
+            roles: new Map([[groupA, 60]]),
+        });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+    });
+    it("returns empty results when user has no groups", async () => {
+        const groups = new Map();
+        const userContext = makeUserContext({ userId, groups });
+        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+        expect(results).toHaveLength(0);
+    });
+});