@peers-app/peers-sdk 0.27.2 → 0.27.4

package/dist/package-installer/package-propagation.test.js

@@ -1,1269 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const package_versions_1 = require("../data/package-versions");
-const keys_1 = require("../keys");
-const systemIds = require("../system-ids");
-const utils_1 = require("../utils");
-const package_author_signing_1 = require("./package-author-signing");
-const package_propagation_1 = require("./package-propagation");
-// --- Mocks ---
-// Pin the host to a fresh "current" peers-core key and revoke a fresh "old" one so the
-// revocation tests do not depend on the real constants.
-jest.mock("../system-ids", () => {
-    const actual = jest.requireActual("../system-ids");
-    const { newKeys: makeKeys } = jest.requireActual("../keys");
-    const revoked = makeKeys();
-    const current = makeKeys();
-    return {
-        ...actual,
-        peersCorePublishPublicKey: current.publicKey,
-        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
-        __testKeys: { revoked, current },
-    };
-});
-const { revoked: revokedCoreKeys, current: currentCoreKeys } = systemIds.__testKeys;
-const mockGetUserRole = jest.fn();
-jest.mock("../data/group-permissions", () => ({
-    getUserRole: (...args) => mockGetUserRole(...args),
-}));
-let mockScenario;
-const mockPackagesList = jest.fn();
-const mockPackagesGet = jest.fn();
-const mockPackagesSignAndSave = jest.fn();
-jest.mock("../data/packages", () => ({
-    Packages: (ctx) => ({
-        list: () => {
-            mockPackagesList(ctx);
-            return Promise.resolve(mockScenario?.packages.get(ctx?.dataContextId) ?? []);
-        },
-        get: (pkgId) => {
-            mockPackagesGet(ctx, pkgId);
-            const pkg = mockScenario?.packages
-                .get(ctx?.dataContextId)
-                ?.find((candidate) => candidate.packageId === pkgId);
-            if (pkg)
-                return Promise.resolve(pkg);
-            const pkgsForCtx = mockScenario?.sourcePackages?.get(ctx?.dataContextId);
-            return Promise.resolve(pkgsForCtx?.get(pkgId) ?? undefined);
-        },
-        signAndSave: (pkg, opts) => {
-            if (opts === undefined) {
-                mockPackagesSignAndSave(pkg);
-            }
-            else {
-                mockPackagesSignAndSave(pkg, opts);
-            }
-            const contextId = ctx?.dataContextId;
-            const packages = mockScenario?.packages.get(contextId);
-            if (packages) {
-                const index = packages.findIndex((candidate) => candidate.packageId === pkg.packageId);
-                if (index >= 0) {
-                    packages[index] = pkg;
-                }
-                else {
-                    packages.push(pkg);
-                }
-            }
-            return Promise.resolve(pkg);
-        },
-    }),
-}));
-const mockPvList = jest.fn();
-const mockPvGet = jest.fn();
-const mockPvSignAndSave = jest.fn();
-const packageVersionDataChangedHandlers = new Map();
-jest.mock("../data/package-versions", () => {
-    const actual = jest.requireActual("../data/package-versions");
-    return {
-        ...actual,
-        PackageVersions: (ctx) => ({
-            list: (filter) => {
-                mockPvList(ctx, filter);
-                const allPvs = mockScenario?.pvs.get(ctx?.dataContextId) ?? [];
-                if (filter?.packageId) {
-                    return Promise.resolve(allPvs.filter((pv) => pv.packageId === filter.packageId));
-                }
-                return Promise.resolve(allPvs);
-            },
-            get: (pvId) => {
-                mockPvGet(ctx, pvId);
-                const allPvs = mockScenario?.pvs.get(ctx?.dataContextId) ?? [];
-                const pv = allPvs.find((candidate) => candidate.packageVersionId === pvId);
-                if (pv) {
-                    return Promise.resolve(pv);
-                }
-                const existing = mockScenario?.existingPvIds?.get(ctx?.dataContextId);
-                if (existing?.has(pvId)) {
-                    return Promise.resolve({ packageVersionId: pvId });
-                }
-                return Promise.resolve(undefined);
-            },
-            signAndSave: (pv, opts) => {
-                if (opts === undefined) {
-                    mockPvSignAndSave(pv);
-                }
-                else {
-                    mockPvSignAndSave(pv, opts);
-                }
-                const contextId = ctx?.dataContextId;
-                const pvs = mockScenario?.pvs.get(contextId);
-                if (pvs) {
-                    const index = pvs.findIndex((candidate) => candidate.packageVersionId === pv.packageVersionId);
-                    if (index >= 0) {
-                        pvs[index] = pv;
-                    }
-                    else {
-                        pvs.push(pv);
-                    }
-                }
-                mockScenario?.existingPvIds?.get(contextId)?.add(pv.packageVersionId);
-                return Promise.resolve(pv);
-            },
-            dataChanged: {
-                subscribe: (handler) => {
-                    const contextId = ctx?.dataContextId;
-                    let handlers = packageVersionDataChangedHandlers.get(contextId);
-                    if (!handlers) {
-                        handlers = new Set();
-                        packageVersionDataChangedHandlers.set(contextId, handlers);
-                    }
-                    handlers.add(handler);
-                    return { unsubscribe: () => handlers?.delete(handler) ?? false };
-                },
-            },
-        }),
-    };
-});
-const mockFilesGet = jest.fn();
-const mockFilesSaveFileRecord = jest.fn();
-const filesDataChangedHandlers = new Map();
-jest.mock("../data/files/files", () => ({
-    Files: (ctx) => ({
-        get: (fileId) => {
-            mockFilesGet(ctx, fileId);
-            const filesForCtx = mockScenario?.filesByContext.get(ctx?.dataContextId);
-            return Promise.resolve(filesForCtx?.get(fileId));
-        },
-        saveFileRecord: (f) => {
-            mockFilesSaveFileRecord(f);
-            return Promise.resolve(f);
-        },
-        loadChunkHashesRecursively: (fileId) => {
-            const filesForCtx = mockScenario?.filesByContext.get(ctx?.dataContextId);
-            const file = filesForCtx?.get(fileId);
-            if (!file) {
-                return Promise.reject(new Error(`Index file not found: ${fileId}`));
-            }
-            if (file.loadedChunkHashes) {
-                return Promise.resolve(file.loadedChunkHashes);
-            }
-            if (file.chunkHashes) {
-                return Promise.resolve(file.chunkHashes);
-            }
-            if (file.indexFileId) {
-                const nested = filesForCtx?.get(file.indexFileId);
-                if (nested?.chunkHashes) {
-                    return Promise.resolve(nested.chunkHashes);
-                }
-            }
-            return Promise.reject(new Error(`Index file has no chunk hashes: ${fileId}`));
-        },
-        dataChanged: {
-            subscribe: (handler) => {
-                const contextId = ctx?.dataContextId;
-                let handlers = filesDataChangedHandlers.get(contextId);
-                if (!handlers) {
-                    handlers = new Set();
-                    filesDataChangedHandlers.set(contextId, handlers);
-                }
-                handlers.add(handler);
-                return { unsubscribe: () => handlers?.delete(handler) ?? false };
-            },
-        },
-    }),
-}));
-// --- Helpers ---
-const authorKeys = (0, keys_1.newKeys)();
-function hashChunkHashes(chunkHashes) {
-    return (0, keys_1.hashBytes)(new TextEncoder().encode(JSON.stringify(chunkHashes)));
-}
-function testChunkHashes(fileId) {
-    return [`chunk-${fileId}`];
-}
-function makeFileRecord(fileId, overrides) {
-    const chunkHashes = overrides?.chunkHashes ?? testChunkHashes(fileId);
-    return {
-        fileId,
-        name: "file",
-        fileSize: 100,
-        fileHash: hashChunkHashes(chunkHashes),
-        chunkHashes,
-        ...overrides,
-    };
-}
-function makePkg(overrides) {
-    return {
-        packageId: (0, utils_1.newid)(),
-        name: "test-package",
-        description: "A test package",
-        createdBy: (0, utils_1.newid)(),
-        publishPublicKey: authorKeys.publicKey,
-        versionFollowRange: "latest",
-        followVersionTags: "stable",
-        signature: "fake-sig",
-        ...overrides,
-    };
-}
-function makePV(packageId, overrides) {
-    const packageBundleFileId = (0, utils_1.newid)();
-    const routesBundleFileId = (0, utils_1.newid)();
-    const uiBundleFileId = (0, utils_1.newid)();
-    const packageBundleFileHash = makeFileRecord(packageBundleFileId).fileHash;
-    const routesBundleFileHash = makeFileRecord(routesBundleFileId).fileHash;
-    const uiBundleFileHash = makeFileRecord(uiBundleFileId).fileHash;
-    const pv = {
-        packageVersionId: (0, utils_1.newid)(),
-        packageId,
-        version: "1.0.0",
-        versionTag: "stable",
-        packageVersionHash: (0, package_versions_1.computePackageVersionHash)("1.0.0", "stable", packageBundleFileHash, routesBundleFileHash, uiBundleFileHash),
-        packageBundleFileId,
-        packageBundleFileHash,
-        routesBundleFileId,
-        routesBundleFileHash,
-        uiBundleFileId,
-        uiBundleFileHash,
-        packageAuthorSignature: undefined,
-        signature: "fake-pv-sig",
-        createdBy: (0, utils_1.newid)(),
-        createdAt: new Date().toISOString(),
-        ...overrides,
-    };
-    return pv;
-}
-function makeSignedPV(packageId, overrides) {
-    const pv = makePV(packageId, overrides);
-    pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, authorKeys.secretKey);
-    return pv;
-}
-function makeSignedPVWithSecretKey(packageId, secretKey, overrides) {
-    const pv = makePV(packageId, overrides);
-    pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, secretKey);
-    return pv;
-}
-function makeDataContext(groupId) {
-    return { groupId, dataContextId: groupId ?? "user-ctx" };
-}
-function makeUserContext(opts) {
-    const subscribers = new Set();
-    const groupIds = (() => Array.from(opts.groups.keys()));
-    groupIds.subscribe = (handler) => {
-        subscribers.add(handler);
-        return { dispose: () => subscribers.delete(handler) };
-    };
-    groupIds.notifySubscribers = () => {
-        for (const subscriber of subscribers)
-            subscriber();
-    };
-    return {
-        userId: opts.userId,
-        userDataContext: opts.userDataContext ?? makeDataContext(undefined),
-        groupDataContexts: opts.groups,
-        groupIds,
-    };
-}
-beforeEach(() => {
-    jest.clearAllMocks();
-    packageVersionDataChangedHandlers.clear();
-    filesDataChangedHandlers.clear();
-    mockScenario = undefined;
-});
-/**
- * Since jest.mock replaces module-level exports, we need a way to make the
- * mocked Packages/PackageVersions/Files return different data per DataContext.
- * We achieve this by having the mock implementations check which context
- * they were "called for" via a tracking variable set before each call.
- *
- * The propagation module calls `Packages(dataContext)`, `PackageVersions(dataContext)`,
- * etc. — so we re-mock them to capture the dataContext arg.
- */
-// Override mocks to be context-aware
-function setupMocksForScenario(scenario) {
-    const filesByContext = new Map();
-    for (const [contextId, files] of scenario.files ?? []) {
-        filesByContext.set(contextId, new Map(files));
-    }
-    for (const [contextId, pvs] of scenario.pvs) {
-        const files = filesByContext.get(contextId) ?? new Map();
-        filesByContext.set(contextId, files);
-        for (const pv of pvs) {
-            if (!files.has(pv.packageBundleFileId)) {
-                files.set(pv.packageBundleFileId, makeFileRecord(pv.packageBundleFileId));
-            }
-            if (pv.routesBundleFileId && !files.has(pv.routesBundleFileId)) {
-                files.set(pv.routesBundleFileId, makeFileRecord(pv.routesBundleFileId));
-            }
-            if (pv.uiBundleFileId && !files.has(pv.uiBundleFileId)) {
-                files.set(pv.uiBundleFileId, makeFileRecord(pv.uiBundleFileId));
-            }
-        }
-    }
-    mockScenario = { ...scenario, filesByContext };
-    // getUserRole mock
-    mockGetUserRole.mockImplementation((groupId) => {
-        const role = scenario.roles?.get(groupId);
-        return Promise.resolve(role ?? 0);
-    });
-}
-// --- Tests ---
-describe("discoverAndPropagateVersions", () => {
-    const userId = (0, utils_1.newid)();
-    it("propagates a valid author-signed PV from group A to group B (happy path)", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([
-                [groupB, [pkg]], // target group has the package
-            ]),
-            pvs: new Map([
-                [groupA, [signedPv]], // source group has the signed PV
-                [groupB, []], // target has nothing
-            ]),
-            roles: new Map([
-                [groupA, 60], // Admin
-                [groupB, 60], // Admin
-            ]),
-            sourcePackages: new Map([[groupA, new Map([[pkg.packageId, pkg]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        expect(results[0]).toMatchObject({
-            groupId: groupB,
-            packageId: pkg.packageId,
-            packageVersionId: signedPv.packageVersionId,
-            version: "2.0.0",
-            versionTag: "stable",
-            activated: true,
-        });
-        expect(mockPvSignAndSave).toHaveBeenCalled();
-        expect(mockFilesSaveFileRecord).toHaveBeenCalled();
-    });
-    it("skips groups where user is not admin", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 40], // Writer — not admin
-                [groupB, 40], // Writer — not admin
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        expect(mockPvSignAndSave).not.toHaveBeenCalled();
-    });
-    it("skips unsigned PVs (no packageAuthorSignature)", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const unsignedPv = makePV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [unsignedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-    });
-    it("installs older signed versions without activating them over a newer active version", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const localPv = makePV(pkg.packageId, { version: "3.0.0", versionTag: "stable" });
-        const targetPkg = makePkg({
-            packageId: pkg.packageId,
-            publishPublicKey: pkg.publishPublicKey,
-            activePackageVersionId: localPv.packageVersionId,
-        });
-        const olderSignedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [targetPkg]]]),
-            pvs: new Map([
-                [groupA, [olderSignedPv]],
-                [groupB, [localPv]], // target already has 3.0.0
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        expect(results[0]).toMatchObject({
-            packageVersionId: olderSignedPv.packageVersionId,
-            activated: false,
-        });
-        expect(mockPvSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
-            packageVersionId: olderSignedPv.packageVersionId,
-        }), { saveAsSnapshot: true, restoreIfDeleted: true });
-    });
-    it("installs beta PVs in stable-only groups without activating them", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg({ followVersionTags: "stable" });
-        const betaPv = makeSignedPV(pkg.packageId, {
-            version: "2.0.0",
-            versionTag: "beta",
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [betaPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        expect(results[0]).toMatchObject({
-            packageVersionId: betaPv.packageVersionId,
-            activated: false,
-        });
-    });
-    it("establishes TOFU when target has empty publishPublicKey", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkgWithKey = makePkg();
-        const pkgNoKey = makePkg({
-            packageId: pkgWithKey.packageId,
-            publishPublicKey: "", // no TOFU anchor yet
-        });
-        const signedPv = makeSignedPV(pkgWithKey.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkgNoKey]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            sourcePackages: new Map([[groupA, new Map([[pkgWithKey.packageId, pkgWithKey]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        // Should have called signAndSave on Packages to set publishPublicKey
-        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
-            packageId: pkgWithKey.packageId,
-            publishPublicKey: authorKeys.publicKey,
-        }));
-    });
-    it("uses deterministic source ordering when establishing TOFU", async () => {
-        const groupA = "group-a";
-        const groupZ = "group-z";
-        const groupTarget = "group-target";
-        const ctxA = makeDataContext(groupA);
-        const ctxZ = makeDataContext(groupZ);
-        const ctxTarget = makeDataContext(groupTarget);
-        const groups = new Map([
-            [groupZ, ctxZ],
-            [groupTarget, ctxTarget],
-            [groupA, ctxA],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const keyA = (0, keys_1.newKeys)();
-        const keyZ = (0, keys_1.newKeys)();
-        const packageId = (0, utils_1.newid)();
-        const packageVersionId = (0, utils_1.newid)();
-        const pkgA = makePkg({ packageId, publishPublicKey: keyA.publicKey });
-        const pkgZ = makePkg({ packageId, publishPublicKey: keyZ.publicKey });
-        const targetPkg = makePkg({ packageId, publishPublicKey: "" });
-        const pvA = makeSignedPVWithSecretKey(packageId, keyA.secretKey, {
-            packageVersionId,
-            version: "2.0.0",
-            createdAt: "2026-01-01T00:00:00.000Z",
-        });
-        const pvZ = {
-            ...pvA,
-            packageAuthorSignature: (0, package_author_signing_1.signPackageAuthor)(pvA, keyZ.secretKey),
-        };
-        setupMocksForScenario({
-            packages: new Map([
-                [groupA, []],
-                [groupZ, []],
-                [groupTarget, [targetPkg]],
-            ]),
-            pvs: new Map([
-                [groupA, [pvA]],
-                [groupZ, [pvZ]],
-                [groupTarget, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupZ, 60],
-                [groupTarget, 60],
-            ]),
-            sourcePackages: new Map([
-                [groupA, new Map([[packageId, pkgA]])],
-                [groupZ, new Map([[packageId, pkgZ]])],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
-            packageId,
-            publishPublicKey: keyA.publicKey,
-        }));
-    });
-    it("rejects PV when target publishPublicKey differs from signer", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const differentKeys = (0, keys_1.newKeys)();
-        const pkg = makePkg({ publishPublicKey: differentKeys.publicKey });
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        // signedPv is signed with authorKeys, but pkg has differentKeys
-        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        consoleError.mockRestore();
-    });
-    describe("revoked publisher keys", () => {
-        function twoGroupSetup() {
-            const groupA = "group-a";
-            const groupB = "group-b";
-            const groups = new Map([
-                [groupA, makeDataContext(groupA)],
-                [groupB, makeDataContext(groupB)],
-            ]);
-            const roles = new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]);
-            return { groupA, groupB, userContext: makeUserContext({ userId, groups }), roles };
-        }
-        let consoleError;
-        let consoleWarn;
-        beforeEach(() => {
-            consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
-            consoleWarn = jest.spyOn(console, "warn").mockImplementation(() => { });
-        });
-        afterEach(() => {
-            consoleError.mockRestore();
-            consoleWarn.mockRestore();
-        });
-        it("refuses to establish TOFU from a source pinned to a revoked key", async () => {
-            const { groupA, groupB, userContext, roles } = twoGroupSetup();
-            const packageId = (0, utils_1.newid)();
-            const sourcePkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
-            const targetPkg = makePkg({ packageId, publishPublicKey: "" });
-            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
-                version: "2.0.0",
-            });
-            setupMocksForScenario({
-                packages: new Map([[groupB, [targetPkg]]]),
-                pvs: new Map([
-                    [groupA, [pv]],
-                    [groupB, []],
-                ]),
-                roles,
-                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
-            });
-            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-            expect(results).toHaveLength(0);
-            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
-            expect(mockPvSignAndSave).not.toHaveBeenCalled();
-            expect(consoleError).toHaveBeenCalledWith(expect.stringContaining("Refusing revoked publisher key"));
-        });
-        it("re-pins peers-core from a revoked key and accepts a version signed by the current key", async () => {
-            const { groupA, groupB, userContext, roles } = twoGroupSetup();
-            const packageId = systemIds.peersCorePackageId;
-            const sourcePkg = makePkg({ packageId, publishPublicKey: currentCoreKeys.publicKey });
-            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
-            const pv = makeSignedPVWithSecretKey(packageId, currentCoreKeys.secretKey, {
-                version: "2.0.0",
-            });
-            setupMocksForScenario({
-                packages: new Map([[groupB, [targetPkg]]]),
-                pvs: new Map([
-                    [groupA, [pv]],
-                    [groupB, []],
-                ]),
-                roles,
-                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
-            });
-            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-            expect(results).toHaveLength(1);
-            expect(results[0]).toMatchObject({ groupId: groupB, packageId, version: "2.0.0" });
-            expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({ packageId, publishPublicKey: currentCoreKeys.publicKey }));
-        });
-        it("rejects a peers-core version signed by the revoked key even where that key is pinned", async () => {
-            const { groupA, groupB, userContext, roles } = twoGroupSetup();
-            const packageId = systemIds.peersCorePackageId;
-            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
-            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
-                version: "2.0.0",
-            });
-            setupMocksForScenario({
-                packages: new Map([[groupB, [targetPkg]]]),
-                pvs: new Map([
-                    [groupA, [pv]],
-                    [groupB, []],
-                ]),
-                roles,
-            });
-            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-            expect(results).toHaveLength(0);
-            expect(mockPvSignAndSave).not.toHaveBeenCalled();
-        });
-        it("does not re-pin other packages pinned to a revoked key; their versions are rejected", async () => {
-            const { groupA, groupB, userContext, roles } = twoGroupSetup();
-            const packageId = (0, utils_1.newid)();
-            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
-            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
-                version: "2.0.0",
-            });
-            setupMocksForScenario({
-                packages: new Map([[groupB, [targetPkg]]]),
-                pvs: new Map([
-                    [groupA, [pv]],
-                    [groupB, []],
-                ]),
-                roles,
-            });
-            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-            expect(results).toHaveLength(0);
-            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
-        });
-    });
-    it("skips PV when packageVersionId already exists in target (dedup)", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            existingPvIds: new Map([[groupB, new Set([signedPv.packageVersionId])]]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        expect(mockPvSignAndSave).not.toHaveBeenCalled();
-    });
-    it("copies all bundle file records (package, routes, ui)", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        const packageFile = makeFileRecord(signedPv.packageBundleFileId, {
-            name: "package.bundle.js",
-            fileSize: 1000,
-        });
-        const routesFile = makeFileRecord(signedPv.routesBundleFileId, {
-            name: "routes.bundle.js",
-            fileSize: 500,
-        });
-        const uiFile = makeFileRecord(signedPv.uiBundleFileId, {
-            name: "uis.bundle.js",
-            fileSize: 300,
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            files: new Map([
-                [
-                    groupA,
-                    new Map([
-                        [signedPv.packageBundleFileId, packageFile],
-                        [signedPv.routesBundleFileId, routesFile],
-                        [signedPv.uiBundleFileId, uiFile],
-                    ]),
-                ],
-            ]),
-        });
-        await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledTimes(3);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(packageFile);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(routesFile);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(uiFile);
-    });
-    it("rejects propagation when the required package bundle file record is missing", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, undefined]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        expect(mockPvSignAndSave).not.toHaveBeenCalled();
-        consoleError.mockRestore();
-    });
-    it("rejects file metadata when fileHash does not match the signed PV hash", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        const badFile = makeFileRecord(signedPv.packageBundleFileId, { fileHash: "wrong-hash" });
-        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, badFile]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        expect(mockPvSignAndSave).not.toHaveBeenCalled();
-        consoleError.mockRestore();
-    });
-    it("propagates file with tampered chunkHashes if fileHash matches PV (integrity deferred to FileReadStream)", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        const badFile = makeFileRecord(signedPv.packageBundleFileId, {
-            fileHash: signedPv.packageBundleFileHash,
-            chunkHashes: ["tampered-chunk"],
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            files: new Map([[groupA, new Map([[signedPv.packageBundleFileId, badFile]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        // Propagation trusts fileHash match; FileReadStream catches chunk tampering at read time
-        expect(results).toHaveLength(1);
-        expect(mockPvSignAndSave).toHaveBeenCalled();
-    });
-    it("copies indexed file metadata recursively for large package bundles", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const packageBundleFileId = (0, utils_1.newid)();
-        const indexFileId = (0, utils_1.newid)();
-        const bundleChunkHashes = ["bundle-chunk-a", "bundle-chunk-b"];
-        const packageBundleFileHash = hashChunkHashes(bundleChunkHashes);
-        const signedPv = makeSignedPV(pkg.packageId, {
-            version: "2.0.0",
-            packageBundleFileId,
-            packageBundleFileHash,
-        });
-        const packageFile = {
-            fileId: packageBundleFileId,
-            name: "package.bundle.js",
-            fileSize: 1024 * 1024 * 1024 + 1,
-            fileHash: packageBundleFileHash,
-            indexFileId,
-        };
-        const indexFile = makeFileRecord(indexFileId, {
-            name: `index-${indexFileId}.json`,
-            isIndexFile: true,
-            loadedChunkHashes: bundleChunkHashes,
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-            files: new Map([
-                [
-                    groupA,
-                    new Map([
-                        [packageBundleFileId, packageFile],
-                        [indexFileId, indexFile],
-                    ]),
-                ],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(1);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(indexFile);
-        expect(mockFilesSaveFileRecord).toHaveBeenCalledWith(packageFile);
-    });
-    it("rejects malformed optional bundle references", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const missingHashPv = makeSignedPV(pkg.packageId, {
-            version: "2.0.0",
-            routesBundleFileHash: undefined,
-        });
-        const missingIdPv = makeSignedPV(pkg.packageId, {
-            version: "3.0.0",
-            routesBundleFileId: undefined,
-        });
-        const consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [missingHashPv, missingIdPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-        expect(mockPvSignAndSave).not.toHaveBeenCalled();
-        consoleError.mockRestore();
-    });
-    it("recomputes packageVersionHash instead of trusting the source PV value", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, {
-            version: "2.0.0",
-            packageVersionHash: "untrusted-source-value",
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(mockPvSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
-            packageVersionHash: (0, package_versions_1.computePackageVersionHash)(signedPv.version, signedPv.versionTag ?? "", signedPv.packageBundleFileHash, signedPv.routesBundleFileHash, signedPv.uiBundleFileHash),
-        }), { saveAsSnapshot: true, restoreIfDeleted: true });
-        expect(mockPvSignAndSave).not.toHaveBeenCalledWith(expect.objectContaining({ packageVersionHash: "untrusted-source-value" }), expect.anything());
-    });
-    it("auto-activates with versionFollowRange 'latest', does not activate with 'pinned'", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const groupC = "group-c";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const ctxC = makeDataContext(groupC);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-            [groupC, ctxC],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkgLatest = makePkg({ versionFollowRange: "latest" });
-        const pkgPinned = makePkg({
-            packageId: pkgLatest.packageId,
-            publishPublicKey: pkgLatest.publishPublicKey,
-            versionFollowRange: "pinned",
-        });
-        const signedPv = makeSignedPV(pkgLatest.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([
-                [groupB, [pkgLatest]],
-                [groupC, [pkgPinned]],
-            ]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-                [groupC, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-                [groupC, 60],
-            ]),
-            sourcePackages: new Map([[groupA, new Map([[pkgLatest.packageId, pkgLatest]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        const activatedResult = results.find((r) => r.groupId === groupB);
-        const pinnedResult = results.find((r) => r.groupId === groupC);
-        expect(activatedResult?.activated).toBe(true);
-        expect(pinnedResult?.activated).toBe(false);
-    });
-    it("auto-activates patch and minor ranges using the real active PV version", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const groupC = "group-c";
-        const groupD = "group-d";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const ctxC = makeDataContext(groupC);
-        const ctxD = makeDataContext(groupD);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-            [groupC, ctxC],
-            [groupD, ctxD],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const patchBasePkg = makePkg();
-        const minorBasePkg = makePkg();
-        const patchRejectBasePkg = makePkg();
-        const patchActive = makePV(patchBasePkg.packageId, { version: "1.2.0" });
-        const minorActive = makePV(minorBasePkg.packageId, { version: "1.2.0" });
-        const patchRejectActive = makePV(patchRejectBasePkg.packageId, { version: "1.2.0" });
-        const patchPkg = makePkg({
-            packageId: patchBasePkg.packageId,
-            publishPublicKey: patchBasePkg.publishPublicKey,
-            versionFollowRange: "patch",
-            activePackageVersionId: patchActive.packageVersionId,
-        });
-        const minorPkg = makePkg({
-            packageId: minorBasePkg.packageId,
-            publishPublicKey: minorBasePkg.publishPublicKey,
-            versionFollowRange: "minor",
-            activePackageVersionId: minorActive.packageVersionId,
-        });
-        const patchRejectPkg = makePkg({
-            packageId: patchRejectBasePkg.packageId,
-            publishPublicKey: patchRejectBasePkg.publishPublicKey,
-            versionFollowRange: "patch",
-            activePackageVersionId: patchRejectActive.packageVersionId,
-        });
-        const patchPv = makeSignedPV(patchBasePkg.packageId, { version: "1.2.1" });
-        const minorPv = makeSignedPV(minorBasePkg.packageId, { version: "1.3.0" });
-        const patchRejectPv = makeSignedPV(patchRejectBasePkg.packageId, { version: "1.3.0" });
-        setupMocksForScenario({
-            packages: new Map([
-                [groupB, [patchPkg]],
-                [groupC, [minorPkg]],
-                [groupD, [patchRejectPkg]],
-            ]),
-            pvs: new Map([
-                [groupA, [patchPv, minorPv, patchRejectPv]],
-                [groupB, [patchActive]],
-                [groupC, [minorActive]],
-                [groupD, [patchRejectActive]],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-                [groupC, 60],
-                [groupD, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results.find((r) => r.groupId === groupB)?.activated).toBe(true);
-        expect(results.find((r) => r.groupId === groupC)?.activated).toBe(true);
-        expect(results.find((r) => r.groupId === groupD)?.activated).toBe(false);
-    });
-    it("installs all valid candidates and leaves the newest eligible version active", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const olderPv = makeSignedPV(pkg.packageId, {
-            version: "2.0.0",
-            createdAt: "2026-01-01T00:00:00.000Z",
-        });
-        const newerPv = makeSignedPV(pkg.packageId, {
-            version: "3.0.0",
-            createdAt: "2026-01-02T00:00:00.000Z",
-        });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [pkg]]]),
-            pvs: new Map([
-                [groupA, [olderPv, newerPv]],
-                [groupB, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(2);
-        expect(results.find((result) => result.packageVersionId === newerPv.packageVersionId)).toMatchObject({
-            packageVersionId: newerPv.packageVersionId,
-            version: "3.0.0",
-            activated: true,
-        });
-        expect(results.find((result) => result.packageVersionId === olderPv.packageVersionId)).toMatchObject({
-            packageVersionId: olderPv.packageVersionId,
-            version: "2.0.0",
-            activated: false,
-        });
-        expect(mockPvSignAndSave).toHaveBeenCalledTimes(2);
-        expect(mockPackagesSignAndSave).toHaveBeenLastCalledWith(expect.objectContaining({ activePackageVersionId: newerPv.packageVersionId }));
-    });
-    it("uses the active PV tag when followVersionTags is undefined", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg({ followVersionTags: undefined });
-        const activeBetaPv = makePV(pkg.packageId, { version: "1.0.0", versionTag: "beta" });
-        const targetPkg = makePkg({
-            packageId: pkg.packageId,
-            publishPublicKey: pkg.publishPublicKey,
-            followVersionTags: undefined,
-            activePackageVersionId: activeBetaPv.packageVersionId,
-        });
-        const stablePv = makeSignedPV(pkg.packageId, { version: "3.0.0", versionTag: "stable" });
-        const betaPv = makeSignedPV(pkg.packageId, { version: "2.0.0", versionTag: "beta" });
-        setupMocksForScenario({
-            packages: new Map([[groupB, [targetPkg]]]),
-            pvs: new Map([
-                [groupA, [stablePv, betaPv]],
-                [groupB, [activeBetaPv]],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-            ]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(2);
-        expect(results.find((result) => result.packageVersionId === stablePv.packageVersionId)).toMatchObject({
-            packageVersionId: stablePv.packageVersionId,
-            versionTag: "stable",
-            activated: false,
-        });
-        expect(results.find((result) => result.packageVersionId === betaPv.packageVersionId)).toMatchObject({
-            packageVersionId: betaPv.packageVersionId,
-            versionTag: "beta",
-            activated: true,
-        });
-    });
-    it("propagates from one source to multiple admin groups", async () => {
-        const groupA = "group-a";
-        const groupB = "group-b";
-        const groupC = "group-c";
-        const ctxA = makeDataContext(groupA);
-        const ctxB = makeDataContext(groupB);
-        const ctxC = makeDataContext(groupC);
-        const groups = new Map([
-            [groupA, ctxA],
-            [groupB, ctxB],
-            [groupC, ctxC],
-        ]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg();
-        const signedPv = makeSignedPV(pkg.packageId, { version: "2.0.0" });
-        setupMocksForScenario({
-            packages: new Map([
-                [groupB, [pkg]],
-                [groupC, [pkg]],
-            ]),
-            pvs: new Map([
-                [groupA, [signedPv]],
-                [groupB, []],
-                [groupC, []],
-            ]),
-            roles: new Map([
-                [groupA, 60],
-                [groupB, 60],
-                [groupC, 60],
-            ]),
-            sourcePackages: new Map([[groupA, new Map([[pkg.packageId, pkg]])]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(2);
-        expect(results.map((r) => r.groupId).sort()).toEqual(["group-b", "group-c"]);
-    });
-    it("returns empty results when no packages have publishPublicKey", async () => {
-        const groupA = "group-a";
-        const ctxA = makeDataContext(groupA);
-        const groups = new Map([[groupA, ctxA]]);
-        const userContext = makeUserContext({ userId, groups });
-        const pkg = makePkg({ publishPublicKey: "" });
-        setupMocksForScenario({
-            packages: new Map([[groupA, [pkg]]]),
-            pvs: new Map([[groupA, []]]),
-            roles: new Map([[groupA, 60]]),
-        });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-    });
-    it("returns empty results when user has no groups", async () => {
-        const groups = new Map();
-        const userContext = makeUserContext({ userId, groups });
-        const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
-        expect(results).toHaveLength(0);
-    });
-});