create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/lib/__tests__/site.test.ts

@@ -1,292 +0,0 @@
-/**
- * @file site.test.ts
- * @description Coverage for the site-alias -> workspace resolution (#6155
- * spec D2/D5/D6, AC-5): `resolveSiteWorkspaceId()`'s two-and-only-two
- * resolution rule and `assertSiteAliasResolves()`'s startup refusal.
- *
- * Mocks the module-level `prisma` singleton via the repo's manual-mock
- * convention (`apps/api/src/lib/__mocks__/prisma.ts`), the same shape
- * `middleware/__tests__/default-tenant.test.ts` uses — this suite exercises
- * the REAL `resolveSentinelWorkspaceRow` (`@working-theory/database/tenancy`,
- * mapped straight to source by `jest.config.cjs`) against the mocked
- * `prisma.workspace` delegate, not a re-implementation of it.
- *
- * `DATABASE_URL` is set globally by `src/__tests__/setup.ts`, so every case
- * here runs past the D6 database-less carve-out and exercises the real
- * resolution path. `CONTENT_ADAPTER` is pinned to `database` per-case below
- * (#6228): the assertion's first arm now skips on any OTHER adapter, so a
- * case that means to exercise the REAL resolution must say which adapter it
- * is booting under rather than inherit whatever the ambient env holds.
- *
- * `describe("site stamp (#7868)")` covers the Checkout `metadata.site` stamp
- * and the webhook's foreign-site test (spec D2/D7).
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../prisma.js");
-
-import { prisma } from "../prisma.js";
-
-import {
-  __resetSiteWorkspaceCacheForTests,
-  assertSiteAliasResolves,
-  currentSiteId,
-  isForeignSiteStamp,
-  resolveSiteWorkspaceId,
-  siteStamp,
-} from "../site.js";
-
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-const PINNED_WORKSPACE_ID = "wksp_01930000-0000-7000-8000-000000000042";
-const NON_SENTINEL_ORG_ID = "org_01930000-0000-7bcd-8000-000000000002";
-
-const ORIGINAL_AILK_SITE_ID = process.env.AILK_SITE_ID;
-const ORIGINAL_CONTENT_ADAPTER = process.env.CONTENT_ADAPTER;
-
-beforeEach(() => {
-  // #6228 arm 0 — every case in this suite is about the alias->workspace
-  // resolution itself, which only the database adapter reaches.
-  process.env.CONTENT_ADAPTER = "database";
-});
-
-afterEach(() => {
-  if (ORIGINAL_CONTENT_ADAPTER === undefined) {
-    delete process.env.CONTENT_ADAPTER;
-  } else {
-    process.env.CONTENT_ADAPTER = ORIGINAL_CONTENT_ADAPTER;
-  }
-  __resetSiteWorkspaceCacheForTests();
-  jest.clearAllMocks();
-  if (ORIGINAL_AILK_SITE_ID === undefined) {
-    delete process.env.AILK_SITE_ID;
-  } else {
-    process.env.AILK_SITE_ID = ORIGINAL_AILK_SITE_ID;
-  }
-});
-
-describe("resolveSiteWorkspaceId / assertSiteAliasResolves (#6155 D2/D5/D6)", () => {
-  it("case 1 — resolves a pinned alias to the matching workspace, and the assertion returns without throwing", async () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: PINNED_WORKSPACE_ID,
-      organizationId: NON_SENTINEL_ORG_ID,
-    });
-
-    const resolved = await resolveSiteWorkspaceId();
-
-    expect(resolved).toBe(PINNED_WORKSPACE_ID);
-    expect(prisma.workspace.findUnique).toHaveBeenCalledWith({
-      where: { id: PINNED_WORKSPACE_ID },
-    });
-    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
-  });
-
-  it("case 2 — the unset alias (the scaffold default) resolves to the seeded sentinel workspace (D2 rule 2)", async () => {
-    delete process.env.AILK_SITE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: DEFAULT_ORG_ID,
-    });
-
-    const resolved = await resolveSiteWorkspaceId();
-
-    expect(resolved).toBe(DEFAULT_WORKSPACE_ID);
-    expect(prisma.workspace.findUnique).toHaveBeenCalledWith({
-      where: { id: DEFAULT_WORKSPACE_ID },
-    });
-    // resolveSentinelWorkspaceRow carries no workspace.count() gate (D2).
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-  });
-
-  it("case 3 — a pinned alias naming no workspace does not resolve, and the assertion rejects naming both the alias and AILK_SITE_ID", async () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const resolved = await resolveSiteWorkspaceId();
-    expect(resolved).toBeNull();
-
-    await expect(assertSiteAliasResolves()).rejects.toThrow(
-      new RegExp(PINNED_WORKSPACE_ID.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
-    );
-    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
-  });
-
-  it("case 4 — memoized: a second resolveSiteWorkspaceId() call issues zero further Prisma queries", async () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: PINNED_WORKSPACE_ID,
-      organizationId: NON_SENTINEL_ORG_ID,
-    });
-
-    const first = await resolveSiteWorkspaceId();
-    const second = await resolveSiteWorkspaceId();
-
-    expect(first).toBe(PINNED_WORKSPACE_ID);
-    expect(second).toBe(PINNED_WORKSPACE_ID);
-    expect(prisma.workspace.findUnique).toHaveBeenCalledTimes(1);
-  });
-
-  it("case 5 — the unset alias resolves to the sentinel on a MULTI-workspace deployment (the D2 rule-2 regression case)", async () => {
-    // The exact case resolveDefaultWorkspaceRow's workspace.count() gate
-    // would have refused — three workspaces exist, one of them the seeded
-    // sentinel, and AILK_SITE_ID is unpinned. resolveSentinelWorkspaceRow
-    // carries no count() gate, so this must still resolve.
-    delete process.env.AILK_SITE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: DEFAULT_ORG_ID,
-    });
-
-    const resolved = await resolveSiteWorkspaceId();
-
-    expect(resolved).toBe(DEFAULT_WORKSPACE_ID);
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
-  });
-
-  it("case 6 — the unset alias does not resolve when the sentinel workspace is absent — the misconfiguration AC-5 asks to fail loudly", async () => {
-    delete process.env.AILK_SITE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const resolved = await resolveSiteWorkspaceId();
-    expect(resolved).toBeNull();
-
-    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
-  });
-
-  it("case 7 — a genuine thrown resolution error PROPAGATES and crashes the boot — it is NOT swallowed as a database-less carve-out", async () => {
-    // The code-review finding this case pins (#6155): the D6 carve-out is a
-    // presence check made BEFORE any query, never a catch around one that
-    // already ran. A reachable database that errors mid-query (a real
-    // connection failure, a permissions error) is exactly the
-    // misconfiguration class AC-5 exists to surface, so it must reject —
-    // not resolve silently the way the "cannot be attempted" cases do.
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    const connectionError = new Error("P1001: Can't reach database server");
-    (prisma.workspace.findUnique as jest.Mock).mockRejectedValue(
-      connectionError,
-    );
-
-    await expect(resolveSiteWorkspaceId()).rejects.toThrow(connectionError);
-    await expect(assertSiteAliasResolves()).rejects.toThrow(connectionError);
-  });
-
-  it("case 8 — prisma.workspace.findUnique missing entirely (a prisma double that never touches tenancy) is the ONLY case that skips without throwing", async () => {
-    // The exact shape that surfaced the D6 carve-out: a shared/global prisma
-    // test double (lib/__mocks__/prisma-client.js, and the many hand-rolled
-    // hoisted factories elsewhere) that declares no workspace delegate at
-    // all — the resolution could not even be ATTEMPTED. Distinguishes this
-    // from case 7's genuine mid-query failure: here findUnique is not a
-    // function at all, never called, never thrown from.
-    delete process.env.AILK_SITE_ID;
-    const original = prisma.workspace.findUnique;
-    // eslint-disable-next-line no-restricted-syntax -- deliberately simulating a prisma double that declares no `workspace.findUnique` delegate at all (the shape assertSiteAliasResolves()'s presence check exists to catch), restored in the finally block below.
-    (prisma.workspace as unknown as Record<string, unknown>).findUnique =
-      undefined;
-
-    try {
-      await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
-    } finally {
-      prisma.workspace.findUnique = original;
-    }
-  });
-
-  it("currentSiteId() stays synchronous and byte-identical for the env-set case (NFR1)", () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    expect(currentSiteId()).toBe(PINNED_WORKSPACE_ID);
-  });
-
-  it("currentSiteId() stays synchronous and byte-identical for the env-unset case (NFR1)", () => {
-    delete process.env.AILK_SITE_ID;
-    expect(currentSiteId()).toBe("default");
-  });
-});
-
-describe("assertSiteAliasResolves — the #6228 content-adapter carve-out (arm 0)", () => {
-  it("skips the assertion on a non-database adapter, even with DATABASE_URL set and unreachable", async () => {
-    // The scaffold-boot shape: create-ailk's verify-scaffold.mjs sets a
-    // PLACEHOLDER DATABASE_URL (validateConfig checks presence only, Prisma
-    // connects lazily), so arm 1 does not fire. Before #6228 the generated
-    // MDX site crashed at boot on `Can't reach database server`.
-    process.env.CONTENT_ADAPTER = "mdx";
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockRejectedValue(
-      new Error("Can't reach database server at 127.0.0.1:5432"),
-    );
-
-    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
-    // The arm is a PRESENCE check made BEFORE any query — not a catch around
-    // one that already ran (the #6155 code-review finding this file's
-    // docblock records).
-    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("skips on the projection adapter too — the arm is `not database`, not `is mdx`", async () => {
-    process.env.CONTENT_ADAPTER = "projection";
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-
-    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
-    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("still throws under the database adapter when the alias names no workspace", async () => {
-    // AC-2: the arm narrows WHICH boots are asserted, never WHAT the
-    // assertion decides once it runs.
-    process.env.CONTENT_ADAPTER = "database";
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
-    expect(prisma.workspace.findUnique).toHaveBeenCalled();
-  });
-});
-
-describe("site stamp (#7868)", () => {
-  // Stripe types metadata values as strings; a non-string arrives only from a
-  // malformed payload, so the fixture is cast at this one boundary.
-  const nonStringStamp: Record<string, unknown> = { site: 42 };
-
-  it("siteStamp() with AILK_SITE_ID unset stamps the default alias", () => {
-    delete process.env.AILK_SITE_ID;
-    expect(siteStamp()).toEqual({ site: "default" });
-  });
-
-  it("siteStamp() follows AILK_SITE_ID, read per call", () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    expect(siteStamp()).toEqual({ site: PINNED_WORKSPACE_ID });
-  });
-
-  it("siteStamp() is empty when AILK_SITE_ID is the empty string — Stripe is never sent an empty value (SEC-7868-5)", () => {
-    process.env.AILK_SITE_ID = "";
-    expect(siteStamp()).toEqual({});
-  });
-
-  it.each([
-    ["undefined metadata", undefined],
-    ["null metadata", null],
-    ["no stamp", {}],
-    ["an empty stamp", { site: "" }],
-    ["the own stamp", { site: "default" }],
-    ["a non-string stamp", nonStringStamp as Record<string, string>],
-  ])("isForeignSiteStamp is false for %s (unstamped is own, roadmap D4)", (_label, metadata) => {
-    delete process.env.AILK_SITE_ID;
-    expect(isForeignSiteStamp(metadata)).toBe(false);
-  });
-
-  it("isForeignSiteStamp is true for another site's stamp", () => {
-    delete process.env.AILK_SITE_ID;
-    expect(isForeignSiteStamp({ site: "samhenry" })).toBe(true);
-  });
-
-  it("isForeignSiteStamp compares exactly — a case-folded own alias is foreign", () => {
-    delete process.env.AILK_SITE_ID;
-    expect(isForeignSiteStamp({ site: "Default" })).toBe(true);
-  });
-
-  it("isForeignSiteStamp reads the alias per call, not once at import", () => {
-    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
-    expect(isForeignSiteStamp({ site: PINNED_WORKSPACE_ID })).toBe(false);
-    expect(isForeignSiteStamp({ site: "default" })).toBe(true);
-  });
-});

package/templates/apps/api/src/lib/__tests__/slice-load.test.ts

@@ -1,89 +0,0 @@
-/**
- * #5334 — `loadSlice()` is the slice-module load boundary.
- *
- * The regression that matters most here is the LAST block: a slice that throws
- * while evaluating must keep its own error object, type and stack. Wrapping it
- * would turn a real bug in a slice into a misleading "could not be resolved"
- * report, which is the opposite of what this boundary exists to do.
- */
-import { loadSlice } from "../slice-load.js";
-
-function moduleNotFound(code: string, message: string): Error {
-  const error = new Error(message) as Error & { code: string };
-  error.code = code;
-  return error;
-}
-
-describe("loadSlice (#5334)", () => {
-  it("passes a resolving thunk's value straight through", async () => {
-    const mod = { workspaceContextRoutes: () => undefined };
-    await expect(loadSlice("./routes/workspaces/index.js", async () => mod))
-      .resolves.toBe(mod);
-  });
-
-  it("awaits the thunk rather than the specifier — the specifier is never imported", async () => {
-    const load = jest.fn(async () => ({ ok: true }));
-    await loadSlice("./never-imported.js", load);
-    expect(load).toHaveBeenCalledTimes(1);
-  });
-
-  describe.each([
-    ["ERR_MODULE_NOT_FOUND", "the ESM resolver's code"],
-    ["MODULE_NOT_FOUND", "the CJS resolver's code"],
-  ])("on %s (%s)", (code) => {
-    const original = moduleNotFound(
-      code,
-      "Cannot find module '/x/apps/api/dist/list.js'",
-    );
-    const failing = async () => {
-      throw original;
-    };
-
-    it("names the specifier in the message", async () => {
-      await expect(loadSlice("./list.js", failing)).rejects.toThrow(
-        /AILK slice module '\.\/list\.js'/,
-      );
-    });
-
-    it("names BOTH causes, so a reader can tell a tracer miss from a bundled build", async () => {
-      const error = await loadSlice("./list.js", failing).catch(
-        (e: unknown) => e as Error,
-      );
-      expect(error.message).toMatch(/not SHIPPED/);
-      expect(error.message).toMatch(/slice-reachability:check/);
-      expect(error.message).toMatch(/BUNDLED/);
-      expect(error.message).toMatch(/apps\/api\/CLAUDE\.md/);
-    });
-
-    it("preserves the original error as `cause`", async () => {
-      const error = await loadSlice("./list.js", failing).catch(
-        (e: unknown) => e as Error,
-      );
-      expect(error.cause).toBe(original);
-    });
-  });
-
-  it("rethrows a non-resolution error IDENTICALLY — same object, not a wrapper", async () => {
-    const boom = new Error("slice blew up while evaluating");
-    const caught = await loadSlice("./list.js", async () => {
-      throw boom;
-    }).catch((e: unknown) => e);
-    expect(caught).toBe(boom);
-    expect((caught as Error).message).toBe("slice blew up while evaluating");
-  });
-
-  it("rethrows an errno-shaped error that is not a module-resolution code", async () => {
-    const denied = moduleNotFound("EACCES", "permission denied");
-    const caught = await loadSlice("./list.js", async () => {
-      throw denied;
-    }).catch((e: unknown) => e);
-    expect(caught).toBe(denied);
-  });
-
-  it("rethrows a non-Error throw untouched", async () => {
-    const caught = await loadSlice("./list.js", async () => {
-      throw "a string, because JavaScript";
-    }).catch((e: unknown) => e);
-    expect(caught).toBe("a string, because JavaScript");
-  });
-});

package/templates/apps/api/src/lib/__tests__/spoke-store.test.ts

@@ -1,202 +0,0 @@
-/**
- * @file spoke-store.test.ts
- *
- * The hub's spoke registry boundary (#7532, spec
- * docs/specs/7532-a-spoke-s-public-reads-spec.md D2, D7, AC-5): minting a key,
- * its digest, the two reads the resolver makes (the key lookup, and whether
- * the deployment is a hub — #7633 D1), and the three operator functions the
- * `spokes` CLI calls.
- *
- * External dependency boundary mocked:
- *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../prisma.js");
-
-import { createHash } from "node:crypto";
-
-import { prisma } from "../prisma.js";
-import {
-  SPOKE_KEY_PREFIX,
-  findSpokeById,
-  findSpokeByKeyHash,
-  hasRegisteredSpoke,
-  hashSpokeKey,
-  listSpokes,
-  mintSpokeKey,
-  registerSpoke,
-  revokeSpoke,
-} from "../spoke-store.js";
-
-const db = jest.mocked(prisma);
-
-const W1 = "wksp_00000000-0000-7000-8000-0000000000b1";
-const S1 = "spoke_00000000-0000-7000-8000-0000000000c1";
-
-beforeEach(() => {
-  jest.resetAllMocks();
-});
-
-describe("mintSpokeKey / hashSpokeKey (D2)", () => {
-  it("mints `ailk_spk_` + 32 random bytes in base64url — 52 characters", () => {
-    const key = mintSpokeKey();
-    expect(key.startsWith(SPOKE_KEY_PREFIX)).toBe(true);
-    expect(key).toHaveLength(52);
-    expect(key.slice(SPOKE_KEY_PREFIX.length)).toMatch(/^[A-Za-z0-9_-]{43}$/);
-  });
-
-  it("never mints the same key twice", () => {
-    const keys = new Set(Array.from({ length: 50 }, () => mintSpokeKey()));
-    expect(keys.size).toBe(50);
-  });
-
-  it("digests the TRIMMED key to lowercase hex SHA-256", () => {
-    const key = mintSpokeKey();
-    const expected = createHash("sha256").update(key).digest("hex");
-    expect(hashSpokeKey(key)).toBe(expected);
-    expect(hashSpokeKey(`  ${key}\t`)).toBe(expected);
-    expect(hashSpokeKey(key)).toMatch(/^[0-9a-f]{64}$/);
-  });
-});
-
-describe("findSpokeByKeyHash (D3 step 5)", () => {
-  it("is one findUnique by digest, selecting only what the resolver needs", async () => {
-    const row = { id: S1, workspaceId: W1, revokedAt: null };
-    db.spoke.findUnique.mockResolvedValue(row as never);
-    const digest = "a".repeat(64);
-
-    await expect(findSpokeByKeyHash(digest)).resolves.toEqual(row);
-    expect(db.spoke.findUnique).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findUnique).toHaveBeenCalledWith({
-      where: { credentialHash: digest },
-      select: { id: true, workspaceId: true, revokedAt: true },
-    });
-  });
-
-  it("answers null when no row carries the digest", async () => {
-    db.spoke.findUnique.mockResolvedValue(null);
-    await expect(findSpokeByKeyHash("b".repeat(64))).resolves.toBeNull();
-  });
-});
-
-describe("findSpokeById (#7894 D3, D5)", () => {
-  it("is one findUnique by id, selecting the row the sign-in client needs", async () => {
-    const row = { id: S1, workspaceId: W1, revokedAt: null, name: "Site" };
-    db.spoke.findUnique.mockResolvedValue(row as never);
-
-    await expect(findSpokeById(S1)).resolves.toEqual(row);
-    expect(db.spoke.findUnique).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findUnique).toHaveBeenCalledWith({
-      where: { id: S1 },
-      select: { id: true, workspaceId: true, revokedAt: true, name: true },
-    });
-  });
-
-  it("answers null for an unknown id", async () => {
-    db.spoke.findUnique.mockResolvedValue(null);
-    await expect(findSpokeById(S1)).resolves.toBeNull();
-  });
-});
-
-describe("hasRegisteredSpoke (#7633 D1, AC-5)", () => {
-  it("is true when the registry holds a row, revoked or not — one findFirst with no where", async () => {
-    db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
-
-    await expect(hasRegisteredSpoke()).resolves.toBe(true);
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
-  });
-
-  it("is false when the registry is empty", async () => {
-    db.spoke.findFirst.mockResolvedValue(null);
-    await expect(hasRegisteredSpoke()).resolves.toBe(false);
-    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
-  });
-
-  it("caches nothing: two calls are two reads", async () => {
-    db.spoke.findFirst.mockResolvedValue(null);
-    await hasRegisteredSpoke();
-    await hasRegisteredSpoke();
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
-  });
-
-  it("propagates a failed read — never answers \"not a hub\"", async () => {
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-    await expect(hasRegisteredSpoke()).rejects.toThrow("connection reset");
-  });
-});
-
-describe("registerSpoke (D7, AC-5)", () => {
-  it("stores the key's digest and a 17-character prefix, never the key", async () => {
-    db.workspace.findUnique.mockResolvedValue({ id: W1 } as never);
-    db.spoke.create.mockImplementation((async (args: {
-      data: Record<string, unknown>;
-    }) => ({ id: S1, createdAt: new Date(), ...args.data })) as never);
-
-    const result = await registerSpoke({ workspaceId: W1, name: "acme" });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    const createArg = db.spoke.create.mock.calls[0]![0] as {
-      data: Record<string, unknown>;
-    };
-    expect(createArg.data["credentialHash"]).toMatch(/^[0-9a-f]{64}$/);
-    expect(createArg.data["credentialHash"]).toBe(hashSpokeKey(result.key));
-    expect(createArg.data["credentialPrefix"]).toBe(result.key.slice(0, 17));
-    expect(createArg.data["workspaceId"]).toBe(W1);
-    expect(createArg.data["name"]).toBe("acme");
-    // No create argument equals the returned key.
-    expect(JSON.stringify(createArg)).not.toContain(result.key);
-    expect(result.spoke.id).toBe(S1);
-  });
-
-  it("refuses a workspace that does not exist, creating nothing", async () => {
-    db.workspace.findUnique.mockResolvedValue(null);
-
-    await expect(
-      registerSpoke({ workspaceId: W1, name: "acme" }),
-    ).resolves.toEqual({ ok: false, reason: "workspace-not-found" });
-    expect(db.spoke.create).not.toHaveBeenCalled();
-  });
-});
-
-describe("revokeSpoke (D7, AC-5)", () => {
-  it("sets revokedAt on that one unrevoked row only", async () => {
-    db.spoke.updateMany.mockResolvedValue({ count: 1 });
-
-    await expect(revokeSpoke(S1)).resolves.toBe(true);
-    const arg = db.spoke.updateMany.mock.calls[0]![0] as {
-      where: unknown;
-      data: { revokedAt: unknown };
-    };
-    expect(arg.where).toEqual({ id: S1, revokedAt: null });
-    expect(arg.data.revokedAt).toBeInstanceOf(Date);
-  });
-
-  it("reports false when no unrevoked row matched", async () => {
-    db.spoke.updateMany.mockResolvedValue({ count: 0 });
-    await expect(revokeSpoke(S1)).resolves.toBe(false);
-  });
-});
-
-describe("listSpokes (D7, AC-5)", () => {
-  it("never selects the credential digest", async () => {
-    db.spoke.findMany.mockResolvedValue([]);
-
-    await listSpokes();
-
-    const arg = db.spoke.findMany.mock.calls[0]![0] as {
-      select: Record<string, boolean>;
-    };
-    expect(arg.select).not.toHaveProperty("credentialHash");
-    expect(arg.select).toEqual({
-      id: true,
-      name: true,
-      workspaceId: true,
-      credentialPrefix: true,
-      createdAt: true,
-      revokedAt: true,
-    });
-  });
-});