ddd-ts-kit 0.14.0 → 0.15.0

package/templates/presets/identity/context/test/unit/member-removed.publisher.spec.ts.tpl

@@ -0,0 +1,35 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberRemovedPublisher } from '{{alias.context}}/application/integration/publishers/member-removed.publisher{{alias.ext}}';
+import { MemberRemoved } from '{{alias.context}}/domain/events/member-removed.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member removed" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.removed, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberRemovedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberRemoved('member-1', at, { organisationId: 'acme', accountId: 'subject-ada' }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.removed',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberRemovedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberRemoved('member-1', at, { organisationId: 'acme', accountId: 'subject-ada' }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member-role-changed.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberRoleChangedPublisher } from '{{alias.context}}/application/integration/publishers/member-role-changed.publisher{{alias.ext}}';
+import { MemberRoleChanged } from '{{alias.context}}/domain/events/member-role-changed.event{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member role changed" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.role-changed, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberRoleChangedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberRoleChanged('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.role-changed',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada', from: 'member', to: 'admin' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberRoleChangedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberRoleChanged('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member.aggregate.spec.ts.tpl

@@ -0,0 +1,142 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+
+const joinedAt = new Date('2026-02-01T00:00:00.000Z');
+const later = new Date('2026-02-02T00:00:00.000Z');
+const byAnOwner = { by: MemberRole.Owner, byAccount: 'subject-owner', delegationId: undefined, owners: 2 };
+const byAnAdmin = { by: MemberRole.Admin, byAccount: 'subject-admin', delegationId: undefined, owners: 2 };
+const byAMember = { by: MemberRole.Member, byAccount: 'subject-member', delegationId: 'delegation-1', owners: 2 };
+
+describe('Member', () => {
+  it('joins an organisation in a role, and announces it', () => {
+    const joined = Member.join(
+      'member-1',
+      { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin },
+      joinedAt,
+    );
+
+    expect(joined.isActive).toBe(true);
+
+    expect(joined.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.member.joined',
+        aggregateId: 'member-1',
+        occurredAt: joinedAt,
+        facts: { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = aMember().build();
+    const loaded = Member.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('The role of a member', () => {
+  it('changes, and the change is announced with the role it leaves', () => {
+    given(aMember().identifiedBy('member-1').of('acme', 'subject-ada'))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.member.role-changed',
+          facts: { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin },
+        },
+      ])
+      .thenState((member) => expect(member.role).toBe(MemberRole.Admin));
+  });
+
+  it('stays as it is, silently, when it is asked again', () => {
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenNoEvent();
+  });
+
+  it('becomes, or stops being, owner only by the decision of an owner', () => {
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Owner, byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Owner, byAnOwner, later))
+      .thenEventNames(['{{context.kebab}}.member.role-changed']);
+  });
+
+  it('stays owner when the organisation has no other owner', () => {
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.changeRole(MemberRole.Admin, { ...byAnOwner, owners: 1 }, later))
+      .thenError('LAST_OWNER');
+  });
+
+  it('is never changed by the member themselves, nor above the role of who decides', () => {
+    given(aMember().of('acme', 'subject-ada').as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Member, { ...byAnOwner, byAccount: 'subject-ada' }, later))
+      .thenError('OWN_ROLE');
+
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Admin, byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Member, byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+  });
+});
+
+describe('A member', () => {
+  it('is removed, and the removal is announced', () => {
+    given(aMember().identifiedBy('member-1').of('acme', 'subject-ada'))
+      .when((member) => member.remove(byAnAdmin, later))
+      .thenEvents([{ name: '{{context.kebab}}.member.removed', facts: { organisationId: 'acme', accountId: 'subject-ada' } }])
+      .thenState((member) => expect(member.isActive).toBe(false));
+  });
+
+  it('who owns the organisation is removed by an owner only, and never when they are its last owner', () => {
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.remove(byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.remove({ ...byAnOwner, owners: 1 }, later))
+      .thenError('LAST_OWNER');
+  });
+
+  it('leaves by themselves, and is removed by no one below their role; the delegation used is named', () => {
+    given(aMember().of('acme', 'subject-ada').as(MemberRole.Admin))
+      .when((member) => member.remove({ ...byAMember, byAccount: 'subject-ada', by: MemberRole.Admin }, later))
+      .thenEventNames(['{{context.kebab}}.member.removed']);
+
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.remove(byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+
+    given(aMember().of('acme', 'subject-irene'))
+      .when((member) => member.remove(byAMember, later))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.member.removed',
+          facts: { organisationId: 'acme', accountId: 'subject-irene', delegationId: 'delegation-1' },
+        },
+      ]);
+  });
+
+  it('who was removed is not found any more', () => {
+    given(aMember().removedAt(joinedAt))
+      .when((member) => member.remove(byAnOwner, later))
+      .thenError('MEMBER_NOT_FOUND');
+
+    given(aMember().removedAt(joinedAt))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnOwner, later))
+      .thenError('MEMBER_NOT_FOUND');
+  });
+});

package/templates/presets/identity/context/test/unit/open-organisation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { OpenOrganisationCommand } from '{{alias.context}}/application/commands/open-organisation/open-organisation.command{{alias.ext}}';
+import { OpenOrganisationController } from '{{alias.context}}/presentation/http/organisations/open-organisation/open-organisation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /organisations', () => {
+  it('answers 201 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { slug: 'acme', name: 'Acme' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations');
+    expect([response.status, response.body]).toEqual([201, { id: 'acme' }]);
+    expect(sent).toMatchObject([{ organisation: { slug: 'acme', name: 'Acme' } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { slug: 'acme' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: OpenOrganisationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(OpenOrganisationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'acme';
+    },
+  });
+
+  return { route: controllerRoute(new OpenOrganisationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/open-organisation.handler.spec.ts.tpl

@@ -0,0 +1,52 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { OpenOrganisationCommand } from '{{alias.context}}/application/commands/open-organisation/open-organisation.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const acme = { slug: 'acme', name: 'Acme' };
+
+describe('Open organisation', () => {
+  it('opens the organisation under its slug, its opener its first owner, and tells the provider and the other contexts', async () => {
+    const { application, accounts, members, identityProvider, as } = await startedIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+
+    const id = await application.commandBus.execute(new OpenOrganisationCommand(as('subject-ada'), acme));
+
+    expect(id).toBe('acme');
+    expect((await members.findOf('acme', 'subject-ada'))?.role).toBe(MemberRole.Owner);
+    expect(identityProvider.asked).toEqual(['open acme named Acme', 'add subject-ada to acme']);
+
+    expect(application.eventBus.published.map((event) => event.type)).toEqual([
+      '{{context.kebab}}.organisation.opened',
+      '{{context.kebab}}.member.joined',
+    ]);
+  });
+
+  it('refuses a slug another organisation holds, and saves nothing', async () => {
+    const { application, accounts, organisations, members, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+    await organisations.save(anOrganisation().identifiedBy('acme').build());
+
+    await expect(
+      application.commandBus.execute(new OpenOrganisationCommand(as('subject-ada'), acme)),
+    ).rejects.toMatchObject({
+      code: 'ORGANISATION_SLUG_TAKEN',
+    });
+
+    expect(members.all()).toEqual([]);
+  });
+
+  it('refuses a person who never signed in', async () => {
+    const { application, as } = arrangeIdentity();
+
+    await expect(
+      application.commandBus.execute(new OpenOrganisationCommand(as('subject-ghost'), acme)),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/organisation-name.vo.spec.ts.tpl

@@ -0,0 +1,13 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { OrganisationName } from '{{alias.context}}/domain/value-objects/organisation-name.vo{{alias.ext}}';
+
+describe('OrganisationName', () => {
+  it('is free text, without the spaces at its ends', () => {
+    expect(OrganisationName.create(' Acme & Sons ').value).toBe('Acme & Sons');
+  });
+
+  it.each(['', '  ', 'x'.repeat(101)])('refuses "%s"', (raw) => {
+    expectRefusal(() => OrganisationName.create(raw), 'INVALID_ORGANISATION_NAME', { raw });
+  });
+});

package/templates/presets/identity/context/test/unit/organisation-opened.integration-handler.spec.ts.tpl

@@ -0,0 +1,24 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { organisationOpenedV1 } from '{{alias.context}}/published-language/organisation-opened.v1.integration-event{{alias.ext}}';
+import { startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const opening = organisationOpenedV1.create(
+  { organisationId: 'acme', name: 'Acme', openedBy: 'subject-ada' },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When an organisation is opened, the identity provider follows', () => {
+  it('learns the organisation under its slug once, asked again after a failure until it answers', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    await expect(application.eventBus.publish([opening])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([opening]);
+    await application.eventBus.publish([opening]);
+
+    expect(identityProvider.asked).toEqual(['open acme named Acme']);
+  });
+});

package/templates/presets/identity/context/test/unit/organisation-opened.publisher.spec.ts.tpl

@@ -0,0 +1,35 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { OrganisationOpenedPublisher } from '{{alias.context}}/application/integration/publishers/organisation-opened.publisher{{alias.ext}}';
+import { OrganisationOpened } from '{{alias.context}}/domain/events/organisation-opened.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "organisation opened" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.organisation.opened, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new OrganisationOpenedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new OrganisationOpened('acme', at, { name: 'Acme', openedBy: 'subject-ada' }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.organisation.opened',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { organisationId: 'acme', name: 'Acme', openedBy: 'subject-ada' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new OrganisationOpenedPublisher(bus, new SequentialIdGenerator('event')).handle(new OrganisationOpened('acme', at, { name: 'Acme', openedBy: 'subject-ada' }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/organisation-rights.vo.spec.ts.tpl

@@ -0,0 +1,23 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+
+describe('OrganisationRights', () => {
+  it('holds each right once, whatever gave it twice', () => {
+    const rights = OrganisationRights.of('acme', 'account-ada', [
+      MemberRight.ReadMembers,
+      MemberRight.InviteMembers,
+      MemberRight.ReadMembers,
+    ]);
+
+    expect(rights.rights).toEqual([MemberRight.InviteMembers, MemberRight.ReadMembers]);
+    expect(rights.includes(MemberRight.InviteMembers)).toBe(true);
+    expect(rights.includes(MemberRight.ManageMembers)).toBe(false);
+  });
+
+  it('names the context as the resource the platform authorizes, for the account and the organisation it holds in', () => {
+    const rights = OrganisationRights.of('acme', 'account-ada', []);
+
+    expect(rights).toMatchObject({ type: 'context', id: '{{context.kebab}}', organisationId: 'acme', accountId: 'account-ada' });
+  });
+});

package/templates/presets/identity/context/test/unit/organisation-slug.vo.spec.ts.tpl

@@ -0,0 +1,17 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { OrganisationSlug } from '{{alias.context}}/domain/value-objects/organisation-slug.vo{{alias.ext}}';
+
+describe('OrganisationSlug', () => {
+  it('is lower-case letters, digits and hyphens, up to 63 of them', () => {
+    expect(OrganisationSlug.create(' Acme-42 ').value).toBe('acme-42');
+    expect(OrganisationSlug.create('a'.repeat(63)).value).toHaveLength(63);
+  });
+
+  it.each(['', 'a', '-acme', 'acme_42', 'acme.org', 'acme corp', 'a'.repeat(64)])(
+    'refuses "%s", which names no tenant',
+    (raw) => {
+      expectRefusal(() => OrganisationSlug.create(raw), 'INVALID_ORGANISATION_SLUG', { raw });
+    },
+  );
+});

package/templates/presets/identity/context/test/unit/organisation.aggregate.spec.ts.tpl

@@ -0,0 +1,33 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { OrganisationName } from '{{alias.context}}/domain/value-objects/organisation-name.vo{{alias.ext}}';
+import { OrganisationSlug } from '{{alias.context}}/domain/value-objects/organisation-slug.vo{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+
+const openedAt = new Date('2026-02-01T00:00:00.000Z');
+
+describe('Organisation', () => {
+  it('is opened under its slug by an account, and announces its name and its opener', () => {
+    const terms = { name: OrganisationName.create('Acme'), openedBy: 'subject-ada' };
+    const opened = Organisation.open(OrganisationSlug.create('acme'), terms, openedAt);
+
+    expect([opened.id, opened.name.value, opened.openedBy, opened.openedAt]).toEqual(['acme', 'Acme', 'subject-ada', openedAt]);
+
+    expect(opened.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.organisation.opened',
+        aggregateId: 'acme',
+        occurredAt: openedAt,
+        facts: { name: 'Acme', openedBy: 'subject-ada' },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = anOrganisation().build();
+    const loaded = Organisation.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});

package/templates/presets/identity/context/test/unit/provision-account.controller.spec.ts.tpl

@@ -0,0 +1,73 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { ProvisionAccountCommand } from '{{alias.context}}/application/commands/provision-account/provision-account.command{{alias.ext}}';
+import { ProvisionAccountController } from '{{alias.context}}/presentation/http/accounts/provision-account/provision-account.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', emailVerified: true, username: 'ada' },
+};
+
+describe('PUT /accounts/me', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { displayName: 'Ada L.' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/accounts/me');
+    expect([response.status, response.body]).toEqual([200, { id: 'subject-ada' }]);
+
+    expect(sent).toMatchObject([
+      { actor: { id: 'subject-ada' }, profile: { email: 'ada@example.test', emailVerified: true, displayName: 'Ada L.' } },
+    ]);
+  });
+
+  it('says the address is not verified unless the token says it is', async () => {
+    const { route, sent } = arrange();
+    const unverified: Actor = { ...caller, attributes: { email: 'ada@example.test' } };
+
+    await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { resolvePrincipal: () => unverified },
+    );
+
+    expect(sent).toMatchObject([{ profile: { email: 'ada@example.test', emailVerified: false, displayName: 'ada@example.test' } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { displayName: '' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: ProvisionAccountCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(ProvisionAccountCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'subject-ada';
+    },
+  });
+
+  return { route: controllerRoute(new ProvisionAccountController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/provision-account.handler.spec.ts.tpl

@@ -0,0 +1,65 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { ProvisionAccountCommand } from '{{alias.context}}/application/commands/provision-account/provision-account.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const profile = { email: 'Ada@Example.test', emailVerified: true, displayName: 'Ada Lovelace' };
+
+describe('Provision account', () => {
+  it('provisions the account of a person at their first sign-in, under their subject', async () => {
+    const { application, accounts, as } = arrangeIdentity();
+
+    const id = await application.commandBus.execute(new ProvisionAccountCommand(as('subject-ada'), profile));
+
+    expect(id).toBe('subject-ada');
+    expect((await accounts.findById(id))?.email.value).toBe('ada@example.test');
+  });
+
+  it('refreshes the profile at a later sign-in, without a second account', async () => {
+    const { application, accounts, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').reachedAt('old@example.test').build());
+    await application.commandBus.execute(new ProvisionAccountCommand(as('subject-ada'), profile));
+
+    expect(accounts.all().map((account) => account.email.value)).toEqual(['ada@example.test']);
+  });
+
+  it('refuses a profile the token carries no address in, and a deactivated account', async () => {
+    const { application, accounts, as } = arrangeIdentity();
+
+    await expect(
+      application.commandBus.execute(new ProvisionAccountCommand(as('subject-ada'), { ...profile, email: 'nobody' })),
+    ).rejects.toMatchObject({ code: 'INVALID_EMAIL_ADDRESS' });
+
+    await accounts.save(anAccount().identifiedBy('subject-alan').deactivatedAt(new Date('2025-12-01T00:00:00.000Z')).build());
+
+    await expect(
+      application.commandBus.execute(new ProvisionAccountCommand(as('subject-alan'), profile)),
+    ).rejects.toMatchObject({ code: 'ACCOUNT_DEACTIVATED' });
+  });
+
+  it('refuses an address the provider has not verified, at the first sign-in as at a later one', async () => {
+    const { application, accounts, as } = arrangeIdentity();
+    const unverified = { ...profile, emailVerified: false };
+
+    await expect(
+      application.commandBus.execute(new ProvisionAccountCommand(as('subject-ada'), unverified)),
+    ).rejects.toMatchObject({ code: 'EMAIL_NOT_VERIFIED' });
+
+    await accounts.save(anAccount().identifiedBy('subject-alan').reachedAt('alan@example.test').build());
+
+    await expect(
+      application.commandBus.execute(new ProvisionAccountCommand(as('subject-alan'), unverified)),
+    ).rejects.toMatchObject({ code: 'EMAIL_NOT_VERIFIED' });
+
+    expect(accounts.all().map((account) => account.email.value)).toEqual(['alan@example.test']);
+  });
+
+  it('is refused to an actor the platform grants nothing', async () => {
+    const { application, stranger } = arrangeIdentity();
+
+    await expect(application.commandBus.execute(new ProvisionAccountCommand(stranger, profile))).rejects.toMatchObject({
+      code: 'FORBIDDEN',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/remove-member.controller.spec.ts.tpl

@@ -0,0 +1,44 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { RemoveMemberCommand } from '{{alias.context}}/application/commands/remove-member/remove-member.command{{alias.ext}}';
+import { RemoveMemberController } from '{{alias.context}}/presentation/http/organisations/remove-member/remove-member.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('DELETE /organisations/:organisationId/members/:accountId', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme', accountId: 'subject-grace' }, query: {}, headers: {}, body: {}, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/members/:accountId');
+    expect([response.status, response.body]).toEqual([200, { id: 'member-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', accountId: 'subject-grace' }]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: RemoveMemberCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(RemoveMemberCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'member-1';
+    },
+  });
+
+  return { route: controllerRoute(new RemoveMemberController(commands)), sent };
+}