ddd-ts-kit 0.14.0 → 0.16.0

package/templates/presets/identity/context/test/unit/change-member-role.handler.spec.ts.tpl

@@ -0,0 +1,135 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { ChangeMemberRoleCommand } from '{{alias.context}}/application/commands/change-member-role/change-member-role.command{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const DAY = 86_400_000;
+
+describe('Change member role', () => {
+  it('gives the member the new role, tells the other contexts, and ends the delegations they gave', async () => {
+    const arranged = arrangeIdentity();
+    const { application, members, delegations, as } = arranged;
+    const now = application.clock.now();
+
+    await acmeOwnedBy(arranged, 'subject-ada', 'subject-grace');
+    await members.save(aMember().of('acme', 'subject-alan').build());
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .from('subject-grace')
+        .to('subject-alan')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + DAY))
+        .build(),
+    );
+
+    const before = application.eventBus.published.length;
+
+    await application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-ada'), 'acme', 'subject-grace', MemberRole.Member));
+
+    expect((await members.findOf('acme', 'subject-grace'))?.role).toBe(MemberRole.Member);
+    expect((await delegations.findById('delegation-1'))?.isActiveAt(now)).toBe(false);
+
+    expect(application.eventBus.published.slice(before).map((event) => event.type)).toEqual([
+      '{{context.kebab}}.member.role-changed',
+      '{{context.kebab}}.delegation.revoked',
+    ]);
+  });
+
+  it('never changes the role of who asks: another member does', async () => {
+    const arranged = arrangeIdentity();
+
+    await acmeOwnedBy(arranged, 'subject-ada', 'subject-grace');
+
+    await expect(
+      arranged.application.commandBus.execute(new ChangeMemberRoleCommand(arranged.as('subject-ada'), 'acme', 'subject-ada', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'OWN_ROLE' });
+  });
+
+  it('refuses a person who is not a member, and an admin who touches an owner', async () => {
+    const arranged = arrangeIdentity();
+    const { application, members, as } = arranged;
+
+    await acmeOwnedBy(arranged, 'subject-ada');
+    await members.save(aMember().of('acme', 'subject-grace').as(MemberRole.Admin).build());
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-grace'), 'acme', 'subject-nobody', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'MEMBER_NOT_FOUND' });
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-grace'), 'acme', 'subject-ada', MemberRole.Member)),
+    ).rejects.toMatchObject({ code: 'OWNERS_ONLY' });
+  });
+
+  it('is refused to a member who does not manage the members', async () => {
+    const arranged = arrangeIdentity();
+
+    await acmeOwnedBy(arranged, 'subject-ada');
+    await arranged.members.save(aMember().of('acme', 'subject-alan').build());
+    await arranged.members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      arranged.application.commandBus.execute(new ChangeMemberRoleCommand(arranged.as('subject-alan'), 'acme', 'subject-grace', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+  });
+});
+
+describe('Change member role under a delegation', () => {
+  it('never turns the delegation into a role: the delegate does not promote themselves', async () => {
+    const { application, as } = await delegateOfAlan();
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-alan', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'OWN_ROLE' });
+  });
+
+  it('keeps the delegate within their own role: they appoint nobody above it, and touch nobody above it', async () => {
+    const { application, as } = await delegateOfAlan();
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-grace', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-linus', MemberRole.Member)),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+  });
+});
+
+/** The organisation `acme`, with an owner of each name given. */
+async function acmeOwnedBy(arranged: ReturnType<typeof arrangeIdentity>, ...owners: readonly string[]): Promise<void> {
+  await arranged.organisations.save(anOrganisation().identifiedBy('acme').build());
+
+  for (const owner of owners) {
+    await arranged.members.save(aMember().of('acme', owner).as(MemberRole.Owner).build());
+  }
+}
+
+/** A member lent the right to manage the members of acme for a day. */
+async function delegateOfAlan(): Promise<ReturnType<typeof arrangeIdentity>> {
+  const arranged = arrangeIdentity();
+  const now = arranged.application.clock.now();
+
+  await acmeOwnedBy(arranged, 'subject-ada');
+  await arranged.members.save(aMember().of('acme', 'subject-alan').build());
+  await arranged.members.save(aMember().of('acme', 'subject-grace').build());
+  await arranged.members.save(aMember().of('acme', 'subject-linus').as(MemberRole.Admin).build());
+
+  await arranged.delegations.save(
+    aDelegation()
+      .identifiedBy('delegation-1')
+      .from('subject-ada')
+      .to('subject-alan')
+      .lending(MemberRight.ManageMembers)
+      .between(now, new Date(now.getTime() + DAY))
+      .build(),
+  );
+
+  return arranged;
+}

package/templates/presets/identity/context/test/unit/crypto-invitation-tokens.adapter.spec.ts.tpl

@@ -0,0 +1,15 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { CryptoInvitationTokens } from '{{alias.context}}/infrastructure/external/crypto-invitation-tokens.adapter{{alias.ext}}';
+
+describe('CryptoInvitationTokens', () => {
+  it('issues a new token each time, fit for an address, with the digest it is found by', () => {
+    const tokens = new CryptoInvitationTokens();
+    const first = tokens.issue();
+    const second = tokens.issue();
+
+    expect(first.token).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(first.token).not.toBe(second.token);
+    expect(first.digest).toBe(tokens.digestOf(first.token));
+    expect(first.digest).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

package/templates/presets/identity/context/test/unit/deactivate-account.controller.spec.ts.tpl

@@ -0,0 +1,44 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { DeactivateAccountCommand } from '{{alias.context}}/application/commands/deactivate-account/deactivate-account.command{{alias.ext}}';
+import { DeactivateAccountController } from '{{alias.context}}/presentation/http/accounts/deactivate-account/deactivate-account.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /accounts/me/deactivation', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/accounts/me/deactivation');
+    expect([response.status, response.body]).toEqual([200, { id: 'subject-ada' }]);
+    expect(sent).toMatchObject([{ actor: { id: 'subject-ada' } }]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: DeactivateAccountCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(DeactivateAccountCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'subject-ada';
+    },
+  });
+
+  return { route: controllerRoute(new DeactivateAccountController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/deactivate-account.handler.spec.ts.tpl

@@ -0,0 +1,106 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { offsetPage } from '@ddd-ts-kit/kernel';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { DeactivateAccountCommand } from '{{alias.context}}/application/commands/deactivate-account/deactivate-account.command{{alias.ext}}';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { RemoveMemberCommand } from '{{alias.context}}/application/commands/remove-member/remove-member.command{{alias.ext}}';
+import { SearchMembersQuery } from '{{alias.context}}/application/queries/search-members/search-members.query{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const DAY = 86_400_000;
+
+describe('Deactivate account', () => {
+  it('deactivates the account of the person who asks, tells the other contexts, then the provider', async () => {
+    const { application, accounts, identityProvider, as } = await startedIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-ada')));
+
+    expect((await accounts.findById('subject-ada'))?.isActive).toBe(false);
+    expect(identityProvider.asked).toEqual(['disable subject-ada']);
+
+    expect(application.eventBus.published).toMatchObject([
+      { type: '{{context.kebab}}.account.deactivated', payload: { accountId: 'subject-ada' } },
+    ]);
+  });
+
+  it('leaves every organisation and ends every delegation, so that the account holds no right anywhere', async () => {
+    const { application, accounts, organisations, members, delegations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').build());
+
+    for (const slug of ['acme', 'globex']) {
+      await organisations.save(anOrganisation().identifiedBy(slug).build());
+      await members.save(aMember().of(slug, 'subject-ada').as(MemberRole.Owner).build());
+      await members.save(aMember().of(slug, 'subject-grace').as(MemberRole.Admin).build());
+    }
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .in('acme')
+        .from('subject-ada')
+        .to('subject-grace')
+        .lending(MemberRight.GrantDelegations)
+        .between(now, new Date(now.getTime() + DAY))
+        .build(),
+    );
+
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-grace')));
+
+    expect(await members.searchCurrentOf('subject-grace')).toEqual([]);
+    expect((await delegations.findById('delegation-1'))?.isActiveAt(now)).toBe(false);
+  });
+
+  it('leaves a deactivated person no use case of an organisation, whatever their token still says', async () => {
+    const { application, accounts, organisations, members, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').build());
+    await organisations.save(anOrganisation().identifiedBy('acme').build());
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-grace').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-alan').build());
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-grace')));
+
+    const invite = new InviteMemberCommand(as('subject-grace'), 'acme', { email: 'eve@example.test', role: MemberRole.Member });
+    const remove = new RemoveMemberCommand(as('subject-grace'), 'acme', 'subject-alan');
+    const search = new SearchMembersQuery(as('subject-grace'), 'acme', offsetPage({ limit: 20 }));
+
+    await expect(application.commandBus.execute(invite)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    await expect(application.commandBus.execute(remove)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    await expect(application.queryBus.execute(search)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    expect(await members.countOwners('acme')).toBe(1);
+  });
+
+  it('refuses the last owner of an organisation, who appoints another owner first, and changes nothing', async () => {
+    const { application, accounts, organisations, members, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+    await organisations.save(anOrganisation().identifiedBy('acme').build());
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+
+    await expect(application.commandBus.execute(new DeactivateAccountCommand(as('subject-ada')))).rejects.toMatchObject(
+      {
+        code: 'LAST_OWNER',
+      },
+    );
+
+    expect((await accounts.findById('subject-ada'))?.isActive).toBe(true);
+  });
+
+  it('refuses a person who never signed in', async () => {
+    const { application, as } = arrangeIdentity();
+
+    await expect(
+      application.commandBus.execute(new DeactivateAccountCommand(as('subject-ghost'))),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/decline-invitation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { DeclineInvitationCommand } from '{{alias.context}}/application/commands/decline-invitation/decline-invitation.command{{alias.ext}}';
+import { DeclineInvitationController } from '{{alias.context}}/presentation/http/invitations/decline-invitation/decline-invitation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /invitations/declination', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { token: 'token-1' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/invitations/declination');
+    expect([response.status, response.body]).toEqual([200, { id: 'invitation-1' }]);
+    expect(sent).toMatchObject([{ token: 'token-1' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: DeclineInvitationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(DeclineInvitationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'invitation-1';
+    },
+  });
+
+  return { route: controllerRoute(new DeclineInvitationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/decline-invitation.handler.spec.ts.tpl

@@ -0,0 +1,40 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { DeclineInvitationCommand } from '{{alias.context}}/application/commands/decline-invitation/decline-invitation.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+describe('Decline invitation', () => {
+  it('records the answer of the person it was sent to, who joins nothing', async () => {
+    const { application, accounts, invitations, members, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+    await invitations.save(anInvitation().identifiedBy('invitation-1').withTokenHash(token.digest).build());
+
+    await application.commandBus.execute(new DeclineInvitationCommand(as('subject-grace'), token.token));
+
+    expect((await invitations.findById('invitation-1'))?.status).toBe(InvitationStatus.Declined);
+    expect(members.all()).toEqual([]);
+  });
+
+  it('knows no token it did not issue, and no person who never signed in', async () => {
+    const { application, invitations, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await invitations.save(anInvitation().withTokenHash(token.digest).build());
+
+    await expect(
+      application.commandBus.execute(new DeclineInvitationCommand(as('subject-grace'), 'forged')),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_NOT_FOUND',
+    });
+
+    await expect(
+      application.commandBus.execute(new DeclineInvitationCommand(as('subject-ghost'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/delegation-granted.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { DelegationGrantedPublisher } from '{{alias.context}}/application/integration/publishers/delegation-granted.publisher{{alias.ext}}';
+import { DelegationGranted } from '{{alias.context}}/domain/events/delegation-granted.event{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "delegation granted" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.delegation.granted, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new DelegationGrantedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new DelegationGranted('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: [MemberRight.InviteMembers], startsAt: at, endsAt: new Date('2026-01-15T00:00:00.000Z') }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.delegation.granted',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { delegationId: 'delegation-1', organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: ['invite-members'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new DelegationGrantedPublisher(bus, new SequentialIdGenerator('event')).handle(new DelegationGranted('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: [MemberRight.InviteMembers], startsAt: at, endsAt: new Date('2026-01-15T00:00:00.000Z') }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/delegation-period.vo.spec.ts.tpl

@@ -0,0 +1,32 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+
+const start = new Date('2026-03-01T00:00:00.000Z');
+const end = new Date('2026-03-15T00:00:00.000Z');
+
+describe('DelegationPeriod', () => {
+  it('holds from its start, included, to its end, excluded', () => {
+    const period = DelegationPeriod.create(start, end);
+
+    expect(period.includes(start)).toBe(true);
+    expect(period.includes(new Date('2026-03-14T23:59:59.999Z'))).toBe(true);
+    expect(period.includes(end)).toBe(false);
+    expect(period.includes(new Date('2026-02-28T23:59:59.999Z'))).toBe(false);
+  });
+
+  it('refuses to end before it starts, or when it starts', () => {
+    expectRefusal(() => DelegationPeriod.create(end, start), 'DELEGATION_PERIOD_INVERTED');
+    expectRefusal(() => DelegationPeriod.create(start, start), 'DELEGATION_PERIOD_INVERTED');
+  });
+
+  it('lasts ninety days at most', () => {
+    expect(DelegationPeriod.create(start, new Date('2026-05-30T00:00:00.000Z')).endsAt).toEqual(
+      new Date('2026-05-30T00:00:00.000Z'),
+    );
+
+    expectRefusal(() => DelegationPeriod.create(start, new Date('2026-05-30T00:00:00.001Z')), 'DELEGATION_TOO_LONG', {
+      longestDays: 90,
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/delegation-revoked.publisher.spec.ts.tpl

@@ -0,0 +1,35 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { DelegationRevokedPublisher } from '{{alias.context}}/application/integration/publishers/delegation-revoked.publisher{{alias.ext}}';
+import { DelegationRevoked } from '{{alias.context}}/domain/events/delegation-revoked.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "delegation revoked" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.delegation.revoked, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new DelegationRevokedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new DelegationRevoked('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.delegation.revoked',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { delegationId: 'delegation-1', organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new DelegationRevokedPublisher(bus, new SequentialIdGenerator('event')).handle(new DelegationRevoked('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/delegation.aggregate.spec.ts.tpl

@@ -0,0 +1,111 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Delegation, type DelegationTerms } from '{{alias.context}}/domain/aggregates/delegation.aggregate{{alias.ext}}';
+import { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+
+const startsAt = new Date('2026-03-01T00:00:00.000Z');
+const endsAt = new Date('2026-03-15T00:00:00.000Z');
+const during = new Date('2026-03-05T00:00:00.000Z');
+const period = DelegationPeriod.create(startsAt, endsAt);
+const adminRights = OrganisationRights.of('acme', 'subject-ada', [MemberRight.ReadMembers, MemberRight.InviteMembers]);
+
+describe('Delegation', () => {
+  it('lends rights the delegator holds, for a period, and announces its terms', () => {
+    const granted = Delegation.grant('delegation-1', lending([MemberRight.InviteMembers]), startsAt);
+
+    expect(granted.isActiveAt(during)).toBe(true);
+
+    expect(granted.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.delegation.granted',
+        aggregateId: 'delegation-1',
+        occurredAt: startsAt,
+        facts: {
+          organisationId: 'acme',
+          delegatorId: 'subject-ada',
+          delegateId: 'subject-grace',
+          rights: [MemberRight.InviteMembers],
+          startsAt,
+          endsAt,
+        },
+      },
+    ]);
+  });
+
+  it('lends nothing beyond what the delegator holds, nothing to the delegator, and something', () => {
+    expect(() => Delegation.grant('d', lending([MemberRight.ManageMembers]), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_BEYOND_RIGHTS', facts: { right: MemberRight.ManageMembers } }),
+    );
+
+    expect(() => Delegation.grant('d', lending([MemberRight.InviteMembers], 'subject-ada'), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_TO_ONESELF' }),
+    );
+
+    expect(() => Delegation.grant('d', lending([]), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_WITHOUT_RIGHTS' }),
+    );
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = aDelegation().build();
+    const loaded = Delegation.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('A granted delegation', () => {
+  it('holds during its period only', () => {
+    const granted = aDelegation().between(startsAt, endsAt).build();
+
+    expect([granted.isActiveAt(startsAt), granted.isActiveAt(during), granted.isActiveAt(endsAt)]).toEqual([
+      true,
+      true,
+      false,
+    ]);
+  });
+
+  it('is revoked while it holds, and announces it', () => {
+    given(aDelegation().identifiedBy('delegation-1').between(startsAt, endsAt))
+      .when((delegation) => delegation.revoke(during))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.delegation.revoked',
+          aggregateId: 'delegation-1',
+          facts: { organisationId: 'acme', delegatorId: 'account-owner', delegateId: 'account-deputy' },
+        },
+      ])
+      .thenState((delegation) => expect(delegation.isActiveAt(during)).toBe(false));
+  });
+
+  it('is revoked no more once it ended', () => {
+    given(aDelegation().between(startsAt, endsAt))
+      .when((delegation) => delegation.revoke(endsAt))
+      .thenError('DELEGATION_NOT_ACTIVE');
+
+    const revoked = aDelegation().between(startsAt, endsAt).build();
+
+    revoked.revoke(during);
+
+    given(revoked)
+      .when((delegation) => delegation.revoke(during))
+      .thenError('DELEGATION_NOT_ACTIVE');
+  });
+
+  it('ends once with the standing it was granted under, and a second end changes nothing', () => {
+    given(aDelegation().between(startsAt, endsAt))
+      .when((delegation) => {
+        delegation.end(during);
+        delegation.end(during);
+      })
+      .thenEventNames(['{{context.kebab}}.delegation.revoked']);
+  });
+});
+
+function lending(rights: readonly MemberRight[], delegateId = 'subject-grace'): DelegationTerms {
+  return { organisationId: 'acme', delegatorId: 'subject-ada', delegateId, rights, period, held: adminRights };
+}

package/templates/presets/identity/context/test/unit/display-name.vo.spec.ts.tpl

@@ -0,0 +1,13 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+
+describe('DisplayName', () => {
+  it('is what the person wrote, without the spaces at its ends', () => {
+    expect(DisplayName.create('  Grace Hopper ').value).toBe('Grace Hopper');
+  });
+
+  it.each(['', '   ', 'x'.repeat(101)])('refuses a name of %s characters out of bounds', (raw) => {
+    expectRefusal(() => DisplayName.create(raw), 'INVALID_DISPLAY_NAME', { raw });
+  });
+});

package/templates/presets/identity/context/test/unit/email-address.vo.spec.ts.tpl

@@ -0,0 +1,24 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+
+describe('EmailAddress', () => {
+  it('is one address whatever the case and the spaces around it', () => {
+    const typed = EmailAddress.create('  Ada.Lovelace@Example.ORG ');
+
+    expect(typed.value).toBe('ada.lovelace@example.org');
+    expect(typed.equals(EmailAddress.create('ada.lovelace@example.org'))).toBe(true);
+  });
+
+  it.each([
+    '',
+    'ada',
+    'ada@',
+    '@example.org',
+    'ada@example',
+    'ada lovelace@example.org',
+    `${'a'.repeat(250)}@example.org`,
+  ])('refuses "%s", which is no address', (raw) => {
+    expectRefusal(() => EmailAddress.create(raw), 'INVALID_EMAIL_ADDRESS', { raw });
+  });
+});