feat(testkit): deterministic fake platform ports + fixtures + replay oracle

Fakes for all 7 IiosPlatformPorts (deny/timeout/ambiguous controls), portal +
unknown-email fixtures, replayTwice idempotency oracle. Adds ingest request
contract. Vitest alias resolves workspace packages to source.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-testkit/src/fakes/capability.ts

@@ -0,0 +1,10 @@
+import type { IiosPlatformPorts } from '@insignia/iios-contracts';
+
+type CapabilityPort = IiosPlatformPorts['capability'];
+
+/** Deterministic Capability Broker fake. Reports a successful provider send. */
+export class FakeCapability implements CapabilityPort {
+  async invoke(_input: unknown): Promise<{ providerRef: string; outcome: string }> {
+    return { providerRef: 'fake-provider', outcome: 'SENT' };
+  }
+}

packages/iios-testkit/src/fakes/cmp.ts

@@ -0,0 +1,20 @@
+import type { IiosPlatformPorts } from '@insignia/iios-contracts';
+
+type CmpPort = IiosPlatformPorts['cmp'];
+
+/** Deterministic CMP (consent) fake. Defaults to NOT_REQUIRED. */
+export class FakeCmp implements CmpPort {
+  private status: 'ALLOW' | 'DENY' | 'NOT_REQUIRED' = 'NOT_REQUIRED';
+
+  setStatus(s: 'ALLOW' | 'DENY' | 'NOT_REQUIRED'): this {
+    this.status = s;
+    return this;
+  }
+
+  async checkPurpose(_input: unknown): Promise<{ receiptRef?: string; status: 'ALLOW' | 'DENY' | 'NOT_REQUIRED' }> {
+    return {
+      receiptRef: this.status === 'ALLOW' ? 'fake-receipt' : undefined,
+      status: this.status,
+    };
+  }
+}

packages/iios-testkit/src/fakes/crre.ts

@@ -0,0 +1,15 @@
+import type { IiosPlatformPorts, ContextDecisionBundle } from '@insignia/iios-contracts';
+
+type CrrePort = IiosPlatformPorts['crre'];
+
+/** Deterministic CRRE fake. Returns an empty (no-constraint) context bundle. */
+export class FakeCrre implements CrrePort {
+  async resolve(_input: unknown): Promise<ContextDecisionBundle> {
+    return {
+      bundleRef: 'fake-bundle',
+      scopeHash: 'fake-hash',
+      resourceSet: [],
+      constraints: [],
+    };
+  }
+}

packages/iios-testkit/src/fakes/index.ts

@@ -0,0 +1,34 @@
+import type { IiosPlatformPorts } from '@insignia/iios-contracts';
+import { FakeSession } from './session';
+import { FakeOpa } from './opa';
+import { FakeCmp } from './cmp';
+import { FakeMdm } from './mdm';
+import { FakeCrre } from './crre';
+import { FakeSas } from './sas';
+import { FakeCapability } from './capability';
+
+export { FakeSession, FakeOpa, FakeCmp, FakeMdm, FakeCrre, FakeSas, FakeCapability };
+
+/** The full set of fakes, typed so tests can reach each fake's control methods. */
+export interface FakePorts extends IiosPlatformPorts {
+  session: FakeSession;
+  opa: FakeOpa;
+  cmp: FakeCmp;
+  mdm: FakeMdm;
+  crre: FakeCrre;
+  sas: FakeSas;
+  capability: FakeCapability;
+}
+
+/** Assemble a fresh, fully-faked IiosPlatformPorts (all default to "happy"). */
+export function makeFakePorts(): FakePorts {
+  return {
+    session: new FakeSession(),
+    opa: new FakeOpa(),
+    cmp: new FakeCmp(),
+    mdm: new FakeMdm(),
+    crre: new FakeCrre(),
+    sas: new FakeSas(),
+    capability: new FakeCapability(),
+  };
+}

packages/iios-testkit/src/fakes/mdm.ts

@@ -0,0 +1,34 @@
+import type { IiosPlatformPorts, SourceHandleResolution } from '@insignia/iios-contracts';
+
+type MdmPort = IiosPlatformPorts['mdm'];
+
+/**
+ * Deterministic MDM fake. Defaults to UNRESOLVED (an unknown handle stays a
+ * SourceHandle — no silent merge). Can be set to ambiguous or resolved.
+ */
+export class FakeMdm implements MdmPort {
+  private resolution: SourceHandleResolution = {
+    canonicalEntityId: undefined,
+    confidence: 0,
+    status: 'UNRESOLVED',
+  };
+
+  setResolution(r: Partial<SourceHandleResolution>): this {
+    this.resolution = { ...this.resolution, ...r };
+    return this;
+  }
+
+  ambiguous(confidence = 0.42): this {
+    this.resolution = { canonicalEntityId: undefined, confidence, status: 'AMBIGUOUS' };
+    return this;
+  }
+
+  resolved(canonicalEntityId: string, confidence = 0.99): this {
+    this.resolution = { canonicalEntityId, confidence, status: 'RESOLVED' };
+    return this;
+  }
+
+  async resolveSourceHandle(_input: unknown): Promise<SourceHandleResolution> {
+    return this.resolution;
+  }
+}

packages/iios-testkit/src/fakes/opa.ts

@@ -0,0 +1,39 @@
+import type { IiosPlatformPorts, PolicyDecision } from '@insignia/iios-contracts';
+
+type OpaPort = IiosPlatformPorts['opa'];
+
+/** Deterministic OPA fake. Defaults to allow; can be set to deny or timeout. */
+export class FakeOpa implements OpaPort {
+  private decision: PolicyDecision = {
+    decisionRef: 'fake-allow',
+    allow: true,
+    obligations: [],
+    ttlSeconds: 60,
+  };
+  private mode: 'normal' | 'timeout' = 'normal';
+
+  setDecision(d: Partial<PolicyDecision>): this {
+    this.decision = { ...this.decision, ...d };
+    return this;
+  }
+
+  deny(reason = 'denied by fake opa'): this {
+    this.decision = {
+      decisionRef: 'fake-deny',
+      allow: false,
+      obligations: [{ kind: 'AUDIT', reason }],
+      ttlSeconds: 0,
+    };
+    return this;
+  }
+
+  timeout(): this {
+    this.mode = 'timeout';
+    return this;
+  }
+
+  async decide(_input: unknown): Promise<PolicyDecision> {
+    if (this.mode === 'timeout') throw new Error('opa timeout');
+    return this.decision;
+  }
+}

packages/iios-testkit/src/fakes/sas.ts

@@ -0,0 +1,10 @@
+import type { IiosPlatformPorts } from '@insignia/iios-contracts';
+
+type SasPort = IiosPlatformPorts['sas'];
+
+/** Deterministic SAS (secure-store) fake. Pass-through tokenization in dev. */
+export class FakeSas implements SasPort {
+  async tokenizeParts(parts: unknown[]): Promise<unknown[]> {
+    return parts;
+  }
+}

packages/iios-testkit/src/fakes/session.ts

@@ -0,0 +1,29 @@
+import type { IiosPlatformPorts, PlatformPrincipal } from '@insignia/iios-contracts';
+
+type SessionPort = IiosPlatformPorts['session'];
+
+/** Deterministic Session fake. Returns a fixed principal; can be set to reject. */
+export class FakeSession implements SessionPort {
+  private principal: PlatformPrincipal = {
+    principalRef: 'fake-principal',
+    orgId: 'org_demo',
+    appId: 'portal-demo',
+    assurance: 'authenticated',
+  };
+  private fail = false;
+
+  setPrincipal(p: Partial<PlatformPrincipal>): this {
+    this.principal = { ...this.principal, ...p };
+    return this;
+  }
+
+  reject(): this {
+    this.fail = true;
+    return this;
+  }
+
+  async verify(_token: string): Promise<PlatformPrincipal> {
+    if (this.fail) throw new Error('invalid token');
+    return this.principal;
+  }
+}