mock: { mock: { calls: Array<Array<unknown>> } },

expected: string,

) {

const matched = mock.mock.calls.some(([value]) => {

const matchingCalls = mock.mock.calls.filter(([value]) => {

const options = value && typeof value === "object" ? (value as Record<string, unknown>) : {};

return readGatewayAuthToken(options.config) === expected;

});

expect(matched).toBe(true);

expect(matchingCalls).not.toEqual([]);

}

function expectNoteContaining(messagePart: string, title: string) {

const messages = mocks.note.mock.calls

.filter(([, callTitle]) => callTitle === title)

.map(([message]) => String(message));

expect(messages.some((message) => message.includes(messagePart))).toBe(true);

expect(messages.join("\n")).toContain(messagePart);

}

function expectNoNoteContaining(messagePart: string, title: string) {

const messages = mocks.note.mock.calls

.filter(([, callTitle]) => callTitle === title)

.map(([message]) => String(message));

expect(messages.some((message) => message.includes(messagePart))).toBe(false);

expect(messages.join("\n")).not.toContain(messagePart);

}

function setupGatewayEntrypointRepairScenario(params: {

const runtimeNotes = mocks.note.mock.calls.filter(([, title]) => title === "Gateway runtime");

const runtimeMessages = runtimeNotes.map(([message]) => message);

expect(runtimeMessages).not.toContain("duplicate doctor runtime warning");

expect(runtimeMessages.some((message) => String(message).includes("not found"))).toBe(false);

expect(

runtimeMessages.some((message) =>

String(message).includes("Using /home/orin/.nvm/versions/node/v22.22.2/bin/node"),

),

).toBe(true);

expect(runtimeMessages.map((message) => String(message)).join("\n")).not.toContain("not found");

expect(runtimeMessages.map((message) => String(message)).join("\n")).toContain(

"Using /home/orin/.nvm/versions/node/v22.22.2/bin/node",

);

});

it("passes planned managed env keys into service audit for legacy inline secret detection", async () => {