test: align tests with member-seeding and visibility merge

Two test-only fixes to match new behavior that already shipped:

1. service-tenant/project-provisioning.test.ts
   ProjectProvisioningService.provisionProject now also seeds a row in
   sys_project_member (creator → owner) so the dispatcher's per-user
   membership lookup returns the role immediately after creation. Test
   was still asserting only ['sys_project', 'sys_project_credential'];
   expand to ['sys_project', 'sys_project_credential',
   'sys_project_member'] and assert the seeded owner row.

2. service-cloud/public-artifact-routes.test.ts
   Visibility merge collapsed 'unlisted' into 'private' with share-by-link
   semantics. Rewrite the visibility-gating tests:
   - 'private project: all public routes return 404' → split into
     enumeration-404 and ?commit=<id>-200 (share-by-link works anonymously).
   - 'private project: defaults when visibility is undefined' → asserts
     both branches (no-commit 404, with-commit 200).
   - Old 'unlisted' tests are kept as 'legacy unlisted rows behave like
     private' to exercise the coercion path on old DB rows.

Full suite: pnpm test → 100/100 turbo tasks successful.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/services/service-cloud/test/public-artifact-routes.test.ts

@@ -4,11 +4,11 @@
  * Tests for the public, unauthenticated artifact API
  * (`/pub/v1/projects/:id/*`) and its visibility gating.
  *
- *   - sys_project.visibility = 'private'  → 404 on every public route
- *   - sys_project.visibility = 'unlisted' → 404 on /artifact without ?commit=,
- *                                            200 on /artifact?commit=<id>,
- *                                            404 on /revisions and /manifest.json
+ *   - sys_project.visibility = 'private'  → 404 on /artifact without ?commit=
+ *                                            (and on /revisions + /manifest.json),
+ *                                            200 on /artifact?commit=<id> (share-by-link)
  *   - sys_project.visibility = 'public'   → 200 on all three routes
+ *   - sys_project.visibility = 'unlisted' (legacy) is coerced to 'private'
  */
 
 import { describe, it, expect, beforeEach } from 'vitest';
@@ -121,25 +121,29 @@ describe('public artifact API (/pub/v1/projects/:id/*)', () => {
         await plugin.init(ctx); await plugin.start(ctx);
     }
 
-    // --- private --------------------------------------------------------------
-    it('private project: all public routes return 404 (no leak)', async () => {
+    // --- private (share-by-link) ---------------------------------------------
+    it('private project: enumeration routes return 404, but ?commit= returns 200', async () => {
         await boot([{ id: 'proj_a', organization_id: 'org_1', visibility: 'private' }]);
 
-        const a = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact');
-        const b = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact', { query: { commit: 'cafebabe' } });
-        const c = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/revisions');
-        const d = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/manifest.json');
-        expect([a.status, b.status, c.status, d.status]).toEqual([404, 404, 404, 404]);
+        const enumArtifact = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact');
+        const shareByLink = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact', { query: { commit: 'cafebabe' } });
+        const revs = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/revisions');
+        const mani = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/manifest.json');
+        expect([enumArtifact.status, shareByLink.status, revs.status, mani.status]).toEqual([404, 200, 404, 404]);
+        expect(shareByLink.body.data.commitId).toBe('cafebabe');
     });
 
     it('private project: defaults when visibility is undefined', async () => {
         await boot([{ id: 'proj_a', organization_id: 'org_1' /* no visibility */ }]);
-        const r = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact', { query: { commit: 'cafebabe' } });
-        expect(r.status).toBe(404);
+        // Defaulted-to-private: enumeration is hidden but share-by-link works.
+        const noCommit = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact');
+        expect(noCommit.status).toBe(404);
+        const withCommit = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact', { query: { commit: 'cafebabe' } });
+        expect(withCommit.status).toBe(200);
     });
 
-    // --- unlisted -------------------------------------------------------------
-    it('unlisted project: 404 without ?commit=, 200 with ?commit=', async () => {
+    // --- unlisted (legacy → coerced to private) ------------------------------
+    it('legacy `unlisted` rows behave like `private` (share-by-link)', async () => {
         await boot([{ id: 'proj_a', organization_id: 'org_1', visibility: 'unlisted' }]);
 
         const enumAttempt = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/artifact');
@@ -151,7 +155,7 @@ describe('public artifact API (/pub/v1/projects/:id/*)', () => {
         expect(ok.body.data.commitId).toBe('cafebabe');
     });
 
-    it('unlisted project: revisions and manifest are still hidden', async () => {
+    it('legacy `unlisted` rows still hide /revisions and /manifest.json', async () => {
         await boot([{ id: 'proj_a', organization_id: 'org_1', visibility: 'unlisted' }]);
         const revs = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/revisions');
         const mani = await server.invoke('GET', '/api/v1/pub/v1/projects/proj_a/manifest.json');

packages/services/service-tenant/src/project-provisioning.test.ts

@@ -69,7 +69,11 @@ describe('ProjectProvisioningService.provisionProject', () => {
     });
 
     const objects = created.map((c) => c.object);
-    expect(objects).toEqual(['sys_project', 'sys_project_credential']);
+    expect(objects).toEqual([
+      'sys_project',
+      'sys_project_credential',
+      'sys_project_member',
+    ]);
 
     const projectRow = created.find((c) => c.object === 'sys_project')!.data;
     expect(projectRow.organization_id).toBe('org-42');
@@ -83,6 +87,15 @@ describe('ProjectProvisioningService.provisionProject', () => {
     expect(projectRow.project_type).toBeUndefined();
     expect(projectRow.region).toBeUndefined();
 
+    // Creator should be seeded as the initial owner so /projects/:id/members
+    // returns at least one row immediately after provisioning.
+    const memberRow = created.find((c) => c.object === 'sys_project_member')!.data;
+    expect(memberRow.project_id).toBe(projectRow.id);
+    expect(memberRow.user_id).toBe('user-1');
+    expect(memberRow.role).toBe('owner');
+    expect(memberRow.invited_by).toBe('user-1');
+    expect(memberRow.organization_id).toBe('org-42');
+
     expect(result.warnings).toBeUndefined();
   });