chore(deps): update dependency vitest to v4 [security] (finos#2556)

* chore(deps): update dependency vitest to v4 [security]

* chore(deps): align @vitest/coverage-v8 and @vitest/ui with vitest v4

Renovate's vitest 3 -> 4 bump in this PR left @vitest/coverage-v8 and
@vitest/ui on ^3, but vitest@4 declares peerOptional matching its own
major (e.g. @vitest/ui@"4.1.8" from vitest@4.1.8). npm ci therefore
refused to install with an ERESOLVE, failing every CI job before tests
could run.

Bumps the companion packages to ^4 in the root devDependencies and in
the four calm-suite/calm-studio workspaces that also pinned
@vitest/coverage-v8@^3. Lockfile regenerated incrementally; all 105
linux / 28 darwin / 35 win32 platform variants preserved.

This unblocks npm ci but does not address downstream vitest@4 mock
breaking changes (vi.fn(arrow) no longer constructable, v8 coverage
branch-count drift) that surface in cli, shared, calm-plugins/vscode,
calm-widgets and a couple of calm-studio tests once installs succeed -
those need a separate migration pass.

* test: migrate test suites to vitest v4

Vitest v4 tightened mocking and module resolution. This commit makes
the existing tests pass under v4 without changing behaviour:

* Convert `vi.fn(arrow)` / `mockImplementation(arrow)` to function
  expressions. In v4, arrow-function implementations cannot be called
  with `new` (TypeError: ... is not a constructor) - tests that mock
  constructor calls were failing across cli, shared, calm-plugins/vscode,
  calm-widgets and calm-suite/calm-studio. The function-expression form
  is semantically identical for non-constructor calls and constructable
  for `new`. See https://vitest.dev/guide/migration.html.
* Add a `default` condition to `@finos/calm-models`'s `exports` map for
  every subpath. v4's resolver (via newer Vite) no longer falls back
  from `import` to `default` implicitly, breaking calm-server tests
  that transitively imported `@finos/calm-models/canonical`.
* Lower the branch-coverage threshold from 85 to 78 in calm-models,
  calm-widgets, shared and cli. v4's v8 coverage reporter counts
  branches more strictly than v3 (observed drop of ~3-5 points on
  unchanged source); 78 keeps a meaningful gate while accommodating
  the new measurement.

All workspace test suites now pass with coverage enabled on Node 22.

* fix(calm-widgets): re-include @types/node in tsconfig types

The workspace's tsconfig.json overrode the base config's
`"types": ["vitest", "node"]` with `"types": ["vitest"]`, dropping the
Node types. Under vitest 3, the bundled `vitest` types transitively
pulled in @types/node so this went unnoticed; under vitest 4 the type
surface was cleaned up, leaving `__dirname`, `fs` and `path` unresolved
during DTS generation (TS2304).

This cascaded into every PR 2556 CI job that builds calm-widgets as a
dependency (Shared, CLI, VSCode Extension, CALM Server).

* test(calm-hub-ui): apply vitest v4 vi.fn arrow→function conversion

Same root cause as 0299dd1 - I scoped the original migration to the
workspaces that surfaced in earlier failed CI checks and missed
calm-hub-ui, which has its own workflow ("Build CALM Hub UI") whose
"Build, Test, and Lint Shared Module" job tests the calm-hub-ui
sources rather than @finos/calm-shared.

Six React Testing Library specs were affected. 700/700 tests pass
locally on Node 22.22.2.

* test: backfill tests and revert v4 threshold lowering

Vitest 4's v8 coverage reporter counts branches more strictly than v3
(short-circuit operators, nullish coalescing, optional chaining, default
parameters all now contribute branches that v3 silently elided). Same
source code measures 3–5 points lower under v4.

The previous commit lowered the branch threshold from 85 to 78 across
calm-models, calm-widgets, shared and cli to paper over this. That was
the wrong call — the threshold was a quality gate, and lowering it on
account of measurement drift loses information. This commit reverts the
threshold to 85 and instead writes real tests for the branches v4 now
surfaces, restoring the original gate honestly:

* calm-models — 82.27% → 90.71% — adds the missing canonical/
  template-models spec (5 type guards, visitRelationship dispatch for
  all five relationship kinds plus the default, toKindView).
* calm-widgets — 82.41% → 85.06% — adds flow-sequence cases for
  composed-of/options/missing-relationship paths and validateContext
  guards; adds related-nodes cases for every node-id branch in the
  filter (interacts actor/nodes, deployed-in container/nodes,
  composed-of, options-default).
* shared — 81.00% → 85.06% — adds full logger.spec for the node and
  browser branches; covers pretty-output's info/hint severities,
  fallback header/code paths, snippet trimming and out-of-range
  branches; covers flow-sequence-helper for all kind branches and
  empty-nodes fallbacks; covers control-registry's no-controls and
  duplicate-pass branches; covers handlers.ts (msw test infra) directly;
  covers c4's unknown-actor / unknown-source / unknown-destination
  warnings; adds template-preprocessor empty-body and no-mustaches
  edges.
* cli — 79.91% → 85.09% — adds hub-output.spec for parseOutputFormat /
  printJsonSuccess / printTableSuccess / printError; covers cli-config
  loadAuthPlugin error paths; covers diff/timeline ends-with-newline and
  non-Error throw branches; covers index.ts entry point including the
  catch with Error / non-Error / falsy values; adds
  getting-started-url-mapping coverage of the JSON-read catch blocks.

* fix(test): satisfy strict tsc on new flow-sequence specs

The coverage-backfill commit landed new flow-sequence tests that pass
vitest (transpile-only) but fail strict tsc on the tsup-then-tsc build
step:

* `arch.flows[0]` — flows is optional on CalmCoreCanonicalModel; needs
  a non-null assertion (`arch.flows![0]`) since makeArch always
  populates it.
* The options-kind relationship literal was missing the required
  `relationships: []` field on CalmDecisionCanonicalModel.

These are test-only assertions; production types are unchanged. Caught
by every CI job that builds calm-widgets (Shared, CLI, VSCode Ext,
CALM Server, calm-widgets itself).

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Matthew Bain <66839492+rocketstack-matt@users.noreply.github.com>

Author: renovate[bot]

calm-hub-ui/src/hub/components/control-detail-section/ControlDetailSection.test.tsx

@@ -25,13 +25,13 @@ const mockFetchConfigurationVersions = vi.fn();
 const mockFetchConfigurationForVersion = vi.fn();
 
 vi.mock('../../../service/control-service.js', () => ({
-    ControlService: vi.fn().mockImplementation(() => ({
+    ControlService: vi.fn().mockImplementation(function () { return {
         fetchRequirementVersions: (...args: unknown[]) => mockFetchRequirementVersions(...args),
         fetchRequirementForVersion: (...args: unknown[]) => mockFetchRequirementForVersion(...args),
         fetchConfigurationsForControl: (...args: unknown[]) => mockFetchConfigurationsForControl(...args),
         fetchConfigurationVersions: (...args: unknown[]) => mockFetchConfigurationVersions(...args),
         fetchConfigurationForVersion: (...args: unknown[]) => mockFetchConfigurationForVersion(...args),
-    })),
+    }; }),
 }));
 
 // ── Test data ─────────────────────────────────────────────

calm-hub-ui/src/hub/components/diagram-section/DiagramSection.test.tsx

@@ -21,7 +21,7 @@ vi.mock('react-router-dom', async () => {
     const actual = await vi.importActual('react-router-dom');
     return {
         ...actual,
-        useNavigate: vi.fn(() => vi.fn()),
+        useNavigate: vi.fn(function () { return vi.fn(); }),
     };
 });
 
@@ -61,13 +61,13 @@ vi.mock('./timeline/TimelineBar.js', () => ({
 }));
 
 vi.mock('../../../service/calm-service.js', () => ({
-    CalmService: vi.fn().mockImplementation(() => ({
+    CalmService: vi.fn().mockImplementation(function () { return {
         fetchDecoratorValues: calmServiceMock.fetchDecoratorValues,
         fetchVersionsByCustomId: calmServiceMock.fetchVersionsByCustomId,
         fetchArchitectureTimeline: calmServiceMock.fetchArchitectureTimeline,
         fetchArchitectureSummaries: calmServiceMock.fetchArchitectureSummaries,
         fetchPatternSummaries: calmServiceMock.fetchPatternSummaries,
-    })),
+    }; }),
 }));
 
 const architectureData: Data & { calmType: 'Architectures' } = {

calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.test.tsx

@@ -11,7 +11,7 @@ vi.mock('react-router-dom', async () => {
     const actual = await vi.importActual('react-router-dom');
     return {
         ...actual,
-        useNavigate: vi.fn(() => mockNavigate),
+        useNavigate: vi.fn(function () { return mockNavigate; }),
     };
 });
 
@@ -24,11 +24,11 @@ const mockFetchFlowVersions = vi.fn();
 const mockFetchVersionsByCustomId = vi.fn();
 
 vi.mock('../../../service/calm-service.js', () => ({
-    CalmService: vi.fn().mockImplementation(() => ({
+    CalmService: vi.fn().mockImplementation(function () { return {
         fetchStandardVersions: mockFetchStandardVersions,
         fetchFlowVersions: mockFetchFlowVersions,
         fetchVersionsByCustomId: mockFetchVersionsByCustomId,
-    })),
+    }; }),
 }));
 
 describe('DocumentDetailSection', () => {

calm-hub-ui/src/hub/components/interface-detail-section/InterfaceDetailSection.test.tsx

@@ -22,10 +22,10 @@ const mockFetchInterfaceVersions = vi.fn();
 const mockFetchInterfaceForVersion = vi.fn();
 
 vi.mock('../../../service/interface-service.js', () => ({
-    InterfaceService: vi.fn().mockImplementation(() => ({
+    InterfaceService: vi.fn().mockImplementation(function () { return {
         fetchInterfaceVersions: (...args: unknown[]) => mockFetchInterfaceVersions(...args),
         fetchInterfaceForVersion: (...args: unknown[]) => mockFetchInterfaceForVersion(...args),
-    })),
+    }; }),
 }));
 
 // ── Test data ─────────────────────────────────────────────

calm-hub-ui/src/hub/components/tree-navigation/TreeNavigation.test.tsx

@@ -36,7 +36,7 @@ let calmServiceInstance: {
 } | undefined;
 
 vi.mock('../../../service/calm-service.js', () => ({
-    CalmService: vi.fn().mockImplementation(() => {
+    CalmService: vi.fn().mockImplementation(function () {
         calmServiceInstance = {
             fetchNamespaces: vi.fn().mockResolvedValue(['test-namespace', 'another-namespace']),
             fetchPatternSummaries: vi.fn().mockResolvedValue([]),
@@ -65,7 +65,7 @@ let controlServiceInstance: {
 } | undefined;
 
 vi.mock('../../../service/control-service.js', () => ({
-    ControlService: vi.fn().mockImplementation(() => {
+    ControlService: vi.fn().mockImplementation(function () {
         controlServiceInstance = {
             fetchDomains: vi.fn().mockResolvedValue(['test-domain']),
             fetchControlsForDomain: vi.fn().mockResolvedValue([]),
@@ -79,7 +79,7 @@ let interfaceServiceInstance: {
 } | undefined;
 
 vi.mock('../../../service/interface-service.js', () => ({
-    InterfaceService: vi.fn().mockImplementation(() => {
+    InterfaceService: vi.fn().mockImplementation(function () {
         interfaceServiceInstance = {
             fetchInterfacesForNamespace: vi.fn().mockResolvedValue([]),
         };
@@ -93,7 +93,7 @@ let adrServiceInstance: {
     fetchAdr: Mock;
 } | undefined;
 vi.mock('../../../service/adr-service/adr-service.js', () => ({
-    AdrService: vi.fn().mockImplementation(() => {
+    AdrService: vi.fn().mockImplementation(function () {
         adrServiceInstance = {
             fetchAdrSummaries: vi.fn().mockResolvedValue([{ id: 201, title: 'Use CALM', status: 'accepted' }, { id: 202, title: 'Use React', status: 'proposed' }]),
             fetchAdrRevisions: vi.fn().mockResolvedValue(['v1.0', 'v2.0']),
@@ -230,7 +230,7 @@ describe('TreeNavigation', () => {
     });
 
     it('loads data based on deeplink route - interface', async () => {
-        vi.mocked(InterfaceService).mockImplementation(() => {
+        vi.mocked(InterfaceService).mockImplementation(function () {
             interfaceServiceInstance = {
                 fetchInterfacesForNamespace: vi.fn().mockResolvedValue([
                     { id: 301, name: 'Test Interface', description: 'An interface' },
@@ -262,7 +262,7 @@ describe('TreeNavigation', () => {
     });
 
     it('loads data based on deeplink route - control', async () => {
-        vi.mocked(ControlService).mockImplementation(() => {
+        vi.mocked(ControlService).mockImplementation(function () {
             controlServiceInstance = {
                 fetchDomains: vi.fn().mockResolvedValue(['test-domain']),
                 fetchControlsForDomain: vi.fn().mockResolvedValue([
@@ -298,7 +298,7 @@ describe('TreeNavigation', () => {
         vi.mocked(useParams).mockReturnValue({});
         const navigate = vi.fn();
         vi.mocked(useNavigate).mockReturnValue(navigate);
-        vi.mocked(CalmService).mockImplementationOnce(() => ({
+        vi.mocked(CalmService).mockImplementationOnce(function () { return {
             fetchNamespaces: vi.fn().mockResolvedValue(['test-namespace']),
             fetchPatternSummaries: vi.fn().mockResolvedValue([]),
             fetchFlowSummaries: vi.fn().mockResolvedValue([]),
@@ -315,7 +315,7 @@ describe('TreeNavigation', () => {
             fetchMappings: vi.fn().mockResolvedValue([]),
             fetchVersionsByCustomId: vi.fn().mockResolvedValue([]),
             fetchResourceByCustomId: vi.fn().mockResolvedValue({}),
-        }) as unknown as InstanceType<typeof CalmService>);
+        }; } as unknown as InstanceType<typeof CalmService>);
 
         render(<MemoryRouter initialEntries={["/"]}>
             <TreeNavigation {...mockProps} />
@@ -381,7 +381,7 @@ describe('buildNamespaceTree', () => {
 
     it('renders hierarchical namespaces in the tree', async () => {
         vi.mocked(useParams).mockReturnValue({});
-        vi.mocked(CalmService).mockImplementationOnce(() => ({
+        vi.mocked(CalmService).mockImplementationOnce(function () { return {
             fetchNamespaces: vi.fn().mockResolvedValue(['org.finos', 'org.finos.calm', 'com.traderx']),
             fetchPatternSummaries: vi.fn().mockResolvedValue([]),
             fetchFlowSummaries: vi.fn().mockResolvedValue([]),
@@ -398,7 +398,7 @@ describe('buildNamespaceTree', () => {
             fetchMappings: vi.fn().mockResolvedValue([]),
             fetchVersionsByCustomId: vi.fn().mockResolvedValue([]),
             fetchResourceByCustomId: vi.fn().mockResolvedValue({})
-        }));
+        }; });
 
         render(
             <MemoryRouter initialEntries={['/']}>

calm-hub-ui/src/visualizer/components/drawer/Drawer.test.tsx

@@ -8,9 +8,9 @@ import { DropzoneOptions } from 'react-dropzone';
 const mockFetchDecoratorValues = vi.fn().mockResolvedValue([]);
 
 vi.mock('../../../service/calm-service.js', () => ({
-    CalmService: vi.fn().mockImplementation(() => ({
+    CalmService: vi.fn().mockImplementation(function () { return {
         fetchDecoratorValues: (...args: unknown[]) => mockFetchDecoratorValues(...args),
-    })),
+    }; }),
 }));
 
 vi.mock('../reactflow/MetadataPanel.js', () => ({

calm-models/package.json

@@ -4,20 +4,24 @@
   "description": "CALM (Common Architecture Language Model) type definitions and model classes",
   "exports": {
     "./model": {
+      "types": "./dist/model/index.d.ts",
       "import": "./dist/model/index.js",
-      "types": "./dist/model/index.d.ts"
+      "default": "./dist/model/index.js"
     },
     "./types": {
+      "types": "./dist/types/index.d.ts",
       "import": "./dist/types/index.js",
-      "types": "./dist/types/index.d.ts"
+      "default": "./dist/types/index.js"
     },
     "./canonical": {
+      "types": "./dist/canonical/template-models.d.ts",
       "import": "./dist/canonical/template-models.js",
-      "types": "./dist/canonical/template-models.d.ts"
+      "default": "./dist/canonical/template-models.js"
     },
     "./diff": {
+      "types": "./dist/diff/index.d.ts",
       "import": "./dist/diff/index.js",
-      "types": "./dist/diff/index.d.ts"
+      "default": "./dist/diff/index.js"
     }
   },
   "files": [

calm-models/src/canonical/template-models.spec.ts

@@ -0,0 +1,150 @@
+import { describe, it, expect } from 'vitest';
+import {
+    isInteracts,
+    isConnects,
+    isComposedOf,
+    isDeployedIn,
+    isOptions,
+    visitRelationship,
+    toKindView,
+    CalmRelationshipTypeCanonicalModel,
+} from './template-models';
+
+const interacts: CalmRelationshipTypeCanonicalModel = {
+    interacts: { actor: 'user', nodes: ['svc-a'] },
+};
+const connects: CalmRelationshipTypeCanonicalModel = {
+    connects: {
+        source: { node: 'svc-a' },
+        destination: { node: 'svc-b' },
+    },
+};
+const composedOf: CalmRelationshipTypeCanonicalModel = {
+    'composed-of': { container: 'svc-c', nodes: ['svc-a', 'svc-b'] },
+};
+const deployedIn: CalmRelationshipTypeCanonicalModel = {
+    'deployed-in': { container: 'cluster-1', nodes: ['svc-a'] },
+};
+const options: CalmRelationshipTypeCanonicalModel = {
+    options: [{ description: 'opt-1', nodes: ['svc-a'] }],
+};
+
+describe('relationship type guards', () => {
+    it('isInteracts narrows interacts and rejects others', () => {
+        expect(isInteracts(interacts)).toBe(true);
+        expect(isInteracts(connects)).toBe(false);
+    });
+
+    it('isConnects narrows connects and rejects others', () => {
+        expect(isConnects(connects)).toBe(true);
+        expect(isConnects(interacts)).toBe(false);
+    });
+
+    it('isComposedOf narrows composed-of and rejects others', () => {
+        expect(isComposedOf(composedOf)).toBe(true);
+        expect(isComposedOf(connects)).toBe(false);
+    });
+
+    it('isDeployedIn narrows deployed-in and rejects others', () => {
+        expect(isDeployedIn(deployedIn)).toBe(true);
+        expect(isDeployedIn(connects)).toBe(false);
+    });
+
+    it('isOptions narrows options and rejects others', () => {
+        expect(isOptions(options)).toBe(true);
+        expect(isOptions(connects)).toBe(false);
+    });
+});
+
+describe('visitRelationship', () => {
+    it('dispatches to interacts handler', () => {
+        const out = visitRelationship<string>(interacts, {
+            interacts: (r) => `i:${r.interacts.actor}`,
+            default: () => 'default',
+        });
+        expect(out).toBe('i:user');
+    });
+
+    it('dispatches to connects handler', () => {
+        const out = visitRelationship<string>(connects, {
+            connects: (r) => `c:${r.connects.source.node}->${r.connects.destination.node}`,
+            default: () => 'default',
+        });
+        expect(out).toBe('c:svc-a->svc-b');
+    });
+
+    it('dispatches to composedOf handler', () => {
+        const out = visitRelationship<string>(composedOf, {
+            composedOf: (r) => `co:${r['composed-of'].container}`,
+            default: () => 'default',
+        });
+        expect(out).toBe('co:svc-c');
+    });
+
+    it('dispatches to deployedIn handler', () => {
+        const out = visitRelationship<string>(deployedIn, {
+            deployedIn: (r) => `d:${r['deployed-in'].container}`,
+            default: () => 'default',
+        });
+        expect(out).toBe('d:cluster-1');
+    });
+
+    it('dispatches to options handler', () => {
+        const out = visitRelationship<string>(options, {
+            options: (r) => `o:${r.options.length}`,
+            default: () => 'default',
+        });
+        expect(out).toBe('o:1');
+    });
+
+    it('falls through to default when no matching handler is provided', () => {
+        const out = visitRelationship<string>(interacts, { default: () => 'fallback' });
+        expect(out).toBe('fallback');
+    });
+});
+
+describe('toKindView', () => {
+    it('maps interacts to kind view', () => {
+        expect(toKindView(interacts)).toEqual({
+            kind: 'interacts',
+            actor: 'user',
+            nodes: ['svc-a'],
+        });
+    });
+
+    it('maps connects to kind view', () => {
+        expect(toKindView(connects)).toEqual({
+            kind: 'connects',
+            source: { node: 'svc-a' },
+            destination: { node: 'svc-b' },
+        });
+    });
+
+    it('maps composed-of to kind view', () => {
+        expect(toKindView(composedOf)).toEqual({
+            kind: 'composed-of',
+            container: 'svc-c',
+            nodes: ['svc-a', 'svc-b'],
+        });
+    });
+
+    it('maps deployed-in to kind view', () => {
+        expect(toKindView(deployedIn)).toEqual({
+            kind: 'deployed-in',
+            container: 'cluster-1',
+            nodes: ['svc-a'],
+        });
+    });
+
+    it('maps options to kind view', () => {
+        expect(toKindView(options)).toEqual({
+            kind: 'options',
+            options: [{ description: 'opt-1', nodes: ['svc-a'] }],
+        });
+    });
+
+    it('throws on an unrecognised relationship type', () => {
+        const bogus = {} as CalmRelationshipTypeCanonicalModel;
+        expect(() => toKindView(bogus)).toThrow('Unknown relationship type');
+    });
+});