a hardcoded installation id stops matching reality

"""Find configured GitHub App installation ids that no longer mean what they did.

Read only. One paginated GET over the App's own installations with the App JWT,
and one optional GET per configured account. Nothing is minted or changed. The
endpoint that mints an installation access token is a write, so this script does
not call it and never reproduces the 404 that usually starts the investigation.

Installation ids are not stable. Uninstalling and reinstalling an App creates a
new installation with a new id, so an id copied out of a URL once either stops
resolving or, if it was transposed or reused, resolves against an account that
is not the one your configuration believes.

Environment:

    GITHUB_APP_JWT           the JWT your own signing code produced
    GITHUB_INSTALLATION_MAP  account=id pairs, comma separated, or a JSON object
    GITHUB_MAP_RECORDED_AT   optional ISO date the map was last written
"""
import argparse
import json
import logging
import os
import sys
from datetime import datetime, timezone

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("github_installation_id_drift")

API = "https://api.github.com"
UA = "github-installation-id-drift/1.0"

# The one finding that never announces itself. A stale id 404s on the next call;
# a crossed id succeeds forever against the wrong organization, so it is ordered
# first in every report this script prints.
SILENT = ("crossed",)


def parse_map(text):
    """account=id pairs, or a JSON object, into a plain dict. Pure.

    Accepts both because this value lives in an environment variable in some
    deployments and in a config file in others, and a checker that only reads
    one of the two shapes gets skipped in half of them.
    """
    raw = str(text or "").strip()
    if not raw:
        return {}
    if raw.startswith("{"):
        try:
            loaded = json.loads(raw)
        except ValueError:
            return {}
        return {str(k).strip().lower(): str(v).strip()
                for k, v in loaded.items() if str(k).strip()}
    out = {}
    for chunk in raw.replace(";", ",").split(","):
        if "=" not in chunk:
            continue
        account, _, ident = chunk.partition("=")
        account, ident = account.strip().lower(), ident.strip()
        if account and ident:
            out[account] = ident
    return out


def account_of(inst):
    """The login of the account an installation sits on. Pure."""
    if not isinstance(inst, dict):
        return None
    account = inst.get("account")
    if isinstance(account, dict) and account.get("login"):
        return str(account["login"])
    return None


def stable_key(inst):
    """The value worth keying stored state on. Pure.

    The login rather than the installation id, lowercased so the same account
    written two ways is one key. This is the whole recommendation of the note,
    expressed as a function so it can be tested rather than only asserted.
    """
    login = account_of(inst)
    return login.lower() if login else None


def index_by_id(installations):
    """Installations by their id, as text. Pure."""
    out = {}
    for inst in installations or []:
        if isinstance(inst, dict) and inst.get("id") is not None:
            out[str(inst["id"]).strip()] = inst
    return out


def index_by_account(installations):
    """Installations by lowercased account login. Pure."""
    out = {}
    for inst in installations or []:
        key = stable_key(inst)
        if key:
            out[key] = inst
    return out


def current_id_for(account, by_account):
    """The id this account's installation has right now, or None. Pure."""
    inst = (by_account or {}).get(str(account or "").strip().lower())
    return str(inst["id"]) if isinstance(inst, dict) and inst.get("id") is not None else None


def parse_moment(text):
    """An ISO 8601 timestamp as an aware datetime, or None. Pure."""
    raw = str(text or "").strip()
    if not raw:
        return None
    if raw.endswith("Z"):
        raw = raw[:-1] + "+00:00"
    try:
        when = datetime.fromisoformat(raw)
    except ValueError:
        return None
    return when if when.tzinfo else when.replace(tzinfo=timezone.utc)


def reinstalled_since(inst, recorded_at):
    """Whether this installation was created after the map was written. Pure.

    None when either date is unreadable, which is a third answer rather than a
    False: not knowing is not the same as knowing nothing happened.
    """
    created = parse_moment((inst or {}).get("created_at") if isinstance(inst, dict) else None)
    recorded = parse_moment(recorded_at)
    if created is None or recorded is None:
        return None
    return created > recorded


def drift(account, configured_id, by_id, by_account, recorded_at=None):
    """Compare one configured pair against reality. Pure."""
    account = str(account or "").strip()
    wanted = str(configured_id or "").strip()
    listed = (by_id or {}).get(wanted)
    current = current_id_for(account, by_account)

    if listed is not None:
        owner = account_of(listed) or ""
        if owner.lower() != account.lower():
            return ("crossed",
                    "%s is configured as %s, which exists and belongs to %s. "
                    "Nothing about this fails: it works against the wrong "
                    "account." % (account, wanted, owner or "another account"))
        fresh = reinstalled_since(listed, recorded_at)
        if fresh:
            return ("current-but-reinstalled",
                    "%s still resolves to %s, and that installation was created "
                    "after the map was written, so the App was removed and "
                    "re-added at some point." % (account, wanted))
        return ("current", "%s resolves to %s." % (account, wanted))

    if current is not None:
        created = (by_account.get(account.lower()) or {}).get("created_at")
        return ("stale",
                "%s is configured as %s, which this App no longer has. The "
                "current installation for %s is %s%s."
                % (account, wanted, account, current,
                   ", created %s" % created if created else ""))
    return ("gone",
            "%s is configured as %s and this App has no installation on that "
            "account at all. It was uninstalled and not put back."
            % (account, wanted))


def unmapped(by_account, configured):
    """Accounts the App is installed on that the configuration omits. Pure."""
    known = {str(k).strip().lower() for k in (configured or {})}
    return sorted(k for k in (by_account or {}) if k not in known)


def summarize(findings):
    """Counts by state, with the silent finding pulled out. Pure."""
    counts = {}
    for f in findings or []:
        counts[f["state"]] = counts.get(f["state"], 0) + 1
    return {"total": len(findings or []), "by_state": counts,
            "silent": sum(counts.get(s, 0) for s in SILENT)}


def repair(state, account=None, current=None):
    """The sentence a reader has to act on. Pure."""
    if state == "crossed":
        return ("stop the deploy. The id filed under %s belongs to another "
                "account, so every call made with it lands on the wrong "
                "organization and nothing will ever error. Fix the mapping, "
                "then resolve the id at runtime so it cannot drift again."
                % (account or "this account"))
    if state == "stale":
        return ("resolve the id per account from the org's own installation "
                "route rather than storing it. The current id is %s today and "
                "will be a different one after the next reinstall."
                % (current or "on the list above"))
    if state == "gone":
        return ("the App is not installed on %s. This is not an id problem: "
                "somebody has to install it again, and your code should key "
                "state on the account login so the history survives."
                % (account or "that account"))
    if state == "current-but-reinstalled":
        return ("nothing is broken, but the id changed hands once already. "
                "Move the lookup into the code before it changes again.")
    return "nothing. This account resolves correctly."


def get(session, path):
    """One GET. Returns (status, json-or-None)."""
    url = API + path if path.startswith("/") else path
    r = session.get(url, timeout=30)
    try:
        body = r.json()
    except ValueError:
        body = None
    return r.status_code, body


def list_installations(session, pages=10):
    """Every installation this App currently has. Read only."""
    out = []
    for page in range(1, pages + 1):
        status, body = get(session, "/app/installations?per_page=100&page=%d" % page)
        if status != 200 or not isinstance(body, list):
            if page == 1:
                log.error("GET /app/installations returned %d; this endpoint "
                          "wants the App's JWT", status)
            break
        out.extend(body)
        if len(body) < 100:
            break
    return out


def confirm_account(session, account):
    """The current installation for one organization, straight from the API."""
    status, body = get(session, "/orgs/%s/installation" % account)
    if status != 200 or not isinstance(body, dict):
        return None
    return str(body.get("id")) if body.get("id") is not None else None


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--map", default=os.environ.get("GITHUB_INSTALLATION_MAP", ""),
                    help="account=id pairs, comma separated, or a JSON object")
    ap.add_argument("--recorded-at", default=os.environ.get("GITHUB_MAP_RECORDED_AT"),
                    help="ISO date the map was last written, to spot reinstalls")
    ap.add_argument("--confirm", action="store_true",
                    help="also resolve each account's current id directly")
    args = ap.parse_args()

    jwt = os.environ.get("GITHUB_APP_JWT")
    if not jwt:
        log.error("set GITHUB_APP_JWT. The installation list is read with the "
                  "App's JWT, not with a token minted from an installation")
        return 2

    configured = parse_map(args.map)
    if not configured:
        log.error("no account=id pairs to check; pass --map or set "
                  "GITHUB_INSTALLATION_MAP")
        return 2

    session = requests.Session()
    session.headers.update({
        "Authorization": "Bearer " + jwt,
        "Accept": "application/vnd.github+json",
        "X-GitHub-Api-Version": "2022-11-28",
        "User-Agent": UA,
    })

    installations = list_installations(session)
    log.info("%d installation(s) visible to this App", len(installations))
    by_id = index_by_id(installations)
    by_account = index_by_account(installations)

    findings = []
    for account, ident in sorted(configured.items()):
        state, detail = drift(account, ident, by_id, by_account, args.recorded_at)
        row = {"account": account, "configured_id": ident, "state": state,
               "detail": detail, "current_id": current_id_for(account, by_account)}
        if args.confirm:
            row["confirmed_id"] = confirm_account(session, account)
        findings.append(row)

    findings.sort(key=lambda f: (f["state"] not in SILENT, f["account"]))
    for f in findings:
        if f["state"] != "current":
            log.info("%s: %s", f["state"], f["detail"])
            log.info("repair: %s", repair(f["state"], f["account"], f["current_id"]))

    extra = unmapped(by_account, configured)
    if extra:
        log.info("also installed and not in the map: %s", ", ".join(extra))

    stats = summarize(findings)
    print(json.dumps({"visible": len(installations), "summary": stats,
                      "unmapped_accounts": extra, "findings": findings},
                     indent=2, default=str))
    return 1 if stats["by_state"].get("current", 0) != stats["total"] else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Find configured GitHub App installation ids that no longer mean what they did.
 *
 * Read only. One paginated GET over the App's own installations with the App
 * JWT, and one optional GET per configured account. The endpoint that mints an
 * installation access token is a write and is not called here.
 *
 * Environment:
 *   GITHUB_APP_JWT           the JWT your own signing code produced
 *   GITHUB_INSTALLATION_MAP  account=id pairs, comma separated, or a JSON object
 *   GITHUB_MAP_RECORDED_AT   optional ISO date the map was last written
 */
const API = 'https://api.github.com';
const UA = 'github-installation-id-drift/1.0';

/** The finding that never announces itself. */
export const SILENT = ['crossed'];

/** account=id pairs, or a JSON object, into a plain object. Pure. */
export function parseMap(text) {
  const raw = String(text ?? '').trim();
  if (!raw) return {};
  if (raw.startsWith('{')) {
    let loaded;
    try { loaded = JSON.parse(raw); } catch { return {}; }
    const out = {};
    for (const [k, v] of Object.entries(loaded || {})) {
      const key = String(k).trim().toLowerCase();
      if (key) out[key] = String(v).trim();
    }
    return out;
  }
  const out = {};
  for (const chunk of raw.replace(/;/g, ',').split(',')) {
    const at = chunk.indexOf('=');
    if (at < 0) continue;
    const account = chunk.slice(0, at).trim().toLowerCase();
    const ident = chunk.slice(at + 1).trim();
    if (account && ident) out[account] = ident;
  }
  return out;
}

/** The login of the account an installation sits on. Pure. */
export function accountOf(inst) {
  if (!inst || typeof inst !== 'object') return null;
  const account = inst.account;
  if (account && typeof account === 'object' && account.login) return String(account.login);
  return null;
}

/** The value worth keying stored state on. Pure. */
export function stableKey(inst) {
  const login = accountOf(inst);
  return login ? login.toLowerCase() : null;
}

/** Installations by their id, as text. Pure. */
export function indexById(installations) {
  const out = {};
  for (const inst of installations || []) {
    if (inst && typeof inst === 'object' && inst.id !== null && inst.id !== undefined) {
      out[String(inst.id).trim()] = inst;
    }
  }
  return out;
}

/** Installations by lowercased account login. Pure. */
export function indexByAccount(installations) {
  const out = {};
  for (const inst of installations || []) {
    const key = stableKey(inst);
    if (key) out[key] = inst;
  }
  return out;
}

/** The id this account's installation has right now, or null. Pure. */
export function currentIdFor(account, byAccount) {
  const inst = (byAccount || {})[String(account ?? '').trim().toLowerCase()];
  if (!inst || typeof inst !== 'object') return null;
  return inst.id === null || inst.id === undefined ? null : String(inst.id);
}

/** An ISO 8601 timestamp as epoch milliseconds, or null. Pure. */
export function parseMoment(text) {
  const raw = String(text ?? '').trim();
  if (!raw) return null;
  const ms = Date.parse(raw);
  return Number.isNaN(ms) ? null : ms;
}

/** Whether this installation was created after the map was written. Pure. */
export function reinstalledSince(inst, recordedAt) {
  const created = parseMoment(inst && typeof inst === 'object' ? inst.created_at : null);
  const recorded = parseMoment(recordedAt);
  if (created === null || recorded === null) return null;
  return created > recorded;
}

/** Compare one configured pair against reality. Pure. */
export function drift(account, configuredId, byId, byAccount, recordedAt = null) {
  const name = String(account ?? '').trim();
  const wanted = String(configuredId ?? '').trim();
  const listed = (byId || {})[wanted];
  const current = currentIdFor(name, byAccount);

  if (listed !== undefined && listed !== null) {
    const owner = accountOf(listed) || '';
    if (owner.toLowerCase() !== name.toLowerCase()) {
      return ['crossed',
        `${name} is configured as ${wanted}, which exists and belongs to `
        + `${owner || 'another account'}. Nothing about this fails: it works `
        + 'against the wrong account.'];
    }
    if (reinstalledSince(listed, recordedAt)) {
      return ['current-but-reinstalled',
        `${name} still resolves to ${wanted}, and that installation was created `
        + 'after the map was written, so the App was removed and re-added at '
        + 'some point.'];
    }
    return ['current', `${name} resolves to ${wanted}.`];
  }

  if (current !== null) {
    const created = ((byAccount || {})[name.toLowerCase()] || {}).created_at;
    return ['stale',
      `${name} is configured as ${wanted}, which this App no longer has. The `
      + `current installation for ${name} is ${current}`
      + `${created ? `, created ${created}` : ''}.`];
  }
  return ['gone',
    `${name} is configured as ${wanted} and this App has no installation on `
    + 'that account at all. It was uninstalled and not put back.'];
}

/** Accounts the App is installed on that the configuration omits. Pure. */
export function unmapped(byAccount, configured) {
  const known = new Set(Object.keys(configured || {}).map((k) => String(k).trim().toLowerCase()));
  return Object.keys(byAccount || {}).filter((k) => !known.has(k)).sort();
}

/** Counts by state, with the silent finding pulled out. Pure. */
export function summarize(findings) {
  const counts = {};
  for (const f of findings || []) counts[f.state] = (counts[f.state] || 0) + 1;
  return {
    total: (findings || []).length,
    by_state: counts,
    silent: SILENT.reduce((n, s) => n + (counts[s] || 0), 0),
  };
}

/** The sentence a reader has to act on. Pure. */
export function repair(state, account = null, current = null) {
  if (state === 'crossed') {
    return `stop the deploy. The id filed under ${account || 'this account'} `
      + 'belongs to another account, so every call made with it lands on the '
      + 'wrong organization and nothing will ever error. Fix the mapping, then '
      + 'resolve the id at runtime so it cannot drift again.';
  }
  if (state === 'stale') {
    return 'resolve the id per account from the org\'s own installation route '
      + `rather than storing it. The current id is ${current || 'on the list above'} `
      + 'today and will be a different one after the next reinstall.';
  }
  if (state === 'gone') {
    return `the App is not installed on ${account || 'that account'}. This is `
      + 'not an id problem: somebody has to install it again, and your code '
      + 'should key state on the account login so the history survives.';
  }
  if (state === 'current-but-reinstalled') {
    return 'nothing is broken, but the id changed hands once already. Move the '
      + 'lookup into the code before it changes again.';
  }
  return 'nothing. This account resolves correctly.';
}

function headers(jwt) {
  return {
    Authorization: `Bearer ${jwt}`,
    Accept: 'application/vnd.github+json',
    'X-GitHub-Api-Version': '2022-11-28',
    'User-Agent': UA,
  };
}

async function get(jwt, path) {
  const res = await fetch(API + path, { headers: headers(jwt) });
  let body = null;
  try { body = await res.json(); } catch { body = null; }
  return { status: res.status, body };
}

async function main() {
  const jwt = process.env.GITHUB_APP_JWT;
  if (!jwt) {
    console.error('set GITHUB_APP_JWT; the installation list wants the App JWT');
    process.exitCode = 2;
    return;
  }
  const configured = parseMap(process.env.GITHUB_INSTALLATION_MAP || '');
  if (!Object.keys(configured).length) {
    console.error('set GITHUB_INSTALLATION_MAP to account=id pairs');
    process.exitCode = 2;
    return;
  }
  const recordedAt = process.env.GITHUB_MAP_RECORDED_AT || null;

  const installations = [];
  for (let page = 1; page <= 10; page += 1) {
    const { status, body } = await get(jwt, `/app/installations?per_page=100&page=${page}`);
    if (status !== 200 || !Array.isArray(body)) {
      if (page === 1) console.error(`GET /app/installations returned ${status}`);
      break;
    }
    installations.push(...body);
    if (body.length < 100) break;
  }
  console.log(`${installations.length} installation(s) visible to this App`);

  const byId = indexById(installations);
  const byAccount = indexByAccount(installations);
  const findings = Object.entries(configured).sort().map(([account, ident]) => {
    const [state, detail] = drift(account, ident, byId, byAccount, recordedAt);
    return {
      account, configured_id: ident, state, detail,
      current_id: currentIdFor(account, byAccount),
    };
  });
  findings.sort((a, b) => (SILENT.includes(b.state) ? 1 : 0) - (SILENT.includes(a.state) ? 1 : 0)
    || a.account.localeCompare(b.account));

  for (const f of findings) {
    if (f.state !== 'current') {
      console.log(`${f.state}: ${f.detail}`);
      console.log(`repair: ${repair(f.state, f.account, f.current_id)}`);
    }
  }
  const extra = unmapped(byAccount, configured);
  if (extra.length) console.log(`also installed and not in the map: ${extra.join(', ')}`);

  const stats = summarize(findings);
  console.log(JSON.stringify({
    visible: installations.length, summary: stats, unmapped_accounts: extra, findings,
  }, null, 2));
  process.exitCode = (stats.by_state.current || 0) === stats.total ? 0 : 1;
}

// Guarded so importing this file from the test runner does not start a run.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from github_installation_id_drift import (
    account_of, current_id_for, drift, index_by_account, index_by_id, parse_map,
    reinstalled_since, repair, stable_key, summarize, unmapped,
)

ACME = {"id": 55120044, "account": {"login": "acme-corp"},
        "created_at": "2026-08-25T08:02:11Z"}
GAMMA = {"id": 41234568, "account": {"login": "gamma-labs"},
         "created_at": "2024-02-01T00:00:00Z"}
BY_ID = index_by_id([ACME, GAMMA])
BY_ACCOUNT = index_by_account([ACME, GAMMA])


def test_the_map_is_read_as_pairs_or_as_json():
    assert parse_map("acme-corp=41234567,beta-inc=41234568") == {
        "acme-corp": "41234567", "beta-inc": "41234568"}
    assert parse_map(' {"Acme-Corp": 41234567} ') == {"acme-corp": "41234567"}
    assert parse_map(" acme-corp = 41234567 ; beta-inc=9 ") == {
        "acme-corp": "41234567", "beta-inc": "9"}
    assert parse_map("") == {}
    assert parse_map("nonsense") == {}
    assert parse_map("{not json") == {}


def test_ids_are_indexed_as_text_however_they_arrived():
    assert BY_ID["55120044"] is ACME
    assert index_by_id([{"id": "77", "account": {"login": "x"}}])["77"]["id"] == "77"
    assert index_by_id([{"account": {"login": "x"}}]) == {}


def test_the_stable_key_is_the_login_not_the_id():
    assert stable_key(ACME) == "acme-corp"
    assert stable_key({"id": 5, "account": {"login": "Acme-Corp"}}) == "acme-corp"
    assert stable_key({"id": 5}) is None
    assert account_of(None) is None


def test_an_id_that_belongs_to_another_account_is_its_own_finding():
    state, detail = drift("beta-inc", 41234568, BY_ID, BY_ACCOUNT)
    assert state == "crossed"
    assert "gamma-labs" in detail
    assert "wrong account" in detail
    assert "stop the deploy" in repair(state, "beta-inc")


def test_a_missing_id_on_a_live_account_names_the_current_one():
    state, detail = drift("acme-corp", 41234567, BY_ID, BY_ACCOUNT)
    assert state == "stale"
    assert "55120044" in detail
    assert current_id_for("ACME-CORP", BY_ACCOUNT) == "55120044"


def test_a_missing_id_on_a_missing_account_is_not_a_stale_id():
    state, detail = drift("delta-ltd", 999, BY_ID, BY_ACCOUNT)
    assert state == "gone"
    assert "no installation on that account" in detail


def test_a_matching_id_is_current_whether_it_was_stored_as_text():
    assert drift("acme-corp", "55120044", BY_ID, BY_ACCOUNT)[0] == "current"
    assert drift("Acme-Corp", 55120044, BY_ID, BY_ACCOUNT)[0] == "current"


def test_a_reinstall_after_the_map_was_written_is_flagged_even_when_it_matches():
    state, detail = drift("acme-corp", 55120044, BY_ID, BY_ACCOUNT,
                          recorded_at="2026-01-01T00:00:00Z")
    assert state == "current-but-reinstalled"
    assert "removed and re-added" in detail


def test_an_unreadable_date_is_a_third_answer_and_not_a_no():
    assert reinstalled_since(ACME, "2026-01-01T00:00:00Z") is True
    assert reinstalled_since(ACME, "2026-12-01T00:00:00Z") is False
    assert reinstalled_since(ACME, None) is None
    assert reinstalled_since({}, "2026-01-01T00:00:00Z") is None


def test_installations_the_map_never_mentions_are_listed_separately():
    assert unmapped(BY_ACCOUNT, {"acme-corp": "1"}) == ["gamma-labs"]
    assert unmapped(BY_ACCOUNT, {"ACME-CORP": "1", "gamma-labs": "2"}) == []


def test_the_summary_counts_the_silent_finding_apart():
    stats = summarize([{"state": "crossed"}, {"state": "stale"}, {"state": "current"}])
    assert stats["total"] == 3
    assert stats["silent"] == 1
    assert stats["by_state"]["stale"] == 1

import { test } from 'node:test';
import assert from 'node:assert/strict';
import {
  accountOf, currentIdFor, drift, indexByAccount, indexById, parseMap,
  reinstalledSince, repair, stableKey, summarize, unmapped,
} from './github-installation-id-drift.mjs';

const ACME = {
  id: 55120044, account: { login: 'acme-corp' }, created_at: '2026-08-25T08:02:11Z',
};
const GAMMA = {
  id: 41234568, account: { login: 'gamma-labs' }, created_at: '2024-02-01T00:00:00Z',
};
const BY_ID = indexById([ACME, GAMMA]);
const BY_ACCOUNT = indexByAccount([ACME, GAMMA]);

test('the map is read as pairs or as JSON', () => {
  assert.deepEqual(parseMap('acme-corp=41234567,beta-inc=41234568'),
    { 'acme-corp': '41234567', 'beta-inc': '41234568' });
  assert.deepEqual(parseMap(' {"Acme-Corp": 41234567} '), { 'acme-corp': '41234567' });
  assert.deepEqual(parseMap(' acme-corp = 41234567 ; beta-inc=9 '),
    { 'acme-corp': '41234567', 'beta-inc': '9' });
  assert.deepEqual(parseMap(''), {});
  assert.deepEqual(parseMap('nonsense'), {});
  assert.deepEqual(parseMap('{not json'), {});
});

test('ids are indexed as text however they arrived', () => {
  assert.equal(BY_ID['55120044'], ACME);
  assert.equal(indexById([{ id: '77', account: { login: 'x' } }])['77'].id, '77');
  assert.deepEqual(indexById([{ account: { login: 'x' } }]), {});
});

test('the stable key is the login not the id', () => {
  assert.equal(stableKey(ACME), 'acme-corp');
  assert.equal(stableKey({ id: 5, account: { login: 'Acme-Corp' } }), 'acme-corp');
  assert.equal(stableKey({ id: 5 }), null);
  assert.equal(accountOf(null), null);
});

test('an id that belongs to another account is its own finding', () => {
  const [state, detail] = drift('beta-inc', 41234568, BY_ID, BY_ACCOUNT);
  assert.equal(state, 'crossed');
  assert.match(detail, /gamma-labs/);
  assert.match(detail, /wrong account/);
  assert.match(repair(state, 'beta-inc'), /stop the deploy/);
});

test('a missing id on a live account names the current one', () => {
  const [state, detail] = drift('acme-corp', 41234567, BY_ID, BY_ACCOUNT);
  assert.equal(state, 'stale');
  assert.match(detail, /55120044/);
  assert.equal(currentIdFor('ACME-CORP', BY_ACCOUNT), '55120044');
});

test('a missing id on a missing account is not a stale id', () => {
  const [state, detail] = drift('delta-ltd', 999, BY_ID, BY_ACCOUNT);
  assert.equal(state, 'gone');
  assert.match(detail, /no installation on that account/);
});

test('a matching id is current whether it was stored as text', () => {
  assert.equal(drift('acme-corp', '55120044', BY_ID, BY_ACCOUNT)[0], 'current');
  assert.equal(drift('Acme-Corp', 55120044, BY_ID, BY_ACCOUNT)[0], 'current');
});

test('a reinstall after the map was written is flagged even when it matches', () => {
  const [state, detail] = drift('acme-corp', 55120044, BY_ID, BY_ACCOUNT,
    '2026-01-01T00:00:00Z');
  assert.equal(state, 'current-but-reinstalled');
  assert.match(detail, /removed and re-added/);
});

test('an unreadable date is a third answer and not a no', () => {
  assert.equal(reinstalledSince(ACME, '2026-01-01T00:00:00Z'), true);
  assert.equal(reinstalledSince(ACME, '2026-12-01T00:00:00Z'), false);
  assert.equal(reinstalledSince(ACME, null), null);
  assert.equal(reinstalledSince({}, '2026-01-01T00:00:00Z'), null);
});

test('installations the map never mentions are listed separately', () => {
  assert.deepEqual(unmapped(BY_ACCOUNT, { 'acme-corp': '1' }), ['gamma-labs']);
  assert.deepEqual(unmapped(BY_ACCOUNT, { 'ACME-CORP': '1', 'gamma-labs': '2' }), []);
});

test('the summary counts the silent finding apart', () => {
  const stats = summarize([{ state: 'crossed' }, { state: 'stale' }, { state: 'current' }]);
  assert.equal(stats.total, 3);
  assert.equal(stats.silent, 1);
  assert.equal(stats.by_state.stale, 1);
});