@7365admin1/core 3.80.0 → 3.82.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.80.0",
+  "version": "3.82.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/robot-cloud.util.ts src/utils/robot-tracking.util.ts src/utils/robot-apps.util.ts src/utils/robot-permission.util.ts src/utils/lift-contract.util.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/robot-scope.e2e.test.mjs

@@ -12,8 +12,9 @@
 // 1. THE LIST HANDS OUT CREDENTIALS. `robot.repo.ts` projects `appKey` and
 //    `appToken` into the response. Any signed-in account on the platform could
 //    name any organisation and site in the URL and read that estate's robot
-//    credentials. Case 0 shows the fields really are in the payload; cases 1, 2
-//    and 5 show they are now out of reach.
+//    credentials. Cases 1, 2 and 5 show the estate is now out of reach, and case
+//    0 shows the credentials are no longer in the payload AT ALL - not even for a
+//    caller standing at the robot's own estate.
 //
 // 2. THE WRITE COULD BE AIMED ANYWHERE. `metadata.siteId` came off the body, so a
 //    robot could be aimed at another client's estate (case 3), and it is
@@ -24,18 +25,17 @@
 //    the service looked the display name up from it. It now comes from the
 //    session.
 //
-// A STRAIGHT WORD ABOUT THE WRITE PATH, because the cases below are shaped by it:
-// `POST /api/robots` does not work today and did not before this change. The
-// service overwrites `value.createdBy` with `createdBy._id`, an `ObjectId`, and
-// `MRobot` then re-validates against `robotSchema`, where `createdBy` is
-// `Joi.string()`. Every create therefore ends in
-// `400 "createdBy" must be a string` and nothing is ever stored. That is a
-// pre-existing defect, reported on the PR and deliberately NOT fixed here.
+// A STRAIGHT WORD ABOUT THE WRITE PATH: `POST /api/robots` never worked. The
+// service overwrote `value.createdBy` with `createdBy._id`, an `ObjectId`, and
+// `MRobot` then re-validated against `robotSchema`, where `createdBy` is
+// `Joi.string()`. Every create ended in `400 "createdBy" must be a string` and
+// no robot was ever stored, by anybody, through either app. It is fixed here,
+// because the cleaning robot integration cannot begin without the ability to
+// register a robot.
 //
-// So for the write the guard is proved by WHICH refusal a caller gets: an
-// unauthorised caller is stopped by the guard (404, before the service), an
-// authorised one gets through the guard and falls over at the model (400). Cases
-// 3 and 6 are that pair. The spec does not pretend a robot is ever stored.
+// So the write is now proved BOTH ways: an unauthorised caller is stopped by the
+// guard (404, before the service), and an authorised one is stored (201). Cases
+// 3 and 6 are that pair.
 //
 // The fix is `requireSiteReach`, the rule `/api/attendances`, `/api/site-cameras`
 // and `/api/documents` already use, so the contracted agency still reaches its
@@ -66,6 +66,10 @@ const COLL = "robots";
 
 // What an authorised create fails with today: the pre-existing model defect,
 // reached only AFTER the guard has let the caller through.
+// The refusal every create used to end in, kept so case 3 can assert the guard
+// stopped the request BEFORE the model rather than at it. Creates now succeed:
+// the service handed `MRobot` an ObjectId where the schema wanted a string, so
+// no robot could ever be registered through either app.
 const MODEL_REFUSAL = '"createdBy" must be a string';
 
 describe("robots and their credentials are scoped to their estate", { concurrency: 1 }, () => {
@@ -127,20 +131,30 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
     assert.equal(list.status, 200);
     assert.equal(list.body?.items?.length, 1);
 
-    // This is what the leak was worth: the projection really does carry the
-    // robot's credentials. The fields are checked for PRESENCE only.
+    // The projection no longer carries the robot's credentials AT ALL - not even
+    // to a caller standing at the robot's own estate. The tenancy guard decided
+    // WHO could read them; this decides that nobody reads them over HTTP. The
+    // connector reads them server-side.
     const row = list.body.items[0];
-    assert.equal("appKey" in row, true);
-    assert.equal("appToken" in row, true);
-
-    // And the write route answers: past the guard, into the model.
+    assert.equal("appKey" in row, false);
+    assert.equal("appToken" in row, false);
+    // and the row is still a usable listing.
+    assert.equal(typeof row.name, "string");
+
+    // And the write route answers - and now SUCCEEDS. It never did before: the
+    // service handed `MRobot` an ObjectId where the schema wanted a string, so
+    // every create ended in `400 "createdBy" must be a string`.
     const create = await h.api("/robots", {
       method: "POST",
       sid: outsiderSid,
       body: newRobot(id.siteA, id.orgA, "rb-baseline"),
     });
-    assert.equal(create.status, 400);
-    assert.equal(create.body?.message, MODEL_REFUSAL);
+    assert.equal(create.status, 201);
+
+    // Stored against the SESSION's account, and defaulted to a cleaning robot.
+    const stored = await byName("rb-baseline");
+    assert.equal(String(stored.metadata.siteId), String(id.siteA));
+    assert.equal(stored.type, "cleaning");
   });
 
   // ---- refusals -----------------------------------------------------------
@@ -167,8 +181,9 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
       body: newRobot(id.siteB, id.orgB, "rb-planted"),
     });
 
-    // 404 from the guard, NOT the model's 400 - the request never reached the
-    // service. Case 6 is the same request from someone who may make it.
+    // 404 from the guard - the request never reached the service, so nothing was
+    // stored. Case 6 is the same request from someone who may make it, and it
+    // now succeeds, which is what makes this refusal meaningful.
     assert.equal(res.status, 404);
     assert.notEqual(res.body?.message, MODEL_REFUSAL);
     assert.equal(await countAtSite(id.siteB), before);
@@ -195,21 +210,28 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
 
   // ---- still works: the people who are supposed to reach it ---------------
 
-  record("6. an authorised create still gets PAST the guard (and dies at the model)", async () => {
+  record("6. an authorised create gets past the guard AND is stored", async () => {
     const res = await h.api("/robots", {
       method: "POST",
       sid: managerSid,
       body: newRobot(id.siteB, id.orgB, "rb-allowed"),
     });
 
-    assert.equal(res.status, 400);
-    assert.equal(res.body?.message, MODEL_REFUSAL);
+    assert.equal(res.status, 201);
+    const stored = await byName("rb-allowed");
+    assert.equal(String(stored.metadata.siteId), String(id.siteB));
   });
 
   record("7. the site B client still LISTS site B", async () => {
     const res = await h.api(listUrl(id.orgB, id.siteB), { sid: managerSid });
     assert.equal(res.status, 200);
-    assert.equal(res.body?.items?.length, 1);
+
+    // A count, not an exact one: case 6 now genuinely stores a robot at site B,
+    // so pinning this to 1 would only be asserting the order the cases run in.
+    // What matters is that site B's own robots are here and site A's are not.
+    const names = (res.body?.items ?? []).map((r) => r.name);
+    assert.ok(names.length >= 1);
+    assert.equal(names.includes("rb-baseline"), false, "site A's robot");
   });
 
   record("8. the contracted agency still LISTS its client's site (customer.sites branch)", async () => {
@@ -217,18 +239,21 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
     // ACTIVE `customer.sites` engagement.
     const res = await h.api(listUrl(id.orgB, id.siteB), { sid: cleanerSid });
     assert.equal(res.status, 200);
-    assert.equal(res.body?.items?.length, 1);
+
+    const names = (res.body?.items ?? []).map((r) => r.name);
+    assert.ok(names.length >= 1);
+    assert.equal(names.includes("rb-baseline"), false, "site A's robot");
   });
 
-  record("9. the contracted agency's create still gets past the guard too", async () => {
+  record("9. the contracted agency's create gets past the guard too", async () => {
     const res = await h.api("/robots", {
       method: "POST",
       sid: cleanerSid,
       body: newRobot(id.siteB, id.orgB, "rb-agency"),
     });
 
-    assert.equal(res.status, 400);
-    assert.equal(res.body?.message, MODEL_REFUSAL);
+    assert.equal(res.status, 201);
+    assert.notEqual(await byName("rb-agency"), null);
   });
 
   record("10. Seven365 platform staff still reach any estate on both routes", async () => {
@@ -240,8 +265,7 @@ describe("robots and their credentials are scoped to their estate", { concurrenc
       sid: staffSid,
       body: newRobot(id.siteA, id.orgA, "rb-staff"),
     });
-    assert.equal(create.status, 400);
-    assert.equal(create.body?.message, MODEL_REFUSAL);
+    assert.equal(create.status, 201);
   });
 
   // ---- the refusal leaks nothing ------------------------------------------

package/test/lift-contract.test.mjs

@@ -0,0 +1,271 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  LIFT_DOOR,
+  LIFT_MODE,
+  LIFT_MOTION,
+  LIFT_REQUEST,
+  createLiftSimulator,
+  holdsLift,
+  isLiftAvailable,
+  isSafeToCross,
+  servesFloor,
+} from "./.build/utils/lift-contract.util.mjs";
+
+/* --------------------------------------------------------------------------
+ * The lift is the one part of this system that can injure somebody, and the
+ * Inovance register map has not arrived, so every decision here is made against
+ * a simulator rather than a real car. These assert the decisions that would
+ * otherwise only be discovered on a live lift.
+ *
+ * Enum values match rmf_lift_msgs verbatim (open-rmf/rmf_internal_msgs).
+ * ----------------------------------------------------------------------- */
+
+const FLOORS = ["L1", "L2", "L3", "L4"];
+const sim = (o = {}) => createLiftSimulator({ name: "LIFT-A", floors: FLOORS, ...o });
+
+const stateWith = (over = {}) => ({
+  liftName: "LIFT-A",
+  liftTime: 0,
+  availableFloors: [...FLOORS],
+  currentFloor: "L1",
+  destinationFloor: "L1",
+  doorState: LIFT_DOOR.OPEN,
+  motionState: LIFT_MOTION.STOPPED,
+  currentMode: LIFT_MODE.HUMAN,
+  sessionId: "",
+  ...over,
+});
+
+/* ------------------------------------------------- the enums match RMF */
+
+test("the enum values are rmf_lift_msgs values, not our own numbering", () => {
+  assert.deepEqual(LIFT_DOOR, { CLOSED: 0, MOVING: 1, OPEN: 2 });
+  assert.deepEqual(LIFT_MOTION, { STOPPED: 0, UP: 1, DOWN: 2, UNKNOWN: 3 });
+  assert.deepEqual(LIFT_MODE, {
+    UNKNOWN: 0, HUMAN: 1, AGV: 2, FIRE: 3, OFFLINE: 4, EMERGENCY: 5,
+  });
+  assert.deepEqual(LIFT_REQUEST, { END_SESSION: 0, AGV_MODE: 1, HUMAN_MODE: 2 });
+});
+
+/* ------------------------------------------------------------ availability */
+
+test("a lift in FIRE or EMERGENCY mode is never available", () => {
+  // During an evacuation the lift belongs to the fire service. A robot must not
+  // be queued for it, whatever else is true.
+  for (const mode of [LIFT_MODE.FIRE, LIFT_MODE.EMERGENCY, LIFT_MODE.OFFLINE, LIFT_MODE.UNKNOWN]) {
+    const s = stateWith({ currentMode: mode });
+    assert.equal(isLiftAvailable(s), false, `mode ${mode}`);
+    assert.equal(isSafeToCross(s, "L1"), false, `mode ${mode}`);
+  }
+});
+
+test("a lift that has never reported is not available", () => {
+  assert.equal(isLiftAvailable(null), false);
+  assert.equal(isSafeToCross(null, "L1"), false);
+  assert.equal(servesFloor(null, "L1"), false);
+});
+
+/* -------------------------------------------------------- crossing the door */
+
+test("a MOVING door is not an open door", () => {
+  // The branch that matters most: telling a robot to cross a closing door plane
+  // is how a robot gets struck.
+  assert.equal(isSafeToCross(stateWith({ doorState: LIFT_DOOR.MOVING }), "L1"), false);
+  assert.equal(isSafeToCross(stateWith({ doorState: LIFT_DOOR.CLOSED }), "L1"), false);
+  assert.equal(isSafeToCross(stateWith({ doorState: LIFT_DOOR.OPEN }), "L1"), true);
+});
+
+test("a car still in motion is never safe to cross, doors notwithstanding", () => {
+  for (const motion of [LIFT_MOTION.UP, LIFT_MOTION.DOWN, LIFT_MOTION.UNKNOWN]) {
+    assert.equal(
+      isSafeToCross(stateWith({ motionState: motion, doorState: LIFT_DOOR.OPEN }), "L1"),
+      false,
+      `motion ${motion}`
+    );
+  }
+});
+
+test("a car at the WRONG floor is not safe to cross", () => {
+  // A passenger redirecting the car mid-journey is exactly this case.
+  assert.equal(isSafeToCross(stateWith({ currentFloor: "L3" }), "L1"), false);
+  assert.equal(isSafeToCross(stateWith({ currentFloor: "L3" }), "L3"), true);
+});
+
+/* ------------------------------------------------------------- the session */
+
+test("an empty session id never holds the lift", () => {
+  // Otherwise a caller that forgot to set one is handed a lift somebody is riding.
+  assert.equal(holdsLift(stateWith({ sessionId: "" }), ""), false);
+  assert.equal(holdsLift(stateWith({ sessionId: "j-1" }), ""), false);
+  assert.equal(holdsLift(stateWith({ sessionId: "" }), "j-1"), false);
+  assert.equal(holdsLift(stateWith({ sessionId: "j-1" }), "j-1"), true);
+});
+
+test("a floor the lift does not serve is not a destination", () => {
+  assert.equal(servesFloor(stateWith(), "L9"), false);
+  assert.equal(servesFloor(stateWith(), ""), false);
+  assert.equal(servesFloor(stateWith(), "L3"), true);
+});
+
+/* ------------------------------------------------------------- simulator */
+
+test("a requested lift travels, arrives, and opens its doors", async () => {
+  const lift = sim({ msPerFloor: 1_000 });
+
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L3",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  let s = await lift.read();
+  assert.equal(s.motionState, LIFT_MOTION.UP);
+  assert.equal(s.doorState, LIFT_DOOR.CLOSED, "doors shut while travelling");
+  assert.equal(isSafeToCross(s, "L3"), false);
+
+  lift.tick(2_000); // two floors
+  s = await lift.read();
+  assert.equal(s.currentFloor, "L3");
+  assert.equal(s.motionState, LIFT_MOTION.STOPPED);
+  assert.equal(s.doorState, LIFT_DOOR.OPEN);
+  assert.equal(isSafeToCross(s, "L3"), true);
+});
+
+test("the doors close themselves — this is why the hold must be refreshed", async () => {
+  // The tightest timing in the whole design: a passenger lift times its doors
+  // out while the robot is still crossing.
+  const lift = sim({ msPerFloor: 1_000, doorDwellMs: 4_000 });
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L1",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  assert.equal((await lift.read()).doorState, LIFT_DOOR.OPEN);
+  lift.tick(4_000);
+  assert.equal((await lift.read()).doorState, LIFT_DOOR.CLOSED, "closed on its own");
+});
+
+test("refreshing the hold keeps the doors open", async () => {
+  const lift = sim({ doorDwellMs: 4_000 });
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L1",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  for (let i = 0; i < 5; i++) {
+    lift.tick(3_000);
+    await lift.refresh("j-1");
+  }
+  assert.equal((await lift.read()).doorState, LIFT_DOOR.OPEN);
+});
+
+test("refreshing somebody else's session does NOT hold the doors", async () => {
+  const lift = sim({ doorDwellMs: 4_000 });
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L1",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  lift.tick(3_000);
+  await lift.refresh("j-2"); // not the holder
+  lift.tick(2_000);
+  assert.equal((await lift.read()).doorState, LIFT_DOOR.CLOSED);
+});
+
+test("a lift held by one journey is refused to another, not stolen", async () => {
+  const lift = sim();
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L2",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  await assert.rejects(
+    () => lift.request({
+      liftName: "LIFT-A", sessionId: "j-2",
+      requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L4",
+      doorState: LIFT_DOOR.OPEN,
+    }),
+    /held by j-1/
+  );
+});
+
+test("release is safe to call twice, and frees the lift for the next journey", async () => {
+  const lift = sim();
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L2",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  await lift.release("j-1");
+  await lift.release("j-1"); // the watchdog fires unconditionally
+  const s = await lift.read();
+  assert.equal(s.sessionId, "");
+  assert.equal(s.currentMode, LIFT_MODE.HUMAN, "handed back to passengers");
+
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-2",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L4",
+    doorState: LIFT_DOOR.OPEN,
+  });
+  assert.equal((await lift.read()).sessionId, "j-2");
+});
+
+test("releasing a lift somebody else holds does nothing", async () => {
+  const lift = sim();
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L2",
+    doorState: LIFT_DOOR.OPEN,
+  });
+
+  await lift.release("j-2");
+  assert.equal((await lift.read()).sessionId, "j-1", "still held by j-1");
+});
+
+test("a floor the lift does not serve is refused", async () => {
+  const lift = sim();
+  await assert.rejects(
+    () => lift.request({
+      liftName: "LIFT-A", sessionId: "j-1",
+      requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "B2",
+      doorState: LIFT_DOOR.OPEN,
+    }),
+    /does not serve B2/
+  );
+});
+
+test("END_SESSION hands the lift back to passengers", async () => {
+  const lift = sim();
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.AGV_MODE, destinationFloor: "L2",
+    doorState: LIFT_DOOR.OPEN,
+  });
+  assert.equal((await lift.read()).currentMode, LIFT_MODE.AGV);
+
+  await lift.request({
+    liftName: "LIFT-A", sessionId: "j-1",
+    requestType: LIFT_REQUEST.END_SESSION, destinationFloor: "L2",
+    doorState: LIFT_DOOR.CLOSED,
+  });
+  const s = await lift.read();
+  assert.equal(s.sessionId, "");
+  assert.equal(s.currentMode, LIFT_MODE.HUMAN);
+});
+
+test("read() returns a copy — a caller cannot mutate the lift", async () => {
+  const lift = sim();
+  const s = await lift.read();
+  s.availableFloors.push("L99");
+  s.currentFloor = "L4";
+  const again = await lift.read();
+  assert.equal(again.availableFloors.includes("L99"), false);
+  assert.equal(again.currentFloor, "L1");
+});

package/test/robot-apps.test.mjs

@@ -0,0 +1,154 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  ROBOT_APP_SCOPES,
+  canMonitorRobotType,
+  canSetUpRobotType,
+  robotScopeForApp,
+  robotTypesVisibleTo,
+} from "./.build/utils/robot-apps.util.mjs";
+
+/* --------------------------------------------------------------------------
+ * The owner's rule, 2026-09-22: iService365 is the fleet manager for EVERY
+ * robot on a property. A cleaning robot is set up in the cleaning apps, a
+ * security robot in the security apps, Property Management does both because
+ * the property owns the fleet, the Seven365 console does everything everywhere,
+ * and the managing agent watches without configuring.
+ *
+ * These assert that table, and the two ways it can fail quietly: an app nobody
+ * declared getting everything instead of nothing, and a refusal being read as
+ * "no filter".
+ * ----------------------------------------------------------------------- */
+
+const HYGIENE_WEB = "iservice365-web-app-hygiene";
+const ICLEAN = "iservice365-hygiene-mobile-app";
+const SECURITY_WEB = "iservice365-web-app-security";
+const ISECURE = "iservice365-security-mobile-app";
+const PM_WEB = "iservice365-web-app-property-management";
+const IMA = "iservice365-ma-mobile-app";
+const CONSOLE = "iservice365-web-app-admin";
+
+/* ------------------------------------------------------- the owner's rule */
+
+test("cleaning apps see cleaning robots and NOT security patrols", () => {
+  for (const app of [HYGIENE_WEB, ICLEAN]) {
+    assert.equal(canSetUpRobotType(app, "cleaning"), true, app);
+    assert.equal(canMonitorRobotType(app, "cleaning"), true, app);
+
+    // A cleaner must never be shown where a security patrol is.
+    assert.equal(canSetUpRobotType(app, "security"), false, app);
+    assert.equal(canMonitorRobotType(app, "security"), false, app);
+  }
+});
+
+test("security apps see security robots and NOT cleaning robots", () => {
+  for (const app of [SECURITY_WEB, ISECURE]) {
+    assert.equal(canSetUpRobotType(app, "security"), true, app);
+    assert.equal(canMonitorRobotType(app, "security"), true, app);
+    assert.equal(canSetUpRobotType(app, "cleaning"), false, app);
+    assert.equal(canMonitorRobotType(app, "cleaning"), false, app);
+  }
+});
+
+test("Property Management sets up and monitors BOTH", () => {
+  for (const type of ["cleaning", "security"]) {
+    assert.equal(canSetUpRobotType(PM_WEB, type), true, type);
+    assert.equal(canMonitorRobotType(PM_WEB, type), true, type);
+  }
+});
+
+test("the Seven365 console does everything, for every robot type", () => {
+  for (const type of ["cleaning", "security"]) {
+    assert.equal(canSetUpRobotType(CONSOLE, type), true, type);
+    assert.equal(canMonitorRobotType(CONSOLE, type), true, type);
+  }
+});
+
+test("the managing agent watches the whole fleet but configures nothing", () => {
+  assert.equal(canMonitorRobotType(IMA, "cleaning"), true);
+  assert.equal(canMonitorRobotType(IMA, "security"), true);
+
+  // Setup is a different job from monitoring - iMA365 must not be able to
+  // re-point a robot at a different cloud.
+  assert.equal(canSetUpRobotType(IMA, "cleaning"), false);
+  assert.equal(canSetUpRobotType(IMA, "security"), false);
+});
+
+/* ------------------------------------------------------------ fails closed */
+
+test("an app nobody declared gets NO robots, not all of them", () => {
+  // A new service app, a renamed deployment, a typo in an env var. The wrong
+  // default here is a landscaping app listing a building's security patrols.
+  for (const unknown of [
+    "iservice365-landscaping-mobile-app",
+    "iservice365-web-app-pest-control",
+    "not-an-app",
+    "",
+    null,
+    undefined,
+    42,
+    {},
+  ]) {
+    assert.deepEqual(
+      robotScopeForApp(unknown),
+      { setup: [], monitor: [] },
+      String(unknown)
+    );
+    assert.equal(canMonitorRobotType(unknown, "cleaning"), false);
+    assert.equal(canSetUpRobotType(unknown, "security"), false);
+  }
+});
+
+test("an unknown robot type is refused everywhere, including the console", () => {
+  for (const app of Object.keys(ROBOT_APP_SCOPES)) {
+    assert.equal(canSetUpRobotType(app, "drone"), false, app);
+    assert.equal(canMonitorRobotType(app, undefined), false, app);
+  }
+});
+
+/* --------------------------------------------------- the listing filter */
+
+test("no type requested means every type the app may monitor", () => {
+  assert.deepEqual(robotTypesVisibleTo(PM_WEB), ["cleaning", "security"]);
+  assert.deepEqual(robotTypesVisibleTo(ICLEAN), ["cleaning"]);
+  assert.deepEqual(robotTypesVisibleTo(ISECURE, ""), ["security"]);
+  assert.deepEqual(robotTypesVisibleTo(PM_WEB, null), ["cleaning", "security"]);
+});
+
+test("a permitted type narrows the listing to that type", () => {
+  assert.deepEqual(robotTypesVisibleTo(PM_WEB, "security"), ["security"]);
+  assert.deepEqual(robotTypesVisibleTo(CONSOLE, "cleaning"), ["cleaning"]);
+});
+
+test("asking for a type the app may not see returns [] - list NOTHING", () => {
+  // The case that must never be read as "no filter": if a caller treats the
+  // empty array as "no constraint", a refusal becomes a listing of every robot
+  // on the estate.
+  assert.deepEqual(robotTypesVisibleTo(ICLEAN, "security"), []);
+  assert.deepEqual(robotTypesVisibleTo(ISECURE, "cleaning"), []);
+  assert.deepEqual(robotTypesVisibleTo(IMA, "drone"), []);
+  assert.deepEqual(robotTypesVisibleTo("not-an-app", "cleaning"), []);
+});
+
+test("an app that monitors nothing is never widened by an empty request", () => {
+  // iMA365 configures nothing, so its SETUP list is empty - but that must not
+  // make `robotTypesVisibleTo` return everything for an unlisted app.
+  assert.deepEqual(robotTypesVisibleTo("not-an-app"), []);
+  assert.deepEqual(robotTypesVisibleTo("not-an-app", undefined), []);
+});
+
+/* ------------------------------------------------------------ the table */
+
+test("every declared app names only known robot types", () => {
+  const known = new Set(["cleaning", "security"]);
+  for (const [app, scope] of Object.entries(ROBOT_APP_SCOPES)) {
+    for (const t of [...scope.setup, ...scope.monitor]) {
+      assert.equal(known.has(t), true, `${app} declares unknown type ${t}`);
+    }
+    // Anything an app can set up, it must also be able to see.
+    for (const t of scope.setup) {
+      assert.equal(scope.monitor.includes(t), true, `${app} sets up ${t} blind`);
+    }
+  }
+});