@aria-cli/tools 1.0.0

package/tests/network-runtime/local-control-contract.test.ts

@@ -0,0 +1,869 @@
+import { describe, expect, expectTypeOf, it } from "vitest";
+import type {
+  AttachedClientView,
+  AttachedLocalControlApi,
+  LocalControlApi,
+  PersistedInboxEvent,
+} from "../../src/index.js";
+import { PrincipalFingerprintSchema, TlsCaFingerprintSchema } from "../../src/index.js";
+
+const remotePrincipalFingerprint = PrincipalFingerprintSchema.parse("f".repeat(64));
+const pinnedTlsCaFingerprint = TlsCaFingerprintSchema.parse("a".repeat(64));
+
+describe("network runtime local control contracts", () => {
+  it("exports canonical local-control schemas from the shared runtime contract layer", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(runtime.RunRequestSchema).toBeDefined();
+    expect(runtime.RuntimeQueuedReceiptSchema).toBeDefined();
+    expect(runtime.RuntimeDeliveryReceiptSchema).toBeDefined();
+    expect(runtime.InboxCursorSchema).toBeDefined();
+    expect(runtime.PersistedInboxEventSchema).toBeDefined();
+    expect(runtime.PeerViewEventSchema).toBeDefined();
+    expect(runtime.RuntimeStatusSchema).toBeDefined();
+    expect(runtime.PendingPairRequestViewSchema).toBeDefined();
+    expect(runtime.PairRequestDecisionSchema).toBeDefined();
+    expect(runtime.PairRequestResponseSchema).toBeDefined();
+    expect(runtime.PairRequestRouteBodySchema).toBeDefined();
+    expect(runtime.PairRequestRouteBodyJsonSchema).toBeDefined();
+    expect(runtime.InvitePeerRequestSchema).toBeDefined();
+    expect(runtime.InvitePeerResultSchema).toBeDefined();
+    expect(runtime.AcceptInviteRequestSchema).toBeDefined();
+    expect(runtime.AcceptInviteRequestBodyJsonSchema).toBeDefined();
+    expect(runtime.AcceptInviteResponseSchema).toBeDefined();
+    expect(runtime.PairRelayRouteBodySchema).toBeDefined();
+    expect(runtime.PairRelayRouteBodyJsonSchema).toBeDefined();
+    expect(runtime.DirectPairRequestSchema).toBeDefined();
+    expect(runtime.DirectPairResponseSchema).toBeDefined();
+    expect(runtime.RevokePeerRequestSchema).toBeDefined();
+    expect(runtime.NetworkRouteRevokeRequestSchema).toBeDefined();
+    expect(runtime.NetworkRouteRevokeRequestJsonSchema).toBeDefined();
+    expect(runtime.RevokePeerResponseSchema).toBeDefined();
+    expect(runtime.RepairPeerRequestSchema).toBeDefined();
+    expect(runtime.RepairPeerResponseSchema).toBeDefined();
+    expect(runtime.LocalControlClientKindSchema).toBeDefined();
+    expect(runtime.AttachedClientViewSchema).toBeDefined();
+    expect(runtime.AttachedClientLeaseGrantSchema).toBeDefined();
+    expect(runtime.AttachedClientAuthSchema).toBeDefined();
+    expect(runtime.LocalControlSocketAttachClientRequestSchema).toBeDefined();
+    expect(runtime.LocalControlSocketAttachClientResponseSchema).toBeDefined();
+    expect(runtime.LocalControlSocketDetachClientRequestSchema).toBeDefined();
+    expect(runtime.LocalControlSocketDetachClientResponseSchema).toBeDefined();
+  });
+
+  it("models attached clients and lease grants as first-class local-control contracts", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.AttachedClientViewSchema.parse({
+        clientId: "client-tui-1",
+        clientKind: "tui",
+        displayLabel: "TUI 1",
+        self: false,
+        attachedAt: "2026-03-13T00:00:00.000Z",
+        lastSeenAt: "2026-03-13T00:00:01.000Z",
+      }),
+    ).toEqual({
+      clientId: "client-tui-1",
+      clientKind: "tui",
+      displayLabel: "TUI 1",
+      self: false,
+      attachedAt: "2026-03-13T00:00:00.000Z",
+      lastSeenAt: "2026-03-13T00:00:01.000Z",
+    });
+
+    expect(
+      runtime.AttachedClientLeaseGrantSchema.parse({
+        clientId: "client-tui-1",
+        clientAuthToken: "lease-secret",
+      }),
+    ).toEqual({
+      clientId: "client-tui-1",
+      clientAuthToken: "lease-secret",
+    });
+  });
+
+  it("canonicalizes partial delivery receipts into the authoritative shared shape", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.RuntimeQueuedReceiptSchema.parse({
+        transport: "tunnel",
+        delivered: false,
+        queued: true,
+      }),
+    ).toEqual({
+      transport: "tunnel",
+      delivered: false,
+      queued: true,
+      accepted: true,
+      deliveryState: "queued_for_route",
+      sessionState: "handshaking",
+      deliveryReadiness: "can_queue_only",
+      queuedReason: "route_not_established",
+    });
+
+    expect(
+      runtime.RuntimeQueuedReceiptSchema.parse({
+        transport: "tunnel",
+        delivered: false,
+        queued: true,
+        deliveryState: "sent",
+        queuedReason: "awaiting_remote_ack",
+      }),
+    ).toEqual({
+      transport: "tunnel",
+      delivered: false,
+      queued: true,
+      accepted: true,
+      deliveryState: "dispatching",
+      sessionState: "connected",
+      deliveryReadiness: "can_send_now",
+      queuedReason: "awaiting_remote_ack",
+    });
+
+    expect(
+      runtime.RuntimeQueuedReceiptSchema.parse({
+        transport: "local_runtime",
+        delivered: true,
+        queued: false,
+      }),
+    ).toEqual({
+      transport: "local_runtime",
+      delivered: true,
+      queued: false,
+      accepted: true,
+      deliveryState: "acked",
+      sessionState: "none",
+      deliveryReadiness: "can_queue_only",
+    });
+
+    expect(
+      runtime.RuntimeDeliveryReceiptSchema.parse({
+        transport: "local_runtime",
+        delivered: true,
+        queued: false,
+        storedAt: 42,
+      }),
+    ).toEqual({
+      transport: "local_runtime",
+      delivered: true,
+      queued: false,
+      accepted: true,
+      deliveryState: "acked",
+      sessionState: "none",
+      deliveryReadiness: "can_queue_only",
+      storedAt: 42,
+    });
+  });
+
+  it("fails closed when explicit unhealthy receipt signals are present", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.RuntimeQueuedReceiptSchema.parse({
+        transport: "tunnel",
+        delivered: false,
+        queued: true,
+        accepted: true,
+        deliveryState: "dispatching",
+        sessionState: "dead",
+        deliveryReadiness: "cannot_address",
+        queuedReason: "transport_unavailable",
+      }),
+    ).toEqual({
+      transport: "tunnel",
+      delivered: false,
+      queued: true,
+      accepted: true,
+      deliveryState: "dispatching",
+      sessionState: "dead",
+      deliveryReadiness: "cannot_address",
+      queuedReason: "transport_unavailable",
+    });
+  });
+
+  it("uses explicit recipientInbox contracts for local client routing while preserving node compatibility", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.OutboundMessageSchema.parse({
+        rawMessage: { id: "msg-node" },
+        to: "node-bravo",
+        recipientInbox: {
+          kind: "node",
+          nodeId: "node-bravo",
+        },
+      }),
+    ).toEqual({
+      rawMessage: { id: "msg-node" },
+      to: "node-bravo",
+      recipientInbox: {
+        kind: "node",
+        nodeId: "node-bravo",
+      },
+    });
+
+    expect(
+      runtime.OutboundMessageSchema.safeParse({
+        rawMessage: { id: "msg-node-mismatch" },
+        to: "node-charlie",
+        recipientInbox: {
+          kind: "node",
+          nodeId: "node-bravo",
+        },
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.OutboundMessageSchema.parse({
+        rawMessage: { id: "msg-client" },
+        recipientInbox: {
+          kind: "client",
+          clientId: "client-bravo",
+        },
+      }),
+    ).toEqual({
+      rawMessage: { id: "msg-client" },
+      recipientInbox: {
+        kind: "client",
+        clientId: "client-bravo",
+      },
+    });
+
+    expect(
+      runtime.OutboundMessageSchema.safeParse({
+        rawMessage: { id: "msg-client-invalid" },
+        to: "node-bravo",
+        recipientInbox: {
+          kind: "client",
+          clientId: "client-bravo",
+        },
+      }).success,
+    ).toBe(false);
+  });
+
+  it("requires attached-client auth on self-scoped runtime-socket requests", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.LocalControlSocketRequestSchema.safeParse({
+        id: "req-clients-missing-auth",
+        method: "listAttachedClients",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.LocalControlSocketRequestSchema.safeParse({
+        id: "req-direct-missing-auth",
+        method: "listDirectClientInbox",
+        payload: { unreadOnly: true },
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.LocalControlSocketRequestSchema.parse({
+        id: "req-clients-with-auth",
+        method: "listAttachedClients",
+        auth: {
+          clientId: "client-self",
+          clientAuthToken: "proof-token",
+        },
+      }),
+    ).toEqual({
+      id: "req-clients-with-auth",
+      method: "listAttachedClients",
+      auth: {
+        clientId: "client-self",
+        clientAuthToken: "proof-token",
+      },
+    });
+
+    expect(
+      runtime.LocalControlSocketRequestSchema.parse({
+        id: "req-status",
+        method: "getRuntimeStatus",
+      }),
+    ).toEqual({
+      id: "req-status",
+      method: "getRuntimeStatus",
+    });
+  });
+
+  it("exposes attached-only methods only on AttachedLocalControlApi", () => {
+    expectTypeOf<AttachedLocalControlApi>().toExtend<LocalControlApi>();
+    expectTypeOf<Awaited<ReturnType<AttachedLocalControlApi["listAttachedClients"]>>>()
+      .toEqualTypeOf<AttachedClientView[]>();
+    expectTypeOf<Awaited<ReturnType<AttachedLocalControlApi["listDirectClientInbox"]>>>()
+      .toEqualTypeOf<PersistedInboxEvent[]>();
+
+    if (false) {
+      const base = {} as LocalControlApi;
+      const attached = {} as AttachedLocalControlApi;
+      void attached.listAttachedClients;
+      void attached.listDirectClientInbox;
+      void attached.subscribeDirectClientInbox;
+
+      // @ts-expect-error attached-client directory must not exist on the base LocalControlApi
+      void base.listAttachedClients;
+      // @ts-expect-error direct client inbox reads must not exist on the base LocalControlApi
+      void base.listDirectClientInbox;
+      // @ts-expect-error direct client inbox subscriptions must not exist on the base LocalControlApi
+      void base.subscribeDirectClientInbox;
+    }
+  });
+
+  it("separates local-control revoke input from the public network revoke route contract", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.RevokePeerRequestSchema.parse({
+        nodeId: "node-bravo",
+      }),
+    ).toEqual({
+      nodeId: "node-bravo",
+    });
+
+    expect(
+      runtime.NetworkRouteRevokeRequestSchema.safeParse({
+        nodeId: "node-bravo",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.NetworkRouteRevokeRequestSchema.parse({
+        nodeId: "node-bravo",
+        envelope: {
+          version: 1,
+          id: "env-revoke",
+          operation: "network.revoke",
+          principal: {
+            nodeId: "node-local-authority",
+            principalFingerprint: "a".repeat(64),
+            transportPublicKey: "wg-node-local-authority",
+            bindingGeneration: 1,
+          },
+          target: {
+            nodeId: "node-bravo",
+            principalFingerprint: "a".repeat(64),
+            transportPublicKey: "wg-node-bravo",
+            bindingGeneration: 1,
+          },
+          namespace: "mesh",
+          policyEpoch: 1,
+          nonce: "nonce-1",
+          timestamp: 1,
+          ttl: 60000,
+          contextHash: "context-hash",
+          payload: {
+            nodeId: "node-bravo",
+          },
+          signature: "signature",
+        },
+      }),
+    ).toEqual({
+      nodeId: "node-bravo",
+      envelope: {
+        version: 1,
+        id: "env-revoke",
+        operation: "network.revoke",
+        principal: {
+          nodeId: "node-local-authority",
+          principalFingerprint: "a".repeat(64),
+          transportPublicKey: "wg-node-local-authority",
+          bindingGeneration: 1,
+        },
+        target: {
+          nodeId: "node-bravo",
+          principalFingerprint: "a".repeat(64),
+          transportPublicKey: "wg-node-bravo",
+          bindingGeneration: 1,
+        },
+        namespace: "mesh",
+        policyEpoch: 1,
+        nonce: "nonce-1",
+        timestamp: 1,
+        ttl: 60000,
+        contextHash: "context-hash",
+        payload: {
+          nodeId: "node-bravo",
+        },
+        signature: "signature",
+      },
+    });
+  });
+
+  it("models LAN invite results as proof-pending instead of generic success", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.InvitePeerResultSchema.safeParse({
+        success: true,
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "lan_direct",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.InvitePeerResultSchema.safeParse({
+        peerId: "node-bravo",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "lan_direct",
+        pairingProofState: "pending_verification",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.InvitePeerResultSchema.parse({
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "lan_direct",
+        pairingProofState: "pending_verification",
+      }),
+    ).toEqual({
+      nodeId: "node-bravo",
+      displayNameSnapshot: "Bravo",
+      mode: "lan_direct",
+      pairingProofState: "pending_verification",
+    });
+  });
+
+  it("models WAN invite results as pending proof instead of proof-accepted success", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.InvitePeerResultSchema.safeParse({
+        success: true,
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "wan_pair",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.InvitePeerResultSchema.safeParse({
+        peerId: "node-bravo",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "wan_pair",
+        pairingProofState: "pending_verification",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.InvitePeerResultSchema.parse({
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        mode: "wan_pair",
+        pairingProofState: "pending_verification",
+      }),
+    ).toEqual({
+      nodeId: "node-bravo",
+      displayNameSnapshot: "Bravo",
+      mode: "wan_pair",
+      pairingProofState: "pending_verification",
+    });
+  });
+
+  it("models direct pair control responses as request receipt with pending proof", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.DirectPairResponseSchema.safeParse({
+        success: true,
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.DirectPairResponseSchema.safeParse({
+        received: true,
+        pairingProofState: "pending_verification",
+        peerId: "node-bravo",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.DirectPairResponseSchema.parse({
+        received: true,
+        pairingProofState: "pending_verification",
+      }),
+    ).toEqual({
+      received: true,
+      pairingProofState: "pending_verification",
+    });
+  });
+
+  it("hard-cuts direct pair requests to explicit peerNodeId and principalFingerprint instead of the ambiguous peerId alias", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.DirectPairRequestSchema.parse({
+        peerNodeId: "node-bravo",
+        principalFingerprint: remotePrincipalFingerprint,
+        peerDisplayName: "Bravo",
+        peerWgPubkey: "peer-public-key",
+        peerSigningPubkey: "signing-key",
+        transportEndpoint: { host: "10.0.0.4", port: 58291 },
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+        psk: "psk",
+      }),
+    ).toEqual({
+      peerNodeId: "node-bravo",
+      principalFingerprint: remotePrincipalFingerprint,
+      peerDisplayName: "Bravo",
+      peerWgPubkey: "peer-public-key",
+      peerSigningPubkey: "signing-key",
+      transportEndpoint: { host: "10.0.0.4", port: 58291 },
+      controlEndpoint: {
+        host: "10.0.0.4",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: remotePrincipalFingerprint,
+        protocolVersion: 1,
+      },
+      psk: "psk",
+    });
+
+    expect(
+      runtime.DirectPairRequestSchema.safeParse({
+        peerId: "node-bravo",
+        peerDisplayName: "Bravo",
+        peerWgPubkey: "peer-public-key",
+        peerSigningPubkey: "signing-key",
+        transportEndpoint: { host: "10.0.0.4", port: 58291 },
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+        psk: "psk",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.DirectPairRequestSchema.safeParse({
+        peerNodeId: "node-bravo",
+        peerPrincipalId: remotePrincipalFingerprint,
+        peerDisplayName: "Bravo",
+        peerWgPubkey: "peer-public-key",
+        peerSigningPubkey: "signing-key",
+        transportEndpoint: { host: "10.0.0.4", port: 58291 },
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+        psk: "psk",
+      }).success,
+    ).toBe(false);
+  });
+
+  it("hard-cuts nearby peer views to explicit principal fingerprints instead of a generic fingerprint alias", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.NearbyPeerViewSchema.parse({
+        displayNameSnapshot: "Bravo",
+        nodeId: "node-bravo",
+        host: "10.0.0.4",
+        port: 58291,
+        principalFingerprint: remotePrincipalFingerprint,
+        version: "1",
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        transport: "lan",
+        status: "discovered",
+      }),
+    ).toEqual({
+      displayNameSnapshot: "Bravo",
+      nodeId: "node-bravo",
+      host: "10.0.0.4",
+      port: 58291,
+      principalFingerprint: remotePrincipalFingerprint,
+      version: "1",
+      tlsCaFingerprint: pinnedTlsCaFingerprint,
+      transport: "lan",
+      status: "discovered",
+    });
+
+    expect(
+      runtime.NearbyPeerViewSchema.safeParse({
+        displayNameSnapshot: "Bravo",
+        nodeId: "node-bravo",
+        host: "10.0.0.4",
+        port: 58291,
+        fingerprint: remotePrincipalFingerprint,
+        version: "1",
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        transport: "lan",
+        status: "discovered",
+      }).success,
+    ).toBe(false);
+  });
+
+  it("hard-cuts invite requests to durable nodeId instead of the ambiguous peerId alias", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.InvitePeerRequestSchema.parse({
+        nodeId: "node-bravo",
+        displayName: "Bravo",
+        principalFingerprint: remotePrincipalFingerprint,
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+        transport: "lan",
+      }),
+    ).toEqual({
+      nodeId: "node-bravo",
+      displayName: "Bravo",
+      principalFingerprint: remotePrincipalFingerprint,
+      controlEndpoint: {
+        host: "10.0.0.4",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: remotePrincipalFingerprint,
+        protocolVersion: 1,
+      },
+      transport: "lan",
+    });
+
+    expect(
+      runtime.InvitePeerRequestSchema.safeParse({
+        peerId: "node-bravo",
+        displayName: "Bravo",
+        principalFingerprint: remotePrincipalFingerprint,
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+        transport: "lan",
+      }).success,
+    ).toBe(false);
+  });
+
+  it("hard-cuts pair route body schemas to nodeId on request/accept and targetNodeId+nodeId on relay", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.PairRequestRouteBodySchema.safeParse({
+        displayNameSnapshot: "Bravo",
+        peerId: "node-bravo",
+        signingPublicKey: "signing-key",
+        port: 58291,
+        ephemeralPublicKey: "eph",
+        ephemeralKeySignature: "sig",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.PairRequestRouteBodySchema.parse({
+        displayNameSnapshot: "Bravo",
+        nodeId: "node-bravo",
+        signingPublicKey: "signing-key",
+        port: 58291,
+        ephemeralPublicKey: "eph",
+        ephemeralKeySignature: "sig",
+      }),
+    ).toMatchObject({ nodeId: "node-bravo" });
+
+    expect(
+      runtime.PairRelayRouteBodySchema.safeParse({
+        targetNodeId: "node-target",
+        displayNameSnapshot: "Bravo",
+        peerId: "node-bravo",
+        signingPublicKey: "signing-key",
+        port: 58291,
+        ephemeralPublicKey: "eph",
+        ephemeralKeySignature: "sig",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.PairRelayRouteBodySchema.parse({
+        targetNodeId: "node-target",
+        displayNameSnapshot: "Bravo",
+        nodeId: "node-bravo",
+        signingPublicKey: "signing-key",
+        port: 58291,
+        ephemeralPublicKey: "eph",
+        ephemeralKeySignature: "sig",
+      }),
+    ).toMatchObject({ targetNodeId: "node-target", nodeId: "node-bravo" });
+
+    expect(
+      runtime.RelayPendingQuerySchema.safeParse({
+        targetPeerId: "node-target",
+        signingPublicKey: "signing-key",
+        signature: "sig",
+        timestamp: `${Date.now()}`,
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.RelayPendingQuerySchema.parse({
+        targetNodeId: "node-target",
+        signingPublicKey: "signing-key",
+        signature: "sig",
+        timestamp: `${Date.now()}`,
+      }),
+    ).toMatchObject({ targetNodeId: "node-target" });
+  });
+
+  it("hard-cuts pending pair request views to nodeId instead of a duplicate peerId alias", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.PendingPairRequestViewSchema.parse({
+        id: "req-1",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        principalFingerprint: remotePrincipalFingerprint,
+      }),
+    ).toEqual({
+      id: "req-1",
+      nodeId: "node-bravo",
+      displayNameSnapshot: "Bravo",
+      principalFingerprint: remotePrincipalFingerprint,
+    });
+
+    expect(
+      runtime.PendingPairRequestViewSchema.safeParse({
+        id: "req-1",
+        peerId: "node-bravo",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        principalFingerprint: remotePrincipalFingerprint,
+      }).success,
+    ).toBe(false);
+  });
+
+  it("accepts canonical nodeId-only accept-invite responses", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.AcceptInviteResponseSchema.parse({
+        success: true,
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+      }),
+    ).toEqual({
+      success: true,
+      nodeId: "node-bravo",
+      displayNameSnapshot: "Bravo",
+    });
+  });
+
+  it("hard-cuts accept-invite requests to nodeId only", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.AcceptInviteRequestSchema.parse({
+        inviteToken: "invite-token",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        transportEndpoint: {
+          host: "10.0.0.4",
+          port: 51820,
+        },
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+      }),
+    ).toEqual({
+      inviteToken: "invite-token",
+      nodeId: "node-bravo",
+      displayNameSnapshot: "Bravo",
+      transportEndpoint: {
+        host: "10.0.0.4",
+        port: 51820,
+      },
+      controlEndpoint: {
+        host: "10.0.0.4",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: remotePrincipalFingerprint,
+        protocolVersion: 1,
+      },
+    });
+
+    expect(
+      runtime.AcceptInviteRequestSchema.safeParse({
+        inviteToken: "invite-token",
+        peerId: "peer-bravo",
+        displayNameSnapshot: "Bravo",
+        transportEndpoint: {
+          host: "10.0.0.4",
+          port: 51820,
+        },
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.AcceptInviteRequestSchema.safeParse({
+        inviteToken: "invite-token",
+        nodeId: "node-bravo",
+        displayNameSnapshot: "Bravo",
+        signingPublicKey: "signing-key",
+        controlEndpoint: {
+          host: "10.0.0.4",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: remotePrincipalFingerprint,
+          protocolVersion: 1,
+        },
+      }).success,
+    ).toBe(false);
+  });
+
+  it("hard-cuts pair request responses to token-only acceptance payloads", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.PairRequestResponseSchema.parse({
+        accepted: true,
+        inviteToken: "signed-invite-token",
+      }),
+    ).toEqual({
+      accepted: true,
+      inviteToken: "signed-invite-token",
+    });
+
+    expect(
+      runtime.PairRequestResponseSchema.safeParse({
+        accepted: true,
+        inviteToken: "signed-invite-token",
+        signingPublicKey: "stale-duplicate-authority",
+      }).success,
+    ).toBe(false);
+  });
+});