@aria-cli/tools 1.0.8 → 1.0.10

package/tests/network-runtime/local-control-contract.test.ts

@@ -1,869 +0,0 @@
-import { describe, expect, expectTypeOf, it } from "vitest";
-import type {
-  AttachedClientView,
-  AttachedLocalControlApi,
-  LocalControlApi,
-  PersistedInboxEvent,
-} from "../../src/index.js";
-import { PrincipalFingerprintSchema, TlsCaFingerprintSchema } from "../../src/index.js";
-
-const remotePrincipalFingerprint = PrincipalFingerprintSchema.parse("f".repeat(64));
-const pinnedTlsCaFingerprint = TlsCaFingerprintSchema.parse("a".repeat(64));
-
-describe("network runtime local control contracts", () => {
-  it("exports canonical local-control schemas from the shared runtime contract layer", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(runtime.RunRequestSchema).toBeDefined();
-    expect(runtime.RuntimeQueuedReceiptSchema).toBeDefined();
-    expect(runtime.RuntimeDeliveryReceiptSchema).toBeDefined();
-    expect(runtime.InboxCursorSchema).toBeDefined();
-    expect(runtime.PersistedInboxEventSchema).toBeDefined();
-    expect(runtime.PeerViewEventSchema).toBeDefined();
-    expect(runtime.RuntimeStatusSchema).toBeDefined();
-    expect(runtime.PendingPairRequestViewSchema).toBeDefined();
-    expect(runtime.PairRequestDecisionSchema).toBeDefined();
-    expect(runtime.PairRequestResponseSchema).toBeDefined();
-    expect(runtime.PairRequestRouteBodySchema).toBeDefined();
-    expect(runtime.PairRequestRouteBodyJsonSchema).toBeDefined();
-    expect(runtime.InvitePeerRequestSchema).toBeDefined();
-    expect(runtime.InvitePeerResultSchema).toBeDefined();
-    expect(runtime.AcceptInviteRequestSchema).toBeDefined();
-    expect(runtime.AcceptInviteRequestBodyJsonSchema).toBeDefined();
-    expect(runtime.AcceptInviteResponseSchema).toBeDefined();
-    expect(runtime.PairRelayRouteBodySchema).toBeDefined();
-    expect(runtime.PairRelayRouteBodyJsonSchema).toBeDefined();
-    expect(runtime.DirectPairRequestSchema).toBeDefined();
-    expect(runtime.DirectPairResponseSchema).toBeDefined();
-    expect(runtime.RevokePeerRequestSchema).toBeDefined();
-    expect(runtime.NetworkRouteRevokeRequestSchema).toBeDefined();
-    expect(runtime.NetworkRouteRevokeRequestJsonSchema).toBeDefined();
-    expect(runtime.RevokePeerResponseSchema).toBeDefined();
-    expect(runtime.RepairPeerRequestSchema).toBeDefined();
-    expect(runtime.RepairPeerResponseSchema).toBeDefined();
-    expect(runtime.LocalControlClientKindSchema).toBeDefined();
-    expect(runtime.AttachedClientViewSchema).toBeDefined();
-    expect(runtime.AttachedClientLeaseGrantSchema).toBeDefined();
-    expect(runtime.AttachedClientAuthSchema).toBeDefined();
-    expect(runtime.LocalControlSocketAttachClientRequestSchema).toBeDefined();
-    expect(runtime.LocalControlSocketAttachClientResponseSchema).toBeDefined();
-    expect(runtime.LocalControlSocketDetachClientRequestSchema).toBeDefined();
-    expect(runtime.LocalControlSocketDetachClientResponseSchema).toBeDefined();
-  });
-
-  it("models attached clients and lease grants as first-class local-control contracts", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.AttachedClientViewSchema.parse({
-        clientId: "client-tui-1",
-        clientKind: "tui",
-        displayLabel: "TUI 1",
-        self: false,
-        attachedAt: "2026-03-13T00:00:00.000Z",
-        lastSeenAt: "2026-03-13T00:00:01.000Z",
-      }),
-    ).toEqual({
-      clientId: "client-tui-1",
-      clientKind: "tui",
-      displayLabel: "TUI 1",
-      self: false,
-      attachedAt: "2026-03-13T00:00:00.000Z",
-      lastSeenAt: "2026-03-13T00:00:01.000Z",
-    });
-
-    expect(
-      runtime.AttachedClientLeaseGrantSchema.parse({
-        clientId: "client-tui-1",
-        clientAuthToken: "lease-secret",
-      }),
-    ).toEqual({
-      clientId: "client-tui-1",
-      clientAuthToken: "lease-secret",
-    });
-  });
-
-  it("canonicalizes partial delivery receipts into the authoritative shared shape", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.RuntimeQueuedReceiptSchema.parse({
-        transport: "tunnel",
-        delivered: false,
-        queued: true,
-      }),
-    ).toEqual({
-      transport: "tunnel",
-      delivered: false,
-      queued: true,
-      accepted: true,
-      deliveryState: "queued_for_route",
-      sessionState: "handshaking",
-      deliveryReadiness: "can_queue_only",
-      queuedReason: "route_not_established",
-    });
-
-    expect(
-      runtime.RuntimeQueuedReceiptSchema.parse({
-        transport: "tunnel",
-        delivered: false,
-        queued: true,
-        deliveryState: "sent",
-        queuedReason: "awaiting_remote_ack",
-      }),
-    ).toEqual({
-      transport: "tunnel",
-      delivered: false,
-      queued: true,
-      accepted: true,
-      deliveryState: "dispatching",
-      sessionState: "connected",
-      deliveryReadiness: "can_send_now",
-      queuedReason: "awaiting_remote_ack",
-    });
-
-    expect(
-      runtime.RuntimeQueuedReceiptSchema.parse({
-        transport: "local_runtime",
-        delivered: true,
-        queued: false,
-      }),
-    ).toEqual({
-      transport: "local_runtime",
-      delivered: true,
-      queued: false,
-      accepted: true,
-      deliveryState: "acked",
-      sessionState: "none",
-      deliveryReadiness: "can_queue_only",
-    });
-
-    expect(
-      runtime.RuntimeDeliveryReceiptSchema.parse({
-        transport: "local_runtime",
-        delivered: true,
-        queued: false,
-        storedAt: 42,
-      }),
-    ).toEqual({
-      transport: "local_runtime",
-      delivered: true,
-      queued: false,
-      accepted: true,
-      deliveryState: "acked",
-      sessionState: "none",
-      deliveryReadiness: "can_queue_only",
-      storedAt: 42,
-    });
-  });
-
-  it("fails closed when explicit unhealthy receipt signals are present", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.RuntimeQueuedReceiptSchema.parse({
-        transport: "tunnel",
-        delivered: false,
-        queued: true,
-        accepted: true,
-        deliveryState: "dispatching",
-        sessionState: "dead",
-        deliveryReadiness: "cannot_address",
-        queuedReason: "transport_unavailable",
-      }),
-    ).toEqual({
-      transport: "tunnel",
-      delivered: false,
-      queued: true,
-      accepted: true,
-      deliveryState: "dispatching",
-      sessionState: "dead",
-      deliveryReadiness: "cannot_address",
-      queuedReason: "transport_unavailable",
-    });
-  });
-
-  it("uses explicit recipientInbox contracts for local client routing while preserving node compatibility", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.OutboundMessageSchema.parse({
-        rawMessage: { id: "msg-node" },
-        to: "node-bravo",
-        recipientInbox: {
-          kind: "node",
-          nodeId: "node-bravo",
-        },
-      }),
-    ).toEqual({
-      rawMessage: { id: "msg-node" },
-      to: "node-bravo",
-      recipientInbox: {
-        kind: "node",
-        nodeId: "node-bravo",
-      },
-    });
-
-    expect(
-      runtime.OutboundMessageSchema.safeParse({
-        rawMessage: { id: "msg-node-mismatch" },
-        to: "node-charlie",
-        recipientInbox: {
-          kind: "node",
-          nodeId: "node-bravo",
-        },
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.OutboundMessageSchema.parse({
-        rawMessage: { id: "msg-client" },
-        recipientInbox: {
-          kind: "client",
-          clientId: "client-bravo",
-        },
-      }),
-    ).toEqual({
-      rawMessage: { id: "msg-client" },
-      recipientInbox: {
-        kind: "client",
-        clientId: "client-bravo",
-      },
-    });
-
-    expect(
-      runtime.OutboundMessageSchema.safeParse({
-        rawMessage: { id: "msg-client-invalid" },
-        to: "node-bravo",
-        recipientInbox: {
-          kind: "client",
-          clientId: "client-bravo",
-        },
-      }).success,
-    ).toBe(false);
-  });
-
-  it("requires attached-client auth on self-scoped runtime-socket requests", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.LocalControlSocketRequestSchema.safeParse({
-        id: "req-clients-missing-auth",
-        method: "listAttachedClients",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.LocalControlSocketRequestSchema.safeParse({
-        id: "req-direct-missing-auth",
-        method: "listDirectClientInbox",
-        payload: { unreadOnly: true },
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.LocalControlSocketRequestSchema.parse({
-        id: "req-clients-with-auth",
-        method: "listAttachedClients",
-        auth: {
-          clientId: "client-self",
-          clientAuthToken: "proof-token",
-        },
-      }),
-    ).toEqual({
-      id: "req-clients-with-auth",
-      method: "listAttachedClients",
-      auth: {
-        clientId: "client-self",
-        clientAuthToken: "proof-token",
-      },
-    });
-
-    expect(
-      runtime.LocalControlSocketRequestSchema.parse({
-        id: "req-status",
-        method: "getRuntimeStatus",
-      }),
-    ).toEqual({
-      id: "req-status",
-      method: "getRuntimeStatus",
-    });
-  });
-
-  it("exposes attached-only methods only on AttachedLocalControlApi", () => {
-    expectTypeOf<AttachedLocalControlApi>().toExtend<LocalControlApi>();
-    expectTypeOf<Awaited<ReturnType<AttachedLocalControlApi["listAttachedClients"]>>>()
-      .toEqualTypeOf<AttachedClientView[]>();
-    expectTypeOf<Awaited<ReturnType<AttachedLocalControlApi["listDirectClientInbox"]>>>()
-      .toEqualTypeOf<PersistedInboxEvent[]>();
-
-    if (false) {
-      const base = {} as LocalControlApi;
-      const attached = {} as AttachedLocalControlApi;
-      void attached.listAttachedClients;
-      void attached.listDirectClientInbox;
-      void attached.subscribeDirectClientInbox;
-
-      // @ts-expect-error attached-client directory must not exist on the base LocalControlApi
-      void base.listAttachedClients;
-      // @ts-expect-error direct client inbox reads must not exist on the base LocalControlApi
-      void base.listDirectClientInbox;
-      // @ts-expect-error direct client inbox subscriptions must not exist on the base LocalControlApi
-      void base.subscribeDirectClientInbox;
-    }
-  });
-
-  it("separates local-control revoke input from the public network revoke route contract", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.RevokePeerRequestSchema.parse({
-        nodeId: "node-bravo",
-      }),
-    ).toEqual({
-      nodeId: "node-bravo",
-    });
-
-    expect(
-      runtime.NetworkRouteRevokeRequestSchema.safeParse({
-        nodeId: "node-bravo",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.NetworkRouteRevokeRequestSchema.parse({
-        nodeId: "node-bravo",
-        envelope: {
-          version: 1,
-          id: "env-revoke",
-          operation: "network.revoke",
-          principal: {
-            nodeId: "node-local-authority",
-            principalFingerprint: "a".repeat(64),
-            transportPublicKey: "wg-node-local-authority",
-            bindingGeneration: 1,
-          },
-          target: {
-            nodeId: "node-bravo",
-            principalFingerprint: "a".repeat(64),
-            transportPublicKey: "wg-node-bravo",
-            bindingGeneration: 1,
-          },
-          namespace: "mesh",
-          policyEpoch: 1,
-          nonce: "nonce-1",
-          timestamp: 1,
-          ttl: 60000,
-          contextHash: "context-hash",
-          payload: {
-            nodeId: "node-bravo",
-          },
-          signature: "signature",
-        },
-      }),
-    ).toEqual({
-      nodeId: "node-bravo",
-      envelope: {
-        version: 1,
-        id: "env-revoke",
-        operation: "network.revoke",
-        principal: {
-          nodeId: "node-local-authority",
-          principalFingerprint: "a".repeat(64),
-          transportPublicKey: "wg-node-local-authority",
-          bindingGeneration: 1,
-        },
-        target: {
-          nodeId: "node-bravo",
-          principalFingerprint: "a".repeat(64),
-          transportPublicKey: "wg-node-bravo",
-          bindingGeneration: 1,
-        },
-        namespace: "mesh",
-        policyEpoch: 1,
-        nonce: "nonce-1",
-        timestamp: 1,
-        ttl: 60000,
-        contextHash: "context-hash",
-        payload: {
-          nodeId: "node-bravo",
-        },
-        signature: "signature",
-      },
-    });
-  });
-
-  it("models LAN invite results as proof-pending instead of generic success", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.InvitePeerResultSchema.safeParse({
-        success: true,
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "lan_direct",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.InvitePeerResultSchema.safeParse({
-        peerId: "node-bravo",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "lan_direct",
-        pairingProofState: "pending_verification",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.InvitePeerResultSchema.parse({
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "lan_direct",
-        pairingProofState: "pending_verification",
-      }),
-    ).toEqual({
-      nodeId: "node-bravo",
-      displayNameSnapshot: "Bravo",
-      mode: "lan_direct",
-      pairingProofState: "pending_verification",
-    });
-  });
-
-  it("models WAN invite results as pending proof instead of proof-accepted success", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.InvitePeerResultSchema.safeParse({
-        success: true,
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "wan_pair",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.InvitePeerResultSchema.safeParse({
-        peerId: "node-bravo",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "wan_pair",
-        pairingProofState: "pending_verification",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.InvitePeerResultSchema.parse({
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        mode: "wan_pair",
-        pairingProofState: "pending_verification",
-      }),
-    ).toEqual({
-      nodeId: "node-bravo",
-      displayNameSnapshot: "Bravo",
-      mode: "wan_pair",
-      pairingProofState: "pending_verification",
-    });
-  });
-
-  it("models direct pair control responses as request receipt with pending proof", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.DirectPairResponseSchema.safeParse({
-        success: true,
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.DirectPairResponseSchema.safeParse({
-        received: true,
-        pairingProofState: "pending_verification",
-        peerId: "node-bravo",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.DirectPairResponseSchema.parse({
-        received: true,
-        pairingProofState: "pending_verification",
-      }),
-    ).toEqual({
-      received: true,
-      pairingProofState: "pending_verification",
-    });
-  });
-
-  it("hard-cuts direct pair requests to explicit peerNodeId and principalFingerprint instead of the ambiguous peerId alias", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.DirectPairRequestSchema.parse({
-        peerNodeId: "node-bravo",
-        principalFingerprint: remotePrincipalFingerprint,
-        peerDisplayName: "Bravo",
-        peerWgPubkey: "peer-public-key",
-        peerSigningPubkey: "signing-key",
-        transportEndpoint: { host: "10.0.0.4", port: 58291 },
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-        psk: "psk",
-      }),
-    ).toEqual({
-      peerNodeId: "node-bravo",
-      principalFingerprint: remotePrincipalFingerprint,
-      peerDisplayName: "Bravo",
-      peerWgPubkey: "peer-public-key",
-      peerSigningPubkey: "signing-key",
-      transportEndpoint: { host: "10.0.0.4", port: 58291 },
-      controlEndpoint: {
-        host: "10.0.0.4",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: remotePrincipalFingerprint,
-        protocolVersion: 1,
-      },
-      psk: "psk",
-    });
-
-    expect(
-      runtime.DirectPairRequestSchema.safeParse({
-        peerId: "node-bravo",
-        peerDisplayName: "Bravo",
-        peerWgPubkey: "peer-public-key",
-        peerSigningPubkey: "signing-key",
-        transportEndpoint: { host: "10.0.0.4", port: 58291 },
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-        psk: "psk",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.DirectPairRequestSchema.safeParse({
-        peerNodeId: "node-bravo",
-        peerPrincipalId: remotePrincipalFingerprint,
-        peerDisplayName: "Bravo",
-        peerWgPubkey: "peer-public-key",
-        peerSigningPubkey: "signing-key",
-        transportEndpoint: { host: "10.0.0.4", port: 58291 },
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-        psk: "psk",
-      }).success,
-    ).toBe(false);
-  });
-
-  it("hard-cuts nearby peer views to explicit principal fingerprints instead of a generic fingerprint alias", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.NearbyPeerViewSchema.parse({
-        displayNameSnapshot: "Bravo",
-        nodeId: "node-bravo",
-        host: "10.0.0.4",
-        port: 58291,
-        principalFingerprint: remotePrincipalFingerprint,
-        version: "1",
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        transport: "lan",
-        status: "discovered",
-      }),
-    ).toEqual({
-      displayNameSnapshot: "Bravo",
-      nodeId: "node-bravo",
-      host: "10.0.0.4",
-      port: 58291,
-      principalFingerprint: remotePrincipalFingerprint,
-      version: "1",
-      tlsCaFingerprint: pinnedTlsCaFingerprint,
-      transport: "lan",
-      status: "discovered",
-    });
-
-    expect(
-      runtime.NearbyPeerViewSchema.safeParse({
-        displayNameSnapshot: "Bravo",
-        nodeId: "node-bravo",
-        host: "10.0.0.4",
-        port: 58291,
-        fingerprint: remotePrincipalFingerprint,
-        version: "1",
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        transport: "lan",
-        status: "discovered",
-      }).success,
-    ).toBe(false);
-  });
-
-  it("hard-cuts invite requests to durable nodeId instead of the ambiguous peerId alias", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.InvitePeerRequestSchema.parse({
-        nodeId: "node-bravo",
-        displayName: "Bravo",
-        principalFingerprint: remotePrincipalFingerprint,
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-        transport: "lan",
-      }),
-    ).toEqual({
-      nodeId: "node-bravo",
-      displayName: "Bravo",
-      principalFingerprint: remotePrincipalFingerprint,
-      controlEndpoint: {
-        host: "10.0.0.4",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: remotePrincipalFingerprint,
-        protocolVersion: 1,
-      },
-      transport: "lan",
-    });
-
-    expect(
-      runtime.InvitePeerRequestSchema.safeParse({
-        peerId: "node-bravo",
-        displayName: "Bravo",
-        principalFingerprint: remotePrincipalFingerprint,
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-        transport: "lan",
-      }).success,
-    ).toBe(false);
-  });
-
-  it("hard-cuts pair route body schemas to nodeId on request/accept and targetNodeId+nodeId on relay", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.PairRequestRouteBodySchema.safeParse({
-        displayNameSnapshot: "Bravo",
-        peerId: "node-bravo",
-        signingPublicKey: "signing-key",
-        port: 58291,
-        ephemeralPublicKey: "eph",
-        ephemeralKeySignature: "sig",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.PairRequestRouteBodySchema.parse({
-        displayNameSnapshot: "Bravo",
-        nodeId: "node-bravo",
-        signingPublicKey: "signing-key",
-        port: 58291,
-        ephemeralPublicKey: "eph",
-        ephemeralKeySignature: "sig",
-      }),
-    ).toMatchObject({ nodeId: "node-bravo" });
-
-    expect(
-      runtime.PairRelayRouteBodySchema.safeParse({
-        targetNodeId: "node-target",
-        displayNameSnapshot: "Bravo",
-        peerId: "node-bravo",
-        signingPublicKey: "signing-key",
-        port: 58291,
-        ephemeralPublicKey: "eph",
-        ephemeralKeySignature: "sig",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.PairRelayRouteBodySchema.parse({
-        targetNodeId: "node-target",
-        displayNameSnapshot: "Bravo",
-        nodeId: "node-bravo",
-        signingPublicKey: "signing-key",
-        port: 58291,
-        ephemeralPublicKey: "eph",
-        ephemeralKeySignature: "sig",
-      }),
-    ).toMatchObject({ targetNodeId: "node-target", nodeId: "node-bravo" });
-
-    expect(
-      runtime.RelayPendingQuerySchema.safeParse({
-        targetPeerId: "node-target",
-        signingPublicKey: "signing-key",
-        signature: "sig",
-        timestamp: `${Date.now()}`,
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.RelayPendingQuerySchema.parse({
-        targetNodeId: "node-target",
-        signingPublicKey: "signing-key",
-        signature: "sig",
-        timestamp: `${Date.now()}`,
-      }),
-    ).toMatchObject({ targetNodeId: "node-target" });
-  });
-
-  it("hard-cuts pending pair request views to nodeId instead of a duplicate peerId alias", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.PendingPairRequestViewSchema.parse({
-        id: "req-1",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        principalFingerprint: remotePrincipalFingerprint,
-      }),
-    ).toEqual({
-      id: "req-1",
-      nodeId: "node-bravo",
-      displayNameSnapshot: "Bravo",
-      principalFingerprint: remotePrincipalFingerprint,
-    });
-
-    expect(
-      runtime.PendingPairRequestViewSchema.safeParse({
-        id: "req-1",
-        peerId: "node-bravo",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        principalFingerprint: remotePrincipalFingerprint,
-      }).success,
-    ).toBe(false);
-  });
-
-  it("accepts canonical nodeId-only accept-invite responses", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.AcceptInviteResponseSchema.parse({
-        success: true,
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-      }),
-    ).toEqual({
-      success: true,
-      nodeId: "node-bravo",
-      displayNameSnapshot: "Bravo",
-    });
-  });
-
-  it("hard-cuts accept-invite requests to nodeId only", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.AcceptInviteRequestSchema.parse({
-        inviteToken: "invite-token",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        transportEndpoint: {
-          host: "10.0.0.4",
-          port: 51820,
-        },
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-      }),
-    ).toEqual({
-      inviteToken: "invite-token",
-      nodeId: "node-bravo",
-      displayNameSnapshot: "Bravo",
-      transportEndpoint: {
-        host: "10.0.0.4",
-        port: 51820,
-      },
-      controlEndpoint: {
-        host: "10.0.0.4",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: remotePrincipalFingerprint,
-        protocolVersion: 1,
-      },
-    });
-
-    expect(
-      runtime.AcceptInviteRequestSchema.safeParse({
-        inviteToken: "invite-token",
-        peerId: "peer-bravo",
-        displayNameSnapshot: "Bravo",
-        transportEndpoint: {
-          host: "10.0.0.4",
-          port: 51820,
-        },
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-      }).success,
-    ).toBe(false);
-
-    expect(
-      runtime.AcceptInviteRequestSchema.safeParse({
-        inviteToken: "invite-token",
-        nodeId: "node-bravo",
-        displayNameSnapshot: "Bravo",
-        signingPublicKey: "signing-key",
-        controlEndpoint: {
-          host: "10.0.0.4",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: remotePrincipalFingerprint,
-          protocolVersion: 1,
-        },
-      }).success,
-    ).toBe(false);
-  });
-
-  it("hard-cuts pair request responses to token-only acceptance payloads", async () => {
-    const runtime = await import("../../src/network-runtime/index.js");
-
-    expect(
-      runtime.PairRequestResponseSchema.parse({
-        accepted: true,
-        inviteToken: "signed-invite-token",
-      }),
-    ).toEqual({
-      accepted: true,
-      inviteToken: "signed-invite-token",
-    });
-
-    expect(
-      runtime.PairRequestResponseSchema.safeParse({
-        accepted: true,
-        inviteToken: "signed-invite-token",
-        signingPublicKey: "stale-duplicate-authority",
-      }).success,
-    ).toBe(false);
-  });
-});