@fuzdev/fuz_app 0.102.0 → 0.104.0

package/dist/testing/cross_backend/capabilities.d.ts

@@ -159,6 +159,20 @@ export interface BackendCapabilities {
      * coverage.
      */
     readonly peer_request: boolean;
+    /**
+     * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
+     * layer — creating a `kind: 'gated'` cell requires the `participant` role
+     * or admin; every other kind (and a typeless cell) is open. Gates
+     * `describe_cell_gated_create_cross_tests`, the TS↔Rust cell-creation-
+     * authorizer parity proof. The authorizer adds no method / column / wire
+     * shape, so schema-snapshot + action-manifest parity are **blind** to an
+     * authorizer divergence — this behavioral cross case is the only gate that
+     * catches one. `true` only on the reference spine binaries that mount the
+     * test policy (the TS spine `full_spine_mount` + the Rust
+     * `testing_spine_stub`); consumers and the in-process default app don't
+     * mount it.
+     */
+    readonly cell_gated_create: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Nearly every

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAcpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -56,6 +56,9 @@ export const in_process_capabilities = Object.freeze({
     account_status: true,
     oversized_reject_closes_connection: true,
     peer_request: false,
+    // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
+    // spine binaries' full mount + the Rust stub, not the in-process default app.
+    cell_gated_create: false,
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAublF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -27,7 +27,12 @@ import '../assert_dev_env.js';
  * - `path` write by a non-admin → 403 (`cell_path_admin_only`), on both create
  *   and update (even by the owner);
  * - `cell_get` with neither `id` nor `path` → `invalid_params`;
- * - null-auth `cell_list` with `created_by` → `invalid_params`.
+ * - null-auth `cell_list` with `created_by` → `invalid_params`;
+ * - a denied caller (non-editor update / non-admin path create) carrying a
+ *   `kind` inside `data` still gets the authz error (404 / 403), never the
+ *   kind error — authz runs before the input-shape checks, on both spines;
+ * - an empty-string `kind` is rejected on create (`cell_kind_empty`) and is
+ *   accepted as a list filter that matches nothing.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -54,7 +59,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             const owner_headers = owner.create_session_headers();
             // create — default visibility, owner-stamped, no grants
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', label: 'hi' } }, owner_headers), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: { label: 'hi' } }, owner_headers), CellCreateOutput);
             assert.strictEqual(created.cell.visibility, 'private');
             assert.strictEqual(created.cell.created_by, owner.actor.id);
             assert.strictEqual(created.cell.updated_by, null);
@@ -70,7 +75,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.strictEqual(got.can_edit, true);
             assert.strictEqual(got.can_grant, true); // owner is manage-tier
             // update data + flip to public (owner is manage-tier, so visibility write is allowed)
-            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { kind: 'note', label: 'hi2' }, visibility: 'public' }, owner_headers), CellUpdateOutput);
+            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'hi2' }, visibility: 'public' }, owner_headers), CellUpdateOutput);
             assert.strictEqual(updated.cell.visibility, 'public');
             assert.strictEqual(updated.cell.updated_by, owner.actor.id);
             // list includes it
@@ -97,7 +102,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const ref_b = `blake3:${'b'.repeat(64)}`;
             const ref_c = `blake3:${'c'.repeat(64)}`;
             const sorted = [ref_a, ref_b, ref_c];
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: { cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
             assert.deepStrictEqual(created.cell.refs, sorted, 'create did not return sorted refs');
             // Read it back — the stored column round-trips sorted too.
             const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: created.cell.id }, owner_headers), CellGetOutput);
@@ -111,8 +116,8 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_anon_owner' });
             const owner_headers = owner.create_session_headers();
             const authed = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { data: { kind: 'note' }, visibility: 'private' }, owner_headers), CellCreateOutput).cell;
-            const pub = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { data: { kind: 'note' }, visibility: 'public' }, owner_headers), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'private' }, owner_headers), CellCreateOutput).cell;
+            const pub = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'public' }, owner_headers), CellCreateOutput).cell;
             const anon = fixture.fresh_transport({ origin: null });
             const anon_pub = await cross_rpc_call(anon, rpc_path, 'cell_get', { id: pub.id }, {});
             assert.ok(anon_pub.ok, `anon could not read public cell: ${JSON.stringify(anon_pub.error)}`);
@@ -129,11 +134,11 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_idor_owner' });
             const other = await fixture.create_account({ username: 'cell_idor_other' });
             const t = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner.create_session_headers()), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
             const other_headers = other.create_session_headers();
             const read = await cross_rpc_call(t, rpc_path, 'cell_get', { id: priv.id }, other_headers);
             assert.strictEqual(error_reason(read), 'cell_not_found');
-            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { kind: 'note', label: 'x' } }, other_headers);
+            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { label: 'x' } }, other_headers);
             assert.ok(!edit.ok, 'non-owner edited a private cell');
             assert.strictEqual(error_reason(edit), 'cell_not_found');
             const del = await cross_rpc_call(t, rpc_path, 'cell_delete', { cell_id: priv.id }, other_headers);
@@ -144,7 +149,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_admin_owner' });
             const t = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner.create_session_headers()), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
             // `fixture` is the bootstrapped keeper (holds ROLE_ADMIN).
             const admin_read = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: priv.id }, fixture.create_session_headers()), CellGetOutput);
             assert.strictEqual(admin_read.cell.id, priv.id);
@@ -154,8 +159,8 @@ export const describe_cell_crud_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             // `path` writes are admin-only; the keeper is admin.
             const admin_headers = fixture.create_session_headers();
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/dup' }, admin_headers), CellCreateOutput);
-            const dup = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/dup' }, admin_headers);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/dup' }, admin_headers), CellCreateOutput);
+            const dup = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/dup' }, admin_headers);
             assert.ok(!dup.ok, 'duplicate path was accepted');
             assert.strictEqual(error_reason(dup), 'cell_path_taken');
         });
@@ -164,11 +169,11 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_path_owner' });
             const t = fixture.fresh_transport();
             const owner_headers = owner.create_session_headers();
-            const create_with_path = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/forbidden' }, owner_headers);
+            const create_with_path = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/forbidden' }, owner_headers);
             assert.ok(!create_with_path.ok, 'non-admin set a path on create');
             assert.strictEqual(error_reason(create_with_path), 'cell_path_admin_only');
             // Even owning the cell, a non-admin cannot write `path` on update.
-            const owned = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_headers), CellCreateOutput).cell;
+            const owned = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_headers), CellCreateOutput).cell;
             const update_path = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: owned.id, path: 'parity/owned' }, owner_headers);
             assert.ok(!update_path.ok, 'non-admin set a path on update');
             assert.strictEqual(error_reason(update_path), 'cell_path_admin_only');
@@ -187,5 +192,42 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!bad.ok, 'anon created_by filter accepted');
             assert.strictEqual(error_reason(bad), 'cell_list_created_by_requires_auth');
         });
+        test_if(capabilities.cell_crud, 'authz before input-shape: a non-editor update with kind-in-data → 404, not the kind error', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_order_owner' });
+            const other = await fixture.create_account({ username: 'cell_order_other' });
+            const t = fixture.fresh_transport();
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
+            // `can_edit` (404 IDOR mask) must fire before `reject_kind_in_data`
+            // on both spines — a denied caller can't tell a malformed payload
+            // from a missing cell.
+            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { kind: 'post' } }, other.create_session_headers());
+            assert.ok(!edit.ok, 'non-editor reached the kind check');
+            assert.strictEqual(error_reason(edit), 'cell_not_found');
+        });
+        test_if(capabilities.cell_crud, 'authz before input-shape: a non-admin create with path + kind-in-data → 403, not the kind error', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_order_path' });
+            const t = fixture.fresh_transport();
+            // The path-admin gate (403) fires before `reject_kind_in_data`.
+            const bad = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/order' }, owner.create_session_headers());
+            assert.ok(!bad.ok, 'non-admin path write was not refused first');
+            assert.strictEqual(error_reason(bad), 'cell_path_admin_only');
+        });
+        test_if(capabilities.cell_crud, 'empty kind: rejected on create (cell_kind_empty); accepted as a filter that matches nothing', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_kind_empty' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            const empty = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: '', data: {} }, owner_headers);
+            assert.ok(!empty.ok, 'an empty kind was stored');
+            assert.strictEqual(error_reason(empty), 'cell_kind_empty');
+            // The list filter accepts '' on both spines (TS dropped the
+            // min-length Rust never had) and matches nothing — no cell carries
+            // an empty kind.
+            const note = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_headers), CellCreateOutput).cell;
+            const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind: '' }, owner_headers), CellListOutput);
+            assert.ok(!listed.cells.some((c) => c.id === note.id), 'empty-kind filter matched a non-empty-kind cell');
+        });
     });
 };

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -0,0 +1,28 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+/**
+ * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
+ * approved | rejected` transition) — root-authority-gated.
+ *
+ * Builds a moderated public space (admin) + a `participant`'s `post` (born
+ * `pending` + private under the `moderation_required: true` policy), then
+ * proves both spines agree:
+ *
+ * - **a root manager (admin) approves** → `moderation: 'approved'` +
+ *   `visibility: 'public'` (the contribution goes live).
+ * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
+ *   author can *view* their own pending cell, so they reach the gate, and are
+ *   denied — moderation authority is over the governing root, not the
+ *   contribution).
+ * - **a non-viewer is 404-masked** → a stranger who can't see the pending
+ *   contribution gets `cell_not_found`, never learns it exists.
+ * - **reject** → `moderation: 'rejected'`, visibility stays private.
+ *
+ * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
+ * exists when the directory authorizer is mounted (reference spine binaries).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ */
+export declare const describe_cell_moderate_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+//# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAkBzD,eAAO,MAAM,sCAAsC,GAAI,SAAS,wBAAwB,KAAG,IAwP1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAAI,SAAS,wBAAwB,KAAG,IAwHtF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -0,0 +1,213 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **parent-aware cell-creation authorizer**
+ * (`CellCreateAuthorize`) — the directory model.
+ *
+ * The authorizer adds no method, column, or wire shape, so the schema-snapshot
+ * and action-manifest parity gates are **blind** to a TS↔Rust authorizer
+ * divergence (the authorizer in the wrong phase, a different deny shape, the
+ * 404/403 split, the moderation outcome). This behavioral cross case is the
+ * only gate that catches one — proven *here in fuz_app*, against both reference
+ * spines.
+ *
+ * Both spines mount the same directory-model policy (the TS spine binary via
+ * `create_test_cell_gated_create_authorize`, the Rust `testing_spine_stub` via
+ * `TestCellGatedCreateAuthorize`): admin bypasses; a non-admin creating a
+ * `kind: 'space'` **root** is denied (admin-only); a **contribution** under a
+ * space is gated by the space's `data.policy[kind] = {min_role, moderation_required}`,
+ * with the moderation outcome folded into the verdict; plain parentless creates
+ * stay open. The suite asserts all spines agree on:
+ *
+ * - **root-create admin-only** — a non-admin `space` root → **403**
+ *   `cell_create_forbidden`; admin → succeeds.
+ * - **contribution gated by the root's policy** — under a public space, an
+ *   unauthorized stranger → **403**; a `participant` → succeeds.
+ * - **moderation per `moderation_required`** — a `participant`'s `post`
+ *   (`moderation_required: true`) is born `moderation: 'pending'` + private; a
+ *   `react` (`moderation_required: false`) is born `moderation: 'approved'` at
+ *   the author's visibility.
+ * - **404 on a hidden parent vs 403 on a visible one** — a contribution under a
+ *   **private** space the caller can't view → **404** `cell_not_found` (the
+ *   parent is masked); under a **public** space → **403** (you see it, you
+ *   can't contribute).
+ *
+ * Gated on `capabilities.cell_gated_create` — `true` only on the reference
+ * spine binaries that mount the policy, so it skips for generic consumers and
+ * the in-process default app (the authorizer hook's in-process coverage is the
+ * standalone `auth/cell_create_authorize.db.test.ts`).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ *
+ * @module
+ */
+import { describe, assert } from 'vitest';
+import { CellCreateOutput, CellModerateOutput } from '../../auth/cell_action_specs.js';
+import { test_if } from './capabilities.js';
+import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { SPACE_CELL_KIND, PARTICIPATION_ROLE } from './test_cell_gated_create_authorize.js';
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live). `comment` exists so the deep-case test can
+ * create a comment under a post (`root_id !== parent_id`) and prove the policy
+ * resolves from the governing root (the space), not the immediate parent.
+ */
+const SPACE_POLICY = {
+    policy: {
+        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+    },
+};
+export const describe_cell_gated_create_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('cell_gated_create authorizer parity (directory model)', () => {
+        test_if(capabilities.cell_gated_create, 'a non-admin is denied a `space` root (admin-only), admin succeeds', async () => {
+            const fixture = await setup_test();
+            const stranger = await fixture.create_account({ username: 'space_stranger' });
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {} }, stranger.create_session_headers());
+            assert.ok(!denied.ok, 'a non-admin must not create a space root');
+            assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(space.cell.kind, SPACE_CELL_KIND, 'admin creates the space root');
+            assert.strictEqual(space.cell.parent_id, null, 'a root is parentless');
+            assert.strictEqual(space.cell.root_id, null, 'a root has no governing root');
+            assert.strictEqual(space.cell.moderation, null, 'a root carries no moderation marker even under a mounted authorizer (moderation is a contribution concept)');
+        });
+        test_if(capabilities.cell_gated_create, 'a contribution under a public space: unauthorized → 403, participant → allowed', async () => {
+            const fixture = await setup_test();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            // A non-participant sees the public space but can't contribute → 403.
+            const stranger = await fixture.create_account({ username: 'post_stranger' });
+            const forbidden = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
+            assert.ok(!forbidden.ok, 'a non-participant must not post in the space');
+            assert.strictEqual(error_reason(forbidden), 'cell_create_forbidden');
+            // A participant may post; the contribution carries the directory edges.
+            const participant = await fixture.create_account({
+                username: 'post_participant',
+                roles: [PARTICIPATION_ROLE],
+            });
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.parent_id, space.cell.id, 'parent edge set');
+            assert.strictEqual(post.cell.root_id, space.cell.id, 'root resolved to the space');
+        });
+        test_if(capabilities.cell_gated_create, 'moderation is set per `moderation_required` (post → pending+private, react → approved)', async () => {
+            const fixture = await setup_test();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const participant = await fixture.create_account({
+                username: 'mod_participant',
+                roles: [PARTICIPATION_ROLE],
+            });
+            // `post` requires moderation → born pending + forced private.
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id, visibility: 'public' }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.moderation, 'pending', 'gated post is born pending');
+            assert.strictEqual(post.cell.visibility, 'private', 'a pending contribution is forced private until approved');
+            // `react` does not require moderation → born approved at the author's visibility.
+            const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, visibility: 'public' }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(react.cell.moderation, 'approved', 'unmoderated kind is born approved');
+            assert.strictEqual(react.cell.visibility, 'public', "the author's visibility is honored");
+        });
+        test_if(capabilities.cell_gated_create, 'a contribution under a hidden (private) space is 404-masked (not 403)', async () => {
+            const fixture = await setup_test();
+            // A private space — only admin/owner can view it.
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
+            const stranger = await fixture.create_account({ username: 'hidden_stranger' });
+            const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
+            assert.ok(!masked.ok, 'a stranger must not contribute under a hidden space');
+            assert.strictEqual(error_reason(masked), 'cell_not_found', 'a hidden parent 404-masks the attempt (never reveals it exists)');
+        });
+        test_if(capabilities.cell_gated_create, 'a deep contribution (comment under a post) resolves policy from the governing root, not the parent', async () => {
+            const fixture = await setup_test();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const participant = await fixture.create_account({
+                username: 'deep_participant',
+                roles: [PARTICIPATION_ROLE],
+            });
+            // A post lives directly under the space — the shallow case
+            // (`root_id === parent_id`), so the handler reuses the parent row as
+            // `root_data`. The post is gated `moderation_required: true`, so it's
+            // born pending + private; the author can still view their own pending
+            // cell, so it's a valid parent for the comment below.
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.root_id, space.cell.id, 'a post roots at the space');
+            // A comment lives under the post — the DEEP case. Here
+            // `root_id !== parent_id`, so the handler must read the governing
+            // root (the space) *through* the post (the separate in-tx root read),
+            // and the authorizer must resolve `policy.comment` from the SPACE's
+            // data, not the post's. This is the only case that exercises the
+            // deep-read branch on both spines.
+            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(comment.cell.parent_id, post.cell.id, 'the immediate parent is the post');
+            assert.strictEqual(comment.cell.root_id, space.cell.id, 'the governing root resolves to the space (deep read through the post), not the post');
+            assert.strictEqual(comment.cell.moderation, 'approved', 'the comment policy (moderation_required: false) resolved from the space, not the post');
+        });
+    });
+};
+/**
+ * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
+ * approved | rejected` transition) — root-authority-gated.
+ *
+ * Builds a moderated public space (admin) + a `participant`'s `post` (born
+ * `pending` + private under the `moderation_required: true` policy), then
+ * proves both spines agree:
+ *
+ * - **a root manager (admin) approves** → `moderation: 'approved'` +
+ *   `visibility: 'public'` (the contribution goes live).
+ * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
+ *   author can *view* their own pending cell, so they reach the gate, and are
+ *   denied — moderation authority is over the governing root, not the
+ *   contribution).
+ * - **a non-viewer is 404-masked** → a stranger who can't see the pending
+ *   contribution gets `cell_not_found`, never learns it exists.
+ * - **reject** → `moderation: 'rejected'`, visibility stays private.
+ *
+ * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
+ * exists when the directory authorizer is mounted (reference spine binaries).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ */
+export const describe_cell_moderate_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    // Build an admin-owned public space (moderated `post` policy) + a
+    // participant's pending post under it.
+    const setup_pending_post = async () => {
+        const fixture = await setup_test();
+        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+        const author = await fixture.create_account({
+            username: 'moderate_author',
+            roles: [PARTICIPATION_ROLE],
+        });
+        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
+        return { fixture, author, post };
+    };
+    describe('cell_moderate verb parity (root-authority-gated)', () => {
+        test_if(capabilities.cell_gated_create, 'a root manager (admin) approves a pending post → approved + public', async () => {
+            const { fixture, post } = await setup_pending_post();
+            assert.strictEqual(post.cell.moderation, 'pending', 'the post is born pending');
+            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, fixture.create_session_headers()), CellModerateOutput);
+            assert.strictEqual(moderated.cell.moderation, 'approved', 'approval sets the marker');
+            assert.strictEqual(moderated.cell.visibility, 'public', 'approval publishes the post');
+        });
+        test_if(capabilities.cell_gated_create, 'the author (non-manager) cannot moderate their own pending post → 403', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, author.create_session_headers());
+            assert.ok(!denied.ok, 'the author must not self-approve');
+            assert.strictEqual(error_reason(denied), 'cell_moderate_forbidden');
+        });
+        test_if(capabilities.cell_gated_create, 'a non-viewer is 404-masked from moderating a pending post', async () => {
+            const { fixture, post } = await setup_pending_post();
+            const stranger = await fixture.create_account({ username: 'moderate_stranger' });
+            const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, stranger.create_session_headers());
+            assert.ok(!masked.ok, 'a non-viewer must not moderate');
+            assert.strictEqual(error_reason(masked), 'cell_not_found', 'a non-viewer never learns the pending post exists');
+        });
+        test_if(capabilities.cell_gated_create, 'a root manager rejects a pending post → rejected, stays private', async () => {
+            const { fixture, post } = await setup_pending_post();
+            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'rejected' }, fixture.create_session_headers()), CellModerateOutput);
+            assert.strictEqual(moderated.cell.moderation, 'rejected', 'rejection sets the marker');
+            assert.strictEqual(moderated.cell.visibility, 'private', 'rejection leaves the post private');
+        });
+    });
+};

package/dist/testing/cross_backend/cell_grant_role.js

@@ -59,7 +59,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const stranger = await fixture.create_account({ username: 'cell_role_stranger' });
             // Owner creates a private cell (default visibility) and grants
             // view access to anyone holding CELL_EDITOR_ROLE.
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'viewer', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
             // Holder of the role is admitted through the role-shaped grant.
@@ -76,7 +76,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const t = fixture.transport;
             const owner = await fixture.create_account({ username: 'cell_unknown_role_owner' });
             const owner_h = owner.create_session_headers();
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const denied = await cross_rpc_call(t, rpc_path, 'cell_grant_create', {
                 cell_id: created.cell.id,
                 level: 'viewer',
@@ -92,10 +92,10 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const owner_h = owner.create_session_headers();
             const holder = fixture.extra_accounts[CELL_ROLE_HOLDER_USERNAME];
             assert.ok(holder, `fixture must seed the ${CELL_ROLE_HOLDER_USERNAME} extra account`);
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'editor', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
-            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { kind: 'note', label: 'by role editor' } }, holder.create_session_headers()), CellUpdateOutput);
+            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'by role editor' } }, holder.create_session_headers()), CellUpdateOutput);
             assert.strictEqual(edited.cell.updated_by, holder.actor.id, 'edit attributed to the holder');
         });
     });

package/dist/testing/cross_backend/cell_relations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqF9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAsFzD,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IAyvBvF,CAAC"}
+{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqF9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAsFzD,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IA+vBvF,CAAC"}