@fuzdev/fuz_app 0.143.0 → 0.144.0

package/dist/db/fact_store.js

@@ -1,8 +1,8 @@
 /**
- * PG-backed `FactStore` implementation.
+ * PG-backed `HeldFactStore` implementation.
  *
  * Wraps the raw queries in `db/fact_queries.ts` with the lifecycle the
- * `FactStore` interface promises:
+ * `HeldFactStore` interface promises:
  *
  * - sync hash on `put`; `put_stream` hashes as it streams
  * - idempotent insert (`ON CONFLICT DO NOTHING` in the queries layer)
@@ -33,18 +33,32 @@
  * `external_url` has any other shape, and any external row on a store with no
  * disk CAS configured, as unavailable: a warning and `null`.
  *
+ * ## Holders
+ *
+ * Every put names its holder (`HeldFactPutOptions.holder`): the actor whose
+ * request carried the bytes, or `null` for a system put (seeds, server-side
+ * imports). A named holder gets a `fact_holder` row on every put — a
+ * deduplicated put included, since bringing identical bytes is possession. The
+ * `fact` row, its refs, and the holder row commit in one transaction. Cell ref
+ * admission (`auth/cell_ref_admission.ts`) reads the holder rows. The holder is
+ * a spine concept, so `PgFactStore` implements `HeldFactStore` — the
+ * `@fuzdev/fuz_util` `FactStore` reads plus puts that take `HeldFactPutOptions` —
+ * rather than the backend-agnostic `FactStore`, whose puts name no actor.
+ *
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { fact_hash_bytes, fact_hash_verify, fact_hash_extract_refs } from '@fuzdev/fuz_util/fact_hash.ts';
 import { query_delete_fact, query_get_fact, query_get_fact_meta, query_get_fact_refs, query_has_fact, query_put_fact, query_put_fact_refs } from './fact_queries.js';
+import { query_put_fact_holder } from './fact_holder_queries.js';
 import { is_file_fact_url } from './file_fact_url.js';
 import { read_fact_bytes_from_disk, stream_fact_to_disk, write_fact_bytes_to_disk } from './fact_disk_storage.js';
 /** Default embedded-vs-referenced cutoff (1 MiB). */
 export const FACT_EMBEDDED_THRESHOLD_DEFAULT = 1024 * 1024;
 /**
- * PG-backed `FactStore`. Delegates to `db/fact_queries.ts` for I/O and adds
- * the lifecycle layer described in the module doc.
+ * PG-backed fact store. Delegates to `db/fact_queries.ts` for I/O and adds
+ * the lifecycle layer described in the module doc. Implements `HeldFactStore`:
+ * the `@fuzdev/fuz_util` `FactStore` reads, puts taking `HeldFactPutOptions`.
  */
 export class PgFactStore {
     #deps;
@@ -65,7 +79,10 @@ export class PgFactStore {
      * are configured) at `<facts_dir>/<shard>/<rest>` with a `file:` URL. Oversize
      * without a disk root throws: the store has nowhere to put bytes it cannot
      * embed. Idempotent — `ON CONFLICT DO NOTHING` + content-addressed disk
-     * filenames make a re-write a no-op.
+     * filenames make a re-write a no-op. `options.holder`, when set, is recorded
+     * as a holder on a fresh insert and a dedup hit alike.
+     *
+     * @mutates fact_holder - records `options.holder` (when non-null) in the transaction that writes the `fact` row
      */
     async put(bytes, options) {
         const hash = fact_hash_bytes(bytes);
@@ -82,16 +99,13 @@ export class PgFactStore {
             row_bytes = bytes;
             row_external_url = null;
         }
-        const inserted = await query_put_fact(this.#deps, {
+        await this.#insert_row({
             hash,
             bytes: row_bytes,
             external_url: row_external_url,
-            content_type: options?.content_type ?? null,
+            content_type: options.content_type ?? null,
             size: bytes.length
-        });
-        if (inserted) {
-            await query_put_fact_refs(this.#deps, hash, resolve_refs(bytes, options));
-        }
+        }, resolve_refs(bytes, options), options.holder);
         return hash;
     }
     /**
@@ -109,7 +123,9 @@ export class PgFactStore {
      *
      * Requires `fs` (and, for the over-threshold spill, `disk_root`) to be
      * configured. The streaming twin of `put`; mirrors the Rust
-     * `FactStore::put_stream`.
+     * `FactStore::put_stream`. Records `options.holder` the way `put` does.
+     *
+     * @mutates fact_holder - records `options.holder` (when non-null) in the transaction that writes the `fact` row
      */
     async put_stream(stream, max_bytes, options) {
         if (this.#fs === undefined) {
@@ -118,18 +134,31 @@ export class PgFactStore {
         const streamed = await stream_fact_to_disk(this.#fs, this.#disk_root, stream, max_bytes, this.#embedded_threshold);
         const row_bytes = streamed.placement.kind === 'embedded' ? streamed.placement.bytes : null;
         const row_external_url = streamed.placement.kind === 'disk' ? streamed.placement.external_url : null;
-        const inserted = await query_put_fact(this.#deps, {
+        await this.#insert_row({
             hash: streamed.hash,
             bytes: row_bytes,
             external_url: row_external_url,
-            content_type: options?.content_type ?? null,
+            content_type: options.content_type ?? null,
             size: streamed.size
-        });
-        if (inserted && options?.refs && options.refs.length > 0) {
-            await query_put_fact_refs(this.#deps, streamed.hash, options.refs);
-        }
+        }, options.refs ?? [], options.holder);
         return { hash: streamed.hash, sha256: streamed.sha256, size: streamed.size };
     }
+    /**
+     * Insert the `fact` row, then — in the same transaction — its refs (fresh
+     * insert only) and the holder row (every put, a dedup hit included). Shared
+     * by `put` and `put_stream`; twin of the Rust `PgFactStore::insert_row`.
+     */
+    async #insert_row(row, refs, holder) {
+        await this.#deps.db.transaction(async (db) => {
+            const inserted = await query_put_fact({ db }, row);
+            if (inserted && refs.length > 0) {
+                await query_put_fact_refs({ db }, row.hash, refs);
+            }
+            if (holder !== null) {
+                await query_put_fact_holder({ db }, holder, row.hash);
+            }
+        });
+    }
     /**
      * Retrieve bytes. Embedded reads return PG bytes directly. An external
      * read comes from the disk CAS and nowhere else: the bytes at the row's
@@ -219,9 +248,9 @@ export class PgFactStore {
  * from JSON content; otherwise no refs.
  */
 const resolve_refs = (bytes, options) => {
-    if (options?.refs !== undefined)
+    if (options.refs !== undefined)
         return options.refs;
-    if (options?.content_type !== 'application/json')
+    if (options.content_type !== 'application/json')
         return [];
     let value;
     try {

package/dist/server/serve_fact_route.d.ts

@@ -41,6 +41,25 @@
  * hash. B publishing identical bytes from B's public cell makes them
  * readable *via B's cell* — it never touches A's private reference.
  *
+ * The edge is only as safe as what may create it. A cell's `refs` derive
+ * from its `data`, and any account that can write a cell writes its `data` —
+ * so this route alone would make a known hash a read capability: name it in
+ * a cell you own, flip the cell public, and the bytes serve to the world,
+ * while a 200 against a 404 says whether the fact exists. What closes that is
+ * **possession-gated ref admission** on the cell verbs
+ * (`auth/cell_ref_admission.ts`): a non-admin `cell_create` / `cell_update` /
+ * `cell_clone` may introduce a ref only to a fact its acting actor holds —
+ * one it put the bytes of, recorded in `fact_holder` on every put, a
+ * deduplicated put included — and is refused `403 cell_ref_not_held`
+ * otherwise, the same answer whether or not a fact is stored. Refs a cell
+ * already carries stay admitted through updates and clones, so a viewer who
+ * clones a cell carries its refs: what a viewer can read through a cell, it
+ * can republish — no more than downloading the bytes and uploading them
+ * again. A serve is a snapshot of the edge at read time; revoking someone's
+ * access to a cell does not withdraw refs they already wrote elsewhere.
+ * Writers that bypass the verbs (seeds, raw inserts) are trusted and not
+ * admitted.
+ *
  * The bare-hash route is **admin-only**: an admin's reach already spans
  * every cell, so serving by bare hash grants no escalation. Non-admin
  * callers are rejected at the auth phase and never reach the handler.
@@ -64,10 +83,11 @@
  * don't distinguish 403 from 404 — neither the existence of a fact nor the
  * existence of a cell→fact edge should leak through the public surface.
  *
- * Content-addressed serving of inline `blake3:` images (a markdown doc cell
- * with embedded image refs) works through this model: the referencing cell
- * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
- * → serve.
+ * A ref is a `data` string value that is exactly a fact hash
+ * (`derive_cell_refs`) — a hash inside prose or markup is not one. So a doc
+ * cell that shows images stores each image's hash as its own string value
+ * (an attachment list, say) beside the text that places them; serving then
+ * goes view-doc-cell → doc-cell-refs-include-hash → serve.
  *
  * ## Untrusted-content hardening
  *

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAkHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkHG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAkHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -41,6 +41,25 @@
  * hash. B publishing identical bytes from B's public cell makes them
  * readable *via B's cell* — it never touches A's private reference.
  *
+ * The edge is only as safe as what may create it. A cell's `refs` derive
+ * from its `data`, and any account that can write a cell writes its `data` —
+ * so this route alone would make a known hash a read capability: name it in
+ * a cell you own, flip the cell public, and the bytes serve to the world,
+ * while a 200 against a 404 says whether the fact exists. What closes that is
+ * **possession-gated ref admission** on the cell verbs
+ * (`auth/cell_ref_admission.ts`): a non-admin `cell_create` / `cell_update` /
+ * `cell_clone` may introduce a ref only to a fact its acting actor holds —
+ * one it put the bytes of, recorded in `fact_holder` on every put, a
+ * deduplicated put included — and is refused `403 cell_ref_not_held`
+ * otherwise, the same answer whether or not a fact is stored. Refs a cell
+ * already carries stay admitted through updates and clones, so a viewer who
+ * clones a cell carries its refs: what a viewer can read through a cell, it
+ * can republish — no more than downloading the bytes and uploading them
+ * again. A serve is a snapshot of the edge at read time; revoking someone's
+ * access to a cell does not withdraw refs they already wrote elsewhere.
+ * Writers that bypass the verbs (seeds, raw inserts) are trusted and not
+ * admitted.
+ *
  * The bare-hash route is **admin-only**: an admin's reach already spans
  * every cell, so serving by bare hash grants no escalation. Non-admin
  * callers are rejected at the auth phase and never reach the handler.
@@ -64,10 +83,11 @@
  * don't distinguish 403 from 404 — neither the existence of a fact nor the
  * existence of a cell→fact edge should leak through the public surface.
  *
- * Content-addressed serving of inline `blake3:` images (a markdown doc cell
- * with embedded image refs) works through this model: the referencing cell
- * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
- * → serve.
+ * A ref is a `data` string value that is exactly a fact hash
+ * (`derive_cell_refs`) — a hash inside prose or markup is not one. So a doc
+ * cell that shows images stores each image's hash as its own string value
+ * (an attachment list, say) beside the text that places them; serving then
+ * goes view-doc-cell → doc-cell-refs-include-hash → serve.
  *
  * ## Untrusted-content hardening
  *

package/dist/testing/CLAUDE.md

@@ -968,7 +968,9 @@ source of truth for wire-shape conformance.
   gates `describe_fact_serving_cross_tests` (the cell-scoped per-reference +
   admin-only bare-hash fact-serving parity suite); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
-  the `_testing_put_fact` seeder. `ready` gates `describe_ready_cross_tests`
+  the `_testing_put_fact` seeder (whose optional `holder` records a
+  `fact_holder` row, so a non-admin can reference what it seeds) — it also
+  gates `describe_cell_ref_admission_cross_tests`. `ready` gates `describe_ready_cross_tests`
   (anonymous `GET /ready` → `200 {ready: true}` on a clean spine bootstrap);
   like cells/sse the `/ready` deploy gate stays off the declared surface, `true`
   on every spine that live-mounts it over the shared `expected_schema.json`.
@@ -1640,6 +1642,28 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   complete action list plus its own spec. Daemon-token-gated like its siblings;
   the Rust mirror is `fuz_testing::create_testing_action_manifest_action_spec`.
 
+### Cell ref admission parity — `cross_backend/cell_ref_admission.ts`
+
+`describe_cell_ref_admission_cross_tests({setup_test, capabilities, rpc_path?})`
+— possession-gated ref admission over real HTTP: a non-admin `cell_create`
+naming a stored fact it never put and one naming an unstored hash get one
+identical `403 cell_ref_not_held` (status + error body); a system-put fact is
+refused too; the uploader's public cell serves the bytes to anyone; a second
+actor putting identical bytes becomes a holder; an editor keeps refs another
+writer introduced and is refused adding (or restoring a dropped) unheld one; a
+shallow and a deep clone carry each row's source refs, while a patch adding an
+unheld ref or moving a child's ref onto the root is refused; the keeper (a
+global admin) is ungated; a grantee who read a fact through a granted cell
+can't name its hash in a cell of its own, before or after the revoke; the ref
+grammar is exact (prose, markup, `blake3:zz`, uppercase, object keys are not
+refs); and a hidden cell's update, a create under a hidden parent, and a clone
+of a hidden source answer `404` whatever `data` names. Facts are put through
+`cross_put_fact` (exported by `fact_serving.ts`), whose `holder` maps onto
+`_testing_put_fact`'s optional `holder` key. Gated on
+`capabilities.fact_serving`; cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/cell_ref_admission.cross.test.ts`; the in-process
+cases are `src/test/auth/cell_ref_admission{,.fact_less}.db.test.ts`.
+
 ### Token-scope surface parity — `cross_backend/token_scope_surface.ts`
 
 `describe_token_scope_surface_cross_tests({setup_test, capabilities, rpc_path?,

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6fF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IAggBF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -100,14 +100,17 @@ export const describe_cell_crud_cross_tests = (options) => {
         });
         test_if(capabilities.cell_crud, 'refs are deduped and lexicographically sorted (deterministic, cross-impl-identical)', async () => {
             const fixture = await setup_test();
-            const owner = await fixture.create_account({ username: 'cell_refs_owner' });
             const t = fixture.fresh_transport();
-            const owner_headers = owner.create_session_headers();
+            // The keeper — a global admin, whom ref admission doesn't gate — so
+            // fabricated hashes nobody holds are writable refs (a non-admin
+            // writing them is `cell_ref_not_held`, the admission suite's
+            // subject), and the case runs on backends without the fact chain.
+            const owner_headers = fixture.create_session_headers();
             // Three valid distinct fact hashes that sort a < b < c, embedded in
             // `data` in a deliberately unsorted, nested, duplicated order. Both
             // spines must derive `refs` as the sorted [a, b, c] regardless of
             // traversal order or `HashSet` iteration — the byte-identical
-            // cross-backend contract (Rust `extract_refs` ↔ TS `derive_refs`).
+            // cross-backend contract (Rust `extract_refs` ↔ TS `derive_cell_refs`).
             const ref_a = `blake3:${'a'.repeat(64)}`;
             const ref_b = `blake3:${'b'.repeat(64)}`;
             const ref_c = `blake3:${'c'.repeat(64)}`;

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA25BF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAs6BF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -241,37 +241,48 @@ export const describe_cell_gated_create_cross_tests = (options) => {
 export const describe_cell_moderate_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    // Seed `content` as an embedded fact the author holds (as their upload
+    // would) — a non-admin cell may reference only a fact its writer holds —
+    // and return the post `data` referencing it, `{}` for no fact.
+    const author_post_data = async (fixture, author, post_fact_content) => {
+        if (post_fact_content === undefined)
+            return { post_data: {}, hash: null };
+        const { hash } = expect_output(await cross_rpc_call(
+        // origin-free — the daemon-token middleware discards the credential beside an `Origin`
+        fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', { content: post_fact_content, holder: author.actor.id }, fixture.create_daemon_token_headers()), TestingPutFactOutput);
+        return { post_data: { cover: hash }, hash };
+    };
     // Build an admin-owned public space (moderated `post` policy) + a
-    // participant's pending post under it.
-    const setup_pending_post_on = async (fixture, post_data = {}) => {
+    // participant's pending post under it, optionally carrying a fact the
+    // author put.
+    const setup_pending_post_on = async (fixture, post_fact_content) => {
         const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'moderate_author',
             roles: [PARTICIPATION_ROLE]
         });
+        const { post_data, hash } = await author_post_data(fixture, author, post_fact_content);
         const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
-        return { fixture, space, author, post };
+        return { fixture, space, author, post, hash };
     };
     const setup_pending_post = async () => setup_pending_post_on(await setup_test());
     // A non-admin's policy root (a parentless non-`space` kind stays open under
     // the test authorizer, and contributions read the policy off any root) + a
-    // participant's pending post under it.
-    const setup_stewarded_post_on = async (fixture, post_data = {}) => {
+    // participant's pending post under it, optionally carrying a fact the author
+    // put.
+    const setup_stewarded_post_on = async (fixture, post_fact_content) => {
         const root_owner = await fixture.create_account({ username: 'steward_root_owner' });
         const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'steward_author',
             roles: [PARTICIPATION_ROLE]
         });
+        const { post_data, hash } = await author_post_data(fixture, author, post_fact_content);
         const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: root.cell.id }, author.create_session_headers()), CellCreateOutput);
         assert.strictEqual(post.cell.moderation, 'pending', "the root's policy gates the post");
-        return { fixture, root, root_owner, author, post };
+        return { fixture, root, root_owner, author, post, hash };
     };
     const setup_stewarded_post = async () => setup_stewarded_post_on(await setup_test());
-    /** Seed an embedded fact over the daemon channel; returns its `blake3:` hash. */
-    const put_fact = async (fixture, content) => expect_output(await cross_rpc_call(
-    // origin-free — the daemon-token middleware discards the credential beside an `Origin`
-    fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', { content }, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
     /** The status of a fact GET — `null` headers = anon. */
     const fact_status = async (fixture, path, headers) => {
         const transport = headers === null ? fixture.fresh_transport({ origin: null }) : fixture.transport;
@@ -507,9 +518,8 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.deepStrictEqual(await reach(author_h), everywhere, 'author, rejected');
         });
         test_if(capabilities.cell_gated_create && capabilities.fact_serving, "a pending post's fact is 404 to anon, even flipped public; live once approved", async () => {
-            const fixture = await setup_test();
-            const hash = await put_fact(fixture, 'pending-post-fact');
-            const { author, post } = await setup_pending_post_on(fixture, { cover: hash });
+            const { fixture, author, post, hash } = await setup_pending_post_on(await setup_test(), 'pending-post-fact');
+            assert.ok(hash !== null);
             await set_visibility(fixture, author.create_session_headers(), post.cell.id, 'public');
             const path = `/api/cells/${post.cell.id}/facts/${hash}`;
             assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
@@ -569,9 +579,8 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found', 'anon');
         });
         test_if(capabilities.cell_gated_create && capabilities.fact_serving, "the root owner fetches a pending post's fact; anon 404", async () => {
-            const fixture = await setup_test();
-            const hash = await put_fact(fixture, 'stewarded-post-fact');
-            const { root_owner, post } = await setup_stewarded_post_on(fixture, { cover: hash });
+            const { fixture, root_owner, post, hash } = await setup_stewarded_post_on(await setup_test(), 'stewarded-post-fact');
+            assert.ok(hash !== null);
             const path = `/api/cells/${post.cell.id}/facts/${hash}`;
             assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
             assert.strictEqual(await fact_status(fixture, path, root_owner.create_session_headers()), 200, 'steward');

package/dist/testing/cross_backend/cell_ref_admission.d.ts

@@ -0,0 +1,4 @@
+import '../assert_dev_env.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+export declare const describe_cell_ref_admission_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
+//# sourceMappingURL=cell_ref_admission.d.ts.map

package/dist/testing/cross_backend/cell_ref_admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cell_ref_admission.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_ref_admission.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AA6B1E,eAAO,MAAM,uCAAuC,GACnD,SAAS,uCAAuC,KAC9C,IA8eF,CAAC"}