@fuzdev/fuz_app 0.149.0 → 0.150.0

package/dist/testing/cross_backend/cell_ref_admission.js

@@ -31,7 +31,9 @@ import '../assert_dev_env.js';
  *
  * Facts are put through `_testing_put_fact`, with `holder` naming the actor a
  * real upload would record. Gated on `capabilities.fact_serving` (the
- * seeder + the serve routes); runs under every `cross_backend_*` project.
+ * seeder + the serve routes), and the cases driving a grant, item, or clone
+ * verb on `capabilities.cell_relations` as well; runs under every
+ * `cross_backend_*` project.
  *
  * @module
  */
@@ -101,7 +103,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             }), uploaded);
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { cover: uploaded } }, bob_headers), CellCreateOutput);
         });
-        test_if(capabilities.fact_serving, 'update keeps existing refs and refuses new unheld ones', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'update keeps existing refs and refuses new unheld ones', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_upd_alice' });
             const bob = await fixture.create_account({ username: 'ref_upd_bob' });
@@ -135,7 +137,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'dropped' } }, bob_headers), CellUpdateOutput);
             assert_not_held(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { cover: alices } }, bob_headers), 'update restoring a dropped ref');
         });
-        test_if(capabilities.fact_serving, 'clone carries source refs per row without holding them', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'clone carries source refs per row without holding them', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_clone_alice' });
             const bob = await fixture.create_account({ username: 'ref_clone_bob' });
@@ -184,7 +186,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
                 assert.deepStrictEqual(created.cell.refs, [named]);
             }
         });
-        test_if(capabilities.fact_serving, 'a revoked grantee cannot re-reference a fact it read', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'a revoked grantee cannot re-reference a fact it read', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_rev_alice' });
             const bob = await fixture.create_account({ username: 'ref_rev_bob' });
@@ -242,17 +244,21 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             const prose = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: not_refs }, bob.create_session_headers()), CellCreateOutput);
             assert.strictEqual(prose.cell.refs, null);
         });
-        test_if(capabilities.fact_serving, 'ref admission answers after the 404 masks', async () => {
+        /** Alice's private cell over her own fact, which Bob cannot see. */
+        const setup_hidden_cell = async (prefix) => {
             const fixture = await setup_test();
-            const alice = await fixture.create_account({ username: 'ref_mask_alice' });
-            const bob = await fixture.create_account({ username: 'ref_mask_bob' });
+            const alice = await fixture.create_account({ username: `${prefix}_alice` });
+            const bob = await fixture.create_account({ username: `${prefix}_bob` });
             const t = fixture.fresh_transport();
-            const bob_headers = bob.create_session_headers();
             const alices = await cross_put_fact(fixture, rpc_path, {
-                content: 'alice hidden bytes',
+                content: `${prefix} hidden bytes`,
                 holder: alice.actor.id
             });
             const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { file: alices }, visibility: 'private' }, alice.create_session_headers()), CellCreateOutput).cell.id;
+            return { t, bob_headers: bob.create_session_headers(), alices, hidden };
+        };
+        test_if(capabilities.fact_serving, 'ref admission answers after the 404 masks', async () => {
+            const { t, bob_headers, alices, hidden } = await setup_hidden_cell('ref_mask');
             // An update of a hidden cell answers its mask whatever `data` names —
             // an unheld new ref or the hidden cell's own ref alike.
             for (const named of [UNSTORED_HASH, alices]) {
@@ -261,6 +267,9 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             }
             const under = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { file: UNSTORED_HASH }, parent_id: hidden }, bob_headers);
             assert.strictEqual(error_reason(under), 'cell_not_found', 'create under a hidden parent');
+        });
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'clone ref admission answers after the 404 mask', async () => {
+            const { t, bob_headers, hidden } = await setup_hidden_cell('ref_clone_mask');
             const clone = await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: hidden, with_data_patch: { extra: UNSTORED_HASH } }, bob_headers);
             assert.strictEqual(error_reason(clone), 'cell_not_found', 'clone of a hidden source');
         });

package/dist/testing/cross_backend/conformance_table.d.ts

@@ -154,6 +154,11 @@ export interface SendConformanceCaseOptions {
     readonly resolved_rpc_endpoints: ReturnType<typeof resolve_rpc_endpoints_for_setup>;
     /** Send the request as a frame on a socket at this endpoint instead of over HTTP. */
     readonly ws?: WsEndpointTarget;
+    /**
+     * Headers added to the HTTP request beneath the principal's, which win on
+     * a name clash. Not sent on the WS leg (a frame carries no headers).
+     */
+    readonly request_headers?: Readonly<Record<string, string>>;
 }
 /** The spec a sent case resolved to — the RPC action, or the REST route. */
 export type ConformanceCaseTarget = {

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8C9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAe,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,+BAA+B,EAC/B,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAGN,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,8BAA8B;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,8BAA8B,KACrC,KAAK,CAAC,eAAe,CAKvB,CAAC;AAkBF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,GAAG,eAAe,KAAG,OAIf,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,WAAW,EACpB,IAAI,oBAAoB,EACxB,aAAa,0BAA0B,EACvC,yBAAwB,UAAU,CAAC,OAAO,+BAA+B,CAAM,KAC7E,OAAO,CAAC,4BAA4B,CAmJtC,CAAC;AA4CF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AA0BF,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC;IACpF,qFAAqF;IACrF,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,eAAe,EAClB,SAAS,0BAA0B,KACjC,OAAO,CAAC,uBAAuB,CAuEjC,CAAC;AAsNF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAuEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8C9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAe,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,+BAA+B,EAC/B,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAGN,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,8BAA8B;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,8BAA8B,KACrC,KAAK,CAAC,eAAe,CAKvB,CAAC;AAkBF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,GAAG,eAAe,KAAG,OAIf,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,WAAW,EACpB,IAAI,oBAAoB,EACxB,aAAa,0BAA0B,EACvC,yBAAwB,UAAU,CAAC,OAAO,+BAA+B,CAAM,KAC7E,OAAO,CAAC,4BAA4B,CAmJtC,CAAC;AA4CF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AA0BF,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC;IACpF,qFAAqF;IACrF,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,eAAe,EAClB,SAAS,0BAA0B,KACjC,OAAO,CAAC,uBAAuB,CA2EjC,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAuEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -391,13 +391,16 @@ const is_success_status = (status) => status >= 200 && status < 300;
  *   auth routes
  */
 export const send_conformance_case = async (c, options) => {
-    const { fixture, surface_source, principals, resolved_rpc_endpoints, ws } = options;
+    const { fixture, surface_source, principals, resolved_rpc_endpoints, ws, request_headers } = options;
     if (ws && !is_ws_conformance_case(c)) {
         throw new Error(`conformance: case '${c.name}' cannot run over a WebSocket (is_ws_conformance_case) — ` +
             `filter the cases before sending them on the WS leg.`);
     }
     const principal = await resolve_conformance_principal(fixture, c.request.as, principals, resolved_rpc_endpoints);
-    const { transport, headers, suppress_default_origin } = principal;
+    const { transport, suppress_default_origin } = principal;
+    const headers = request_headers
+        ? { ...request_headers, ...principal.headers }
+        : principal.headers;
     const params = c.request.acting
         ? bind_acting(c, resolve_acting_binding(c, c.request.acting, fixture, principal))
         : c.request.params;
@@ -461,15 +464,14 @@ const CONFORMANCE_REQUEST_ID = 'test';
  * The upgrade carries the principal's headers (its cookie, bearer or daemon
  * token) and the `Origin` the HTTP leg would send: none for a principal that
  * suppresses it, the target's otherwise. It also names the principal's own
- * actor as `?acting=`. Only the TS spine resolves an actor at the upgrade,
- * refusing a multi-actor account's upgrade without one (400
- * `actor_required`); the Rust spine's upgrade resolves the account and
- * ignores `?acting=`. Per-frame dispatch resolves the actor from each frame's
+ * actor as `?acting=`, which both spines resolve at the upgrade (a
+ * multi-actor account's upgrade without one is refused 400
+ * `actor_required`). Per-frame dispatch resolves the actor from each frame's
  * own `acting` on both. Because the leg always sends `?acting=`, it does not
- * cover that upgrade-level difference — the front-door table's multi-actor
- * row does. The socket closes afterwards; a
- * close error is not the case's subject (a request that revokes its own
- * credential closes the socket after its reply).
+ * cover the upgrade's own refusal — the front-door table's multi-actor row
+ * does. The socket closes afterwards; a close error is not the case's subject
+ * (a request that revokes its own credential closes the socket after its
+ * reply).
  */
 const send_ws_frame = async (method, params, principal, ws) => {
     const client = await create_admitted_ws_transport({

package/dist/testing/cross_backend/differential.d.ts

@@ -6,6 +6,13 @@ import type { ConformanceCase } from './conformance_case.js';
 import { type ConformancePrincipalConfig } from './conformance_table.js';
 import type { SetupTest } from './setup.js';
 import type { WsEndpointTarget } from './ws_endpoint.js';
+/**
+ * Headers every HTTP request the differential sends carries, beneath the
+ * principal's: `accept-encoding: identity`, so each backend answers
+ * uncompressed and a runtime's own compression (`Deno.serve` compresses for a
+ * request that accepts gzip) never reads as a header difference.
+ */
+export declare const DIFFERENTIAL_REQUEST_HEADERS: Readonly<Record<string, string>>;
 /** One side of the differential. */
 export interface DifferentialBackend {
     /** Short label used in failure output (`ts`, `rust`). */

package/dist/testing/cross_backend/differential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"differential.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/differential.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6C9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAIN,KAAK,0BAA0B,EAC/B,MAAM,wBAAwB,CAAC;AAShC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG;IACpD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;CACnE,CAAC;AAEF,6DAA6D;AAC7D,MAAM,WAAW,8BAA8B;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACvE,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,oDAAoD;IACpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,aAAa,CAAC,eAAe,CAAC,EACrC,QAAQ,aAAa,CAAC,eAAe,CAAC,KACpC,KAAK,CAAC,MAAM,CA0Bd,CAAC;AA6BF;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,8BAA8B,KACrC,IA0GF,CAAC"}
+{"version":3,"file":"differential.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/differential.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoD9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAIN,KAAK,0BAA0B,EAC/B,MAAM,wBAAwB,CAAC;AAShC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE,CAAC;AAEF,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG;IACpD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;CACnE,CAAC;AAEF,6DAA6D;AAC7D,MAAM,WAAW,8BAA8B;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACvE,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,oDAAoD;IACpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,aAAa,CAAC,eAAe,CAAC,EACrC,QAAQ,aAAa,CAAC,eAAe,CAAC,KACpC,KAAK,CAAC,MAAM,CA0Bd,CAAC;AA6BF;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,8BAA8B,KACrC,IA2GF,CAAC"}

package/dist/testing/cross_backend/differential.js

@@ -19,6 +19,13 @@ import '../assert_dev_env.js';
  * each backend's conformance leg already holds them; the differential holds
  * the two answers to each other.
  *
+ * Every HTTP request asks for an uncompressed response
+ * (`DIFFERENTIAL_REQUEST_HEADERS`): content negotiation is the transport's,
+ * not the app's — Deno's `Deno.serve` compresses a response whose request
+ * accepts gzip, as Node's `fetch` sends by default, while other servers send
+ * it as is — so letting a server choose would read as a `content-encoding` and
+ * `vary` difference on every case.
+ *
  * A difference that is tracked and accepted goes in the **known-divergence
  * ledger** (`KnownDivergence`), matched by case names or by methods, naming
  * the paths that differ (`what_differs`), each optionally with the value each
@@ -42,6 +49,15 @@ import '../assert_dev_env.js';
 import { assert, describe, test } from 'vitest';
 import { is_ws_conformance_case, resolve_conformance_rpc_endpoints, send_conformance_case } from './conformance_table.js';
 import { diff_differential_responses, differential_path_covers, format_differential_diffs, normalize_differential_response } from './differential_normalize.js';
+/**
+ * Headers every HTTP request the differential sends carries, beneath the
+ * principal's: `accept-encoding: identity`, so each backend answers
+ * uncompressed and a runtime's own compression (`Deno.serve` compresses for a
+ * request that accepts gzip) never reads as a header difference.
+ */
+export const DIFFERENTIAL_REQUEST_HEADERS = {
+    'accept-encoding': 'identity'
+};
 const as_list = (value) => typeof value === 'string' ? [value] : value;
 /** The ledger entries matching a case. */
 const find_known_divergences = (c, ledger) => ledger.filter((d) => d.case_name !== undefined
@@ -126,6 +142,7 @@ export const describe_differential_conformance_tests = (options) => {
         surface_source,
         ...(principals && { principals }),
         resolved_rpc_endpoints,
+        request_headers: DIFFERENTIAL_REQUEST_HEADERS,
         ...(backend.ws && { ws: backend.ws })
     }));
     describe(options.suite_name ?? 'differential conformance', () => {

package/dist/testing/cross_backend/expected_schema.json

@@ -72,6 +72,7 @@
 		"moderation",
 		"parent_id",
 		"path",
+		"policy",
 		"refs",
 		"root_id",
 		"updated_at",

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkC7D,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA2CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,eAAe,CAOvE,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkC7D,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA4CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,eAAe,CAOvE,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -56,10 +56,11 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         // Mount the directory-model `cell_gated_create` test policy (twin of the
         // Rust stub's `TestCellGatedCreateAuthorize`) so the cross-backend
         // authorizer-parity suite has a known gate: `kind: 'space'` roots are
-        // admin-only, contributions are gated by the root's `data.policy`, and
-        // plain parentless creates stay open (the other cell suites are
-        // unaffected). The handler hands the governing root's `data` to the
-        // (pure) authorizer.
+        // admin-only, contributions are gated by the root's `policy`, and plain
+        // parentless creates stay open (the other cell suites are unaffected).
+        // The handler hands the governing root's `policy` to the (pure)
+        // authorizer, whose `validate_policy` accepts or refuses each policy
+        // write.
         ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),

package/dist/testing/cross_backend/role_grant_offer_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAMxE,qEAAqE;AACrE,MAAM,WAAW,uCAAwC,SAAQ,wBAAwB;IACxF;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAyRF,CAAC"}
+{"version":3,"file":"role_grant_offer_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAMxE,qEAAqE;AACrE,MAAM,WAAW,uCAAwC,SAAQ,wBAAwB;IACxF;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAyYF,CAAC"}

package/dist/testing/cross_backend/role_grant_offer_lifecycle.js

@@ -17,6 +17,13 @@ import '../assert_dev_env.js';
  * - **already decided → 400** `invalid_request` with reason
  *   `role_grant_offer_terminal` — a decline or retract after an accept, a
  *   second decline, a second retract, and either one after the other.
+ * - **a grantor's lost authority ends its pending offers.** Revoking a
+ *   grantor's grant, or deleting its account, supersedes every pending offer
+ *   it made — gone from the recipient's inbox, an accept answers
+ *   `role_grant_offer_terminal`, and a `role_grant_offer_supersede` row records
+ *   it (`role_grant_revoked` with the grant as cause, `account_deleted` with
+ *   the account). The keeper's own `admin` grant refuses a revoke, 403
+ *   `cannot_revoke_keeper_admin`.
  * - **one audit row per success, none per refusal.** A decline writes
  *   `role_grant_offer_decline` attributed to the recipient and targeting the
  *   grantor, a retract `role_grant_offer_retract` attributed to the grantor
@@ -37,11 +44,14 @@ import '../assert_dev_env.js';
  */
 import { assert, describe, test } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
-import { ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { ERROR_CANNOT_REVOKE_KEEPER_ADMIN, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { AdminAccountListOutput } from '../../auth/admin_action_specs.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { expect_output } from './cross_rpc.js';
 import { JSONRPC_INVALID_REQUEST } from '../../http/jsonrpc.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { assert_audit_metadata_fields, list_audit_events } from './audit_cross_helpers.js';
-import { create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
+import { create_active_role_grant, create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
 import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that names no offer. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
@@ -200,4 +210,66 @@ export const describe_role_grant_offer_lifecycle_cross_tests = (options) => {
             assert.strictEqual(after.retracts.length, before.retracts.length, 'no retract row added');
         });
     });
+    describe("a grantor's lost authority ends its pending offers", () => {
+        /** A grantor holding a global `admin` grant (offer authority) and its id. */
+        const setup_grantor = async (fixture, username) => {
+            const grantor = await fixture.create_account({ username });
+            const grant_id = await create_active_role_grant(fixture, grantor, {
+                role: ROLE_ADMIN,
+                rpc_path
+            });
+            return { grantor, grant_id };
+        };
+        /** The pending `role` offer `grantor` makes to `recipient`. */
+        const offer_from = (fixture, grantor, recipient) => create_pending_role_grant_offer(fixture, recipient.account.id, grantor.create_session_headers(), { role, rpc_path });
+        const assert_superseded = async (fixture, recipient, offer_id, cause) => {
+            assert.ok(!(await is_pending(fixture, recipient, offer_id)), 'gone from the recipient inbox');
+            assert_terminal(await accept(fixture, offer_id, recipient.create_session_headers()), 'an accept of the superseded offer');
+            const rows = (await list_audit_events(fixture, { event_type: 'role_grant_offer_supersede' }, rpc_path)).filter((e) => e.metadata?.offer_id === offer_id);
+            assert.strictEqual(rows.length, 1, 'one role_grant_offer_supersede row');
+            assert_audit_metadata_fields(fixture, rows[0].metadata, {
+                offer_id,
+                role,
+                scope_id: null,
+                ...cause
+            });
+        };
+        test("revoking the grantor's grant supersedes its pending offers", async () => {
+            const fixture = await setup_test();
+            const { grantor, grant_id } = await setup_grantor(fixture, 'lost_authority_revoked');
+            const recipient = await fixture.create_account({ username: 'lost_authority_to' });
+            const offer = await offer_from(fixture, grantor, recipient);
+            // another grantor's offer to the same recipient is the control
+            const control = await create_offer(fixture, recipient);
+            assert_ok(await rpc(fixture, 'role_grant_revoke', { actor_id: grantor.actor.id, role_grant_id: grant_id }, fixture.create_session_headers()), 'revoke');
+            await assert_superseded(fixture, recipient, offer.id, {
+                reason: 'role_grant_revoked',
+                cause_id: grant_id
+            });
+            assert.ok(await is_pending(fixture, recipient, control.id), "the keeper's offer stays");
+        });
+        test("deleting the grantor's account supersedes its pending offers", async () => {
+            const fixture = await setup_test();
+            const { grantor } = await setup_grantor(fixture, 'lost_authority_deleted');
+            const recipient = await fixture.create_account({ username: 'lost_authority_del_to' });
+            const offer = await offer_from(fixture, grantor, recipient);
+            assert_ok(await rpc(fixture, 'account_delete', { account_id: grantor.account.id }, fixture.create_session_headers()), 'account_delete');
+            await assert_superseded(fixture, recipient, offer.id, {
+                reason: 'account_deleted',
+                cause_id: grantor.account.id
+            });
+        });
+        test("the keeper's admin grant refuses a revoke → 403 cannot_revoke_keeper_admin", async () => {
+            const fixture = await setup_test();
+            const listed = expect_output(await rpc(fixture, 'admin_account_list', {}, fixture.create_session_headers()), AdminAccountListOutput);
+            const keeper = listed.accounts.find((a) => a.account.id === fixture.account.id);
+            const keeper_admin = keeper?.role_grants.find((g) => g.role === ROLE_ADMIN && g.scope_id === null);
+            assert.ok(keeper_admin, "the keeper's global admin grant");
+            const refused = await rpc(fixture, 'role_grant_revoke', { actor_id: fixture.actor.id, role_grant_id: keeper_admin.id }, fixture.create_session_headers());
+            assert.ok(!refused.ok, 'the keeper keeps its admin grant');
+            assert.strictEqual(refused.status, 403);
+            assert.strictEqual(refused.error.code, JSONRPC_ERROR_CODES.forbidden);
+            assert.deepStrictEqual(refused.error.data, { reason: ERROR_CANNOT_REVOKE_KEEPER_ADMIN });
+        });
+    });
 };

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -9,38 +9,37 @@ export declare const SPACE_CELL_KIND = "space";
  */
 export declare const PARTICIPATION_ROLE = "participant";
 /**
- * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * A space `policy` mirroring the test ladder: gated `post` (moderated) +
  * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
  * exists so a suite can create a comment under a post (`root_id !==
  * parent_id`) and prove the policy resolves from the governing root (the
  * space), not the immediate parent. Shared by the gated-create and moderate
- * cross suites.
+ * cross suites, which pass it as a root's `cell_create` `policy`.
  */
 export declare const TEST_SPACE_POLICY: {
-    readonly policy: {
-        readonly post: {
-            readonly min_role: "participant";
-            readonly moderation_required: true;
-        };
-        readonly react: {
-            readonly min_role: "participant";
-            readonly moderation_required: false;
-        };
-        readonly comment: {
-            readonly min_role: "participant";
-            readonly moderation_required: false;
-        };
+    readonly post: {
+        readonly min_role: "participant";
+        readonly moderation_required: true;
+    };
+    readonly react: {
+        readonly min_role: "participant";
+        readonly moderation_required: false;
+    };
+    readonly comment: {
+        readonly min_role: "participant";
+        readonly moderation_required: false;
     };
 };
-/** A space's per-kind contribution rule (the shape stamped into `space.data.policy`). */
+/** A space's per-kind contribution rule (the shape of each `policy` entry). */
 export interface ContributionRule {
     min_role?: string;
     moderation_required?: boolean;
 }
 /**
- * The directory-model test authorizer — a **pure** function of the input (it
- * reads the governing root's policy off `input.root_data`, supplied by the
- * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
+ * The directory-model test authorizer — `authorize` is a **pure** function of
+ * the input (it reads the governing root's policy off `input.root_policy`,
+ * supplied by the handler). Byte-equivalent with the Rust
+ * `TestCellGatedCreateAuthorize`.
  */
 export declare const test_cell_gated_create_authorize: CellCreateAuthorize;
 //# sourceMappingURL=test_cell_gated_create_authorize.d.ts.map

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;CAMpB,CAAC;AAEX,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAKtE,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;CAIpB,CAAC;AAEX,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwBD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBA8B9C,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -13,17 +13,24 @@ import '../assert_dev_env.js';
  *   every other parentless kind stays open, so the plain-create `cell_crud` /
  *   `cell_relations` suites are unaffected.
  * - **Contribution** (`root_id` set): the governing root's
- *   `data.policy[kind] = {min_role?, moderation_required?}` decides — a missing
- *   entry denies, a present `min_role` the actor lacks globally denies, and otherwise it
- *   admits with the entry's `moderation_required` folded into the verdict. The
- *   root's `data` arrives in `input.root_data` (the handler read it in-tx), so
- *   the predicate is **pure** — no DB read of its own (which also dodges the
- *   single-connection in-memory deadlock a separate handle would hit — pglet, PGlite).
+ *   `policy[kind] = {min_role?, moderation_required?}` decides — a missing
+ *   entry (or no policy) denies, a present `min_role` the actor lacks globally
+ *   denies, and otherwise it admits with the entry's `moderation_required`
+ *   folded into the verdict. The root's policy arrives in `input.root_policy`
+ *   (the handler read it in-tx), so the predicate is **pure** — no DB read of
+ *   its own (which also dodges the single-connection in-memory deadlock a
+ *   separate handle would hit — pglet, PGlite).
+ *
+ * Its `validate_policy` accepts a policy whose every entry is an object with
+ * an optional string `min_role` and an optional boolean `moderation_required`,
+ * and refuses any other with `ERROR_CELL_POLICY_INVALID`.
  *
  * @module
  */
 import { has_scoped_role } from '../../auth/request_context.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { ERROR_CELL_POLICY_INVALID } from '../../auth/cell_action_specs.js';
+import { jsonrpc_errors } from '../../http/jsonrpc_errors.js';
 import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
 /** The admin-only root kind the test policy gates (talk's `space` analog). */
 export const SPACE_CELL_KIND = 'space';
@@ -34,26 +41,32 @@ export const SPACE_CELL_KIND = 'space';
  */
 export const PARTICIPATION_ROLE = SPINE_PARTICIPANT_ROLE;
 /**
- * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * A space `policy` mirroring the test ladder: gated `post` (moderated) +
  * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
  * exists so a suite can create a comment under a post (`root_id !==
  * parent_id`) and prove the policy resolves from the governing root (the
  * space), not the immediate parent. Shared by the gated-create and moderate
- * cross suites.
+ * cross suites, which pass it as a root's `cell_create` `policy`.
  */
 export const TEST_SPACE_POLICY = {
-    policy: {
-        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
-        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
-        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
-    }
+    post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+    react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+    comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
 };
-/** Pull the governing root's `data.policy[kind]` rule, defensively (loose `data`). */
-const get_contribution_rule = (data, kind) => {
-    if (data === null || typeof data !== 'object')
-        return undefined;
-    const policy = data.policy;
-    if (policy === null || typeof policy !== 'object')
+/** Whether `value` is a `ContributionRule` — an object of only those two keys, each its type. */
+const is_contribution_rule = (value) => value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.entries(value).every(([key, v]) => {
+        if (key === 'min_role')
+            return typeof v === 'string';
+        if (key === 'moderation_required')
+            return typeof v === 'boolean';
+        return false;
+    });
+/** Pull the governing root's `policy[kind]` rule, defensively. */
+const get_contribution_rule = (policy, kind) => {
+    if (policy === null)
         return undefined;
     const rule = policy[kind];
     if (rule === null || typeof rule !== 'object')
@@ -61,29 +74,40 @@ const get_contribution_rule = (data, kind) => {
     return rule;
 };
 /**
- * The directory-model test authorizer — a **pure** function of the input (it
- * reads the governing root's policy off `input.root_data`, supplied by the
- * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
+ * The directory-model test authorizer — `authorize` is a **pure** function of
+ * the input (it reads the governing root's policy off `input.root_policy`,
+ * supplied by the handler). Byte-equivalent with the Rust
+ * `TestCellGatedCreateAuthorize`.
  */
-export const test_cell_gated_create_authorize = (auth, input) => {
-    // Admin bypass — admins create roots + any kind, live immediately. The
-    // global grant only: a scoped `admin` row bypasses nothing.
-    if (has_scoped_role(auth, ROLE_ADMIN, null))
-        return { allow: true, moderation_required: false };
-    // Root creation (no governing root): `space` is admin-only; other parentless
-    // kinds stay open (the plain-create suites).
-    if (input.root_id === null) {
-        return input.kind === SPACE_CELL_KIND
-            ? { allow: false }
-            : { allow: true, moderation_required: false };
+export const test_cell_gated_create_authorize = {
+    authorize: (auth, input) => {
+        // Admin bypass — admins create roots + any kind, live immediately. The
+        // global grant only: a scoped `admin` row bypasses nothing.
+        if (has_scoped_role(auth, ROLE_ADMIN, null)) {
+            return { allow: true, moderation_required: false };
+        }
+        // Root creation (no governing root): `space` is admin-only; other
+        // parentless kinds stay open (the plain-create suites).
+        if (input.root_id === null) {
+            return input.kind === SPACE_CELL_KIND
+                ? { allow: false }
+                : { allow: true, moderation_required: false };
+        }
+        // Contribution: resolve the governing root's per-kind policy.
+        const rule = get_contribution_rule(input.root_policy, input.kind ?? '');
+        if (!rule)
+            return { allow: false };
+        // `min_role` names no scope, so only the global grant satisfies it.
+        const admitted = rule.min_role === undefined || has_scoped_role(auth, rule.min_role, null);
+        return admitted
+            ? { allow: true, moderation_required: rule.moderation_required ?? false }
+            : { allow: false };
+    },
+    validate_policy: (policy) => {
+        if (!Object.values(policy).every(is_contribution_rule)) {
+            throw jsonrpc_errors.invalid_params('invalid space policy', {
+                reason: ERROR_CELL_POLICY_INVALID
+            });
+        }
     }
-    // Contribution: resolve the governing root's per-kind policy.
-    const rule = get_contribution_rule(input.root_data, input.kind ?? '');
-    if (!rule)
-        return { allow: false };
-    // `min_role` names no scope, so only the global grant satisfies it.
-    const admitted = rule.min_role === undefined || has_scoped_role(auth, rule.min_role, null);
-    return admitted
-        ? { allow: true, moderation_required: rule.moderation_required ?? false }
-        : { allow: false };
 };

package/dist/testing/cross_backend/transport_composition.js

@@ -60,9 +60,9 @@ import '../assert_dev_env.js';
  * **Multi-actor upgrade.** One more WS row needs a keeper seeded with a
  * second actor (`extra_actors`), so it runs only given `multi_actor`: a
  * multi-actor keeper's session upgrading with no `?acting=` → 400
- * `actor_required`, the flat body the TS spine's upgrade-time authorization
- * phase answers. The upgrade resolves an actor there, and a multi-actor
- * account must name one. A backend whose upgrade resolves no actor admits
+ * `actor_required`, the flat body both spines' upgrade-time actor resolution
+ * answers. The upgrade resolves an actor there, and a multi-actor account
+ * must name one. A backend whose upgrade resolves no actor admits
  * the socket instead; `multi_actor.xfail` runs the row as `xfail_until` for
  * it.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.149.0",
+  "version": "0.150.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",