@happyvertical/smrt-ui 0.53.0 → 0.53.2

package/dist/components/data/__tests__/data-surface.test.js

@@ -1,746 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { createDataSurfaceRegistry, DATA_SURFACE_IDENTIFIER_MAX_LENGTH, DATA_SURFACE_MAX_REPLAY_ENTRIES, DATA_SURFACE_MAX_REQUEST_BYTES, normalizeDataSurfaceActionRequest, normalizeDataSurfaceDescriptor, normalizeDataSurfaceQueryRequest, normalizeDataSurfaceVisibleCommand, } from '../data-surface.js';
-const identity = {
-    surfaceId: 'content-library',
-    kind: 'table',
-    subject: { type: 'site', id: 'docs' },
-};
-function descriptor(overrides = {}) {
-    return {
-        version: 1,
-        identity,
-        schemaVersion: 1,
-        label: 'Content library',
-        rowKey: 'id',
-        columns: [
-            { id: 'id', label: 'ID', capabilities: ['read', 'project'] },
-            {
-                id: 'title',
-                label: 'Title',
-                capabilities: ['read', 'search', 'filter', 'sort', 'project'],
-            },
-            {
-                id: 'internal',
-                label: 'Internal',
-                sensitivity: 'sensitive',
-                capabilities: [],
-            },
-        ],
-        query: {
-            modes: ['rows', 'count', 'facets'],
-            projectableColumnIds: ['id', 'title'],
-        },
-        controls: [{ id: 'set-search', label: 'Search' }],
-        actions: [
-            {
-                id: 'archive',
-                label: 'Archive',
-                selectionScopes: ['explicit-ids', 'all-matching'],
-                requiresConfirmation: true,
-            },
-        ],
-        limits: { maxQueryRows: 50, maxQueryBytes: 10_000, maxSelectionSize: 3 },
-        ...overrides,
-    };
-}
-function command(overrides = {}) {
-    return {
-        version: 1,
-        commandId: 'search-1',
-        identity,
-        expectedRevision: 3,
-        controlId: 'set-search',
-        payload: { search: 'Grace' },
-        ...overrides,
-    };
-}
-function registerFixture(options = {}) {
-    let revision = 3;
-    let state = { search: 'Ada', internal: 'not-for-discovery' };
-    const execute = vi.fn((next) => {
-        state = {
-            ...state,
-            search: next.payload &&
-                typeof next.payload === 'object' &&
-                !Array.isArray(next.payload)
-                ? String(next.payload.search ?? '')
-                : '',
-        };
-        if (options.advance !== false)
-            revision += 1;
-    });
-    const registry = createDataSurfaceRegistry();
-    const unregister = registry.register({
-        descriptor: descriptor(),
-        getSnapshot: () => ({ revision, state }),
-        execute,
-        ...(options.redact
-            ? {
-                redact: (snapshot) => ({
-                    ...snapshot,
-                    state: { search: snapshot.state.search ?? '' },
-                }),
-            }
-            : {}),
-    });
-    return { registry, unregister, execute };
-}
-describe('data surface registry', () => {
-    it('identifies unknown action columns in descriptor validation errors', () => {
-        expect(() => normalizeDataSurfaceDescriptor(descriptor({
-            actions: [
-                {
-                    id: 'archive',
-                    label: 'Archive',
-                    selectionScopes: ['explicit-ids'],
-                    columnIds: ['missing'],
-                },
-            ],
-        }))).toThrow('Unknown DataSurface action column id: missing');
-    });
-    it('aligns bounded query result shapes with each query kind', () => {
-        const results = [
-            {
-                version: 1,
-                requestId: 'rows-1',
-                identity,
-                revision: 3,
-                kind: 'rows',
-                rowKey: 'id',
-                rows: [{ id: 'a' }],
-                hasMore: false,
-                truncated: false,
-            },
-            {
-                version: 1,
-                requestId: 'count-1',
-                identity,
-                revision: 3,
-                kind: 'count',
-                count: 1,
-            },
-            {
-                version: 1,
-                requestId: 'facets-1',
-                identity,
-                revision: 3,
-                kind: 'facets',
-                columnId: 'title',
-                facets: [{ value: 'Guide', count: 1 }],
-                truncated: false,
-            },
-        ];
-        expect(results.map((result) => result.kind)).toEqual([
-            'rows',
-            'count',
-            'facets',
-        ]);
-    });
-    it('discovers defensive serializable descriptors and snapshots', () => {
-        const { registry } = registerFixture();
-        const [listed] = registry.list();
-        expect(listed).toMatchObject({
-            identity,
-            rowKey: 'id',
-            query: { projectableColumnIds: ['id', 'title'] },
-        });
-        listed.label = 'mutated by a consumer';
-        expect(registry.list()[0]?.label).toBe('Content library');
-        const snapshot = registry.inspect(identity);
-        expect(snapshot).toMatchObject({
-            revision: 3,
-            state: { search: 'Ada', internal: 'not-for-discovery' },
-            selection: null,
-        });
-        expect(JSON.parse(JSON.stringify(snapshot))).toEqual(snapshot);
-    });
-    it('rejects duplicate mounted identities rather than replacing them', () => {
-        const { registry } = registerFixture();
-        expect(() => registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        })).toThrow(JSON.stringify(['table', 'content-library', ['site', 'docs']]));
-    });
-    it('keeps identities with delimiter-like components distinct', () => {
-        const firstIdentity = {
-            kind: 'table',
-            surfaceId: 'x',
-            subject: { type: 'y', id: 'z\u0000w' },
-        };
-        const secondIdentity = {
-            kind: 'table',
-            surfaceId: 'x\u0000y',
-            subject: { type: 'z', id: 'w' },
-        };
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor({ identity: firstIdentity }),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        });
-        registry.register({
-            descriptor: descriptor({ identity: secondIdentity }),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        });
-        expect(registry.list()).toHaveLength(2);
-        registry.unregister(secondIdentity);
-        expect(registry.inspect(firstIdentity)?.revision).toBe(0);
-        expect(registry.inspect(secondIdentity)).toBeUndefined();
-    });
-    it('applies the host-owned redaction boundary before inspect results escape', () => {
-        const { registry } = registerFixture({ redact: true });
-        expect(registry.inspect(identity)?.state).toEqual({ search: 'Ada' });
-    });
-    it('rejects authority and SQL keys from default and redacted snapshots', () => {
-        const registry = createDataSurfaceRegistry();
-        expect(() => registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 0, state: { tenantId: 'other' } }),
-        })).toThrow('authority or SQL');
-        expect(() => registry.register({
-            descriptor: descriptor({
-                identity: { ...identity, surfaceId: 'tenant-context' },
-            }),
-            getSnapshot: () => ({
-                revision: 0,
-                state: { tenant: { id: 'other' } },
-            }),
-        })).toThrow('authority or SQL');
-        expect(() => registry.register({
-            descriptor: descriptor({
-                identity: { ...identity, surfaceId: 'authorization-header' },
-            }),
-            getSnapshot: () => ({
-                revision: 0,
-                state: { authorizationHeader: 'Bearer credential' },
-            }),
-        })).toThrow('authority or SQL');
-        expect(() => registry.register({
-            descriptor: descriptor({
-                identity: { ...identity, surfaceId: 'authorization-token' },
-            }),
-            getSnapshot: () => ({
-                revision: 0,
-                state: { authToken: 'Bearer credential' },
-            }),
-        })).toThrow('authority or SQL');
-        for (const [surfaceId, state] of [
-            ['bare-token', { token: 'credential' }],
-            ['bare-bearer', { bearer: 'credential' }],
-        ]) {
-            expect(() => registry.register({
-                descriptor: descriptor({
-                    identity: { ...identity, surfaceId },
-                }),
-                getSnapshot: () => ({ revision: 0, state }),
-            })).toThrow('authority or SQL');
-        }
-        expect(() => registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-            redact: (snapshot) => ({ ...snapshot, state: { sql: 'select 1' } }),
-        })).toThrow('authority or SQL');
-    });
-    it('rejects unsupported and stale commands before invoking the surface', async () => {
-        const { registry, execute } = registerFixture();
-        await expect(registry.execute(command({ controlId: 'delete-everything' }))).resolves.toMatchObject({ ok: false, reason: 'unsupported' });
-        await expect(registry.execute(command({ commandId: 'stale', expectedRevision: 2 }))).resolves.toMatchObject({
-            ok: false,
-            reason: 'stale_revision',
-            revision: 3,
-        });
-        expect(execute).not.toHaveBeenCalled();
-    });
-    it('rejects commands that unmount and replace their surface', async () => {
-        let unregister = () => undefined;
-        const registry = createDataSurfaceRegistry();
-        unregister = registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 3, state: { search: 'Ada' } }),
-            execute: () => {
-                unregister();
-                registry.register({
-                    descriptor: descriptor(),
-                    getSnapshot: () => ({ revision: 9, state: { search: 'Grace' } }),
-                });
-            },
-        });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            reason: 'not_found',
-        });
-        expect(registry.inspect(identity)).toMatchObject({
-            revision: 9,
-            state: { search: 'Grace' },
-        });
-    });
-    it('replays a command idempotently and rejects conflicting reuse of its id', async () => {
-        const { registry, execute } = registerFixture();
-        const initial = command();
-        const first = await registry.execute(initial);
-        const replay = await registry.execute(initial);
-        const conflict = await registry.execute(command({ payload: { search: 'Ada' } }));
-        expect(first).toMatchObject({ ok: true, revision: 4 });
-        expect(replay).toEqual(first);
-        expect(conflict).toMatchObject({
-            ok: false,
-            reason: 'idempotency_conflict',
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-    });
-    it('bounds the LRU replay cache for long-lived mounted surfaces', async () => {
-        let revision = 0;
-        const execute = vi.fn(() => {
-            revision += 1;
-        });
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision, state: {} }),
-            execute,
-        });
-        for (let index = 0; index < DATA_SURFACE_MAX_REPLAY_ENTRIES; index += 1) {
-            await expect(registry.execute(command({
-                commandId: `command-${index}`,
-                expectedRevision: index,
-            }))).resolves.toMatchObject({ ok: true, revision: index + 1 });
-        }
-        await expect(registry.execute(command({ commandId: 'command-0', expectedRevision: 0 }))).resolves.toMatchObject({ ok: true, revision: 1 });
-        await expect(registry.execute(command({
-            commandId: `command-${DATA_SURFACE_MAX_REPLAY_ENTRIES}`,
-            expectedRevision: DATA_SURFACE_MAX_REPLAY_ENTRIES,
-        }))).resolves.toMatchObject({
-            ok: true,
-            revision: DATA_SURFACE_MAX_REPLAY_ENTRIES + 1,
-        });
-        await expect(registry.execute(command({ commandId: 'command-1', expectedRevision: 1 }))).resolves.toMatchObject({
-            ok: false,
-            reason: 'stale_revision',
-            revision: DATA_SURFACE_MAX_REPLAY_ENTRIES + 1,
-        });
-        await expect(registry.execute(command({ commandId: 'command-0', expectedRevision: 0 }))).resolves.toMatchObject({ ok: true, revision: 1 });
-        expect(execute).toHaveBeenCalledTimes(DATA_SURFACE_MAX_REPLAY_ENTRIES + 1);
-    });
-    it('serializes concurrent commands so only one can execute at a revision', async () => {
-        let revision = 3;
-        let releaseFirst;
-        const firstExecution = new Promise((resolve) => {
-            releaseFirst = resolve;
-        });
-        const execute = vi.fn(async () => {
-            await firstExecution;
-            revision += 1;
-        });
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision, state: {} }),
-            execute,
-        });
-        const first = registry.execute(command({ commandId: 'first' }));
-        const second = registry.execute(command({ commandId: 'second' }));
-        await vi.waitFor(() => expect(execute).toHaveBeenCalledTimes(1));
-        releaseFirst();
-        await expect(first).resolves.toMatchObject({ ok: true, revision: 4 });
-        await expect(second).resolves.toMatchObject({
-            ok: false,
-            reason: 'stale_revision',
-            revision: 4,
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-    });
-    it('rejects in-flight and queued commands after their surface unregisters', async () => {
-        let revision = 3;
-        let releaseFirst;
-        const firstExecution = new Promise((resolve) => {
-            releaseFirst = resolve;
-        });
-        const execute = vi.fn(async () => {
-            await firstExecution;
-            revision += 1;
-        });
-        const registry = createDataSurfaceRegistry();
-        const unregister = registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision, state: {} }),
-            execute,
-        });
-        const first = registry.execute(command({ commandId: 'first' }));
-        const queued = registry.execute(command({ commandId: 'queued' }));
-        await vi.waitFor(() => expect(execute).toHaveBeenCalledTimes(1));
-        unregister();
-        releaseFirst();
-        await expect(first).resolves.toMatchObject({
-            ok: false,
-            commandId: 'first',
-            reason: 'not_found',
-        });
-        await expect(queued).resolves.toMatchObject({
-            ok: false,
-            commandId: 'queued',
-            reason: 'not_found',
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-    });
-    it('returns execution_failed when handler teardown also breaks snapshots', async () => {
-        let tornDown = false;
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => {
-                if (tornDown)
-                    throw new Error('renderer is gone');
-                return { revision: 3, state: {} };
-            },
-            execute: () => {
-                tornDown = true;
-                throw new Error('handler failed');
-            },
-        });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            commandId: 'search-1',
-            reason: 'execution_failed',
-        });
-    });
-    it('quarantines a changed snapshot when its handler throws before revision advances', async () => {
-        let state = { search: 'Ada' };
-        const execute = vi.fn(() => {
-            state = { search: 'Grace' };
-            throw new Error('handler failed');
-        });
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 3, state }),
-            execute,
-        });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        await expect(registry.execute(command({ commandId: 'blocked-after-failure' }))).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-    });
-    it('quarantines a changed snapshot until its renderer advances revision', async () => {
-        let revision = 3;
-        let state = { search: 'Ada' };
-        let advance = false;
-        const execute = vi.fn(() => {
-            state = { search: 'Grace' };
-            if (advance)
-                revision += 1;
-        });
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision, state }),
-            execute,
-        });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        await expect(registry.execute(command({ commandId: 'blocked-at-revision-3' }))).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-        revision = 4;
-        advance = true;
-        await expect(registry.execute(command({
-            commandId: 'after-refresh',
-            expectedRevision: 4,
-        }))).resolves.toMatchObject({ ok: true, revision: 5 });
-        expect(execute).toHaveBeenCalledTimes(2);
-    });
-    it('quarantines host-driven snapshot changes until revision advances', async () => {
-        let revision = 3;
-        const state = { search: 'Ada' };
-        const execute = vi.fn(() => {
-            state.search = 'Lin';
-            revision += 1;
-        });
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision, state }),
-            execute,
-        });
-        state.search = 'Grace';
-        expect(registry.inspect(identity)?.state).toEqual({ search: 'Grace' });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        expect(execute).not.toHaveBeenCalled();
-        revision = 4;
-        await expect(registry.execute(command({ commandId: 'after-host-refresh', expectedRevision: 4 }))).resolves.toMatchObject({ ok: true, revision: 5 });
-        expect(execute).toHaveBeenCalledTimes(1);
-    });
-    it('quarantines redacted snapshot changes until revision advances', async () => {
-        let audience = 'owner';
-        const execute = vi.fn();
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({ revision: 3, state: { search: 'Ada' } }),
-            execute,
-            redact: (snapshot) => ({
-                ...snapshot,
-                state: { search: audience },
-            }),
-        });
-        audience = 'viewer';
-        expect(registry.inspect(identity)?.state).toEqual({ search: 'viewer' });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: false,
-            reason: 'non_monotonic_revision',
-        });
-        expect(execute).not.toHaveBeenCalled();
-    });
-    it('emits monotonic sequence events and removes unregistered surfaces', async () => {
-        const { registry, unregister } = registerFixture();
-        const events = [];
-        const unsubscribe = registry.subscribe((event) => events.push(event));
-        await registry.execute(command());
-        unregister();
-        unsubscribe();
-        expect(events.map(({ type, sequence, revision }) => ({
-            type,
-            sequence,
-            revision,
-        }))).toEqual([
-            { type: 'command', sequence: 2, revision: 4 },
-            { type: 'unregistered', sequence: 3, revision: 4 },
-        ]);
-        expect(registry.inspect(identity)).toBeUndefined();
-        expect(registry.list()).toEqual([]);
-    });
-    it('isolates subscriber failures from registry operations', async () => {
-        const { registry, execute } = registerFixture();
-        registry.subscribe(() => {
-            throw new Error('transport failed');
-        });
-        await expect(registry.execute(command())).resolves.toMatchObject({
-            ok: true,
-            revision: 4,
-        });
-        expect(execute).toHaveBeenCalledTimes(1);
-        const secondIdentity = { ...identity, surfaceId: 'secondary-surface' };
-        expect(() => registry.register({
-            descriptor: descriptor({ identity: secondIdentity }),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        })).not.toThrow();
-        expect(() => registry.unregister(secondIdentity)).not.toThrow();
-    });
-    it('validates bounded query and preview/apply action envelopes without executing them', () => {
-        const { registry } = registerFixture();
-        expect(registry.validateQuery({
-            version: 1,
-            requestId: 'rows-1',
-            identity,
-            kind: 'rows',
-            limit: 25,
-            projection: ['title', 'id'],
-        })).toEqual({ ok: true });
-        expect(registry.validateQuery({
-            version: 1,
-            requestId: 'rows-too-large',
-            identity,
-            kind: 'rows',
-            limit: 51,
-        })).toEqual({ ok: false, reason: 'limit_exceeded' });
-        expect(registry.validateQuery({
-            version: 1,
-            requestId: 'rows-hidden',
-            identity,
-            kind: 'rows',
-            limit: 1,
-            projection: ['internal'],
-        })).toEqual({ ok: false, reason: 'projection_not_allowed' });
-        expect(registry.validateAction({
-            version: 1,
-            requestId: 'archive-preview',
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: { scope: 'explicit-ids', rowIds: ['b', 'a', 'a'] },
-        })).toEqual({ ok: true });
-        expect(registry.validateAction({
-            version: 1,
-            requestId: 'archive-apply',
-            identity,
-            actionId: 'archive',
-            phase: 'apply',
-            selection: { scope: 'explicit-ids', rowIds: ['a'] },
-        })).toEqual({ ok: false, reason: 'confirmation_required' });
-    });
-    it('enforces the descriptor query-byte limit using the normalized UTF-8 envelope', () => {
-        const request = {
-            version: 1,
-            requestId: 'unicode-cursor',
-            identity,
-            kind: 'rows',
-            limit: 1,
-            cursor: 'é',
-        };
-        const maxQueryBytes = new TextEncoder().encode(JSON.stringify(normalizeDataSurfaceQueryRequest(request))).byteLength;
-        const registry = createDataSurfaceRegistry();
-        registry.register({
-            descriptor: descriptor({
-                limits: { maxQueryRows: 50, maxQueryBytes, maxSelectionSize: 3 },
-            }),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        });
-        expect(registry.validateQuery(request)).toEqual({ ok: true });
-        expect(registry.validateQuery({ ...request, cursor: 'éé' })).toEqual({
-            ok: false,
-            reason: 'limit_exceeded',
-        });
-    });
-    it('rejects SQL and authority values at the browser-contract boundary', () => {
-        expect(() => normalizeDataSurfaceVisibleCommand(command({ payload: { sql: 'select * from content' } }))).toThrow('authority or SQL');
-        expect(() => normalizeDataSurfaceVisibleCommand(command({ payload: { tenantId: 'other-tenant' } }))).toThrow('authority or SQL');
-    });
-    it('enforces the shared identifier bound at registry boundaries', () => {
-        const tooLong = 'x'.repeat(DATA_SURFACE_IDENTIFIER_MAX_LENGTH + 1);
-        const identifiers = [
-            ['command id', command({ commandId: tooLong })],
-            ['control id', command({ controlId: tooLong })],
-            [
-                'surface id',
-                command({ identity: { ...identity, surfaceId: tooLong } }),
-            ],
-            [
-                'subject type',
-                command({
-                    identity: {
-                        ...identity,
-                        subject: { type: tooLong, id: 'docs' },
-                    },
-                }),
-            ],
-            [
-                'subject id',
-                command({
-                    identity: {
-                        ...identity,
-                        subject: { type: 'site', id: tooLong },
-                    },
-                }),
-            ],
-        ];
-        for (const [label, value] of identifiers) {
-            expect(() => normalizeDataSurfaceVisibleCommand(value), label).toThrow();
-        }
-        expect(() => normalizeDataSurfaceActionRequest({
-            version: 1,
-            requestId: tooLong,
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: { scope: 'current-page' },
-        })).toThrow();
-        expect(() => normalizeDataSurfaceActionRequest({
-            version: 1,
-            requestId: 'row-id',
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: { scope: 'explicit-ids', rowIds: [tooLong] },
-        })).toThrow();
-        expect(() => createDataSurfaceRegistry().register({
-            descriptor: descriptor({
-                identity: { ...identity, surfaceId: tooLong },
-            }),
-            getSnapshot: () => ({ revision: 0, state: {} }),
-        })).toThrow();
-    });
-    it('rejects parsed prototype keys at every browser-contract boundary', () => {
-        const prototypePayload = JSON.parse('{"__proto__":{"tenantId":"other"}}');
-        expect(() => normalizeDataSurfaceVisibleCommand(command({ payload: prototypePayload }))).toThrow('prototype key');
-        expect(() => normalizeDataSurfaceActionRequest({
-            version: 1,
-            requestId: 'prototype-action',
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: { scope: 'current-page' },
-            payload: prototypePayload,
-        })).toThrow('prototype key');
-        const registry = createDataSurfaceRegistry();
-        expect(() => registry.register({
-            descriptor: descriptor(),
-            getSnapshot: () => ({
-                revision: 0,
-                state: JSON.parse('{"__proto__":{"tenantId":"other"}}'),
-            }),
-        })).toThrow('prototype key');
-    });
-    it('bounds command and action envelopes before dispatch', () => {
-        const oversized = 'x'.repeat(DATA_SURFACE_MAX_REQUEST_BYTES);
-        expect(() => normalizeDataSurfaceVisibleCommand(command({ payload: { value: oversized } }))).toThrow('UTF-8 bytes');
-        expect(() => normalizeDataSurfaceActionRequest({
-            version: 1,
-            requestId: 'oversized-action',
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: { scope: 'current-page' },
-            payload: { value: oversized },
-        })).toThrow('UTF-8 bytes');
-        expect(() => normalizeDataSurfaceActionRequest({
-            version: 1,
-            requestId: 'many-row-ids',
-            identity,
-            actionId: 'archive',
-            phase: 'preview',
-            selection: {
-                scope: 'explicit-ids',
-                rowIds: Array.from({ length: 1_001 }, () => 'duplicate'),
-            },
-        })).toThrow('more than 1000 row ids');
-    });
-    it('bounds query content during structural validation', () => {
-        const stringify = vi.spyOn(JSON, 'stringify');
-        try {
-            expect(() => normalizeDataSurfaceQueryRequest({
-                version: 1,
-                requestId: 'oversized-projection',
-                identity,
-                kind: 'rows',
-                limit: 1,
-                projection: ['x'.repeat(DATA_SURFACE_MAX_REQUEST_BYTES)],
-            })).toThrow('DataSurface query request cannot exceed');
-            expect(stringify).not.toHaveBeenCalled();
-        }
-        finally {
-            stringify.mockRestore();
-        }
-    });
-    it('accepts a query whose canonical envelope is exactly at the byte limit', () => {
-        const request = {
-            version: 1,
-            requestId: 'exact-limit',
-            identity,
-            kind: 'rows',
-            limit: 1,
-            projection: Array.from({ length: 394 }, (_, index) => `${String(index).padStart(3, '0')}${'x'.repeat(247)}`),
-        };
-        const withEmpty = { ...request, projection: [...request.projection, ''] };
-        const overhead = new TextEncoder().encode(JSON.stringify(withEmpty)).byteLength -
-            new TextEncoder().encode(JSON.stringify(request)).byteLength;
-        const finalLength = DATA_SURFACE_MAX_REQUEST_BYTES -
-            new TextEncoder().encode(JSON.stringify(request)).byteLength -
-            overhead;
-        const exactLimit = {
-            ...request,
-            projection: [...request.projection, 'x'.repeat(finalLength)],
-        };
-        expect(new TextEncoder().encode(JSON.stringify(exactLimit)).byteLength).toBe(DATA_SURFACE_MAX_REQUEST_BYTES);
-        expect(normalizeDataSurfaceQueryRequest(exactLimit)).toEqual(exactLimit);
-    });
-});