@peers-app/peers-sdk 0.27.3 → 0.27.5

package/dist/contracts/__tests__/contract-resolvers.test.js

@@ -1,758 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const access_level_1 = require("../../data/access-level");
-const user_permissions_1 = require("../../data/user-permissions");
-const user_trust_levels_1 = require("../../data/user-trust-levels");
-const users_1 = require("../../data/users");
-const socket_type_1 = require("../../device/socket.type");
-const keys_1 = require("../../keys");
-const system_ids_1 = require("../../system-ids");
-const utils_1 = require("../../utils");
-const index_1 = require("../index");
-jest.mock("../../data/group-permissions", () => {
-    const actual = jest.requireActual("../../data/group-permissions");
-    return {
-        ...actual,
-        getUserRole: jest.fn(async () => actual.GroupMemberRole.Founder),
-        // The real module is loaded inside this factory (via ../context), which re-enters the
-        // mock and can yield two jest.fn instances. Shared global state keeps every instance
-        // in sync so tests can drive and observe the level the resolvers actually see.
-        getUserAccessLevel: jest.fn(async (dataContext, userId) => {
-            const state = globalThis.__remoteAccessLevelMock;
-            state?.calls.push([dataContext, userId]);
-            return state?.level ?? 80;
-        }),
-    };
-});
-const accessLevelMock = { level: 80, calls: [] };
-globalThis.__remoteAccessLevelMock = accessLevelMock;
-jest.mock("../../data/user-trust-levels", () => ({
-    UserTrustLevels: jest.fn(),
-}));
-jest.mock("../../data/users", () => ({
-    Users: jest.fn(),
-}));
-const mockUserTrustLevels = user_trust_levels_1.UserTrustLevels;
-const mockUsers = users_1.Users;
-const mockTrustGet = jest.fn();
-function makeIdentity() {
-    const keys = (0, keys_1.newKeys)();
-    const userId = (0, utils_1.newid)();
-    const user = (0, user_permissions_1.signUserObject)({
-        userId,
-        name: "Remote user",
-        publicKey: keys.publicKey,
-        publicBoxKey: keys.publicBoxKey,
-    }, keys.secretKey);
-    const remoteIdentity = {
-        userId,
-        deviceId: (0, utils_1.newid)(),
-        publicKey: keys.publicKey,
-        publicBoxKey: keys.publicBoxKey,
-    };
-    return { remoteIdentity, user };
-}
-function setupUserContext(localUserId, records) {
-    const personalContext = {};
-    const groupContext = {};
-    const userContext = {
-        userId: localUserId,
-        userDataContext: personalContext,
-        groupDataContexts: new Map([["group", groupContext]]),
-        getDataContext: jest.fn(),
-    };
-    mockUsers.mockImplementation((dataContext) => ({
-        get: jest.fn().mockResolvedValue(records.get(dataContext) ?? null),
-    }));
-    mockUserTrustLevels.mockReturnValue({ get: mockTrustGet });
-    return { groupContext, personalContext, userContext: userContext };
-}
-const call = {
-    contractId: "test-contract",
-    version: 1,
-    member: "table",
-    name: "Items",
-    operation: "list",
-    args: [],
-};
-describe("Self-trusted contract caller authorization", () => {
-    beforeEach(() => {
-        jest.clearAllMocks();
-    });
-    it.each([
-        ["same-account", true],
-        ["explicit cross-account", false],
-    ])("allows a signed %s identity with personal Self trust", async (_label, sameAccount) => {
-        const { remoteIdentity, user } = makeIdentity();
-        const localUserId = sameAccount ? remoteIdentity.userId : (0, utils_1.newid)();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext(localUserId, records);
-        records.set(personalContext, user);
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, remoteIdentity)).resolves.toBe(true);
-        if (sameAccount) {
-            expect(mockTrustGet).not.toHaveBeenCalled();
-        }
-        else {
-            expect(mockUserTrustLevels).toHaveBeenCalledWith(personalContext);
-            expect(mockTrustGet).toHaveBeenCalledWith(remoteIdentity.userId);
-        }
-    });
-    it.each([
-        socket_type_1.TrustLevel.Trusted,
-        socket_type_1.TrustLevel.Unknown,
-    ])("denies a signed identity with trust level %s", async (trustLevel) => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(personalContext, user);
-        mockTrustGet.mockResolvedValue({ trustLevel });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, remoteIdentity)).resolves.toBe(false);
-    });
-    it("accepts a matching signed identity found only in a shared group", async () => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { groupContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(groupContext, user);
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, remoteIdentity)).resolves.toBe(true);
-    });
-    it("denies unsigned discovery stubs", async () => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(personalContext, { ...user, signature: undefined });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, remoteIdentity)).resolves.toBe(false);
-        expect(mockTrustGet).not.toHaveBeenCalled();
-    });
-    it.each([
-        "publicKey",
-        "publicBoxKey",
-    ])("denies a connection whose %s differs from the signed user", async (field) => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(personalContext, user);
-        const mismatchedIdentity = { ...remoteIdentity, [field]: `mismatch-${(0, utils_1.newid)()}` };
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, mismatchedIdentity)).resolves.toBe(false);
-        expect(mockTrustGet).not.toHaveBeenCalled();
-    });
-    it("denies a malformed user signature", async () => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(personalContext, { ...user, signature: `${user.signature}tampered` });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        await expect((0, index_1.isSelfTrustedContractCaller)(userContext, remoteIdentity)).resolves.toBe(false);
-    });
-    it("ignores peer-supplied caller context when authorizing the router", async () => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(personalContext, { ...user, signature: undefined });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        const [consumerTransport, providerTransport] = (0, index_1.inProcessTransportPair)();
-        const router = (0, index_1.createUserContextContractProviderRouter)(providerTransport, {
-            userContext,
-            remoteIdentity,
-        });
-        await expect(consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, call, {
-            callerUserId: userContext.userId,
-            localUserId: userContext.userId,
-        })).rejects.toThrow("Permission denied");
-        router.dispose();
-    });
-    it.each([
-        ["Tool Access Control", system_ids_1.toolAccessControlContractId],
-        ["Identity", system_ids_1.identityContractId],
-        ["Host Tools", system_ids_1.hostToolsContractId],
-        ["Desktop Tools", system_ids_1.desktopToolsContractId],
-        ["Invites", system_ids_1.invitesContractId],
-        ["HTTP", system_ids_1.httpContractId],
-        ["Scheduler", system_ids_1.schedulerContractId],
-        ["Contract Catalog", system_ids_1.contractCatalogContractId],
-        ["Tool Catalog", system_ids_1.toolCatalogContractId],
-    ])("rejects remote %s as local-only", async (_name, contractId) => {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { personalContext, userContext } = setupUserContext(remoteIdentity.userId, records);
-        records.set(personalContext, user);
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        const [consumerTransport, providerTransport] = (0, index_1.inProcessTransportPair)();
-        const router = (0, index_1.createUserContextContractProviderRouter)(providerTransport, {
-            userContext,
-            remoteIdentity,
-        });
-        await expect(consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, {
-            ...call,
-            contractId,
-            member: "tool",
-            name: "approve",
-            operation: "run",
-        })).rejects.toThrow("local-only");
-        router.dispose();
-    });
-});
-describe("remote contract call authorization (group members)", () => {
-    const groupId = "group";
-    const contractId = (0, utils_1.newid)();
-    const toolCall = {
-        contractId,
-        version: 1,
-        member: "tool",
-        name: "ping",
-        operation: "run",
-        args: [{}],
-        dataContextId: groupId,
-    };
-    function setupGroupMember(opts) {
-        const { remoteIdentity, user } = makeIdentity();
-        const records = new Map();
-        const { groupContext, userContext } = setupUserContext((0, utils_1.newid)(), records);
-        records.set(groupContext, user);
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Trusted });
-        accessLevelMock.level = opts.callerLevel;
-        accessLevelMock.calls = [];
-        const definition = {
-            contractId,
-            version: 1,
-            name: "Ping",
-            description: "",
-            tables: [],
-            tools: [
-                {
-                    name: "ping",
-                    usageDescription: "",
-                    inputFields: [],
-                    outputFields: [],
-                    ...(opts.remoteAccessLevel !== undefined
-                        ? { remoteAccessLevel: opts.remoteAccessLevel }
-                        : {}),
-                },
-                { name: "localOnly", usageDescription: "", inputFields: [], outputFields: [] },
-            ],
-            observables: [],
-            events: [],
-        };
-        const groupDataContext = {
-            groupId,
-            packageLoader: {
-                contractRegistry: {
-                    selectProvider: jest.fn(({ contractId: id, version }) => id === contractId && version === 1
-                        ? { providerPackageId: "provider-a", definition }
-                        : undefined),
-                    getProviderImplementation: jest.fn((id, version) => ({
-                        contractId: id,
-                        version,
-                    })),
-                },
-            },
-        };
-        userContext.groupIds = jest.fn(() => [groupId]);
-        userContext.getDataContext = jest.fn((id) => id === groupId ? groupDataContext : { groupId: undefined });
-        return { remoteIdentity, userContext, groupDataContext };
-    }
-    beforeEach(() => {
-        jest.clearAllMocks();
-    });
-    it("allows a verified group member whose role meets the tool's remoteAccessLevel", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Writer,
-            callerLevel: access_level_1.AccessLevel.Writer,
-        });
-        const route = await (0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity);
-        expect(route.dataContextId).toBe(groupId);
-        expect(route.context?.callerUserId).toBe(remoteIdentity.userId);
-        expect(route.context?.callerDeviceId).toBe(remoteIdentity.deviceId);
-        expect(route.context?.dataContext).toBe(groupDataContext);
-        expect(accessLevelMock.calls).toEqual([[groupDataContext, remoteIdentity.userId]]);
-    });
-    it("uses the active frozen provider's remote policy, not the last registration's", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Admin,
-            callerLevel: access_level_1.AccessLevel.Reader,
-        });
-        const selected = groupDataContext.packageLoader.contractRegistry.selectProvider({
-            contractId,
-            version: 1,
-        });
-        if (!selected)
-            throw new Error("Missing test provider");
-        const { definition } = selected;
-        const registry = new index_1.ContractRegistry();
-        expect(registry.register("strict", definition).valid).toBe(true);
-        const permissive = {
-            ...definition,
-            tools: definition.tools.map((tool) => ({ ...tool, remoteAccessLevel: access_level_1.AccessLevel.Reader })),
-        };
-        expect(registry.register("permissive", permissive).valid).toBe(true);
-        Object.assign(groupDataContext.packageLoader, { contractRegistry: registry });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("requires Admin");
-        registry.setActiveProvider(contractId, 1, "permissive");
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).resolves.toMatchObject({ providerPackageId: "permissive" });
-        expect(registry.register("dev", { ...permissive, devTag: "dev" }).valid).toBe(false);
-    });
-    it("uses the implementing tool's remote policy for a version the provider also implements", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Reader,
-        });
-        const selected = groupDataContext.packageLoader.contractRegistry.selectProvider({
-            contractId,
-            version: 1,
-        });
-        if (!selected)
-            throw new Error("Missing test provider");
-        const v1 = selected.definition;
-        // v2 keeps v1's tools but asks a remote caller for Admin.
-        const v2 = {
-            ...v1,
-            version: 2,
-            tools: v1.tools.map((tool) => ({ ...tool, remoteAccessLevel: access_level_1.AccessLevel.Admin })),
-        };
-        const registry = new index_1.ContractRegistry();
-        const registered = registry.registerBatch("upgraded", [
-            { definition: v2, alsoImplements: [{ contractId, version: 1, definition: v1 }] },
-        ]);
-        expect(registered.valid).toBe(true);
-        Object.assign(groupDataContext.packageLoader, { contractRegistry: registry });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("requires Admin");
-        // Another provider's permissive policy must not admit this provider's alias.
-        expect(registry.register("permissive", { ...v2, tools: v1.tools }).valid).toBe(true);
-        expect(registry.setActiveProvider(contractId, 2, "permissive")).toBe(true);
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("requires Admin");
-    });
-    it("denies an alias when its implementing tool has no remote policy, and denies newer-only tools", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Reader,
-        });
-        const selected = groupDataContext.packageLoader.contractRegistry.selectProvider({
-            contractId,
-            version: 1,
-        });
-        if (!selected)
-            throw new Error("Missing test provider");
-        const v1 = selected.definition;
-        const v2 = {
-            ...v1,
-            version: 2,
-            tools: [
-                ...v1.tools.map(({ remoteAccessLevel: _level, ...tool }) => tool),
-                { ...v1.tools[0], name: "newTool" },
-            ],
-        };
-        const registry = new index_1.ContractRegistry();
-        expect(registry.register("upgraded", v2, [{ contractId, version: 1, definition: v1 }]).valid).toBe(true);
-        Object.assign(groupDataContext.packageLoader, { contractRegistry: registry });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("not remotely callable");
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, name: "newTool" }, userContext, remoteIdentity)).rejects.toThrow("not provided in this data context");
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, version: 2, name: "newTool" }, userContext, remoteIdentity)).resolves.toMatchObject({ providerPackageId: "upgraded" });
-    });
-    it.each([
-        "request",
-        "router",
-    ])("keeps the authorized provider through %s dispatch", async (route) => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Reader,
-        });
-        const handleCall = jest.fn(async () => "ok");
-        const resolveContractEndpoint = jest.fn(async (_request) => ({
-            handleCall,
-            dispose: jest.fn(),
-        }));
-        const getActiveContractProviderPackageId = jest.fn(() => "different-provider");
-        Object.assign(groupDataContext.packageLoader, {
-            resolveContractEndpoint,
-            getActiveContractProviderPackageId,
-        });
-        if (route === "request") {
-            await expect((0, index_1.handleContractCall)(toolCall, { userContext, remoteIdentity })).resolves.toBe("ok");
-        }
-        else {
-            const [consumer, provider] = (0, index_1.inProcessTransportPair)();
-            const router = (0, index_1.createUserContextContractProviderRouter)(provider, {
-                userContext,
-                remoteIdentity,
-            });
-            try {
-                await expect(consumer.emit(index_1.CONTRACT_REQUEST_CHANNEL, toolCall)).resolves.toBe("ok");
-            }
-            finally {
-                router.dispose();
-            }
-        }
-        expect(resolveContractEndpoint.mock.calls[0][0]).toMatchObject({
-            providerPackageId: "provider-a",
-        });
-        expect(getActiveContractProviderPackageId).not.toHaveBeenCalled();
-    });
-    it("waits for catalog persistence before authorizing a cold group's first call", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Writer,
-            callerLevel: access_level_1.AccessLevel.Writer,
-        });
-        let release;
-        const catalogReady = new Promise((resolve) => {
-            release = resolve;
-        });
-        Object.assign(groupDataContext.packageLoader, { catalogReady });
-        const pending = (0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity);
-        try {
-            await new Promise((resolve) => setImmediate(resolve));
-            expect(groupDataContext.packageLoader.contractRegistry.selectProvider).not.toHaveBeenCalled();
-            expect(accessLevelMock.calls).toEqual([]);
-        }
-        finally {
-            release();
-        }
-        await expect(pending).resolves.toMatchObject({ dataContextId: groupId });
-    });
-    it("fails closed on catalog initialization failure and permits a later retry", async () => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Writer,
-            callerLevel: access_level_1.AccessLevel.Writer,
-        });
-        let fail = true;
-        Object.defineProperty(groupDataContext.packageLoader, "catalogReady", {
-            get: () => (fail ? Promise.reject(new Error("catalog unavailable")) : Promise.resolve()),
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("catalog unavailable");
-        expect(groupDataContext.packageLoader.contractRegistry.selectProvider).not.toHaveBeenCalled();
-        expect(accessLevelMock.calls).toEqual([]);
-        fail = false;
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).resolves.toMatchObject({ dataContextId: groupId });
-    });
-    it("denies a group member below the tool's remoteAccessLevel", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Admin,
-            callerLevel: access_level_1.AccessLevel.Writer,
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("requires Admin (60)");
-    });
-    it("denies a remoteAccessLevel of 0 to callers with no role", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.None,
-            callerLevel: access_level_1.AccessLevel.None,
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("Permission denied");
-    });
-    it("denies tools that are not marked remotely callable", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({ callerLevel: access_level_1.AccessLevel.Owner });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, name: "localOnly" }, userContext, remoteIdentity)).rejects.toThrow("not remotely callable");
-        await expect((0, index_1.authorizeRemoteContractCall)(toolCall, userContext, remoteIdentity)).rejects.toThrow("not remotely callable");
-    });
-    it("denies tools missing from the registered contract definition", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({ callerLevel: access_level_1.AccessLevel.Owner });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, name: "missing" }, userContext, remoteIdentity)).rejects.toThrow("not provided in this data context");
-    });
-    it("denies non-tool members and subscriptions for group callers", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Owner,
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, member: "table", name: "Items", operation: "list" }, userContext, remoteIdentity)).rejects.toThrow("only tool runs are remotely callable");
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, member: "event", operation: "subscribe", subscriptionId: (0, utils_1.newid)() }, userContext, remoteIdentity)).rejects.toThrow("only tool runs are remotely callable");
-    });
-    it("requires an explicit shared-group data context", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Owner,
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, dataContextId: undefined }, userContext, remoteIdentity)).rejects.toThrow("shared group data context is required");
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, dataContextId: "unknown-group" }, userContext, remoteIdentity)).rejects.toThrow("shared group data context is required");
-    });
-    it("rejects relayed calls that still carry a targetDeviceId", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({
-            remoteAccessLevel: access_level_1.AccessLevel.Reader,
-            callerLevel: access_level_1.AccessLevel.Owner,
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, targetDeviceId: (0, utils_1.newid)() }, userContext, remoteIdentity)).rejects.toThrow("cannot relay");
-    });
-    it("lets a Self-trusted device administer System Packages on this device", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({ callerLevel: access_level_1.AccessLevel.None });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        const route = await (0, index_1.authorizeRemoteContractCall)({ ...toolCall, contractId: system_ids_1.packagesContractId, name: "activatePackageVersion" }, userContext, remoteIdentity);
-        expect(route.dataContextId).toBe(groupId);
-        expect(route.context?.callerDeviceId).toBe(remoteIdentity.deviceId);
-    });
-    it.each([
-        ["Admin", access_level_1.AccessLevel.Admin],
-        ["Owner", access_level_1.AccessLevel.Owner],
-    ])("refuses System Packages to a group %s who is not trusted as Self", async (_role, level) => {
-        const { remoteIdentity, userContext, groupDataContext } = setupGroupMember({
-            callerLevel: level,
-        });
-        groupDataContext.packageLoader.contractRegistry.selectProvider.mockReturnValue({
-            providerPackageId: "system",
-            definition: (0, index_1.getPackagesContractDefinition)(),
-        });
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, contractId: system_ids_1.packagesContractId, name: "listPackages" }, userContext, remoteIdentity)).rejects.toThrow("tool is not remotely callable");
-    });
-    it("keeps full access for Self-trusted callers without consulting remoteAccessLevel", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({ callerLevel: access_level_1.AccessLevel.None });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        const route = await (0, index_1.authorizeRemoteContractCall)({ ...toolCall, name: "localOnly" }, userContext, remoteIdentity);
-        expect(route.dataContextId).toBe(groupId);
-        expect(accessLevelMock.calls).toEqual([]);
-    });
-    it("refuses a Self-trusted caller naming a group this device does not have", async () => {
-        const { remoteIdentity, userContext } = setupGroupMember({ callerLevel: access_level_1.AccessLevel.None });
-        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
-        const unknownGroupId = (0, utils_1.newid)();
-        await expect((0, index_1.authorizeRemoteContractCall)({ ...toolCall, dataContextId: unknownGroupId }, userContext, remoteIdentity)).rejects.toThrow("not available locally");
-        expect(userContext.getDataContext).not.toHaveBeenCalledWith(unknownGroupId);
-    });
-});
-describe("local user-context contract routing", () => {
-    function setupLocalRouter() {
-        const userId = (0, utils_1.newid)();
-        const groupId = (0, utils_1.newid)();
-        const personalContext = { dataContextId: userId };
-        const groupContext = { dataContextId: groupId };
-        const getDataContext = jest.fn((dataContextId) => {
-            if (dataContextId === userId)
-                return personalContext;
-            if (dataContextId === groupId)
-                return groupContext;
-            throw new Error("unexpected data context");
-        });
-        const userContext = {
-            userId,
-            userDataContext: personalContext,
-            groupDataContexts: new Map([[groupId, groupContext]]),
-            groupIds: jest.fn(() => [groupId]),
-            getDataContext,
-        };
-        const contractId = (0, utils_1.newid)();
-        (0, index_1.registerContractResolver)(contractId, 1, ({ dataContext }) => ({
-            contractId,
-            version: 1,
-            tools: {
-                inspect: {
-                    tool: {
-                        toolId: (0, utils_1.newid)(),
-                        name: "inspect",
-                        usageDescription: "Return the authorized route.",
-                        inputSchema: { type: "simple", fields: [] },
-                        outputSchema: { type: "simple", fields: [] },
-                        code: "",
-                        packageId: (0, utils_1.newid)(),
-                        accessLevel: 0,
-                    },
-                    toolFn: () => dataContext.dataContextId,
-                },
-            },
-        }));
-        const [consumerTransport, providerTransport] = (0, index_1.inProcessTransportPair)();
-        return {
-            consumerTransport,
-            contractId,
-            getDataContext,
-            groupId,
-            providerTransport,
-            userContext,
-            userId,
-        };
-    }
-    const makeToolCall = (contractId, dataContextId) => ({
-        contractId,
-        version: 1,
-        member: "tool",
-        name: "inspect",
-        operation: "run",
-        args: [],
-        dataContextId,
-    });
-    it("registers synchronously and waits for a lazily loaded user context", async () => {
-        const setup = setupLocalRouter();
-        let resolveUserContext;
-        const userContextPromise = new Promise((resolve) => {
-            resolveUserContext = resolve;
-        });
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: () => userContextPromise,
-        });
-        const result = setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId));
-        resolveUserContext(setup.userContext);
-        await expect(result).resolves.toBe(setup.userId);
-        router.dispose();
-    });
-    it.each([
-        false,
-        true,
-    ])("waits for catalog readiness before provider selection (explicit=%s)", async (explicit) => {
-        const setup = setupLocalRouter();
-        const providerPackageId = (0, utils_1.newid)();
-        let release;
-        const catalogReady = new Promise((resolve) => {
-            release = resolve;
-        });
-        const getRegisteredProviderIds = jest.fn(() => [providerPackageId]);
-        const getActiveContractProviderPackageId = jest.fn(() => providerPackageId);
-        const handleCall = jest.fn(async () => "ready");
-        const resolveContractEndpoint = jest.fn(async () => ({ handleCall, dispose() { } }));
-        setup.userContext.userDataContext.packageLoader = {
-            catalogReady,
-            contractRegistry: { getRegisteredProviderIds },
-            getActiveContractProviderPackageId,
-            resolveContractEndpoint,
-        };
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: async () => setup.userContext,
-        });
-        try {
-            const pending = setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, {
-                ...makeToolCall(setup.contractId),
-                ...(explicit ? { providerPackageId } : {}),
-            });
-            try {
-                await new Promise((resolve) => setImmediate(resolve));
-                expect(getRegisteredProviderIds).not.toHaveBeenCalled();
-                expect(getActiveContractProviderPackageId).not.toHaveBeenCalled();
-                expect(resolveContractEndpoint).not.toHaveBeenCalled();
-            }
-            finally {
-                release();
-            }
-            await expect(pending).resolves.toBe("ready");
-            expect(resolveContractEndpoint).toHaveBeenCalledWith(expect.objectContaining({ providerPackageId }), expect.anything());
-            expect(handleCall).toHaveBeenCalledTimes(1);
-        }
-        finally {
-            router.dispose();
-        }
-    });
-    it("resolves a signed-out contract without waiting for a user context", async () => {
-        const contractId = (0, utils_1.newid)();
-        (0, index_1.registerContractResolver)(contractId, 1, () => ({
-            contractId,
-            version: 1,
-            tools: {
-                inspect: {
-                    tool: {
-                        toolId: (0, utils_1.newid)(),
-                        name: "inspect",
-                        usageDescription: "Report that no user was required.",
-                        inputSchema: { type: "simple", fields: [] },
-                        outputSchema: { type: "simple", fields: [] },
-                        code: "",
-                        packageId: (0, utils_1.newid)(),
-                        accessLevel: 0,
-                    },
-                    toolFn: () => "signed-out",
-                },
-            },
-        }), { requiresUserContext: false });
-        const [consumerTransport, providerTransport] = (0, index_1.inProcessTransportPair)();
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(providerTransport, {
-            getUserContext: () => new Promise(() => undefined),
-            peekUserContext: () => undefined,
-        });
-        await expect(consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(contractId))).resolves.toBe("signed-out");
-        router.dispose();
-    });
-    it("routes known groups and rejects unknown contexts without creating them", async () => {
-        const setup = setupLocalRouter();
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: async () => setup.userContext,
-        });
-        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId, setup.groupId))).resolves.toBe(setup.groupId);
-        const unknownId = (0, utils_1.newid)();
-        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId, unknownId))).rejects.toThrow("not available locally");
-        expect(setup.getDataContext).not.toHaveBeenCalledWith(unknownId);
-        router.dispose();
-    });
-    it("prefers an isolated package endpoint over an in-process resolver", async () => {
-        const setup = setupLocalRouter();
-        const isolatedHandle = jest.fn(async () => "from-isolated");
-        setup.userContext.userDataContext.packageLoader = {
-            resolveIsolatedEndpoint: jest.fn(async () => ({
-                handleCall: isolatedHandle,
-                dispose() { },
-            })),
-        };
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: async () => setup.userContext,
-        });
-        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId))).resolves.toBe("from-isolated");
-        expect(isolatedHandle).toHaveBeenCalled();
-        router.dispose();
-    });
-    it("enforces an optional contract allowlist before resolving a provider", async () => {
-        const setup = setupLocalRouter();
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: async () => setup.userContext,
-            allowedContractIds: new Set([(0, utils_1.newid)()]),
-        });
-        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId))).rejects.toThrow("contract");
-        router.dispose();
-    });
-    it("appends host-only variable access to local package tool calls", async () => {
-        const setup = setupLocalRouter();
-        const resolveVariable = jest.fn(async ({ dataContext, variableName, requestingToolId }) => [dataContext.dataContextId, variableName, requestingToolId].join(":"));
-        (0, index_1.registerContractResolver)(setup.contractId, 1, () => ({
-            contractId: setup.contractId,
-            version: 1,
-            tools: {
-                inspect: {
-                    tool: {
-                        toolId: "00localcontractsecrettool",
-                        name: "inspect",
-                        usageDescription: "Resolve a local variable.",
-                        inputSchema: { type: "simple", fields: [] },
-                        outputSchema: { type: "simple", fields: [] },
-                        code: "",
-                        accessLevel: 0,
-                    },
-                    toolFn: async (variableName, context) => context.getVariable(variableName, "00localcontractsecrettool"),
-                },
-            },
-        }));
-        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
-            getUserContext: async () => setup.userContext,
-            resolveVariable,
-        });
-        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, {
-            ...makeToolCall(setup.contractId),
-            args: ["OPENAI_API_KEY"],
-        })).resolves.toBe(`${setup.userId}:OPENAI_API_KEY:00localcontractsecrettool`);
-        expect(resolveVariable).toHaveBeenCalledWith(expect.objectContaining({
-            dataContext: expect.objectContaining({ dataContextId: setup.userId }),
-            variableName: "OPENAI_API_KEY",
-            requestingToolId: "00localcontractsecrettool",
-        }));
-        router.dispose();
-    });
-});
-describe("provider-scoped contract resolvers", () => {
-    it("prefers the selected provider and preserves the unscoped fallback", () => {
-        const contractId = (0, utils_1.newid)();
-        const providerA = (0, utils_1.newid)();
-        const providerB = (0, utils_1.newid)();
-        const unscoped = jest.fn(() => ({ contractId, version: 1 }));
-        const scopedA = jest.fn(() => ({ contractId, version: 1 }));
-        (0, index_1.registerContractResolver)(contractId, 1, unscoped);
-        (0, index_1.registerContractResolver)(contractId, 1, scopedA, {
-            providerPackageId: providerA,
-        });
-        expect((0, index_1.getContractResolver)(contractId, 1, providerA)).toBe(scopedA);
-        expect((0, index_1.getContractResolver)(contractId, 1, providerB)).toBe(unscoped);
-        expect((0, index_1.getContractResolver)(contractId, 1)).toBe(unscoped);
-    });
-    it("supports legacy unscoped lookup only when a scoped provider is unambiguous", () => {
-        const contractId = (0, utils_1.newid)();
-        const providerA = (0, utils_1.newid)();
-        const providerB = (0, utils_1.newid)();
-        const scopedA = jest.fn(() => ({ contractId, version: 1 }));
-        const scopedB = jest.fn(() => ({ contractId, version: 1 }));
-        (0, index_1.registerContractResolver)(contractId, 1, scopedA, { providerPackageId: providerA });
-        expect((0, index_1.getContractResolver)(contractId, 1)).toBe(scopedA);
-        (0, index_1.registerContractResolver)(contractId, 1, scopedB, { providerPackageId: providerB });
-        expect((0, index_1.getContractResolver)(contractId, 1)).toBeUndefined();
-        expect((0, index_1.getContractResolver)(contractId, 1, providerB)).toBe(scopedB);
-    });
-});