@rikalabs/akter 0.1.0-alpha.0

package/dist/testing/conformance/assertions.js

@@ -0,0 +1,849 @@
+import { Clock, Context, Crypto, Deferred, Effect, Fiber, Layer, Option, Schedule, Schema, Stream, } from "effect";
+import { Base64Url } from "effect/encoding";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpRouter } from "effect/http";
+import { Unauthorized, User } from "../../index.js";
+import { ActorError } from "../../errors/actor.js";
+import { InternalActors } from "../../runtime/actors.js";
+import { ASSERTION_HEADER, ASSERTION_TYPE, KEY_REFRESH_PATH, KEY_REFRESH_TYPE, reauthenticationDigest, requestDigest, } from "../../serve/assertion/binding.js";
+import { actorErrorBody } from "../../protocol/wire.js";
+import { gate, HttpRoom, receipts, runs, tenantOf, httpSuite } from "./http.js";
+import { endReason, opened, serveSockets, socket } from "./transports/wire.js";
+import { transportsSuite } from "./transports/actors.js";
+import { serveFetch, silentListener } from "./platform.js";
+import { serve } from "../../serve/layer.js";
+import { Auth } from "../../runtime/index.js";
+/**
+ * The runner half of hosted assertions: a runner serving with
+ * `Auth.assertion` admits a request only with a valid assertion bound
+ * to exactly that request. The cases sign assertions as an edge would, with
+ * their own Ed25519 keys.
+ */
+export const ISSUER = "https://edge.durable.test";
+export const DEPLOYMENT = "dep-assertions";
+export const REGION = "test-1";
+const utf8 = new TextEncoder();
+export const edgeKey = Effect.fnUntraced(function* (kid) {
+    const pair = yield* Effect.promise(() => crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]));
+    const { x } = yield* Effect.promise(() => crypto.subtle.exportKey("jwk", pair.publicKey));
+    return {
+        kid,
+        privateKey: pair.privateKey,
+        publicKey: { kid, kty: "OKP", crv: "Ed25519", x: x ?? "" },
+    };
+});
+const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Json));
+const decodeJson = Schema.decodeEffect(Schema.fromJsonString(Schema.Json));
+const segment = (value) => encodeJson(value).pipe(Effect.orDie, Effect.map(Base64Url.encode));
+/** A compact JWS over `claims`; the header defaults to an Ed25519 assertion under `key`. */
+export const signAssertion = Effect.fnUntraced(function* (key, claims, header) {
+    const head = yield* segment({ alg: "EdDSA", typ: ASSERTION_TYPE, kid: key.kid, ...header });
+    const signed = `${head}.${yield* segment({ ...claims })}`;
+    const signature = yield* Effect.promise(() => crypto.subtle.sign({ name: "Ed25519" }, key.privateKey, utf8.encode(signed)));
+    return `${signed}.${Base64Url.encode(new Uint8Array(signature))}`;
+});
+/** A key-set refresh push for `audience`, issued now for 10 seconds, signed with `key`. */
+export const signRefresh = Effect.fnUntraced(function* (key, audience = DEPLOYMENT) {
+    const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+    const claims = { iss: ISSUER, aud: audience, iat: now, exp: now + 10 };
+    return yield* signAssertion(key, claims, { typ: KEY_REFRESH_TYPE });
+});
+/** Claims for `tenant`'s `subject`, issued now for 10 seconds, bound to `req`. */
+export const claimsFor = Effect.fnUntraced(function* (options) {
+    const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+    return {
+        iss: ISSUER,
+        aud: DEPLOYMENT,
+        region: REGION,
+        iat: now,
+        exp: now + 10,
+        tenant: options.tenant,
+        caller: User.make({ subject: options.subject }),
+        req: options.req,
+    };
+});
+/** Sends `request` to the server at `url`. */
+const sendTo = (client, url) => (request) => Effect.gen(function* () {
+    const base = HttpClientRequest.make(request.method)(`${url}${request.path}`, {
+        headers: request.headers,
+    });
+    const keyed = request.key === undefined
+        ? base
+        : HttpClientRequest.setHeader(base, "idempotency-key", request.key);
+    const built = request.body === ""
+        ? keyed
+        : HttpClientRequest.bodyText(keyed, request.body, "application/json");
+    const response = yield* client.execute(built);
+    const text = yield* response.text;
+    return { status: response.status, body: text === "" ? undefined : yield* decodeJson(text) };
+}).pipe(Effect.orDie);
+/** Serves `HttpRoom` with `auth` from a real listening server for the rest of the scope. */
+const serveAsserted = Effect.fnUntraced(function* (auth) {
+    const actors = yield* InternalActors;
+    const random = yield* Crypto.Crypto;
+    const context = yield* Effect.context();
+    const fetchLayer = yield* Layer.build(FetchHttpClient.layer);
+    const client = Context.get(fetchLayer, HttpClient.HttpClient);
+    const app = serve({ actors: [HttpRoom], auth }).pipe(Layer.provide(Layer.succeedContext(context)), Layer.provide(Layer.succeedContext(fetchLayer)));
+    const web = HttpRouter.toWebHandler(app, { disableLogger: true });
+    yield* Effect.addFinalizer(() => Effect.promise(() => web.dispose()));
+    const port = yield* serveFetch((request) => web.handler(request));
+    const url = `http://127.0.0.1:${port}`;
+    return {
+        url,
+        send: sendTo(client, url),
+        digest: (request) => requestDigest({
+            method: request.method,
+            target: request.path,
+            idempotencyKey: request.key,
+            body: utf8.encode(request.body),
+        }),
+        mint: Effect.gen(function* () {
+            const now = yield* actors.databaseNow;
+            return `v1.${now}.${now + actors.retryWindowMs}.${yield* random.randomUUIDv4}`;
+        }).pipe(Effect.orDie),
+    };
+});
+/** A runner's assertion provider trusting exactly `keys`. */
+export const staticAuth = (keys) => Auth.assertion({
+    issuer: ISSUER,
+    audience: DEPLOYMENT,
+    region: REGION,
+    keys: { keys: keys.map((key) => key.publicKey) },
+});
+const unauthorizedBody = (code) => actorErrorBody(ActorError.make({ reason: Unauthorized.make({ code }) }));
+/** A request to `HttpRoom/<id>/<member>` with a fresh command id. */
+export const command = Effect.fnUntraced(function* (server, id, member, body = "") {
+    return {
+        method: "POST",
+        path: `/actors/HttpRoom/${id}/${member}`,
+        key: yield* server.mint,
+        body,
+        headers: {},
+    };
+});
+/** A query request, which carries no command id. */
+const query = (id, member) => ({
+    method: "POST",
+    path: `/actors/HttpRoom/${id}/${member}`,
+    key: undefined,
+    body: "",
+    headers: {},
+});
+/** An assertion for `tenant`'s alice bound to `request`, with `change` applied to its claims. */
+const assertionFor = Effect.fnUntraced(function* (options) {
+    const req = yield* options.server.digest(options.request);
+    const claims = yield* claimsFor({ tenant: options.tenant, subject: "alice", req });
+    return yield* signAssertion(options.edge, options.change === undefined ? claims : options.change(claims));
+});
+/** Sends `request` carrying `assertion`. */
+const asserted = (server, request, assertion) => server.send({ ...request, headers: { ...request.headers, [ASSERTION_HEADER]: assertion } });
+/** A key-set URL whose keys the case changes while the runner polls it. */
+const keySetServer = Effect.fnUntraced(function* (initial) {
+    let keys = initial;
+    const port = yield* serveFetch(() => Response.json({ keys: keys.map((key) => key.publicKey) }));
+    return {
+        url: new URL(`http://127.0.0.1:${port}/keys`),
+        publish: (next) => Effect.sync(() => {
+            keys = next;
+        }),
+    };
+});
+export const assertionsConformance = [
+    {
+        name: "refuses forged, unknown-kid, wrong-algorithm, and none-algorithm assertions before admission",
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const impostor = yield* edgeKey("edge-1");
+            const stranger = yield* edgeKey("edge-9");
+            const server = yield* serveAsserted(staticAuth([edge]));
+            const tenant = yield* tenantOf;
+            const before = runs.count;
+            const unsecured = (claims) => Effect.gen(function* () {
+                const header = yield* segment({ alg: "none", typ: ASSERTION_TYPE, kid: "edge-1" });
+                return `${header}.${yield* segment({ ...claims })}.`;
+            });
+            const attempts = [
+                (claims) => signAssertion(impostor, claims),
+                (claims) => signAssertion(stranger, claims),
+                (claims) => signAssertion(edge, claims, { alg: "ES256" }),
+                (claims) => signAssertion(edge, claims, { typ: "JWT" }),
+                unsecured,
+            ];
+            for (const attempt of attempts) {
+                const request = yield* command(server, "forged", "Whoami");
+                const req = yield* server.digest(request);
+                const claims = yield* claimsFor({ tenant, subject: "alice", req });
+                const reply = yield* asserted(server, request, yield* attempt(claims));
+                expect(reply.status).toBe(401);
+                expect(reply.body).toEqual(yield* unauthorizedBody("invalid_credentials"));
+            }
+            const missing = yield* server.send(yield* command(server, "forged", "Whoami"));
+            expect(missing.status).toBe(401);
+            expect(missing.body).toEqual(yield* unauthorizedBody("missing_credentials"));
+            expect(runs.count).toBe(before);
+            expect(yield* receipts(tenant, "HttpRoom", "forged")).toBe(0);
+            const request = yield* command(server, "forged", "Whoami");
+            const valid = yield* assertionFor({ edge, server, request, tenant });
+            expect(yield* asserted(server, request, valid)).toMatchObject({
+                status: 200,
+                body: `${tenant}/alice`,
+            });
+        })),
+    },
+    {
+        name: "refuses expired assertions, assertions issued in the future beyond skew, and assertions for another deployment or region",
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const server = yield* serveAsserted(staticAuth([edge]));
+            const tenant = yield* tenantOf;
+            const before = runs.count;
+            const refused = [
+                [(claims) => ({ ...claims, iat: claims.iat - 20, exp: claims.iat - 6 }), "expired"],
+                [
+                    (claims) => ({ ...claims, iat: claims.iat + 10, exp: claims.iat + 20 }),
+                    "invalid_credentials",
+                ],
+                [(claims) => ({ ...claims, exp: claims.iat + 61 }), "invalid_credentials"],
+                [(claims) => ({ ...claims, aud: "dep-other" }), "invalid_credentials"],
+                [(claims) => ({ ...claims, region: "test-2" }), "invalid_credentials"],
+                [(claims) => ({ ...claims, iss: "https://edge.other.test" }), "invalid_credentials"],
+            ];
+            for (const [change, code] of refused) {
+                const request = yield* command(server, "lifetime", "Whoami");
+                const assertion = yield* assertionFor({ edge, server, request, tenant, change });
+                const reply = yield* asserted(server, request, assertion);
+                expect(reply.status).toBe(401);
+                expect(reply.body).toEqual(yield* unauthorizedBody(code));
+            }
+            expect(runs.count).toBe(before);
+            expect(yield* receipts(tenant, "HttpRoom", "lifetime")).toBe(0);
+            const skewed = [
+                (claims) => ({ ...claims, iat: claims.iat - 10, exp: claims.iat - 1 }),
+                (claims) => ({ ...claims, iat: claims.iat + 4, exp: claims.iat + 14 }),
+            ];
+            for (const change of skewed) {
+                const request = yield* command(server, "lifetime", "Whoami");
+                const assertion = yield* assertionFor({ edge, server, request, tenant, change });
+                expect((yield* asserted(server, request, assertion)).status).toBe(200);
+            }
+        })),
+    },
+    {
+        name: "refuses an assertion moved to another method, path, query, idempotency key, or body",
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const server = yield* serveAsserted(staticAuth([edge]));
+            const tenant = yield* tenantOf;
+            const before = runs.count;
+            const original = yield* command(server, "bound", "Post", '{"text":"hello"}');
+            const signed = yield* assertionFor({ edge, server, request: original, tenant });
+            const moved = [
+                { ...original, path: "/actors/HttpRoom/other/Post" },
+                { ...original, path: "/actors/HttpRoom/bound/Hold", body: "" },
+                { ...original, path: `${original.path}?member=Hold` },
+                { ...original, key: yield* server.mint },
+                { ...original, body: '{"text":"goodbye"}' },
+                { ...original, body: '{ "text":"hello"}' },
+            ];
+            for (const request of moved) {
+                const reply = yield* asserted(server, request, signed);
+                expect(reply.status).toBe(401);
+                expect(reply.body).toEqual(yield* unauthorizedBody("invalid_credentials"));
+            }
+            const get = yield* assertionFor({
+                edge,
+                server,
+                request: { ...original, method: "GET" },
+                tenant,
+            });
+            expect((yield* asserted(server, original, get)).status).toBe(401);
+            const count = query("bound", "Count");
+            const countSigned = yield* assertionFor({ edge, server, request: count, tenant });
+            expect((yield* asserted(server, count, countSigned)).status).toBe(200);
+            expect((yield* asserted(server, query("other", "Count"), countSigned)).status).toBe(401);
+            expect(runs.count).toBe(before);
+            expect(yield* receipts(tenant, "HttpRoom", "bound")).toBe(0);
+            expect(yield* receipts(tenant, "HttpRoom", "other")).toBe(0);
+            expect(yield* asserted(server, original, signed)).toMatchObject({ status: 200, body: 1 });
+        })),
+    },
+    {
+        name: "takes the caller and tenant only from the assertion, whatever authorization the request carries",
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const server = yield* serveAsserted(staticAuth([edge]));
+            const tenant = yield* tenantOf;
+            const request = {
+                ...(yield* command(server, "caller", "Whoami")),
+                headers: { authorization: "Bearer other-tenant:mallory", cookie: "session=mallory" },
+            };
+            const assertion = yield* assertionFor({ edge, server, request, tenant });
+            expect(yield* asserted(server, request, assertion)).toMatchObject({
+                status: 200,
+                body: `${tenant}/alice`,
+            });
+            const bare = yield* server.send({
+                ...(yield* command(server, "caller", "Whoami")),
+                headers: { authorization: `Bearer ${tenant}:alice` },
+            });
+            expect(bare.status).toBe(401);
+            expect(bare.body).toEqual(yield* unauthorizedBody("missing_credentials"));
+        })),
+    },
+    {
+        name: "keeps admitted work running after its assertion expires, and replays its receipt to a newly authenticated retry",
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const server = yield* serveAsserted(staticAuth([edge]));
+            const tenant = yield* tenantOf;
+            const request = yield* command(server, "expiring", "Hold");
+            const iat = Math.floor((yield* Clock.currentTimeMillis) / 1000) - 10;
+            const exp = iat + 9;
+            const late = yield* assertionFor({
+                edge,
+                server,
+                request,
+                tenant,
+                change: (claims) => ({ ...claims, iat, exp }),
+            });
+            const entered = yield* Deferred.make();
+            const release = yield* Deferred.make();
+            gate.hold = Deferred.succeed(entered, undefined).pipe(Effect.andThen(Deferred.await(release)));
+            const before = runs.count;
+            const call = yield* asserted(server, request, late).pipe(Effect.forkChild);
+            const admitted = yield* Effect.raceFirst(Deferred.await(entered).pipe(Effect.as(undefined)), Fiber.join(call));
+            expect(admitted).toBe(undefined);
+            while ((yield* Clock.currentTimeMillis) <= (exp + 5) * 1000 + 200)
+                yield* Effect.sleep("100 millis");
+            gate.hold = Effect.void;
+            yield* Deferred.succeed(release, undefined);
+            expect(yield* Fiber.join(call)).toMatchObject({ status: 200, body: 1 });
+            const stale = yield* asserted(server, request, late);
+            expect(stale.status).toBe(401);
+            expect(stale.body).toEqual(yield* unauthorizedBody("expired"));
+            const fresh = yield* assertionFor({ edge, server, request, tenant });
+            expect(yield* asserted(server, request, fresh)).toMatchObject({ status: 200, body: 1 });
+            expect(runs.count).toBe(before + 1);
+            expect(yield* receipts(tenant, "HttpRoom", "expiring")).toBe(1);
+        })),
+    },
+    {
+        name: "accepts a rotated key during overlap and refuses a revoked key within the polling bound",
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const old = yield* edgeKey("edge-2026-08");
+            const rotated = yield* edgeKey("edge-2026-09");
+            const keySet = yield* keySetServer([old]);
+            const server = yield* serveAsserted(Auth.assertion({
+                issuer: ISSUER,
+                audience: DEPLOYMENT,
+                region: REGION,
+                keys: keySet.url,
+                refreshEvery: "1 second",
+            }));
+            const tenant = yield* tenantOf;
+            const status = Effect.fnUntraced(function* (key) {
+                const request = yield* command(server, "rotation", "Whoami");
+                const assertion = yield* assertionFor({ edge: key, server, request, tenant });
+                return (yield* asserted(server, request, assertion)).status;
+            });
+            expect(yield* status(old)).toBe(200);
+            yield* keySet.publish([old, rotated]);
+            yield* Effect.sleep("1200 millis");
+            expect(yield* status(rotated)).toBe(200);
+            expect(yield* status(old)).toBe(200);
+            yield* keySet.publish([rotated]);
+            yield* Effect.sleep("1200 millis");
+            expect(yield* status(old)).toBe(401);
+            expect(yield* status(rotated)).toBe(200);
+        })),
+    },
+    {
+        name: "rereads its key set at once on the edge's authenticated refresh push, and refuses any other push",
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const old = yield* edgeKey("edge-2026-08");
+            const rotated = yield* edgeKey("edge-2026-09");
+            const stranger = yield* edgeKey("edge-9");
+            const keySet = yield* keySetServer([old, rotated]);
+            const server = yield* serveAsserted(Auth.assertion({
+                issuer: ISSUER,
+                audience: DEPLOYMENT,
+                region: REGION,
+                keys: keySet.url,
+            }));
+            const tenant = yield* tenantOf;
+            const status = Effect.fnUntraced(function* (key) {
+                const request = yield* command(server, "pushed", "Whoami");
+                const assertion = yield* assertionFor({ edge: key, server, request, tenant });
+                return (yield* asserted(server, request, assertion)).status;
+            });
+            const push = (token) => server.send({
+                method: "POST",
+                path: KEY_REFRESH_PATH,
+                key: undefined,
+                body: "",
+                headers: token === undefined ? {} : { [ASSERTION_HEADER]: token },
+            });
+            expect(yield* status(old)).toBe(200);
+            yield* keySet.publish([rotated]);
+            expect(yield* status(old)).toBe(200);
+            const refused = [
+                yield* push(undefined),
+                yield* push(yield* signRefresh(stranger)),
+                yield* push(yield* signRefresh(rotated, "dep-other")),
+                yield* push(yield* assertionFor({
+                    edge: rotated,
+                    server,
+                    request: yield* command(server, "pushed", "Whoami"),
+                    tenant,
+                })),
+            ];
+            expect(refused.map((reply) => reply.status)).toEqual([401, 401, 401, 401]);
+            expect(yield* status(old)).toBe(200);
+            expect((yield* push(yield* signRefresh(rotated))).status).toBe(204);
+            expect(yield* status(old)).toBe(401);
+            expect((yield* push(yield* signRefresh(rotated))).status).toBe(204);
+            expect(yield* status(rotated)).toBe(200);
+        })),
+    },
+    {
+        name: "refuses a reauthentication assertion whose sid belongs to another session",
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* edgeKey("edge-1");
+            const host = yield* serveSockets(environment, { auth: staticAuth([edge]) });
+            const tenant = yield* tenantOf;
+            const path = "/api/actors/SocketRoom/asserted/Chat";
+            const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+            const upgrade = yield* requestDigest({
+                method: "GET",
+                target: path,
+                idempotencyKey: undefined,
+                body: new Uint8Array(0),
+            });
+            const bearer = (claims) => signAssertion(edge, claims).pipe(Effect.map((jws) => `Bearer ${jws}`));
+            const base = yield* claimsFor({ tenant, subject: "alice", req: upgrade });
+            const opening = yield* bearer({ ...base, sid: "session-a", cexp: now + 3600 });
+            const ws = yield* socket(host, "asserted");
+            yield* ws.send({ t: "hello", authorization: opening, params: { name: "alice" } });
+            expect((yield* opened(yield* ws.next())).reauthenticateBy).toBe((now + 3600) * 1000);
+            const renewal = Effect.fnUntraced(function* (sid) {
+                const req = yield* reauthenticationDigest({ path, session: sid });
+                return yield* bearer({ ...base, req, sid, cexp: now + 7200 });
+            });
+            yield* ws.send({ t: "reauthenticate", authorization: yield* renewal("session-a") });
+            expect((yield* ws.until("reauthenticated")).at(-1)).toEqual({
+                t: "reauthenticated",
+                by: (now + 7200) * 1000,
+            });
+            yield* ws.send({ t: "reauthenticate", authorization: yield* renewal("session-b") });
+            expect(yield* endReason((yield* ws.until("end")).at(-1))).toMatchObject({
+                tag: "Unauthorized",
+                code: "invalid_credentials",
+            });
+            expect((yield* ws.closed).code).toBe(1008);
+            const second = yield* socket(host, "asserted");
+            const secondOpening = yield* bearer({ ...base, sid: "session-c" });
+            yield* second.send({
+                t: "hello",
+                authorization: secondOpening,
+                params: { name: "alice" },
+            });
+            yield* opened(yield* second.next());
+            yield* second.send({ t: "reauthenticate", authorization: secondOpening });
+            expect(yield* endReason((yield* second.until("end")).at(-1))).toMatchObject({
+                tag: "Unauthorized",
+                code: "invalid_credentials",
+            });
+        })),
+    },
+];
+export const edgeOf = (edge) => edge === undefined ? Effect.die(new Error("The case needs a hosted edge")) : Effect.succeed(edge);
+/** Sends requests to the server at `url` for the rest of the scope. */
+export const clientFor = Effect.fnUntraced(function* (url) {
+    const client = Context.get(yield* Layer.build(FetchHttpClient.layer), HttpClient.HttpClient);
+    return sendTo(client, url);
+});
+/** A runner in `region` that trusts `edge`, rereading its key set every second. */
+export const edgeRunner = Effect.fnUntraced(function* (edge, region) {
+    return yield* serveAsserted(Auth.assertion({
+        issuer: edge.issuer,
+        audience: edge.deployment,
+        region,
+        keys: edge.keys,
+        refreshEvery: "1 second",
+    }));
+});
+export const bearerHeaders = (key) => ({ authorization: `Bearer ${key}` });
+/**
+ * A proxy in front of a runner that holds each request for the delay its
+ * path's actor id names, and counts the requests that reached it.
+ */
+export const delayingProxy = Effect.fnUntraced(function* (target) {
+    const delays = new Map();
+    const failures = new Map();
+    const arrived = [];
+    const cookies = [];
+    const client = Context.get(yield* Layer.build(FetchHttpClient.layer), HttpClient.HttpClient);
+    const context = yield* Effect.context();
+    const hold = (request) => Effect.gen(function* () {
+        const path = new URL(request.url).pathname;
+        const body = new Uint8Array(yield* Effect.promise(() => request.arrayBuffer()));
+        arrived.push(path);
+        cookies.push(request.headers.get("cookie"));
+        const failing = failures.get(path) ?? 0;
+        if (failing > 0) {
+            failures.set(path, failing - 1);
+            return new Response(null, { status: 503 });
+        }
+        yield* Effect.sleep(delays.get(path.split("/")[3] ?? "") ?? 0);
+        const forwarded = HttpClientRequest.make(request.method === "GET" ? "GET" : "POST")(`${target}${path}`, { headers: Object.fromEntries(request.headers) });
+        const response = yield* client.execute(body.byteLength === 0
+            ? forwarded
+            : HttpClientRequest.bodyUint8Array(forwarded, body, request.headers.get("content-type") ?? undefined));
+        return new Response(yield* response.arrayBuffer, {
+            status: response.status,
+            headers: response.headers,
+        });
+    }).pipe(Effect.orDie);
+    const port = yield* serveFetch((request) => Effect.runPromiseWith(context)(hold(request)));
+    return {
+        url: `http://127.0.0.1:${port}`,
+        delay: (id, ms) => Effect.sync(() => delays.set(id, ms)),
+        /** Answers the next `times` requests for `path` with 503. */
+        fail: (path, times) => Effect.sync(() => failures.set(path, times)),
+        arrived: Effect.sync(() => arrived.length),
+        /** The `cookie` header of each request that reached the proxy, `null` when it had none. */
+        cookies: Effect.sync(() => [...cookies]),
+    };
+});
+/** Edge cases: the edge strips client-supplied assertions, signs the caller it authenticated, honors key rotation and revocation bounds, and routes across runners and regions. */
+export const edgeConformance = [
+    {
+        name: "refuses a body over its request limit by content-length and stops reading a streamed one soon after the limit",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({ primaryRegion: REGION });
+            const runner = yield* edgeRunner(edge, REGION);
+            yield* edge.addRunner({ region: REGION, url: runner.url });
+            const client = Context.get(yield* Layer.build(FetchHttpClient.layer), HttpClient.HttpClient);
+            const target = `${edge.url}/actors/HttpRoom/limited/Post`;
+            const chunk = new Uint8Array(64 * 1024);
+            let produced = 0;
+            const endless = Stream.fromEffectRepeat(Effect.sync(() => {
+                produced += chunk.byteLength;
+                return chunk;
+            }));
+            const reply = (request) => client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({ status: response.status, text }))), Effect.timeout("10 seconds"), Effect.orDie);
+            const streamed = yield* reply(HttpClientRequest.post(target).pipe(HttpClientRequest.bodyStream(endless)));
+            expect(streamed.status).toBe(413);
+            expect(streamed.text.includes('"code":"too_large"')).toBe(true);
+            expect(produced < 16 * 1024 * 1024).toBe(true);
+            const declared = yield* reply(HttpClientRequest.post(target).pipe(HttpClientRequest.bodyUint8Array(new Uint8Array(2 * 1024 * 1024))));
+            expect(declared.status).toBe(413);
+            expect(declared.text.includes('"code":"too_large"')).toBe(true);
+        })),
+    },
+    {
+        name: "forwards no client cookie to a runner",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({ primaryRegion: REGION });
+            const runner = yield* edgeRunner(edge, REGION);
+            const door = yield* delayingProxy(runner.url);
+            yield* edge.addRunner({ region: REGION, url: door.url });
+            const send = yield* clientFor(edge.url);
+            const tenant = yield* tenantOf;
+            const key = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            const reply = yield* send({
+                ...(yield* command(runner, "cookies", "Whoami")),
+                headers: { ...bearerHeaders(key), cookie: "session=secret-session-cookie" },
+            });
+            expect(reply).toMatchObject({ status: 200, body: `${tenant}/alice` });
+            expect(yield* door.cookies).toEqual([null]);
+        })),
+    },
+    {
+        name: "closes a client socket that sends a message over the frame limit, or floods past its buffer while no runner has accepted it",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({ primaryRegion: REGION });
+            const silent = yield* silentListener;
+            yield* edge.addRunner({ region: REGION, url: `http://127.0.0.1:${silent}` });
+            const host = new URL(edge.url).host;
+            const oversized = yield* socket(host, "oversized");
+            yield* oversized.send({ t: "hello", params: { name: "alice" } });
+            yield* oversized.sendRaw("x".repeat(70 * 1024));
+            expect([1006, 1009]).toContain((yield* oversized.closed).code);
+            expect(yield* oversized.poll(100)).toEqual(Option.none());
+            const flooding = yield* socket(host, "flooding");
+            yield* flooding.send({ t: "hello", params: { name: "alice" } });
+            for (let index = 0; index < 40; index++)
+                yield* flooding.sendRaw("x".repeat(60 * 1024));
+            expect((yield* flooding.closed).code).toBe(1008);
+            expect(yield* flooding.poll(100)).toEqual(Option.none());
+        })),
+    },
+    {
+        name: "strips a client-supplied durable-assertion and takes the caller only from the assertion",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({ primaryRegion: REGION });
+            const runner = yield* edgeRunner(edge, REGION);
+            const send = yield* clientFor(edge.url);
+            const tenant = yield* tenantOf;
+            const key = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            yield* edge.addRunner({ region: REGION, url: runner.url });
+            const forger = yield* edgeKey("edge-1");
+            const request = yield* command(runner, "stripped", "Whoami");
+            const forged = yield* assertionFor({
+                edge: forger,
+                server: runner,
+                request,
+                tenant: "mallory",
+            });
+            const reply = yield* send({
+                ...request,
+                headers: { ...bearerHeaders(key), [ASSERTION_HEADER]: forged },
+            });
+            expect(reply).toMatchObject({ status: 200, body: `${tenant}/alice` });
+            const bare = yield* send({
+                ...(yield* command(runner, "stripped", "Whoami")),
+                headers: { [ASSERTION_HEADER]: forged },
+            });
+            expect(bare.status).toBe(401);
+            expect(bare.body).toEqual(yield* unauthorizedBody("missing_credentials"));
+        })),
+    },
+    {
+        name: "refuses new requests from a revoked caller at the edge, and admits in-flight ones only within the assertion lifetime",
+        requiresEdge: true,
+        timeoutMs: 40_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({
+                primaryRegion: REGION,
+                assertionSeconds: 1,
+            });
+            const runner = yield* edgeRunner(edge, REGION);
+            const proxy = yield* delayingProxy(runner.url);
+            const send = yield* clientFor(edge.url);
+            const tenant = yield* tenantOf;
+            const key = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            yield* edge.addRunner({ region: REGION, url: proxy.url });
+            yield* proxy.delay("held-long", 7_000);
+            yield* proxy.delay("held-short", 300);
+            const long = yield* command(runner, "held-long", "Whoami");
+            const short = yield* command(runner, "held-short", "Whoami");
+            const late = yield* send({ ...long, headers: bearerHeaders(key) }).pipe(Effect.forkChild);
+            const inTime = yield* send({ ...short, headers: bearerHeaders(key) }).pipe(Effect.forkChild);
+            while ((yield* proxy.arrived) < 2)
+                yield* Effect.sleep("20 millis");
+            yield* edge.revokeApiKey(key);
+            const refused = yield* send({
+                ...(yield* command(runner, "after", "Whoami")),
+                headers: bearerHeaders(key),
+            });
+            expect(refused.status).toBe(401);
+            expect(refused.body).toEqual(yield* unauthorizedBody("invalid_credentials"));
+            expect(yield* proxy.arrived).toBe(2);
+            expect(yield* Fiber.join(inTime)).toMatchObject({ status: 200, body: `${tenant}/alice` });
+            const expired = yield* Fiber.join(late);
+            expect(expired.status).toBe(401);
+            expect(expired.body).toEqual(yield* unauthorizedBody("expired"));
+            expect(yield* receipts(tenant, "HttpRoom", "held-long")).toBe(0);
+            expect(yield* receipts(tenant, "HttpRoom", "after")).toBe(0);
+        })),
+    },
+    {
+        name: "reauthenticates a WebSocket session through the edge and closes it at the revocation bound",
+        requiresEdge: true,
+        timeoutMs: 40_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({
+                primaryRegion: REGION,
+                apiKeySessionSeconds: 4,
+            });
+            const host = yield* serveSockets(environment, {
+                auth: Auth.assertion({
+                    issuer: edge.issuer,
+                    audience: edge.deployment,
+                    region: REGION,
+                    keys: edge.keys,
+                    refreshEvery: "1 second",
+                }),
+            });
+            yield* edge.addRunner({ region: REGION, url: `http://${host}`, basePath: "/api/" });
+            yield* edge.addRunner({ region: REGION, url: "http://127.0.0.1:9", basePath: "/api" });
+            const tenant = yield* tenantOf;
+            const key = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            const probe = yield* socket(new URL(edge.url).host, "through-edge");
+            yield* probe.send({
+                t: "hello",
+                authorization: `Bearer ${key}`,
+                params: { name: "alice" },
+            });
+            yield* opened(yield* probe.next());
+            yield* probe.close;
+            const ws = yield* socket(new URL(edge.url).host, "through-edge");
+            yield* ws.send({ t: "hello", authorization: `Bearer ${key}`, params: { name: "alice" } });
+            const open = yield* opened(yield* ws.next());
+            const started = yield* Clock.currentTimeMillis;
+            const by = open.reauthenticateBy ?? 0;
+            expect(by > started + 2_000 && by <= started + 4_000).toBe(true);
+            const asked = (yield* ws.until("reauthenticate", 10_000)).at(-1);
+            expect(asked?.t).toBe("reauthenticate");
+            yield* Effect.sleep("1100 millis");
+            yield* ws.send({ t: "reauthenticate", authorization: `Bearer ${key}` });
+            const renewed = (yield* ws.until("reauthenticated", 10_000)).at(-1);
+            expect(renewed?.t === "reauthenticated" && (renewed.by ?? 0) > (open.reauthenticateBy ?? 0)).toBe(true);
+            yield* edge.revokeApiKey(key);
+            yield* ws.until("reauthenticate", 10_000);
+            yield* ws.send({ t: "reauthenticate", authorization: `Bearer ${key}` });
+            expect(yield* endReason((yield* ws.until("end", 10_000)).at(-1))).toMatchObject({
+                tag: "Unauthorized",
+                code: "invalid_credentials",
+            });
+            expect((yield* ws.closed).code).toBe(1008);
+            expect((yield* Clock.currentTimeMillis) - started < 10_000).toBe(true);
+        })),
+    },
+    {
+        name: "pushes a signing-key revocation to runners, which refuse the key well before their polling bound",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const old = yield* edgeKey("edge-2026-08");
+            const rotated = yield* edgeKey("edge-2026-09");
+            const edge = yield* (yield* edgeOf(environment.edge)).start({
+                primaryRegion: REGION,
+                signingKeys: [old, rotated],
+            });
+            const runner = yield* serveAsserted(Auth.assertion({
+                issuer: edge.issuer,
+                audience: edge.deployment,
+                region: REGION,
+                keys: edge.keys,
+            }));
+            const door = yield* delayingProxy(runner.url);
+            yield* door.fail(KEY_REFRESH_PATH, 1);
+            yield* edge.addRunner({ region: REGION, url: door.url, basePath: "/" });
+            const send = yield* clientFor(edge.url);
+            const tenant = yield* tenantOf;
+            const apiKey = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            const direct = Effect.fnUntraced(function* (key) {
+                const request = yield* command(runner, "revoked-key", "Whoami");
+                const claims = yield* claimsFor({
+                    tenant,
+                    subject: "alice",
+                    req: yield* runner.digest(request),
+                });
+                const assertion = yield* signAssertion(key, {
+                    ...claims,
+                    iss: edge.issuer,
+                    aud: edge.deployment,
+                });
+                return (yield* asserted(runner, request, assertion)).status;
+            });
+            expect(yield* direct(old)).toBe(200);
+            const started = yield* Clock.currentTimeMillis;
+            yield* edge.revokeSigningKey(old.kid);
+            const refused = yield* direct(old).pipe(Effect.repeat({
+                until: (status) => status === 401,
+                schedule: Schedule.spaced("100 millis"),
+                times: 100,
+            }));
+            const elapsed = (yield* Clock.currentTimeMillis) - started;
+            expect(refused).toBe(401);
+            expect(elapsed < 10_000).toBe(true);
+            expect(yield* direct(rotated)).toBe(200);
+            const through = yield* send({
+                ...(yield* command(runner, "revoked-key", "Whoami")),
+                headers: bearerHeaders(apiKey),
+            });
+            expect(through).toMatchObject({ status: 200, body: `${tenant}/alice` });
+        })),
+    },
+    {
+        name: "fails a WebSocket over to the next runner with an assertion signed after it accepts",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({
+                primaryRegion: REGION,
+                assertionSeconds: 2,
+            });
+            const host = yield* serveSockets(environment, {
+                auth: Auth.assertion({
+                    issuer: edge.issuer,
+                    audience: edge.deployment,
+                    region: REGION,
+                    keys: edge.keys,
+                    refreshEvery: "1 second",
+                }),
+            });
+            const hole = yield* silentListener;
+            yield* edge.addRunner({ region: REGION, url: `http://${host}`, basePath: "/api" });
+            yield* edge.addRunner({ region: REGION, url: `http://127.0.0.1:${hole}` });
+            const tenant = yield* tenantOf;
+            const key = yield* edge.issueApiKey({ tenant, subject: "alice" });
+            for (let index = 0; index < 2; index++) {
+                const ws = yield* socket(new URL(edge.url).host, "fail-over");
+                yield* ws.send({
+                    t: "hello",
+                    authorization: `Bearer ${key}`,
+                    params: { name: "alice" },
+                });
+                expect((yield* ws.next(10_000)).t).toBe("open");
+                yield* ws.close;
+            }
+        })),
+    },
+    {
+        name: "routes a tenant with no directory row to the primary region and never writes a row",
+        requiresEdge: true,
+        timeoutMs: 30_000,
+        run: ({ expect, environment }) => environment.run(Effect.gen(function* () {
+            const edge = yield* (yield* edgeOf(environment.edge)).start({ primaryRegion: REGION });
+            const other = "test-2";
+            const primary = yield* edgeRunner(edge, REGION);
+            const secondary = yield* edgeRunner(edge, other);
+            const primaryDoor = yield* delayingProxy(primary.url);
+            const secondaryDoor = yield* delayingProxy(secondary.url);
+            const send = yield* clientFor(edge.url);
+            yield* edge.addRunner({ region: REGION, url: primaryDoor.url });
+            yield* edge.addRunner({ region: other, url: secondaryDoor.url });
+            const homeless = yield* tenantOf;
+            const moved = yield* tenantOf;
+            const homelessKey = yield* edge.issueApiKey({ tenant: homeless, subject: "alice" });
+            const movedKey = yield* edge.issueApiKey({ tenant: moved, subject: "alice" });
+            yield* edge.home({ tenant: moved, region: other });
+            const call = (key) => Effect.flatMap(command(primary, "routed", "Whoami"), (request) => send({ ...request, headers: bearerHeaders(key) }));
+            for (let index = 0; index < 3; index++)
+                expect(yield* call(homelessKey)).toMatchObject({
+                    status: 200,
+                    body: `${homeless}/alice`,
+                });
+            expect(yield* primaryDoor.arrived).toBe(3);
+            expect(yield* secondaryDoor.arrived).toBe(0);
+            expect(yield* call(movedKey)).toMatchObject({ status: 200, body: `${moved}/alice` });
+            expect(yield* secondaryDoor.arrived).toBe(1);
+            expect(yield* edge.directoryRows).toBe(1);
+            yield* edge.home({ tenant: homeless, region: other });
+            const reached = yield* call(homelessKey).pipe(Effect.andThen(secondaryDoor.arrived), Effect.repeat({
+                until: (arrived) => arrived > 1,
+                schedule: Schedule.spaced("200 millis"),
+                times: 100,
+            }));
+            expect(reached).toBe(2);
+        })),
+    },
+];
+/** Assertion and edge cases call the served HTTP actors and the socket room. */
+export const assertionsSuite = {
+    uses: [httpSuite, transportsSuite],
+};