@substrat-run/contract-tests 0.143.0 → 0.145.0

package/dist/attachment-refusal-suite.d.ts

@@ -0,0 +1,3 @@
+import type { ScopeHostFixture } from './scope-host-suite.js';
+export declare function attachmentRefusalContractSuite(adapterName: string, makeFixture: () => Promise<ScopeHostFixture>): void;
+//# sourceMappingURL=attachment-refusal-suite.d.ts.map

package/dist/attachment-refusal-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-refusal-suite.d.ts","sourceRoot":"","sources":["../src/attachment-refusal-suite.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAmC9D,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC3C,IAAI,CAsGN"}

package/dist/attachment-refusal-suite.js

@@ -0,0 +1,128 @@
+/**
+ * Attachment refusals keep their code (#113).
+ *
+ * An attachment verb refused by its gate is a `PermissionDenied` where it is raised. On the
+ * pure adapter it is thrown in-process and reaches the caller as itself. On Cloudflare it is
+ * raised inside the ScopeDO, and a throw across that hop arrives as a bare `Error` carrying
+ * only its sentence, so every reader above it had to guess the status from the words. The
+ * verbs now answer a refusal as data (`…Reply`), and this suite holds both adapters to the
+ * same answer: the code, the `permission` extension and the sentence, for every subject an
+ * attachment surface is opened as (a principal, a connection, a module's system principal),
+ * with the denial still recorded where it is refused. Each refusal has its allowed twin.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { errorCodeOf, permissionKey, platformActorId, principalId, scopeId, tenantId, toProblem, } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { capMod } from './modules.js';
+const CAP_READ = permissionKey.parse('cap:read');
+const CAP_WRITE = permissionKey.parse('cap:write');
+const doc = (id) => ({ entityType: 'doc', entityId: id });
+const bytes = (s) => new TextEncoder().encode(s);
+const refusal = (p) => p.then(() => undefined, (e) => e);
+/**
+ * The refusal as a caller reads it: its code, its declared permission and its sentence —
+ * `expectRefusal`'s check, plus the `permission` extension it does not read. A call that
+ * resolved fails it the same way, since `errorCodeOf(undefined)` is never a code.
+ */
+const expectDenied = (err, permission) => {
+    expect(errorCodeOf(err)).toBe('permission_denied');
+    expect(toProblem(err)).toMatchObject({
+        code: 'permission_denied',
+        permission,
+        detail: `permission denied: ${permission}`,
+    });
+};
+export function attachmentRefusalContractSuite(adapterName, makeFixture) {
+    describe(`attachment refusals keep their code (#113): ${adapterName}`, () => {
+        let fixture;
+        let host;
+        const t1 = tenantId.parse(ulid());
+        const s1 = scopeId.parse(ulid());
+        const alice = principalId.parse(ulid()); // read + write
+        const bob = principalId.parse(ulid()); // read only
+        const carol = principalId.parse(ulid()); // nothing
+        const staff = platformActorId.parse(ulid());
+        let file;
+        const filesOf = (who) => host.attachments(who, t1, s1);
+        const upload = (surface, name) => surface.upload({ entity: doc('d1'), filename: `${name}.txt`, contentType: 'text/plain', visibility: 'internal', body: bytes(name) });
+        const denials = async () => (await host.getScope(alice, t1, s1)).invoke('cap/denials');
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            host.registerModule(capMod);
+            await host.admin.createTenant(staff, { id: t1, slug: `att-ref-${t1.toLowerCase()}`, name: 'Attachment refusals' });
+            await host.admin.grantEntitlement(staff, t1, 'cap');
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s1, vertical: 'cap-vertical' });
+            await host.admin.activateScope(staff, t1, s1);
+            await host.provisionBlobStore(staff, { tenantId: t1, vertical: 'cap-vertical', binding: 'ATTACHMENTS' });
+            await host.admin.defineRole(staff, t1, { key: 'editor', permissions: [CAP_READ, CAP_WRITE], source: 'vertical' });
+            await host.admin.defineRole(staff, t1, { key: 'reader', permissions: [CAP_READ], source: 'vertical' });
+            const node = { tenantId: t1, scopeId: null };
+            await host.admin.assignRole(staff, { principalId: alice, roleKey: 'editor', node });
+            await host.admin.assignRole(staff, { principalId: bob, roleKey: 'reader', node });
+            file = await upload(await filesOf(alice), 'd1');
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        it('a principal without the write key: upload and remove are permission_denied, and recorded', async () => {
+            const files = await filesOf(bob);
+            expectDenied(await refusal(upload(files, 'nope')), 'cap:write');
+            expectDenied(await refusal(files.remove(file.id)), 'cap:write');
+            const rows = (await denials()).filter((d) => d.actor.includes(bob));
+            expect(rows).toContainEqual(expect.objectContaining({ permission: 'cap:write', operation: 'attachments.upload' }));
+            expect(rows).toContainEqual(expect.objectContaining({ permission: 'cap:write', operation: 'attachments.remove' }));
+            // The twin: the same key held, the same verbs succeed.
+            const mine = await filesOf(alice);
+            const extra = await upload(mine, 'extra');
+            expect((await mine.remove(extra.id))?.id).toBe(extra.id);
+        });
+        it('a principal without the read key: list and open are permission_denied, and recorded', async () => {
+            const files = await filesOf(carol);
+            expectDenied(await refusal(files.list(doc('d1'))), 'cap:read');
+            expectDenied(await refusal(files.open(file.id)), 'cap:read');
+            const rows = (await denials()).filter((d) => d.actor.includes(carol));
+            expect(rows).toContainEqual(expect.objectContaining({ permission: 'cap:read', operation: 'attachments.list' }));
+            expect(rows).toContainEqual(expect.objectContaining({ permission: 'cap:read', operation: 'attachments.open' }));
+            // The twin: a reader lists and opens the same file.
+            const theirs = await filesOf(bob);
+            expect((await theirs.list(doc('d1'))).map((r) => r.id)).toContain(file.id);
+            expect((await theirs.open(file.id))?.record.id).toBe(file.id);
+        });
+        it('an unknown id is null, not a refusal', async () => {
+            const files = await filesOf(carol);
+            expect(await files.open(ulid())).toBeNull();
+            expect(await files.remove(ulid())).toBeNull();
+        });
+        it('a connection never granted the write key: upload is permission_denied', async () => {
+            const connId = ulid();
+            await host.admin.createConnection(staff, {
+                id: connId,
+                tenantId: t1,
+                vertical: 'cap-vertical',
+                provider: 'signer',
+                label: 'signer',
+                secret: { accessToken: 'x' },
+            });
+            const files = await host.getConnectorAttachments(connId, s1);
+            expectDenied(await refusal(upload(files, 'sealed')), 'cap:write');
+            // The twin: granted the key, the same connection uploads as itself.
+            await host.admin.grantToConnection(staff, {
+                connectionId: connId,
+                permission: CAP_WRITE,
+                node: { tenantId: t1, scopeId: s1 },
+                grantedBy: staff,
+            });
+            expect((await upload(files, 'sealed')).createdBy).toBe(connId);
+        });
+        it('a module’s system principal without the read grant: open is permission_denied', async () => {
+            const moduleId = capMod.manifest.id;
+            const system = await host.getSystemAttachments(moduleId, t1, s1);
+            expectDenied(await refusal(system.open(file.id)), 'cap:read');
+            // The twin: granted the read key, the same open answers the file.
+            await host.admin.grantToSystem(staff, { moduleId, permission: CAP_READ, node: { tenantId: t1, scopeId: s1 }, grantedBy: staff });
+            expect((await system.open(file.id))?.record.id).toBe(file.id);
+        });
+    });
+}
+//# sourceMappingURL=attachment-refusal-suite.js.map

package/dist/attachment-refusal-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-refusal-suite.js","sourceRoot":"","sources":["../src/attachment-refusal-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,EACR,SAAS,GAIV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAyC,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAEnD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7E,MAAM,KAAK,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAQrE,MAAM,OAAO,GAAG,CAAC,CAAmB,EAAoB,EAAE,CACxD,CAAC,CAAC,IAAI,CACJ,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAClB,CAAC;AAEJ;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,GAAY,EAAE,UAAkB,EAAQ,EAAE;IAC9D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;QACnC,IAAI,EAAE,mBAAmB;QACzB,UAAU;QACV,MAAM,EAAE,sBAAsB,UAAU,EAAE;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,WAA4C;IAE5C,QAAQ,CAAC,+CAA+C,WAAW,EAAE,EAAE,GAAG,EAAE;QAC1E,IAAI,OAAyB,CAAC;QAC9B,IAAI,IAAe,CAAC;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe;QACrE,MAAM,GAAG,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY;QAChE,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU;QAChE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAsB,CAAC;QAE3B,MAAM,OAAO,GAAG,CAAC,GAAgB,EAA6B,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,CAAC,OAAyB,EAAE,IAAY,EAAE,EAAE,CACzD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvI,MAAM,OAAO,GAAG,KAAK,IAA0B,EAAE,CAC/C,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAc,aAAa,CAAC,CAAC;QAE1E,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACnH,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAClH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;YACxG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,YAAY,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAChE,YAAY,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACnH,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACnH,uDAAuD;YACvD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;YACnG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,YAAY,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/D,YAAY,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;YAChH,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;YAChH,oDAAoD;YACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE;gBACvC,EAAE,EAAE,MAAe;gBACnB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;aAC7B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAe,EAAE,EAAE,CAAC,CAAC;YACtE,YAAY,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAClE,oEAAoE;YACpE,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE;gBACxC,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;YAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,YAAY,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC9D,kEAAkE;YAClE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACjI,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/bind-module.d.ts

@@ -0,0 +1,220 @@
+/**
+ * The fixture behind `bindingInviteContractSuite` (#1686): one record type whose own column
+ * names its person — the shape of a support desk's contact, a shop's customer.
+ *
+ * - `brecord` — `bind_records (id, principal, email, fate)`. `principal` is the binding column,
+ *   an erasure SUBJECT beside `id`, never `erasable`; `email` is erasable.
+ * - The hook reads the records by `principal` and logs what it saw (`bind_seen`), so the suite
+ *   can see that the erasure's unbind waited for it; a record whose `fate` is `'drop'` is
+ *   DELETED by it, so the suite can see a record the hook removed still released.
+ *
+ * - `bgroup` — `bind_groups (id)`, a record's declared parent: what a grant on a parent of the
+ *   shape's type is made on (#2177).
+ *
+ * Operations are thin pass-throughs and check nothing themselves, except `bind/read`, which is
+ * the portal read a bound person makes: `bind:read-own` on that one record; `bind/allowed`,
+ * which answers the caller's own check of a key on an entity; and `bind/granted`, the caller's
+ * own grant-scoped listing.
+ */
+import { z } from 'zod';
+import { type EntityGrantShape } from '@substrat-run/contracts';
+import { type ModuleRegistration } from '@substrat-run/kernel';
+export declare const BIND_READ_OWN: string & z.$brand<"PermissionKey">;
+export declare const BIND_INVITE: string & z.$brand<"PermissionKey">;
+export declare const BIND_MEMBER: string & z.$brand<"PermissionKey">;
+/** A key the shape used to carry — what an unbind must take back too. */
+export declare const BIND_OLD: string & z.$brand<"PermissionKey">;
+export declare const bindEntities: {
+    readonly brecord: {
+        readonly table: "bind_records";
+        readonly fields: z.ZodObject<{
+            id: z.ZodString;
+            principal: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+            fate: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        readonly erasable: readonly ["email"];
+        readonly erasure: {
+            readonly subjects: readonly ["id", "principal"];
+        };
+        /** A record may sit in a group — what a grant on a parent is made on (#2177). */
+        readonly parents: readonly ["bgroup"];
+    };
+    readonly bgroup: {
+        readonly table: "bind_groups";
+        readonly fields: z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>;
+    };
+    /** What the erasure hook saw, by principal — written only by the hook. */
+    readonly bseen: {
+        readonly table: "bind_seen";
+        readonly fields: z.ZodObject<{
+            subject: z.ZodString;
+            record_id: z.ZodString;
+        }, z.core.$strip>;
+        readonly primaryKey: readonly ["subject", "record_id"];
+    };
+};
+export declare const bindModManifest: {
+    id: string & z.$brand<"ModuleId">;
+    version: string;
+    kernelContract: string;
+    permissions: {
+        key: string & z.$brand<"PermissionKey">;
+        description: string;
+    }[];
+    events: {
+        emits: {
+            type: string;
+            schemaVersion: number;
+        }[];
+        consumes: {
+            type: string;
+            schemaVersion: number;
+            from?: string | undefined;
+        }[];
+        exports?: {
+            type: string;
+            schemaVersion: number;
+            readPermission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+    };
+    migrations: {
+        journalDir: string;
+        compatibleFrom: string;
+    };
+    attachmentTargets: {
+        entityType: string;
+        readPermission: string & z.$brand<"PermissionKey">;
+        writePermission?: (string & z.$brand<"PermissionKey">) | undefined;
+    }[];
+    liveTargets?: {
+        entityType: string;
+        readPermission: string & z.$brand<"PermissionKey">;
+    }[] | undefined;
+    entityRelations?: {
+        entityType: string;
+        parentType: string;
+    }[] | undefined;
+    guards?: {
+        before: string;
+        predicate: string;
+        config: Record<string, unknown>;
+    }[] | undefined;
+    schedules?: {
+        operation: string;
+        cadence: {
+            everyMinutes: number;
+        };
+        input?: Record<string, unknown> | undefined;
+        permissions: (string & z.$brand<"PermissionKey">)[];
+        purge?: {
+            entityType: string;
+        } | undefined;
+    }[] | undefined;
+    peers?: {
+        vertical: string;
+        operations: string[];
+        permissions: (string & z.$brand<"PermissionKey">)[];
+    }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
+    withdraws?: string[] | undefined;
+    entitlementKey: string;
+    envSpec?: {
+        key: string;
+        label?: string | undefined;
+        description: string;
+        placeholder?: string | undefined;
+        required: boolean;
+        secret: boolean;
+        default?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    ownerGrants?: (string & z.$brand<"PermissionKey">)[] | undefined;
+    entitlements?: string[] | undefined;
+    provides?: string[] | undefined;
+    requires?: string[] | undefined;
+    api?: string | undefined;
+    searchables?: {
+        entityType: string;
+        fields: string[];
+        table?: string | undefined;
+        idColumn?: string | undefined;
+        tokenizer?: "prefix" | "substring" | undefined;
+    }[] | undefined;
+    lists?: {
+        entityType: string;
+        sortable: string[];
+        filterable?: string[] | undefined;
+        table?: string | undefined;
+        idColumn?: string | undefined;
+    }[] | undefined;
+    entityStates?: {
+        archivePermission?: (string & z.$brand<"PermissionKey">) | undefined;
+        trashPermission?: (string & z.$brand<"PermissionKey">) | undefined;
+        purgeAfterDays?: number | undefined;
+        purgeEarly?: boolean | undefined;
+        table?: string | undefined;
+        idColumn?: string | undefined;
+        entityType: string;
+    }[] | undefined;
+    erasure?: {
+        tables: string[];
+        entities: {
+            entityType: string;
+            table: string;
+            mode: "blank" | "custom" | "delete" | "unreached";
+            subjects?: string[] | undefined;
+            fields: {
+                name: string;
+                blank: "" | null;
+            }[];
+        }[];
+    } | undefined;
+    updatedStamps?: {
+        table: string;
+        idColumn: string;
+        at?: string | undefined;
+        by?: string | undefined;
+        entityType: string;
+    }[] | undefined;
+    ui?: {
+        routes?: {
+            path: string;
+            screen: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        nav?: {
+            label: string;
+            icon?: string | undefined;
+            to: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        entityViews?: {
+            entityType: string;
+            view: string;
+        }[] | undefined;
+        widgets?: {
+            slot: string;
+            component: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        settingsPanels?: {
+            label: string;
+            component: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+    } | undefined;
+};
+/** The binding shape, as a vertical's `ENTITY_GRANTS` declares it. */
+export declare const BIND_SHAPE: EntityGrantShape;
+/** A binding shape over `bind_dups`, whose `key` two rows may share. */
+export declare const BIND_DUP_SHAPE: EntityGrantShape;
+export declare const bindMod: ModuleRegistration;
+//# sourceMappingURL=bind-module.d.ts.map

package/dist/bind-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind-module.d.ts","sourceRoot":"","sources":["../src/bind-module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKL,KAAK,gBAAgB,EAGtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAiB,KAAK,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAG3H,eAAO,MAAM,aAAa,oCAAuC,CAAC;AAClE,eAAO,MAAM,WAAW,oCAAqC,CAAC;AAC9D,eAAO,MAAM,WAAW,oCAAqC,CAAC;AAC9D,yEAAyE;AACzE,eAAO,MAAM,QAAQ,oCAAkC,CAAC;AAExD,eAAO,MAAM,YAAY;;;;;;;;;;;;;QAMrB,iFAAiF;;;;;;;;;IAOnF,0EAA0E;;;;;;;;;CAM1E,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAc1B,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,UAAU,EAAE,gBAOxB,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,cAAc,EAAE,gBAM5B,CAAC;AAUF,eAAO,MAAM,OAAO,EAAE,kBAgDrB,CAAC"}

package/dist/bind-module.js

@@ -0,0 +1,135 @@
+/**
+ * The fixture behind `bindingInviteContractSuite` (#1686): one record type whose own column
+ * names its person — the shape of a support desk's contact, a shop's customer.
+ *
+ * - `brecord` — `bind_records (id, principal, email, fate)`. `principal` is the binding column,
+ *   an erasure SUBJECT beside `id`, never `erasable`; `email` is erasable.
+ * - The hook reads the records by `principal` and logs what it saw (`bind_seen`), so the suite
+ *   can see that the erasure's unbind waited for it; a record whose `fate` is `'drop'` is
+ *   DELETED by it, so the suite can see a record the hook removed still released.
+ *
+ * - `bgroup` — `bind_groups (id)`, a record's declared parent: what a grant on a parent of the
+ *   shape's type is made on (#2177).
+ *
+ * Operations are thin pass-throughs and check nothing themselves, except `bind/read`, which is
+ * the portal read a bound person makes: `bind:read-own` on that one record; `bind/allowed`,
+ * which answers the caller's own check of a key on an entity; and `bind/granted`, the caller's
+ * own grant-scoped listing.
+ */
+import { z } from 'zod';
+import { defineEntities, manifestEntities, moduleManifest, permissionKey, } from '@substrat-run/contracts';
+import { assertAllowed } from '@substrat-run/kernel';
+import { testOperations } from './test-operations.js';
+export const BIND_READ_OWN = permissionKey.parse('bind:read-own');
+export const BIND_INVITE = permissionKey.parse('bind:invite');
+export const BIND_MEMBER = permissionKey.parse('bind:member');
+/** A key the shape used to carry — what an unbind must take back too. */
+export const BIND_OLD = permissionKey.parse('bind:old');
+export const bindEntities = defineEntities({
+    brecord: {
+        table: 'bind_records',
+        fields: z.object({ id: z.string(), principal: z.string().nullable(), email: z.string().nullable(), fate: z.string().nullable() }),
+        erasable: ['email'],
+        erasure: { subjects: ['id', 'principal'] },
+        /** A record may sit in a group — what a grant on a parent is made on (#2177). */
+        parents: ['bgroup'],
+    },
+    bgroup: {
+        table: 'bind_groups',
+        fields: z.object({ id: z.string() }),
+    },
+    /** What the erasure hook saw, by principal — written only by the hook. */
+    bseen: {
+        table: 'bind_seen',
+        fields: z.object({ subject: z.string(), record_id: z.string() }),
+        primaryKey: ['subject', 'record_id'],
+    },
+});
+export const bindModManifest = moduleManifest.parse({
+    id: '@test/bind',
+    version: '1.0.0',
+    kernelContract: '^0.0.1',
+    permissions: [
+        { key: 'bind:read-own', description: 'read one record — the one that names you' },
+        { key: 'bind:invite', description: 'invite a record’s person, or unbind them' },
+        { key: 'bind:member', description: 'be a member of the scope' },
+        { key: 'bind:old', description: 'a key the shape retired' },
+    ],
+    events: { emits: [], consumes: [] },
+    migrations: { journalDir: './migrations', compatibleFrom: '1.0.0' },
+    entitlementKey: 'bind',
+    ...manifestEntities(bindEntities, {}),
+});
+/** The binding shape, as a vertical's `ENTITY_GRANTS` declares it. */
+export const BIND_SHAPE = {
+    entityType: 'brecord',
+    permissions: [BIND_READ_OWN],
+    bootstrap: true,
+    holder: { table: 'bind_records', idColumn: 'id', principalColumn: 'principal' },
+    retired: [BIND_OLD],
+    bind: { permission: BIND_INVITE },
+};
+/** A binding shape over `bind_dups`, whose `key` two rows may share. */
+export const BIND_DUP_SHAPE = {
+    entityType: 'bdup',
+    permissions: [BIND_READ_OWN],
+    bootstrap: true,
+    holder: { table: 'bind_dups', idColumn: 'key', principalColumn: 'holder' },
+    bind: { permission: BIND_INVITE },
+};
+const onSubjectErased = (ctx, { subjectId }) => {
+    const mine = ctx.sql.query('SELECT id, fate FROM bind_records WHERE principal = ?', [subjectId]);
+    for (const r of mine)
+        ctx.sql.exec('INSERT INTO bind_seen (subject, record_id) VALUES (?, ?)', [subjectId, r.id]);
+    ctx.sql.exec("DELETE FROM bind_records WHERE (id = ? OR principal = ?) AND fate = 'drop'", [subjectId, subjectId]);
+};
+export const bindMod = {
+    manifest: bindModManifest,
+    migrations: [
+        {
+            version: '0001-init',
+            // The index a vertical naturally has on its binding column — its portal and erasure find
+            // rows by it — and the one that makes a Durable Object's write count read one row as two.
+            sql: `CREATE TABLE bind_records (id TEXT PRIMARY KEY, principal TEXT, email TEXT, fate TEXT);
+            CREATE INDEX bind_records_by_principal ON bind_records (principal);
+            -- A holder table whose id is NOT unique: what a careless declaration can point at.
+            CREATE TABLE bind_dups (key TEXT NOT NULL, holder TEXT);
+            CREATE TABLE bind_seen (subject TEXT NOT NULL, record_id TEXT NOT NULL, PRIMARY KEY (subject, record_id));`,
+        },
+        { version: '0002-groups', sql: 'CREATE TABLE bind_groups (id TEXT PRIMARY KEY);' },
+    ],
+    ...testOperations({
+        /** Write a fixture row: `{ sql, params }` against the module's own tables. */
+        'bind/put': ((ctx, input) => {
+            ctx.sql.exec(input.sql, input.params ?? []);
+        }),
+        /** Read rows back, the spine included: `{ sql, params }`. */
+        'bind/sql': ((ctx, input) => ctx.sql.query(input.sql, input.params ?? [])),
+        /** File a record under a group: `{ child, parent }`, entity refs. */
+        'bind/link': ((ctx, input) => {
+            ctx.link(input.child, input.parent);
+        }),
+        /** Whether the caller holds `{ permission }` on `{ entity }`, by the ordinary check. */
+        'bind/allowed': (async (ctx, input) => (await ctx.check(input.permission, input.entity)).allowed),
+        /** Every id the caller's grants list for `{ permission, entityType }`, all pages, or the page kind when it is not ids. */
+        'bind/granted': (async (ctx, input) => {
+            const ids = [];
+            let cursor;
+            do {
+                const page = await ctx.grantedEntities(input.permission, input.entityType, cursor === undefined ? {} : { cursor });
+                if (page.kind !== 'ids')
+                    return page.kind;
+                ids.push(...page.ids);
+                cursor = page.nextCursor ?? undefined;
+            } while (cursor !== undefined);
+            return [...new Set(ids)].sort();
+        }),
+        /** The bound person's portal read: their own record, and nobody else's. */
+        'bind/read': (async (ctx, input) => {
+            assertAllowed(await ctx.check(BIND_READ_OWN, { entityType: 'brecord', entityId: input.id }));
+            return ctx.sql.query('SELECT id FROM bind_records WHERE id = ?', [input.id])[0] ?? null;
+        }),
+    }),
+    onSubjectErased,
+};
+//# sourceMappingURL=bind-module.js.map

package/dist/bind-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind-module.js","sourceRoot":"","sources":["../src/bind-module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,aAAa,GAId,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAwE,MAAM,sBAAsB,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAC9D,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;IACzC,OAAO,EAAE;QACP,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjI,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;QAC1C,iFAAiF;QACjF,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB;IACD,MAAM,EAAE;QACN,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACrC;IACD,0EAA0E;IAC1E,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,UAAU,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;KACrC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC;IAClD,EAAE,EAAE,YAAY;IAChB,OAAO,EAAE,OAAO;IAChB,cAAc,EAAE,QAAQ;IACxB,WAAW,EAAE;QACX,EAAE,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACjF,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC/E,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE;QAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;KAC5D;IACD,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACnC,UAAU,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE;IACnE,cAAc,EAAE,MAAM;IACtB,GAAG,gBAAgB,CAAC,YAAY,EAAE,EAAE,CAAC;CACtC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAqB;IAC1C,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,aAAa,CAAC;IAC5B,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE;IAC/E,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;CAClC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAqB;IAC9C,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,CAAC,aAAa,CAAC;IAC5B,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;IAC1E,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;CAClC,CAAC;AAEF,MAAM,eAAe,GAAoB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAsC,uDAAuD,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtI,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACrH,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,OAAO,GAAuB;IACzC,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE;QACV;YACE,OAAO,EAAE,WAAW;YACpB,yFAAyF;YACzF,0FAA0F;YAC1F,GAAG,EAAE;;;;uHAI4G;SAClH;QACD,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,iDAAiD,EAAE;KACnF;IACD,GAAG,cAAc,CAAC;QAChB,8EAA8E;QAC9E,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,KAAkD,EAAE,EAAE;YACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAY;QACb,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,KAAkD,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAY;QAClI,qEAAqE;QACrE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,KAA8C,EAAE,EAAE;YACpE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAY;QACb,wFAAwF;QACxF,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAuD,EAAE,EAAE,CACtF,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAY;QACvE,0HAA0H;QAC1H,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAwD,EAAE,EAAE;YACvF,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;YACxC,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;YAC/B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC,CAAY;QACb,2EAA2E;QAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAqB,EAAE,EAAE;YACjD,aAAa,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC1F,CAAC,CAAY;KACd,CAAC;IACF,eAAe;CAChB,CAAC"}

package/dist/binding-invite-suite.d.ts

@@ -0,0 +1,12 @@
+import { type BoundedBecomeMint, type BoundedUnbind, type EntityRef, type PrincipalBecomeCapabilityInput, type PrincipalId, type ScopeId, type TenantId } from '@substrat-run/contracts';
+import type { ScopeHostFixture } from './scope-host-suite.js';
+import type { RawScopeQuery } from './subject-erasure-suite.js';
+/** The host verbs under test — on each adapter's host class, not on `ScopeHost`. */
+export interface BindingVerbs {
+    mintBecomeCapabilityBounded(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, input: PrincipalBecomeCapabilityInput): Promise<BoundedBecomeMint>;
+    unbindEntityHolderBounded(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, entity: EntityRef): Promise<BoundedUnbind>;
+}
+export declare function bindingInviteContractSuite(adapterName: string, makeFixture: () => Promise<ScopeHostFixture & {
+    verbs: BindingVerbs;
+}>, raw: RawScopeQuery): void;
+//# sourceMappingURL=binding-invite-suite.d.ts.map

package/dist/binding-invite-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-invite-suite.d.ts","sourceRoot":"","sources":["../src/binding-invite-suite.ts"],"names":[],"mappings":"AAgCA,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAElB,KAAK,SAAS,EAEd,KAAK,8BAA8B,EACnC,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1J,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjI;AAID,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,EACtE,GAAG,EAAE,aAAa,GACjB,IAAI,CA2lBN"}