@substrat-run/contract-tests 0.147.0 → 0.148.0

package/dist/scope-host-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAqBL,KAAK,SAAS,EAqBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAeL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAa9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAytUN"}
+{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAqBL,KAAK,SAAS,EAqBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAeL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAa9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAu1UN"}

package/dist/scope-host-suite.js

@@ -5236,6 +5236,113 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(await host.admin.openSubjectPayloads(staff, t1, s, [{ subjectId: subject, sealed: sealed }]))
                 .toEqual([null]);
         });
+        /** A vertical with one admitted version, served on `ref`, and a scope pinned to `scopeRef`. */
+        const pinnedErasureFixture = async (scopeRef) => {
+            const slug = `pin-${ulid().toLowerCase().slice(-8)}`;
+            await host.admin.registerVertical(staff, { slug, name: slug, source: 'cli' });
+            const versionId = ulid();
+            const ref = `${slug}-serving`;
+            await host.admin.publishVersion(staff, {
+                id: versionId,
+                verticalSlug: slug,
+                version: `1.0.${versionId.slice(-4).toLowerCase()}`,
+                manifestDigest: `m-${versionId}`,
+                permissionDigest: 'p',
+                migrationDigest: 'g',
+                deploymentRef: ref,
+                manifestJson: JSON.stringify({
+                    version: '1.0.0', entry: 'index.js', compatibilityDate: '2026-07-01',
+                    registry: { permissions: [], roles: [], entityGrants: [] },
+                    digests: { manifest: 'm', permission: 'p', migration: 'g' },
+                }),
+            });
+            await host.admin.admitVersion(staff, versionId);
+            const s = scopeId.parse(ulid());
+            const subject = ulid();
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s, vertical: slug });
+            const [sealed] = await host.admin.sealSubjectPayloads(staff, t1, s, [{ subjectId: subject, plaintext: 'private' }]);
+            await host.admin.setVerticalServing(staff, slug, { ref, versionId, doClasses: ['ScopeDO'], migrationTag: 'v1' });
+            await host.admin.setScopeServingRef(staff, t1, s, scopeRef ?? ref);
+            const opened = () => host.admin.openSubjectPayloads(staff, t1, s, [{ subjectId: subject, sealed: sealed }]);
+            return { slug, versionId, ref, s, subject, opened };
+        };
+        const redacted = [{ events: 0, intents: 0, jobRuns: 0, idempotencyResults: 0, intentIds: [],
+                vertical: { verticalRows: [], hookRows: [], unreachedEntities: [] } }];
+        it('an erasure claim fails when the serving pointer is not the pair it read, and the key stays (#2285)', async () => {
+            const { versionId, ref, s, subject, opened } = await pinnedErasureFixture();
+            const expected = { versionId: null, servingRef: ref, epoch: 0, copyCount: 0, servingPointer: { ref, versionId: ulid() } };
+            await expectRefusal(host.admin.finalizeSubjectShred(staff, t1, s, subject, redacted, expected), 'precondition_failed');
+            expect(await opened()).toEqual(['private']);
+            expect((await host.admin.finalizeSubjectShred(staff, t1, s, subject, redacted, { ...expected, servingPointer: { ref, versionId } })).keyDestroyed).toBe(true);
+            expect(await opened()).toEqual([null]);
+        });
+        it('a scope off its pin is fenced too: a pointer moved onto its script refuses the claim (#2285)', async () => {
+            // The scope's own script is not the pointer's when the erasure reads it, so it runs no
+            // pointer version. A rollback onto that script before the claim would make it run one.
+            const { slug, versionId, ref, s, subject, opened } = await pinnedErasureFixture('old-script');
+            const expected = { versionId: null, servingRef: 'old-script', epoch: 0, copyCount: 0, servingPointer: { ref, versionId } };
+            await host.admin.setVerticalServing(staff, slug, { ref: 'old-script', versionId, doClasses: ['ScopeDO'], migrationTag: 'v1' });
+            await expectRefusal(host.admin.finalizeSubjectShred(staff, t1, s, subject, redacted, expected), 'precondition_failed');
+            expect(await opened()).toEqual(['private']);
+            expect((await host.admin.finalizeSubjectShred(staff, t1, s, subject, redacted, { ...expected, servingPointer: { ref: 'old-script', versionId } })).keyDestroyed).toBe(true);
+        });
+        it('a direct shred with a fence claims it: a moved scope keeps the key, and the pair it read destroys it (#2285)', async () => {
+            const { versionId, ref, s, subject, opened } = await pinnedErasureFixture();
+            const fence = { versionId: null, servingRef: ref, epoch: 0, copyCount: 0, servingPointer: { ref, versionId: ulid() } };
+            await expectRefusal(host.admin.shredSubject(staff, t1, s, subject, fence), 'precondition_failed');
+            expect(await opened()).toEqual(['private']);
+            expect(await host.admin.scopeErasureEpoch(staff, t1, s)).toBe(0);
+            expect((await host.admin.shredSubject(staff, t1, s, subject, { ...fence, servingPointer: { ref, versionId } })).keyDestroyed)
+                .toBe(true);
+            expect(await opened()).toEqual([null]);
+            // The claim moved the epoch every bind compares, as the orchestrated finalize's does.
+            expect(await host.admin.scopeErasureEpoch(staff, t1, s)).toBe(1);
+        });
+        // #2286, L17: what the lifecycle reaches is every binding any version declared.
+        it('keeps every scope-store binding a version declared, refuses a re-kind at publish, and names none it cannot read', async () => {
+            const slug = `bind-${ulid().toLowerCase().slice(-8)}`;
+            await host.admin.registerVertical(staff, { slug, name: slug, source: 'cli' });
+            const publish = (scopeStores, raw) => {
+                const id = ulid();
+                return host.admin.publishVersion(staff, {
+                    id,
+                    verticalSlug: slug,
+                    version: `1.0.${id.slice(-6).toLowerCase()}`,
+                    manifestDigest: `m-${id}`,
+                    permissionDigest: 'p',
+                    migrationDigest: 'g',
+                    deploymentRef: null,
+                    manifestJson: raw ?? JSON.stringify({
+                        version: '1.0.0', entry: 'index.js', compatibilityDate: '2026-07-01',
+                        registry: { permissions: [], roles: [], entityGrants: [] },
+                        digests: { manifest: 'm', permission: 'p', migration: 'g' },
+                        ...(scopeStores ? { scopeStores } : {}),
+                    }),
+                }).then(() => id);
+            };
+            await publish([{ binding: 'GRAPH', kind: 'graph' }, { binding: 'OLD', kind: 'graph' }]);
+            await publish([{ binding: 'GRAPH', kind: 'graph' }]);
+            // A dropped binding is still there.
+            expect(await host.admin.verticalScopeStores(staff, slug)).toEqual([
+                { binding: 'GRAPH', kind: 'graph' },
+                { binding: 'OLD', kind: 'graph' },
+            ]);
+            // A re-kind is refused, and the version is not stored.
+            const before = (await host.admin.listVersions(staff, slug)).length;
+            await expectRefusal(publish([{ binding: 'NEW', kind: 'graph' }, { binding: 'OLD', kind: 'counter' }]), 'conflict');
+            expect((await host.admin.listVersions(staff, slug)).length).toBe(before);
+            // So is a version that declares one binding twice.
+            await expectRefusal(publish([{ binding: 'NEW', kind: 'graph' }, { binding: 'NEW', kind: 'graph' }]), 'conflict');
+            expect((await host.admin.listVersions(staff, slug)).length).toBe(before);
+            // The twin: the same kind again, with a new binding beside it, is published.
+            await publish([{ binding: 'OLD', kind: 'graph' }, { binding: 'NEW', kind: 'graph' }]);
+            expect((await host.admin.verticalScopeStores(staff, slug)).map((s) => s.binding)).toEqual(['GRAPH', 'NEW', 'OLD']);
+            // A version whose manifest cannot be read may declare a store nobody can name.
+            await publish(undefined, '{nope');
+            await expectRefusal(host.admin.verticalScopeStores(staff, slug), 'unavailable');
+            // An unknown vertical declared none.
+            expect(await host.admin.verticalScopeStores(staff, `none-${slug}`)).toEqual([]);
+        });
         // #1722 (Codex #2008 r7): the admin-log record of a staff resolution of a kept copy. The
         // resolution itself runs in the vertical's store; the directory only records it, in full.
         it('records a kept-copy resolution in the admin log, before and after, and refuses an unknown scope', async () => {
@@ -6916,6 +7023,17 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const reclaimed = (await host.admin.listHostnames(staff, { scopeId: s2 })).find((h) => h.hostname === 'eu.example.com');
             expect(reclaimed?.scopeId).toBe(s2);
         });
+        it('an unbind for one scope leaves a name rebound to another scope bound (#2285)', async () => {
+            // `eu.example.com` is s2's now (the test above). An unroute of s1 that listed the name while
+            // it was s1's must not take it from s2: the owner is judged by the delete itself.
+            const s2Names = async () => (await host.admin.listHostnames(staff, { scopeId: s2 })).map((h) => h.hostname);
+            await host.admin.unbindHostname(staff, 'eu.example.com', { tenantId: t1, scopeId: s1 });
+            expect(await s2Names()).toContain('eu.example.com');
+            // The twin: the owner it names unbinds it, and the unbind is audited on that scope.
+            await host.admin.unbindHostname(staff, 'EU.example.com', { tenantId: t2, scopeId: s2 });
+            expect(await s2Names()).not.toContain('eu.example.com');
+            expect((await host.admin.auditLog(staff, { scopeId: s2 })).map((e) => e.action)).toContain('unbindHostname');
+        });
         it('rejects duplicate module registration', () => {
             expect(() => host.registerModule({ manifest: testModManifest })).toThrow(/already registered/);
         });