@substrat-run/contract-tests 0.160.0 → 0.162.0

package/dist/scope-host-suite.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
 import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, LIST_PAGE_MAX, KERNEL_AUTHORED_EVENT_TYPES, EMAIL_SENT, PLATFORM_REQUEST_ENTITY_TYPE, SEND_EMAIL_KIND, isUndecodablePlatformRequest, platformRequestEntry, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, unheldMigrationDigest, withUpstreamReference, } from '@substrat-run/contracts';
-import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, withheldOpsFailure, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, WIRE_AUTH_FILTER_TEXT_MAX, } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, withheldOpsFailure, withheldStaffFailure, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, WIRE_AUTH_FILTER_TEXT_MAX, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, TEST_LIFECYCLE, testModManifest, victimModManifest, } from './modules.js';
 import { testOperations } from './test-operations.js';
 import { derivedDigestOf, heldMigrations } from './held-migrations.js';
@@ -2368,6 +2368,21 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 // The spine: present and flagged system, so the UI can group it apart.
                 expect(byName.get('_substrat_outbox')?.system).toBe(true);
             });
+            it('counts what is in force apart from what a table keeps as tombstones (#2531)', async () => {
+                const key = `introspect-${ulid().toLowerCase()}`;
+                await host.admin.defineRole(staff, t1, { key, permissions: [permissionKey.parse('thing:read')], source: 'vertical' });
+                const seat = { principalId: principalId.parse(ulid()), roleKey: key, node: { tenantId: t1, scopeId: s1 } };
+                const tuples = async () => (await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_tuples');
+                const before = await tuples();
+                expect(before.liveRowCount).toBeDefined();
+                await host.admin.assignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount + 1 });
+                // A revoke tombstones the seat: the row is kept, and it is no longer in force.
+                await host.admin.unassignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount });
+                // A table that keeps no tombstones answers no live count.
+                expect((await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_outbox')).not.toHaveProperty('liveRowCount');
+            });
             it('reads a bounded page of a table', async () => {
                 const stub = await host.getScope(alice, t1, s1);
                 await stub.invoke('test/write-marker', { v: 'page-row' });
@@ -3126,6 +3141,29 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                         expect(await rowsOf(ops.elsewhere)).toEqual(before.elsewhere);
                         await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
                     });
+                    it("#2556: staff's row alone, for a withheld pass that left a tombstoned intent pending, is redacted too", async () => {
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        const linked = await routeIntent(kind, erased, 'Anna Ek');
+                        const unlinked = await routeIntent(kind, spared, 'Bo Lund');
+                        // As the drain files it (`withheldStaffFailure`): no tenant, the drained scope, marker first.
+                        const transient = (operation, id, error) => host.admin.recordOpsFailure({
+                            actor: staff,
+                            ...withheldStaffFailure({ operation, stage: 'transient', scopeId: s1 }, `${error}; reference = up${ulid().toLowerCase()}`, ulid(), platformIntentFailureMessage(id, 'pending (the call did not complete at its deployment): ')),
+                        });
+                        const ops = { linked: op('transient-linked'), unlinked: op('transient-unlinked') };
+                        await transient(ops.linked, linked, 'HTTP 500: Anna Ek is not on file');
+                        await transient(ops.unlinked, unlinked, 'HTTP 500: Bo Lund is not on file');
+                        const rowsOf = async (operation) => (await host.admin.listOpsFailures(staff, { operation })).map((r) => [r.tenantId, r.message]);
+                        const before = await rowsOf(ops.unlinked);
+                        expect((await rowsOf(ops.linked))[0][1]).toMatch(/^\[upstream reference = up[0-9a-z]+\] platform intent .* pending \(the call did not complete at its deployment\): HTTP 500: /);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect(await rowsOf(ops.linked)).toEqual([[null, REDACTED_FAILURE_NOTE]]);
+                        expect((await issueOf(ops.linked)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                        expect(await rowsOf(ops.unlinked)).toEqual(before);
+                        await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
+                    });
                     /** Whose an exemplar is, as the directory stores it — not on the issue read shape. */
                     const exemplarOwnerOf = async (operation) => {
                         const dump = await host.admin.exportDirectory(staff);
@@ -7440,7 +7478,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.setVerticalListed(staff, slug, true);
             await host.admin.promoteVersion(staff, slug, 'prod', first);
             expect((await host.admin.getScopeRecord(staff, t2, install))?.verticalVersionId).toBe(next);
-        });
+            // Seven scopes, a snapshot and three promotions: about 3 s alone, past the 5 s default under CI load (#2576).
+        }, 30_000);
         it('publish refuses an auto-admitted prod version until a staff admit vouches for it', async () => {
             // Listing is the moment OTHER tenants start trusting this code, so the version
             // they would install needs a recorded human decision — the auto-admission note
@@ -9709,8 +9748,22 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const at = (time) => `2026-10-24T${time}.000Z`;
             /** The whole fleet, one full page: every read names its reach and its limit. */
             const fleet = { reach: { fleet: true }, limit: LIST_PAGE_MAX };
-            /** Record `rec` for the script `<vertical>-<script>`. */
-            const put = (vertical, script, versionId, rec, time) => host.admin.recordWireAuth(staff, { deploymentRef: `${vertical}-${script}`, verticalSlug: vertical, versionId, record: rec, recordedAt: at(time) });
+            /** The verticals this block registered: a record is written only beside its vertical's registration. */
+            const registered = new Set();
+            const register = async (slug, ownerTenant) => {
+                await host.admin.registerVertical(staff, { slug, name: slug, source: 'cli', ...(ownerTenant ? { ownerTenant } : {}) });
+                registered.add(slug);
+            };
+            const forget = async (slug) => {
+                await host.admin.deleteVertical(staff, slug);
+                registered.delete(slug);
+            };
+            /** Record `rec` for the script `<vertical>-<script>`, registering the vertical (platform-owned) first when no test did. */
+            const put = async (vertical, script, versionId, rec, time) => {
+                if (!registered.has(vertical))
+                    await register(vertical);
+                await host.admin.recordWireAuth(staff, { deploymentRef: `${vertical}-${script}`, verticalSlug: vertical, versionId, record: rec, recordedAt: at(time) });
+            };
             it('keeps one record per deployment, the last upload’s, and lists one vertical’s by deployment', async () => {
                 const [a, b] = [slugOf('wire-a'), slugOf('wire-b')];
                 await put(a, 'serving', 'v1', record({ audience: `${a}-serving` }), '10:00:00');
@@ -9825,26 +9878,25 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const [owner, other] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
                 await host.admin.createTenant(staff, { id: owner, slug: `wire-own-${owner.slice(-6).toLowerCase()}`, name: 'Wire Owner' });
                 await host.admin.createTenant(staff, { id: other, slug: `wire-oth-${other.slice(-6).toLowerCase()}`, name: 'Wire Other' });
-                const [mine, theirs, platform, unregistered] = [slugOf('wire-mine'), slugOf('wire-theirs'), slugOf('wire-plat'), slugOf('wire-unreg')];
-                await host.admin.registerVertical(staff, { slug: mine, name: 'Mine', source: 'cli', ownerTenant: owner });
-                await host.admin.registerVertical(staff, { slug: theirs, name: 'Theirs', source: 'cli', ownerTenant: other });
-                await host.admin.registerVertical(staff, { slug: platform, name: 'Platform', source: 'cli' });
-                for (const [i, slug] of [mine, theirs, platform, unregistered].entries()) {
+                const [mine, theirs, platform] = [slugOf('wire-mine'), slugOf('wire-theirs'), slugOf('wire-plat')];
+                await register(mine, owner);
+                await register(theirs, other);
+                await register(platform);
+                for (const [i, slug] of [mine, theirs, platform].entries()) {
                     await put(slug, 'serving', null, record(), `16:00:0${i}`);
                     await put(slug, 'archive', 'v1', record(), `16:00:1${i}`);
                 }
                 const refs = async (reach, verticalSlug) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, ...(verticalSlug ? { verticalSlug } : {}) }))
                     .map((r) => r.deploymentRef)
-                    .filter((ref) => [mine, theirs, platform, unregistered].some((slug) => ref.startsWith(`${slug}-`)));
+                    .filter((ref) => [mine, theirs, platform].some((slug) => ref.startsWith(`${slug}-`)));
                 expect(await refs({ tenantId: owner })).toEqual([`${mine}-archive`, `${mine}-serving`]);
                 expect(await refs({ tenantId: other })).toEqual([`${theirs}-archive`, `${theirs}-serving`]);
                 // Naming another tenant's vertical inside one tenant's reach reaches nothing, not that vertical.
                 expect(await refs({ tenantId: owner }, theirs)).toEqual([]);
                 expect(await refs({ tenantId: owner }, mine)).toEqual([`${mine}-archive`, `${mine}-serving`]);
-                // A tenant that owns nothing reaches nothing; a vertical no tenant owns, or the registry does not
-                // know, is reached by the fleet alone.
+                // A tenant that owns nothing reaches nothing; a vertical no tenant owns is reached by the fleet alone.
                 expect(await refs({ tenantId: tenantId.parse(ulid()) })).toEqual([]);
-                for (const slug of [mine, theirs, platform, unregistered]) {
+                for (const slug of [mine, theirs, platform]) {
                     expect(await refs({ fleet: true }, slug)).toEqual([`${slug}-archive`, `${slug}-serving`]);
                 }
                 // A page inside the reach pages over the tenant's records only.
@@ -9891,7 +9943,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const owner = tenantId.parse(ulid());
                 await host.admin.createTenant(staff, { id: owner, slug: `wire-log-${owner.slice(-6).toLowerCase()}`, name: 'Wire Log' });
                 const mine = slugOf('wire-logged');
-                await host.admin.registerVertical(staff, { slug: mine, name: 'Logged', source: 'cli', ownerTenant: owner });
+                await register(mine, owner);
                 await put(mine, 'serving', null, record(), '17:00:00');
                 // The reach given last, as a caller may spell it: the log still names it first.
                 await host.admin.listWireAuth(staff, { limit: 5, verticalSlug: mine, reach: { tenantId: owner } });
@@ -9919,30 +9971,119 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await host.admin.createTenant(staff, { id: second, slug: `wire-snd-${second.slice(-6).toLowerCase()}`, name: 'Wire Second' });
                 const slug = slugOf('wire-owned');
                 const refsOf = async (owner) => (await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => r.deploymentRef);
-                // A record written while no tenant owned the slug is read by whoever owns it when the read runs.
+                // The owner reads what was recorded while it held the slug.
+                await register(slug, first);
                 await put(slug, 'archive', 'v0', record(), '18:00:00');
-                expect(await refsOf(first)).toEqual([]);
-                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: first });
                 expect(await refsOf(first)).toEqual([`${slug}-archive`]);
                 await put(slug, 'serving', 'v1', record(), '18:00:01');
                 expect(await refsOf(first)).toEqual([`${slug}-archive`, `${slug}-serving`]);
                 // An owner changes by deleting the vertical, which takes its records, and registering it again:
                 // the tenant that held it reads nothing after, the new owner reads only what was recorded since.
-                await host.admin.deleteVertical(staff, slug);
-                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: second });
+                await forget(slug);
+                await register(slug, second);
                 expect(await refsOf(first)).toEqual([]);
                 expect(await refsOf(second)).toEqual([]);
                 await put(slug, 'serving', 'v2', record(), '18:00:02');
                 expect(await refsOf(first)).toEqual([]);
                 expect(await refsOf(second)).toEqual([`${slug}-serving`]);
             });
+            it('writes no record, and no admin row, for a vertical the registry does not hold', async () => {
+                const never = slugOf('wire-unreg');
+                const gone = slugOf('wire-gone');
+                await put(gone, 'serving', 'v1', record(), '20:00:00');
+                await forget(gone);
+                for (const slug of [never, gone]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { deploymentRef: `${slug}-serving`, verticalSlug: slug, versionId: 'v2', record: record(), recordedAt: at('20:00:01') }), 'not_found');
+                    expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: slug })).toEqual([]);
+                }
+                const rows = (await host.admin.auditLog(staff, { action: 'recordWireAuth' })).filter((r) => r.vertical === never || r.vertical === gone);
+                // Only the one write made while `gone` was registered.
+                expect(rows.map((r) => r.after.versionId)).toEqual(['v1']);
+                // Registered again, the slug's records start empty: nothing written while unregistered survives.
+                await register(gone);
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: gone })).toEqual([]);
+            });
+            it('keeps a walk’s hold on a record, by binding name, and refuses a hold it cannot read', async () => {
+                const a = slugOf('wire-hold');
+                const hold = { reason: 'verify', bindings: ['SCOPE', 'SUBSTRAT_WIRE_STATE'], at: at('22:00:00') };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: hold }, '22:00:00');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(hold);
+                // The next upload of the script writes a record without it.
+                await put(a, 'archive', 'v1', record(), '22:00:01');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                const good = { deploymentRef: `${a}-archive`, verticalSlug: a, versionId: 'v1', recordedAt: at('22:00:02') };
+                for (const walkHold of [
+                    { ...hold, reason: 'because' },
+                    { ...hold, at: 'yesterday' },
+                    { ...hold, bindings: [''] },
+                    { ...hold, bindings: Array.from({ length: 65 }, (_, i) => `B${i}`) },
+                    { ...hold, value: 'not a field' },
+                    // The count of names past the cap is a positive whole number when given.
+                    { ...hold, more: 0 },
+                    { ...hold, more: 1.5 },
+                ]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), walkHold } }), 'validation_failed');
+                }
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                // A hold of more names than it keeps: the first ones, and how many more.
+                const many = { ...hold, bindings: Array.from({ length: 64 }, (_, i) => `B${i}`), more: 6 };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: many }, '22:00:02');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(many);
+                await put(a, 'archive', 'v1', record(), '22:00:02');
+                // `unverified`, the walk's record of a script it could not confirm: lists claimed by none, and
+                // only beside a hold. Without the hold, or beside lists, it is refused.
+                const unverified = withheld('unverified');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: unverified }), 'validation_failed');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), withheld: 'unverified', walkHold: hold } }), 'validation_failed');
+                await put(a, 'archive', 'v1', { ...unverified, walkHold: hold }, '22:00:03');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record).toMatchObject({ withheld: 'unverified', state: 'legacy-only', routerKids: [], walkHold: hold });
+            });
+            it('audits a pass of the fleet walk as walkWireAuth, naming scripts and reasons, never a value', async () => {
+                const entry = {
+                    apply: true,
+                    confirm: false,
+                    from: null,
+                    next: 'acme/crm|01HZZZZZZZZZZZZZZZZZZZZZZZ',
+                    walked: 3,
+                    updated: ['acme-crm'],
+                    held: ['acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz'],
+                    released: [],
+                    skipped: [{ deploymentRef: 'acme-crm-01hyyyyyyyyyyyyyyyyyyyyyyy', reason: 'no-entry' }],
+                    failed: [{ deploymentRef: 'acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz', reason: 'verify' }],
+                };
+                await host.admin.recordWireWalk(staff, entry);
+                const rows = (await host.admin.auditLog(staff, { action: 'walkWireAuth' })).filter((r) => r.after.next === entry.next);
+                expect(rows).toHaveLength(1);
+                expect(rows[0].actor).toBe(staff);
+                expect(rows[0].after).toEqual(entry);
+            });
+            it('restores the owners and the records together, from one dump', async () => {
+                const [first, second] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
+                await host.admin.createTenant(staff, { id: first, slug: `wire-rst-${first.slice(-6).toLowerCase()}`, name: 'Wire Restore' });
+                const slug = slugOf('wire-restore');
+                await register(slug, first);
+                await put(slug, 'serving', 'v1', record(), '21:00:00');
+                const backup = await host.admin.exportDirectory(staff);
+                // Diverge past the copy: the vertical deleted (its records with it) and taken by another tenant.
+                await host.admin.createTenant(staff, { id: second, slug: `wire-rs2-${second.slice(-6).toLowerCase()}`, name: 'Wire Restore 2' });
+                await forget(slug);
+                await register(slug, second);
+                await put(slug, 'archive', 'v2', record(), '21:00:01');
+                await host.admin.restoreDirectory(staff, backup);
+                registered.add(slug);
+                // The copy's owner reads the copy's records, and nothing of the divergence came back with it.
+                const reads = async (reach) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => [r.deploymentRef, r.versionId]);
+                expect(await reads({ tenantId: first })).toEqual([[`${slug}-serving`, 'v1']]);
+                expect(await reads({ tenantId: second })).toEqual([]);
+                expect(await reads({ fleet: true })).toEqual([[`${slug}-serving`, 'v1']]);
+            });
             it('forgets a vertical’s records with the vertical', async () => {
                 const a = slugOf('wire-del');
-                await host.admin.registerVertical(staff, { slug: a, name: 'Wire record', source: 'cli' });
+                await register(a);
                 await put(a, 'serving', null, record(), '13:00:00');
                 const kept = slugOf('wire-kept');
                 await put(kept, 'serving', null, record(), '13:00:01');
-                await host.admin.deleteVertical(staff, a);
+                await forget(a);
                 expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a })).toEqual([]);
                 // Another vertical's record is not touched.
                 expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: kept })).toHaveLength(1);
@@ -10638,6 +10779,16 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 name: 'Impostor Co',
             }), 'conflict', /already taken/);
         });
+        it('words the tenant slug refusal without the tenant that holds the slug (#2556)', async () => {
+            const holder = tenantId.parse(ulid());
+            const slug = `held-${holder.toLowerCase()}`;
+            await host.admin.createTenant(staff, { id: holder, slug, name: 'Holder Co' });
+            const taken = await host.admin
+                .createTenant(staff, { id: tenantId.parse(ulid()), slug, name: 'Impostor Co' })
+                .then(() => null, (e) => e);
+            expect(taken?.message).toBe(`tenant slug '${slug}' is already taken (slugs are unique)`);
+            expect(taken?.message).not.toContain(holder);
+        });
         it('enumerates the scopes under a tenant, and filters by status (§4.5)', async () => {
             const all = await host.admin.listScopes(staff, { tenantId: t5 });
             expect(all.length).toBeGreaterThanOrEqual(2);