@substrat-run/contract-tests 0.92.0 → 0.94.0

package/dist/spine-guard-suite.d.ts

@@ -0,0 +1,3 @@
+import type { ScopeHostFixture } from './scope-host-suite.js';
+export declare function spineGuardContractSuite(adapterName: string, makeFixture: () => Promise<ScopeHostFixture>): void;
+//# sourceMappingURL=spine-guard-suite.d.ts.map

package/dist/spine-guard-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine-guard-suite.d.ts","sourceRoot":"","sources":["../src/spine-guard-suite.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAS9D,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC3C,IAAI,CAwFN"}

package/dist/spine-guard-suite.js

@@ -0,0 +1,97 @@
+/**
+ * Contract suite for the spine guard on `ctx.sql` (#954).
+ *
+ * What it pins is one sentence: **module code cannot write a `_substrat_*` table
+ * through the connection the kernel hands it, and can still read one.**
+ *
+ * Before this existed the rule was a source scan — CLAUDE.md plus
+ * `tools/boundary-lint.mjs` — and boundary-lint does not run on the hosted push
+ * path, so a vertical that never passed through this repo's CI reached production
+ * with `INSERT INTO _substrat_tuples …` (a forged grant) fully available to it.
+ *
+ * It belongs in the contract suites rather than in one adapter's tests because
+ * the guard is only worth anything if BOTH module-facing connections carry it: a
+ * vertical is developed against the pure host and deployed onto the DO, so a
+ * refusal that exists in only one of them is a rule that changes meaning at
+ * deploy time. The guard itself lives in the kernel (`guardSpine`); each adapter
+ * proves it wrapped the connection module code actually holds.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { errorCodeOf, platformActorId, principalId, scopeId, tenantId } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { testMod } from './modules.js';
+export function spineGuardContractSuite(adapterName, makeFixture) {
+    describe(`spine guard (ctx.sql): ${adapterName}`, () => {
+        let fixture;
+        let host;
+        let stub;
+        const t1 = tenantId.parse(ulid());
+        const s1 = scopeId.parse(ulid());
+        const alice = principalId.parse(ulid());
+        const staff = platformActorId.parse(ulid());
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            host.registerModule(testMod);
+            await host.admin.createTenant(staff, { id: t1, slug: 'spine-tenant', name: 'Spine Tenant' });
+            await host.admin.grantEntitlement(staff, t1, 'testmod');
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s1, vertical: 'spine-vertical' });
+            await host.admin.activateScope(staff, t1, s1);
+            stub = await host.getScope(alice, t1, s1);
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        // -- the refusals --------------------------------------------------------
+        const refused = [
+            ['a forged tuple (INSERT)', 'testmod/forge-tuple'],
+            ['a rewritten event (UPDATE)', 'testmod/forge-outbox'],
+            ['a dropped migration journal (DROP)', 'testmod/forge-drop-journal'],
+            ['a quoted identifier (DELETE FROM "_substrat_tuples")', 'testmod/forge-quoted'],
+            ['a write dressed as a read (INSERT … RETURNING via ctx.sql.query)', 'testmod/forge-returning'],
+            ['a trigger ON the outbox (CREATE TRIGGER … ON)', 'testmod/forge-trigger'],
+        ];
+        for (const [what, operation] of refused) {
+            it(`refuses ${what}`, async () => {
+                await expect(stub.invoke(operation)).rejects.toThrow(/cannot write the platform spine/);
+            });
+        }
+        it('refuses as a `forbidden`, so a transport answers 403 rather than 500', async () => {
+            const err = await stub.invoke('testmod/forge-tuple').then(() => undefined, (e) => e);
+            expect(errorCodeOf(err)).toBe('forbidden');
+        });
+        it('left no forged tuple behind — the whole operation rolled back', async () => {
+            const tuples = await stub.invoke('testmod/read-tuples');
+            expect(tuples.some((t) => t.subject === 'principal:forged')).toBe(false);
+        });
+        /**
+         * The one that proves the refusal is a THROW and not a silent skip: the
+         * operation writes a legitimate row before it forges, so a guard that merely
+         * dropped the offending statement would leave the item committed.
+         */
+        it('takes the operation down with it — the legitimate row before the forge is gone', async () => {
+            await expect(stub.invoke('testmod/forge-after-write', { id: 'forge-1' })).rejects.toThrow();
+            const items = await stub.invoke('testmod/read-items');
+            expect(items.map((i) => i.id)).not.toContain('forge-1');
+        });
+        // -- what stays open -----------------------------------------------------
+        it('still reads the migration journal', async () => {
+            const rows = await stub.invoke('testmod/read-journal');
+            expect(rows.length).toBeGreaterThan(0);
+        });
+        it('still reads the tuple store', async () => {
+            await expect(stub.invoke('testmod/read-tuples')).resolves.toBeInstanceOf(Array);
+        });
+        /**
+         * The projection CLAUDE.md blesses — a spine READ feeding a domain write. Only
+         * the write's TARGET is judged, so this must keep working; a guard that refused
+         * it would be a rule against timelines rather than against forging.
+         */
+        it('still projects a spine table into a module table', async () => {
+            await expect(stub.invoke('testmod/project-journal')).resolves.toBeUndefined();
+            const notes = await stub.invoke('testmod/read-notes');
+            expect(notes.length).toBeGreaterThan(0);
+        });
+    });
+}
+//# sourceMappingURL=spine-guard-suite.js.map

package/dist/spine-guard-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine-guard-suite.js","sourceRoot":"","sources":["../src/spine-guard-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAoB,MAAM,yBAAyB,CAAC;AACzH,OAAO,EAAE,IAAI,EAAkC,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQvC,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,WAA4C;IAE5C,QAAQ,CAAC,0BAA0B,WAAW,EAAE,EAAE,GAAG,EAAE;QACrD,IAAI,OAAyB,CAAC;QAC9B,IAAI,IAAe,CAAC;QACpB,IAAI,IAAe,CAAC;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAE3E,MAAM,OAAO,GAAuB;YAClC,CAAC,yBAAyB,EAAE,qBAAqB,CAAC;YAClD,CAAC,4BAA4B,EAAE,sBAAsB,CAAC;YACtD,CAAC,oCAAoC,EAAE,4BAA4B,CAAC;YACpE,CAAC,sDAAsD,EAAE,sBAAsB,CAAC;YAChF,CAAC,kEAAkE,EAAE,yBAAyB,CAAC;YAC/F,CAAC,+CAA+C,EAAE,uBAAuB,CAAC;SAC3E,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACxC,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC/B,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QAED,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAClB,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAa,qBAAqB,CAAC,CAAC;YACpE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH;;;;WAIG;QACH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAmB,oBAAoB,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAE3E,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAA0B,sBAAsB,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAa,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QAEH;;;;WAIG;QACH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAiC,oBAAoB,CAAC,CAAC;YACtF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contract-tests",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "description": "The suite every scope-host adapter must pass, forever (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -31,8 +31,8 @@
   ],
   "dependencies": {
     "vitest": "^3.2.7",
-    "@substrat-run/kernel": "^0.92.0",
-    "@substrat-run/contracts": "^0.92.0"
+    "@substrat-run/contracts": "^0.94.0",
+    "@substrat-run/kernel": "^0.94.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",