@things-factory/ai-assistant 10.1.37 → 10.1.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/ai-assistant",
-  "version": "10.1.37",
+  "version": "10.1.39",
   "main": "dist-server/index.js",
   "things-factory": true,
   "author": "heartyoh",
@@ -29,10 +29,10 @@
     "@operato/graphql": "^10.0.0",
     "@operato/i18n": "^10.0.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/ai-client-base": "^10.1.31",
-    "@things-factory/auth-base": "^10.1.37",
+    "@things-factory/ai-client-base": "^10.1.39",
+    "@things-factory/auth-base": "^10.1.39",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.37",
+    "@things-factory/shell": "^10.1.39",
     "dompurify": "^3.0.0",
     "graphql-scalars": "^1.22.0",
     "graphql-tag": "^2.12.6",
@@ -44,5 +44,5 @@
     "copyfiles": "^2.4.1",
     "rimraf": "^5.0.0"
   },
-  "gitHead": "d8a69e5c8803a4b9d3289df0cf38e161a207db61"
+  "gitHead": "fe5257ad8995fe7e79275e287f36e95b5fd32d1c"
 }

package/server/service/chat-message/chat-message-broadcast.ts

@@ -7,6 +7,7 @@
  * **ChatSession 단위**로 묶이므로 필터 키가 sessionId (+ domain 격리).
  */
 import type { ChatMessage } from './chat-message.js' // type-only — 런타임 import 아님
+import { mayReadSession } from '../chat-session/session-visibility.js'
 
 /** chat-message 브로드캐스트 토픽. */
 export const CHAT_MESSAGE_TOPIC = 'board-ai-chat-message'
@@ -25,3 +26,45 @@ export function chatMessageFilter(domainId: string, sessionId: string) {
   return (payload: ChatMessagePayload): boolean =>
     !!payload && payload.domainId === domainId && payload.sessionId === sessionId
 }
+
+/*
+ * ── Is the room open to this person — ADR-0073 decision 2 ─────────────────────
+ *
+ * An open conversation is readable by anyone in the domain, a private one by its participants. The
+ * stored path (`chatMessages`) asked that and the broadcast path did not — subscribing checked only
+ * domain membership, and the filter matched only domain + session. So anyone in the domain holding a
+ * private session's id received that conversation as it was written.
+ *
+ * The rule is one line (`mayReadSession`) and both paths read that line. Writing it again here would
+ * make two copies from that day on.
+ */
+/** The two questions about a room. The caller supplies the storage — this file does not know it. */
+export interface ChatRoomLookup {
+  /** The session's visibility now; `undefined` when this domain has no such session. */
+  visibility(): Promise<string | null | undefined>
+  /** Whether the caller sits in that session now. */
+  isParticipant(): Promise<boolean>
+}
+
+export async function mayHearRoom(room: ChatRoomLookup): Promise<boolean> {
+  const visibility = await room.visibility()
+
+  /* A session this domain does not have — never read as open. */
+  if (visibility === undefined) return false
+
+  /* An open room does not ask about membership — one query fewer per message. */
+  if (mayReadSession(visibility, false)) return true
+
+  return mayReadSession(visibility, await room.isParticipant())
+}
+
+/**
+ * Passes only the same domain + session, and only while **that room is open to this person**.
+ *
+ * The room is asked again for every message — a session can be made private while someone is
+ * listening. People write these messages, so they are infrequent, and an open room costs one query.
+ */
+export function chatMessageRoomFilter(domainId: string, sessionId: string, room: ChatRoomLookup) {
+  const sameSession = chatMessageFilter(domainId, sessionId)
+  return async (payload: ChatMessagePayload): Promise<boolean> => sameSession(payload) && (await mayHearRoom(room))
+}

package/server/service/chat-message/chat-message-room.test.ts

@@ -0,0 +1,140 @@
+/*
+ * What this guards: a private conversation does not stream to people outside it.
+ *
+ * ADR-0073 decision 2 — an open session is readable by anyone in the domain, a private one by its
+ * participants. The stored path (`chatMessages`) asked that; the live path did not. Subscribing
+ * checked domain membership, the filter matched domain + session, and the resolver redacted by doors
+ * — so anyone in the domain holding a private session's id received its messages as they were
+ * written. Same value, two paths, one of them asking about the room.
+ *
+ * The room is asked on every message, not only when subscribing: a session can be made private
+ * while someone is already listening.
+ */
+import { publishChatMessage } from './chat-message-publish'
+import { chatMessageRoomFilter, mayHearRoom, type ChatRoomLookup } from './chat-message-broadcast'
+import { chatMessageStream, chatRoomLookup } from './chat-message-room'
+
+/** A room whose visibility and membership the test sets — and counts how often it is asked. */
+function room(visibility: string | null | undefined, participant: boolean) {
+  const asked = { visibility: 0, participant: 0 }
+  const lookup: ChatRoomLookup & { set(v: string | null | undefined): void } = {
+    async visibility() {
+      asked.visibility++
+      return visibility
+    },
+    async isParticipant() {
+      asked.participant++
+      return participant
+    },
+    set(v) {
+      visibility = v
+    }
+  }
+  return { lookup, asked }
+}
+
+describe('mayHearRoom — the same rule the stored path reads', () => {
+  it('★ a private room is closed to someone who does not sit in it', async () => {
+    expect(await mayHearRoom(room('private', false).lookup)).toBe(false)
+  })
+
+  it('a private room is open to its participants', async () => {
+    expect(await mayHearRoom(room('private', true).lookup)).toBe(true)
+  })
+
+  it('an open room is open to the domain, and membership is not asked', async () => {
+    const { lookup, asked } = room('open', false)
+    expect(await mayHearRoom(lookup)).toBe(true)
+    expect(asked.participant).toBe(0)
+  })
+
+  it('a session that predates the visibility column reads as open — the stored path reads it so too', async () => {
+    expect(await mayHearRoom(room(null, false).lookup)).toBe(true)
+  })
+
+  it('★ a session this domain does not have is closed, not open', async () => {
+    expect(await mayHearRoom(room(undefined, true).lookup)).toBe(false)
+  })
+})
+
+describe('chatMessageRoomFilter', () => {
+  const payload = (over: any = {}) => ({ domainId: 'd1', sessionId: 's1', message: { id: 'm1' } as any, ...over })
+
+  it('another domain or another session never passes, and the room is not asked', async () => {
+    const { lookup, asked } = room('open', true)
+    const pass = chatMessageRoomFilter('d1', 's1', lookup)
+
+    expect(await pass(payload({ domainId: 'd2' }))).toBe(false)
+    expect(await pass(payload({ sessionId: 's2' }))).toBe(false)
+    expect(asked.visibility).toBe(0)
+  })
+
+  it('★ the room is asked again for every message — a session made private mid-stream stops streaming', async () => {
+    const { lookup } = room('open', false)
+    const pass = chatMessageRoomFilter('d1', 's1', lookup)
+
+    expect(await pass(payload())).toBe(true)
+    lookup.set('private')
+    expect(await pass(payload())).toBe(false)
+  })
+})
+
+describe('chatRoomLookup — both questions stay inside the caller\'s domain', () => {
+  function repos(session: any, participant: any) {
+    const seen: any[] = []
+    const make = (row: any) => ({
+      findOne: async (options: any) => {
+        seen.push(options.where)
+        return row
+      }
+    })
+    return { deps: { sessions: make(session), participants: make(participant) }, seen }
+  }
+
+  it('★ the session and the seat are both looked up with the domain', async () => {
+    const { deps, seen } = repos({ id: 's1', visibility: 'private' }, { id: 'p1' })
+    const lookup = chatRoomLookup(deps, { domainId: 'd1', sessionId: 's1', userId: 'u1' })
+
+    expect(await lookup.visibility()).toBe('private')
+    expect(await lookup.isParticipant()).toBe(true)
+    expect(seen[0]).toEqual({ id: 's1', domain: { id: 'd1' } })
+    expect(seen[1]).toEqual({ session: { id: 's1' }, user: { id: 'u1' }, domain: { id: 'd1' } })
+  })
+
+  it('no session in this domain answers undefined — the rule reads that as closed', async () => {
+    const { deps } = repos(null, null)
+    expect(await chatRoomLookup(deps, { domainId: 'd1', sessionId: 's1', userId: 'u1' }).visibility()).toBeUndefined()
+  })
+
+  it('a caller with no user sits nowhere', async () => {
+    const { deps, seen } = repos({ id: 's1', visibility: 'private' }, { id: 'p1' })
+    expect(await chatRoomLookup(deps, { domainId: 'd1', sessionId: 's1', userId: undefined }).isParticipant()).toBe(false)
+    expect(seen).toEqual([])
+  })
+})
+
+describe('the live stream the subscription returns', () => {
+  function nextOrTimeout(it: AsyncIterator<any>, ms = 300): Promise<any> {
+    return Promise.race([it.next().then(r => r.value), new Promise(resolve => setTimeout(() => resolve('TIMEOUT'), ms))])
+  }
+
+  it('★ someone outside a private room does not receive what is said in it', async () => {
+    const it = chatMessageStream('d1', 's-private', room('private', false).lookup)[Symbol.asyncIterator]()
+    const next = nextOrTimeout(it)
+
+    publishChatMessage({ domainId: 'd1', sessionId: 's-private', message: { id: 'm1', role: 'user', content: 'not for you' } as any })
+
+    expect(await next).toBe('TIMEOUT')
+    await it.return?.()
+  })
+
+  it('a participant does', async () => {
+    const it = chatMessageStream('d1', 's-private', room('private', true).lookup)[Symbol.asyncIterator]()
+    const next = nextOrTimeout(it)
+
+    publishChatMessage({ domainId: 'd1', sessionId: 's-private', message: { id: 'm2', role: 'user', content: 'for you' } as any })
+
+    expect((await next)?.message?.id).toBe('m2')
+    await it.return?.()
+  })
+})

package/server/service/chat-message/chat-message-room.ts

@@ -0,0 +1,48 @@
+/*
+ * The room on the broadcast path — the stream the subscription returns, and the two lookups that
+ * ask about the room.
+ *
+ * jest cannot read the subscription resolver (parameter decorators: @Root · @Arg), so composing the
+ * stream lives here — the test runs **the same thing** the resolver returns
+ * (`chat-message-room.test.ts`).
+ *
+ * The caller passes the storage in. Importing the entities here would make this file unreadable to
+ * the tests too.
+ */
+import { filter, pipe } from 'graphql-yoga'
+import { pubsub } from '@things-factory/shell'
+
+import { CHAT_MESSAGE_TOPIC, chatMessageRoomFilter, type ChatRoomLookup } from './chat-message-broadcast.js'
+
+interface FindOne {
+  findOne(options: { where: any; select?: any }): Promise<any>
+}
+
+/**
+ * The two lookups about a room. **Both search within the caller's domain** — the same condition as
+ * the stored path's query (`chatMessages`).
+ */
+export function chatRoomLookup(
+  repos: { sessions: FindOne; participants: FindOne },
+  who: { domainId: string; sessionId: string; userId?: string }
+): ChatRoomLookup {
+  return {
+    async visibility() {
+      const session = await repos.sessions.findOne({ where: { id: who.sessionId, domain: { id: who.domainId } } })
+      return session ? ((session as any).visibility ?? null) : undefined
+    },
+
+    async isParticipant() {
+      if (!who.userId) return false
+      const seat = await repos.participants.findOne({
+        where: { session: { id: who.sessionId }, user: { id: who.userId }, domain: { id: who.domainId } }
+      })
+      return !!seat
+    }
+  }
+}
+
+/** The stream the subscription returns — same domain + session, and the room open to this person at every message. */
+export function chatMessageStream(domainId: string, sessionId: string, room: ChatRoomLookup) {
+  return pipe(pubsub.subscribe(CHAT_MESSAGE_TOPIC), filter(chatMessageRoomFilter(domainId, sessionId, room)))
+}

package/server/service/chat-message/chat-message-subscription.ts

@@ -14,11 +14,12 @@
  * 순수 로직(토픽/필터)은 chat-message-broadcast.ts (테스트 가능). 여기엔 pubsub 의존만.
  */
 import { Resolver, Subscription, Root, Arg, Ctx } from 'type-graphql'
-import { filter, pipe } from 'graphql-yoga'
-import { pubsub } from '@things-factory/shell'
+import { assertDomainSubscribeAllowed, getRepository } from '@things-factory/shell'
 import { ChatMessage } from './chat-message.js'
-import { CHAT_MESSAGE_TOPIC, chatMessageFilter, type ChatMessagePayload } from './chat-message-broadcast.js'
-import { assertDomainSubscribeAllowed } from '../subscribe-auth.js'
+import { ChatSession } from '../chat-session/chat-session.js'
+import { ChatSessionParticipant } from '../chat-session-participant/chat-session-participant.js'
+import { mayHearRoom, type ChatMessagePayload } from './chat-message-broadcast.js'
+import { chatMessageStream, chatRoomLookup } from './chat-message-room.js'
 import { readerGate } from './reader-gate.js'
 
 // publishChatMessage 는 데코레이터 없는 chat-message-publish.ts 에 분리 (테스트 import 가능).
@@ -43,7 +44,22 @@ export class ChatMessageSubscription {
 
       await assertDomainSubscribeAllowed(domain, user, (d, u) => process.superUserGranted(d, u))
 
-      return pipe(pubsub.subscribe(CHAT_MESSAGE_TOPIC), filter(chatMessageFilter(domain.id, sessionId)))
+      /*
+       * **Ask about the room** — ADR-0073 decision 2. An open room is for anyone in the domain, a private
+       * one for its participants. The stored path (`chatMessages`) asked this and the broadcast path did
+       * not, so anyone in the domain holding a private session's id received it live.
+       *
+       * A room the caller cannot enter is refused rather than handed an empty stream, in the same words
+       * as a missing session — so a private room's existence is not confirmed either. Once subscribed,
+       * the room is asked again for every message (`chatMessageRoomFilter`).
+       */
+      const room = chatRoomLookup(
+        { sessions: getRepository(ChatSession), participants: getRepository(ChatSessionParticipant) },
+        { domainId: domain.id, sessionId, userId: user?.id }
+      )
+      if (!(await mayHearRoom(room))) throw new Error('chat session not found')
+
+      return chatMessageStream(domain.id, sessionId, room)
     }
   })
   /*

package/server/service/chat-session/session-activity-subscription.ts

@@ -8,10 +8,9 @@
  */
 import { Resolver, Subscription, Root, ObjectType, Field } from 'type-graphql'
 import { filter, pipe } from 'graphql-yoga'
-import { pubsub } from '@things-factory/shell'
+import { assertDomainSubscribeAllowed, pubsub } from '@things-factory/shell'
 
 import { SESSION_ACTIVITY_TOPIC, sessionActivityFilter, type SessionActivityPayload } from './session-activity-broadcast.js'
-import { assertDomainSubscribeAllowed } from '../subscribe-auth.js'
 
 export { publishSessionActivity } from './session-activity-publish.js'
 

package/server/service/index.ts

@@ -21,7 +21,6 @@ export * from './assistant-capability-resolver.js'
 export * from './tool-access.js'
 /* 무엇이 근거인가 — 도구 결과 밖의 셋(프롬프트 · 대화 · 화면 스냅숏). */
 export * from './grounding-sources.js'
-export * from './subscribe-auth.js'
 /* 앵커 순수 로직 — 호스트가 앵커 종류를 참조한다(리졸버는 데코레이터 때문에 무겁다). */
 export * from './chat-session/session-anchor.js'
 /* Who may read a conversation — one rule, also asked by doors outside this package (board-ai's revertPatch). */

package/server/service/testing/conversation-script.test.ts

@@ -101,7 +101,7 @@ it('★ a proposal belongs to the turn that asked for it', async () => {
       {
         kind: 'read',
         name: 'proposeSceneEdit',
-        /* 저작 도구는 열린 씬만 본다 — 저장소에 닿지 않으므로 문이 없다. */
+        /* An authoring tool reads only the open scene — it reaches no storage, so it has no doors. */
         doors: [],
         description: 'propose placing a component',
         schema: {},

package/server/service/testing/mode-conformance.test.ts

@@ -26,9 +26,9 @@ beforeEach(() => {
     name: 'twin-authoring',
     guidance: 'read the scene before proposing an edit',
     specs: [
-      /* 화면이 보낸 것을 되돌려 준다 — 저장소에 안 닿는다. */
+      /* Hands back what the surface sent — reaches no storage. */
       { kind: 'read', name: 'getOpenScene', description: 'the open scene', schema: {}, doors: [], builder: () => ({}) },
-      /* 저장소를 읽는다 — 문을 적는다. 관문이 이 자리를 가른다. */
+      /* Reads storage — names its door. This is where the gate splits. */
       { kind: 'read', name: 'getTwinStructure', description: 'the twin structure', schema: {}, doors: ['Query.twinInstances'], builder: () => ({}) }
     ]
   } as any)

package/server/service/testing/mode-conformance.ts

@@ -53,11 +53,12 @@ export async function runRegisteredMode(
     maxTokens: settings.maxTokens,
     hostContext: options.hostContext,
     /*
-     * 이 하네스가 묻는 것은 **모드**다 — 「이 모드가 무엇을 여는가」이지 「이 사람이 문을 지나는가」가
-     * 아니다. 관문이 `doors` 로 옮겨간 뒤(ADR-0071 결정 2) 검사를 안 넘기면 문을 적은 도구가 전부
-     * 닫히고, 그러면 앱의 적합성 시험에서 **실제 자료를 읽는 도구만** 조용히 사라진다. 그래서 기본은
-     * 모든 문을 지나는 사람이고, 다른 쪽을 보고 싶은 앱은 `toolAccess` 를 적어 그 경우를 쓴다.
-     * 권한 축은 자기 시험이 따로 본다(`tool-access.test.ts` · `tool-scope.test.ts`).
+     * This harness asks about **the mode** — "what does this mode open", not "does this person pass the
+     * doors". Since the gate moved onto `doors` (ADR-0071 decision 2), passing no check closes every tool
+     * that names a door, and an app's conformance test would quietly lose **exactly the tools that read
+     * real data**. So the default is someone who passes every door; an app that wants the other case
+     * writes `toolAccess`. The permission axis has its own tests (`tool-access.test.ts` ·
+     * `tool-scope.test.ts`).
      */
     toolAccess: options.toolAccess ?? (async () => true),
     state: options.state ?? { domain: { id: 'dom-1' }, user: { id: 'u-1' } }

package/server/tool-registry-boot-report.test.ts

@@ -1,16 +1,24 @@
+/*
+ * The boot report prints what registered but is not yet what the contracts require.
+ *
+ * It also asks the schema, through AUTH's field table, whether a door a tool names exists. That
+ * import is why this suite did not load from 2026-09-18 (`0c3a8ac939`) until 2026-09-24: the
+ * package root of auth-base brings shell and its ORM configuration with it, and jest has no module
+ * list to give that configuration. The table is a function of one field name, so it is stood in
+ * here — the door report has its own tests (`door-declaration-report.test.ts`).
+ */
 jest.mock('@things-factory/env', () => ({ logger: { warn: jest.fn() } }))
+jest.mock('@things-factory/auth-base', () => ({ privilegeOfField: () => ({ known: false }) }))
 
 import { formatToolRegistryWarnings } from './tool-registry-boot-report'
 
 it('★ groups the recorded omissions by code and names every tool', () => {
   const lines = formatToolRegistryWarnings([
-    { code: 'tool-privilege-undeclared', params: { category: 'twin-authoring', tool: 'bindTwinEntity', kind: 'write' }, message: '' },
-    { code: 'tool-privilege-undeclared', params: { category: 'x-ops', tool: 'runThing', kind: 'external' }, message: '' }
+    { code: 'tool-doors-undeclared', params: { category: 'twin-authoring', tool: 'getOpenScene', kind: 'read' }, message: '' },
+    { code: 'tool-doors-undeclared', params: { category: 'x-ops', tool: 'runThing', kind: 'external' }, message: '' }
   ])
 
-  expect(lines).toEqual([
-    '[ai-assistant] tool-privilege-undeclared ×2: twin-authoring/bindTwinEntity(write), x-ops/runThing(external)'
-  ])
+  expect(lines).toEqual(['[ai-assistant] tool-doors-undeclared ×2: twin-authoring/getOpenScene(read), x-ops/runThing(external)'])
 })
 
 it('says nothing when every tool is declared', () => {

package/test/open-doors.test.ts

@@ -0,0 +1,132 @@
+/*
+ * Which of ai-assistant's doors are open, and why each one is allowed to be.
+ *
+ * ── The thing this catches ──────────────────────────────────────────────────
+ * `@privilege` is opt-in. A root field that declares nothing is recorded as open, and that is
+ * indistinguishable from a field somebody decided to open. The list below turns the absence into a
+ * statement: anything open that is not on it fails, and the reason has to be written first. Same
+ * measure as `worklist/tests/open-doors.test.ts` and `headless-twin/test/open-doors.test.ts`.
+ *
+ * ── What the census found (2026-09-24) ──────────────────────────────────────
+ * 27 root fields, 25 declare `ai-assistant:query` or `:mutation`. The two open ones are the
+ * subscriptions — a stream has no `@privilege` to carry, so what keeps it inside the tenant is its
+ * subscribe and its filter. Writing their reasons found one false: `chatMessageActivity` asked the
+ * domain and the session but not the room, so a private conversation streamed to anyone in the
+ * domain holding its id (ADR-0073 decision 2). Fixed in `8264dc46e7`; the reason below is true
+ * from then on, and `chat-message-room.test.ts` keeps it true.
+ *
+ * ── Why the compiled output ──────────────────────────────────────────────────
+ * type-graphql needs `emitDecoratorMetadata` to build the schema; jest's babel transform does not
+ * emit it. So this reads `dist-server` — and a build older than its sources would miss a door added
+ * since and pass, hence the freshness check before anything else.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
+import { join, relative } from 'path'
+
+import { buildSchema } from 'type-graphql'
+import type { GraphQLSchema } from 'graphql'
+
+const PKG = join(__dirname, '..')
+const DIST = join(PKG, 'dist-server')
+const AUTH_BASE_DIST = join(PKG, '..', 'auth-base', 'dist-server')
+
+/** Resolver sources newer than their build: the schema below would not be the one served. */
+function staleResolvers(): string[] {
+  const out: string[] = []
+  const walk = (dir: string) => {
+    for (const name of readdirSync(dir)) {
+      const path = join(dir, name)
+      if (statSync(path).isDirectory()) walk(path)
+      else if (path.endsWith('.ts') && !path.endsWith('.test.ts') && /@(Query|Mutation|Subscription)\(/.test(readFileSync(path, 'utf8'))) {
+        const built = join(DIST, relative(join(PKG, 'server'), path)).replace(/\.ts$/, '.js')
+        if (!existsSync(built) || statSync(built).mtimeMs < statSync(path).mtimeMs) out.push(relative(PKG, path))
+      }
+    }
+  }
+  walk(join(PKG, 'server'))
+  return out
+}
+
+type Root = 'Query' | 'Mutation' | 'Subscription'
+
+/** Open on purpose, each with what keeps it inside the caller's tenant — and, for a room, inside the room. */
+const OPEN_BY_DECISION: Record<Root, Record<string, string>> = {
+  Query: {},
+  Mutation: {},
+  Subscription: {
+    chatMessageActivity:
+      "subscribe: a member of the domain, and the room open to the caller — open to the domain, private to its participants " +
+      '(ADR-0073 decision 2), refused with the words of a missing session otherwise. Every message: same domain + session, ' +
+      'and the room asked again. The body is redacted by doors for each receiver (ADR-0073 ruling 1).',
+    mySessionActivity:
+      "subscribe: a member of the domain. Every message: same domain, and the caller among the payload's participants. " +
+      'Badge fields and a one-line preview only, no body.'
+  }
+}
+
+let schema: GraphQLSchema
+let privilegeOfField: (typeName: string, field: string) => { known: boolean; gate?: unknown }
+
+beforeAll(async () => {
+  const stale = staleResolvers()
+  if (stale.length) {
+    throw new Error(
+      `dist-server is older than ${stale.length} resolver source(s), so the schema below is not the one served:\n  ` +
+        stale.join('\n  ') +
+        '\nBuild first: yarn workspace @things-factory/ai-assistant build:server'
+    )
+  }
+
+  const { schema: declared } = require(join(DIST, 'service', 'index.js'))
+  const directive = require(join(AUTH_BASE_DIST, 'service', 'privilege', 'privilege-directive.js'))
+  privilegeOfField = directive.privilegeOfField
+
+  schema = await buildSchema({
+    resolvers: declared.resolverClasses,
+    validate: false,
+    /* The subscriptions name their own subscribe; the walk only needs a pubSub to accept them. */
+    pubSub: { publish() {}, subscribe() {} } as any
+  })
+  directive.privilegeDirectiveResolver(schema)
+})
+
+function fieldsOf(typeName: Root): string[] {
+  const type = typeName === 'Query' ? schema.getQueryType() : typeName === 'Mutation' ? schema.getMutationType() : schema.getSubscriptionType()
+  return Object.keys(type?.getFields() ?? {})
+}
+
+function openFields(typeName: Root): string[] {
+  return fieldsOf(typeName).filter(field => {
+    const gate = privilegeOfField(typeName, field)
+    return gate.known && gate.gate === null
+  })
+}
+
+describe('every open door has a written reason', () => {
+  it.each(['Query', 'Mutation', 'Subscription'] as const)('%s', typeName => {
+    expect(openFields(typeName).sort()).toEqual(Object.keys(OPEN_BY_DECISION[typeName]).sort())
+  })
+})
+
+describe('what the walk itself has to be true for', () => {
+  it('reaches the whole schema, not a handful of fields', () => {
+    /* If the resolver list shrank to nothing, the lists above would pass by having nothing to look at. */
+    expect(fieldsOf('Query').length).toBeGreaterThanOrEqual(10)
+    expect(fieldsOf('Mutation').length).toBeGreaterThanOrEqual(13)
+    expect(fieldsOf('Subscription')).toHaveLength(2)
+  })
+
+  it('tells an undeclared field from one the schema does not have', () => {
+    /* `known: false` must never read as open — that is how a typo becomes a gate that is not there. */
+    expect(privilegeOfField('Query', 'noSuchField')).toEqual({ known: false })
+  })
+
+  it('the census, in plain numbers', () => {
+    /* 2026-09-24: 27 root fields, 25 declared, 2 open — both streams. */
+    const all = fieldsOf('Query').length + fieldsOf('Mutation').length + fieldsOf('Subscription').length
+    const open = openFields('Query').length + openFields('Mutation').length + openFields('Subscription').length
+
+    expect(all).toBe(27)
+    expect(open).toBe(2)
+  })
+})

package/dist-server/service/subscribe-auth.d.ts

@@ -1,14 +0,0 @@
-/**
- * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).
- * - domain 없음 → 거부.
- * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.
- *
- * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은
- * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가
- * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.
- *
- * @param domain  context.state.domain
- * @param user    context.state.user (domains[] / email 사용)
- * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)
- */
-export declare function assertDomainSubscribeAllowed(domain: any, user: any, isSuperUser: (domain: any, user: any) => boolean | Promise<boolean>): Promise<void>;

package/dist-server/service/subscribe-auth.js

@@ -1,33 +0,0 @@
-"use strict";
-/*
- * 구독 도메인 인증 게이트 — 순수 로직 (데코레이터·pubsub 없음 → 테스트 가능).
- *
- * 실시간 구독(@Subscription)은 같은 도메인 구성원만 허용해야 한다(도메인 격리 = 보안 핵심).
- * 이 게이트는 board-patch / chat-message 양쪽 spine 의 subscribe 클로저가 공유한다
- * (reuse — fork 금지). superUserGranted 는 process 전역 의존이라 주입받아 순수성 유지.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertDomainSubscribeAllowed = assertDomainSubscribeAllowed;
-/**
- * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).
- * - domain 없음 → 거부.
- * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.
- *
- * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은
- * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가
- * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.
- *
- * @param domain  context.state.domain
- * @param user    context.state.user (domains[] / email 사용)
- * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)
- */
-async function assertDomainSubscribeAllowed(domain, user, isSuperUser) {
-    if (!domain) {
-        throw new Error('domain required');
-    }
-    const subdomain = domain?.subdomain;
-    if (!user?.domains?.find((d) => d.subdomain === subdomain) && !(await isSuperUser(domain, user))) {
-        throw new Error(`domain(${subdomain}) is not working for user(${user?.email}).`);
-    }
-}
-//# sourceMappingURL=subscribe-auth.js.map

package/dist-server/service/subscribe-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"subscribe-auth.js","sourceRoot":"","sources":["../../server/service/subscribe-auth.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,oEAYC;AAzBD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,4BAA4B,CAChD,MAAW,EACX,IAAS,EACT,WAAmE;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,6BAA6B,IAAI,EAAE,KAAK,IAAI,CAAC,CAAA;IAClF,CAAC;AACH,CAAC","sourcesContent":["/*\n * 구독 도메인 인증 게이트 — 순수 로직 (데코레이터·pubsub 없음 → 테스트 가능).\n *\n * 실시간 구독(@Subscription)은 같은 도메인 구성원만 허용해야 한다(도메인 격리 = 보안 핵심).\n * 이 게이트는 board-patch / chat-message 양쪽 spine 의 subscribe 클로저가 공유한다\n * (reuse — fork 금지). superUserGranted 는 process 전역 의존이라 주입받아 순수성 유지.\n */\n\n/**\n * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).\n * - domain 없음 → 거부.\n * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.\n *\n * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은\n * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가\n * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.\n *\n * @param domain  context.state.domain\n * @param user    context.state.user (domains[] / email 사용)\n * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)\n */\nexport async function assertDomainSubscribeAllowed(\n  domain: any,\n  user: any,\n  isSuperUser: (domain: any, user: any) => boolean | Promise<boolean>\n): Promise<void> {\n  if (!domain) {\n    throw new Error('domain required')\n  }\n  const subdomain = domain?.subdomain\n  if (!user?.domains?.find((d: any) => d.subdomain === subdomain) && !(await isSuperUser(domain, user))) {\n    throw new Error(`domain(${subdomain}) is not working for user(${user?.email}).`)\n  }\n}\n"]}