@vellumai/assistant 0.11.3-staging.1 → 0.11.3-staging.3

package/src/__tests__/conversation-routes-hidden-queue.test.ts

@@ -164,7 +164,11 @@ function makeConversationWithPendingConfirmation(
       promoteToHead: (requestId: string) => ({ requestId }),
     },
     pendingSteerRepair: false,
-    setTrustContext: () => {},
+    // Stores rather than discarding, so a test can observe which trust the
+    // route resolved and move the slot afterwards.
+    setTrustContext(this: { trustContext: unknown }, ctx: unknown) {
+      this.trustContext = ctx;
+    },
     updateClient: () => {},
     emitConfirmationStateChanged: () => {},
     emitActivityState: () => {},
@@ -354,3 +358,62 @@ describe("hidden sends to an idle conversation with a pending confirmation", ()
     expect(spies.agentLoopOptions()?.isHiddenPrompt).toBeUndefined();
   });
 });
+
+describe("POST /messages turn trust", () => {
+  test("the idle send path runs its turn under the trust resolved for the request", async () => {
+    // The idle web path does not go through `processMessage`; it persists and
+    // calls `runAgentLoop` directly. Without the captured trust travelling
+    // with that call, the loop re-reads the conversation slot when it opens,
+    // and the slot is writable in between by paths that do not own this turn
+    // (channel ingress for another actor, live-voice hydration, pointer
+    // elevation, the voice bridge).
+    //
+    // The defect here is at the call site, not inside the loop, so observing
+    // the options the route passes is sufficient. The re-read *inside* the
+    // loop is covered separately against a real Conversation, since a stub
+    // like this one cannot see it.
+    const spies = makeConversationWithPendingConfirmation(false);
+    setConversation(CONV_ID, spies.conversation);
+
+    const conversation = spies.conversation as unknown as {
+      trustContext: unknown;
+      persistUserMessage: () => Promise<{ id: string; deduplicated: boolean }>;
+    };
+
+    // Another actor writes the slot inside the window, after the route
+    // resolves this request's trust and before the loop call.
+    let slotMoved = false;
+    conversation.persistUserMessage = async () => {
+      conversation.trustContext = {
+        trustClass: "trusted_contact",
+        sourceChannel: "slack",
+        requesterExternalUserId: "U-other-actor",
+      };
+      slotMoved = true;
+      return { id: "persisted-user-id", deduplicated: false };
+    };
+
+    const res = await callHandler(
+      (args) => handleSendMessage(args, makeDeps(spies.conversation)),
+      makeRequest({ content: "run a command" }),
+      undefined,
+      202,
+    );
+
+    expect(res.status).toBe(202);
+    // Guard the test itself: if the injection stopped running the assertion
+    // below would pass for the wrong reason.
+    expect(slotMoved).toBe(true);
+    expect(
+      (conversation.trustContext as { trustClass?: string } | undefined)
+        ?.trustClass,
+    ).toBe("trusted_contact");
+
+    // The turn carries the trust this request resolved, not the moved slot.
+    const turnTrust = spies.agentLoopOptions()?.turnTrustContext as
+      | { trustClass?: string }
+      | undefined;
+    expect(turnTrust).toBeDefined();
+    expect(turnTrust?.trustClass).toBe("guardian");
+  });
+});

package/src/__tests__/events-dev-bypass-actor.test.ts

@@ -27,6 +27,10 @@ let fakeGuardianPrincipalId: string | undefined = undefined;
 // exactly when the SSE self-heal lookup completes.
 const pendingAsyncResolutions: Array<(value: string | undefined) => void> = [];
 
+/** Options each async resolution was called with, in the same order. */
+const asyncResolutionOptions: Array<{ forceRefresh?: boolean } | undefined> =
+  [];
+
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => fakeHttpAuthDisabled,
   hasUngatedHttpAuthDisabled: () => false,
@@ -42,10 +46,14 @@ mock.module("../runtime/local-actor-identity.js", () => ({
     }
     return fakeGuardianPrincipalId;
   },
-  resolveActorPrincipalIdForLocalGuardian: (rawHeader: string | undefined) => {
+  resolveActorPrincipalIdForLocalGuardian: (
+    rawHeader: string | undefined,
+    options?: { forceRefresh?: boolean },
+  ) => {
     if (rawHeader !== "dev-bypass" || !fakeHttpAuthDisabled) {
       return Promise.resolve(rawHeader);
     }
+    asyncResolutionOptions.push(options);
     return new Promise<string | undefined>((resolve) => {
       pendingAsyncResolutions.push(resolve);
     });
@@ -57,6 +65,23 @@ async function flushMicrotasks(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
 }
 
+/**
+ * Poll until `predicate` holds, for assertions that depend on the heal's
+ * retry backoff timer rather than on promise settling alone.
+ */
+async function waitFor(
+  predicate: () => boolean,
+  timeoutMs = 3_000,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!predicate()) {
+    if (Date.now() >= deadline) {
+      throw new Error("waitFor timed out");
+    }
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
 // ── Real imports (after mocks) ────────────────────────────────────────────
 
 import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
@@ -69,6 +94,7 @@ afterAll(() => {
 describe("events SSE registration — dev-bypass actor translation", () => {
   beforeEach(() => {
     pendingAsyncResolutions.length = 0;
+    asyncResolutionOptions.length = 0;
   });
 
   test("translates 'dev-bypass' to the real guardian principalId when auth is disabled", () => {
@@ -261,6 +287,91 @@ describe("events SSE registration — dev-bypass actor translation", () => {
     ac2.abort();
   });
 
+  test("retries the heal after a failed lookup instead of giving up for the connection's lifetime", async () => {
+    // The gateway IPC returns null on any transport failure, so the first
+    // lookup can miss even when a guardian is bound. A subscription left
+    // principal-less rejects every host-proxy result it submits, so the heal
+    // has to outlive one miss rather than stopping there.
+    fakeHttpAuthDisabled = true;
+    fakeGuardianPrincipalId = undefined; // cold cache: sync resolution misses
+
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "retry-client-001",
+          "x-vellum-interface-id": "chrome-extension",
+          "x-vellum-actor-principal-id": "dev-bypass",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    // First attempt fails (gateway not reachable yet).
+    expect(pendingAsyncResolutions).toHaveLength(1);
+    pendingAsyncResolutions.shift()!(undefined);
+    await flushMicrotasks();
+    expect(
+      hub.getActorPrincipalIdForClient("retry-client-001"),
+    ).toBeUndefined();
+
+    // The retry fires on the backoff and succeeds this time.
+    await waitFor(() => pendingAsyncResolutions.length === 1);
+    pendingAsyncResolutions.shift()!("guardian-real-id");
+    await flushMicrotasks();
+
+    expect(hub.getActorPrincipalIdForClient("retry-client-001")).toBe(
+      "guardian-real-id",
+    );
+
+    // Every attempt must bypass the guardian-delivery cache. A successful read
+    // that finds no binding is cached for minutes, which outlives the retry
+    // schedule, so a cached read would spend all attempts on the same answer
+    // and never observe a binding created in between.
+    expect(asyncResolutionOptions).toEqual([
+      { forceRefresh: true },
+      { forceRefresh: true },
+    ]);
+
+    ac.abort();
+  });
+
+  test("needsActorPrincipalHeal reports only live, principal-less client subscriptions", () => {
+    const hub = new AssistantEventHub();
+    const bare = hub.subscribe({
+      type: "client",
+      clientId: "needs-heal-001",
+      interfaceId: "chrome-extension",
+      capabilities: [],
+      callback: () => {},
+    });
+    const withPrincipal = hub.subscribe({
+      type: "client",
+      clientId: "needs-heal-002",
+      interfaceId: "macos",
+      capabilities: [],
+      actorPrincipalId: "guardian-real-id",
+      callback: () => {},
+    });
+    const process = hub.subscribe({ type: "process", callback: () => {} });
+
+    expect(hub.needsActorPrincipalHeal(bare.connectionId)).toBe(true);
+    expect(hub.needsActorPrincipalHeal(withPrincipal.connectionId)).toBe(false);
+    expect(hub.needsActorPrincipalHeal(process.connectionId)).toBe(false);
+    expect(hub.needsActorPrincipalHeal("conn-does-not-exist")).toBe(false);
+
+    // A disposed connection stops needing a heal, which is what ends the
+    // retry loop when a client disconnects mid-backoff.
+    bare.dispose();
+    expect(hub.needsActorPrincipalHeal(bare.connectionId)).toBe(false);
+
+    withPrincipal.dispose();
+    process.dispose();
+  });
+
   test("fillClientActorPrincipalId never overwrites a present principal", () => {
     const hub = new AssistantEventHub();
     const sub = hub.subscribe({

package/src/__tests__/media-stream-output.test.ts

@@ -26,6 +26,7 @@ import {
 } from "../calls/media-stream-audio-transcode.js";
 import { MediaStreamOutput } from "../calls/media-stream-output.js";
 import { resolveCallTtsProvider } from "../calls/resolve-call-tts-provider.js";
+import { setConfig } from "./helpers/set-config.js";
 
 const mockResolveCallTtsProvider = resolveCallTtsProvider as ReturnType<
   typeof jest.fn
@@ -1213,6 +1214,180 @@ describe("MediaStreamOutput", () => {
     });
   });
 
+  // ---------------------------------------------------------------------------
+  // Synthesis language hint
+  // ---------------------------------------------------------------------------
+
+  describe("synthesis language hint", () => {
+    /** Synthesize one turn and return the provider request it produced. */
+    async function synthesizeOneTurn(
+      output: MediaStreamOutput,
+    ): Promise<{ language?: string }> {
+      mockSynthesize.mockResolvedValue({
+        audio: makeWavBuffer([1000, 2000, 3000, 4000]),
+        contentType: "audio/wav",
+      });
+      output.sendTextToken("Hello caller.", true);
+      await drain(() => mockSynthesize.mock.calls.length > 0);
+      return mockSynthesize.mock.calls[0][0] as { language?: string };
+    }
+
+    test("the resolver's language rides the provider request", async () => {
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-lang");
+      output.setSynthesisLanguageResolver(() => "es");
+
+      const request = await synthesizeOneTurn(output);
+
+      expect(request.language).toBe("es");
+    });
+
+    test("fixed system copy synthesizes without the caller-language hint while model text keeps it", async () => {
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-lang");
+      output.setSynthesisLanguageResolver(() => "ja");
+      mockSynthesize.mockResolvedValue({
+        audio: makeWavBuffer([1000, 2000, 3000, 4000]),
+        contentType: "audio/wav",
+      });
+
+      output.sendTextToken("Model reply.", true);
+      output.sendTextToken("Are you still there?", true, { systemCopy: true });
+      await drain(() => mockSynthesize.mock.calls.length >= 2);
+
+      const requests = mockSynthesize.mock.calls.map(
+        (call) => call[0] as { text: string; language?: string },
+      );
+      expect(requests[0]?.text).toBe("Model reply.");
+      expect(requests[0]?.language).toBe("ja");
+      expect(requests[1]?.text).toBe("Are you still there?");
+      expect(requests[1]?.language).toBeUndefined();
+    });
+
+    test("no language when nothing resolves (default multilingual pin)", async () => {
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-lang");
+
+      const request = await synthesizeOneTurn(output);
+
+      expect(request.language).toBeUndefined();
+    });
+
+    test("a monolingual pin on a manual-selection provider resolves as the hint", async () => {
+      setConfig("services", {
+        stt: { provider: "deepgram", language: "es-ES" },
+      });
+      try {
+        const { ws } = createMockWs();
+        const output = makeOutput(ws, "stream-lang");
+
+        const request = await synthesizeOneTurn(output);
+
+        expect(request.language).toBe("es");
+      } finally {
+        setConfig("services", {});
+      }
+    });
+
+    test("the pin is ignored for auto-detecting providers", async () => {
+      setConfig("services", {
+        stt: { provider: "openai-whisper", language: "es" },
+      });
+      try {
+        const { ws } = createMockWs();
+        const output = makeOutput(ws, "stream-lang");
+
+        const request = await synthesizeOneTurn(output);
+
+        expect(request.language).toBeUndefined();
+      } finally {
+        setConfig("services", {});
+      }
+    });
+  });
+
+  // ---------------------------------------------------------------------------
+  // Per-language voice override (languageVoices)
+  // ---------------------------------------------------------------------------
+
+  describe("per-language voice override", () => {
+    afterEach(() => {
+      setConfig("services", {});
+    });
+
+    /** Seed a deepgram languageVoices entry and resolve deepgram as the provider. */
+    function useDeepgramWithHindiVoice(): void {
+      setConfig("services", {
+        tts: {
+          provider: "deepgram",
+          providers: {
+            deepgram: { languageVoices: { hi: "aura-2-hindi-voice" } },
+          },
+        },
+      });
+      useProvider({
+        id: "deepgram",
+        capabilities: { supportsStreaming: false, supportedFormats: ["wav"] },
+        synthesize: mockSynthesize,
+      });
+      mockSynthesize.mockResolvedValue({
+        audio: makeWavBuffer([1000, 2000, 3000, 4000]),
+        contentType: "audio/wav",
+      });
+    }
+
+    test("a configured languageVoices entry for the resolved language rides the request as voiceId", async () => {
+      useDeepgramWithHindiVoice();
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-voice");
+      output.setSynthesisLanguageResolver(() => "hi");
+
+      output.sendTextToken("Namaste.", true);
+      await drain(() => mockSynthesize.mock.calls.length > 0);
+
+      const request = mockSynthesize.mock.calls[0][0] as {
+        voiceId?: string;
+        language?: string;
+      };
+      expect(request.language).toBe("hi");
+      expect(request.voiceId).toBe("aura-2-hindi-voice");
+    });
+
+    test("no voiceId when the map has no entry for the resolved language", async () => {
+      useDeepgramWithHindiVoice();
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-voice");
+      output.setSynthesisLanguageResolver(() => "es");
+
+      output.sendTextToken("Hola.", true);
+      await drain(() => mockSynthesize.mock.calls.length > 0);
+
+      const request = mockSynthesize.mock.calls[0][0] as {
+        voiceId?: string;
+        language?: string;
+      };
+      expect(request.language).toBe("es");
+      expect(request.voiceId).toBeUndefined();
+    });
+
+    test("system copy gets neither the language hint nor the language voice", async () => {
+      useDeepgramWithHindiVoice();
+      const { ws } = createMockWs();
+      const output = makeOutput(ws, "stream-voice");
+      output.setSynthesisLanguageResolver(() => "hi");
+
+      output.sendTextToken("Are you still there?", true, { systemCopy: true });
+      await drain(() => mockSynthesize.mock.calls.length > 0);
+
+      const request = mockSynthesize.mock.calls[0][0] as {
+        voiceId?: string;
+        language?: string;
+      };
+      expect(request.language).toBeUndefined();
+      expect(request.voiceId).toBeUndefined();
+    });
+  });
+
   // ---------------------------------------------------------------------------
   // Streaming PCM synthesis (incremental transcode)
   // ---------------------------------------------------------------------------

package/src/__tests__/media-stream-stt-session.test.ts

@@ -897,6 +897,73 @@ describe("MediaStreamSttSession", () => {
       session.dispose();
     });
 
+    // ── Detected language (latest tagged utterance) ─────────────────
+
+    test("a language switch retargets on the first final in the new language", async () => {
+      const { session, fake } = await startStreamingSession();
+
+      expect(session.currentLanguage()).toBeUndefined();
+
+      fake.emit({ type: "final", text: "hola", languages: ["es", "en"] });
+      fake.emit({ type: "final", text: "buenos dias", languages: ["es"] });
+      expect(session.currentLanguage()).toBe("es");
+
+      // The first ja-tagged utterance wins immediately: the caller does
+      // not have to outvote the session's es history. The secondary "es"
+      // tag does not dilute the utterance's dominant tag.
+      fake.emit({ type: "final", text: "konnichiwa", languages: ["ja", "es"] });
+      expect(session.currentLanguage()).toBe("ja");
+
+      session.dispose();
+    });
+
+    test("regional variants normalize to their base subtag", async () => {
+      const { session, fake } = await startStreamingSession();
+
+      fake.emit({ type: "final", text: "tudo bem", languages: ["pt-BR"] });
+
+      expect(session.currentLanguage()).toBe("pt");
+
+      session.dispose();
+    });
+
+    test("empty and untagged finals keep the previous value", async () => {
+      const { session, fake } = await startStreamingSession();
+
+      // A silence final can carry container-level tags describing no
+      // emitted words; it must not update the language.
+      fake.emit({ type: "final", text: "   ", languages: ["fr"] });
+      expect(session.currentLanguage()).toBeUndefined();
+
+      fake.emit({ type: "final", text: "hola", languages: ["es"] });
+      expect(session.currentLanguage()).toBe("es");
+
+      // A committed final without tags keeps the previous value.
+      fake.emit({ type: "final", text: "hello" });
+      expect(session.currentLanguage()).toBe("es");
+
+      // So does a tagged silence final after a language is established.
+      fake.emit({ type: "final", text: "   ", languages: ["fr"] });
+      expect(session.currentLanguage()).toBe("es");
+
+      session.dispose();
+    });
+
+    test("falling back to batch mid-call clears the detected language", async () => {
+      const { session, fake } = await startStreamingSession();
+
+      fake.emit({ type: "final", text: "konnichiwa", languages: ["ja"] });
+      expect(session.currentLanguage()).toBe("ja");
+
+      // Provider closes the stream unexpectedly: the session settles on
+      // batch, whose transcripts carry no language metadata. The stale ja
+      // detection must not keep hinting synthesis for English speech.
+      fake.emit({ type: "closed" });
+      expect(session.currentLanguage()).toBeUndefined();
+
+      session.dispose();
+    });
+
     test("local VAD turn end never triggers batch transcription in streaming mode", async () => {
       const onTranscriptFinal = jest.fn();
       const { session } = await startStreamingSession(

package/src/__tests__/oauth-provider-seed-logos.test.ts

@@ -1,7 +1,44 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
 import { PROVIDER_SEED_DATA } from "../oauth/seed-providers.js";
 
+const REPO_ROOT = dirname(dirname(dirname(import.meta.dir)));
+const WEB_PUBLIC_DIR = join(REPO_ROOT, "clients/web/public");
+const INTEGRATION_ICON_SOURCE = join(
+  REPO_ROOT,
+  "clients/web/src/components/integrations/integration-icon.tsx",
+);
+
+/**
+ * Provider keys the web client draws without a `BUNDLED_LOGO_URLS` entry.
+ * Google's mark is multi-colour, so it ships as the `GoogleLogo` component
+ * and is returned before the bundled-asset lookup runs.
+ */
+const COMPONENT_RENDERED_PROVIDERS = new Set(["google"]);
+
+/** `publicAsset("/images/...")` paths from `BUNDLED_LOGO_URLS`, by key. */
+function readBundledLogoMap(): Map<string, string> {
+  const source = readFileSync(INTEGRATION_ICON_SOURCE, "utf8");
+  const block = source.match(
+    /const BUNDLED_LOGO_URLS: Record<string, string> = \{([\s\S]*?)\n\};/,
+  );
+  if (!block) {
+    throw new Error(
+      `Could not find BUNDLED_LOGO_URLS in ${INTEGRATION_ICON_SOURCE}. If it ` +
+        `was renamed or restructured, update this test rather than deleting it.`,
+    );
+  }
+  const entries = new Map<string, string>();
+  for (const [, key, path] of block[1]!.matchAll(
+    /(\w+):\s*publicAsset\("([^"]+)"\)/g,
+  )) {
+    entries.set(key!, path!);
+  }
+  return entries;
+}
+
 /**
  * Allowed CDN prefixes for the ``logoUrl`` field on ``PROVIDER_SEED_DATA``
  * (``assistant/src/oauth/seed-providers.ts``):
@@ -41,3 +78,31 @@ describe("PROVIDER_SEED_DATA logo URLs", () => {
     expect(invalid).toEqual([]);
   });
 });
+
+/**
+ * The `logoUrl` above is a fallback for providers registered at runtime. Every
+ * provider we seed ourselves must draw from an asset we ship, because an icon
+ * CDN can drop a brand at any time and the client then degrades to an initials
+ * avatar with nothing in CI to notice: the prefix check above passes just as
+ * happily for a URL that 404s. Simple Icons hosts no Microsoft mark and no
+ * Slack mark, so the seeded URLs for those brands do not resolve there.
+ */
+describe("PROVIDER_SEED_DATA bundled logo coverage", () => {
+  test("every seeded provider renders from a bundled asset", () => {
+    const bundled = readBundledLogoMap();
+    const uncovered = Object.keys(PROVIDER_SEED_DATA).filter(
+      (provider) =>
+        !bundled.has(provider) && !COMPONENT_RENDERED_PROVIDERS.has(provider),
+    );
+
+    expect(uncovered).toEqual([]);
+  });
+
+  test("every bundled logo path resolves to a file on disk", () => {
+    const missingFiles = [...readBundledLogoMap()]
+      .filter(([, path]) => !existsSync(join(WEB_PUBLIC_DIR, path)))
+      .map(([provider, path]) => ({ provider, path }));
+
+    expect(missingFiles).toEqual([]);
+  });
+});

package/src/__tests__/tool-grant-request-escalation.test.ts

@@ -101,17 +101,20 @@ import {
   getRegisteredKinds,
   getResolver,
 } from "../approvals/guardian-request-resolvers.js";
+import { getConfig } from "../config/loader.js";
 import { getDb } from "../persistence/db-connection.js";
 import { getSqlite } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import {
+  TC_GRANT_WAIT_MAX_MS,
   ToolApprovalHandler,
   waitForInlineGrant,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
+import { setConfig } from "./helpers/set-config.js";
 
-/** Short wait config for tests — avoids blocking test suite on the 60s default. */
+/** Short wait config for tests: keeps escalation cases off the real budget. */
 const TEST_INLINE_WAIT_CONFIG = { maxWaitMs: 100, intervalMs: 20 };
 
 await initializeDb();
@@ -490,6 +493,42 @@ describe("inline wait-and-resume", () => {
     expect(elapsed).toBeLessThan(500);
   });
 
+  test("waitForInlineGrant spends timeouts.permissionTimeoutSec when no explicit budget is given", async () => {
+    // The guardian's escalation window must track the configured approval
+    // budget rather than a compiled-in constant, so an operator raising
+    // permissionTimeoutSec actually widens the window a guardian has to
+    // answer in. Omitting maxWaitMs is what production does.
+    const priorTimeouts = getConfig().timeouts;
+    setConfig("timeouts", {
+      ...priorTimeouts,
+      permissionTimeoutSec: 0.15,
+    });
+    try {
+      const req = seedGrantRequest("sha256:configbudget");
+
+      const start = Date.now();
+      const result = await waitForInlineGrant(
+        req.id,
+        {
+          toolName: "bash",
+          inputDigest: "sha256:configbudget",
+          consumingRequestId: "consume-config-budget",
+        },
+        { intervalMs: 20 },
+      );
+      const elapsed = Date.now() - start;
+
+      expect(result.outcome).toBe("timeout");
+      // Bounded well under TC_GRANT_WAIT_MAX_MS: a regression that ignores
+      // config and falls back to the constant blows this ceiling by ~400x.
+      expect(elapsed).toBeGreaterThanOrEqual(120);
+      expect(elapsed).toBeLessThan(3_000);
+      expect(elapsed).toBeLessThan(TC_GRANT_WAIT_MAX_MS);
+    } finally {
+      setConfig("timeouts", priorTimeouts);
+    }
+  }, 10_000);
+
   test("waitForInlineGrant returns aborted when signal fires during wait", async () => {
     const req = seedGrantRequest("sha256:abortwait");