agent-comms 9.0.10 → 9.0.12

package/dist/test/capability-ask.unit.test.js

@@ -1,300 +0,0 @@
-/**
- * Direct, DI-based unit tests for CapabilityAskAdmission -- mirrors connection-approval.test.ts's own approach (a narrow, injectable deps surface, fake collaborators via vi.fn()) so every branch of the ask tier's tool-layer surfacing (agent-comms#165) is asserted on directly rather than only indirectly through a live transport.
- */
-import { webcrypto } from "node:crypto";
-import { describe, it, expect, vi } from "vitest";
-import { createNodeIdentity } from "wire-mesh-core/adapters/node-identity";
-import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
-import { verifyCapabilityToken } from "wire-mesh-core/domain/tokens";
-import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
-import { CapabilityAskAdmission, } from "../core/capability-ask.js";
-const ES256 = -7;
-const NOW_MS = 1_893_456_000_000;
-const HOUR_MS = 3_600_000;
-const EXPIRES_MS = NOW_MS + HOUR_MS;
-const CAPABILITY = "dm:send";
-const SCOPE = { kind: "user" };
-const OWNER_ID = "owner-peer";
-async function generateEs256Identity() {
-    const keyPair = await webcrypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
-    const publicKeyBytes = new Uint8Array(await webcrypto.subtle.exportKey("raw", keyPair.publicKey));
-    return createNodeIdentity(keyPair.privateKey, publicKeyBytes, ES256);
-}
-function fixedClock(atMs) {
-    return { now: () => atMs };
-}
-function makeHarness(options = {}) {
-    const queueDelivery = vi.fn();
-    const onDelivery = options.withOnDelivery === true ? vi.fn() : undefined;
-    const deps = {
-        getPeerId: () => OWNER_ID,
-        getOnDelivery: () => onDelivery,
-        queueDelivery,
-    };
-    return {
-        deps,
-        admission: new CapabilityAskAdmission(deps),
-        queueDelivery,
-        onDelivery,
-    };
-}
-let nextRequestId = 0;
-function fakeIncoming(params) {
-    nextRequestId += 1;
-    return {
-        requestId: nextRequestId,
-        command: { verb: CAPABILITY, params },
-        scope: SCOPE,
-        respond: vi.fn(async () => undefined),
-    };
-}
-describe("CapabilityAskAdmission — createAskHandler", () => {
-    it("holds the request open, queues a capability_request delivery event, and touches neither respond nor onDelivery's own callback synchronously", async () => {
-        const h = makeHarness({ withOnDelivery: true });
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        // The handler awaits only until onRequest is called, never until decide() settles -- the ask stays held open, so this resolves without ever calling respond().
-        await handler(incoming);
-        expect(incoming.respond).not.toHaveBeenCalled();
-        expect(h.queueDelivery).toHaveBeenCalledTimes(1);
-        const [deliveredTo, event] = h.queueDelivery.mock.calls[0];
-        expect(deliveredTo).toBe(OWNER_ID);
-        expect(event).toEqual({
-            type: "capability_request",
-            requestId: expect.any(String),
-            capability: CAPABILITY,
-            scopeKind: "user",
-            requesterDevice: deviceIdToHex(requester.deviceId),
-        });
-        expect(h.onDelivery).toHaveBeenCalledTimes(1);
-    });
-    it("includes scopePath in the delivery event when the incoming request's own scope carries one", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        nextRequestId += 1;
-        const incoming = {
-            requestId: nextRequestId,
-            command: {
-                verb: CAPABILITY,
-                params: { verb: "capability.request", capability: CAPABILITY },
-            },
-            scope: { kind: "room", path: "abc/general" },
-            respond: vi.fn(async () => undefined),
-        };
-        await handler(incoming);
-        const [, event] = h.queueDelivery.mock.calls[0];
-        expect(event).toMatchObject({
-            scopeKind: "room",
-            scopePath: "abc/general",
-        });
-    });
-    it("responds malformed for a request naming a different capability, and never surfaces it as a pending ask", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: "room:member",
-        });
-        await handler(incoming);
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "malformed",
-        });
-        expect(h.queueDelivery).not.toHaveBeenCalled();
-        expect(h.admission.listPendingCapabilityRequests()).toEqual([]);
-    });
-});
-describe("CapabilityAskAdmission — listPendingCapabilityRequests / acceptCapabilityRequest / rejectCapabilityRequest", () => {
-    it("lists every still-held ask with its capability, scope, and requester", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        await handler(fakeIncoming({ verb: "capability.request", capability: CAPABILITY }));
-        expect(h.admission.listPendingCapabilityRequests()).toEqual([
-            {
-                requestId: expect.any(String),
-                capability: CAPABILITY,
-                scopeKind: "user",
-                requesterDevice: deviceIdToHex(requester.deviceId),
-            },
-        ]);
-    });
-    it("accepting a pending ask mints a granted token, responds ok, and removes it from the pending list", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        const [requestId] = h.admission
-            .listPendingCapabilityRequests()
-            .map((p) => p.requestId);
-        if (requestId === undefined)
-            throw new Error("no pending request");
-        await h.admission.acceptCapabilityRequest(requestId, {
-            expires: EXPIRES_MS,
-            delegationsRemaining: 1,
-        });
-        expect(incoming.respond).toHaveBeenCalledTimes(1);
-        const outcome = incoming.respond.mock.calls[0]?.[0];
-        expect(outcome.result).toBe("ok");
-        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
-            identity,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            expectedBearer: requester.deviceId,
-        });
-        expect(verdict.ok).toBe(true);
-        if (verdict.ok) {
-            expect(verdict.claims.capability).toBe(CAPABILITY);
-        }
-        expect(h.admission.listPendingCapabilityRequests()).toEqual([]);
-    });
-    it("rejecting a pending ask responds denied with the given reason and removes it from the pending list", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        const [requestId] = h.admission
-            .listPendingCapabilityRequests()
-            .map((p) => p.requestId);
-        if (requestId === undefined)
-            throw new Error("no pending request");
-        await h.admission.rejectCapabilityRequest(requestId, "not right now");
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "denied",
-            message: "not right now",
-        });
-        expect(h.admission.listPendingCapabilityRequests()).toEqual([]);
-    });
-    it("rejects with no message field when no reason is given", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        const [requestId] = h.admission
-            .listPendingCapabilityRequests()
-            .map((p) => p.requestId);
-        if (requestId === undefined)
-            throw new Error("no pending request");
-        await h.admission.rejectCapabilityRequest(requestId);
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "denied",
-        });
-    });
-    it("throws naming the exact unknown request id when accepting, and never touches decide", async () => {
-        const h = makeHarness();
-        await expect(h.admission.acceptCapabilityRequest("no-such-request", {
-            expires: EXPIRES_MS,
-        })).rejects.toThrow("No pending capability request no-such-request");
-    });
-    it("throws naming the exact unknown request id when rejecting", async () => {
-        const h = makeHarness();
-        await expect(h.admission.rejectCapabilityRequest("no-such-request")).rejects.toThrow("No pending capability request no-such-request");
-    });
-    it("grants a narrower capability than requested when the accept decision names one explicitly", async () => {
-        const h = makeHarness();
-        const identity = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = h.admission.createAskHandler({
-            capability: CAPABILITY,
-            identity,
-            clock: fixedClock(NOW_MS),
-            bearerDevice: requester.deviceId,
-            timeoutMs: HOUR_MS,
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        const [requestId] = h.admission
-            .listPendingCapabilityRequests()
-            .map((p) => p.requestId);
-        if (requestId === undefined)
-            throw new Error("no pending request");
-        await h.admission.acceptCapabilityRequest(requestId, {
-            expires: EXPIRES_MS,
-            capability: "dm:send-narrow",
-        });
-        const outcome = incoming.respond.mock.calls[0]?.[0];
-        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
-            identity,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            expectedBearer: requester.deviceId,
-        });
-        expect(verdict.ok).toBe(true);
-        if (verdict.ok) {
-            expect(verdict.claims.capability).toBe("dm:send-narrow");
-        }
-    });
-});
-//# sourceMappingURL=capability-ask.unit.test.js.map

package/dist/test/capability-ask.unit.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"capability-ask.unit.test.js","sourceRoot":"","sources":["../../src/test/capability-ask.unit.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;AACjB,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AACpC,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;AACxC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,KAAK,UAAU,qBAAqB;IAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAChD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,UAAU,CACnC,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAC3D,CAAC;IACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AASD,SAAS,WAAW,CAClB,UAAkD,EAAE;IAEpD,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAA+C,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,IAAI,GAA+B;QACvC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ;QACzB,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU;QAC/B,aAAa;KACd,CAAC;IACF,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAC3C,aAAa;QACb,UAAU;KACX,CAAC;AACJ,CAAC;AAMD,IAAI,aAAa,GAAG,CAAC,CAAC;AACtB,SAAS,YAAY,CAAC,MAA+B;IACnD,aAAa,IAAI,CAAC,CAAC;IACnB,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACrC,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,6IAA6I,EAAE,KAAK,IAAI,EAAE;QAC3J,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,+JAA+J;QAC/J,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAGxD,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7B,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,MAAM;YACjB,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,aAAa,IAAI,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAiB;YAC7B,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE;gBACP,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE;aAC/D;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;YAC5C,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;SACtC,CAAC;QACF,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;YAC1B,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4GAA4G,EAAE,GAAG,EAAE;IAC1H,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,CACX,YAAY,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CACrE,CAAC;QAEF,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC;YAC1D;gBACE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC7B,UAAU,EAAE,UAAU;gBACtB,SAAS,EAAE,MAAM;gBACjB,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;aACnD;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS;aAC5B,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAEnE,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE;YACnD,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAGjD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACpE,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS;aAC5B,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAEnE,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEtE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS;aAC5B,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAEnE,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,MAAM,CACV,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,iBAAiB,EAAE;YACrD,OAAO,EAAE,UAAU;SACpB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,MAAM,CACV,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CACvD,CAAC,OAAO,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAC3C,UAAU,EAAE,UAAU;YACtB,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS;aAC5B,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAEnE,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE;YACnD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAGjD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACpE,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/capability-bubble-up.unit.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=capability-bubble-up.unit.test.d.ts.map

package/dist/test/capability-bubble-up.unit.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"capability-bubble-up.unit.test.d.ts","sourceRoot":"","sources":["../../src/test/capability-bubble-up.unit.test.ts"],"names":[],"mappings":""}

package/dist/test/capability-bubble-up.unit.test.js

@@ -1,350 +0,0 @@
-import { webcrypto } from "node:crypto";
-import { describe, it, expect, vi } from "vitest";
-import { createNodeIdentity } from "wire-mesh-core/adapters/node-identity";
-import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
-import { mintCapabilityToken } from "wire-mesh-core/domain/tokens";
-import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
-import { verifyCapabilityToken } from "wire-mesh-core/domain/tokens";
-import { resolveBubbleUpRoute, createBubbleUpCapabilityRequestHandler, } from "../core/capability-bubble-up.js";
-const ES256 = -7;
-const HOUR_MS = 3_600_000;
-const NOW_MS = 1_893_456_000_000;
-const EXPIRES_MS = NOW_MS + HOUR_MS;
-const CAPABILITY = "exec:pty";
-const SCOPE = { kind: "folder" };
-function buf(bytes) {
-    return Uint8Array.from(bytes);
-}
-async function generateEs256Identity() {
-    const keyPair = await webcrypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
-    const publicKeyBytes = new Uint8Array(await webcrypto.subtle.exportKey("raw", keyPair.publicKey));
-    return createNodeIdentity(keyPair.privateKey, publicKeyBytes, ES256);
-}
-function fixedClock(atMs) {
-    return { now: () => atMs };
-}
-let issuedTokenIds = 0;
-function nextTokenId() {
-    issuedTokenIds += 1;
-    return buf([issuedTokenIds]);
-}
-async function mint(issuer, bearer, options = {}) {
-    const verdict = await mintCapabilityToken({
-        identity: issuer,
-        clock: fixedClock(options.mintedAt ?? NOW_MS),
-        tokenId: nextTokenId(),
-        bearer: bearer.deviceId,
-        capability: options.capability ?? CAPABILITY,
-        scope: options.scope ?? SCOPE,
-        expires: options.expires ?? EXPIRES_MS,
-        ...(options.delegationsRemaining !== undefined
-            ? { delegationsRemaining: options.delegationsRemaining }
-            : {}),
-        ...(options.parent !== undefined ? { parent: options.parent } : {}),
-    });
-    if (!verdict.ok)
-        throw new Error(`mint failed: ${verdict.reason}`);
-    return verdict.token;
-}
-describe("resolveBubbleUpRoute", () => {
-    it("grants directly when the held token has depth remaining that narrows the request", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const heldToken = await mint(root, holder, { delegationsRemaining: 2 });
-        const route = await resolveBubbleUpRoute({
-            heldToken,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: SCOPE,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 1,
-        });
-        expect(route.kind).toBe("grant");
-        if (route.kind === "grant") {
-            expect(route.token).toBe(heldToken);
-        }
-    });
-    it("forwards to the held token's own issuer when its delegation depth is exhausted", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
-        const route = await resolveBubbleUpRoute({
-            heldToken,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: SCOPE,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 0,
-        });
-        expect(route.kind).toBe("forward");
-        if (route.kind === "forward") {
-            expect(deviceIdToHex(route.target)).toBe(deviceIdToHex(root.deviceId));
-        }
-    });
-    it("forwards to the held token's own issuer when the requested scope does not narrow", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const heldToken = await mint(root, holder, {
-            scope: { kind: "room", path: "abc/general" },
-            delegationsRemaining: 3,
-        });
-        const route = await resolveBubbleUpRoute({
-            heldToken,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: { kind: "room", path: "abc/other" },
-            expires: EXPIRES_MS,
-            delegationsRemaining: 1,
-        });
-        expect(route.kind).toBe("forward");
-        if (route.kind === "forward") {
-            expect(deviceIdToHex(route.target)).toBe(deviceIdToHex(root.deviceId));
-        }
-    });
-    it("reports no-route when this device holds no token for the capability at all", async () => {
-        const holder = await generateEs256Identity();
-        const route = await resolveBubbleUpRoute({
-            heldToken: undefined,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: SCOPE,
-            expires: EXPIRES_MS,
-        });
-        expect(route).toEqual({ kind: "no-route", reason: "no-held-token" });
-    });
-    it("reports no-route when the held token has already expired", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const heldToken = await mint(root, holder, {
-            mintedAt: NOW_MS - HOUR_MS,
-            expires: NOW_MS - 1,
-            delegationsRemaining: 2,
-        });
-        const route = await resolveBubbleUpRoute({
-            heldToken,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: SCOPE,
-            expires: NOW_MS,
-            delegationsRemaining: 1,
-        });
-        expect(route).toEqual({ kind: "no-route", reason: "held-token-invalid" });
-    });
-    it("reports no-route rather than forwarding to itself when its held token is self-issued", async () => {
-        const holder = await generateEs256Identity();
-        const heldToken = await mint(holder, holder, { delegationsRemaining: 0 });
-        const route = await resolveBubbleUpRoute({
-            heldToken,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            capability: CAPABILITY,
-            scope: SCOPE,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 0,
-        });
-        expect(route).toEqual({ kind: "no-route", reason: "self-issued" });
-    });
-});
-let nextRequestId = 0;
-function fakeIncoming(params) {
-    nextRequestId += 1;
-    return {
-        requestId: nextRequestId,
-        command: { verb: CAPABILITY, params },
-        scope: SCOPE,
-        respond: vi.fn(async () => undefined),
-    };
-}
-describe("createBubbleUpCapabilityRequestHandler", () => {
-    it("mints a delegated child token when this device can grant from its own held depth", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const heldToken = await mint(root, holder, { delegationsRemaining: 2 });
-        const sendManageRequest = vi.fn();
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 1,
-            ownToken: () => heldToken,
-            session: { sendManageRequest },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        expect(sendManageRequest).not.toHaveBeenCalled();
-        expect(incoming.respond).toHaveBeenCalledTimes(1);
-        const outcome = incoming.respond.mock.calls[0]?.[0];
-        expect(outcome.result).toBe("ok");
-        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            expectedBearer: requester.deviceId,
-        });
-        expect(verdict.ok).toBe(true);
-        if (verdict.ok) {
-            expect(deviceIdToHex(verdict.rootIssuer)).toBe(deviceIdToHex(root.deviceId));
-            expect(verdict.depth).toBe(1);
-        }
-    });
-    it("responds malformed for a request naming a different capability", async () => {
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            ownToken: () => undefined,
-            session: { sendManageRequest: vi.fn() },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: "room:member",
-        });
-        await handler(incoming);
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "malformed",
-        });
-    });
-    it("responds expired for an already-stale ask", async () => {
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            ownToken: () => undefined,
-            session: { sendManageRequest: vi.fn() },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-            "valid-until": NOW_MS - 1,
-        });
-        await handler(incoming);
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "expired",
-        });
-    });
-    it("forwards to the held token's own issuer and re-delegates the returned grant when its own depth is exhausted", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
-        const upstreamGrant = await mint(root, holder, { delegationsRemaining: 1 });
-        const sendManageRequest = vi.fn(async () => ({
-            result: "ok",
-            "granted-token": upstreamGrant,
-        }));
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 0,
-            ownToken: () => heldToken,
-            session: { sendManageRequest },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        expect(sendManageRequest).toHaveBeenCalledWith(expect.objectContaining({ verb: CAPABILITY }), SCOPE, root.deviceId, undefined, undefined);
-        const outcome = incoming.respond.mock.calls[0]?.[0];
-        expect(outcome.result).toBe("ok");
-        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            expectedBearer: requester.deviceId,
-        });
-        expect(verdict.ok).toBe(true);
-        if (verdict.ok) {
-            expect(deviceIdToHex(verdict.rootIssuer)).toBe(deviceIdToHex(root.deviceId));
-        }
-    });
-    it("relays the upstream denial unchanged when forwarding is refused", async () => {
-        const root = await generateEs256Identity();
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
-        const sendManageRequest = vi.fn(async () => ({
-            result: "error",
-            code: "denied",
-            message: "no more depth to give",
-        }));
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            delegationsRemaining: 0,
-            ownToken: () => heldToken,
-            session: { sendManageRequest },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        expect(incoming.respond).toHaveBeenCalledWith({
-            result: "error",
-            code: "denied",
-            message: "no more depth to give",
-        });
-    });
-    it("responds denied when this device holds no token and has nothing to forward from", async () => {
-        const holder = await generateEs256Identity();
-        const requester = await generateEs256Identity();
-        const handler = createBubbleUpCapabilityRequestHandler({
-            capability: CAPABILITY,
-            identity: holder,
-            clock: fixedClock(NOW_MS),
-            revocation: createRevocationView(),
-            bearerDevice: requester.deviceId,
-            expires: EXPIRES_MS,
-            ownToken: () => undefined,
-            session: { sendManageRequest: vi.fn() },
-        });
-        const incoming = fakeIncoming({
-            verb: "capability.request",
-            capability: CAPABILITY,
-        });
-        await handler(incoming);
-        const outcome = incoming.respond.mock.calls[0]?.[0];
-        expect(outcome.result).toBe("error");
-        expect(outcome.code).toBe("denied");
-    });
-});
-//# sourceMappingURL=capability-bubble-up.unit.test.js.map