cursedbelt 2.7.0 → 3.0.0

package/src/server/services/services.spec.ts

@@ -1,726 +0,0 @@
-/**
- * The engine services (Phase 2). These assert the two traps the audit named as
- * the ones the Phase-2 implementations would fall into — the private-bytes
- * bypass (§4.3) and cross-tenant reads (J3-2) — plus the SSRF hardening the
- * `sendHttp` contract demands (§4.2).
- */
-import { Database } from 'bun:sqlite';
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import {
-  catalogueMediaFile,
-  createNotification,
-  createRecord,
-  type RepoScope,
-  vaultRepo,
-} from 'cwip/repositories';
-import { KNOWLEDGE_MIGRATIONS, KNOWLEDGE_NAMESPACE } from 'cwip/domains';
-import { MEDIA_MIGRATIONS, MEDIA_NAMESPACE, SYSTEM_MIGRATIONS, SYSTEM_NAMESPACE } from 'cwip/domains';
-import { runNamespacedMigrations } from 'cwip/sqlite';
-import { assertCcPragmas, getTxnLifetimeGuard } from 'cwip/sqlite';
-import { createLocalStorageProvider, type ObjectStore, type StorageProvider } from 'cwip/storage';
-import type { MeterEventDraft, TelemetryWriter } from 'cwip/telemetry';
-import { createVerifyTelemetry } from '../../verify/runtime/verifyContext';
-import type { CCUserClaims } from '../../core/session/claims';
-import { createMemoryJobResultStore, createSaasJobBroker, type JobBroker } from '../drivers';
-import type { CallScope } from '../mixins/services';
-import { createAssetService } from './assetService';
-import { createVaultMediaSource } from './assetSources';
-import { createKnowledgeService } from './knowledgeService';
-import { createSystemService } from './systemService';
-import { createVaultUploadReaper } from './vaultReaper';
-
-const claims = (overrides: Partial<CCUserClaims> = {}): CCUserClaims => ({
-  tenantId: 't_local',
-  userId: 'u_local',
-  role: 'OWNER',
-  permissions: ['infra:write'],
-  privateScope: true,
-  exp: Math.floor(Date.now() / 1000) + 300,
-  jti: 'jti_1',
-  ...overrides,
-});
-
-const scope = (overrides: Partial<CCUserClaims> = {}): CallScope => ({ claims: claims(overrides) });
-const repoScope = (tenantId = 't_local'): RepoScope => ({ tenantId, userId: 'u_local' });
-
-/** An in-memory ObjectStore — the bytes tier is not what these tests are about. */
-const memoryObjectStore = (): ObjectStore & { objects: Map<string, string> } => {
-  const objects = new Map<string, string>();
-  return {
-    objects,
-    async put(key, body) {
-      const text = await new Response(body).text();
-      objects.set(key, text);
-      return { key, size: text.length, modifiedAt: new Date().toISOString() };
-    },
-    async get(key) {
-      const value = objects.get(key);
-      if (value === undefined) return null;
-      return new Response(value).body;
-    },
-    async stat(key) {
-      const value = objects.get(key);
-      return value === undefined ? null : { key, size: value.length, modifiedAt: new Date().toISOString() };
-    },
-    async delete(key) {
-      return objects.delete(key);
-    },
-    async signedUrl(key) {
-      return `memory://${key}`;
-    },
-  };
-};
-
-/**
- * A telemetry writer that keeps the meter drafts, so the storage-metering
- * assertions (08 §5) can read exactly what was billed.
- */
-const recordingTelemetry = (): TelemetryWriter & { meters: MeterEventDraft[] } => {
-  const base = createVerifyTelemetry();
-  const meters: MeterEventDraft[] = [];
-  return {
-    ...base,
-    meters,
-    recordMeterEvent(draft) {
-      meters.push(draft);
-      return base.recordMeterEvent(draft);
-    },
-  };
-};
-
-const stubBroker = (): JobBroker =>
-  createSaasJobBroker({
-    queue: {
-      async add() {
-        return 'job_1';
-      },
-      async remove() {},
-    },
-    results: createMemoryJobResultStore(),
-    logger: { info() {}, warn() {}, error() {}, debug() {} },
-  });
-
-let knowledge: Database;
-let media: Database;
-let system: Database;
-let storage: StorageProvider;
-
-beforeEach(() => {
-  knowledge = new Database(':memory:');
-  media = new Database(':memory:');
-  system = new Database(':memory:');
-  for (const db of [knowledge, media, system]) assertCcPragmas(db);
-  runNamespacedMigrations(knowledge, KNOWLEDGE_MIGRATIONS, { namespace: KNOWLEDGE_NAMESPACE });
-  runNamespacedMigrations(media, MEDIA_MIGRATIONS, { namespace: MEDIA_NAMESPACE });
-  runNamespacedMigrations(system, SYSTEM_MIGRATIONS, { namespace: SYSTEM_NAMESPACE });
-  storage = createLocalStorageProvider({ handles: { knowledge, media, system } });
-});
-
-afterEach(async () => {
-  await storage.close();
-  for (const db of [knowledge, media, system]) {
-    getTxnLifetimeGuard(db)?.dispose();
-    db.close();
-  }
-});
-
-describe('createKnowledgeService', () => {
-  const service = () => createKnowledgeService({ storage, broker: stubBroker() });
-
-  it('creates and reads a record under the caller’s claims', async () => {
-    const created = await service().create(scope(), { type: 'note', title: 'Hello' });
-    await expect(service().get(scope(), created.id)).resolves.toMatchObject({ title: 'Hello' });
-  });
-
-  it('returns null — not a 403-shaped answer — for another tenant’s id', async () => {
-    const created = await service().create(scope(), { type: 'note', title: 'Mine' });
-    await expect(service().get(scope({ tenantId: 't_other' }), created.id)).resolves.toBeNull();
-  });
-
-  it('refuses a type the spine does not hold', async () => {
-    await expect(service().create(scope(), { type: 'kanban-board', title: 'x' })).rejects.toMatchObject({
-      code: 'UNKNOWN_RECORD_TYPE',
-    });
-  });
-
-  it('update and remove are tenant-scoped', async () => {
-    const created = await service().create(scope(), { type: 'note', title: 'Mine' });
-    const other = scope({ tenantId: 't_other' });
-
-    await expect(service().update(other, created.id, { title: 'Stolen' })).resolves.toBeNull();
-    await expect(service().remove(other, created.id)).resolves.toBe(false);
-    await expect(service().get(scope(), created.id)).resolves.toMatchObject({ title: 'Mine' });
-  });
-
-  it('falls back to the repository filter when no SearchProvider is wired', async () => {
-    await service().create(scope(), { type: 'note', title: 'findable' });
-    const page = await service().search(scope(), 'find', {});
-    expect(page.items.map((r) => r.title)).toEqual(['findable']);
-  });
-
-  it('prefers a wired SearchProvider but re-reads rows through the repository', async () => {
-    const created = await service().create(scope(), { type: 'note', title: 'indexed' });
-    const withProvider = createKnowledgeService({
-      storage,
-      broker: stubBroker(),
-      search: {
-        async index() {},
-        async remove() {},
-        // A stale index entry for a row that no longer exists must NOT resurrect it.
-        async query() {
-          return [
-            { id: created.id, corpus: 'knowledge', tenantId: 't_local', score: 1, title: 'indexed', snippet: '' },
-            { id: 'note_deleted', corpus: 'knowledge', tenantId: 't_local', score: 0.5, title: 'ghost', snippet: '' },
-          ];
-        },
-      },
-    });
-
-    const page = await withProvider.search(scope(), 'anything', {});
-    expect(page.items.map((r) => r.id)).toEqual([created.id]);
-  });
-
-  it('never runs the model inline — organize enqueues', async () => {
-    const created = await service().create(scope(), { type: 'note', title: 'x' });
-    await expect(service().organize(scope(), [created.id])).resolves.toMatchObject({ jobId: 'job_1' });
-  });
-
-  it('refuses an empty organize selection', async () => {
-    await expect(service().organize(scope(), [])).rejects.toMatchObject({ code: 'ORGANIZE_EMPTY_SELECTION' });
-  });
-});
-
-describe('createAssetService', () => {
-  const seed = async (id: string, encryption?: string): Promise<void> => {
-    await storage.domain('media').exec(
-      catalogueMediaFile(repoScope(), {
-        id,
-        objectKey: `t_local/${id}`,
-        relPath: `${id}.mp4`,
-        displayName: id,
-        mimeType: 'video/mp4',
-        byteSize: 4,
-        encryption,
-      }),
-    );
-  };
-
-  it('serves public bytes and REFUSES a private id through the same door (§4.3)', async () => {
-    const objects = memoryObjectStore();
-    objects.objects.set('t_local/file_public', 'PUBLIC');
-    objects.objects.set('t_local/file_private', 'PRIVATE-BYTES');
-    await seed('file_public');
-    await seed('file_private', 'aes-256-gcm');
-
-    const service = createAssetService({ storage, objects, broker: stubBroker(), telemetry: recordingTelemetry() });
-
-    const publicStream = await service.read(scope(), 'file_public');
-    expect(publicStream).not.toBeNull();
-    // Even WITH a full private-scope session, the public door stays shut.
-    await expect(service.read(scope({ privateScope: true }), 'file_private')).resolves.toBeNull();
-  });
-
-  it('fails loud rather than streaming ciphertext when no decryptor is wired', async () => {
-    await seed('file_private', 'aes-256-gcm');
-    const service = createAssetService({ storage, objects: memoryObjectStore(), broker: stubBroker(), telemetry: recordingTelemetry() });
-
-    await expect(service.readPrivate(scope(), 'file_private')).rejects.toMatchObject({
-      code: 'PRIVATE_MEDIA_DECRYPTOR_MISSING',
-    });
-  });
-
-  it('opens a private item with the scheme recorded on its row', async () => {
-    await seed('file_private', 'aes-256-gcm');
-    const seen: string[] = [];
-    const service = createAssetService({
-      storage,
-      objects: memoryObjectStore(),
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-      openPrivateBytes: async (_key, encryption) => {
-        seen.push(encryption);
-        return new Response('plain').body;
-      },
-    });
-
-    await service.readPrivate(scope(), 'file_private');
-    expect(seen).toEqual(['aes-256-gcm']);
-  });
-
-  it('omits private items from a locked listing and includes them when revealed', async () => {
-    await seed('file_public');
-    await seed('file_private', 'aes-256-gcm');
-    const service = createAssetService({ storage, objects: memoryObjectStore(), broker: stubBroker(), telemetry: recordingTelemetry() });
-
-    const locked = await service.list(scope(), { revealPrivate: false });
-    expect(locked.items.map((i) => i.id)).toEqual(['file_public']);
-
-    const revealed = await service.list(scope(), { revealPrivate: true });
-    expect(revealed.items).toHaveLength(2);
-  });
-
-  it('always offers a progressive URL and only offers HLS when a ladder exists', async () => {
-    await seed('file_public');
-    const service = createAssetService({ storage, objects: memoryObjectStore(), broker: stubBroker(), telemetry: recordingTelemetry() });
-
-    const page = await service.list(scope(), { revealPrivate: false });
-    expect(page.items[0]?.streamUrl).toBe('/api/asset/items/file_public/bytes');
-    expect(page.items[0]?.hlsUrl).toBeUndefined();
-  });
-
-  it('streams an upload into the object store, catalogues it and meters the bytes', async () => {
-    const objects = memoryObjectStore();
-    const telemetry = recordingTelemetry();
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry,
-      mintId: () => 'file_uploaded',
-    });
-
-    const request = new Request('http://localhost/upload', {
-      method: 'POST',
-      body: 'BYTES',
-      headers: { 'content-type': 'video/mp4', 'x-cc-filename': 'clip.mp4' },
-    });
-    await expect(service.upload(scope(), request)).resolves.toEqual({ id: 'file_uploaded' });
-    expect(objects.objects.get('t_local/file_uploaded')).toBe('BYTES');
-
-    const page = await service.list(scope(), { revealPrivate: false });
-    expect(page.items.map((i) => i.title)).toEqual(['clip.mp4']);
-
-    // 08 §5: an unmetered byte is a byte billed to nobody.
-    expect(telemetry.meters).toEqual([
-      expect.objectContaining({
-        metric: 'storage.bytes',
-        tenantId: 't_local',
-        qty: 5,
-        eventUuid: 'storage.put:t_local/file_uploaded',
-      }),
-    ]);
-  });
-
-  it('refuses OCR for an id the tenant cannot see', async () => {
-    await seed('file_public');
-    const service = createAssetService({ storage, objects: memoryObjectStore(), broker: stubBroker(), telemetry: recordingTelemetry() });
-    await expect(service.requestOcr(scope({ tenantId: 't_other' }), 'file_public')).rejects.toMatchObject({
-      code: 'MEDIA_NOT_FOUND',
-    });
-  });
-
-  it('deletes a catalogue file and posts the negative storage credit (§2c)', async () => {
-    await seed('file_del'); // byteSize 4
-    const telemetry = recordingTelemetry();
-    const service = createAssetService({ storage, objects: memoryObjectStore(), broker: stubBroker(), telemetry });
-
-    await expect(service.remove(scope(), 'file_del')).resolves.toBe(true);
-    // Gone from the listing; a second delete frees nothing (typed 404 upstream).
-    await expect(service.list(scope(), { revealPrivate: true })).resolves.toMatchObject({ items: [] });
-    await expect(service.remove(scope(), 'file_del')).resolves.toBe(false);
-    expect(telemetry.meters).toEqual([
-      expect.objectContaining({
-        metric: 'storage.bytes',
-        qty: -4,
-        eventUuid: 'storage.delete:t_local/file_del',
-      }),
-    ]);
-  });
-});
-
-// The consolidation blocker (§2b): with the vault registered as a source, its
-// `mv_assets` appear through the SAME asset engine that serves the catalogue —
-// which is what lets AssetStudio replace `plugin-media-vault`.
-describe('createAssetService — vault source bridge (§2b)', () => {
-  const seedVaultAsset = async (checksum: string, encryption?: string) => {
-    const { asset } = await storage.domain('media').exec(
-      vaultRepo.createAsset(repoScope(), {
-        checksum,
-        objectKey: `t_local/vault/${checksum}`,
-        mimeType: 'image/png',
-        byteSize: 7,
-        title: `asset-${checksum}`,
-        encryption,
-      }),
-    );
-    return asset;
-  };
-
-  it('lists catalogue AND vault items through the registry', async () => {
-    await storage.domain('media').exec(
-      catalogueMediaFile(repoScope(), {
-        id: 'file_cat',
-        objectKey: 't_local/file_cat',
-        relPath: 'c.mp4',
-        displayName: 'c',
-        mimeType: 'video/mp4',
-        byteSize: 4,
-      }),
-    );
-    const vaultAsset = await seedVaultAsset('vaulted1');
-
-    const service = createAssetService({
-      storage,
-      objects: memoryObjectStore(),
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-      sources: [createVaultMediaSource(storage)],
-    });
-
-    const page = await service.list(scope(), { revealPrivate: false });
-    const ids = page.items.map((i) => i.id);
-    expect(ids).toContain('file_cat'); // catalogue (source[0])
-    expect(ids).toContain(vaultAsset.id); // vault (registered source)
-  });
-
-  it('resolves and deletes a vault asset through the asset engine', async () => {
-    const asset = await seedVaultAsset('vaulted2');
-    const objects = memoryObjectStore();
-    objects.objects.set('t_local/vault/vaulted2', 'VAULT-BYTES');
-    const telemetry = recordingTelemetry();
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry,
-      sources: [createVaultMediaSource(storage)],
-    });
-
-    // read dispatches to the vault source and streams its bytes.
-    const stream = await service.read(scope(), asset.id);
-    expect(stream).not.toBeNull();
-    await expect(new Response(stream).text()).resolves.toBe('VAULT-BYTES');
-
-    // remove trashes the vault asset and credits its bytes back.
-    await expect(service.remove(scope(), asset.id)).resolves.toBe(true);
-    expect(telemetry.meters).toEqual([
-      expect.objectContaining({ metric: 'storage.bytes', qty: -7, eventUuid: 'storage.delete:t_local/vault/vaulted2' }),
-    ]);
-    // Gone from the union listing afterward.
-    const page = await service.list(scope(), { revealPrivate: true });
-    expect(page.items.map((i) => i.id)).not.toContain(asset.id);
-  });
-
-  it('fails the public door closed on a PRIVATE vault asset (§4.3 holds per source)', async () => {
-    const asset = await seedVaultAsset('vaulted3', 'aes-256-gcm');
-    const service = createAssetService({
-      storage,
-      objects: memoryObjectStore(),
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-      sources: [createVaultMediaSource(storage)],
-    });
-    // A locked listing excludes it, and the public read refuses it.
-    const locked = await service.list(scope(), { revealPrivate: false });
-    expect(locked.items.map((i) => i.id)).not.toContain(asset.id);
-    await expect(service.read(scope({ privateScope: true }), asset.id)).resolves.toBeNull();
-  });
-});
-
-// ── 05 §A2: the vault upload leak path + the reaper ──────────────────────────
-//
-// Only `objects.put` was ever wrapped, so a DB failure AFTER the object settled
-// stranded the `mv_uploads` row in `processing` forever AND orphaned the object:
-// no `failUpload`, no delete, nothing to sweep it later. Both halves are here —
-// the compensation, and the reaper that bounds what compensation cannot catch
-// (a killed process leaves no catch block to run).
-describe('createAssetService — vault upload compensation + reaper (05 §A2)', () => {
-  const uploadRequest = (body: string, name = 'photo.png') =>
-    new Request('http://x/api/asset/vault/upload', {
-      method: 'POST',
-      body,
-      headers: { 'content-type': 'image/png', 'x-cc-filename': encodeURIComponent(name) },
-    });
-
-  const stagedRows = () =>
-    media.query('SELECT id, status FROM mv_uploads ORDER BY id').all() as Array<{ id: string; status: string }>;
-
-  /**
-   * Backdate a staging row so "stale" is a fact rather than a race with the
-   * millisecond clock — `created_at` and `Date.now()` land in the same
-   * millisecond often enough that a `< now` cutoff is a coin flip.
-   */
-  const age = (id: string, iso = '2020-01-01T00:00:00.000Z') =>
-    media.run('UPDATE mv_uploads SET created_at = ? WHERE id = ?', [iso, id]);
-
-  it('fails the staging row AND deletes the object when promotion fails after the put', async () => {
-    const objects = memoryObjectStore();
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-    });
-
-    // Break the promotion step only — the object has already settled by then.
-    const media = storage.domain('media');
-    const realExec = media.exec.bind(media);
-    let poisoned = true;
-    media.exec = (async (op: never) => {
-      const name = (op as { name?: string }).name ?? '';
-      if (poisoned && name === 'vault.recordUploadProgress') throw new Error('disk full');
-      return realExec(op);
-    }) as typeof media.exec;
-
-    await expect(service.vaultUpload(scope(), uploadRequest('BYTES'))).rejects.toThrow(/disk full/);
-    poisoned = false;
-    media.exec = realExec;
-
-    // The object we streamed is gone — not orphaned in the store forever …
-    expect([...objects.objects.keys()].filter((key) => key.includes('/vault/'))).toEqual([]);
-    // … and the row says `failed`, not `processing`, so the poll route stops
-    // reporting an upload that is never coming.
-    expect(stagedRows().map((row) => row.status)).toEqual(['failed']);
-  });
-
-  it('reaps a staging row abandoned in `processing`, deleting its object', async () => {
-    const objects = memoryObjectStore();
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-    });
-
-    // Exactly the wreckage a killed process leaves: a `processing` row and an
-    // object nothing references. No catch block ever ran.
-    const upload = await storage
-      .domain('media')
-      .exec(vaultRepo.beginUpload(repoScope(), { fileName: 'dead.png', mimeType: 'image/png', byteSize: 9 }));
-    objects.objects.set(`t_local/vault/${upload.id}`, 'ORPHAN');
-
-    // Too young to reap — a slow client on a big file is a legitimate
-    // `processing` row, and reaping it would delete bytes mid-stream.
-    await expect(service.reapStaleUploads(scope())).resolves.toEqual({ reaped: 0, objectsDeleted: 0 });
-    expect(objects.objects.has(`t_local/vault/${upload.id}`)).toBe(true);
-
-    age(upload.id);
-    await expect(service.reapStaleUploads(scope())).resolves.toEqual({ reaped: 1, objectsDeleted: 1 });
-    expect(objects.objects.has(`t_local/vault/${upload.id}`)).toBe(false);
-    expect(stagedRows()).toEqual([{ id: upload.id, status: 'failed' }]);
-
-    // Idempotent: a second pass finds a terminal row and reclaims nothing.
-    await expect(service.reapStaleUploads(scope())).resolves.toEqual({ reaped: 0, objectsDeleted: 0 });
-  });
-
-  it('never reaps another tenant’s uploads', async () => {
-    const objects = memoryObjectStore();
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-    });
-    const mine = await storage
-      .domain('media')
-      .exec(vaultRepo.beginUpload(repoScope('t_local'), { fileName: 'a', mimeType: 'image/png', byteSize: 1 }));
-    const theirs = await storage
-      .domain('media')
-      .exec(vaultRepo.beginUpload(repoScope('t_other'), { fileName: 'b', mimeType: 'image/png', byteSize: 1 }));
-    age(mine.id);
-    age(theirs.id);
-
-    await expect(service.reapStaleUploads(scope())).resolves.toMatchObject({ reaped: 1 });
-    const rows = stagedRows();
-    expect(rows.find((row) => row.id === mine.id)?.status).toBe('failed');
-    expect(rows.filter((row) => row.status === 'processing')).toHaveLength(1);
-  });
-
-  it('reports an object it could not reclaim instead of swallowing the drift', async () => {
-    const objects = memoryObjectStore();
-    objects.delete = async () => {
-      throw new Error('store offline');
-    };
-    const orphans: { objectKey: string; tenantId: string }[] = [];
-    const service = createAssetService({
-      storage,
-      objects,
-      broker: stubBroker(),
-      telemetry: recordingTelemetry(),
-      onOrphanedObject: ({ objectKey, tenantId }) => orphans.push({ objectKey, tenantId }),
-    });
-    const upload = await storage
-      .domain('media')
-      .exec(vaultRepo.beginUpload(repoScope(), { fileName: 'a', mimeType: 'image/png', byteSize: 1 }));
-    age(upload.id);
-
-    // The row is still marked — a `processing` row is the worse of the two
-    // leaks, so a store that cannot delete must not block the mark.
-    await expect(service.reapStaleUploads(scope())).resolves.toEqual({ reaped: 1, objectsDeleted: 0 });
-    expect(orphans).toEqual([{ objectKey: `t_local/vault/${upload.id}`, tenantId: 't_local' }]);
-  });
-});
-
-describe('createVaultUploadReaper (05 §A2)', () => {
-  const reaperFor = (
-    calls: string[],
-    fail?: string,
-  ): Parameters<typeof createVaultUploadReaper>[0]['assets'] => ({
-    async reapStaleUploads(callScope) {
-      const tenantId = callScope.claims.tenantId;
-      calls.push(tenantId);
-      if (tenantId === fail) throw new Error('tenant exploded');
-      return { reaped: 1, objectsDeleted: 1 };
-    },
-  });
-
-  const noTimer = {
-    setInterval: (() => 0 as unknown as ReturnType<typeof setInterval>) as never,
-    clearInterval: (() => undefined) as never,
-  };
-
-  it('sweeps every named tenant and totals the outcome', async () => {
-    const calls: string[] = [];
-    const reaper = createVaultUploadReaper({
-      assets: reaperFor(calls),
-      tenants: () => ['t_a', 't_b'],
-      ...noTimer,
-    });
-    await expect(reaper.tick()).resolves.toEqual({ reaped: 2, objectsDeleted: 2 });
-    expect(calls).toEqual(['t_a', 't_b']);
-    reaper.stop();
-  });
-
-  it('one tenant’s failure does not stop the sweep, and is reported', async () => {
-    const calls: string[] = [];
-    const errors: string[] = [];
-    const reaper = createVaultUploadReaper({
-      assets: reaperFor(calls, 't_a'),
-      tenants: () => ['t_a', 't_b'],
-      onError: (_error, tenantId) => errors.push(tenantId),
-      ...noTimer,
-    });
-    await expect(reaper.tick()).resolves.toEqual({ reaped: 1, objectsDeleted: 1 });
-    expect(calls).toEqual(['t_a', 't_b']);
-    expect(errors).toEqual(['t_a']);
-    reaper.stop();
-  });
-
-  it('re-reads the tenant list every tick, so a tenant created after boot is swept', async () => {
-    const calls: string[] = [];
-    let tenants = ['t_a'];
-    const reaper = createVaultUploadReaper({ assets: reaperFor(calls), tenants: () => tenants, ...noTimer });
-    await reaper.tick();
-    tenants = ['t_a', 't_new'];
-    await reaper.tick();
-    expect(calls).toEqual(['t_a', 't_a', 't_new']);
-    reaper.stop();
-  });
-});
-
-describe('createSystemService.sendHttp (§4.2)', () => {
-  const service = (fetchImpl: typeof fetch) =>
-    createSystemService({ storage, fetchImpl, outboundGuard: { allowHosts: ['api.example'] } });
-
-  it('refuses a private target outright', async () => {
-    const svc = service((async () => new Response('never')) as unknown as typeof fetch);
-    await expect(
-      svc.sendHttp(scope(), { url: 'http://169.254.169.254/latest/meta-data/', method: 'GET' }),
-    ).rejects.toMatchObject({ code: 'OUTBOUND_URL_BLOCKED' });
-  });
-
-  it('refuses a REDIRECT into private space — the classic bypass', async () => {
-    const fetchImpl = (async (url: string) => {
-      if (url.startsWith('https://api.example'))
-        return new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/' } });
-      return new Response('SECRETS');
-    }) as unknown as typeof fetch;
-
-    await expect(
-      service(fetchImpl).sendHttp(scope(), { url: 'https://api.example/redirect', method: 'GET' }),
-    ).rejects.toMatchObject({ code: 'OUTBOUND_URL_BLOCKED' });
-  });
-
-  it('follows an allowed redirect and returns the final response', async () => {
-    const fetchImpl = (async (url: string) => {
-      if (url === 'https://api.example/start')
-        return new Response(null, { status: 302, headers: { location: '/final' } });
-      return new Response('OK', { status: 200 });
-    }) as unknown as typeof fetch;
-
-    await expect(service(fetchImpl).sendHttp(scope(), { url: 'https://api.example/start', method: 'GET' })).resolves.toMatchObject(
-      { status: 200, body: 'OK' },
-    );
-  });
-
-  it('refuses a redirect loop past the hop ceiling', async () => {
-    const fetchImpl = (async () =>
-      new Response(null, { status: 302, headers: { location: 'https://api.example/again' } })) as unknown as typeof fetch;
-
-    await expect(
-      createSystemService({
-        storage,
-        fetchImpl,
-        maxRedirects: 2,
-        outboundGuard: { allowHosts: ['api.example'] },
-      }).sendHttp(scope(), { url: 'https://api.example/loop', method: 'GET' }),
-    ).rejects.toMatchObject({ code: 'OUTBOUND_REDIRECT_LIMIT' });
-  });
-
-  it('strips headers a caller must not control', async () => {
-    let seen: Record<string, string> = {};
-    const fetchImpl = (async (_url: string, init: RequestInit) => {
-      seen = (init.headers ?? {}) as Record<string, string>;
-      return new Response('OK');
-    }) as unknown as typeof fetch;
-
-    await service(fetchImpl).sendHttp(scope(), {
-      url: 'https://api.example/x',
-      method: 'GET',
-      headers: { Host: 'internal', 'X-Forwarded-For': '10.0.0.1', Accept: 'text/plain' },
-    });
-
-    expect(seen).toEqual({ Accept: 'text/plain' });
-  });
-
-  it('caps an oversized response body', async () => {
-    const fetchImpl = (async () => new Response('x'.repeat(5000))) as unknown as typeof fetch;
-    const svc = createSystemService({
-      storage,
-      fetchImpl,
-      maxResponseBytes: 100,
-      outboundGuard: { allowHosts: ['api.example'] },
-    });
-
-    const result = await svc.sendHttp(scope(), { url: 'https://api.example/big', method: 'GET' });
-    expect(result.body.length).toBeLessThanOrEqual(100);
-  });
-});
-
-describe('createSystemService inbox', () => {
-  it('lists and closes only the caller’s notifications', async () => {
-    await storage.domain('system').exec(createNotification(repoScope(), { id: 'n1', kind: 't', title: 'Mine' }));
-    const svc = createSystemService({ storage });
-
-    await expect(svc.listNotifications(scope())).resolves.toHaveLength(1);
-    await expect(svc.markNotificationDone(scope({ tenantId: 't_other' }), 'n1')).resolves.toBe(false);
-    await expect(svc.markNotificationDone(scope(), 'n1')).resolves.toBe(true);
-    await expect(svc.listNotifications(scope())).resolves.toHaveLength(0);
-  });
-
-  it('reads calendar events through their calendar’s tenant', async () => {
-    system.run("INSERT INTO cal_calendars (id, tenant_id, user_id, title) VALUES ('cal_1','t_local','u_local','Main')");
-    system.run(
-      "INSERT INTO cal_events (id, calendar_id, title, starts_at) VALUES ('evt_1','cal_1','Standup','2026-07-15T09:00:00.000Z')",
-    );
-    const svc = createSystemService({ storage });
-
-    const mine = await svc.listEvents(scope(), { from: '2026-07-01T00:00:00.000Z', to: '2026-08-01T00:00:00.000Z' });
-    expect(mine.map((e) => e.id)).toEqual(['evt_1']);
-
-    const theirs = await svc.listEvents(scope({ tenantId: 't_other' }), {
-      from: '2026-07-01T00:00:00.000Z',
-      to: '2026-08-01T00:00:00.000Z',
-    });
-    expect(theirs).toEqual([]);
-  });
-});
-
-/** `createRecord` is used above through the service; this pins the repo/service agreement. */
-describe('service ↔ repository agreement', () => {
-  it('a record written through the repository is visible through the service', async () => {
-    await storage.domain('knowledge').exec(createRecord(repoScope(), { type: 'note', title: 'direct' }));
-    const page = await createKnowledgeService({ storage, broker: stubBroker() }).list(scope(), {});
-    expect(page.items.map((r) => r.title)).toEqual(['direct']);
-  });
-});