test: add sharing security principals

src/__tests__/v137-wave-zero-fixtures.test.ts

@@ -4,6 +4,12 @@ import {
   ADMITTED_MUTATING_HANDLERS,
   SHARING_DOMAINS,
 } from "../../tests/fixtures/v137/sharing-matrix";
+import { SECURITY_PRINCIPALS } from "../../tests/fixtures/v137/security-principals";
+import { LEGACY_ACCOUNT_PAYLOADS } from "../../tests/fixtures/v137/legacy-account-payloads";
+import {
+  NOTIFICATION_CHANNELS,
+  NOTIFICATION_DELIVERY_MATRIX,
+} from "../../tests/fixtures/v137/notification-matrix";
 
 describe("sharing and handler inventories", () => {
   it("freezes the exact sharing-domain vocabulary", () => {
@@ -41,3 +47,53 @@ describe("sharing and handler inventories", () => {
     }
   });
 });
+
+describe("security principals and compatibility", () => {
+  it("keeps actor, record, recipient, origin, grant, and job identities distinct", () => {
+    const { activeDelegation, revokedDelegation } = SECURITY_PRINCIPALS;
+
+    expect(new Set(Object.values(activeDelegation.identities)).size).toBe(3);
+    expect(activeDelegation.origin).toBe("delegated-request");
+    expect(activeDelegation.grant.state).toBe("active");
+    expect(revokedDelegation.grant.state).toBe("revoked");
+    expect(activeDelegation.job.id).not.toBe(revokedDelegation.job.id);
+  });
+
+  it("covers every guardian, profile, and delivery channel exactly once", () => {
+    expect(NOTIFICATION_CHANNELS).toEqual([
+      "apns",
+      "web-push",
+      "telegram",
+      "ntfy",
+    ]);
+    expect(NOTIFICATION_DELIVERY_MATRIX).toHaveLength(16);
+    expect(
+      new Set(
+        NOTIFICATION_DELIVERY_MATRIX.map(
+          ({ channel, recipientUserId, recordUserId }) =>
+            `${recordUserId}:${recipientUserId}:${channel}`,
+        ),
+      ).size,
+    ).toBe(NOTIFICATION_DELIVERY_MATRIX.length);
+    expect(
+      NOTIFICATION_DELIVERY_MATRIX.every(
+        ({ interactive, recipientUserId, recordUserId }) =>
+          !interactive && recipientUserId !== recordUserId,
+      ),
+    ).toBe(true);
+  });
+
+  it("retains legacy access compatibility and fails closed for scoped payloads", () => {
+    expect(LEGACY_ACCOUNT_PAYLOADS.map(({ name }) => name)).toEqual([
+      "whole-read",
+      "whole-write",
+      "manage-as-write",
+      "scoped-fail-closed",
+    ]);
+    expect(LEGACY_ACCOUNT_PAYLOADS[2]).toMatchObject({
+      access: "write",
+      level: "manage",
+    });
+    expect(LEGACY_ACCOUNT_PAYLOADS[3]?.legacyDecoder).toBe("deny");
+  });
+});