The contract generator (src/generate.ts) currently walks repo, server, and sync (20 contract checks over the 51-endpoint PINNED_ENDPOINT_SET).
Extend NAMESPACES and EXAMPLE_INPUTS to cover identity, admin, moderation, temp, and label. Most endpoints should need only example values, as the generator mechanics are proven. Expect per-endpoint hint work: admin endpoints need an admin auth class, some endpoints will need skip reasons documented (lifecycle-shaped or out-of-band state).
Done when: pnpm generate emits checks for the new namespaces, stale-file cleanup removes superseded files, and pnpm tsx src/e2e.ts stays green.
Done. Landed in two commits on
main(a5c6d02harness,ef44426generator), e2e green from the committed tree.The generator now walks all eight
com.atprotolexicon dirs, so the pinned set went 51 -> 85 endpoints and the contract checks 20 -> 38. Stale-file cleanup did its job along the way (it removed theupdateAccountSigningKeycheck I'd briefly emitted before realizing that endpoint doesn't exist, see below).The admin auth class was the one piece of real plumbing, as called out in the issue:
xrpc.tsgetsconfigureAdminAuth(); a variant'sauth: 'admin'resolves to a Basicadmin:<password>header and fails closed when the run has no admin creds.runner.tsskipsrequires.auth: 'admin'checks withadmin-auth-unavailablerather than failing, since you can't admin a PDS you don't own.cli.tsreadsPDSUITE_ADMIN_PASSWORD;e2e.ts/oracle.tsuse the TestPds hardcoded password so the admin checks actually run in e2e instead of skipping.A few things the issue assumed would generate turned out not to exist in the reference PDS. Each got a documented
skiprather than an unwinnablemust:identity.resolveDid,resolveIdentity,refreshIdentityand six of the seventempendpoints have no registered route in the reference at all.admin.updateAccountSigningKeywas the trap: it's in the lexicon and even "responds" (400InvalidToken), but that's the OAuth-proxy fallback for an unregistered route, not the endpoint. Skipped, with that noted in the hint.admin.searchAccountslikewise.moderation.createReportandadmin.sendEmailskip because they proxy to a mod service / mailer the dev oracle doesn't have (same 502/environmental class assync.listHosts).Two choices worth a look:
admin.deleteAccountgenerates, but its happy path targets the CAR fixture'sdid:example:pdsuite-import-- an account that was never provisioned -- so the destructive mutation harms no real user and alice's session survives for the checks after it. Same trick as importRepo.no-auth-401probe (normally it's mutations only). Rationale: account emails and invite codes must never answer unauthenticated, so a read leaking is as bad as a write going through. Andmissing-requiredprobes send admin creds, since auth runs before validation and an unauthenticated probe would 401 where it means to see a 400.pnpm e2e: 40 lexicon pass / 0 fail, endpoint inventory 85/85 on the oracle.