[waterflier]

Follow-ups to the resolve-did migration (5d2be8e). On main, the bns-server and cyfs-sn tests did not compile, and test_control_server and test_dns_over_tcp failed.

Depends on buckyos-base d99a4f5 (already on base main). It fixes two name-client bugs these tests exposed:

• After an authority revoked answer, select still returned the cached document.
• A revoked device could never resolve again, even after it was re-signed.

Changes

• bns-server (server). An explicit type=device query now gets the device-slot projection (resolve-did D4: callers that want the device document must ask for device). Before this, such a query returned missing, so node-active's device check could not pass against BNS. The default / type=zone projection is kept for older clients; D4 / N3 plan to remove it once those clients are gone.
• bns-server tests.
  • Migrated to ResolveOpts / Revision / DocResult. The old policies map as in the resolve-did TODO: RemoteAuthority → authority_only().without_local_lock().without_zone_lock().with_force_authority_query(), LocalOnly → strictly_offline(), Anchored → select_authority_current.
  • Device DIDs are resolved with an explicit Device type, and fixtures carry iat.
  • New assertion: an HTTP ?type=device request returns the device JWT with docType: device.
  • Expected semantics:
    • A revoke from an owner cutoff or iat floor drops the cached device.
    • An authority-level expired keeps the verified best selectable (2026-10-20 ruling).
    • A re-signed device resolves again.
• bns_dv. Reads the published state through Source::get_document.
• cyfs-sn. The Zone locker interop check moved to the end of test_sn_bns_proxy_rpc_paths, using a user with a published, signed zone JWT. For a user without a zone on BNS, SN answers with an auth-DB projection that has no iat. The new client treats it as Unknown, which is accepted.
• test_control_server. Provider ids are now http-provider: (they are only echoed back in the response).
• test_dns_over_tcp. Unrelated to resolve-did: the test now binds the control server on a free port instead of the default 13451, which a locally running gateway already holds.

Verification

Run against buckyos-base main d99a4f5, without patches:

• bns-server: lib 30, bns_dv 4, contract_server 12
• cyfs-sn: lib 230
• cyfs_gateway: all integration tests
• cyfs-dns: 24

Not run: the ignored bns_dv e2e test needs anvil, so the migrated resolve_json_doc helper is only compile-checked.

🤖 Generated with Claude Code