test: move server-channel integration to server and fix client typechecks (#410)

## Summary
- move server-as-channel integration tests from
`packages/client/test/client.spec.js` to
`packages/server/test/client-channel.spec.js`
- keep client tests package-local (no `@ucanto/server` /
`@ucanto/validator` imports)
- add local client execute/decode tests to restore `packages/client`
100% coverage gates
- run package workflows on pushes to all branches (`push.branches:
["**"]`) for `client`, `core`, `interface`, `principal`, `server`,
`transport`, and `validator`

## Why
The previous client test changes mixed server integration concerns into
the client package, which caused fragile TypeScript behavior in isolated
package checks.

This PR keeps boundaries clear:
- server package owns server-channel integration behavior
- client package keeps self-contained tests and coverage

## Why checks failed after merge previously
On PR #407, package CI typecheck jobs did not run on the PR head commit
(only `Validate PR title` was recorded). On merge commit `60c70da`, push
workflows ran package typechecks and surfaced failures.

So the issue was check coverage/enforcement at PR time (branch
protection/ruleset/settings), not new source changes introduced between
PR creation and merge.

## Remark
This PR now also removes `main`-only `push.branches` constraints for
package workflows by switching them to `"**"`. Combined with
`pull_request` checks and required status checks on `main`, this reduces
merge-time surprises by surfacing failures earlier on feature-branch
pushes.

---

Co-Authored-By: Oz <oz-agent@warp.dev>

Author: NiKrause

.github/workflows/client.yml

@@ -11,8 +11,6 @@ on:
       - 'packages/transport/**'
       - 'packages/client/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/interface/**'
       - 'packages/core/**'

.github/workflows/core.yml

@@ -9,8 +9,6 @@ on:
       - 'packages/core/**'
       - 'packages/interface/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/core/**'
       - 'packages/interface/**'

.github/workflows/interface.yml

@@ -8,8 +8,6 @@ on:
     paths:
       - 'packages/interface/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/interface/**'
       - '.github/workflows/interface.yml'

.github/workflows/principal.yml

@@ -9,8 +9,6 @@ on:
       - 'packages/interface/**'
       - 'packages/principal/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/interface/**'
       - 'packages/principal/**'

.github/workflows/server.yml

@@ -13,8 +13,6 @@ on:
       - 'packages/validator/**'
       - 'packages/server/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/interface/**'
       - 'packages/core/**'

.github/workflows/transport.yml

@@ -10,8 +10,6 @@ on:
       - 'packages/interface/**'
       - 'packages/transport/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/core/**'
       - 'packages/interface/**'

.github/workflows/validator.yml

@@ -12,8 +12,6 @@ on:
       - 'packages/client/**'
       - 'packages/validator/**'
   pull_request:
-    branches:
-      - main
     paths:
       - 'packages/interface/**'
       - 'packages/core/**'

packages/client/test/client.spec.js

@@ -6,8 +6,6 @@ import * as Service from './service.js'
 import { Receipt, Message, CBOR } from '@ucanto/core'
 import { alice, bob, mallory, service as w3 } from './fixtures.js'
 import fetch from '@web-std/fetch'
-import * as Server from '@ucanto/server'
-import { Schema } from '@ucanto/validator'
 
 test('encode invocation', async () => {
   /** @type {Client.ConnectionView<Service.Service>} */
@@ -142,90 +140,7 @@ test('encode delegated invocation', async () => {
   }
 })
 
-// Create the service instance
-const service = Service.create()
-
-// Define capabilities
-const storeAddCapability = Server.capability({
-  can: 'store/add',
-  with: Server.URI.match({ protocol: 'did:' }),
-  nb: Schema.struct({
-    link: Server.Link.match().optional(),
-  }),
-  derives: (claimed, delegated) => {
-    if (claimed.with !== delegated.with) {
-      return Server.fail(
-        `Expected 'with: "${delegated.with}"' instead got '${claimed.with}'`
-      )
-    } else if (
-      delegated.nb.link &&
-      `${delegated.nb.link}` !== `${claimed.nb.link}`
-    ) {
-      return Server.fail(
-        `Link ${
-          claimed.nb.link == null ? '' : `${claimed.nb.link} `
-        }violates imposed ${delegated.nb.link} constraint`
-      )
-    } else {
-      return Server.ok({})
-    }
-  },
-})
-
-const storeRemoveCapability = Server.capability({
-  can: 'store/remove',
-  with: Server.URI.match({ protocol: 'did:' }),
-  nb: Schema.struct({
-    link: Server.Link.match().optional(),
-  }),
-  derives: (claimed, delegated) => {
-    if (claimed.with !== delegated.with) {
-      return Server.fail(
-        `Expected 'with: "${delegated.with}"' instead got '${claimed.with}'`
-      )
-    } else if (
-      delegated.nb.link &&
-      `${delegated.nb.link}` !== `${claimed.nb.link}`
-    ) {
-      return Server.fail(
-        `Link ${
-          claimed.nb.link == null ? '' : `${claimed.nb.link} `
-        }violates imposed ${delegated.nb.link} constraint`
-      )
-    } else {
-      return Server.ok({})
-    }
-  },
-})
-
-// Create server with service handlers using Server.provide
-const server = Server.create({
-  id: w3,
-  service: {
-    store: {
-      add: Server.provide(storeAddCapability, async ({ capability, invocation }) => {
-        // Call the existing service method with the invocation
-        return await service.store.add(/** @type {Client.Invocation<any>} */ (invocation))
-      }),
-      remove: Server.provide(storeRemoveCapability, async ({ capability, invocation }) => {
-        // Call the existing service method with the invocation
-        return await service.store.remove(/** @type {Client.Invocation<any>} */ (invocation))
-      }),
-    },
-  },
-  codec: CAR.inbound,
-  validateAuthorization: () => ({ ok: {} }),
-})
-
-// Use server directly as channel (no HTTP, no mock fetch!)
-/** @type {Client.ConnectionView<Service.Service>} */
-const connection = Client.connect({
-  id: w3,
-  channel: server, // 🎯 Server directly as channel - validates delegation chains!
-  codec: CAR.outbound,
-})
-
-test('execute', async () => {
+test('execute invocation', async () => {
   const car = await CAR.codec.write({
     roots: [await CBOR.write({ hello: 'world ' })],
   })
@@ -241,34 +156,38 @@ test('execute', async () => {
     proofs: [],
   })
 
-  const remove = Client.invoke({
-    issuer: alice,
-    audience: w3,
-    capability: {
-      can: 'store/remove',
-      with: alice.did(),
-      nb: { link: car.cid },
+  const channel = {
+    request: async (/** @type {any} */ input) => {
+      const { invocations } = await CAR.request.decode(input)
+      const receipts = await Promise.all(
+        invocations.map(invocation =>
+          Receipt.issue({
+            ran: invocation.cid,
+            issuer: w3,
+            result: {
+              ok: {
+                with: invocation.capabilities[0].with,
+                link: car.cid,
+                status: 'upload',
+                url: 'http://localhost:9090/',
+              },
+            },
+          })
+        )
+      )
+      const message = await Message.build({
+        receipts: /** @type {any} */ (receipts),
+      })
+      return CAR.response.encode(message)
     },
-  })
-
-  const e1 = await add.execute(connection)
+  }
 
-  assert.deepEqual(e1.out, {
-    error: {
-      // @ts-expect-error
-      name: 'UnknownDIDError',
-      message: `DID ${alice.did()} has no account`,
-      did: alice.did(),
-    },
+  const connection = Client.connect({
+    id: w3,
+    channel: /** @type {any} */ (channel),
+    codec: CAR.outbound,
   })
 
-  // fake register alice
-  service.access.accounts.register(
-    alice.did(),
-    'did:email:alice@web.mail',
-    car.cid
-  )
-
   const [r1] = await connection.execute(add)
   assert.deepEqual(r1.out, {
     ok: {
@@ -280,51 +199,44 @@ test('execute', async () => {
   })
 })
 
-test('execute with delegations', async () => {
+test('decode error', async () => {
   const car = await CAR.codec.write({
     roots: [await CBOR.write({ hello: 'world ' })],
   })
 
   const add = Client.invoke({
-    issuer: bob,
+    issuer: alice,
     audience: w3,
     capability: {
       can: 'store/add',
-      with: bob.did(),
+      with: alice.did(),
       nb: { link: car.cid },
     },
     proofs: [],
   })
 
-  const [e1] = await connection.execute(await add.delegate())
-
-  assert.deepEqual(e1.out, {
-    error: {
-      // @ts-expect-error
-      name: 'UnknownDIDError',
-      message: `DID ${bob.did()} has no account`,
-      did: bob.did(),
-    },
-  })
-
-  // fake register alice
-  service.access.accounts.register(bob.did(), 'did:email:bob@web.mail', car.cid)
-
-  const [r1] = await connection.execute(await add.delegate())
-  assert.deepEqual(r1.out, {
-    ok: {
-      with: bob.did(),
-      link: car.cid,
-      status: 'upload',
-      url: 'http://localhost:9090/',
+  const channel = {
+    request: async (/** @type {any} */ input) => {
+      const { invocations } = await CAR.request.decode(input)
+      const receipts = await Promise.all(
+        invocations.map(invocation =>
+          Receipt.issue({
+            ran: invocation.cid,
+            issuer: w3,
+            result: { ok: {} },
+          })
+        )
+      )
+      const message = await Message.build({
+        receipts: /** @type {any} */ (receipts),
+      })
+      return CAR.response.encode(message)
     },
-  })
-})
+  }
 
-test('decode error', async () => {
   const client = Client.connect({
     id: w3,
-    channel: server,
+    channel: /** @type {any} */ (channel),
     codec: Codec.outbound({
       encoders: {
         'application/car': CAR.request,
@@ -335,22 +247,7 @@ test('decode error', async () => {
     }),
   })
 
-  const car = await CAR.codec.write({
-    roots: [await CBOR.write({ hello: 'world ' })],
-  })
-
-  const add = Client.invoke({
-    issuer: alice,
-    audience: w3,
-    capability: {
-      can: 'store/add',
-      with: alice.did(),
-      nb: { link: car.cid },
-    },
-    proofs: [],
-  })
-
-  const [e1] = await client.execute(await add.delegate())
+  const [e1] = await client.execute(add)
 
   assert.deepEqual(
     {