@fuzdev/fuz_app 0.102.0 → 0.103.0

package/dist/testing/cross_backend/cell_crud.js

@@ -27,7 +27,12 @@ import '../assert_dev_env.js';
  * - `path` write by a non-admin → 403 (`cell_path_admin_only`), on both create
  *   and update (even by the owner);
  * - `cell_get` with neither `id` nor `path` → `invalid_params`;
- * - null-auth `cell_list` with `created_by` → `invalid_params`.
+ * - null-auth `cell_list` with `created_by` → `invalid_params`;
+ * - a denied caller (non-editor update / non-admin path create) carrying a
+ *   `kind` inside `data` still gets the authz error (404 / 403), never the
+ *   kind error — authz runs before the input-shape checks, on both spines;
+ * - an empty-string `kind` is rejected on create (`cell_kind_empty`) and is
+ *   accepted as a list filter that matches nothing.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -54,7 +59,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             const owner_headers = owner.create_session_headers();
             // create — default visibility, owner-stamped, no grants
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', label: 'hi' } }, owner_headers), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: { label: 'hi' } }, owner_headers), CellCreateOutput);
             assert.strictEqual(created.cell.visibility, 'private');
             assert.strictEqual(created.cell.created_by, owner.actor.id);
             assert.strictEqual(created.cell.updated_by, null);
@@ -70,7 +75,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.strictEqual(got.can_edit, true);
             assert.strictEqual(got.can_grant, true); // owner is manage-tier
             // update data + flip to public (owner is manage-tier, so visibility write is allowed)
-            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { kind: 'note', label: 'hi2' }, visibility: 'public' }, owner_headers), CellUpdateOutput);
+            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'hi2' }, visibility: 'public' }, owner_headers), CellUpdateOutput);
             assert.strictEqual(updated.cell.visibility, 'public');
             assert.strictEqual(updated.cell.updated_by, owner.actor.id);
             // list includes it
@@ -97,7 +102,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const ref_b = `blake3:${'b'.repeat(64)}`;
             const ref_c = `blake3:${'c'.repeat(64)}`;
             const sorted = [ref_a, ref_b, ref_c];
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: { cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
             assert.deepStrictEqual(created.cell.refs, sorted, 'create did not return sorted refs');
             // Read it back — the stored column round-trips sorted too.
             const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: created.cell.id }, owner_headers), CellGetOutput);
@@ -111,8 +116,8 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_anon_owner' });
             const owner_headers = owner.create_session_headers();
             const authed = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { data: { kind: 'note' }, visibility: 'private' }, owner_headers), CellCreateOutput).cell;
-            const pub = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { data: { kind: 'note' }, visibility: 'public' }, owner_headers), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'private' }, owner_headers), CellCreateOutput).cell;
+            const pub = expect_output(await cross_rpc_call(authed, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'public' }, owner_headers), CellCreateOutput).cell;
             const anon = fixture.fresh_transport({ origin: null });
             const anon_pub = await cross_rpc_call(anon, rpc_path, 'cell_get', { id: pub.id }, {});
             assert.ok(anon_pub.ok, `anon could not read public cell: ${JSON.stringify(anon_pub.error)}`);
@@ -129,11 +134,11 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_idor_owner' });
             const other = await fixture.create_account({ username: 'cell_idor_other' });
             const t = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner.create_session_headers()), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
             const other_headers = other.create_session_headers();
             const read = await cross_rpc_call(t, rpc_path, 'cell_get', { id: priv.id }, other_headers);
             assert.strictEqual(error_reason(read), 'cell_not_found');
-            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { kind: 'note', label: 'x' } }, other_headers);
+            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { label: 'x' } }, other_headers);
             assert.ok(!edit.ok, 'non-owner edited a private cell');
             assert.strictEqual(error_reason(edit), 'cell_not_found');
             const del = await cross_rpc_call(t, rpc_path, 'cell_delete', { cell_id: priv.id }, other_headers);
@@ -144,7 +149,7 @@ export const describe_cell_crud_cross_tests = (options) => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_admin_owner' });
             const t = fixture.fresh_transport();
-            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner.create_session_headers()), CellCreateOutput).cell;
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
             // `fixture` is the bootstrapped keeper (holds ROLE_ADMIN).
             const admin_read = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: priv.id }, fixture.create_session_headers()), CellGetOutput);
             assert.strictEqual(admin_read.cell.id, priv.id);
@@ -154,8 +159,8 @@ export const describe_cell_crud_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             // `path` writes are admin-only; the keeper is admin.
             const admin_headers = fixture.create_session_headers();
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/dup' }, admin_headers), CellCreateOutput);
-            const dup = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/dup' }, admin_headers);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/dup' }, admin_headers), CellCreateOutput);
+            const dup = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/dup' }, admin_headers);
             assert.ok(!dup.ok, 'duplicate path was accepted');
             assert.strictEqual(error_reason(dup), 'cell_path_taken');
         });
@@ -164,11 +169,11 @@ export const describe_cell_crud_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_path_owner' });
             const t = fixture.fresh_transport();
             const owner_headers = owner.create_session_headers();
-            const create_with_path = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/forbidden' }, owner_headers);
+            const create_with_path = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, path: 'parity/forbidden' }, owner_headers);
             assert.ok(!create_with_path.ok, 'non-admin set a path on create');
             assert.strictEqual(error_reason(create_with_path), 'cell_path_admin_only');
             // Even owning the cell, a non-admin cannot write `path` on update.
-            const owned = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_headers), CellCreateOutput).cell;
+            const owned = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_headers), CellCreateOutput).cell;
             const update_path = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: owned.id, path: 'parity/owned' }, owner_headers);
             assert.ok(!update_path.ok, 'non-admin set a path on update');
             assert.strictEqual(error_reason(update_path), 'cell_path_admin_only');
@@ -187,5 +192,42 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!bad.ok, 'anon created_by filter accepted');
             assert.strictEqual(error_reason(bad), 'cell_list_created_by_requires_auth');
         });
+        test_if(capabilities.cell_crud, 'authz before input-shape: a non-editor update with kind-in-data → 404, not the kind error', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_order_owner' });
+            const other = await fixture.create_account({ username: 'cell_order_other' });
+            const t = fixture.fresh_transport();
+            const priv = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner.create_session_headers()), CellCreateOutput).cell;
+            // `can_edit` (404 IDOR mask) must fire before `reject_kind_in_data`
+            // on both spines — a denied caller can't tell a malformed payload
+            // from a missing cell.
+            const edit = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: priv.id, data: { kind: 'post' } }, other.create_session_headers());
+            assert.ok(!edit.ok, 'non-editor reached the kind check');
+            assert.strictEqual(error_reason(edit), 'cell_not_found');
+        });
+        test_if(capabilities.cell_crud, 'authz before input-shape: a non-admin create with path + kind-in-data → 403, not the kind error', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_order_path' });
+            const t = fixture.fresh_transport();
+            // The path-admin gate (403) fires before `reject_kind_in_data`.
+            const bad = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' }, path: 'parity/order' }, owner.create_session_headers());
+            assert.ok(!bad.ok, 'non-admin path write was not refused first');
+            assert.strictEqual(error_reason(bad), 'cell_path_admin_only');
+        });
+        test_if(capabilities.cell_crud, 'empty kind: rejected on create (cell_kind_empty); accepted as a filter that matches nothing', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_kind_empty' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            const empty = await cross_rpc_call(t, rpc_path, 'cell_create', { kind: '', data: {} }, owner_headers);
+            assert.ok(!empty.ok, 'an empty kind was stored');
+            assert.strictEqual(error_reason(empty), 'cell_kind_empty');
+            // The list filter accepts '' on both spines (TS dropped the
+            // min-length Rust never had) and matches nothing — no cell carries
+            // an empty kind.
+            const note = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_headers), CellCreateOutput).cell;
+            const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind: '' }, owner_headers), CellListOutput);
+            assert.ok(!listed.cells.some((c) => c.id === note.id), 'empty-kind filter matched a non-empty-kind cell');
+        });
     });
 };

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -0,0 +1,4 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+//# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAIzD,eAAO,MAAM,sCAAsC,GAAI,SAAS,wBAAwB,KAAG,IAqF1F,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -0,0 +1,71 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **cell-creation authorizer**
+ * (`CellCreateAuthorize`).
+ *
+ * The authorizer adds no method, column, or wire shape, so the schema-snapshot
+ * and action-manifest parity gates are **blind** to a TS↔Rust authorizer
+ * divergence (the authorizer in the wrong phase, a different deny shape,
+ * create-vs-update). This behavioral cross case is the only gate that catches
+ * one — proven *here in fuz_app*, against both reference spines.
+ *
+ * Both spines mount the same `test_cell_gated_create_authorize` policy (the
+ * TS spine binary via `full_spine_mount`, the Rust `testing_spine_stub` via
+ * `TestCellGatedCreateAuthorize`): creating a `kind: 'gated'` cell requires the
+ * `participant` app-role or admin; every other kind (and a typeless cell) is
+ * open. The suite asserts all three spines agree:
+ *
+ * - **non-participant → gated kind is denied** with the `cell_not_found` 404
+ *   IDOR mask (a gated kind is wire-indistinguishable from a missing resource).
+ * - **non-participant → ungated kind succeeds** (the policy gates only `gated`).
+ * - **participant → gated kind succeeds** (the role unlocks it).
+ * - **admin → gated kind succeeds** (the admin bypass).
+ *
+ * Gated on `capabilities.cell_gated_create` — `true` only on the reference
+ * spine binaries that mount the policy, so it skips for generic consumers and
+ * the in-process default app (the authorizer hook's in-process coverage is the
+ * standalone `auth/cell_create_authorize.db.test.ts`).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ *
+ * @module
+ */
+import { describe, assert } from 'vitest';
+import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { test_if } from './capabilities.js';
+import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { GATED_CELL_KIND, GATED_CELL_ROLE } from './test_cell_gated_create_authorize.js';
+export const describe_cell_gated_create_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('cell_gated_create authorizer parity', () => {
+        test_if(capabilities.cell_gated_create, 'a non-participant is denied the gated kind (cell_not_found 404 IDOR mask)', async () => {
+            const fixture = await setup_test();
+            const stranger = await fixture.create_account({ username: 'gated_stranger' });
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, stranger.create_session_headers());
+            assert.ok(!denied.ok, 'a non-participant must not create the gated kind');
+            assert.strictEqual(error_reason(denied), 'cell_not_found');
+        });
+        test_if(capabilities.cell_gated_create, 'a non-participant may create an ungated kind (the policy gates only `gated`)', async () => {
+            const fixture = await setup_test();
+            const stranger = await fixture.create_account({ username: 'ungated_stranger' });
+            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'note', data: {} }, stranger.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(created.cell.kind, 'note', 'the ungated cell keeps its kind');
+        });
+        test_if(capabilities.cell_gated_create, 'a participant may create the gated kind', async () => {
+            const fixture = await setup_test();
+            const participant = await fixture.create_account({
+                username: 'gated_participant',
+                roles: [GATED_CELL_ROLE],
+            });
+            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(created.cell.kind, GATED_CELL_KIND, 'the participant created the gated kind');
+        });
+        test_if(capabilities.cell_gated_create, 'an admin (keeper) may create the gated kind (admin bypass)', async () => {
+            const fixture = await setup_test();
+            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, fixture.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(created.cell.kind, GATED_CELL_KIND, 'admin bypasses the gate');
+        });
+    });
+};

package/dist/testing/cross_backend/cell_grant_role.js

@@ -59,7 +59,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const stranger = await fixture.create_account({ username: 'cell_role_stranger' });
             // Owner creates a private cell (default visibility) and grants
             // view access to anyone holding CELL_EDITOR_ROLE.
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'viewer', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
             // Holder of the role is admitted through the role-shaped grant.
@@ -76,7 +76,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const t = fixture.transport;
             const owner = await fixture.create_account({ username: 'cell_unknown_role_owner' });
             const owner_h = owner.create_session_headers();
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const denied = await cross_rpc_call(t, rpc_path, 'cell_grant_create', {
                 cell_id: created.cell.id,
                 level: 'viewer',
@@ -92,10 +92,10 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             const owner_h = owner.create_session_headers();
             const holder = fixture.extra_accounts[CELL_ROLE_HOLDER_USERNAME];
             assert.ok(holder, `fixture must seed the ${CELL_ROLE_HOLDER_USERNAME} extra account`);
-            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput);
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'editor', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
-            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { kind: 'note', label: 'by role editor' } }, holder.create_session_headers()), CellUpdateOutput);
+            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'by role editor' } }, holder.create_session_headers()), CellUpdateOutput);
             assert.strictEqual(edited.cell.updated_by, holder.actor.id, 'edit attributed to the holder');
         });
     });

package/dist/testing/cross_backend/cell_relations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqF9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAsFzD,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IAyvBvF,CAAC"}
+{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqF9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAsFzD,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IA+vBvF,CAAC"}

package/dist/testing/cross_backend/cell_relations.js

@@ -100,9 +100,9 @@ export const describe_cell_relations_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             const owner_h = owner.create_session_headers();
             const editor_h = editor.create_session_headers();
-            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput).cell;
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput).cell;
             // Before the grant the editor can't even see the private cell.
-            const pre = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { kind: 'note', label: 'x' } }, editor_h);
+            const pre = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { label: 'x' } }, editor_h);
             assert.ok(!pre.ok, 'non-grantee edited a private cell');
             assert.strictEqual(error_reason(pre), 'cell_not_found');
             // Owner (manage-tier) grants the editor an actor-shaped editor grant.
@@ -115,7 +115,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             assert.strictEqual(grant.actor_id, editor.actor.id);
             assert.strictEqual(grant.role, null);
             // The editor can now edit content.
-            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { kind: 'note', label: 'by editor' } }, editor_h), CellUpdateOutput);
+            const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { label: 'by editor' } }, editor_h), CellUpdateOutput);
             assert.strictEqual(edited.cell.updated_by, editor.actor.id);
             // grant_list is manage-tier: owner sees the grant.
             const owner_grants = expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_list', { cell_id: cell.id }, owner_h), CellGrantListOutput);
@@ -127,7 +127,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             // Revoke and confirm the edit path is gone.
             const revoked = expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_revoke', { grant_id: grant.id }, owner_h), CellGrantRevokeOutput);
             assert.strictEqual(revoked.ok, true);
-            const post = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { kind: 'note', label: 'y' } }, editor_h);
+            const post = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { label: 'y' } }, editor_h);
             assert.ok(!post.ok, 'revoked editor still edited');
             assert.strictEqual(error_reason(post), 'cell_not_found');
         });
@@ -138,14 +138,14 @@ export const describe_cell_relations_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             const owner_h = owner.create_session_headers();
             const editor_h = editor.create_session_headers();
-            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput).cell;
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput).cell;
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', {
                 cell_id: cell.id,
                 level: 'editor',
                 principal: { kind: 'actor', actor_id: editor.actor.id },
             }, owner_h), CellGrantCreateOutput);
             // Content edits pass (editor tier); a visibility write is manage-tier.
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { kind: 'note', label: 'ok' } }, editor_h), CellUpdateOutput);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { label: 'ok' } }, editor_h), CellUpdateOutput);
             const vis = await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, visibility: 'public' }, editor_h);
             assert.ok(!vis.ok, 'editor flipped visibility');
             assert.strictEqual(error_reason(vis), 'cell_visibility_manage_only');
@@ -155,8 +155,8 @@ export const describe_cell_relations_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_field_owner' });
             const t = fixture.fresh_transport();
             const h = owner.create_session_headers();
-            const source = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, h), CellCreateOutput).cell;
-            const target = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, h), CellCreateOutput).cell;
+            const source = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell;
+            const target = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell;
             const set = expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: source.id, name: 'cover', target_id: target.id }, h), CellFieldSetOutput);
             assert.strictEqual(set.field.name, 'cover');
             assert.strictEqual(set.field.source_id, source.id);
@@ -175,7 +175,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_item_owner' });
             const t = fixture.fresh_transport();
             const h = owner.create_session_headers();
-            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, h), CellCreateOutput).cell.id;
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
             const parent = await make();
             const child_a = await make();
             const child_b = await make();
@@ -208,7 +208,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             const owner = await fixture.create_account({ username: 'cell_clone_owner' });
             const t = fixture.fresh_transport();
             const h = owner.create_session_headers();
-            const make = async (label) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', ...(label === undefined ? {} : { label }) } }, h), CellCreateOutput).cell.id;
+            const make = async (label) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: { ...(label === undefined ? {} : { label }) } }, h), CellCreateOutput).cell.id;
             const source = await make('orig');
             const child = await make('child');
             const field_target = await make('target');
@@ -244,9 +244,9 @@ export const describe_cell_relations_cross_tests = (options) => {
             const t = fixture.fresh_transport();
             const owner_h = owner.create_session_headers();
             const viewer_h = viewer.create_session_headers();
-            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note' } }, owner_h), CellCreateOutput).cell;
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput).cell;
             // A mutation so the timeline has at least the create + update events.
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { kind: 'note', label: 'v2' } }, owner_h), CellUpdateOutput);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: cell.id, data: { label: 'v2' } }, owner_h), CellUpdateOutput);
             // Owner (manage-tier) reads the timeline.
             const timeline = expect_output(await cross_rpc_call(t, rpc_path, 'cell_audit_list', { cell_id: cell.id }, owner_h), CellAuditListOutput);
             assert.ok(timeline.events.length > 0, 'owner audit timeline empty');
@@ -273,14 +273,16 @@ export const describe_cell_relations_cross_tests = (options) => {
             // items and fields. The private child is owned by `owner`, so only
             // `owner` (and admin) can view it.
             const parent = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'collection' },
+                kind: 'collection',
+                data: {},
                 visibility: 'public',
             });
             const pub_child = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'note' },
+                kind: 'note',
+                data: {},
                 visibility: 'public',
             });
-            const priv_child = await create_cell(t, rpc_path, owner_h, { data: { kind: 'note' } });
+            const priv_child = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
             await wire_children(t, rpc_path, owner_h, parent, pub_child, priv_child);
             // Anonymous: only the public child surfaces in the bundle …
             const anon = fixture.fresh_transport({ origin: null });
@@ -301,9 +303,9 @@ export const describe_cell_relations_cross_tests = (options) => {
             const owner_h = owner.create_session_headers();
             const viewer_h = viewer.create_session_headers();
             // Private parent; one child the viewer will be granted, one they won't.
-            const parent = await create_cell(t, rpc_path, owner_h, { data: { kind: 'collection' } });
-            const shared_child = await create_cell(t, rpc_path, owner_h, { data: { kind: 'note' } });
-            const priv_child = await create_cell(t, rpc_path, owner_h, { data: { kind: 'note' } });
+            const parent = await create_cell(t, rpc_path, owner_h, { kind: 'collection', data: {} });
+            const shared_child = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
+            const priv_child = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
             await wire_children(t, rpc_path, owner_h, parent, shared_child, priv_child);
             // Grant the viewer on parent AND shared_child — but not priv_child.
             for (const cell_id of [parent, shared_child]) {
@@ -325,14 +327,16 @@ export const describe_cell_relations_cross_tests = (options) => {
             // The keeper holds [keeper, admin], so its headers are the admin probe.
             const admin_h = fixture.create_session_headers();
             const parent = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'collection' },
+                kind: 'collection',
+                data: {},
                 visibility: 'public',
             });
             const pub_child = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'note' },
+                kind: 'note',
+                data: {},
                 visibility: 'public',
             });
-            const priv_child = await create_cell(t, rpc_path, owner_h, { data: { kind: 'note' } });
+            const priv_child = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
             await wire_children(t, rpc_path, owner_h, parent, pub_child, priv_child);
             // The cloner can read the public parent but not the private child.
             const clone = expect_output(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: parent }, cloner_h), CellCloneOutput).cell;
@@ -362,14 +366,16 @@ export const describe_cell_relations_cross_tests = (options) => {
             const cloner_h = cloner.create_session_headers();
             const admin_h = fixture.create_session_headers();
             const parent = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'collection' },
+                kind: 'collection',
+                data: {},
                 visibility: 'public',
             });
             const pub_child = await create_cell(t, rpc_path, owner_h, {
-                data: { kind: 'note' },
+                kind: 'note',
+                data: {},
                 visibility: 'public',
             });
-            const priv_child = await create_cell(t, rpc_path, owner_h, { data: { kind: 'note' } });
+            const priv_child = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
             await wire_children(t, rpc_path, owner_h, parent, pub_child, priv_child);
             const clone = expect_output(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: parent, deep: true }, cloner_h), CellCloneOutput).cell;
             // Deep clone copies viewable children into fresh cells; the

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAuBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAsBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -41,6 +41,10 @@ export const ts_default_capabilities = Object.freeze({
     // the HTTP RPC endpoint (the no-transport case). The TS spine config opts in;
     // a generic consumer enables it once it wires that mount.
     peer_request: false,
+    // Off by default — the `cell_gated_create` test policy is a fuz_app test
+    // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
+    // consumers.
+    cell_gated_create: false,
 });
 /**
  * Capabilities for the Rust family. The non-gating wiring facts live in
@@ -66,6 +70,9 @@ export const rust_default_capabilities = Object.freeze({
     // Server-initiated requests landed Rust-first canonical — the Rust spine
     // drives the `peer/ping` round-trip, so the family opts into the suite.
     peer_request: true,
+    // Off by default — the `testing_spine_stub` preset opts in (it mounts the
+    // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
+    cell_gated_create: false,
 });
 /**
  * Shape notes for TS-family backends — wiring facts, not gating flags.

package/dist/testing/cross_backend/expected_schema.json

@@ -54,6 +54,7 @@
 		"data",
 		"deleted_at",
 		"id",
+		"kind",
 		"path",
 		"refs",
 		"updated_at",

package/dist/testing/cross_backend/fact_serving.js

@@ -80,8 +80,8 @@ export const describe_fact_serving_cross_tests = (options) => {
      * disambiguate or the authorization phase rejects with `actor_required`.
      */
     const create_cell_with_ref = async (transport, headers, hash, visibility, acting) => expect_output(await cross_rpc_call(transport, rpc_path, 'cell_create', acting === undefined
-        ? { data: { kind: 'doc', cover: hash }, visibility }
-        : { data: { kind: 'doc', cover: hash }, visibility, acting }, headers), CellCreateOutput).cell.id;
+        ? { kind: 'doc', data: { cover: hash }, visibility }
+        : { kind: 'doc', data: { cover: hash }, visibility, acting }, headers), CellCreateOutput).cell.id;
     const cell_fact_path = (cell_id, hash) => `/api/cells/${cell_id}/facts/${hash}`;
     describe('fact serving parity (cell-scoped per-reference reads)', () => {
         test_if(capabilities.fact_serving, 'cell-scoped admit: anon reads a fact through a public referencing cell', async () => {

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAQzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0BjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AASzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAiCjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,6 +5,7 @@ import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
 import { create_testing_action_manifest_action, create_testing_actions, } from './testing_reset_actions.js';
+import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
@@ -28,7 +29,11 @@ export const build_full_spine_rpc_actions = (deps, options) => {
             session_options: spine_session_options,
             daemon_token_state: options.daemon_token_state,
         }),
-        ...create_all_cell_actions(deps, { roles: spine_roles }),
+        // Mount the `cell_gated_create` test policy (twin of the Rust stub's
+        // `TestCellGatedCreateAuthorize`) so the cross-backend authorizer-parity
+        // suite has a known gate. It only gates `kind: 'gated'`; every other kind
+        // stays open, so the other cell suites are unaffected.
+        ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),
         // `peer/ping` is mounted on the HTTP RPC endpoint too (not just WS) so an

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAiDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAiDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -49,14 +49,17 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
 /**
  * Capabilities for the Rust `testing_spine_stub` — `rust_default_capabilities`
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
- * `fuz_realtime::SseRegistry` + audit listener) and `ready` (it live-mounts
- * `/ready` over the env-supplied fixture path). Named (not inline) so every
- * spine preset is greppable, mirroring `ts_spine_capabilities`.
+ * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
+ * `/ready` over the env-supplied fixture path), and `cell_gated_create` (it
+ * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
+ * (not inline) so every spine preset is greppable, mirroring
+ * `ts_spine_capabilities`.
  */
 const rust_spine_stub_capabilities = Object.freeze({
     ...rust_default_capabilities,
     sse: true,
     ready: true,
+    cell_gated_create: true,
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -0,0 +1,17 @@
+import '../assert_dev_env.js';
+import type { CellCreateAuthorize } from '../../auth/cell_actions.js';
+/** The single kind the test policy gates (shared with the driving suite). */
+export declare const GATED_CELL_KIND = "gated";
+/**
+ * The app-role that unlocks creating the gated kind (besides admin) — the
+ * `participant` role both reference spines register. Mirrors the Rust policy's
+ * `"participant"` literal.
+ */
+export declare const GATED_CELL_ROLE = "participant";
+/**
+ * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
+ * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
+ * `TestCellGatedCreateAuthorize` exactly.
+ */
+export declare const test_cell_gated_create_authorize: CellCreateAuthorize;
+//# sourceMappingURL=test_cell_gated_create_authorize.d.ts.map

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,KAAK,EAAC,mBAAmB,EAA2B,MAAM,4BAA4B,CAAC;AAG9F,6EAA6E;AAC7E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAyB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAIiD,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -0,0 +1,36 @@
+import '../assert_dev_env.js';
+/**
+ * Test `CellCreateAuthorize` policy mounted on **both** reference spines — the
+ * TS spine binary's full mount (`full_spine_mount.ts`) and the Rust
+ * `testing_spine_stub` — so the cross-backend `cell_gated_create` suite proves
+ * the cell-creation authorizer agrees TS↔Rust. The twin of the Rust
+ * `TestCellGatedCreateAuthorize`.
+ *
+ * The policy gates exactly one kind: creating a `kind: 'gated'` cell requires
+ * the `participant` app-role (registered on both spines, `grant_paths:
+ * ['admin']`) or admin. Every other kind — and a typeless cell — is open, so
+ * the existing cell suites (which use `note` / `collection` kinds) are
+ * unaffected, exactly as on the Rust stub.
+ *
+ * **`$lib`-free by contract** — reached by the spawned TS spine binary under
+ * Gro's loader (no `$lib` alias). Keep every import relative.
+ *
+ * @module
+ */
+import { has_role } from '../../auth/request_context.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
+/** The single kind the test policy gates (shared with the driving suite). */
+export const GATED_CELL_KIND = 'gated';
+/**
+ * The app-role that unlocks creating the gated kind (besides admin) — the
+ * `participant` role both reference spines register. Mirrors the Rust policy's
+ * `"participant"` literal.
+ */
+export const GATED_CELL_ROLE = SPINE_PARTICIPANT_ROLE;
+/**
+ * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
+ * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
+ * `TestCellGatedCreateAuthorize` exactly.
+ */
+export const test_cell_gated_create_authorize = (auth, input) => input.kind !== GATED_CELL_KIND || has_role(auth, GATED_CELL_ROLE) || has_role(auth, ROLE_ADMIN);

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA+B3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAkC3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}