@fuzdev/fuz_app 0.106.1 → 0.108.0

package/dist/server/app_server.js

@@ -81,16 +81,23 @@ export const create_app_server = async (options) => {
     const { deps } = backend;
     const { log } = deps;
     // Rate limiter defaults (undefined = default, null = disable)
-    const ip_rate_limiter = options.ip_rate_limiter === undefined ? create_rate_limiter() : options.ip_rate_limiter;
+    // One instance per surface — see `AppServerOptions.login_ip_rate_limiter`
+    // for why these are not a single shared bucket.
+    const login_ip_rate_limiter = options.login_ip_rate_limiter === undefined
+        ? create_rate_limiter()
+        : options.login_ip_rate_limiter;
+    const signup_ip_rate_limiter = options.signup_ip_rate_limiter === undefined
+        ? create_rate_limiter()
+        : options.signup_ip_rate_limiter;
+    const bootstrap_ip_rate_limiter = options.bootstrap_ip_rate_limiter === undefined
+        ? create_rate_limiter()
+        : options.bootstrap_ip_rate_limiter;
     const login_account_rate_limiter = options.login_account_rate_limiter === undefined
         ? create_rate_limiter(default_login_account_rate_limit)
         : options.login_account_rate_limiter;
     const signup_account_rate_limiter = options.signup_account_rate_limiter === undefined
         ? create_rate_limiter(default_login_account_rate_limit)
         : options.signup_account_rate_limiter;
-    const bearer_ip_rate_limiter = options.bearer_ip_rate_limiter === undefined
-        ? create_rate_limiter()
-        : options.bearer_ip_rate_limiter;
     const action_ip_rate_limiter = options.action_ip_rate_limiter === undefined
         ? create_rate_limiter(default_action_ip_rate_limit)
         : options.action_ip_rate_limiter;
@@ -115,7 +122,6 @@ export const create_app_server = async (options) => {
     const auth_middleware = await create_auth_middleware_specs(deps, {
         allowed_origins: options.allowed_origins,
         session_options: options.session_options,
-        bearer_ip_rate_limiter,
         daemon_token_state: options.daemon_token_state
     });
     let middleware_specs = [proxy_spec, ...auth_middleware];
@@ -147,7 +153,9 @@ export const create_app_server = async (options) => {
         backend,
         bootstrap_status,
         session_options: options.session_options,
-        ip_rate_limiter,
+        login_ip_rate_limiter,
+        signup_ip_rate_limiter,
+        bootstrap_ip_rate_limiter,
         login_account_rate_limiter,
         signup_account_rate_limiter,
         action_ip_rate_limiter,
@@ -166,7 +174,7 @@ export const create_app_server = async (options) => {
             session_options: options.session_options,
             bootstrap_status,
             on_bootstrap: options.bootstrap.mode === 'live' ? options.bootstrap.on_bootstrap : undefined,
-            ip_rate_limiter
+            bootstrap_ip_rate_limiter
         });
         const prefix = options.bootstrap.route_prefix ?? '/api/account';
         factory_routes.push(...prefix_route_specs(prefix, bootstrap_routes));
@@ -243,19 +251,21 @@ export const create_app_server = async (options) => {
             });
         }
     }
-    if (ip_rate_limiter === null) {
-        config_diagnostics.push({
-            level: 'warning',
-            category: 'config',
-            message: 'IP rate limiter explicitly disabled (null)'
-        });
-    }
-    if (bearer_ip_rate_limiter === null) {
-        config_diagnostics.push({
-            level: 'warning',
-            category: 'config',
-            message: 'Bearer IP rate limiter explicitly disabled (null)'
-        });
+    // One diagnostic per surface — a deployment that disables login's limiter
+    // but keeps signup's is a different posture than one that disables both,
+    // and a single collapsed warning hid which surface was open.
+    for (const [name, limiter] of [
+        ['login', login_ip_rate_limiter],
+        ['signup', signup_ip_rate_limiter],
+        ['bootstrap', bootstrap_ip_rate_limiter]
+    ]) {
+        if (limiter === null) {
+            config_diagnostics.push({
+                level: 'warning',
+                category: 'config',
+                message: `${name} IP rate limiter explicitly disabled (null)`
+            });
+        }
     }
     if (config_diagnostics.length) {
         surface_spec.surface.diagnostics = [...surface_spec.surface.diagnostics, ...config_diagnostics];

package/dist/server/app_server_context.d.ts

@@ -25,8 +25,16 @@ export interface AppServerContext {
     backend: AppBackend;
     bootstrap_status: BootstrapStatus;
     session_options: SessionOptions<string>;
-    /** Shared IP rate limiter (from options). `null` when not configured. */
-    ip_rate_limiter: RateLimiter | null;
+    /**
+     * Per-IP login + password-change rate limiter (from options). `null` when
+     * not configured. One instance per auth surface — see
+     * `AppServerOptions.login_ip_rate_limiter` for why these aren't shared.
+     */
+    login_ip_rate_limiter: RateLimiter | null;
+    /** Per-IP signup rate limiter (from options). `null` when not configured. */
+    signup_ip_rate_limiter: RateLimiter | null;
+    /** Per-IP bootstrap rate limiter (from options). `null` when not configured. */
+    bootstrap_ip_rate_limiter: RateLimiter | null;
     /** Per-account login rate limiter (from options). `null` when not configured. */
     login_account_rate_limiter: RateLimiter | null;
     /** Per-account signup rate limiter (from options). `null` when not configured. */

package/dist/server/app_server_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,gBAAgB,EAAE,eAAe,CAAC;IAClC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yEAAyE;IACzE,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,iFAAiF;IACjF,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,kFAAkF;IAClF,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD,uGAAuG;IACvG,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,0GAA0G;IAC1G,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B"}
+{"version":3,"file":"app_server_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,gBAAgB,EAAE,eAAe,CAAC;IAClC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,6EAA6E;IAC7E,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,gFAAgF;IAChF,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9C,iFAAiF;IACjF,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,kFAAkF;IAClF,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD,uGAAuG;IACvG,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,0GAA0G;IAC1G,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B"}

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAgBtD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6DjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAwCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6DjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA0CF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -93,7 +93,7 @@ import { join } from 'node:path';
 import { FactHashSchema } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { z } from 'zod';
-import { build_request_context, get_request_context, has_role, token_scope_surface_denial } from '../auth/request_context.js';
+import { build_request_context, get_request_context, has_role } from '../auth/request_context.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
 import { ActingActor } from '../http/auth_shape.js';
 import { ACCOUNT_ID_KEY } from '../hono_context.js';
@@ -320,7 +320,17 @@ export const create_serve_fact_route_spec = (options) => {
     return {
         method: 'GET',
         path: '/api/facts/:hash',
-        auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
+        auth: {
+            account: 'required',
+            actor: 'required',
+            roles: [ROLE_ADMIN],
+            // Rule 3 — a narrowed token gets no bare-hash read. This route
+            // serves *any* stored fact by hash with no per-reference cell check
+            // (that is the per-cell route's job), so it is the broad capability
+            // of the pair; gating it keeps a narrowed token to the cell-scoped
+            // route its RPC methods can justify.
+            required_scope: 'surface:fact_bare'
+        },
         description: 'Serve content-addressed fact bytes by bare hash — admin only. Non-admin reads go through GET /api/cells/:cell_id/facts/:hash (per-reference).',
         params: bare_hash_params_schema,
         // `actor: 'required'` (implied by the admin role gate) needs the
@@ -334,14 +344,6 @@ export const create_serve_fact_route_spec = (options) => {
         errors: params_400_error,
         handler: async (c, route) => {
             const { hash } = get_route_params(c);
-            // Rule 3 — a narrowed token gets no bare-hash read. This route serves
-            // *any* stored fact by hash with no per-reference cell check (that is
-            // the per-cell route's job), so it is the broad capability of the
-            // pair; gating it keeps a narrowed token to the cell-scoped route its
-            // RPC methods can justify.
-            const denied = token_scope_surface_denial(c, 'fact_bare');
-            if (denied)
-                return denied;
             // Defense-in-depth: the auth phase already gated this on the admin
             // role, but re-check the resolved context so a mounting/auth-shape
             // regression fails closed instead of serving by bare hash.

package/dist/testing/CLAUDE.md

@@ -457,8 +457,8 @@ file that imports from `middleware.ts` gets these mocks globally. Pair with
 - `BearerAuthTestOptions`, `BearerAuthTestCase` — test-case table shape for the bearer auth runner.
 - `create_bearer_auth_mocks(tc)` — configures the module-level mocks per test case; returns spy references.
 - `TEST_CLIENT_IP = '127.0.0.1'` — IP set by the proxy stub in `create_bearer_auth_test_app`.
-- `create_bearer_auth_test_app(tc, ip_rate_limiter?)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, request_context_set}` — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
-- `describe_bearer_auth_cases(suite_name, cases, ip_rate_limiter?)` — table-driven runner; one `test()` per case; asserts status, error, body fields, `api_token_id`, context preservation.
+- `create_bearer_auth_test_app(tc)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, request_context_set}` — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
+- `describe_bearer_auth_cases(suite_name, cases)` — table-driven runner; one `test()` per case; asserts status, error, body fields, `api_token_id`, context preservation.
 - `TEST_MIDDLEWARE_PATH = '/api/test'` — path used by the echo route in the stack factory.
 - `create_test_middleware_stack_app(options?)` — real proxy + origin + bearer middleware for integration-shape testing. Echo route returns `{ok, client_ip, has_context}`.
 
@@ -571,17 +571,19 @@ Options: `{setup_test, surface_source, capabilities, sensitive_fields?, admin_on
 
 ### `rate_limiting.ts` — `describe_rate_limiting_tests`
 
-Three test groups:
+Two test groups:
 
 1. IP rate limiting on login — fires `max_attempts + 1` requests; last should be 429 with `RateLimitError` body + valid `Retry-After` header.
 2. Per-account rate limiting on login — same username exhausts the bucket; a different username is not blocked.
-3. Bearer auth IP rate limiting — invalid bearer tokens exhaust the IP bucket via the `account_verify` RPC method.
+
+No bearer group — the bearer path carries no rate limiter on either spine
+(`auth/bearer_auth.ts`), which is also why `rpc_endpoints` is optional here.
 
 Each group asserts its required route exists with a descriptive message.
 Creates a tight rate limiter (default `max_attempts: 2`, `window_ms: 60_000`)
 per test and disposes it in `finally`.
 
-Options: `{session_options, create_route_specs, rpc_endpoints, app_options?, db_factories?, max_attempts?}`.
+Options: `{session_options, create_route_specs, rpc_endpoints?, app_options?, db_factories?, max_attempts?}`.
 Reads inputs directly from the options bag instead of going through the
 `setup_test` fixture protocol — the per-test rate-limiter overrides need a
 fresh `TestApp` per test that the single-fixture model can't carry.
@@ -1346,6 +1348,42 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   complete action list plus its own spec. Daemon-token-gated like its siblings;
   the Rust mirror is `fuz_testing::create_testing_action_manifest_action_spec`.
 
+### Token-scope surface parity — `cross_backend/token_scope_surface.ts`
+
+`describe_token_scope_surface_cross_tests({setup_test, capabilities, rpc_path?,
+sse_path?})` — the `surface:<name>` twin of the conformance slate's
+`token_scope_cases`, which cover only the `rpc:<method>` arm. Token scoping's
+RPC-only rule (_a narrowed api token reaches no non-RPC surface_) is the
+load-bearing half of the design and had **no** cross-impl gate: the schema gate
+can't see it (no column), the action-manifest gate can't see it (no method), and
+the spec-derived suites can't see it (REST routes, off the declared RPC surface).
+
+Mints a narrowed bearer through the production `account_token_create` path and
+fires it at the two surfaces whose denial **body** is observable over plain
+HTTP — the audit SSE stream (`capabilities.sse`) and the admin-only bare-hash
+fact read (`capabilities.fact_serving`) — asserting the exact flat
+`{error: 'token_scope_required', required_scope: 'surface:<name>'}` both spines
+contract on (`token_scope_denied_body` ↔
+`fuz_auth::token_scope_surface_denied_response`).
+
+The fifth case is the one with no prior pin anywhere: **scope outranks role**. A
+narrowed token on an account that _also_ lacks the gating role must hear
+`token_scope_required`, not `insufficient_permissions` — the observable the
+TS↔Rust ordering divergence produced before both spines converged on running the
+surface gate ahead of the role gate. Every other scoped-token probe uses the
+keeper's token, whose account holds the role, so both orderings look identical
+there; that is why the divergence survived as long as it did. Verified to
+discriminate: dropping the route's `required_scope` turns it into a 403
+`insufficient_permissions` + `required_roles`, exactly the pre-convergence shape.
+
+Two non-vacuity controls: the narrowed token must still reach the RPC method it
+_does_ name, and a full bearer must get past the scope gate on the same route.
+The WS upgrade is deliberately omitted — `create_ws_transport` threads cookies,
+not bearer headers, and a refused upgrade's body isn't readable, so it can't
+serve a body-parity gate (its per-spine coverage stays in the two surface
+censuses). Cross-process only; fuz_app's own wiring is
+`src/test/cross_backend/token_scope_surface.cross.test.ts`.
+
 ### Origin verification parity — `cross_backend/origin.ts`
 
 `describe_origin_cross_tests({setup_test, capabilities, rpc_path?})` — the
@@ -1396,9 +1434,9 @@ read) it fires three principals over real HTTP: **anonymous** → 401, **session
 proving the daemon-token gate that fences each backdoor action holds end-to-end
 on the real dispatcher (the spec-derived `describe_rpc_attack_surface_tests`
 never enumerates them because they're off the declared surface). Each method is
-sent with **valid** params so the session/bearer cases clear the 400
-input-validation phase and reach the 403 credential gate (order is
-401 → 400 → 403); the handler never runs. Cited property: `docs/security.md`
+sent with **valid** params so each case varies only the credential (validation
+runs after the gates — order is 401 → authz → 403 → 400); the handler never
+runs. Cited property: `docs/security.md`
 §Test Backdoor Actions. Cross-process only (the `_testing_*` actions are
 mounted on the spawned binary, not the in-process app — like the ws/sse
 suites); ungated, since every cross backend that uses
@@ -1459,7 +1497,7 @@ pay the 250ms denial floor.
 
 `describe_login_security_cross_tests({setup_test, login_path?})` — the imperative
 suite pinning **login rate limiting + `X-Forwarded-For` client-IP resolution**
-over real HTTP on both spines. Two cases:
+over real HTTP on both spines:
 
 - **per-IP limit fires** — `default_login_ip_rate_limit.max_attempts` (5, the
   shared cap on both impls) failed logins from one forwarded IP → 401, the next →
@@ -1469,15 +1507,26 @@ over real HTTP on both spines. Two cases:
 - **XFF keying** — exhaust one forwarded IP to 429, then a _distinct_ forwarded IP
   → 401 (not 429), proving the limiter keys on the resolved `X-Forwarded-For` IP,
   not the loopback TCP peer (a backend ignoring XFF would 429 the fresh IP too).
+- **a success does not refund the per-IP budget** — the distributed-spray
+  backstop. Failed guesses against distinct usernames from one forwarded IP,
+  interleaved with the attacker's own successful logins, must still 429 within a
+  bounded total-request budget. Both spines used to clear the IP bucket on
+  success; only the account-grain bucket is forgiven now. The **budget bound** is
+  what makes this adversarial — a decrement-instead-of-zero implementation loops
+  to the iteration cap and fails here. Either leg may trip: the aggregate governs
+  the address, so once it fills the attacker's own login is refused too.
 
 **Cross-process only**, on a **dedicated dual-spawn project** (`cross_backend_security`
 via `global_setup_login_security.ts`) — the limiters can't be enabled on a backend
 the standard suites share (they fire many loopback logins a live limiter would
 429), so the standard backends keep every limiter null. Determinism without a
 limiter reset: each case uses its own forwarded IP (a fresh bucket) plus its own
-non-existent username. Zero Rust code change — the stub's `FUZ_LOGIN_RATE_LIMIT_ENABLED`
+non-existent username; the spray case additionally mints its attacker account
+over the setup path (loopback, no XFF), so minting can't touch the bucket under
+test. Zero Rust code change — the stub's `FUZ_LOGIN_RATE_LIMIT_ENABLED`
 and `FUZ_TRUSTED_PROXIES` env-gates were already wired; the TS side env-gates the
-limiters in the binary, and `create_spine_route_specs` honors `ctx.ip_rate_limiter`.
+limiters in the binary, and `create_spine_route_specs` honors
+`ctx.login_ip_rate_limiter`.
 The in-process counterparts already exist (`describe_rate_limiting_tests` plus the
 proxy middleware tests), so there's no in-process leg. `npm run test:cross:security`.
 Cited property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAmGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAuE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAwE7B,CAAC"}

package/dist/testing/app_server.js

@@ -276,10 +276,11 @@ export const create_test_app = async (options) => {
         allowed_origins: [/^http:\/\/localhost/],
         proxy: { trusted_proxies: ['127.0.0.1'], get_connection_ip: () => '127.0.0.1' },
         env_schema: z.object({}),
-        ip_rate_limiter: null,
+        login_ip_rate_limiter: null,
+        signup_ip_rate_limiter: null,
+        bootstrap_ip_rate_limiter: null,
         login_account_rate_limiter: null,
         signup_account_rate_limiter: null,
-        bearer_ip_rate_limiter: null,
         await_pending_effects: true,
         daemon_token_state,
         rpc_endpoints: options.rpc_endpoints,
@@ -402,10 +403,11 @@ export const create_test_app_for_bootstrap = async (options) => {
         allowed_origins: [/^http:\/\/localhost/],
         proxy: { trusted_proxies: ['127.0.0.1'], get_connection_ip: () => '127.0.0.1' },
         env_schema: z.object({}),
-        ip_rate_limiter: null,
+        login_ip_rate_limiter: null,
+        signup_ip_rate_limiter: null,
+        bootstrap_ip_rate_limiter: null,
         login_account_rate_limiter: null,
         signup_account_rate_limiter: null,
-        bearer_ip_rate_limiter: null,
         await_pending_effects: true,
         daemon_token_state,
         rpc_endpoints: options.rpc_endpoints,

package/dist/testing/cross_backend/conformance_case.js

@@ -141,7 +141,7 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Expected error reason — pass the IMPORTED `ERROR_*` constant from ' +
             '`http/error_schemas.ts`, never a string literal. Asserted against the RPC ' +
             '`error.data.reason` (when the denial carries one) or the REST flat-body ' +
-            '`error` field. The pre-validation 401 carries `data.reason` too; a denial ' +
+            '`error` field. The pre-authorization 401 carries `data.reason` too; a denial ' +
             'that genuinely omits it falls back to the `status` assertion to pin the class.'
     }),
     fields: z

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAI1F,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAe3E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,gBAGxB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC+B,CAAC;AAE7F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAI1F,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAe3E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,gBAGxB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAgC/E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC+B,CAAC;AAE7F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -72,20 +72,21 @@ export const create_spine_route_specs = (ctx) => [
         ...create_account_route_specs(ctx.deps, {
             session_options: spine_session_options,
             // Honor the limiters the server was assembled with (on `AppServerContext`
-            // per the `ip_rate_limiter` / `login_account_rate_limiter` TSDoc) rather
-            // than hardcoding `null`. The standard spine binary passes `null` (the
-            // cross suites fire many loopback logins and must not trip a limiter), so
-            // this is behavior-preserving there; the dedicated login-security cross
-            // backend passes real limiters to exercise the 429 + `Retry-After` path
-            // and XFF-keyed bucketing over the wire (see `login_security.ts`).
-            ip_rate_limiter: ctx.ip_rate_limiter,
+            // per the `login_ip_rate_limiter` / `login_account_rate_limiter` TSDoc)
+            // rather than hardcoding `null`. The standard spine binary passes `null`
+            // (the cross suites fire many loopback logins and must not trip a
+            // limiter), so this is behavior-preserving there; the dedicated
+            // login-security cross backend passes real limiters to exercise the 429 +
+            // `Retry-After` path and XFF-keyed bucketing over the wire (see
+            // `login_security.ts`).
+            login_ip_rate_limiter: ctx.login_ip_rate_limiter,
             login_account_rate_limiter: ctx.login_account_rate_limiter,
             login_fail_floor_ms: 0,
             bootstrap_status: ctx.bootstrap_status
         }),
         ...create_signup_route_specs(ctx.deps, {
             session_options: spine_session_options,
-            ip_rate_limiter: null,
+            signup_ip_rate_limiter: null,
             signup_account_rate_limiter: null,
             // Disable the denial floor so the identity-parity suite's accepted
             // cases (valid username/email, no invite → 403 no-matching-invite)

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAqGF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -24,6 +24,13 @@ import '../assert_dev_env.js';
  *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
  *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
  *   keys on the resolved `X-Forwarded-For` client IP.
+ * - **a success does not refund the per-IP budget** — the distributed-spray
+ *   backstop. Failed guesses against *distinct* usernames from one forwarded
+ *   IP, interleaved with the attacker's own successful logins, must still 429
+ *   within a bounded total-request budget. Both spines used to clear the IP
+ *   bucket on success, which made that budget unbounded: one credential (or,
+ *   under open signup, none) bought unlimited guesses against arbitrary victims
+ *   from a single address. Only the account-grain bucket is forgiven now.
  *
  * **Determinism without a limiter reset.** Limiter state is in-memory and the
  * per-test `_testing_reset` wipes only the DB, never the buckets — so each
@@ -58,6 +65,7 @@ import { default_login_account_rate_limit, default_login_ip_rate_limit } from '.
 const XFF_IP_LIMIT = '203.0.113.1';
 const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
 const XFF_SEGREGATION_FRESH = '203.0.113.3';
+const XFF_SPRAY = '203.0.113.4';
 /** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
 const PROBE_PASSWORD = 'login_security_wrong_password';
 export const describe_login_security_cross_tests = (options) => {
@@ -93,6 +101,20 @@ export const describe_login_security_cross_tests = (options) => {
             retry_after_header: res.headers.get('retry-after')
         };
     };
+    /**
+     * POST a login expected to *succeed*, on a fresh transport with the given
+     * `X-Forwarded-For`. The mirror of `attempt` — used to prove that a success
+     * does not refund the resolved IP's bucket.
+     */
+    const succeed = async (fixture, forwarded_for, username, password) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password })
+        });
+        await res.text();
+        return res.status;
+    };
     describe('login rate limiting + trusted-proxy parity', () => {
         test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
             const fixture = await setup_test();
@@ -126,5 +148,42 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('a success does not refund the per-IP budget (distributed-spray backstop)', async () => {
+            const fixture = await setup_test();
+            // The attacker's own account. Minting rides the setup path from
+            // loopback with no XFF, so it lands on a different bucket than
+            // XFF_SPRAY and can't confound the count.
+            const attacker = await fixture.create_account({
+                username: 'spray_attacker',
+                password_value: 'spray_attacker_password'
+            });
+            let budget = 0;
+            let limited = false;
+            for (let i = 0; i < ip_limit * 3; i++) {
+                // Their own successful login — the move that used to zero the
+                // whole IP window — then one guess against a fresh victim
+                // username, so no per-account bucket accumulates and only the
+                // IP aggregate can stop this.
+                const own = await succeed(fixture, XFF_SPRAY, attacker.account.username, 'spray_attacker_password');
+                budget++;
+                // Either leg may trip: the aggregate governs the *address*, so
+                // once it fills even the attacker's own login is refused. That
+                // is the property — no move from this IP buys more attempts.
+                if (own === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(own, 200, "the attacker's own login must succeed");
+                const guess = await attempt(fixture, XFF_SPRAY, `spray_victim_${i}`);
+                budget++;
+                if (guess.status === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(guess.status, 401, 'a guess against an unknown user must 401');
+            }
+            assert(limited, 'the per-IP aggregate must eventually 429 the spray');
+            assert(budget <= ip_limit * 2 + 2, `interleaved successes must not extend the per-IP budget (spent ${budget})`);
+        });
     });
 };

package/dist/testing/cross_backend/session_cap.d.ts

@@ -0,0 +1,19 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session-cap parity suite. */
+export interface SessionCapCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /**
+     * The cap both spines enforce. Defaults to `DEFAULT_MAX_SESSIONS` — the TS
+     * route default and the Rust `const`. A consumer that overrides
+     * `max_sessions` on the TS side passes its value here.
+     */
+    readonly max_sessions?: number;
+    /** REST login route path. Default `/api/account/login`. */
+    readonly login_path?: string;
+    /** REST account-status route path. Default `/api/account/status`. */
+    readonly status_path?: string;
+}
+export declare const describe_session_cap_cross_tests: (options: SessionCapCrossTestOptions) => void;
+//# sourceMappingURL=session_cap.d.ts.map

package/dist/testing/cross_backend/session_cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA6DtF,CAAC"}

package/dist/testing/cross_backend/session_cap.js

@@ -0,0 +1,93 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **per-account concurrent-session cap**
+ * over real HTTP.
+ *
+ * The cap is a shipped control on the TS spine (`query_session_enforce_limit`,
+ * `DEFAULT_MAX_SESSIONS`) that the Rust spine went without — its session INSERT
+ * carried no eviction, so every Rust-backed deployment served unlimited
+ * concurrent sessions per account. That divergence survived because nothing crossed the
+ * wire on it — the TS half is pinned by in-process tests
+ * (`session_middleware.lifecycle.db.test.ts`, `session_token_limits.integration.db.test.ts`)
+ * whose Rust counterparts simply didn't exist to fail. This suite is the pin
+ * that runs on *both*, so the next spine to lose the cap fails here rather than
+ * in production. Two properties:
+ *
+ * - **the cap bounds concurrent sessions, by eviction not refusal** — logging in
+ *   `max_sessions + 1` times succeeds every time (a login is never denied for
+ *   being the one over the line), and the newest cookie resolves afterward.
+ * - **the evicted session is the oldest** — the first login's cookie no longer
+ *   authenticates once the cap is exceeded. A spine with no cap authenticates it
+ *   fine, which is exactly the defect this catches.
+ *
+ * **Why `max_sessions + 1` logins and not `max_sessions`.** The starting session
+ * count isn't zero and isn't guaranteed equal across impls — `create_account`
+ * seeds its own session on the Rust cradle. Overshooting by one guarantees at
+ * least one eviction whatever the baseline is, and the *oldest* login is the
+ * first to go either way. Asserting on the first and last sessions rather than
+ * on a row count keeps the case wire-observable (no DB channel) and
+ * baseline-independent.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`, `GET /api/account/status`)
+ * on every spine, so this is an imperative suite (not a `conformance_table` row)
+ * — the sibling of `cookie_attributes.ts` / `origin.ts` / `login_security.ts`.
+ * **Cross-process only**, and load-bearingly so: each login is held on its own
+ * `fresh_transport` and identified by that transport's cookie jar, which
+ * in-process is a jar-less passthrough. That also keeps the suite free of a
+ * fourth `Set-Cookie` parser — reading the raw header is `cookie_attributes.ts`'s
+ * job, and this case only needs "does this login still authenticate".
+ *
+ * What it does **not** pin: concurrent creators. Two simultaneous logins can
+ * each evict against a stale count under Read Committed and both commit above
+ * the cap — see `query_session_enforce_limit`'s race note. That needs a
+ * barrier-based test against one backend, not a parity case.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { DEFAULT_MAX_SESSIONS } from '../../auth/account_route_schema.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+export const describe_session_cap_cross_tests = (options) => {
+    const { setup_test } = options;
+    const max_sessions = options.max_sessions ?? DEFAULT_MAX_SESSIONS;
+    const login_path = options.login_path ?? '/api/account/login';
+    const status_path = options.status_path ?? '/api/account/status';
+    // Fresh-keeper-per-test wipes the DB between tests, so a literal username
+    // never collides (see `setup.ts`).
+    const username = 'session_cap_user';
+    describe('per-account session cap parity', () => {
+        test(`logging in ${max_sessions + 1} times evicts the oldest session (newest cookie resolves, first does not)`, async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // One transport per login, each with its own empty jar, so each ends up
+            // holding exactly that login's session cookie and re-sends it on any
+            // later request. That's why this suite is cross-process only: in-process
+            // `fresh_transport` is a jar-less passthrough and every session would
+            // look alike. Held oldest-first.
+            const sessions = [];
+            for (let i = 0; i < max_sessions + 1; i++) {
+                const transport = fixture.fresh_transport();
+                const res = await transport(login_path, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
+                });
+                assert.strictEqual(res.status, 200, `login ${i + 1}/${max_sessions + 1} must succeed — the cap evicts, it never refuses`);
+                assert.ok(transport.cookies().length > 0, `login ${i + 1} must set a session cookie on its jar`);
+                sessions.push(transport);
+            }
+            /** `GET /status` on one login's transport: 200 authenticated, 401 not. */
+            const status_on = async (transport) => {
+                const res = await transport(status_path, { method: 'GET' });
+                await res.text();
+                return res.status;
+            };
+            assert.strictEqual(await status_on(sessions[sessions.length - 1]), 200, 'the newest session must still resolve — the cap must evict, not refuse');
+            assert.strictEqual(await status_on(sessions[0]), 401, `the oldest session must be evicted once the account exceeds ${max_sessions} sessions ` +
+                '(a spine with no cap authenticates this cookie)');
+        });
+    });
+};

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}