@fuzdev/fuz_app 0.110.1 → 0.112.0

package/dist/testing/db.d.ts

@@ -15,27 +15,64 @@ export interface DbFactory {
     skip_reason?: string;
 }
 /**
- * Reset a PGlite database to a clean state by dropping and recreating the public schema.
+ * Reset a test database to a clean state by dropping and recreating the public schema.
  *
  * Removes all tables, sequences, indexes, types, and functions.
- * The database instance remains usable after reset.
+ * The database instance remains usable after reset. Despite the name it issues
+ * plain SQL, so it also resets the other drivers the test factories hand out.
  *
  * @mutates db - drops the `public` schema and recreates it; all rows in all
  *   tables are gone after this returns.
  */
 export declare const reset_pglite: (db: Db) => Promise<void>;
+/**
+ * Builds a `DbFactory` from a schema initializer — `create_pglite_factory`'s own shape.
+ */
+export type DbFactoryBuilder = (init_schema: (db: Db) => Promise<void>) => DbFactory;
+/**
+ * Options for `create_pglite_factory`.
+ */
+export interface CreatePgliteFactoryOptions {
+    /**
+     * Whether an installed substitute (`set_substitute_db_factory`) may stand in
+     * for the PGlite factory at this call site. Defaults to `true`; pass `false`
+     * where PGlite itself is the subject under test.
+     */
+    substitutable?: boolean;
+}
+/**
+ * Install a builder that stands in for `create_pglite_factory`, so suites
+ * written against PGlite can run against another driver without being edited.
+ *
+ * Injected rather than selected here: the drivers a substitute wraps live in
+ * test-side code this shipped module cannot import. A call site that passes
+ * `{substitutable: false}` keeps PGlite regardless. Pass `null` to uninstall.
+ *
+ * The slot is read when a factory is built, not when it creates a database,
+ * so install before the first `create_pglite_factory` call — a vitest
+ * `setupFiles` entry, which runs ahead of every test file's imports, is the
+ * shape fuz_app's own `db` project uses. A factory built earlier (including
+ * the module-level fallback in `testing/app_server.ts`) keeps the driver it
+ * was built with, and uninstalling does not revert it.
+ *
+ * @param create_factory - the builder to install, or `null` to remove the installed one
+ */
+export declare const set_substitute_db_factory: (create_factory: DbFactoryBuilder | null) => void;
 /**
  * Create a pglite (in-memory) database factory for tests.
  *
  * Always enabled — no external dependencies required.
- * Shares a single PGlite WASM instance across all factories in the same
- * vitest worker thread (one test file). Subsequent `create()` calls reset
- * the schema via `DROP SCHEMA public CASCADE` instead of paying the WASM
- * cold-start cost again.
+ * Shares a single PGlite WASM instance across the PGlite factories this module builds.
+ * Subsequent `create()` calls reset the schema via `DROP SCHEMA public CASCADE`
+ * instead of paying the WASM cold-start cost again.
+ *
+ * Returns the installed substitute's factory instead when one is installed and
+ * `options.substitutable` is not `false` — see `set_substitute_db_factory`.
  *
  * @param init_schema - callback to initialize the database schema
+ * @param options - `substitutable: false` pins this call site to PGlite
  */
-export declare const create_pglite_factory: (init_schema: (db: Db) => Promise<void>) => DbFactory;
+export declare const create_pglite_factory: (init_schema: (db: Db) => Promise<void>, options?: CreatePgliteFactoryOptions) => DbFactory;
 /**
  * Create a pg (PostgreSQL) database factory for tests.
  *
@@ -103,4 +140,22 @@ export declare const create_describe_db: (factories: DbFactory | Array<DbFactory
  * Log factory status to console.
  */
 export declare const log_db_factory_status: (factories: Array<DbFactory>) => void;
+/**
+ * Assert a `*_COLUMNS` projection const names exactly the live columns of
+ * `table` — the drift guard for an exported const (`ACCOUNT_COLUMNS`,
+ * `CELL_COLUMNS`, a consumer's own).
+ *
+ * This is the reverse of the fail-loud read: a named projection makes a
+ * *dropped* column fail loud at query time, but a column *added* to the table
+ * and not to the projection would silently vanish from every row read. Both
+ * directions are covered by the equality here. It guards one const; it can't
+ * see a table that has *no* const — for that, keep a table → const registry
+ * and assert its key set against `query_public_columns` (fuz_app's own is
+ * `src/test/db/column_projections.db.test.ts`).
+ *
+ * @param db - a bootstrapped test database
+ * @param table - the `public`-schema table the const projects
+ * @param columns - the projection const's column names
+ */
+export declare const assert_columns_match_live: (db: Db, table: string, columns: ReadonlyArray<string>) => Promise<void>;
 //# sourceMappingURL=db.d.ts.map

package/dist/testing/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKtC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SAgEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAQnE,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAMtC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAQF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAErF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,GAAI,gBAAgB,gBAAgB,GAAG,IAAI,KAAG,IAEnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,UAAU,0BAA0B,KAClC,SAyBF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SAgEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAQnE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,GACrC,IAAI,EAAE,EACN,OAAO,MAAM,EACb,SAAS,aAAa,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,IAAI,CAId,CAAC"}

package/dist/testing/db.js

@@ -22,20 +22,22 @@ import './assert_dev_env.js';
  *
  * @module
  */
-import { describe, beforeAll, beforeEach, afterAll } from 'vitest';
+import { describe, beforeAll, beforeEach, afterAll, assert } from 'vitest';
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_pglite_db } from '../db/db_pglite.js';
 import { assert_valid_sql_identifier } from '../db/sql_identifier.js';
 import { create_pg_db, register_pg_type_parsers } from '../db/db_pg.js';
+import { query_public_columns } from '../db/schema_ready.js';
 /**
  * CI detection — `CI=true` is set automatically by GitHub Actions, GitLab CI, etc.
  */
 export const IS_CI = process.env.CI === 'true';
 /**
- * Reset a PGlite database to a clean state by dropping and recreating the public schema.
+ * Reset a test database to a clean state by dropping and recreating the public schema.
  *
  * Removes all tables, sequences, indexes, types, and functions.
- * The database instance remains usable after reset.
+ * The database instance remains usable after reset. Despite the name it issues
+ * plain SQL, so it also resets the other drivers the test factories hand out.
  *
  * @mutates db - drops the `public` schema and recreates it; all rows in all
  *   tables are gone after this returns.
@@ -44,40 +46,74 @@ export const reset_pglite = async (db) => {
     await db.query('DROP SCHEMA public CASCADE');
     await db.query('CREATE SCHEMA public');
 };
-// Module-level PGlite cache — shared across all factories in the same vitest worker (one test file).
-// Each vitest file runs in its own worker thread, so no cross-file contamination.
+// Module-level PGlite cache — one instance shared by the PGlite factories this
+// module builds, for as long as the module is loaded. Under the `db` project's
+// `isolate: false` + `fileParallelism: false` that is the whole run; a project
+// that isolates its files gets one per worker instead.
 let module_db = null;
+// The installed stand-in for `create_pglite_factory`, `null` when none is installed.
+let substitute_db_factory = null;
+/**
+ * Install a builder that stands in for `create_pglite_factory`, so suites
+ * written against PGlite can run against another driver without being edited.
+ *
+ * Injected rather than selected here: the drivers a substitute wraps live in
+ * test-side code this shipped module cannot import. A call site that passes
+ * `{substitutable: false}` keeps PGlite regardless. Pass `null` to uninstall.
+ *
+ * The slot is read when a factory is built, not when it creates a database,
+ * so install before the first `create_pglite_factory` call — a vitest
+ * `setupFiles` entry, which runs ahead of every test file's imports, is the
+ * shape fuz_app's own `db` project uses. A factory built earlier (including
+ * the module-level fallback in `testing/app_server.ts`) keeps the driver it
+ * was built with, and uninstalling does not revert it.
+ *
+ * @param create_factory - the builder to install, or `null` to remove the installed one
+ */
+export const set_substitute_db_factory = (create_factory) => {
+    substitute_db_factory = create_factory;
+};
 /**
  * Create a pglite (in-memory) database factory for tests.
  *
  * Always enabled — no external dependencies required.
- * Shares a single PGlite WASM instance across all factories in the same
- * vitest worker thread (one test file). Subsequent `create()` calls reset
- * the schema via `DROP SCHEMA public CASCADE` instead of paying the WASM
- * cold-start cost again.
+ * Shares a single PGlite WASM instance across the PGlite factories this module builds.
+ * Subsequent `create()` calls reset the schema via `DROP SCHEMA public CASCADE`
+ * instead of paying the WASM cold-start cost again.
+ *
+ * Returns the installed substitute's factory instead when one is installed and
+ * `options.substitutable` is not `false` — see `set_substitute_db_factory`.
  *
  * @param init_schema - callback to initialize the database schema
+ * @param options - `substitutable: false` pins this call site to PGlite
  */
-export const create_pglite_factory = (init_schema) => ({
-    name: 'pglite',
-    skip: false,
-    async create() {
-        if (module_db) {
-            await reset_pglite(module_db);
-        }
-        else {
-            const { PGlite } = await import('@electric-sql/pglite');
-            const pglite = new PGlite();
-            module_db = create_pglite_db(pglite).db;
-        }
-        await init_schema(module_db);
-        return module_db;
-    },
-    async close() {
-        // No-op: shared instance lives for the worker thread's lifetime.
-        // PGlite is cleaned up when the vitest worker exits.
+export const create_pglite_factory = (init_schema, options) => {
+    if (substitute_db_factory && options?.substitutable !== false) {
+        return substitute_db_factory(init_schema);
     }
-});
+    return {
+        name: 'pglite',
+        skip: false,
+        async create() {
+            if (module_db) {
+                await reset_pglite(module_db);
+            }
+            else {
+                const { PGlite } = await import('@electric-sql/pglite');
+                const pglite = new PGlite();
+                module_db = create_pglite_db(pglite).db;
+            }
+            await init_schema(module_db);
+            return module_db;
+        },
+        async close() {
+            // No-op: the instance is the module-level cache above, so it lives as long
+            // as this module stays loaded — under the `db` project's `isolate: false` +
+            // `fileParallelism: false` that is the whole run. Nothing frees the PGlite
+            // instance earlier.
+        }
+    };
+};
 /**
  * Create a pg (PostgreSQL) database factory for tests.
  *
@@ -246,3 +282,25 @@ export const log_db_factory_status = (factories) => {
     const skipped = factories.filter((f) => f.skip).map((f) => `${f.name} (${f.skip_reason})`);
     console.log(`[db tests] drivers: ${enabled.join(', ')}${skipped.length ? ` | skipped: ${skipped.join(', ')}` : ''}`);
 };
+/**
+ * Assert a `*_COLUMNS` projection const names exactly the live columns of
+ * `table` — the drift guard for an exported const (`ACCOUNT_COLUMNS`,
+ * `CELL_COLUMNS`, a consumer's own).
+ *
+ * This is the reverse of the fail-loud read: a named projection makes a
+ * *dropped* column fail loud at query time, but a column *added* to the table
+ * and not to the projection would silently vanish from every row read. Both
+ * directions are covered by the equality here. It guards one const; it can't
+ * see a table that has *no* const — for that, keep a table → const registry
+ * and assert its key set against `query_public_columns` (fuz_app's own is
+ * `src/test/db/column_projections.db.test.ts`).
+ *
+ * @param db - a bootstrapped test database
+ * @param table - the `public`-schema table the const projects
+ * @param columns - the projection const's column names
+ */
+export const assert_columns_match_live = async (db, table, columns) => {
+    const live = await query_public_columns(db, { table });
+    assert.ok(live[table], `table "${table}" is not in the live public schema`);
+    assert.deepEqual([...columns].sort(), live[table]);
+};

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA07CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAs8CF,CAAC"}

package/dist/testing/integration.js

@@ -25,6 +25,7 @@ import { account_verify_action_spec, account_session_list_action_spec, account_s
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 import { LoginOutput, AccountStatusOutput } from '../auth/account_route_schema.js';
 import { test_if } from './cross_backend/capabilities.js';
+import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './cross_backend/wire_shapes.js';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 /**
  * Standard integration test suite for fuz_app auth routes.
@@ -343,6 +344,13 @@ export const describe_standard_integration_tests = (options) => {
                 // Single-actor keeper: actor resolved, role_grants populated.
                 assert.ok(parsed.actor, 'single-actor keeper must resolve a non-null actor');
                 assert.ok(parsed.role_grants.length > 0, 'single-actor keeper must have populated role_grants');
+                // Byte-shape gate: `z.string()` accepts a millisecond stamp too,
+                // so the schema parse above can't tell the two spines apart.
+                assert_iso8601_seconds(parsed.account.created_at, 'account.created_at');
+                for (const grant of parsed.role_grants) {
+                    assert_iso8601_seconds(grant.created_at, 'role_grant.created_at');
+                    assert_iso8601_seconds_nullable(grant.expires_at, 'role_grant.expires_at');
+                }
             });
         });
         // --- 2. Cookie attributes ---
@@ -419,7 +427,12 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
                 assert.ok(list_res.result.sessions.length >= 1);
-                const session_id = list_res.result.sessions[0].id;
+                const session = list_res.result.sessions[0];
+                // Byte-shape gate on the session timestamps — see the account-status
+                // case for why the output schema alone can't catch the divergence.
+                assert_iso8601_seconds(session.created_at, 'session.created_at');
+                assert_iso8601_seconds(session.expires_at, 'session.expires_at');
+                const session_id = session.id;
                 // Revoke that session by ID
                 const revoke_res = await rpc_call_for_spec({
                     app: { request: fixture.transport },
@@ -691,7 +704,7 @@ export const describe_standard_integration_tests = (options) => {
                 // phase doesn't first demand an acting actor → `actor_required`)
                 // and input/param/query-free (params and query still validate ahead
                 // of the auth phase — only body validation moved behind the gates,
-                // per the 401 → authz → 403 → 400 order). Admin surfaces are
+                // per the 401 → authz → 403 → 429 → 400 order). Admin surfaces are
                 // RPC-first now; a consumer may expose no such REST route (fuz_app
                 // itself, zzz) — then this REST-era check is a no-op and RPC denial
                 // is covered by `describe_rpc_attack_surface_tests`.

package/dist/testing/round_trip.d.ts

@@ -1,5 +1,4 @@
 import './assert_dev_env.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest, TestFixture } from './cross_backend/setup.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
 /** Options for `describe_round_trip_validation`. */
@@ -16,8 +15,6 @@ export interface RoundTripTestOptions {
      * TS by the consumer; same shape for in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations — see `cross_backend/capabilities.ts`. */
-    capabilities: BackendCapabilities;
     /** Routes to skip, in `'METHOD /path'` format. */
     skip_routes?: Array<string>;
     /** Override generated bodies for specific routes (`'METHOD /path'` → body). */

package/dist/testing/round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA2B7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,mBAAmB,CAAC;IAClC,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IA6I9E,CAAC"}
+{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA2B7B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IAyI9E,CAAC"}

package/dist/testing/round_trip.js

@@ -36,10 +36,6 @@ import { resolve_valid_path, generate_valid_body } from './schema_generators.js'
 export const describe_round_trip_validation = (options) => {
     const describe_time_specs = options.surface_source.route_specs;
     const skip_set = new Set(options.skip_routes);
-    // `capabilities` is currently unused by this suite (no in-process-only
-    // reads, no transport-gated cases) but stays on the options for
-    // uniformity with the other Tier 1 suites.
-    void options.capabilities;
     describe('round-trip validation', () => {
         let fixture;
         let authed_account;

package/dist/testing/rpc_attack_surface.js

@@ -84,8 +84,8 @@ const describe_rpc_auth = (options) => {
                                     if (!app)
                                         throw new Error(`No test app for role '${wrong_role}'`);
                                     // Send valid params so the probe varies only the role. Dispatcher
-                                    // ordering is 401 → authz → 403 → 400, so the role gate trips
-                                    // ahead of validation regardless; valid params also keep the
+                                    // ordering is 401 → authz → 403 → 429 → 400, so the role gate
+                                    // trips ahead of validation regardless; valid params also keep the
                                     // authorization phase from answering `actor_required` first.
                                     const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
                                     const params = action ? generate_valid_body(action.spec.input) : undefined;

package/dist/testing/rpc_round_trip.d.ts

@@ -1,7 +1,6 @@
 import './assert_dev_env.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest, TestFixture } from './cross_backend/setup.js';
 import type { SessionOptions } from '../auth/session_cookie.js';
 /** Options for `describe_rpc_round_trip_tests`. */
@@ -14,8 +13,6 @@ export interface RpcRoundTripTestOptions {
      * in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /**
      * Session config — only needed to resolve factory-form `rpc_endpoints`
      * against a stub `AppServerContext` at setup time (the actions' input

package/dist/testing/rpc_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAyB7B,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IAgKhF,CAAC"}
+{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAyB7B,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA+JhF,CAAC"}

package/dist/testing/rpc_round_trip.js

@@ -88,7 +88,6 @@ export const describe_rpc_round_trip_tests = (options) => {
     // match what the running backend serves.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const surface_rpc_endpoints = options.surface_source.surface.rpc_endpoints;
-    void options.capabilities;
     describe('RPC round-trip validation', () => {
         let fixture;
         let authed_account;

package/dist/testing/schema_generators.d.ts

@@ -20,6 +20,21 @@ export declare const generate_valid_value: (field: ZodFieldInfo, field_schema: z
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.
+ *
+ * Without a params schema (or for a param the schema doesn't name) each
+ * `:name` becomes `test_<name>` — fine for an unconstrained segment. With
+ * one, `test_<name>` is still preferred wherever the field schema accepts
+ * it, because the param name in the URL is what makes a failure message
+ * readable. Only a segment that refuses it falls through: a `uuid` param
+ * takes the nil UUID (the fast path — by far the most common shape), and
+ * anything else is synthesized by `generate_valid_string`, so a
+ * format-constrained segment (a `blake3:…` fact hash, a `tok_…` id)
+ * resolves to a value its schema accepts instead of a `test_<name>` that
+ * 400s before the route's real gates run.
+ *
+ * The synthesized value is percent-encoded, and a value containing `/` is
+ * refused (it would silently add a path segment and route elsewhere) —
+ * both fall back to `test_<name>`.
  */
 export declare const resolve_valid_path: (path: string, params_schema?: z.ZodObject) => string;
 /**

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAsGF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}

package/dist/testing/schema_generators.js

@@ -41,19 +41,32 @@ export const detect_format = (field_schema) => {
     return null;
 };
 /**
- * Extract a candidate value from a JSON Schema `pattern` when the shape is
- * a fixed-length hex character class — covers blake3 (64-char lowercase hex),
- * sha256, md5, and similar digest refinements. Returns `null` when the
- * pattern doesn't match the expected shape.
+ * Extract a candidate value from a JSON Schema `pattern` when the shape is a
+ * fixed-length hex character class, optionally behind a literal prefix —
+ * covers bare digests (blake3 64-char lowercase hex, sha256, md5) and the
+ * algorithm-tagged form the fact store addresses bytes by
+ * (`^blake3:[0-9a-f]{64}$` → `blake3:` + 64 zeros).
+ *
+ * Coverage today:
+ * - Optional prefix: alphanumeric, starting with a letter, ending in `:`
+ *   (`blake3:`, `sha256:`). A `_`-joined prefix over a base64url class is
+ *   the sibling shape — see `generate_prefix_slug_pattern_value`.
+ * - Character class must be exactly `[0-9a-f]` or `[0-9a-fA-F]` (Zod passes
+ *   the regex source through verbatim — no character-class reordering).
+ * - Fixed-length quantifier `{N}`.
+ *
+ * Returns `null` when the pattern doesn't match the expected shape; the
+ * caller then falls through to its other candidates.
  */
 const generate_hex_pattern_value = (pattern) => {
-    const match = /^\^\[0-9a-f(?:A-F)?\]\{(\d+)\}\$$/.exec(pattern);
+    const match = /^\^(?:([A-Za-z][A-Za-z0-9]*):)?\[0-9a-f(?:A-F)?\]\{(\d+)\}\$$/.exec(pattern);
     if (!match)
         return null;
-    const n = Number(match[1]);
+    const n = Number(match[2]);
     if (!Number.isInteger(n) || n <= 0)
         return null;
-    return '0'.repeat(n);
+    const prefix = match[1] === undefined ? '' : `${match[1]}:`;
+    return prefix + '0'.repeat(n);
 };
 /**
  * Extract a candidate value from a JSON Schema `pattern` when the shape is a
@@ -78,8 +91,8 @@ const generate_hex_pattern_value = (pattern) => {
  *   doesn't match the detection regex. `x`-fill would still satisfy the
  *   refinement if the detection were widened.
  * - No-prefix fixed-length slugs (e.g. `^[A-Za-z0-9_-]{43}$` — daemon
- *   token shape) are not matched here; see `generate_hex_pattern_value`
- *   for the hex variant.
+ *   token shape) are not matched here; `generate_hex_pattern_value` is the
+ *   hex sibling, and it covers both the bare and the `prefix:`-tagged form.
  * Widen the detection regex when a new branded shape surfaces.
  */
 const generate_prefix_slug_pattern_value = (pattern) => {
@@ -254,22 +267,43 @@ export const generate_valid_value = (field, field_schema) => {
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.
+ *
+ * Without a params schema (or for a param the schema doesn't name) each
+ * `:name` becomes `test_<name>` — fine for an unconstrained segment. With
+ * one, `test_<name>` is still preferred wherever the field schema accepts
+ * it, because the param name in the URL is what makes a failure message
+ * readable. Only a segment that refuses it falls through: a `uuid` param
+ * takes the nil UUID (the fast path — by far the most common shape), and
+ * anything else is synthesized by `generate_valid_string`, so a
+ * format-constrained segment (a `blake3:…` fact hash, a `tok_…` id)
+ * resolves to a value its schema accepts instead of a `test_<name>` that
+ * 400s before the route's real gates run.
+ *
+ * The synthesized value is percent-encoded, and a value containing `/` is
+ * refused (it would silently add a path segment and route elsewhere) —
+ * both fall back to `test_<name>`.
  */
 export const resolve_valid_path = (path, params_schema) => {
     if (!params_schema) {
         return path.replace(/:(\w+)/g, 'test_$1');
     }
     return path.replace(/:(\w+)/g, (_match, name) => {
+        const fallback = `test_${name}`;
         const field_schema = params_schema.shape[name];
         if (!field_schema)
-            return `test_${name}`;
+            return fallback;
+        if (field_schema.safeParse(fallback).success)
+            return fallback;
         const base_type = zod_get_base_type(field_schema);
         if (base_type === 'uuid')
             return '00000000-0000-0000-0000-000000000000';
         const format = detect_format(field_schema);
         if (format === 'uuid')
             return '00000000-0000-0000-0000-000000000000';
-        return `test_${name}`;
+        const generated = generate_valid_string(field_schema);
+        if (generated.includes('/'))
+            return fallback;
+        return encodeURIComponent(generated);
     });
 };
 /**

package/dist/testing/standard.d.ts

@@ -37,7 +37,11 @@ export interface StandardTestOptions {
      * in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
+    /**
+     * Backend capability declarations. Forwarded to the one bundled suite
+     * that gates on them (`describe_standard_integration_tests`); the other
+     * suites in the bundle read no flags and take no capability field.
+     */
     capabilities: BackendCapabilities;
     /** Session config — needed for cookie_name + factory-form rpc_endpoints resolution. */
     session_options: SessionOptions<string>;

package/dist/testing/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IA2DtE,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IAsDtE,CAAC"}

package/dist/testing/standard.js

@@ -24,20 +24,17 @@ export const describe_standard_tests = (options) => {
     });
     describe_round_trip_validation({
         setup_test: options.setup_test,
-        surface_source: options.surface_source,
-        capabilities: options.capabilities
+        surface_source: options.surface_source
     });
     describe_rpc_round_trip_tests({
         setup_test: options.setup_test,
         surface_source: options.surface_source,
-        capabilities: options.capabilities,
         session_options: options.session_options,
         rpc_endpoints: options.rpc_endpoints
     });
     describe_data_exposure_tests({
         setup_test: options.setup_test,
-        surface_source: options.surface_source,
-        capabilities: options.capabilities
+        surface_source: options.surface_source
     });
     describe_rate_limiting_tests({
         session_options: options.session_options,
@@ -49,7 +46,6 @@ export const describe_standard_tests = (options) => {
         describe_standard_admin_integration_tests({
             setup_test: options.setup_test,
             surface_source: options.surface_source,
-            capabilities: options.capabilities,
             session_options: options.session_options,
             roles: options.roles,
             rpc_endpoints: options.rpc_endpoints,
@@ -58,7 +54,6 @@ export const describe_standard_tests = (options) => {
         describe_audit_completeness_tests({
             setup_test: options.setup_test,
             surface_source: options.surface_source,
-            capabilities: options.capabilities,
             session_options: options.session_options,
             rpc_endpoints: options.rpc_endpoints
         });

package/dist/timestamp.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The canonical wire timestamp shape shared by the two spine implementations.
+ *
+ * Every timestamp that reaches the wire is second-precision UTC —
+ * `YYYY-MM-DDTHH:MM:SSZ`, exactly 20 characters. Timestamps read from
+ * Postgres get that shape from the SQL projection
+ * (`iso8601_timestamp_column` in `db/sql_columns.ts`, twin of
+ * `fuz_db::iso8601_timestamp_column`); this module is the same shape for the
+ * stamps minted in TS rather than read back from a row, so the two sources
+ * agree and the two backends serialize the same instant to the same bytes.
+ *
+ * @module
+ */
+/**
+ * The canonical wire timestamp shape as a regex — second-precision UTC,
+ * exactly 20 characters.
+ *
+ * Lives in library code rather than a test helper so the unit suites, the db
+ * suites, and the cross-backend suites all pin the same pattern the server
+ * renders.
+ */
+export declare const ISO8601_SECONDS: RegExp;
+/**
+ * The width of one wire timestamp, in milliseconds.
+ *
+ * A wire stamp is truncated, not rounded, so the instant it names lies
+ * anywhere in `[stamp, stamp + ISO8601_SECOND_MS)`. A predicate that must
+ * not fire early against a stamp — "has this expiry passed?" — adds this to
+ * reach the end of the second the stamp stands for.
+ */
+export declare const ISO8601_SECOND_MS = 1000;
+/**
+ * Whether the second a wire timestamp names has not yet ended.
+ *
+ * The one in-memory expiry rule over a truncated stamp: `stamp` stands for
+ * `[stamp, stamp + ISO8601_SECOND_MS)`, so this admits until that whole
+ * second is over and can never report an expiry the server's raw-column
+ * `expires_at > NOW()` gate would still accept. A stamp that does not parse
+ * is never live.
+ *
+ * @param stamp - a second-precision wire timestamp
+ * @param now_ms - the current time in epoch milliseconds
+ * @returns `true` while `now_ms` lies before the end of `stamp`'s second
+ */
+export declare const is_iso8601_seconds_live: (stamp: string, now_ms: number) => boolean;
+/**
+ * Render a `Date` as the canonical second-precision UTC wire timestamp
+ * (`YYYY-MM-DDTHH:MM:SSZ`).
+ *
+ * Truncates rather than rounds, mirroring Postgres'
+ * `to_char(…, 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` and the Rust spine's
+ * `fuz_sys::rfc3339_now`.
+ *
+ * @param date - the instant to render
+ * @returns the 20-character UTC timestamp
+ */
+export declare const to_iso8601_seconds: (date: Date) => string;
+//# sourceMappingURL=timestamp.d.ts.map