@fuzdev/fuz_app 0.111.0 → 0.112.0

package/dist/testing/attack_surface.d.ts

@@ -7,6 +7,14 @@ export interface AdversarialTestOptions {
     build: () => AppSurfaceSpec;
     /** All roles in the app (e.g. `['admin', 'keeper']`). */
     roles: Array<string>;
+    /**
+     * Routes to skip, in `'METHOD /path'` form (the surface key) — the escape
+     * hatch every sibling suite carries. Reach for it only when a route
+     * cannot be driven generically at all (a handler needing real seeded
+     * state, a path segment no schema can describe); a route whose params
+     * merely have a format is handled by the synthesizer.
+     */
+    skip_routes?: Array<string>;
 }
 /**
  * Generate adversarial HTTP auth enforcement test suites.
@@ -63,6 +71,14 @@ export interface StandardAttackSurfaceOptions {
      * to skip the assertion and keep the audit log informational-only.
      */
     error_schema_tightness?: ErrorSchemaTightnessOptions | null;
+    /**
+     * Routes the three adversarial sub-suites skip, in `'METHOD /path'` form
+     * — the escape hatch every sibling suite carries (`round_trip`,
+     * `data_exposure`). Reach for it only when a route cannot be driven
+     * generically at all; a route whose path params merely carry a format is
+     * handled by the params-schema-aware synthesizer.
+     */
+    skip_routes?: Array<string>;
 }
 /**
  * Run the standard attack surface test suite.

package/dist/testing/attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAoBjC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsCpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IA8H3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,gHAAgH;IAChH,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC5D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA2EF,CAAC"}
+{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAqBjC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAoDpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IAsI3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,gHAAgH;IAChH,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA4EF,CAAC"}

package/dist/testing/attack_surface.js

@@ -18,7 +18,8 @@ import { test, assert, describe } from 'vitest';
 import { assert_surface_invariants, assert_rpc_ws_surface_invariants, assert_surface_security_policy, audit_error_schema_tightness, assert_error_schema_tightness, default_error_schema_tightness, fuz_app_stock_route_tightness_allowlist } from './surface_invariants.js';
 import { describe_adversarial_input } from './adversarial_input.js';
 import { describe_adversarial_404 } from './adversarial_404.js';
-import { create_test_app_from_specs, create_test_request_context, create_auth_test_apps, select_auth_app, resolve_test_path } from './auth_apps.js';
+import { create_test_app_from_specs, create_test_request_context, create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
+import { resolve_valid_path } from './schema_generators.js';
 import { assert_surface_matches_snapshot, assert_surface_deterministic, assert_only_expected_public_routes, assert_full_middleware_stack, assert_error_schema_valid } from './assertions.js';
 import { merge_error_schemas } from '../http/schema_helpers.js';
 import { collect_middleware_errors } from '../http/surface.js';
@@ -45,6 +46,19 @@ const build_error_schema_lookup = (route_specs, middleware_specs) => {
     }
     return lookup;
 };
+/**
+ * Build a lookup from `"METHOD /path"` to the route's own `RouteSpec` — the
+ * companion of `build_error_schema_lookup`, so a generated request can reach
+ * the route's `params` schema and synthesize path segments the route will
+ * actually accept.
+ */
+const build_route_spec_lookup = (route_specs) => {
+    const lookup = new Map();
+    for (const spec of route_specs) {
+        lookup.set(`${spec.method} ${spec.path}`, spec);
+    }
+    return lookup;
+};
 /**
  * Generate adversarial HTTP auth enforcement test suites.
  *
@@ -57,19 +71,26 @@ const build_error_schema_lookup = (route_specs, middleware_specs) => {
 export const describe_adversarial_auth = (options) => {
     const { build, roles } = options;
     const { surface, route_specs, middleware_specs } = build();
-    const protected_routes = filter_protected_routes(surface);
+    const is_skipped = create_route_skip_filter(options.skip_routes);
+    const protected_routes = filter_protected_routes(surface).filter((r) => !is_skipped(r));
     if (protected_routes.length === 0)
         return;
-    const role_routes = filter_role_routes(surface);
-    const keeper_routes = filter_keeper_routes(surface);
+    const role_routes = filter_role_routes(surface).filter((r) => !is_skipped(r));
+    const keeper_routes = filter_keeper_routes(surface).filter((r) => !is_skipped(r));
     // merged error schemas (auto-derived + middleware + handler-specific) for response validation
     const error_schema_lookup = build_error_schema_lookup(route_specs, middleware_specs);
+    // The route's own spec, so a path param with a declared format (a
+    // `blake3:…` fact hash, a `tok_…` id) is synthesized into a value params
+    // validation accepts. Otherwise the generated request 400s on the path
+    // before ever reaching the 401 / 403 gate the case is asserting.
+    const spec_lookup = build_route_spec_lookup(route_specs);
+    const test_path = (route) => resolve_valid_path(route.path, spec_lookup.get(`${route.method} ${route.path}`)?.params);
     const apps = create_auth_test_apps(route_specs, roles);
     describe('adversarial HTTP auth enforcement', () => {
         describe('unauthenticated → 401', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await apps.public.request(resolve_test_path(route.path), {
+                    const res = await apps.public.request(test_path(route), {
                         method: route.method
                     });
                     assert.strictEqual(res.status, 401, `${route.method} ${route.path}`);
@@ -93,7 +114,7 @@ export const describe_adversarial_auth = (options) => {
                             const app = apps.by_role.get(wrong_role);
                             if (!app)
                                 throw new Error(`No test app for role '${wrong_role}'`);
-                            const res = await app.request(resolve_test_path(route.path), {
+                            const res = await app.request(test_path(route), {
                                 method: route.method
                             });
                             assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
@@ -108,7 +129,7 @@ export const describe_adversarial_auth = (options) => {
             describe('authenticated without role → 403', () => {
                 for (const route of role_only_routes) {
                     test(`${route.method} ${route.path}`, async () => {
-                        const res = await apps.authed.request(resolve_test_path(route.path), {
+                        const res = await apps.authed.request(test_path(route), {
                             method: route.method
                         });
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
@@ -126,7 +147,7 @@ export const describe_adversarial_auth = (options) => {
                 const app_session_keeper = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'session');
                 for (const route of keeper_routes) {
                     test(`${route.method} ${route.path}`, async () => {
-                        const res = await app_session_keeper.request(resolve_test_path(route.path), {
+                        const res = await app_session_keeper.request(test_path(route), {
                             method: route.method
                         });
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
@@ -141,7 +162,9 @@ export const describe_adversarial_auth = (options) => {
         describe('correct auth passes guard', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await select_auth_app(apps, route.auth).request(resolve_test_path(route.path), { method: route.method });
+                    const res = await select_auth_app(apps, route.auth).request(test_path(route), {
+                        method: route.method
+                    });
                     // handler may error (500) or return 404 (stub deps) — that's fine, we only verify auth passed
                     assert.notStrictEqual(res.status, 401, 'should not be 401 (auth rejected)');
                     assert.notStrictEqual(res.status, 403, 'should not be 403 (role rejected)');
@@ -210,7 +233,7 @@ export const resolve_standard_error_schema_tightness = (consumer) => {
  * any project-specific assertions in additional `describe` blocks.
  */
 export const describe_standard_attack_surface_tests = (options) => {
-    const { build, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix = '/api/', security_policy } = options;
+    const { build, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix = '/api/', security_policy, skip_routes } = options;
     const error_schema_tightness = resolve_standard_error_schema_tightness(options.error_schema_tightness);
     const built = build();
     const { surface } = built;
@@ -254,7 +277,7 @@ export const describe_standard_attack_surface_tests = (options) => {
             }
         });
     });
-    describe_adversarial_auth({ build: () => built, roles });
-    describe_adversarial_input({ build: () => built, roles });
-    describe_adversarial_404({ build: () => built, roles });
+    describe_adversarial_auth({ build: () => built, roles, skip_routes });
+    describe_adversarial_input({ build: () => built, roles, skip_routes });
+    describe_adversarial_404({ build: () => built, roles, skip_routes });
 };

package/dist/testing/audit_completeness.d.ts

@@ -2,7 +2,6 @@ import './assert_dev_env.js';
 import type { SessionOptions } from '../auth/session_cookie.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest } from './cross_backend/setup.js';
 /**
  * Configuration for `describe_audit_completeness_tests`.
@@ -23,8 +22,6 @@ export interface AuditCompletenessTestOptions {
      * options uniformity.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /** Session config — needed for factory-form rpc_endpoints resolution. */
     session_options: SessionOptions<string>;
     /**

package/dist/testing/audit_completeness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAinBzF,CAAC"}
+{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAgnBzF,CAAC"}

package/dist/testing/audit_completeness.js

@@ -111,7 +111,6 @@ export const describe_audit_completeness_tests = (options) => {
     // confusing test failure when `rpc_endpoints` is missing.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
-    void options.capabilities;
     describe('audit_log_completeness', () => {
         // --- Account routes ---
         describe('account mutation audit events', () => {

package/dist/testing/auth_apps.d.ts

@@ -46,6 +46,13 @@ export declare const create_auth_test_apps: (route_specs: Array<RouteSpec>, role
  *   `create_auth_test_apps`.
  */
 export declare const select_auth_app: (apps: AuthTestApps, auth: RouteAuth) => Hono;
-/** Replace Hono route params (`:foo`) with dummy values for HTTP testing. */
-export declare const resolve_test_path: (path: string) => string;
+/**
+ * Build the skip predicate an adversarial suite applies from its
+ * `skip_routes` option — routes named in `'METHOD /path'` form, the surface
+ * key. `undefined` skips nothing.
+ */
+export declare const create_route_skip_filter: (skip_routes: Array<string> | undefined) => ((route: {
+    method: string;
+    path: string;
+}) => boolean);
 //# sourceMappingURL=auth_apps.d.ts.map

package/dist/testing/auth_apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_apps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/auth_apps.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAI5B;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,MAAM,KAAG,cAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACtC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,WAAW,cAAc,EACzB,kBAAkB,cAAc,KAC9B,IAuBF,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,KAClB,YAeF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,YAAY,EAAE,MAAM,SAAS,KAAG,IAarE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,MAA4C,CAAC"}
+{"version":3,"file":"auth_apps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/auth_apps.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAI5B;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,MAAM,KAAG,cAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACtC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,WAAW,cAAc,EACzB,kBAAkB,cAAc,KAC9B,IAuBF,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,KAClB,YAeF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,YAAY,EAAE,MAAM,SAAS,KAAG,IAarE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACpC,aAAa,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,KACpC,CAAC,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAGvD,CAAC"}

package/dist/testing/auth_apps.js

@@ -90,5 +90,12 @@ export const select_auth_app = (apps, auth) => {
     }
     return apps.authed;
 };
-/** Replace Hono route params (`:foo`) with dummy values for HTTP testing. */
-export const resolve_test_path = (path) => path.replace(/:(\w+)/g, 'test_$1');
+/**
+ * Build the skip predicate an adversarial suite applies from its
+ * `skip_routes` option — routes named in `'METHOD /path'` form, the surface
+ * key. `undefined` skips nothing.
+ */
+export const create_route_skip_filter = (skip_routes) => {
+    const skip_set = new Set(skip_routes);
+    return (route) => skip_set.has(`${route.method} ${route.path}`);
+};

package/dist/testing/cross_backend/account_lifecycle.d.ts

@@ -1,10 +1,11 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /**
  * Options for the account-lifecycle parity suite. The standard
- * RPC-dispatched cross-suite shape (`setup_test` / `capabilities` /
- * `rpc_path`); aliases `RpcPathCrossSuiteOptions` rather than duplicating.
+ * capability-gating RPC-dispatched cross-suite shape (`setup_test` /
+ * `capabilities` / `rpc_path`); aliases
+ * `RpcPathCapabilityGatedCrossSuiteOptions` rather than duplicating.
  */
-export type AccountLifecycleCrossTestOptions = RpcPathCrossSuiteOptions;
+export type AccountLifecycleCrossTestOptions = RpcPathCapabilityGatedCrossSuiteOptions;
 export declare const describe_account_lifecycle_cross_tests: (options: AccountLifecycleCrossTestOptions) => void;
 //# sourceMappingURL=account_lifecycle.d.ts.map

package/dist/testing/cross_backend/account_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AAExE,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IA+TF,CAAC"}
+{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAqUF,CAAC"}

package/dist/testing/cross_backend/account_lifecycle.js

@@ -22,6 +22,7 @@ import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAc
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_account_lifecycle_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
@@ -99,6 +100,9 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const failure = listed.events.find((e) => e.outcome === 'failure' &&
                 e.metadata?.reason === ERROR_CANNOT_DELETE_KEEPER);
             assert.ok(failure, 'keeper-removal guard must emit an account_delete outcome=failure audit row with reason cannot_delete_keeper');
+            // Byte-shape gate on the audit row's timestamp — `z.string()` in
+            // `AuditLogEventWithUsernamesJson` accepts a millisecond stamp too.
+            assert_iso8601_seconds(failure.created_at, 'audit_log_list.created_at');
         });
         test_if(capabilities.account_lifecycle, 'deterministic: double-undelete → second call is not_found', async () => {
             const fixture = await setup_test();
@@ -139,6 +143,9 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const row = with_deleted.accounts.find((a) => a.account.id === victim.account.id);
             assert.ok(row, 'include_deleted surfaces the tombstoned row');
             assert.ok(row.account.deleted_at !== null, 'tombstoned row carries a non-null deleted_at on both spines');
+            assert_iso8601_seconds(row.account.created_at, 'admin_account_list.created_at');
+            assert_iso8601_seconds(row.account.updated_at, 'admin_account_list.updated_at');
+            assert_iso8601_seconds(row.account.deleted_at, 'admin_account_list.deleted_at');
         });
     });
 };

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -2,7 +2,7 @@ import '../assert_dev_env.js';
 /**
  * Cross-impl RPC **action-manifest** introspection — a normalized,
  * JSON-serializable dump of a backend's live RPC method set, one entry per
- * method carrying its auth shape + side-effect flag.
+ * method carrying its auth shape, side-effect flag, and rate-limit class.
  *
  * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
  * captures the live *database* shape for the schema-parity gate, this
@@ -35,13 +35,16 @@ import '../assert_dev_env.js';
  */
 import { z } from 'zod';
 import { type RouteAuth } from '../../http/auth_shape.js';
+import { RateLimitKey } from '../../http/error_schemas.js';
 import type { RequestResponseActionSpec } from '../../actions/action_spec.js';
 /**
  * One method's normalized RPC metadata — the cross-impl-comparable unit.
  * `roles` / `credential_types` are always present + sorted (an absent gate
  * and an empty list both serialize to `[]`) so the diff never trips on a
  * `undefined`-vs-`[]` or declaration-order difference between impls; the
- * auth axes reuse the canonical `AuthAxisState` enum.
+ * auth axes reuse the canonical `AuthAxisState` enum. `rate_limit` is
+ * nullable rather than optional for the same reason — an unthrottled action
+ * serializes an explicit `null`, so a missing key is drift, not a default.
  */
 export declare const ActionManifestEntry: z.ZodObject<{
     /** RPC method name (`spec.method`). */
@@ -64,6 +67,12 @@ export declare const ActionManifestEntry: z.ZodObject<{
     roles: z.ZodArray<z.ZodString>;
     /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
     credential_types: z.ZodArray<z.ZodString>;
+    /** Per-action rate-limit class, or `null` when the action declares none. */
+    rate_limit: z.ZodNullable<z.ZodEnum<{
+        account: "account";
+        ip: "ip";
+        both: "both";
+    }>>;
 }, z.core.$strict>;
 export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
 /** The full action manifest — every entry, sorted by `method`. */
@@ -89,6 +98,12 @@ export declare const ActionManifest: z.ZodObject<{
         roles: z.ZodArray<z.ZodString>;
         /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
         credential_types: z.ZodArray<z.ZodString>;
+        /** Per-action rate-limit class, or `null` when the action declares none. */
+        rate_limit: z.ZodNullable<z.ZodEnum<{
+            account: "account";
+            ip: "ip";
+            both: "both";
+        }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ActionManifest = z.infer<typeof ActionManifest>;
@@ -101,6 +116,7 @@ export declare const action_manifest_entry: (spec: {
     readonly method: string;
     readonly auth: RouteAuth;
     readonly side_effects: boolean;
+    readonly rate_limit?: RateLimitKey;
 }) => ActionManifestEntry;
 /**
  * Build the normalized `ActionManifest` from a list of request-response
@@ -109,5 +125,5 @@ export declare const action_manifest_entry: (spec: {
  * it passes (the TS spine passes its full mount; the Rust stub filters
  * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
  */
-export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects">>) => ActionManifest;
+export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects" | "rate_limit">>) => ActionManifest;
 //# sourceMappingURL=action_manifest.d.ts.map

package/dist/testing/cross_backend/action_manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;kBAEhF,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAhB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;;kBAQhF,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B,KAAG,mBAOF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,KACvF,cAED,CAAC"}
+{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;IAEjF,4EAA4E;;;;;;kBAE3E,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAlB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;QAEjF,4EAA4E;;;;;;;kBAQ3E,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;CACnC,KAAG,mBAQF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CACnB,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY,CAAC,CAClF,KACC,cAED,CAAC"}

package/dist/testing/cross_backend/action_manifest.js

@@ -2,7 +2,7 @@ import '../assert_dev_env.js';
 /**
  * Cross-impl RPC **action-manifest** introspection — a normalized,
  * JSON-serializable dump of a backend's live RPC method set, one entry per
- * method carrying its auth shape + side-effect flag.
+ * method carrying its auth shape, side-effect flag, and rate-limit class.
  *
  * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
  * captures the live *database* shape for the schema-parity gate, this
@@ -35,12 +35,15 @@ import '../assert_dev_env.js';
  */
 import { z } from 'zod';
 import { AuthAxisState } from '../../http/auth_shape.js';
+import { RateLimitKey } from '../../http/error_schemas.js';
 /**
  * One method's normalized RPC metadata — the cross-impl-comparable unit.
  * `roles` / `credential_types` are always present + sorted (an absent gate
  * and an empty list both serialize to `[]`) so the diff never trips on a
  * `undefined`-vs-`[]` or declaration-order difference between impls; the
- * auth axes reuse the canonical `AuthAxisState` enum.
+ * auth axes reuse the canonical `AuthAxisState` enum. `rate_limit` is
+ * nullable rather than optional for the same reason — an unthrottled action
+ * serializes an explicit `null`, so a missing key is drift, not a default.
  */
 export const ActionManifestEntry = z.strictObject({
     /** RPC method name (`spec.method`). */
@@ -54,7 +57,9 @@ export const ActionManifestEntry = z.strictObject({
     /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
     roles: z.array(z.string()),
     /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
-    credential_types: z.array(z.string())
+    credential_types: z.array(z.string()),
+    /** Per-action rate-limit class, or `null` when the action declares none. */
+    rate_limit: RateLimitKey.nullable()
 });
 /** The full action manifest — every entry, sorted by `method`. */
 export const ActionManifest = z.strictObject({
@@ -73,7 +78,8 @@ export const action_manifest_entry = (spec) => ({
     account: spec.auth.account,
     actor: spec.auth.actor,
     roles: sorted_strings(spec.auth.roles),
-    credential_types: sorted_strings(spec.auth.credential_types)
+    credential_types: sorted_strings(spec.auth.credential_types),
+    rate_limit: spec.rate_limit ?? null
 });
 /** Deterministic byte-lexicographic method order — matches the Rust `str::cmp` the stub sorts by. */
 const compare_method = (a, b) => a.method < b.method ? -1 : a.method > b.method ? 1 : 0;

package/dist/testing/cross_backend/action_manifest_parity.d.ts

@@ -7,8 +7,8 @@ import '../assert_dev_env.js';
  * fuz_app spine and the Rust `testing_spine_stub`) are each other's parity
  * reference. After both bootstrap, dump each one's live RPC method set, diff,
  * fail loudly on drift. The diff entries name the specific divergence (a
- * method only one impl mounts, a per-method auth-axis or side-effect
- * mismatch) so the error message points at the source.
+ * method only one impl mounts, a per-method auth-axis, side-effect, or
+ * rate-limit-class mismatch) so the error message points at the source.
  *
  * ```ts
  * const manifest_a = await capture_action_manifest(ts_handle);
@@ -17,13 +17,14 @@ import '../assert_dev_env.js';
  * ```
  *
  * Non-coverage: the manifest captures `{method, side_effects, account, actor,
- * roles, credential_types}` — the wire-relevant auth shape. It does **not**
+ * roles, credential_types, rate_limit}` — the wire-relevant auth shape. It does **not**
  * capture input/output schemas (the declared-surface wire shape is gated by
  * `rpc_round_trip`) nor the protocol actions `heartbeat` / `cancel` (excluded
  * by construction — see `action_manifest.ts`).
  *
  * @module
  */
+import type { RateLimitKey } from '../../http/error_schemas.js';
 import type { ActionManifest } from './action_manifest.js';
 /** Structured drift entry. `where` is the named source impl ('a' or 'b'). */
 export type ActionManifestDiff = {
@@ -35,6 +36,11 @@ export type ActionManifestDiff = {
     readonly method: string;
     readonly a: boolean;
     readonly b: boolean;
+} | {
+    readonly kind: 'rate_limit_differs';
+    readonly method: string;
+    readonly a: RateLimitKey | null;
+    readonly b: RateLimitKey | null;
 } | {
     readonly kind: 'auth_field_differs';
     readonly method: string;

package/dist/testing/cross_backend/action_manifest_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAWhF,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CA+B1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MA8BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAUF,CAAC"}
+{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAWhF,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CAC/B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CAkC1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MAqCF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAUF,CAAC"}

package/dist/testing/cross_backend/action_manifest_parity.js

@@ -30,6 +30,9 @@ export const diff_action_manifests = (a, b) => {
         if (ea.side_effects !== eb.side_effects) {
             diffs.push({ kind: 'side_effects_differ', method, a: ea.side_effects, b: eb.side_effects });
         }
+        if (ea.rate_limit !== eb.rate_limit) {
+            diffs.push({ kind: 'rate_limit_differs', method, a: ea.rate_limit, b: eb.rate_limit });
+        }
         for (const field of AUTH_SCALAR_FIELDS) {
             if (ea[field] !== eb[field]) {
                 diffs.push({ kind: 'auth_field_differs', method, field, a: ea[field], b: eb[field] });
@@ -62,6 +65,9 @@ export const format_action_manifest_diffs = (diffs, labels = {}) => {
             case 'side_effects_differ':
                 lines.push(`  ${d.method} side_effects differs: ${label_a}=${d.a}, ${label_b}=${d.b}`);
                 break;
+            case 'rate_limit_differs':
+                lines.push(`  ${d.method} rate_limit differs: ${label_a}=${JSON.stringify(d.a)}, ${label_b}=${JSON.stringify(d.b)}`);
+                break;
             case 'auth_field_differs':
                 lines.push(`  ${d.method} auth.${d.field} differs: ${label_a}=${JSON.stringify(d.a)}, ${label_b}=${JSON.stringify(d.b)}`);
                 break;

package/dist/testing/cross_backend/actor_lookup.d.ts

@@ -2,8 +2,9 @@ import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /**
  * Options for the actor-lookup parity suite. The standard RPC-dispatched
- * cross-suite shape (`setup_test` / `capabilities` / `rpc_path`); aliases
- * the shared `RpcPathCrossSuiteOptions` rather than minting a duplicate.
+ * cross-suite shape (`setup_test` / `rpc_path`); aliases the shared
+ * `RpcPathCrossSuiteOptions` rather than minting a duplicate. No case here
+ * is capability-gated, so the flag bundle is not on the shape.
  */
 export type ActorLookupCrossTestOptions = RpcPathCrossSuiteOptions;
 export declare const describe_actor_lookup_cross_tests: (options: ActorLookupCrossTestOptions) => void;

package/dist/testing/cross_backend/actor_lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkDxF,CAAC"}
+{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkDxF,CAAC"}

package/dist/testing/cross_backend/body_size.d.ts

@@ -2,8 +2,10 @@ import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /**
  * Options for the body-size parity suite — the standard RPC-dispatched
- * cross-suite shape (`setup_test` / `capabilities` / `rpc_path`); aliases the
- * shared `RpcPathCrossSuiteOptions` rather than minting a duplicate.
+ * cross-suite shape (`setup_test` / `rpc_path`); aliases the shared
+ * `RpcPathCrossSuiteOptions` rather than minting a duplicate. The limit is
+ * on every spine, so no case is capability-gated and the flag bundle is not
+ * on the shape.
  */
 export type BodySizeCrossTestOptions = RpcPathCrossSuiteOptions;
 export declare const describe_body_size_cross_tests: (options: BodySizeCrossTestOptions) => void;

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAmDhE,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA0ClF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAmDhE,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA0ClF,CAAC"}

package/dist/testing/cross_backend/body_size.js

@@ -39,7 +39,7 @@ import '../assert_dev_env.js';
  * Like origin/payload rejection, this is middleware-level flat REST — not the
  * JSON-RPC envelope the conformance-table runner expects — so it's an
  * imperative suite, not a `conformance_table` row. Runs both legs via the
- * shared `{setup_test, capabilities}` protocol: the in-process leg
+ * shared `setup_test` protocol: the in-process leg
  * (`auth/body_size_parity.db.test.ts`, plain `gro test`) and the cross-process
  * leg (`cross_backend/body_size.cross.test.ts`, the TS spine binaries + Rust
  * `testing_spine_stub` over real HTTP). The body-size limit is on every spine,

package/dist/testing/cross_backend/cell_crud.d.ts

@@ -1,4 +1,4 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
-export declare const describe_cell_crud_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+export declare const describe_cell_crud_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_crud.d.ts.map

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAsclF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA+cF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -48,6 +48,7 @@ import { describe, assert } from 'vitest';
 import { CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_cell_crud_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
@@ -64,6 +65,12 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.strictEqual(created.cell.created_by, owner.actor.id);
             assert.strictEqual(created.cell.updated_by, null);
             assert.strictEqual(created.cell.grant_count, 0);
+            // Byte-shape gate: `CellJson`'s `z.string()` accepts a millisecond
+            // stamp too, so `expect_output` alone can't tell the two spines
+            // apart on the timestamp columns.
+            assert_iso8601_seconds(created.cell.created_at, 'cell_create.created_at');
+            assert_iso8601_seconds_nullable(created.cell.updated_at, 'cell_create.updated_at');
+            assert_iso8601_seconds_nullable(created.cell.deleted_at, 'cell_create.deleted_at');
             const cell_id = created.cell.id;
             // get by id — full CellGetOutput envelope; relations empty in the first cut
             const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: cell_id }, owner_headers), CellGetOutput);
@@ -74,10 +81,13 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.strictEqual(got.items_truncated, false);
             assert.strictEqual(got.can_edit, true);
             assert.strictEqual(got.can_grant, true); // owner is manage-tier
+            assert_iso8601_seconds(got.cell.created_at, 'cell_get.created_at');
+            assert_iso8601_seconds_nullable(got.cell.updated_at, 'cell_get.updated_at');
             // update data + flip to public (owner is manage-tier, so visibility write is allowed)
             const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'hi2' }, visibility: 'public' }, owner_headers), CellUpdateOutput);
             assert.strictEqual(updated.cell.visibility, 'public');
             assert.strictEqual(updated.cell.updated_by, owner.actor.id);
+            assert_iso8601_seconds(updated.cell.updated_at, 'cell_update.updated_at');
             // list includes it
             const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', {}, owner_headers), CellListOutput);
             assert.ok(listed.cells.some((c) => c.id === cell_id), 'owner cell_list omitted the cell');

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -1,6 +1,6 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
-export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 /**
  * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
  * approved | rejected` transition) — root-authority-gated.
@@ -24,5 +24,5 @@ export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCr
  *
  * `$lib`-free by contract (relative specifiers only).
  */
-export declare const describe_cell_moderate_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+export declare const describe_cell_moderate_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,eAAO,MAAM,sCAAsC,GAAI,SAAS,wBAAwB,KAAG,IAwP1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAAI,SAAS,wBAAwB,KAAG,IAwHtF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwPF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAwHF,CAAC"}

package/dist/testing/cross_backend/cell_grant_role.d.ts

@@ -1,8 +1,8 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /** App role the holder is seeded with; matches the spine's registered role. */
 export declare const CELL_EDITOR_ROLE = "cell_editor";
 /** Username the fixture seeds (via `extra_accounts`) holding `CELL_EDITOR_ROLE`. */
 export declare const CELL_ROLE_HOLDER_USERNAME = "cell_role_holder";
-export declare const describe_cell_grant_role_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+export declare const describe_cell_grant_role_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_grant_role.d.ts.map