@fuzdev/fuz_app 0.111.0 → 0.113.0

package/dist/testing/attack_surface.js

@@ -18,11 +18,14 @@ import { test, assert, describe } from 'vitest';
 import { assert_surface_invariants, assert_rpc_ws_surface_invariants, assert_surface_security_policy, audit_error_schema_tightness, assert_error_schema_tightness, default_error_schema_tightness, fuz_app_stock_route_tightness_allowlist } from './surface_invariants.js';
 import { describe_adversarial_input } from './adversarial_input.js';
 import { describe_adversarial_404 } from './adversarial_404.js';
-import { create_test_app_from_specs, create_test_request_context, create_auth_test_apps, select_auth_app, resolve_test_path } from './auth_apps.js';
+import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
+import { resolve_valid_path } from './schema_generators.js';
 import { assert_surface_matches_snapshot, assert_surface_deterministic, assert_only_expected_public_routes, assert_full_middleware_stack, assert_error_schema_valid } from './assertions.js';
 import { merge_error_schemas } from '../http/schema_helpers.js';
 import { collect_middleware_errors } from '../http/surface.js';
-import { filter_protected_routes, filter_role_routes, filter_keeper_routes } from '../http/surface_query.js';
+import { filter_protected_routes, filter_role_routes, filter_credential_gated_routes } from '../http/surface_query.js';
+import { CREDENTIAL_TYPES } from '../hono_context.js';
+import { CREDENTIAL_TYPE_SESSION } from '../auth/credential_type_schema.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_CREDENTIAL_TYPE_REQUIRED } from '../http/error_schemas.js';
 // --- Adversarial test runner ---
 /**
@@ -45,31 +48,54 @@ const build_error_schema_lookup = (route_specs, middleware_specs) => {
     }
     return lookup;
 };
+/**
+ * Build a lookup from `"METHOD /path"` to the route's own `RouteSpec` — the
+ * companion of `build_error_schema_lookup`, so a generated request can reach
+ * the route's `params` schema and synthesize path segments the route will
+ * actually accept.
+ */
+const build_route_spec_lookup = (route_specs) => {
+    const lookup = new Map();
+    for (const spec of route_specs) {
+        lookup.set(`${spec.method} ${spec.path}`, spec);
+    }
+    return lookup;
+};
 /**
  * Generate adversarial HTTP auth enforcement test suites.
  *
  * Describe blocks:
  * - unauthenticated → 401 — every protected route
- * - wrong role → 403 — every role route, tested with all non-matching roles
- * - authenticated without role → 403 — every role route, no-role context
+ * - wrong role → 403 — every role route the role apps' session credential
+ *   reaches, tested with all non-matching roles
+ * - authenticated without role → 403 — the same routes, no-role context
+ * - credential-gated routes reject a disallowed credential → 403 — every
+ *   route declaring `auth.credential_types`, probed on a channel it refuses
  * - correct auth passes guard — every protected route, assert not 401/403
  */
 export const describe_adversarial_auth = (options) => {
     const { build, roles } = options;
     const { surface, route_specs, middleware_specs } = build();
-    const protected_routes = filter_protected_routes(surface);
+    const is_skipped = create_route_skip_filter(options.skip_routes);
+    const protected_routes = filter_protected_routes(surface).filter((r) => !is_skipped(r));
     if (protected_routes.length === 0)
         return;
-    const role_routes = filter_role_routes(surface);
-    const keeper_routes = filter_keeper_routes(surface);
+    const role_routes = filter_role_routes(surface).filter((r) => !is_skipped(r));
+    const credential_gated_routes = filter_credential_gated_routes(surface).filter((r) => !is_skipped(r));
     // merged error schemas (auto-derived + middleware + handler-specific) for response validation
     const error_schema_lookup = build_error_schema_lookup(route_specs, middleware_specs);
+    // The route's own spec, so a path param with a declared format (a
+    // `blake3:…` fact hash, a `tok_…` id) is synthesized into a value params
+    // validation accepts. Otherwise the generated request 400s on the path
+    // before ever reaching the 401 / 403 gate the case is asserting.
+    const spec_lookup = build_route_spec_lookup(route_specs);
+    const test_path = (route) => resolve_valid_path(route.path, spec_lookup.get(`${route.method} ${route.path}`)?.params);
     const apps = create_auth_test_apps(route_specs, roles);
     describe('adversarial HTTP auth enforcement', () => {
         describe('unauthenticated → 401', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await apps.public.request(resolve_test_path(route.path), {
+                    const res = await apps.public.request(test_path(route), {
                         method: route.method
                     });
                     assert.strictEqual(res.status, 401, `${route.method} ${route.path}`);
@@ -79,10 +105,17 @@ export const describe_adversarial_auth = (options) => {
                 });
             }
         });
-        // Role-only routes (no credential gate). Keeper routes have a credential
-        // gate that fires before the role gate, so they get tested separately
-        // in the keeper block below.
-        const role_only_routes = role_routes.filter((r) => !(r.auth.credential_types?.length ?? 0));
+        // Role routes the role apps can actually reach. Those apps carry a
+        // session credential, so a route gated to another channel (keeper) is
+        // refused by the pre-authorization credential gate before its role gate
+        // ever runs — probing it here would assert `insufficient_permissions`
+        // and see `credential_type_required`. A route gated *to* the session
+        // channel (the audit SSE stream) stays in: its role gate is reachable,
+        // and dropping it would silently retire this coverage the day a route
+        // gained a session gate. Either way the credential block below probes
+        // the gate itself.
+        const role_only_routes = role_routes.filter((r) => !r.auth.credential_types?.length ||
+            r.auth.credential_types.includes(CREDENTIAL_TYPE_SESSION));
         if (role_only_routes.length > 0) {
             describe('wrong role → 403', () => {
                 for (const route of role_only_routes) {
@@ -93,7 +126,7 @@ export const describe_adversarial_auth = (options) => {
                             const app = apps.by_role.get(wrong_role);
                             if (!app)
                                 throw new Error(`No test app for role '${wrong_role}'`);
-                            const res = await app.request(resolve_test_path(route.path), {
+                            const res = await app.request(test_path(route), {
                                 method: route.method
                             });
                             assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
@@ -108,7 +141,7 @@ export const describe_adversarial_auth = (options) => {
             describe('authenticated without role → 403', () => {
                 for (const route of role_only_routes) {
                     test(`${route.method} ${route.path}`, async () => {
-                        const res = await apps.authed.request(resolve_test_path(route.path), {
+                        const res = await apps.authed.request(test_path(route), {
                             method: route.method
                         });
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
@@ -120,19 +153,35 @@ export const describe_adversarial_auth = (options) => {
                 }
             });
         }
-        if (keeper_routes.length > 0) {
-            describe('keeper routes reject session credential → 403', () => {
-                // keeper role via session cookie should fail (wrong credential type)
-                const app_session_keeper = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'session');
-                for (const route of keeper_routes) {
-                    test(`${route.method} ${route.path}`, async () => {
-                        const res = await app_session_keeper.request(resolve_test_path(route.path), {
+        if (credential_gated_routes.length > 0) {
+            describe('credential-gated routes reject a disallowed credential → 403', () => {
+                // Each route is probed on the first channel its own allowlist
+                // omits, in `CREDENTIAL_TYPES` order: a session for keeper's
+                // `daemon_token` gate, an api token for the session-only routes —
+                // which is the bearer channel those gates exist to refuse. The
+                // channel apps hold the keeper role, so no route's role gate can
+                // be what answers; it could not be anyway, the credential gate
+                // being pre-authorization.
+                for (const route of credential_gated_routes) {
+                    const admitted = route.auth.credential_types ?? [];
+                    const refused = CREDENTIAL_TYPES.find((t) => !admitted.includes(t));
+                    if (!refused) {
+                        // A gate listing every builtin channel refuses none of them, so
+                        // there is no probe to make. Reported as a skip rather than
+                        // dropped silently: a route that reads as gated but is not is
+                        // worth seeing in the run, and a `continue` here would hide
+                        // exactly the shape this block exists to surface.
+                        test.skip(`${route.method} ${route.path} (gate admits every builtin channel — nothing to refuse)`, () => { });
+                        continue;
+                    }
+                    test(`${route.method} ${route.path} (${refused})`, async () => {
+                        const res = await apps.by_credential_type.get(refused).request(test_path(route), {
                             method: route.method
                         });
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                         const body = await res.json();
                         assert.strictEqual(body.error, ERROR_CREDENTIAL_TYPE_REQUIRED);
-                        assert.deepStrictEqual(body.required_credential_types, route.auth.credential_types ?? []);
+                        assert.deepStrictEqual(body.required_credential_types, admitted);
                         assert_error_schema_valid(error_schema_lookup, route, 403, body);
                     });
                 }
@@ -141,7 +190,9 @@ export const describe_adversarial_auth = (options) => {
         describe('correct auth passes guard', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await select_auth_app(apps, route.auth).request(resolve_test_path(route.path), { method: route.method });
+                    const res = await select_auth_app(apps, route.auth).request(test_path(route), {
+                        method: route.method
+                    });
                     // handler may error (500) or return 404 (stub deps) — that's fine, we only verify auth passed
                     assert.notStrictEqual(res.status, 401, 'should not be 401 (auth rejected)');
                     assert.notStrictEqual(res.status, 403, 'should not be 403 (role rejected)');
@@ -210,7 +261,7 @@ export const resolve_standard_error_schema_tightness = (consumer) => {
  * any project-specific assertions in additional `describe` blocks.
  */
 export const describe_standard_attack_surface_tests = (options) => {
-    const { build, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix = '/api/', security_policy } = options;
+    const { build, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix = '/api/', security_policy, skip_routes } = options;
     const error_schema_tightness = resolve_standard_error_schema_tightness(options.error_schema_tightness);
     const built = build();
     const { surface } = built;
@@ -254,7 +305,7 @@ export const describe_standard_attack_surface_tests = (options) => {
             }
         });
     });
-    describe_adversarial_auth({ build: () => built, roles });
-    describe_adversarial_input({ build: () => built, roles });
-    describe_adversarial_404({ build: () => built, roles });
+    describe_adversarial_auth({ build: () => built, roles, skip_routes });
+    describe_adversarial_input({ build: () => built, roles, skip_routes });
+    describe_adversarial_404({ build: () => built, roles, skip_routes });
 };

package/dist/testing/audit_completeness.d.ts

@@ -2,7 +2,6 @@ import './assert_dev_env.js';
 import type { SessionOptions } from '../auth/session_cookie.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest } from './cross_backend/setup.js';
 /**
  * Configuration for `describe_audit_completeness_tests`.
@@ -23,8 +22,6 @@ export interface AuditCompletenessTestOptions {
      * options uniformity.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /** Session config — needed for factory-form rpc_endpoints resolution. */
     session_options: SessionOptions<string>;
     /**

package/dist/testing/audit_completeness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAinBzF,CAAC"}
+{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAgnBzF,CAAC"}

package/dist/testing/audit_completeness.js

@@ -111,7 +111,6 @@ export const describe_audit_completeness_tests = (options) => {
     // confusing test failure when `rpc_endpoints` is missing.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
-    void options.capabilities;
     describe('audit_log_completeness', () => {
         // --- Account routes ---
         describe('account mutation audit events', () => {

package/dist/testing/auth_apps.d.ts

@@ -29,6 +29,16 @@ export interface AuthTestApps {
     public: Hono;
     authed: Hono;
     keeper: Hono;
+    /**
+     * One authenticated app per builtin credential type, each holding the
+     * keeper role — the channel axis, where `by_role` is the authority axis.
+     *
+     * A credential gate is pre-authorization, so probing it needs an app on a
+     * channel the route refuses, and proving a gated route still works needs
+     * one on a channel it admits. `keeper` is the `'daemon_token'` entry of
+     * this map, not a second app.
+     */
+    by_credential_type: Map<CredentialType, Hono>;
     by_role: Map<string, Hono>;
 }
 /**
@@ -41,11 +51,33 @@ export declare const create_auth_test_apps: (route_specs: Array<RouteSpec>, role
 /**
  * Select the Hono test app with correct auth for a route.
  *
+ * The credential channel is decided first, because the channel gate is
+ * pre-authorization: an app whose credential the route refuses never reaches
+ * the role gate, so a role-correct app on the wrong channel answers
+ * `credential_type_required`, and a "correct auth passes guard" case reads it
+ * as a failure of the role gate that never ran.
+ *
+ * A gate admitting `'session'` falls through to the `by_role` /
+ * `authed` apps, which carry that channel. Any other gate leaves the
+ * `by_credential_type` app as the only candidate — those hold the keeper
+ * role, which is why a route pairing a non-session channel with some *other*
+ * role has no app and says so.
+ *
  * @throws Error if `auth.roles` names a role not present in `apps.by_role` —
  *   surfaces a missing entry in the `roles` array passed to
  *   `create_auth_test_apps`.
+ * @throws Error if the route pairs a non-session channel with a role the
+ *   channel apps don't hold. Silently handing back a session app would turn
+ *   every case on the route into a misattributed 403.
  */
 export declare const select_auth_app: (apps: AuthTestApps, auth: RouteAuth) => Hono;
-/** Replace Hono route params (`:foo`) with dummy values for HTTP testing. */
-export declare const resolve_test_path: (path: string) => string;
+/**
+ * Build the skip predicate an adversarial suite applies from its
+ * `skip_routes` option — routes named in `'METHOD /path'` form, the surface
+ * key. `undefined` skips nothing.
+ */
+export declare const create_route_skip_filter: (skip_routes: Array<string> | undefined) => ((route: {
+    method: string;
+    path: string;
+}) => boolean);
 //# sourceMappingURL=auth_apps.d.ts.map

package/dist/testing/auth_apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_apps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/auth_apps.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAI5B;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,MAAM,KAAG,cAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACtC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,WAAW,cAAc,EACzB,kBAAkB,cAAc,KAC9B,IAuBF,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,KAClB,YAeF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,YAAY,EAAE,MAAM,SAAS,KAAG,IAarE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,MAA4C,CAAC"}
+{"version":3,"file":"auth_apps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/auth_apps.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvE,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAI5B;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,MAAM,KAAG,cAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACtC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,WAAW,cAAc,EACzB,kBAAkB,cAAc,KAC9B,IAuBF,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb;;;;;;;;OAQG;IACH,kBAAkB,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,KAClB,YAsBF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,YAAY,EAAE,MAAM,SAAS,KAAG,IAwBrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACpC,aAAa,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,KACpC,CAAC,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAGvD,CAAC"}

package/dist/testing/auth_apps.js

@@ -11,9 +11,11 @@ import { Hono } from 'hono';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_route_specs } from '../http/route_spec.js';
 import { is_public_auth } from '../http/auth_shape.js';
+import { CREDENTIAL_TYPE_DAEMON_TOKEN, CREDENTIAL_TYPE_SESSION } from '../auth/credential_type_schema.js';
+import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';
 import { REQUEST_CONTEXT_KEY, create_fuz_authorization_handler } from '../auth/request_context.js';
-import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, CREDENTIAL_TYPES, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { create_stub_db } from './stubs.js';
 import { create_test_account, create_test_actor, create_test_role_grant } from './entities.js';
 /**
@@ -40,7 +42,7 @@ export const create_test_app_from_specs = (route_specs, auth_ctx, credential_typ
         if (auth_ctx) {
             c.set(ACCOUNT_ID_KEY, auth_ctx.account.id);
             c.set(REQUEST_CONTEXT_KEY, auth_ctx);
-            c.set(CREDENTIAL_TYPE_KEY, credential_type ?? 'session');
+            c.set(CREDENTIAL_TYPE_KEY, credential_type ?? CREDENTIAL_TYPE_SESSION);
             c.set(TEST_CONTEXT_PRESET_KEY, true);
         }
         await next();
@@ -59,25 +61,52 @@ export const create_auth_test_apps = (route_specs, roles) => {
     for (const role of roles) {
         by_role.set(role, create_test_app_from_specs(route_specs, create_test_request_context(role)));
     }
+    const by_credential_type = new Map(CREDENTIAL_TYPES.map((credential_type) => [
+        credential_type,
+        create_test_app_from_specs(route_specs, create_test_request_context(ROLE_KEEPER), credential_type)
+    ]));
     return {
         public: create_test_app_from_specs(route_specs),
         authed: create_test_app_from_specs(route_specs, create_test_request_context()),
-        keeper: create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'daemon_token'),
+        keeper: by_credential_type.get(CREDENTIAL_TYPE_DAEMON_TOKEN),
+        by_credential_type,
         by_role
     };
 };
 /**
  * Select the Hono test app with correct auth for a route.
  *
+ * The credential channel is decided first, because the channel gate is
+ * pre-authorization: an app whose credential the route refuses never reaches
+ * the role gate, so a role-correct app on the wrong channel answers
+ * `credential_type_required`, and a "correct auth passes guard" case reads it
+ * as a failure of the role gate that never ran.
+ *
+ * A gate admitting `'session'` falls through to the `by_role` /
+ * `authed` apps, which carry that channel. Any other gate leaves the
+ * `by_credential_type` app as the only candidate — those hold the keeper
+ * role, which is why a route pairing a non-session channel with some *other*
+ * role has no app and says so.
+ *
  * @throws Error if `auth.roles` names a role not present in `apps.by_role` —
  *   surfaces a missing entry in the `roles` array passed to
  *   `create_auth_test_apps`.
+ * @throws Error if the route pairs a non-session channel with a role the
+ *   channel apps don't hold. Silently handing back a session app would turn
+ *   every case on the route into a misattributed 403.
  */
 export const select_auth_app = (apps, auth) => {
     if (is_public_auth(auth))
         return apps.public;
-    if (auth.credential_types?.includes('daemon_token'))
-        return apps.keeper;
+    const credential_types = auth.credential_types;
+    if (credential_types?.length && !credential_types.includes(CREDENTIAL_TYPE_SESSION)) {
+        const channel = CREDENTIAL_TYPES.find((t) => credential_types.includes(t));
+        const app = channel === undefined ? undefined : apps.by_credential_type.get(channel);
+        const roles = auth.roles;
+        if (app && (!roles?.length || roles.includes(ROLE_KEEPER)))
+            return app;
+        throw new Error(`No test app for credential types '${credential_types.join("', '")}'${roles?.length ? ` with roles '${roles.join("', '")}'` : ''} — the channel apps hold the '${ROLE_KEEPER}' role, and only the session channel has per-role apps`);
+    }
     if (auth.roles?.length) {
         // Multi-role disjunction: any of the named roles admits the caller.
         // Tests pick the first role's app; consumers wanting per-role coverage
@@ -90,5 +119,12 @@ export const select_auth_app = (apps, auth) => {
     }
     return apps.authed;
 };
-/** Replace Hono route params (`:foo`) with dummy values for HTTP testing. */
-export const resolve_test_path = (path) => path.replace(/:(\w+)/g, 'test_$1');
+/**
+ * Build the skip predicate an adversarial suite applies from its
+ * `skip_routes` option — routes named in `'METHOD /path'` form, the surface
+ * key. `undefined` skips nothing.
+ */
+export const create_route_skip_filter = (skip_routes) => {
+    const skip_set = new Set(skip_routes);
+    return (route) => skip_set.has(`${route.method} ${route.path}`);
+};

package/dist/testing/cross_backend/account_lifecycle.d.ts

@@ -1,10 +1,11 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /**
  * Options for the account-lifecycle parity suite. The standard
- * RPC-dispatched cross-suite shape (`setup_test` / `capabilities` /
- * `rpc_path`); aliases `RpcPathCrossSuiteOptions` rather than duplicating.
+ * capability-gating RPC-dispatched cross-suite shape (`setup_test` /
+ * `capabilities` / `rpc_path`); aliases
+ * `RpcPathCapabilityGatedCrossSuiteOptions` rather than duplicating.
  */
-export type AccountLifecycleCrossTestOptions = RpcPathCrossSuiteOptions;
+export type AccountLifecycleCrossTestOptions = RpcPathCapabilityGatedCrossSuiteOptions;
 export declare const describe_account_lifecycle_cross_tests: (options: AccountLifecycleCrossTestOptions) => void;
 //# sourceMappingURL=account_lifecycle.d.ts.map

package/dist/testing/cross_backend/account_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AAExE,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IA+TF,CAAC"}
+{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAqUF,CAAC"}

package/dist/testing/cross_backend/account_lifecycle.js

@@ -22,6 +22,7 @@ import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAc
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_account_lifecycle_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
@@ -99,6 +100,9 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const failure = listed.events.find((e) => e.outcome === 'failure' &&
                 e.metadata?.reason === ERROR_CANNOT_DELETE_KEEPER);
             assert.ok(failure, 'keeper-removal guard must emit an account_delete outcome=failure audit row with reason cannot_delete_keeper');
+            // Byte-shape gate on the audit row's timestamp — `z.string()` in
+            // `AuditLogEventWithUsernamesJson` accepts a millisecond stamp too.
+            assert_iso8601_seconds(failure.created_at, 'audit_log_list.created_at');
         });
         test_if(capabilities.account_lifecycle, 'deterministic: double-undelete → second call is not_found', async () => {
             const fixture = await setup_test();
@@ -139,6 +143,9 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const row = with_deleted.accounts.find((a) => a.account.id === victim.account.id);
             assert.ok(row, 'include_deleted surfaces the tombstoned row');
             assert.ok(row.account.deleted_at !== null, 'tombstoned row carries a non-null deleted_at on both spines');
+            assert_iso8601_seconds(row.account.created_at, 'admin_account_list.created_at');
+            assert_iso8601_seconds(row.account.updated_at, 'admin_account_list.updated_at');
+            assert_iso8601_seconds(row.account.deleted_at, 'admin_account_list.deleted_at');
         });
     });
 };

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -2,7 +2,7 @@ import '../assert_dev_env.js';
 /**
  * Cross-impl RPC **action-manifest** introspection — a normalized,
  * JSON-serializable dump of a backend's live RPC method set, one entry per
- * method carrying its auth shape + side-effect flag.
+ * method carrying its auth shape, side-effect flag, and rate-limit class.
  *
  * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
  * captures the live *database* shape for the schema-parity gate, this
@@ -35,13 +35,16 @@ import '../assert_dev_env.js';
  */
 import { z } from 'zod';
 import { type RouteAuth } from '../../http/auth_shape.js';
+import { RateLimitKey } from '../../http/error_schemas.js';
 import type { RequestResponseActionSpec } from '../../actions/action_spec.js';
 /**
  * One method's normalized RPC metadata — the cross-impl-comparable unit.
  * `roles` / `credential_types` are always present + sorted (an absent gate
  * and an empty list both serialize to `[]`) so the diff never trips on a
  * `undefined`-vs-`[]` or declaration-order difference between impls; the
- * auth axes reuse the canonical `AuthAxisState` enum.
+ * auth axes reuse the canonical `AuthAxisState` enum. `rate_limit` is
+ * nullable rather than optional for the same reason — an unthrottled action
+ * serializes an explicit `null`, so a missing key is drift, not a default.
  */
 export declare const ActionManifestEntry: z.ZodObject<{
     /** RPC method name (`spec.method`). */
@@ -64,6 +67,12 @@ export declare const ActionManifestEntry: z.ZodObject<{
     roles: z.ZodArray<z.ZodString>;
     /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
     credential_types: z.ZodArray<z.ZodString>;
+    /** Per-action rate-limit class, or `null` when the action declares none. */
+    rate_limit: z.ZodNullable<z.ZodEnum<{
+        account: "account";
+        ip: "ip";
+        both: "both";
+    }>>;
 }, z.core.$strict>;
 export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
 /** The full action manifest — every entry, sorted by `method`. */
@@ -89,6 +98,12 @@ export declare const ActionManifest: z.ZodObject<{
         roles: z.ZodArray<z.ZodString>;
         /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
         credential_types: z.ZodArray<z.ZodString>;
+        /** Per-action rate-limit class, or `null` when the action declares none. */
+        rate_limit: z.ZodNullable<z.ZodEnum<{
+            account: "account";
+            ip: "ip";
+            both: "both";
+        }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ActionManifest = z.infer<typeof ActionManifest>;
@@ -101,6 +116,7 @@ export declare const action_manifest_entry: (spec: {
     readonly method: string;
     readonly auth: RouteAuth;
     readonly side_effects: boolean;
+    readonly rate_limit?: RateLimitKey;
 }) => ActionManifestEntry;
 /**
  * Build the normalized `ActionManifest` from a list of request-response
@@ -109,5 +125,5 @@ export declare const action_manifest_entry: (spec: {
  * it passes (the TS spine passes its full mount; the Rust stub filters
  * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
  */
-export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects">>) => ActionManifest;
+export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects" | "rate_limit">>) => ActionManifest;
 //# sourceMappingURL=action_manifest.d.ts.map

package/dist/testing/cross_backend/action_manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;kBAEhF,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAhB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;;kBAQhF,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B,KAAG,mBAOF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,KACvF,cAED,CAAC"}
+{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;IAEjF,4EAA4E;;;;;;kBAE3E,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAlB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;QAEjF,4EAA4E;;;;;;;kBAQ3E,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;CACnC,KAAG,mBAQF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CACnB,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY,CAAC,CAClF,KACC,cAED,CAAC"}

package/dist/testing/cross_backend/action_manifest.js

@@ -2,7 +2,7 @@ import '../assert_dev_env.js';
 /**
  * Cross-impl RPC **action-manifest** introspection — a normalized,
  * JSON-serializable dump of a backend's live RPC method set, one entry per
- * method carrying its auth shape + side-effect flag.
+ * method carrying its auth shape, side-effect flag, and rate-limit class.
  *
  * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
  * captures the live *database* shape for the schema-parity gate, this
@@ -35,12 +35,15 @@ import '../assert_dev_env.js';
  */
 import { z } from 'zod';
 import { AuthAxisState } from '../../http/auth_shape.js';
+import { RateLimitKey } from '../../http/error_schemas.js';
 /**
  * One method's normalized RPC metadata — the cross-impl-comparable unit.
  * `roles` / `credential_types` are always present + sorted (an absent gate
  * and an empty list both serialize to `[]`) so the diff never trips on a
  * `undefined`-vs-`[]` or declaration-order difference between impls; the
- * auth axes reuse the canonical `AuthAxisState` enum.
+ * auth axes reuse the canonical `AuthAxisState` enum. `rate_limit` is
+ * nullable rather than optional for the same reason — an unthrottled action
+ * serializes an explicit `null`, so a missing key is drift, not a default.
  */
 export const ActionManifestEntry = z.strictObject({
     /** RPC method name (`spec.method`). */
@@ -54,7 +57,9 @@ export const ActionManifestEntry = z.strictObject({
     /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
     roles: z.array(z.string()),
     /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
-    credential_types: z.array(z.string())
+    credential_types: z.array(z.string()),
+    /** Per-action rate-limit class, or `null` when the action declares none. */
+    rate_limit: RateLimitKey.nullable()
 });
 /** The full action manifest — every entry, sorted by `method`. */
 export const ActionManifest = z.strictObject({
@@ -73,7 +78,8 @@ export const action_manifest_entry = (spec) => ({
     account: spec.auth.account,
     actor: spec.auth.actor,
     roles: sorted_strings(spec.auth.roles),
-    credential_types: sorted_strings(spec.auth.credential_types)
+    credential_types: sorted_strings(spec.auth.credential_types),
+    rate_limit: spec.rate_limit ?? null
 });
 /** Deterministic byte-lexicographic method order — matches the Rust `str::cmp` the stub sorts by. */
 const compare_method = (a, b) => a.method < b.method ? -1 : a.method > b.method ? 1 : 0;

package/dist/testing/cross_backend/action_manifest_parity.d.ts

@@ -7,8 +7,8 @@ import '../assert_dev_env.js';
  * fuz_app spine and the Rust `testing_spine_stub`) are each other's parity
  * reference. After both bootstrap, dump each one's live RPC method set, diff,
  * fail loudly on drift. The diff entries name the specific divergence (a
- * method only one impl mounts, a per-method auth-axis or side-effect
- * mismatch) so the error message points at the source.
+ * method only one impl mounts, a per-method auth-axis, side-effect, or
+ * rate-limit-class mismatch) so the error message points at the source.
  *
  * ```ts
  * const manifest_a = await capture_action_manifest(ts_handle);
@@ -17,13 +17,14 @@ import '../assert_dev_env.js';
  * ```
  *
  * Non-coverage: the manifest captures `{method, side_effects, account, actor,
- * roles, credential_types}` — the wire-relevant auth shape. It does **not**
+ * roles, credential_types, rate_limit}` — the wire-relevant auth shape. It does **not**
  * capture input/output schemas (the declared-surface wire shape is gated by
  * `rpc_round_trip`) nor the protocol actions `heartbeat` / `cancel` (excluded
  * by construction — see `action_manifest.ts`).
  *
  * @module
  */
+import type { RateLimitKey } from '../../http/error_schemas.js';
 import type { ActionManifest } from './action_manifest.js';
 /** Structured drift entry. `where` is the named source impl ('a' or 'b'). */
 export type ActionManifestDiff = {
@@ -35,6 +36,11 @@ export type ActionManifestDiff = {
     readonly method: string;
     readonly a: boolean;
     readonly b: boolean;
+} | {
+    readonly kind: 'rate_limit_differs';
+    readonly method: string;
+    readonly a: RateLimitKey | null;
+    readonly b: RateLimitKey | null;
 } | {
     readonly kind: 'auth_field_differs';
     readonly method: string;

package/dist/testing/cross_backend/action_manifest_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAWhF,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CA+B1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MA8BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAUF,CAAC"}
+{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAWhF,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CAC/B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CAkC1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MAqCF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAUF,CAAC"}

package/dist/testing/cross_backend/action_manifest_parity.js

@@ -30,6 +30,9 @@ export const diff_action_manifests = (a, b) => {
         if (ea.side_effects !== eb.side_effects) {
             diffs.push({ kind: 'side_effects_differ', method, a: ea.side_effects, b: eb.side_effects });
         }
+        if (ea.rate_limit !== eb.rate_limit) {
+            diffs.push({ kind: 'rate_limit_differs', method, a: ea.rate_limit, b: eb.rate_limit });
+        }
         for (const field of AUTH_SCALAR_FIELDS) {
             if (ea[field] !== eb[field]) {
                 diffs.push({ kind: 'auth_field_differs', method, field, a: ea[field], b: eb[field] });
@@ -62,6 +65,9 @@ export const format_action_manifest_diffs = (diffs, labels = {}) => {
             case 'side_effects_differ':
                 lines.push(`  ${d.method} side_effects differs: ${label_a}=${d.a}, ${label_b}=${d.b}`);
                 break;
+            case 'rate_limit_differs':
+                lines.push(`  ${d.method} rate_limit differs: ${label_a}=${JSON.stringify(d.a)}, ${label_b}=${JSON.stringify(d.b)}`);
+                break;
             case 'auth_field_differs':
                 lines.push(`  ${d.method} auth.${d.field} differs: ${label_a}=${JSON.stringify(d.a)}, ${label_b}=${JSON.stringify(d.b)}`);
                 break;