@fuzdev/fuz_app 0.111.0 → 0.113.0

package/dist/testing/cross_backend/token_lifetime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+C9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAiHF,CAAC"}
+{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAsHF,CAAC"}

package/dist/testing/cross_backend/token_lifetime.js

@@ -37,6 +37,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { account_token_create_action_spec, account_token_list_action_spec, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** TTL used by the bounded-mint case. */
 const TTL_DAYS = 30;
@@ -61,6 +62,9 @@ export const describe_token_lifetime_cross_tests = (options) => {
             }, fixture.create_session_headers());
             const created = expect_output(create_res, TokenCreateOutput);
             assert.ok(created.expires_at !== null, 'a ttl mint must return a non-null expires_at — null means the spine dropped the field');
+            // Byte-shape gate: `z.string()` accepts a millisecond stamp too, so
+            // `expect_output` above can't tell the two spines apart.
+            assert_iso8601_seconds(created.expires_at, 'token_create.expires_at');
             const expires_ms = Date.parse(created.expires_at);
             assert.ok(!Number.isNaN(expires_ms), `expires_at must parse as a date: ${created.expires_at}`);
             const expected = before + TTL_DAYS * 86_400_000;
@@ -71,6 +75,8 @@ export const describe_token_lifetime_cross_tests = (options) => {
             const row = listed.tokens.find((t) => t.id === created.id);
             assert.ok(row, 'the minted token must appear in account_token_list');
             assert.ok(row.expires_at !== null, 'account_token_list must report the stored expiry, not null');
+            assert_iso8601_seconds(row.expires_at, 'token_list.expires_at');
+            assert_iso8601_seconds(row.created_at, 'token_list.created_at');
         });
         test('an eternal mint stores NULL expiry', async () => {
             const fixture = await setup_test();

package/dist/testing/cross_backend/token_scope_surface.d.ts

@@ -1,7 +1,7 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /** Options for the token-scope surface parity suite. */
-export interface TokenScopeSurfaceCrossTestOptions extends RpcPathCrossSuiteOptions {
+export interface TokenScopeSurfaceCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /** Audit-log SSE path. Default `/api/admin/audit/stream`. */
     readonly sse_path?: string;
 }

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,wBAAwB;IAClF,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -26,6 +26,15 @@ import '../assert_dev_env.js';
  *   `required_scope` capability string, per surface. A spine that renamed a
  *   surface, dropped the `surface:` prefix, or emitted the JSON-RPC envelope
  *   from a REST route fails here.
+ * - **The audit stream's channel denial** — that surface is gated to
+ *   `credential_types: ['session']` on both spines, so a bearer never reaches
+ *   its scope gate and the observable is `credential_type_required` instead.
+ *   The case is kept here rather than moved: it is still the bearer-vs-surface
+ *   probe, and what it now pins is the coarser-gate-first ordering both spines
+ *   run (a spine that checked scope first would answer `token_scope_required`).
+ *   `surface:audit_stream`'s own capability string is consequently unreachable
+ *   on the default mount and has no cross-impl pin — each spine's census holds
+ *   its declaration, the way the WS upgrade's is held.
  * - **Scope outranks role** — a narrowed token whose account *also* lacks the
  *   gating role must hear `token_scope_required`, not
  *   `insufficient_permissions`. This is the observable the TS↔Rust ordering
@@ -37,16 +46,17 @@ import '../assert_dev_env.js';
  * Two non-vacuity controls hold the negatives honest: the narrowed token must
  * still reach the RPC method it *does* name (otherwise a spine that rejected
  * the credential outright would pass every denial), and a **full** bearer must
- * reach the same surface (otherwise a route broken for all bearers would pass
- * too).
+ * reach `fact_bare` (otherwise a route broken for all bearers would pass too).
+ * The second has no audit-stream twin by construction — refusing every bearer
+ * is exactly what that route's channel gate is for.
  *
  * ## Why the WS upgrade isn't here
  *
  * Rule 3's third probeable surface is the WebSocket upgrade, and it is
  * deliberately omitted: `create_ws_transport` threads cookies, not bearer
  * headers, and a refused upgrade surfaces as a thrown connection error whose
- * body — the thing this suite exists to compare — isn't readable. The two HTTP
- * surfaces are where the denial body is observable, which is what the parity
+ * body — the thing this suite exists to compare — isn't readable. The HTTP
+ * surfaces are where a denial body is observable, which is what the parity
  * gate needs. The WS gate keeps its per-spine coverage (fuz_app's surface
  * census pins the call site; the Rust census pins its own).
  *
@@ -57,7 +67,7 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
+import { ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -107,6 +117,25 @@ const assert_surface_denied = async (fresh_transport, path, token, surface) => {
     const body = await res.json();
     assert.deepStrictEqual(body, surface_denial_body(surface), `${path} must return the canonical flat surface denial`);
 };
+/**
+ * Assert a bearer GET is refused by the *channel* gate rather than the scope
+ * gate — the shape a surface takes once it declares
+ * `credential_types: ['session']`.
+ *
+ * Distinct from `assert_surface_denied` on purpose: a channel-gated surface
+ * refuses **every** bearer, narrow or full, so the denial cannot name a scope.
+ * A narrowed token is still the right probe — it proves the channel gate runs
+ * *first*, since a scope-gated route would have answered
+ * `token_scope_required` instead.
+ */
+const assert_channel_denied = async (fresh_transport, path, token, credential_types) => {
+    const res = await fresh_transport({ origin: null })(path, {
+        headers: { authorization: `Bearer ${token}` }
+    });
+    assert.strictEqual(res.status, 403, `${path} must refuse a bearer with 403`);
+    const body = await res.json();
+    assert.deepStrictEqual(body, { error: ERROR_CREDENTIAL_TYPE_REQUIRED, required_credential_types: credential_types }, `${path} must return the canonical flat credential-type denial`);
+};
 export const describe_token_scope_surface_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -123,10 +152,10 @@ export const describe_token_scope_surface_cross_tests = (options) => {
             const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, ADMITTED_METHOD, undefined, { authorization: `Bearer ${token}` });
             assert.ok(res.ok, `admitted method must succeed: ${JSON.stringify(res.error)}`);
         });
-        test_if(capabilities.sse, 'a narrowed token is refused the audit stream (surface:audit_stream)', async () => {
+        test_if(capabilities.sse, 'the audit stream refuses a bearer at the channel gate (credential_types)', async () => {
             const fixture = await setup_test();
             const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
-            await assert_surface_denied(fixture.fresh_transport, sse_path, token, 'audit_stream');
+            await assert_channel_denied(fixture.fresh_transport, sse_path, token, ['session']);
         });
         test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
             const fixture = await setup_test();

package/dist/testing/cross_backend/wire_shapes.d.ts

@@ -0,0 +1,22 @@
+import '../assert_dev_env.js';
+/**
+ * Assert `value` is a timestamp in the spine's canonical wire shape:
+ * second-precision UTC, exactly 20 characters. The TS spine emits it from
+ * the `iso8601_timestamp_column` SQL projection (`db/sql_columns.ts`) and
+ * `to_iso8601_seconds` (`timestamp.ts`); the Rust spine from
+ * `fuz_db::iso8601_timestamp_column` and `fuz_sys::rfc3339_now`.
+ *
+ * @param value - the field read off a wire response
+ * @param label - the field's name, for the failure message
+ */
+export declare const assert_iso8601_seconds: (value: unknown, label: string) => void;
+/**
+ * Assert `value` is either `null` or a canonical second-precision UTC
+ * timestamp — the shape of every nullable timestamp on the wire
+ * (`expires_at`, `deleted_at`, `updated_at`, …).
+ *
+ * @param value - the field read off a wire response
+ * @param label - the field's name, for the failure message
+ */
+export declare const assert_iso8601_seconds_nullable: (value: unknown, label: string) => void;
+//# sourceMappingURL=wire_shapes.d.ts.map

package/dist/testing/cross_backend/wire_shapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire_shapes.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/wire_shapes.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkB9B;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,EAAE,OAAO,MAAM,KAAG,IAMtE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAAI,OAAO,OAAO,EAAE,OAAO,MAAM,KAAG,IAG/E,CAAC"}

package/dist/testing/cross_backend/wire_shapes.js

@@ -0,0 +1,41 @@
+import '../assert_dev_env.js';
+/**
+ * Wire-shape assertions shared by the cross-backend suites.
+ *
+ * A field can carry the right value on both backends and still be a parity
+ * defect if the two serialize it differently — a millisecond
+ * `2026-05-17T12:34:56.789Z` and a second-precision `2026-05-17T12:34:56Z`
+ * both parse as the same instant, so a Zod `z.string()` check and an
+ * `assert.ok(value)` pass on either. These helpers pin the bytes.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { ISO8601_SECONDS } from '../../timestamp.js';
+/**
+ * Assert `value` is a timestamp in the spine's canonical wire shape:
+ * second-precision UTC, exactly 20 characters. The TS spine emits it from
+ * the `iso8601_timestamp_column` SQL projection (`db/sql_columns.ts`) and
+ * `to_iso8601_seconds` (`timestamp.ts`); the Rust spine from
+ * `fuz_db::iso8601_timestamp_column` and `fuz_sys::rfc3339_now`.
+ *
+ * @param value - the field read off a wire response
+ * @param label - the field's name, for the failure message
+ */
+export const assert_iso8601_seconds = (value, label) => {
+    assert.isTrue(typeof value === 'string', `${label} must be a string, got ${JSON.stringify(value)}`);
+    assert.match(value, ISO8601_SECONDS, `${label} must be second-precision UTC`);
+};
+/**
+ * Assert `value` is either `null` or a canonical second-precision UTC
+ * timestamp — the shape of every nullable timestamp on the wire
+ * (`expires_at`, `deleted_at`, `updated_at`, …).
+ *
+ * @param value - the field read off a wire response
+ * @param label - the field's name, for the failure message
+ */
+export const assert_iso8601_seconds_nullable = (value, label) => {
+    if (value === null)
+        return;
+    assert_iso8601_seconds(value, label);
+};

package/dist/testing/data_exposure.d.ts

@@ -1,6 +1,5 @@
 import './assert_dev_env.js';
 import type { AppSurface, AppSurfaceSpec } from '../http/surface.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest } from './cross_backend/setup.js';
 /**
  * Recursively collect all property names from a JSON Schema.
@@ -26,8 +25,6 @@ export interface DataExposureTestOptions {
      * TS by the consumer; same shape for in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /** Fields that must never appear in any response. Default: `sensitive_field_blocklist`. */
     sensitive_fields?: ReadonlyArray<string>;
     /** Fields that must not appear in non-admin responses. Default: `admin_only_field_blocklist`. */

package/dist/testing/data_exposure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data_exposure.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/data_exposure.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAqB7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAIvE;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,GAAI,QAAQ,OAAO,KAAG,GAAG,CAAC,MAAM,CAuB9E,CAAC;AAIF;;GAEG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,UAAU,EACnB,mBAAkB,aAAa,CAAC,MAAM,CAA6B,KACjE,IAWF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,UAAU,EACnB,oBAAmB,aAAa,CAAC,MAAM,CAA8B,KACnE,IAgBF,CAAC;AAIF,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IA2L/E,CAAC"}
+{"version":3,"file":"data_exposure.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/data_exposure.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAqB7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYrE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAIvE;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,GAAI,QAAQ,OAAO,KAAG,GAAG,CAAC,MAAM,CAuB9E,CAAC;AAIF;;GAEG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,UAAU,EACnB,mBAAkB,aAAa,CAAC,MAAM,CAA6B,KACjE,IAWF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,UAAU,EACnB,oBAAmB,aAAa,CAAC,MAAM,CAA8B,KACnE,IAgBF,CAAC;AAIF,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IA0L/E,CAAC"}

package/dist/testing/data_exposure.js

@@ -96,7 +96,6 @@ export const describe_data_exposure_tests = (options) => {
     const { surface, route_specs } = options.surface_source;
     const { sensitive_fields = sensitive_field_blocklist, admin_only_fields = admin_only_field_blocklist } = options;
     const skip_set = new Set(options.skip_routes);
-    void options.capabilities;
     describe('data exposure — schema-level', () => {
         test('no sensitive fields in any output schema', () => {
             assert_output_schemas_no_sensitive_fields(surface, sensitive_fields);

package/dist/testing/db.d.ts

@@ -15,27 +15,64 @@ export interface DbFactory {
     skip_reason?: string;
 }
 /**
- * Reset a PGlite database to a clean state by dropping and recreating the public schema.
+ * Reset a test database to a clean state by dropping and recreating the public schema.
  *
  * Removes all tables, sequences, indexes, types, and functions.
- * The database instance remains usable after reset.
+ * The database instance remains usable after reset. Despite the name it issues
+ * plain SQL, so it also resets the other drivers the test factories hand out.
  *
  * @mutates db - drops the `public` schema and recreates it; all rows in all
  *   tables are gone after this returns.
  */
 export declare const reset_pglite: (db: Db) => Promise<void>;
+/**
+ * Builds a `DbFactory` from a schema initializer — `create_pglite_factory`'s own shape.
+ */
+export type DbFactoryBuilder = (init_schema: (db: Db) => Promise<void>) => DbFactory;
+/**
+ * Options for `create_pglite_factory`.
+ */
+export interface CreatePgliteFactoryOptions {
+    /**
+     * Whether an installed substitute (`set_substitute_db_factory`) may stand in
+     * for the PGlite factory at this call site. Defaults to `true`; pass `false`
+     * where PGlite itself is the subject under test.
+     */
+    substitutable?: boolean;
+}
+/**
+ * Install a builder that stands in for `create_pglite_factory`, so suites
+ * written against PGlite can run against another driver without being edited.
+ *
+ * Injected rather than selected here: the drivers a substitute wraps live in
+ * test-side code this shipped module cannot import. A call site that passes
+ * `{substitutable: false}` keeps PGlite regardless. Pass `null` to uninstall.
+ *
+ * The slot is read when a factory is built, not when it creates a database,
+ * so install before the first `create_pglite_factory` call — a vitest
+ * `setupFiles` entry, which runs ahead of every test file's imports, is the
+ * shape fuz_app's own `db` project uses. A factory built earlier (including
+ * the module-level fallback in `testing/app_server.ts`) keeps the driver it
+ * was built with, and uninstalling does not revert it.
+ *
+ * @param create_factory - the builder to install, or `null` to remove the installed one
+ */
+export declare const set_substitute_db_factory: (create_factory: DbFactoryBuilder | null) => void;
 /**
  * Create a pglite (in-memory) database factory for tests.
  *
  * Always enabled — no external dependencies required.
- * Shares a single PGlite WASM instance across all factories in the same
- * vitest worker thread (one test file). Subsequent `create()` calls reset
- * the schema via `DROP SCHEMA public CASCADE` instead of paying the WASM
- * cold-start cost again.
+ * Shares a single PGlite WASM instance across the PGlite factories this module builds.
+ * Subsequent `create()` calls reset the schema via `DROP SCHEMA public CASCADE`
+ * instead of paying the WASM cold-start cost again.
+ *
+ * Returns the installed substitute's factory instead when one is installed and
+ * `options.substitutable` is not `false` — see `set_substitute_db_factory`.
  *
  * @param init_schema - callback to initialize the database schema
+ * @param options - `substitutable: false` pins this call site to PGlite
  */
-export declare const create_pglite_factory: (init_schema: (db: Db) => Promise<void>) => DbFactory;
+export declare const create_pglite_factory: (init_schema: (db: Db) => Promise<void>, options?: CreatePgliteFactoryOptions) => DbFactory;
 /**
  * Create a pg (PostgreSQL) database factory for tests.
  *

package/dist/testing/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAMtC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SAgEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAQnE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,GACrC,IAAI,EAAE,EACN,OAAO,MAAM,EACb,SAAS,aAAa,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,IAAI,CAId,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAMtC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAQF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAErF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,GAAI,gBAAgB,gBAAgB,GAAG,IAAI,KAAG,IAEnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,UAAU,0BAA0B,KAClC,SAyBF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SAgEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAQnE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,GACrC,IAAI,EAAE,EACN,OAAO,MAAM,EACb,SAAS,aAAa,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,IAAI,CAId,CAAC"}

package/dist/testing/db.js

@@ -33,10 +33,11 @@ import { query_public_columns } from '../db/schema_ready.js';
  */
 export const IS_CI = process.env.CI === 'true';
 /**
- * Reset a PGlite database to a clean state by dropping and recreating the public schema.
+ * Reset a test database to a clean state by dropping and recreating the public schema.
  *
  * Removes all tables, sequences, indexes, types, and functions.
- * The database instance remains usable after reset.
+ * The database instance remains usable after reset. Despite the name it issues
+ * plain SQL, so it also resets the other drivers the test factories hand out.
  *
  * @mutates db - drops the `public` schema and recreates it; all rows in all
  *   tables are gone after this returns.
@@ -45,40 +46,74 @@ export const reset_pglite = async (db) => {
     await db.query('DROP SCHEMA public CASCADE');
     await db.query('CREATE SCHEMA public');
 };
-// Module-level PGlite cache — shared across all factories in the same vitest worker (one test file).
-// Each vitest file runs in its own worker thread, so no cross-file contamination.
+// Module-level PGlite cache — one instance shared by the PGlite factories this
+// module builds, for as long as the module is loaded. Under the `db` project's
+// `isolate: false` + `fileParallelism: false` that is the whole run; a project
+// that isolates its files gets one per worker instead.
 let module_db = null;
+// The installed stand-in for `create_pglite_factory`, `null` when none is installed.
+let substitute_db_factory = null;
+/**
+ * Install a builder that stands in for `create_pglite_factory`, so suites
+ * written against PGlite can run against another driver without being edited.
+ *
+ * Injected rather than selected here: the drivers a substitute wraps live in
+ * test-side code this shipped module cannot import. A call site that passes
+ * `{substitutable: false}` keeps PGlite regardless. Pass `null` to uninstall.
+ *
+ * The slot is read when a factory is built, not when it creates a database,
+ * so install before the first `create_pglite_factory` call — a vitest
+ * `setupFiles` entry, which runs ahead of every test file's imports, is the
+ * shape fuz_app's own `db` project uses. A factory built earlier (including
+ * the module-level fallback in `testing/app_server.ts`) keeps the driver it
+ * was built with, and uninstalling does not revert it.
+ *
+ * @param create_factory - the builder to install, or `null` to remove the installed one
+ */
+export const set_substitute_db_factory = (create_factory) => {
+    substitute_db_factory = create_factory;
+};
 /**
  * Create a pglite (in-memory) database factory for tests.
  *
  * Always enabled — no external dependencies required.
- * Shares a single PGlite WASM instance across all factories in the same
- * vitest worker thread (one test file). Subsequent `create()` calls reset
- * the schema via `DROP SCHEMA public CASCADE` instead of paying the WASM
- * cold-start cost again.
+ * Shares a single PGlite WASM instance across the PGlite factories this module builds.
+ * Subsequent `create()` calls reset the schema via `DROP SCHEMA public CASCADE`
+ * instead of paying the WASM cold-start cost again.
+ *
+ * Returns the installed substitute's factory instead when one is installed and
+ * `options.substitutable` is not `false` — see `set_substitute_db_factory`.
  *
  * @param init_schema - callback to initialize the database schema
+ * @param options - `substitutable: false` pins this call site to PGlite
  */
-export const create_pglite_factory = (init_schema) => ({
-    name: 'pglite',
-    skip: false,
-    async create() {
-        if (module_db) {
-            await reset_pglite(module_db);
-        }
-        else {
-            const { PGlite } = await import('@electric-sql/pglite');
-            const pglite = new PGlite();
-            module_db = create_pglite_db(pglite).db;
-        }
-        await init_schema(module_db);
-        return module_db;
-    },
-    async close() {
-        // No-op: shared instance lives for the worker thread's lifetime.
-        // PGlite is cleaned up when the vitest worker exits.
+export const create_pglite_factory = (init_schema, options) => {
+    if (substitute_db_factory && options?.substitutable !== false) {
+        return substitute_db_factory(init_schema);
     }
-});
+    return {
+        name: 'pglite',
+        skip: false,
+        async create() {
+            if (module_db) {
+                await reset_pglite(module_db);
+            }
+            else {
+                const { PGlite } = await import('@electric-sql/pglite');
+                const pglite = new PGlite();
+                module_db = create_pglite_db(pglite).db;
+            }
+            await init_schema(module_db);
+            return module_db;
+        },
+        async close() {
+            // No-op: the instance is the module-level cache above, so it lives as long
+            // as this module stays loaded — under the `db` project's `isolate: false` +
+            // `fileParallelism: false` that is the whole run. Nothing frees the PGlite
+            // instance earlier.
+        }
+    };
+};
 /**
  * Create a pg (PostgreSQL) database factory for tests.
  *

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA07CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAs8CF,CAAC"}

package/dist/testing/integration.js

@@ -25,6 +25,7 @@ import { account_verify_action_spec, account_session_list_action_spec, account_s
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 import { LoginOutput, AccountStatusOutput } from '../auth/account_route_schema.js';
 import { test_if } from './cross_backend/capabilities.js';
+import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './cross_backend/wire_shapes.js';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 /**
  * Standard integration test suite for fuz_app auth routes.
@@ -343,6 +344,13 @@ export const describe_standard_integration_tests = (options) => {
                 // Single-actor keeper: actor resolved, role_grants populated.
                 assert.ok(parsed.actor, 'single-actor keeper must resolve a non-null actor');
                 assert.ok(parsed.role_grants.length > 0, 'single-actor keeper must have populated role_grants');
+                // Byte-shape gate: `z.string()` accepts a millisecond stamp too,
+                // so the schema parse above can't tell the two spines apart.
+                assert_iso8601_seconds(parsed.account.created_at, 'account.created_at');
+                for (const grant of parsed.role_grants) {
+                    assert_iso8601_seconds(grant.created_at, 'role_grant.created_at');
+                    assert_iso8601_seconds_nullable(grant.expires_at, 'role_grant.expires_at');
+                }
             });
         });
         // --- 2. Cookie attributes ---
@@ -419,7 +427,12 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.ok(list_res.ok, 'account_session_list should succeed');
                 assert.ok(list_res.result.sessions.length >= 1);
-                const session_id = list_res.result.sessions[0].id;
+                const session = list_res.result.sessions[0];
+                // Byte-shape gate on the session timestamps — see the account-status
+                // case for why the output schema alone can't catch the divergence.
+                assert_iso8601_seconds(session.created_at, 'session.created_at');
+                assert_iso8601_seconds(session.expires_at, 'session.expires_at');
+                const session_id = session.id;
                 // Revoke that session by ID
                 const revoke_res = await rpc_call_for_spec({
                     app: { request: fixture.transport },
@@ -691,7 +704,7 @@ export const describe_standard_integration_tests = (options) => {
                 // phase doesn't first demand an acting actor → `actor_required`)
                 // and input/param/query-free (params and query still validate ahead
                 // of the auth phase — only body validation moved behind the gates,
-                // per the 401 → authz → 403 → 400 order). Admin surfaces are
+                // per the 401 → authz → 403 → 429 → 400 order). Admin surfaces are
                 // RPC-first now; a consumer may expose no such REST route (fuz_app
                 // itself, zzz) — then this REST-era check is a no-op and RPC denial
                 // is covered by `describe_rpc_attack_surface_tests`.

package/dist/testing/round_trip.d.ts

@@ -1,5 +1,4 @@
 import './assert_dev_env.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest, TestFixture } from './cross_backend/setup.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
 /** Options for `describe_round_trip_validation`. */
@@ -16,8 +15,6 @@ export interface RoundTripTestOptions {
      * TS by the consumer; same shape for in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations — see `cross_backend/capabilities.ts`. */
-    capabilities: BackendCapabilities;
     /** Routes to skip, in `'METHOD /path'` format. */
     skip_routes?: Array<string>;
     /** Override generated bodies for specific routes (`'METHOD /path'` → body). */

package/dist/testing/round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA2B7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,mBAAmB,CAAC;IAClC,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IA6I9E,CAAC"}
+{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA2B7B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IAyI9E,CAAC"}

package/dist/testing/round_trip.js

@@ -36,10 +36,6 @@ import { resolve_valid_path, generate_valid_body } from './schema_generators.js'
 export const describe_round_trip_validation = (options) => {
     const describe_time_specs = options.surface_source.route_specs;
     const skip_set = new Set(options.skip_routes);
-    // `capabilities` is currently unused by this suite (no in-process-only
-    // reads, no transport-gated cases) but stays on the options for
-    // uniformity with the other Tier 1 suites.
-    void options.capabilities;
     describe('round-trip validation', () => {
         let fixture;
         let authed_account;

package/dist/testing/rpc_attack_surface.js

@@ -84,8 +84,8 @@ const describe_rpc_auth = (options) => {
                                     if (!app)
                                         throw new Error(`No test app for role '${wrong_role}'`);
                                     // Send valid params so the probe varies only the role. Dispatcher
-                                    // ordering is 401 → authz → 403 → 400, so the role gate trips
-                                    // ahead of validation regardless; valid params also keep the
+                                    // ordering is 401 → authz → 403 → 429 → 400, so the role gate
+                                    // trips ahead of validation regardless; valid params also keep the
                                     // authorization phase from answering `actor_required` first.
                                     const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
                                     const params = action ? generate_valid_body(action.spec.input) : undefined;

package/dist/testing/rpc_round_trip.d.ts

@@ -1,7 +1,6 @@
 import './assert_dev_env.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest, TestFixture } from './cross_backend/setup.js';
 import type { SessionOptions } from '../auth/session_cookie.js';
 /** Options for `describe_rpc_round_trip_tests`. */
@@ -14,8 +13,6 @@ export interface RpcRoundTripTestOptions {
      * in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /**
      * Session config — only needed to resolve factory-form `rpc_endpoints`
      * against a stub `AppServerContext` at setup time (the actions' input

package/dist/testing/rpc_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAyB7B,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IAgKhF,CAAC"}
+{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAyB7B,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA+JhF,CAAC"}

package/dist/testing/rpc_round_trip.js

@@ -88,7 +88,6 @@ export const describe_rpc_round_trip_tests = (options) => {
     // match what the running backend serves.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const surface_rpc_endpoints = options.surface_source.surface.rpc_endpoints;
-    void options.capabilities;
     describe('RPC round-trip validation', () => {
         let fixture;
         let authed_account;

package/dist/testing/schema_generators.d.ts

@@ -20,6 +20,21 @@ export declare const generate_valid_value: (field: ZodFieldInfo, field_schema: z
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.
+ *
+ * Without a params schema (or for a param the schema doesn't name) each
+ * `:name` becomes `test_<name>` — fine for an unconstrained segment. With
+ * one, `test_<name>` is still preferred wherever the field schema accepts
+ * it, because the param name in the URL is what makes a failure message
+ * readable. Only a segment that refuses it falls through: a `uuid` param
+ * takes the nil UUID (the fast path — by far the most common shape), and
+ * anything else is synthesized by `generate_valid_string`, so a
+ * format-constrained segment (a `blake3:…` fact hash, a `tok_…` id)
+ * resolves to a value its schema accepts instead of a `test_<name>` that
+ * 400s before the route's real gates run.
+ *
+ * The synthesized value is percent-encoded, and a value containing `/` is
+ * refused (it would silently add a path segment and route elsewhere) —
+ * both fall back to `test_<name>`.
  */
 export declare const resolve_valid_path: (path: string, params_schema?: z.ZodObject) => string;
 /**

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAsGF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}