@fuzdev/fuz_app 0.113.0 → 0.115.0

package/dist/testing/CLAUDE.md

@@ -544,16 +544,17 @@ Three layers:
 3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts). `build_broadcast_api<TApi>({harness, specs})` (in `ws_round_trip.ts`) wires a typed broadcast API against the harness transport.
 
 `WsClient` (in `transports/ws_client.ts`):
-`{send, request<R>, close, messages, wait_for, wait_for_close}`. The
-harness's `connect()` returns this shape; the cross-process
+`{send, request<R>, close, messages, wait_for, wait_for_close, close_code}`.
+The harness's `connect()` returns this shape; the cross-process
 `create_ws_transport` in `transports/ws_transport.ts` implements the same
 interface so assertion helpers and suite bodies work against either impl.
 `wait_for_close(timeout_ms?)` resolves `true` if the server closes the
 socket within the timeout, `false` on timeout (and `true` immediately when
 already closed) — the signal for server-initiated close (e.g. an auth-guard
 revocation), distinct from client-initiated `close()`. Mirrors the SSE frame
-reader's `wait_for_close`. `request` throws with
-code + message + data on error frames (so asserting `result.foo` on a
+reader's `wait_for_close`. `close_code` is the connection's close code once
+closed (`1006` for a drop without a close frame), `null` while open.
+`request` throws with code + message + data on error frames (so asserting `result.foo` on a
 failed request surfaces the real cause, not a `Cannot read property 'foo'
 of undefined`). `wait_for(predicate, timeout_ms?)` checks already-received
 messages first, then waits for new arrivals (default 1000ms); drops the
@@ -1079,10 +1080,13 @@ call (not folded into `describe_standard_cross_process_tests`) because it
 needs raw `base_url` / `ws_path` the standard bundle doesn't carry, mirroring
 how `describe_ws_round_trip_tests` sits beside `describe_standard_tests`
 in-process. `describe_cross_process_ws_tests({setup_test, capabilities,
-base_url, ws_path, origin?, rpc_path?})` opens a live `WebSocket` via
-`create_ws_transport` (the `ws` npm package) and asserts up to four cases
-against the upgrade stack `register_ws_endpoint` wires (origin →
+base_url, ws_path, origin?, rpc_path?, max_message_bytes?})` opens a live
+`WebSocket` via `create_ws_transport` (the `ws` npm package) and asserts
+cases against the upgrade stack `register_ws_endpoint` wires (origin →
 `require_auth` → dispatch): authed upgrade round-trips `heartbeat`,
+`heartbeat` admits only the parameterless shapes (a declared param →
+`invalid_params`), a message past `max_message_bytes` (default
+`DEFAULT_WS_MAX_MESSAGE_BYTES`) closes with `WS_CLOSE_MESSAGE_TOO_BIG`,
 anonymous upgrade refused, disallowed-origin upgrade refused, and — gated on
 `rpc_path` — a live socket drops when the account's sessions are revoked
 mid-connection (`account_session_revoke_all` over the keeper session channel
@@ -1144,11 +1148,12 @@ drives the whole round-trip and every outcome (success / `Timeout` / wrong-shape
 `on_request` responder **at construction** (the `create_ws_transport` seam) so
 the inbound server-initiated request is answered as soon as it arrives; the
 security negatives use the raw `WsClient.send` to inject unsolicited /
-cross-connection frames. Seven cases: the positive round-trip plus
+cross-connection frames. Cases: the positive round-trip plus
 unsolicited-response rejection, per-connection id isolation, never-reply
-`Timeout`, wrong-shape rejection, client-error forwarding, and the HTTP
-no-transport path. Gated on `capabilities.peer_request` — `true` on both the
-Rust spine and the TS spine (the `BackendWebsocketTransport.request_connection`
+`Timeout`, wrong-shape rejection, an undeclared reply key accepted and dropped
+(both spines read the reply forward-compatibly), client-error forwarding, and
+the HTTP no-transport path. Gated on `capabilities.peer_request` — `true` on
+both the Rust spine and the TS spine (the `BackendWebsocketTransport.request_connection`
 path + `register_action_ws` response correlation); `peer/ping` is a protocol
 action (manifest-excluded), so parity is behavioral here, not via the manifest
 gate. Cross-process only; fuz_app's own wiring is
@@ -1232,8 +1237,11 @@ the option type states whether the bundle is read.
   (gate on `capabilities.cell_gated_create`, **cross-only**) — the parent-aware
   cell-creation authorizer (`CellCreateAuthorize`, **directory model**) +
   the `cell_moderate` verb parity proofs. Both spines mount the same
-  `test_cell_gated_create_authorize` policy: a `kind: 'space'` **root** is
-  admin-only (a non-admin → **403** `cell_create_forbidden`); a **contribution**
+  `test_cell_gated_create_authorize` policy (its admin bypass and `min_role`
+  read the **global** grant): a `kind: 'space'` **root** is
+  admin-only (a non-admin → **403** `cell_create_forbidden`, and the same for a
+  non-admin `cell_clone` of a viewable space — clone runs the authorizer for
+  every cell it writes); a **contribution**
   under a space is gated by the root's `data.policy[kind] = {min_role,
 moderation_required}`, with `moderation` set per the verdict (`pending`+private
   vs `approved`+author-visibility); a **hidden** parent **404**-masks vs a
@@ -1284,7 +1292,7 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   transport carries the keeper session cookie in its jar after this call
   resolves.
 - `testing/transports/ws_client.ts` — shared `WsClient` interface (`send` /
-  `request` / `close` / `messages` / `wait_for` / `wait_for_close`),
+  `request` / `close` / `messages` / `wait_for` / `wait_for_close` / `close_code`),
   wire-frame types, and
   predicates (`is_notification`, `is_response_for`, ...). Both in-process
   (`ws_round_trip.ts`) and cross-process (`ws_transport.ts`) impls satisfy
@@ -1614,12 +1622,17 @@ non-admin _holder_ of `participant` (and a fresh non-admin) can't offer it (403
 `role_grant_assign` is admin-only** — non-admin holder / fresh → 403
 `insufficient_permissions` (dispatcher gate), anon → 401; plus the
 `to_actor_id`-must-belong-to-`to_account_id` resolution arm (400
-`role_grant_offer_actor_account_mismatch`).
+`role_grant_offer_actor_account_mismatch`); **(d) builtin roles are
+global-only** — an unpaired `scope_kind` / `scope_id` → 400 on assign + offer,
+a scoped `admin` → 400 `role_grant_builtin_scoped` on assign + offer, a builtin
+offer from a non-global-admin → 403 `role_grant_offer_not_authorized`.
 
 `describe_role_grant_participation_cross_tests` (this module) is the **imperative
 escape hatch** for the multi-step success paths a static row can't express (they
 need a real recipient): admin **assigns** `participant` to a fresh account
-(`{ok, role_grant_id}` + idempotent re-assign), and admin **offers**
+(`{ok, role_grant_id}` + idempotent re-assign), admin **assigns** a scoped
+`participant` whose `scope_kind` + `scope_id` round-trip through
+`admin_account_list` (distinct from the global grant), and admin **offers**
 `participant` → recipient **accepts** → a role_grant lands. The `role_holder`
 principal is seeded via `extra_accounts: [{username, roles: ['participant']}]`
 (bootstrap-cradle direct grant) and named through `principals.role_holder`.

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwPF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAwHF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwPF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAyKF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -30,6 +30,9 @@ import '../assert_dev_env.js';
  *   **private** space the caller can't view → **404** `cell_not_found` (the
  *   parent is masked); under a **public** space → **403** (you see it, you
  *   can't contribute).
+ * - **clone is no side door** — `cell_clone` runs the authorizer for every cell
+ *   it writes as a parentless create, so a non-admin clone of a viewable
+ *   `space` root → **403** `cell_create_forbidden`; admin → succeeds.
  *
  * Gated on `capabilities.cell_gated_create` — `true` only on the reference
  * spine binaries that mount the policy, so it skips for generic consumers and
@@ -41,7 +44,8 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput, CellModerateOutput } from '../../auth/cell_action_specs.js';
+import { CellCloneOutput, CellCreateOutput, CellModerateOutput } from '../../auth/cell_action_specs.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -211,4 +215,22 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.strictEqual(moderated.cell.visibility, 'private', 'rejection leaves the post private');
         });
     });
+    describe('cell_clone runs the creation authorizer (parity)', () => {
+        test_if(capabilities.cell_gated_create, 'a non-admin clone of a viewable `space` root → 403, admin clone succeeds', async () => {
+            const fixture = await setup_test();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            // Every cell a clone writes is a parentless create of the source's
+            // kind, gated like `cell_create` — so a caller denied a `space` root
+            // can't clone one they can see into one they own.
+            const stranger = await fixture.create_account({ username: 'clone_stranger' });
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_clone', { source_id: space.cell.id }, stranger.create_session_headers());
+            assert.ok(!denied.ok, 'a non-admin must not clone a space root');
+            assert.strictEqual(denied.error?.code, JSONRPC_ERROR_CODES.forbidden, 'a 403');
+            assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
+            const cloned = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_clone', { source_id: space.cell.id }, fixture.create_session_headers()), CellCloneOutput);
+            assert.strictEqual(cloned.cell.kind, SPACE_CELL_KIND, 'the admin clones the space');
+            assert.notStrictEqual(cloned.cell.id, space.cell.id);
+            assert.strictEqual(cloned.cell.moderation, null, 'a clone stamps no moderation');
+        });
+    });
 };

package/dist/testing/cross_backend/peer_ping_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peer_ping_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/peer_ping_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAuB5C,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,qBAAqB,KAAG,IAwN5E,CAAC"}
+{"version":3,"file":"peer_ping_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/peer_ping_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAuB5C,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,qBAAqB,KAAG,IA8O5E,CAAC"}

package/dist/testing/cross_backend/peer_ping_ws.js

@@ -136,6 +136,24 @@ export const describe_peer_ping_ws_tests = (options) => {
                 await ws.close();
             }
         });
+        // A newer client may add reply fields: both spines read the reply
+        // forward-compatibly (serde's default / `safe_parse_dropping_unknown_keys`)
+        // and return only the declared shape.
+        test_if(capabilities.peer_request, 'a reply with an undeclared key is accepted and the key is dropped', async () => {
+            const fixture = await setup_test();
+            const ws = await open_ws(fixture.create_session_headers().cookie, (req) => {
+                const nonce = req.params?.nonce ?? 0;
+                return { result: { ...valid_reply(nonce), added_later: true } };
+            });
+            try {
+                const frame = await ping_raw(ws, 6, { nonce: 5, timeout_ms: 2000 });
+                assert.ok('result' in frame, `expected success, got ${JSON.stringify(frame)}`);
+                assert.deepStrictEqual(frame.result, valid_reply(5));
+            }
+            finally {
+                await ws.close();
+            }
+        });
         test_if(capabilities.peer_request, 'a client JSON-RPC error reply surfaces as the action error (ClientError forwarded)', async () => {
             const fixture = await setup_test();
             const ws = await open_ws(fixture.create_session_headers().cookie, () => ({

package/dist/testing/cross_backend/role_grant_participation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IAgFF,CAAC"}
+{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA8IF,CAAC"}

package/dist/testing/cross_backend/role_grant_participation.js

@@ -15,6 +15,9 @@ import '../assert_dev_env.js';
  *   re-assigning the active grant is idempotent (same id).
  * - **consent flow** — `role_grant_offer_create` of `participant` (admin-only)
  *   → the recipient `role_grant_offer_accept`s → a role_grant lands.
+ * - **scoped assign** — `role_grant_assign` of `participant` with a paired
+ *   `scope_kind` + `scope_id` lands a scoped grant carrying both, read back
+ *   through `admin_account_list`, distinct from the global grant.
  *
  * The single-request gate/denial matrix (grantability refusal, admin-only
  * conferral, dispatcher admin gate, auth) lives in the declarative table
@@ -55,6 +58,37 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             assert.ok(second.ok, `re-assign must succeed: ${JSON.stringify(second)}`);
             assert.strictEqual(second.result.role_grant_id, assigned.role_grant_id, 're-assigning an active grant returns the existing role_grant id');
         });
+        test('admin assigns a scoped participant grant that round-trips scope_kind', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_scoped' });
+            const scope_id = '33333333-3333-4333-8333-333333333333';
+            const scoped = await rpc(fixture.transport, 'role_grant_assign', {
+                to_account_id: recipient.account.id,
+                role: SPINE_PARTICIPANT_ROLE,
+                scope_kind: 'space',
+                scope_id
+            }, fixture.create_session_headers());
+            assert.ok(scoped.ok, `scoped assign must succeed: ${JSON.stringify(scoped)}`);
+            const scoped_id = scoped.result.role_grant_id;
+            const global = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(global.ok, `global assign must succeed: ${JSON.stringify(global)}`);
+            const global_id = global.result.role_grant_id;
+            assert.notStrictEqual(global_id, scoped_id, 'the global grant is a distinct row');
+            const listed = await rpc(fixture.transport, 'admin_account_list', {}, fixture.create_session_headers());
+            assert.ok(listed.ok, `admin_account_list must succeed: ${JSON.stringify(listed)}`);
+            const entry = listed.result.accounts.find((a) => a.account.id === recipient.account.id);
+            assert.ok(entry, 'the recipient is listed');
+            const by_id = new Map(entry.role_grants.map((g) => [g.id, g]));
+            const scoped_row = by_id.get(scoped_id);
+            assert.ok(scoped_row, 'the scoped grant is listed');
+            assert.strictEqual(scoped_row.role, SPINE_PARTICIPANT_ROLE);
+            assert.strictEqual(scoped_row.scope_kind, 'space', 'scope_kind round-trips');
+            assert.strictEqual(scoped_row.scope_id, scope_id, 'scope_id round-trips');
+            const global_row = by_id.get(global_id);
+            assert.ok(global_row, 'the global grant is listed');
+            assert.strictEqual(global_row.scope_kind, null);
+            assert.strictEqual(global_row.scope_id, null);
+        });
         test('admin offers the participant app-role and the recipient accepts', async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ username: 'participation_offeree' });

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -2,6 +2,14 @@ import '../assert_dev_env.js';
 import type { BackendConfig } from './backend_config.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export declare const RUST_SPINE_STUB_BIN_ENV = "FUZ_TESTING_RUST_SPINE_STUB_BIN";
+/**
+ * Env var overriding the stub's Postgres URL when `database_url` is omitted —
+ * e.g. a scratch cluster on a spare port, keeping the run off the machine's
+ * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
+ * idempotent `createdb` reads, so the database it ensures is the one the URL
+ * names.
+ */
+export declare const RUST_SPINE_STUB_DATABASE_URL_ENV = "FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL";
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
@@ -16,7 +24,10 @@ export declare const RUST_SPINE_STUB_DEFAULT_DATABASE_URL = "postgres://localhos
 export interface SpineStubBackendConfigOptions {
     /** Listening port. Default `RUST_SPINE_STUB_DEFAULT_PORT`. */
     readonly port?: number;
-    /** Postgres connection URL. Default `RUST_SPINE_STUB_DEFAULT_DATABASE_URL`. */
+    /**
+     * Postgres connection URL. Default `$FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL`,
+     * then `RUST_SPINE_STUB_DEFAULT_DATABASE_URL`.
+     */
     readonly database_url?: string;
     /**
      * Prebuilt binary path. Overrides the `FUZ_TESTING_RUST_SPINE_STUB_BIN` env

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAiDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -25,6 +25,9 @@ import '../assert_dev_env.js';
  * createdb fuz_app_test_rust_spine_stub 2>/dev/null || true
  * ```
  *
+ * `FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL` points the stub at another
+ * server (e.g. a scratch cluster on a spare port).
+ *
  * The binary self-wipes the auth-namespace schema on every boot
  * (`FUZ_TESTING_RESET_DB_ON_STARTUP=true`, set by the Rust-family builder),
  * so no manual `DROP TABLE` between sessions is needed; per-test reset is
@@ -39,6 +42,14 @@ import { SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
 import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
+/**
+ * Env var overriding the stub's Postgres URL when `database_url` is omitted —
+ * e.g. a scratch cluster on a spare port, keeping the run off the machine's
+ * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
+ * idempotent `createdb` reads, so the database it ensures is the one the URL
+ * names.
+ */
+export const RUST_SPINE_STUB_DATABASE_URL_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL';
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
@@ -77,7 +88,8 @@ export const RUST_SPINE_STUB_DEFAULT_DATABASE_URL = 'postgres://localhost/fuz_ap
  * @throws Error when no binary path is available.
  */
 export const rust_spine_stub_backend_config = (options = {}) => {
-    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], enable_login_rate_limit, trusted_proxies } = options;
+    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = process.env[RUST_SPINE_STUB_DATABASE_URL_ENV] ||
+        RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], enable_login_rate_limit, trusted_proxies } = options;
     if (!binary_path) {
         throw new Error(`rust_spine_stub_backend_config: no binary path — set ${RUST_SPINE_STUB_BIN_ENV} to a prebuilt ` +
             '`testing_spine_stub` binary (build it with `cargo build -p testing_spine_stub --release`) ' +

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAoB9C,CAAC"}
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -6,15 +6,15 @@ import '../assert_dev_env.js';
  * the parent-aware cell-creation authorizer agrees TS↔Rust. The twin of the
  * Rust `TestCellGatedCreateAuthorize`, **directory model**.
  *
- * Admin bypasses everything (`{allow: true, moderation_required: false}`). For
- * a non-admin:
+ * A **global** admin bypasses everything (`{allow: true, moderation_required:
+ * false}`) — a scoped `admin` row is no admin here. For anyone else:
  *
  * - **Root creation** (`root_id` null): `kind: 'space'` is admin-only (denied);
  *   every other parentless kind stays open, so the plain-create `cell_crud` /
  *   `cell_relations` suites are unaffected.
  * - **Contribution** (`root_id` set): the governing root's
  *   `data.policy[kind] = {min_role?, moderation_required?}` decides — a missing
- *   entry denies, a present `min_role` the actor lacks denies, and otherwise it
+ *   entry denies, a present `min_role` the actor lacks globally denies, and otherwise it
  *   admits with the entry's `moderation_required` folded into the verdict. The
  *   root's `data` arrives in `input.root_data` (the handler read it in-tx), so
  *   the predicate is **pure** — no DB read of its own (which also dodges the
@@ -25,7 +25,7 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import { has_role } from '../../auth/request_context.js';
+import { has_scoped_role } from '../../auth/request_context.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
 /** The admin-only root kind the test policy gates (talk's `space` analog). */
@@ -54,8 +54,9 @@ const get_contribution_rule = (data, kind) => {
  * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
  */
 export const test_cell_gated_create_authorize = (auth, input) => {
-    // Admin bypass — admins create roots + any kind, live immediately.
-    if (has_role(auth, ROLE_ADMIN))
+    // Admin bypass — admins create roots + any kind, live immediately. The
+    // global grant only: a scoped `admin` row bypasses nothing.
+    if (has_scoped_role(auth, ROLE_ADMIN, null))
         return { allow: true, moderation_required: false };
     // Root creation (no governing root): `space` is admin-only; other parentless
     // kinds stay open (the plain-create suites).
@@ -68,7 +69,8 @@ export const test_cell_gated_create_authorize = (auth, input) => {
     const rule = get_contribution_rule(input.root_data, input.kind ?? '');
     if (!rule)
         return { allow: false };
-    const admitted = rule.min_role === undefined || has_role(auth, rule.min_role);
+    // `min_role` names no scope, so only the global grant satisfies it.
+    const admitted = rule.min_role === undefined || has_scoped_role(auth, rule.min_role, null);
     return admitted
         ? { allow: true, moderation_required: rule.moderation_required ?? false }
         : { allow: false };

package/dist/testing/cross_backend/ws_round_trip.d.ts

@@ -24,11 +24,19 @@ export interface CrossProcessWsTestOptions {
      * actions being mounted on the RPC endpoint.
      */
     readonly rpc_path?: string;
+    /**
+     * The backend's inbound WebSocket message cap, in bytes — the
+     * oversized-message case sends a message just past it. Defaults to
+     * `DEFAULT_WS_MAX_MESSAGE_BYTES`; pass the consumer's value when it raises
+     * the server cap.
+     */
+    readonly max_message_bytes?: number;
 }
 /**
- * Register the cross-process WS round-trip suite. Up to four cases over a
- * real upgrade: authed `heartbeat` round-trip, anonymous-upgrade refusal,
- * disallowed-origin refusal, and — when `rpc_path` is supplied —
+ * Register the cross-process WS round-trip suite over a real upgrade: authed
+ * `heartbeat` round-trip, `heartbeat`'s parameterless-shape contract, an
+ * oversized message closing with `WS_CLOSE_MESSAGE_TOO_BIG`, anonymous-upgrade
+ * refusal, disallowed-origin refusal, and — when `rpc_path` is supplied —
  * session-revocation closing the live socket.
  */
 export declare const describe_cross_process_ws_tests: (options: CrossProcessWsTestOptions) => void;

package/dist/testing/cross_backend/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,yBAAyB,KAAG,IAsEpF,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,yBAAyB,KAAG,IAwIpF,CAAC"}

package/dist/testing/cross_backend/ws_round_trip.js

@@ -24,7 +24,13 @@ import '../assert_dev_env.js';
  * upgrade time (not per message), so the negative cases assert the upgrade
  * itself rejects rather than a per-message error frame.
  *
- * A fourth case (gated on `rpc_path`) covers server-initiated close: an
+ * Two spine-parity cases follow: `heartbeat` answers the parameterless shapes
+ * (absent, `{}`) and refuses a declared param with `invalid_params`, and a
+ * message over the backend's cap (`max_message_bytes`, default
+ * `DEFAULT_WS_MAX_MESSAGE_BYTES`) closes the socket with
+ * `WS_CLOSE_MESSAGE_TOO_BIG`.
+ *
+ * A final case (gated on `rpc_path`) covers server-initiated close: an
  * authenticated socket is dropped when the account's sessions are revoked
  * mid-connection. Per-message dispatch never re-checks credential validity,
  * so the live socket survives on the audit-fed `create_ws_auth_guard` seam —
@@ -43,29 +49,31 @@ import '../assert_dev_env.js';
 import { assert, describe } from 'vitest';
 import { assert_rejects } from '@fuzdev/fuz_util/testing.ts';
 import { heartbeat_action_spec } from '../../actions/heartbeat.js';
+import { DEFAULT_WS_MAX_MESSAGE_BYTES, WS_CLOSE_MESSAGE_TOO_BIG } from '../../actions/transports.js';
 import { account_session_revoke_all_action_spec } from '../../auth/account_action_specs.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { is_response_for } from '../transports/ws_client.js';
 import { create_ws_transport } from '../transports/ws_transport.js';
 import { create_rpc_post_init } from '../rpc_helpers.js';
 import { test_if } from './capabilities.js';
 /** Origin guaranteed to fail the `http://localhost:*` allowlist the test backends run with. */
 const DISALLOWED_ORIGIN = 'http://disallowed.example';
 /**
- * Register the cross-process WS round-trip suite. Up to four cases over a
- * real upgrade: authed `heartbeat` round-trip, anonymous-upgrade refusal,
- * disallowed-origin refusal, and — when `rpc_path` is supplied —
+ * Register the cross-process WS round-trip suite over a real upgrade: authed
+ * `heartbeat` round-trip, `heartbeat`'s parameterless-shape contract, an
+ * oversized message closing with `WS_CLOSE_MESSAGE_TOO_BIG`, anonymous-upgrade
+ * refusal, disallowed-origin refusal, and — when `rpc_path` is supplied —
  * session-revocation closing the live socket.
  */
 export const describe_cross_process_ws_tests = (options) => {
-    const { setup_test, capabilities, base_url, ws_path, origin, rpc_path } = options;
+    const { setup_test, capabilities, base_url, ws_path, origin, rpc_path, max_message_bytes = DEFAULT_WS_MAX_MESSAGE_BYTES } = options;
+    const open_authed = async () => {
+        const fixture = await setup_test();
+        return create_ws_transport({ base_url, ws_path, cookies: fixture.transport.cookies(), origin });
+    };
     describe('cross-process websocket', () => {
         test_if(capabilities.ws, 'authenticated upgrade round-trips heartbeat', async () => {
-            const fixture = await setup_test();
-            const client = await create_ws_transport({
-                base_url,
-                ws_path,
-                cookies: fixture.transport.cookies(),
-                origin
-            });
+            const client = await open_authed();
             try {
                 const result = await client.request(1, heartbeat_action_spec.method, {});
                 assert.deepStrictEqual(result, {}, 'heartbeat returns an empty result over the wire');
@@ -74,6 +82,60 @@ export const describe_cross_process_ws_tests = (options) => {
                 await client.close();
             }
         });
+        // `heartbeat` is parameterless on both spines (`z.void()` /
+        // `require_void_params`): the empty shapes are the no-arg call, and a
+        // declared param is `invalid_params`, not ignored.
+        test_if(capabilities.ws, 'heartbeat admits only the parameterless shapes', async () => {
+            const client = await open_authed();
+            try {
+                const cases = [
+                    [1, {}, true],
+                    [2, { params: {} }, true],
+                    [3, { params: { stray: 1 } }, false]
+                ];
+                for (const [id, params, ok] of cases) {
+                    await client.send({
+                        jsonrpc: '2.0',
+                        id,
+                        method: heartbeat_action_spec.method,
+                        ...params
+                    });
+                    const frame = await client.wait_for(is_response_for(id));
+                    const label = JSON.stringify(params);
+                    if (ok) {
+                        assert.ok('result' in frame, `${label}: ${JSON.stringify(frame)}`);
+                        assert.deepStrictEqual(frame.result, {}, label);
+                    }
+                    else {
+                        assert.ok('error' in frame, `${label}: ${JSON.stringify(frame)}`);
+                        assert.strictEqual(frame.error.code, JSONRPC_ERROR_CODES.invalid_params, label);
+                    }
+                }
+            }
+            finally {
+                await client.close();
+            }
+        });
+        // Both spines cap an inbound message (`DEFAULT_WS_MAX_MESSAGE_BYTES` by
+        // default) and close the socket on a larger one rather than replying.
+        test_if(capabilities.ws, 'an oversized message closes the socket with WS_CLOSE_MESSAGE_TOO_BIG', async () => {
+            const client = await open_authed();
+            try {
+                await client.send({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: heartbeat_action_spec.method,
+                    params: { pad: 'x'.repeat(max_message_bytes) }
+                });
+                const closed = await client.wait_for_close(5000);
+                assert.ok(closed, 'socket did not close within 5s of an oversized message');
+                assert.strictEqual(client.close_code, WS_CLOSE_MESSAGE_TOO_BIG);
+            }
+            finally {
+                // the server may reset the connection under the unread tail
+                await client.close().catch(() => { });
+            }
+        });
         // Per-connection auth fires at upgrade time (`require_auth`), so an
         // anonymous socket never opens — the upgrade is refused outright.
         test_if(capabilities.ws, 'anonymous upgrade is refused', async () => {

package/dist/testing/entities.d.ts

@@ -1,7 +1,7 @@
 import './assert_dev_env.js';
 import type { Account, Actor, RoleGrant } from '../auth/account_schema.js';
 import type { AuditLogEvent } from '../auth/audit_log_schema.js';
-import type { RequestContext } from '../auth/request_context.js';
+import type { RequestActorContext } from '../auth/request_context.js';
 /** Override type for `create_test_account` — id-like fields accept plain `string`. */
 export type TestAccountOverrides = Partial<Omit<Account, 'id' | 'created_by' | 'updated_by'>> & {
     id?: string;
@@ -30,8 +30,11 @@ export type TestRoleGrantOverrides = Partial<Omit<RoleGrant, 'id' | 'actor_id' |
 };
 /** Create a test `RoleGrant` with sensible defaults. */
 export declare const create_test_role_grant: (overrides?: TestRoleGrantOverrides) => RoleGrant;
-/** Create a test `RequestContext` with role_grants from partial overrides. */
-export declare const create_test_context: (role_grants?: Array<TestRoleGrantOverrides>) => RequestContext;
+/**
+ * Create a test `RequestActorContext` (a `RequestContext` with a resolved
+ * actor) with role_grants from partial overrides.
+ */
+export declare const create_test_context: (role_grants?: Array<TestRoleGrantOverrides>) => RequestActorContext;
 /** Override type for `create_test_audit_event` — id-like fields accept plain `string`. */
 export type TestAuditEventOverrides = Partial<Omit<AuditLogEvent, 'id' | 'actor_id' | 'account_id' | 'target_account_id' | 'target_actor_id'>> & {
     id?: string;

package/dist/testing/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/entities.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC/F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,GAAI,YAAY,oBAAoB,KAAG,OAarE,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC3F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,GAAI,YAAY,kBAAkB,KAAG,KAUjE,CAAC;AAEH,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAC3C,IAAI,CACH,SAAS,EACT,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAC/F,CACD,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,GAAI,YAAY,sBAAsB,KAAG,SAgB3E,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,GAC/B,cAAa,KAAK,CAAC,sBAAsB,CAAQ,KAC/C,cAID,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,CAAC,CAC/F,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,GAAI,YAAY,uBAAuB,KAAG,aAa5E,CAAC"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/entities.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC/F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,GAAI,YAAY,oBAAoB,KAAG,OAarE,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC3F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,GAAI,YAAY,kBAAkB,KAAG,KAUjE,CAAC;AAEH,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAC3C,IAAI,CACH,SAAS,EACT,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAC/F,CACD,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,GAAI,YAAY,sBAAsB,KAAG,SAgB3E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAa,KAAK,CAAC,sBAAsB,CAAQ,KAC/C,mBAID,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,CAAC,CAC/F,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,GAAI,YAAY,uBAAuB,KAAG,aAa5E,CAAC"}

package/dist/testing/entities.js

@@ -44,7 +44,10 @@ export const create_test_role_grant = (overrides) => {
     };
     return overrides ? { ...base, ...overrides } : base;
 };
-/** Create a test `RequestContext` with role_grants from partial overrides. */
+/**
+ * Create a test `RequestActorContext` (a `RequestContext` with a resolved
+ * actor) with role_grants from partial overrides.
+ */
 export const create_test_context = (role_grants = [{}]) => ({
     account: create_test_account(),
     actor: create_test_actor(),

package/dist/testing/transports/ws_client.d.ts

@@ -124,6 +124,12 @@ export interface WsClient {
      * in `testing/sse_round_trip.ts`.
      */
     wait_for_close: (timeout_ms?: number) => Promise<boolean>;
+    /**
+     * The close code of the connection once it has closed — the server's
+     * (e.g. `WS_CLOSE_MESSAGE_TOO_BIG`), the test's own, or `1006` when the
+     * connection dropped without a close frame. `null` while open.
+     */
+    readonly close_code: number | null;
     /** Every message the server has sent, in arrival order. */
     readonly messages: ReadonlyArray<unknown>;
     /**

package/dist/testing/transports/ws_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_client.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_client.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAa7E,MAAM,WAAW,wBAAwB,CAAC,CAAC,GAAG,OAAO;IACpD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,CAAC,CAAC;CACV;AAED,MAAM,WAAW,2BAA2B,CAAC,CAAC,GAAG,OAAO;IACvD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC,GAAG,OAAO;IACrD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CACnD;AAQD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,MACd,KAAK,OAAO,KAAG,OACsC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAC/B,CAAC,EAAE,QAAQ,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,MAChD,KAAK,OAAO,KAAG,GAAG,IAAI,wBAAwB,CAAC,CAAC,CAGE,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,eAAe,GAC1B,IAAI,MAAM,GAAG,MAAM,MACnB,KAAK,OAAO,KAAG,OAC8D,CAAC;AAQhF,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACxB,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;IACrC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC7B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAChC,OAAO,EAAE,cAAc,KACnB,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,QAAQ,OAAO,EACf,UAAU,KAAK,CAAC,OAAO,CAAC,EACxB,SAAS,KAAK,CAAC,QAAQ,CAAC,EACxB,YAAY,kBAAkB,GAAG,SAAS,EAC1C,OAAO,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAC/B,IAaF,CAAC;AA8BF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACxB;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EACpB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,UAAU,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB;;;;;OAKG;IACH,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,EAAE;QACT,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,GAAG,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrF,CAAC;CACF"}
+{"version":3,"file":"ws_client.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_client.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAa7E,MAAM,WAAW,wBAAwB,CAAC,CAAC,GAAG,OAAO;IACpD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,CAAC,CAAC;CACV;AAED,MAAM,WAAW,2BAA2B,CAAC,CAAC,GAAG,OAAO;IACvD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC,GAAG,OAAO;IACrD,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CACnD;AAQD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,MACd,KAAK,OAAO,KAAG,OACsC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAC/B,CAAC,EAAE,QAAQ,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,MAChD,KAAK,OAAO,KAAG,GAAG,IAAI,wBAAwB,CAAC,CAAC,CAGE,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,eAAe,GAC1B,IAAI,MAAM,GAAG,MAAM,MACnB,KAAK,OAAO,KAAG,OAC8D,CAAC;AAQhF,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACxB,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;IACrC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC7B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAChC,OAAO,EAAE,cAAc,KACnB,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,QAAQ,OAAO,EACf,UAAU,KAAK,CAAC,OAAO,CAAC,EACxB,SAAS,KAAK,CAAC,QAAQ,CAAC,EACxB,YAAY,kBAAkB,GAAG,SAAS,EAC1C,OAAO,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAC/B,IAaF,CAAC;AA8BF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACxB;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EACpB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,UAAU,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB;;;;;OAKG;IACH,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,EAAE;QACT,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,GAAG,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrF,CAAC;CACF"}

package/dist/testing/transports/ws_transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_transport.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_transport.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,gBAAgB,CAAC;AAGxB,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,QAAQ,CA8IvF,CAAC"}
+{"version":3,"file":"ws_transport.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_transport.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,gBAAgB,CAAC;AAGxB,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,QAAQ,CAmJvF,CAAC"}