@fuzdev/fuz_app 0.118.0 → 0.120.0

package/dist/testing/audit_drift_guard.js

@@ -1,7 +1,6 @@
 import './assert_dev_env.js';
 import { assert, beforeEach, afterEach } from 'vitest';
 import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures } from '../auth/audit_log_queries.js';
-import { create_audit_emitter } from '../auth/audit_emitter.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
@@ -95,44 +94,3 @@ export const create_recording_audit_emitter = (calls_ref) => {
     };
     return { emitter, calls };
 };
-/**
- * Build an `audit_factory` that produces a real `create_audit_emitter`
- * with its `emit` decorated to push a `{kind: 'emit', at: seq.value++}`
- * marker into a shared sequence + events array. Used by the close-vs-emit
- * ordering test to compose against a shared sequence counter (typically
- * `create_recording_closer(seq_ref)` capturing eager-close calls).
- *
- * Pass the returned factory through `create_test_app({audit_factory: …})`
- * — the test backend invokes it with its constructed `{db, log}` and
- * lands the decorated emitter on `backend.deps.audit`. Production
- * handlers dereference `deps.audit.emit` at call time, so the decorator
- * sees every subsequent handler invocation. The underlying `emit` still
- * runs — the decorator records the call, it does not suppress side
- * effects.
- *
- * **Scope — both `emit` and `emit_role_grant_target`.** The decorator
- * is captured by `emit_role_grant_target`'s closure inside
- * `create_audit_emitter` (and re-exposed as the outer `emit` slot), so
- * role-grant-shape emissions land in `events_ref` alongside bare `emit`
- * calls. `emit_pool` and `notify` are not decorated — they take
- * `AuditLogInput` / `AuditLogEvent` directly without going through
- * `emit`, so `emit_pool` writes skip capture. Close-firing handlers all reach for
- * `emit` or `emit_role_grant_target`, so the ordering test sees them
- * regardless of which entry point a future refactor picks.
- *
- * Optionally accept `extra_options` to thread `on_audit_event` /
- * `audit_log_config` into the inner emitter — useful when a test wants
- * both ordering capture and a real SSE/WS guard wired into the same
- * emitter chain.
- */
-export const create_emit_ordering_audit_factory = (seq_ref, events_ref, extra_options) => {
-    return ({ db, log }) => create_audit_emitter({
-        ...extra_options,
-        db,
-        log,
-        emit_decorator: (inner) => (ctx, input) => {
-            events_ref.push({ kind: 'emit', at: seq_ref.value++ });
-            inner(ctx, input);
-        }
-    });
-};

package/dist/testing/connection_closer_helpers.d.ts

@@ -1,15 +1,9 @@
 import './assert_dev_env.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
-/**
- * Record of a single `ConnectionCloser` method invocation. `at` is the
- * value of a monotonically-increasing sequence counter at the time of
- * the call — pair with `create_emit_ordering_audit_factory` to record both
- * close + audit emit calls into the same sequence for ordering tests.
- */
+/** Record of a single `ConnectionCloser` method invocation. */
 export interface RecordedClose {
     method: 'session' | 'token' | 'account';
     id: string;
-    at: number;
 }
 export interface RecordingCloser {
     closer: ConnectionCloser;
@@ -17,24 +11,17 @@ export interface RecordingCloser {
 }
 /**
  * Build a `ConnectionCloser` that records every call into `calls` rather
- * than touching real transports. Each method returns 1 ("one socket
- * closed") regardless of whether a real socket exists — handlers
- * typically ignore the return value.
+ * than touching real transports. Each method returns 1 ("one connection
+ * closed") regardless of whether a real connection exists — handlers
+ * ignore the return value.
  *
- * Pass `seq_ref` to share the sequence counter with a sibling
- * `create_emit_ordering_audit_factory` so tests can pin close-vs-emit
- * ordering at the handler call site. Without `seq_ref`, the closer
- * uses a fresh internal counter — `at: N` values within a single test
- * are meaningful, but cannot be compared against audit emit ordering.
+ * To see a handler's closes, add the closer to the backend's
+ * `deps.connection_closer` (`RealtimeCloser.add`), or build the action
+ * factory's deps with it.
  */
-export declare const create_recording_closer: (seq_ref?: {
-    value: number;
-}) => RecordingCloser;
+export declare const create_recording_closer: () => RecordingCloser;
 /**
- * Pin `{method, id}` on a single recorded close call without baking in
- * the `at: N` sequence number. Use at every "did the closer fire?"
- * assertion site; the sequence number is only meaningful for dedicated
- * ordering tests (paired with `create_emit_ordering_audit_factory`).
+ * Pin `{method, id}` on a single recorded close call.
  *
  * Throws via `assert.ok` if `call` is `undefined` — index a recorded
  * `calls` array directly (`calls[0]`) and let this helper handle the

package/dist/testing/connection_closer_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KAAG,eAkBrE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,SAAS,GAAG,OAAO,GAAG,SAAS,EACvC,IAAI,MAAM,KACR,IAIF,CAAC"}
+{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACxC,EAAE,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAO,eAiB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,SAAS,GAAG,OAAO,GAAG,SAAS,EACvC,IAAI,MAAM,KACR,IAIF,CAAC"}

package/dist/testing/connection_closer_helpers.js

@@ -2,40 +2,34 @@ import './assert_dev_env.js';
 import { assert } from 'vitest';
 /**
  * Build a `ConnectionCloser` that records every call into `calls` rather
- * than touching real transports. Each method returns 1 ("one socket
- * closed") regardless of whether a real socket exists — handlers
- * typically ignore the return value.
+ * than touching real transports. Each method returns 1 ("one connection
+ * closed") regardless of whether a real connection exists — handlers
+ * ignore the return value.
  *
- * Pass `seq_ref` to share the sequence counter with a sibling
- * `create_emit_ordering_audit_factory` so tests can pin close-vs-emit
- * ordering at the handler call site. Without `seq_ref`, the closer
- * uses a fresh internal counter — `at: N` values within a single test
- * are meaningful, but cannot be compared against audit emit ordering.
+ * To see a handler's closes, add the closer to the backend's
+ * `deps.connection_closer` (`RealtimeCloser.add`), or build the action
+ * factory's deps with it.
  */
-export const create_recording_closer = (seq_ref) => {
+export const create_recording_closer = () => {
     const calls = [];
-    const seq = seq_ref ?? { value: 0 };
     const closer = {
         close_sockets_for_session: (id) => {
-            calls.push({ method: 'session', id, at: seq.value++ });
+            calls.push({ method: 'session', id });
             return 1;
         },
         close_sockets_for_token: (id) => {
-            calls.push({ method: 'token', id, at: seq.value++ });
+            calls.push({ method: 'token', id });
             return 1;
         },
         close_sockets_for_account: (id) => {
-            calls.push({ method: 'account', id, at: seq.value++ });
+            calls.push({ method: 'account', id });
             return 1;
         }
     };
     return { closer, calls };
 };
 /**
- * Pin `{method, id}` on a single recorded close call without baking in
- * the `at: N` sequence number. Use at every "did the closer fire?"
- * assertion site; the sequence number is only meaningful for dedicated
- * ordering tests (paired with `create_emit_ordering_audit_factory`).
+ * Pin `{method, id}` on a single recorded close call.
  *
  * Throws via `assert.ok` if `call` is `undefined` — index a recorded
  * `calls` array directly (`calls[0]`) and let this helper handle the

package/dist/testing/cross_backend/capabilities.d.ts

@@ -2,9 +2,9 @@ import '../assert_dev_env.js';
 /**
  * Backend wiring facts recorded for documentation — **not** gating flags.
  *
- * The companion to `BackendCapabilities`: where each capability flag has a
- * `test_if(capabilities.X, ...)` reader that skips a suite the backend doesn't
- * implement, nothing reads these. They record middleware / limiter wiring that
+ * The companion to `BackendCapabilities`: where each capability flag is read
+ * by a suite (a `test_if(capabilities.X, ...)` gate, or a fork of one case's
+ * assertion), nothing reads these. They record middleware / limiter wiring that
  * differs between the TS and Rust families (a backend-shape record) but gates
  * no cross test today. They live in their own type precisely so
  * `BackendCapabilities` stops claiming gating power it doesn't have — fold a
@@ -42,15 +42,17 @@ export interface BackendShapeNotes {
 export interface BackendCapabilities {
     /**
      * WebSocket transport is reachable end-to-end. Gates the cross-process
-     * WS round-trip suite; the in-process `describe_ws_round_trip_tests`
-     * runs against `register_action_ws` directly and ignores this flag.
+     * WS round-trip suite and the per-account connection-cap suite
+     * (`describe_ws_connection_cap_cross_tests`); the in-process
+     * `describe_ws_round_trip_tests` runs against `register_action_ws`
+     * directly and ignores this flag.
      */
     readonly ws: boolean;
     /**
      * SSE transport is reachable end-to-end. Gates the cross-process SSE
      * suite (`describe_cross_process_sse_tests` — connect, audit data frame,
-     * close-on-revoke); in-process SSE uses the `on_audit_event` hook and
-     * ignores this flag.
+     * close-on-revoke, the per-session stream cap); in-process SSE uses the
+     * `on_audit_event` hook and ignores this flag.
      */
     readonly sse: boolean;
     /**
@@ -159,6 +161,55 @@ export interface BackendCapabilities {
      * coverage.
      */
     readonly peer_request: boolean;
+    /**
+     * The backend's HTTP server accepts WebSocket frames written in the same
+     * TCP write as the upgrade request, handing them to the socket once the
+     * handshake completes. Gates the `frames sent with the handshake` case in
+     * `describe_cross_process_ws_tests` — the deterministic form of "frames
+     * that arrive before the connection is admitted wait for admission", since
+     * those frames are in the backend's hands before it can have admitted
+     * anything.
+     *
+     * `true` for Node (`ws`), Deno, and the Rust spine (hyper hands the
+     * leftover bytes to the upgraded stream); `false` for Bun, whose HTTP
+     * parser answers such a request `400` before any handler runs. A backend
+     * without it still runs the suite's client-library case (requests sent the
+     * moment the socket opens), which pins the same contract without forcing
+     * the ordering.
+     */
+    readonly ws_handshake_pipelining: boolean;
+    /**
+     * The backend's WebSocket endpoint mounts the self-service account actions
+     * (`account_session_revoke_all` among them), so a socket can revoke the
+     * session it is running on. Gates the self-revocation case in
+     * `describe_cross_process_ws_tests`: the socket reads the reply to its
+     * request, then is closed with `WS_CLOSE_SESSION_REVOKED`.
+     *
+     * `true` on fuz_app's own spine presets — the TS spine binary mounts
+     * `create_account_actions` on `/api/ws`, and the Rust `testing_spine_stub`
+     * serves one action registry on RPC and WS. `false` in the family defaults:
+     * a consumer's WS endpoint carries whatever its domain mounts, so it opts in
+     * once the account actions are there.
+     */
+    readonly ws_account_actions: boolean;
+    /**
+     * A socket that revokes the credential it is running on reads the reply to
+     * that request **before** the revocation's close. Read by the
+     * self-revocation case in `describe_cross_process_ws_tests` (which
+     * `ws_account_actions` gates): with it `true` the case requires the reply
+     * frame ahead of the `WS_CLOSE_SESSION_REVOKED` close; with it `false` the
+     * case requires the close alone.
+     *
+     * `true` for the TS family — `register_action_ws` sends the response and
+     * only then flushes the request's post-commit queue, where the close is.
+     * `false` for the Rust family: its dispatch runs the post-commit queue
+     * before handing the response to the socket loop, and the loop, finding the
+     * connection already closed, writes the close frame and drops the response.
+     * The caller's revocation still took effect; it is not told so. The flag
+     * records that divergence so the suite stays green on both spines without
+     * hiding it — flip it once the Rust spine answers first.
+     */
+    readonly ws_self_revocation_reply: boolean;
     /**
      * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
      * layer — creating a `kind: 'gated'` cell requires the `participant` role
@@ -177,12 +228,15 @@ export interface BackendCapabilities {
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
- * with no missing optional behaviors. The one exception is `peer_request`:
- * `describe_peer_ping_ws_tests` is cross-process-only (it needs a real bound
- * socket with an `on_request` responder via `create_ws_transport`), so the
- * in-process driver never runs it — the transport itself supports
- * server-initiated requests. Cross-process consumers declare each flag
- * explicitly per backend.
+ * with no missing optional behaviors. The exceptions are the flags whose
+ * cases are cross-process-only: `peer_request` (`describe_peer_ping_ws_tests`
+ * needs a real bound socket with an `on_request` responder via
+ * `create_ws_transport`, so the in-process driver never runs it — the
+ * transport itself supports server-initiated requests),
+ * `ws_handshake_pipelining` (raw bytes on a real socket),
+ * `ws_account_actions` (a real socket's reply-then-close ordering), and
+ * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
 /**

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAcpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -7,25 +7,29 @@ import '../assert_dev_env.js';
  * implement. No `if (config.name === 'rust')` branches anywhere — name-
  * checking is a code smell that says capability vocabulary is missing.
  *
- * In-process Hono via `default_in_process_setup` declares every
- * capability `true` (see `in_process_capabilities`). Cross-process
- * backends opt in per-flag on their `BackendConfig`.
+ * In-process Hono via `default_in_process_setup` declares every capability
+ * its transport can exercise (see `in_process_capabilities` — the
+ * cross-process-only flags stay `false`). Cross-process backends opt in
+ * per-flag on their `BackendConfig`.
  *
  * **Where the per-backend declarations live** (this file owns only the
  * vocabulary + the in-process preset):
  *
- * - `in_process_capabilities` — here; every flag `true`.
+ * - `in_process_capabilities` — here; every flag `true` except the
+ *   cross-process-only ones.
  * - `ts_default_capabilities` / `rust_default_capabilities` — consumer-facing
  *   family defaults, in `default_backend_configs.ts` (full literals, so adding
  *   a capability is a compile error until each family declares it).
  * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
  *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
- *   default; Bun flips `oversized_reject_closes_connection`).
+ *   default; Bun flips `oversized_reject_closes_connection` and
+ *   `ws_handshake_pipelining`).
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
  *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
  *
  * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
- * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader).
+ * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader,
+ * or — `ws_self_revocation_reply` — forks one case's assertion).
  * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
  * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
  * (`in_process_shape_notes` here, `ts_default_shape_notes` /
@@ -38,12 +42,15 @@ import { test } from 'vitest';
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
- * with no missing optional behaviors. The one exception is `peer_request`:
- * `describe_peer_ping_ws_tests` is cross-process-only (it needs a real bound
- * socket with an `on_request` responder via `create_ws_transport`), so the
- * in-process driver never runs it — the transport itself supports
- * server-initiated requests. Cross-process consumers declare each flag
- * explicitly per backend.
+ * with no missing optional behaviors. The exceptions are the flags whose
+ * cases are cross-process-only: `peer_request` (`describe_peer_ping_ws_tests`
+ * needs a real bound socket with an `on_request` responder via
+ * `create_ws_transport`, so the in-process driver never runs it — the
+ * transport itself supports server-initiated requests),
+ * `ws_handshake_pipelining` (raw bytes on a real socket),
+ * `ws_account_actions` (a real socket's reply-then-close ordering), and
+ * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * per backend.
  */
 export const in_process_capabilities = Object.freeze({
     ws: true,
@@ -56,6 +63,14 @@ export const in_process_capabilities = Object.freeze({
     account_status: true,
     oversized_reject_closes_connection: true,
     peer_request: false,
+    // Cross-process-only, like `peer_request`: the case needs a real bound socket
+    // to write raw bytes to.
+    ws_handshake_pipelining: false,
+    // Cross-process-only: the case reads a real socket's frames in wire order.
+    ws_account_actions: false,
+    // Read only by the case `ws_account_actions` gates; the in-process
+    // dispatcher does answer first.
+    ws_self_revocation_reply: true,
     // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
     // spine binaries' full mount + the Rust stub, not the in-process default app.
     cell_gated_create: false

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAsBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -41,6 +41,17 @@ export const ts_default_capabilities = Object.freeze({
     // the HTTP RPC endpoint (the no-transport case). The TS spine config opts in;
     // a generic consumer enables it once it wires that mount.
     peer_request: false,
+    // Node (`ws`) and Deno hand frames pipelined with the upgrade request to the
+    // socket. A Bun-served consumer overrides to `false` (see the bun spine
+    // config) — `Bun.serve` answers such a request `400`.
+    ws_handshake_pipelining: true,
+    // Off by default: a consumer's WS endpoint mounts its own domain's actions.
+    // fuz_app's spine configs opt in (the spine binary mounts the account
+    // actions on `/api/ws`); a consumer does once its endpoint carries them.
+    ws_account_actions: false,
+    // `register_action_ws` sends a request's response before it flushes the
+    // post-commit queue a self-revocation's close is on.
+    ws_self_revocation_reply: true,
     // Off by default — the `cell_gated_create` test policy is a fuz_app test
     // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
     // consumers.
@@ -70,6 +81,16 @@ export const rust_default_capabilities = Object.freeze({
     // Server-initiated requests landed Rust-first canonical — the Rust spine
     // drives the `peer/ping` round-trip, so the family opts into the suite.
     peer_request: true,
+    // hyper hands bytes pipelined after the upgrade request to the upgraded
+    // stream, where they wait for the read loop that starts at admission.
+    ws_handshake_pipelining: true,
+    // Off by default, as on the TS family: a consumer opts in once its WS
+    // endpoint mounts the account actions. The `testing_spine_stub` preset does.
+    ws_account_actions: false,
+    // The Rust dispatch runs the post-commit queue — the self-revocation's
+    // close — before the socket loop writes the response, and the loop then
+    // drops it. A divergence from the TS spine; see the flag's doc.
+    ws_self_revocation_reply: false,
     // Off by default — the `testing_spine_stub` preset opts in (it mounts the
     // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
     cell_gated_create: false

package/dist/testing/cross_backend/role_grant_offer_notification_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAK7E,iFAAiF;AACjF,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IA8VF,CAAC"}
+{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAK7E,iFAAiF;AACjF,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAuWF,CAAC"}

package/dist/testing/cross_backend/role_grant_offer_notification_ws.js

@@ -38,7 +38,7 @@ import '../assert_dev_env.js';
  * guard), and accept stays idempotent on the role_grant while still superseding
  * pending siblings. Gated on `capabilities.ws`.
  *
- * Cross-process only: `create_ws_transport` needs a real bound socket, so wire
+ * Cross-process only: `create_admitted_ws_transport` needs a real bound socket, so wire
  * it from a `*.cross.test.ts` file, never an in-process setup. Authed cookies
  * come from the per-account session minted by `fixture.create_account` /
  * `fixture.create_session_headers`.
@@ -47,7 +47,7 @@ import '../assert_dev_env.js';
  */
 import { assert, describe } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
-import { create_ws_transport } from '../transports/ws_transport.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { is_notification_with } from '../transports/ws_client.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, RoleGrantOfferReceivedParams, RoleGrantOfferAcceptedParams, RoleGrantOfferDeclinedParams, RoleGrantOfferRetractedParams, RoleGrantOfferSupersedeParams, RoleGrantRevokeParams } from '../../auth/role_grant_offer_notifications.js';
@@ -65,10 +65,19 @@ const RPC_PATH = '/api/rpc';
 export const describe_role_grant_offer_notification_ws_tests = (options) => {
     const { setup_test, capabilities, base_url, ws_path } = options;
     // -- shared helpers -------------------------------------------------------
-    /** Open a WS transport for a single session cookie (`<name>=<value>`). */
+    /**
+     * Open a WS transport for a single session cookie (`<name>=<value>`),
+     * admitted before it resolves: a targeted notification is delivered only to
+     * an admitted connection, and the handshake alone doesn't say it is one.
+     */
     const open_ws = (cookie) => {
         assert.ok(cookie, 'expected a session cookie for the WS upgrade');
-        return create_ws_transport({ base_url, ws_path, cookies: [cookie], origin: base_url });
+        return create_admitted_ws_transport({
+            base_url,
+            ws_path,
+            cookies: [cookie],
+            origin: base_url
+        });
     };
     /** Drive a JSON-RPC call over the fixture's HTTP transport. */
     const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: RPC_PATH, method, params, headers });

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -61,7 +61,9 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
  * Capabilities for the Rust `testing_spine_stub` — `rust_default_capabilities`
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
  * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
- * `/ready` over the env-supplied fixture path), and `cell_gated_create` (it
+ * `/ready` over the env-supplied fixture path), `ws_account_actions` (it
+ * serves one action registry on `/api/rpc` and `/api/ws`), and
+ * `cell_gated_create` (it
  * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
  * (not inline) so every spine preset is greppable, mirroring
  * `ts_spine_capabilities`.
@@ -70,6 +72,7 @@ const rust_spine_stub_capabilities = Object.freeze({
     ...rust_default_capabilities,
     sse: true,
     ready: true,
+    ws_account_actions: true,
     cell_gated_create: true
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */

package/dist/testing/cross_backend/session_cap.d.ts

@@ -14,6 +14,19 @@ export interface SessionCapCrossTestOptions {
     readonly login_path?: string;
     /** REST account-status route path. Default `/api/account/status`. */
     readonly status_path?: string;
+    /**
+     * Where the backend's WebSocket endpoint is, for the case that an evicted
+     * session's socket is closed. Pass it when the backend has a WS transport
+     * (`capabilities.ws`); omitted, that case is skipped.
+     */
+    readonly ws?: {
+        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+        readonly base_url: string;
+        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+        readonly ws_path: string;
+        /** Origin for the upgrade. Defaults to `base_url`. */
+        readonly origin?: string;
+    };
 }
 export declare const describe_session_cap_cross_tests: (options: SessionCapCrossTestOptions) => void;
 //# sourceMappingURL=session_cap.d.ts.map

package/dist/testing/cross_backend/session_cap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA6DtF,CAAC"}
+{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA4FtF,CAAC"}

package/dist/testing/cross_backend/session_cap.js

@@ -3,15 +3,11 @@ import '../assert_dev_env.js';
  * Cross-backend parity suite for the **per-account concurrent-session cap**
  * over real HTTP.
  *
- * The cap is a shipped control on the TS spine (`query_session_enforce_limit`,
- * `DEFAULT_MAX_SESSIONS`) that the Rust spine went without — its session INSERT
- * carried no eviction, so every Rust-backed deployment served unlimited
- * concurrent sessions per account. That divergence survived because nothing crossed the
- * wire on it — the TS half is pinned by in-process tests
- * (`session_middleware.lifecycle.db.test.ts`, `session_token_limits.integration.db.test.ts`)
- * whose Rust counterparts simply didn't exist to fail. This suite is the pin
- * that runs on *both*, so the next spine to lose the cap fails here rather than
- * in production. Two properties:
+ * Both spines cap concurrent sessions per account (the TS
+ * `query_session_enforce_limit` / `DEFAULT_MAX_SESSIONS`, the Rust
+ * `create_capped_session`). Each spine's own tests pin its half in-process;
+ * nothing in them crosses the wire, so a spine that lost the cap would fail
+ * no shared test. This suite is the pin that runs on *both*. It pins:
  *
  * - **the cap bounds concurrent sessions, by eviction not refusal** — logging in
  *   `max_sessions + 1` times succeeds every time (a login is never denied for
@@ -19,6 +15,11 @@ import '../assert_dev_env.js';
  * - **the evicted session is the oldest** — the first login's cookie no longer
  *   authenticates once the cap is exceeded. A spine with no cap authenticates it
  *   fine, which is exactly the defect this catches.
+ * - **an evicted session's socket is closed** (when `ws` is supplied) — the cap
+ *   deletes the session row, and a WebSocket never re-reads its session, so
+ *   the login that evicts it must close the socket it opened
+ *   (`WS_CLOSE_SESSION_REVOKED`), once the eviction has committed. A spine
+ *   that only deletes the row leaves the socket running on a dead session.
  *
  * **Why `max_sessions + 1` logins and not `max_sessions`.** The starting session
  * count isn't zero and isn't guaranteed equal across impls — `create_account`
@@ -48,16 +49,32 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
+import { WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
 import { DEFAULT_MAX_SESSIONS } from '../../auth/account_route_schema.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { create_ws_transport } from '../transports/ws_transport.js';
+import { test_if } from './capabilities.js';
 export const describe_session_cap_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, ws } = options;
     const max_sessions = options.max_sessions ?? DEFAULT_MAX_SESSIONS;
     const login_path = options.login_path ?? '/api/account/login';
     const status_path = options.status_path ?? '/api/account/status';
     // Fresh-keeper-per-test wipes the DB between tests, so a literal username
     // never collides (see `setup.ts`).
     const username = 'session_cap_user';
+    /** Log `username` in on a fresh transport — one login, one session, one jar. */
+    const login = async (fixture, label) => {
+        const transport = fixture.fresh_transport();
+        const res = await transport(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
+        });
+        assert.strictEqual(res.status, 200, `${label} must succeed — the cap evicts, it never refuses`);
+        assert.ok(transport.cookies().length > 0, `${label} must set a session cookie on its jar`);
+        return transport;
+    };
     describe('per-account session cap parity', () => {
         test(`logging in ${max_sessions + 1} times evicts the oldest session (newest cookie resolves, first does not)`, async () => {
             const fixture = await setup_test();
@@ -69,15 +86,7 @@ export const describe_session_cap_cross_tests = (options) => {
             // look alike. Held oldest-first.
             const sessions = [];
             for (let i = 0; i < max_sessions + 1; i++) {
-                const transport = fixture.fresh_transport();
-                const res = await transport(login_path, {
-                    method: 'POST',
-                    headers: { 'content-type': 'application/json' },
-                    body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
-                });
-                assert.strictEqual(res.status, 200, `login ${i + 1}/${max_sessions + 1} must succeed — the cap evicts, it never refuses`);
-                assert.ok(transport.cookies().length > 0, `login ${i + 1} must set a session cookie on its jar`);
-                sessions.push(transport);
+                sessions.push(await login(fixture, `login ${i + 1}/${max_sessions + 1}`));
             }
             /** `GET /status` on one login's transport: 200 authenticated, 401 not. */
             const status_on = async (transport) => {
@@ -89,5 +98,32 @@ export const describe_session_cap_cross_tests = (options) => {
             assert.strictEqual(await status_on(sessions[0]), 401, `the oldest session must be evicted once the account exceeds ${max_sessions} sessions ` +
                 '(a spine with no cap authenticates this cookie)');
         });
+        // `max_sessions` further logins leave the watched session outside the
+        // newest `max_sessions`, so it is evicted whatever sessions the account
+        // held before it (`create_account` seeds one on some cradles).
+        test_if(ws !== undefined, 'a session the cap evicts has its open socket closed', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            const victim = await login(fixture, 'the login whose socket is watched');
+            const client = await create_ws_transport({
+                base_url: ws.base_url,
+                ws_path: ws.ws_path,
+                cookies: victim.cookies(),
+                origin: ws.origin
+            });
+            try {
+                // admitted and dispatching before the evicting logins
+                await client.request(1, heartbeat_action_spec.method, {});
+                for (let i = 0; i < max_sessions; i++) {
+                    await login(fixture, `evicting login ${i + 1}/${max_sessions}`);
+                }
+                const closed = await client.wait_for_close(2000);
+                assert.ok(closed, `the socket of a session evicted past ${max_sessions} sessions did not close within 2s`);
+                assert.strictEqual(client.close_code, WS_CLOSE_SESSION_REVOKED);
+            }
+            finally {
+                await client.close();
+            }
+        });
     });
 };