@fuzdev/fuz_app 0.125.0 → 0.127.0

package/dist/testing/cross_backend/full_spine_mount.js

@@ -1,5 +1,6 @@
 import '../assert_dev_env.js';
 import { peer_ping_action } from '../../actions/peer_ping.js';
+import { protocol_actions } from '../../actions/protocol.js';
 import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js';
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
@@ -7,7 +8,6 @@ import { create_actor_search_actions } from '../../auth/actor_search_actions.js'
 import { create_testing_action_manifest_action, create_testing_actions } from './testing_reset_actions.js';
 import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * Build the complete live RPC action list the spine test binary mounts on
  * its single endpoint: the declared `create_standard_rpc_actions` bundle plus
@@ -54,12 +54,29 @@ export const build_full_spine_rpc_actions = (deps, options) => {
     return actions;
 };
 /**
- * Factory-form full mount at {@link SPINE_RPC_PATH}, the shape
- * `create_app_server`'s `rpc_endpoints` slot accepts. The spine binary wires
- * this directly; the surface builder (`create_spine_surface_spec`) keeps using
- * the narrower `spine_rpc_endpoints` so the declared surface stays the
- * standard bundle only.
+ * Build the full live mount for both of the spine binary's endpoints: the
+ * RPC list, and the WS list that serves the same actions behind the protocol
+ * actions.
+ *
+ * The Rust `testing_spine_stub` serves one action registry on RPC and WS, so
+ * mounting the full list on WS keeps the two spines' WS method sets equal —
+ * the cell verbs among them, whose dispatcher-charged rate limit
+ * `describe_ws_action_rate_limit_cross_tests` drives over a socket. The one
+ * difference is `cancel`: a registered protocol action on TS, read-loop-owned
+ * (never dispatched) on Rust.
+ *
+ * @param deps - the backend `AppDeps`
+ * @param options - daemon-token state + optional WS notification sender
+ * @returns the RPC and WS action lists, built once and sharing handler instances
  */
-export const full_spine_rpc_endpoints = (ctx, options) => [
-    { path: SPINE_RPC_PATH, actions: build_full_spine_rpc_actions(ctx.deps, options) }
-];
+export const build_full_spine_mount = (deps, options) => {
+    const rpc_actions = build_full_spine_rpc_actions(deps, options);
+    const protocol_methods = new Set(protocol_actions.map((action) => action.spec.method));
+    return {
+        rpc_actions,
+        ws_actions: [
+            ...protocol_actions,
+            ...rpc_actions.filter((action) => !protocol_methods.has(action.spec.method))
+        ]
+    };
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -13,7 +13,7 @@ export declare const RUST_SPINE_STUB_DATABASE_URL_ENV = "FUZ_TESTING_RUST_SPINE_
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
- * **same** fixture the TS spine reads ({@link SPINE_EXPECTED_SCHEMA_URL}) —
+ * **same** fixture the TS spine reads (`SPINE_EXPECTED_SCHEMA_URL`) —
  * column-presence is engine-portable, so one file is the cross-impl contract.
  */
 export declare const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = "FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH";
@@ -51,6 +51,21 @@ export interface SpineStubBackendConfigOptions {
      * TS spine binary wires the equivalent set unconditionally.
      */
     readonly trusted_proxies?: string;
+    /**
+     * Enable the action rate limiters (`FUZ_ACTION_RATE_LIMIT_ENABLED=true`) —
+     * one per-IP and one per-account limiter shared by the RPC and WS
+     * endpoints. Off by default, like `enable_login_rate_limit`; set only for
+     * the dedicated security cross project, which drives them through
+     * `ws_action_rate_limit.ts`. Mirrors `TsSpineBackendConfigOptions.enable_action_rate_limit`.
+     */
+    readonly enable_action_rate_limit?: boolean;
+    /**
+     * Replace both action limiters' `max_attempts`
+     * (`FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS`) so a suite reaches the cap in a few
+     * calls. Requires `enable_action_rate_limit` — the binary refuses to boot
+     * otherwise. Mirrors `TsSpineBackendConfigOptions.action_rate_limit_max_attempts`.
+     */
+    readonly action_rate_limit_max_attempts?: number;
 }
 /**
  * Build the `BackendConfig` for `testing_spine_stub`. Resolves the binary

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -38,8 +38,8 @@ import '../assert_dev_env.js';
  */
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
+import { action_rate_limit_env, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -53,7 +53,7 @@ export const RUST_SPINE_STUB_DATABASE_URL_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_DAT
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
- * **same** fixture the TS spine reads ({@link SPINE_EXPECTED_SCHEMA_URL}) —
+ * **same** fixture the TS spine reads (`SPINE_EXPECTED_SCHEMA_URL`) —
  * column-presence is engine-portable, so one file is the cross-impl contract.
  */
 export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH';
@@ -127,7 +127,8 @@ export const rust_spine_stub_backend_config = (options = {}) => {
             // limiters + trust the loopback proxy so the limiter keys on the
             // resolved `X-Forwarded-For` IP. The stub reads both directly.
             ...(enable_login_rate_limit ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {}),
-            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {})
+            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {}),
+            ...action_rate_limit_env(options)
         }
     });
 };

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -1,7 +1,8 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface path + role constants — the hono-free leaf split out of
- * `default_spine_surface.ts`.
+ * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
+ * env-var names the backend configs set for the spawned spine binaries. A
+ * hono-free leaf split out of `default_spine_surface.ts`.
  *
  * Cross-process suite modules (which drive a separately-spawned backend binary
  * over HTTP) need only the wire path / role / fixture-URL, not the in-process
@@ -10,7 +11,13 @@ import '../assert_dev_env.js';
  * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
  * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
  * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ * peer. `default_spine_surface.ts` imports the ones it uses from here.
+ *
+ * The env-var names live here so both sides of each contract share one
+ * constant: the backend configs that set them (`default_backend_configs.ts`,
+ * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
+ * spawned TS spine binary that reads them, which imports this leaf rather than
+ * the config builders.
  *
  * @module
  */
@@ -56,4 +63,37 @@ export declare const SPINE_PARTICIPANT_ROLE = "participant";
  * engine-portable, so one fixture is the cross-impl contract.
  */
 export declare const SPINE_EXPECTED_SCHEMA_URL: URL;
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls
+ * (`ts_spine_backend_config` and `rust_spine_stub_backend_config` set it).
+ */
+export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
+/**
+ * Env var both spine binaries read to enable their action rate limiters
+ * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
+ * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
+ * that charge in-handler). The cross-language contract for the action
+ * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
+ * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, neither spine builds an action
+ * limiter.
+ */
+export declare const ACTION_RATE_LIMIT_ENABLED_ENV = "FUZ_ACTION_RATE_LIMIT_ENABLED";
+/**
+ * Env var replacing both action limiters' `max_attempts` (a positive integer;
+ * the windows stay `default_action_ip_rate_limit`'s /
+ * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
+ * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
+ * integer, so a suite never asserts a throttle the backend didn't build.
+ */
+export declare const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = "FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS";
+/**
+ * Env var naming the TS spine backend's root dir, set by
+ * `ts_spine_backend_config`; the spawned binary writes its daemon token to
+ * `{dir}/run/daemon_token`, which must match `bootstrap.daemon_token_path`.
+ */
+export declare const TS_SPINE_DIR_ENV = "FUZ_TESTING_TS_SPINE_DIR";
 //# sourceMappingURL=spine_surface_constants.d.ts.map

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -1,7 +1,8 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface path + role constants — the hono-free leaf split out of
- * `default_spine_surface.ts`.
+ * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
+ * env-var names the backend configs set for the spawned spine binaries. A
+ * hono-free leaf split out of `default_spine_surface.ts`.
  *
  * Cross-process suite modules (which drive a separately-spawned backend binary
  * over HTTP) need only the wire path / role / fixture-URL, not the in-process
@@ -10,7 +11,13 @@ import '../assert_dev_env.js';
  * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
  * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
  * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ * peer. `default_spine_surface.ts` imports the ones it uses from here.
+ *
+ * The env-var names live here so both sides of each contract share one
+ * constant: the backend configs that set them (`default_backend_configs.ts`,
+ * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
+ * spawned TS spine binary that reads them, which imports this leaf rather than
+ * the config builders.
  *
  * @module
  */
@@ -56,3 +63,36 @@ export const SPINE_PARTICIPANT_ROLE = 'participant';
  * engine-portable, so one fixture is the cross-impl contract.
  */
 export const SPINE_EXPECTED_SCHEMA_URL = new URL('./expected_schema.json', import.meta.url);
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls
+ * (`ts_spine_backend_config` and `rust_spine_stub_backend_config` set it).
+ */
+export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
+/**
+ * Env var both spine binaries read to enable their action rate limiters
+ * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
+ * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
+ * that charge in-handler). The cross-language contract for the action
+ * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
+ * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, neither spine builds an action
+ * limiter.
+ */
+export const ACTION_RATE_LIMIT_ENABLED_ENV = 'FUZ_ACTION_RATE_LIMIT_ENABLED';
+/**
+ * Env var replacing both action limiters' `max_attempts` (a positive integer;
+ * the windows stay `default_action_ip_rate_limit`'s /
+ * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
+ * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
+ * integer, so a suite never asserts a throttle the backend didn't build.
+ */
+export const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = 'FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS';
+/**
+ * Env var naming the TS spine backend's root dir, set by
+ * `ts_spine_backend_config`; the spawned binary writes its daemon token to
+ * `{dir}/run/daemon_token`, which must match `bootstrap.daemon_token_path`.
+ */
+export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,6 +1,20 @@
 import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /** Options for the testing-backdoor negative-credential suite. */
-export type TestingBackdoorCrossTestOptions = RpcPathCrossSuiteOptions;
+export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /**
+     * Where the backend's WebSocket endpoint is, for the session-socket cases.
+     * Pass it when the backend serves the `_testing_*` actions on its WS
+     * endpoint too; omitted, those cases are skipped.
+     */
+    readonly ws?: {
+        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+        readonly base_url: string;
+        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+        readonly ws_path: string;
+        /** Origin for the upgrade. Defaults to `base_url`. */
+        readonly origin?: string;
+    };
+}
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -12,7 +12,8 @@ import '../assert_dev_env.js';
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
- * endpoint but keeps them off the declared surface — so the spec-derived
+ * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
+ * endpoint) but keeps them off the declared surface — so the spec-derived
  * `describe_rpc_attack_surface_tests` never enumerates them, and nothing
  * else fires them with a non-daemon credential to prove the gate holds
  * end-to-end. This suite does, against each impl's real auth resolution.
@@ -28,6 +29,14 @@ import '../assert_dev_env.js';
  *   `credential_type_required` — same ceiling; an api token cannot reach
  *   keeper operations.
  *
+ * Over WebSocket (when `ws` is supplied), the same methods sent on a socket
+ * opened with the keeper's **session** cookie answer the same `forbidden`
+ * error with `credential_type_required`: the upgrade admits a session, but
+ * each message runs the same per-action gates as HTTP RPC, so a socket is no
+ * way around the daemon-token channel. Anonymous and bearer have no WS case —
+ * an anonymous upgrade is refused before any message, and the upgrade client
+ * threads cookies.
+ *
  * Each method is sent with **valid** params so each case varies only the
  * credential. (Validation runs after the gates — the order is 401 → authz →
  * 403 → 429 → 400 — so the shapes are belt-and-suspenders here rather than load-
@@ -44,7 +53,9 @@ import '../assert_dev_env.js';
  * binary, not the in-process app — like the ws/sse suites. Wire from a
  * `*.cross.test.ts`. Requires the standard `_testing_*` actions mounted (the
  * same precondition `default_cross_process_setup` already imposes for its
- * per-test `_testing_reset`); ungated, since every cross backend mounts them.
+ * per-test `_testing_reset`); the HTTP cases are ungated, since every cross
+ * backend mounts them, and the WS cases run when `ws` is passed — for a
+ * backend that also serves them on its WS endpoint.
  *
  * `$lib`-free by contract (relative specifiers only), like the sibling
  * cross-backend suites.
@@ -53,7 +64,11 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { is_response_for } from '../transports/ws_client.js';
+import { test_if } from './capabilities.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
@@ -80,18 +95,21 @@ const principals = [
     {
         name: 'anonymous',
         status: 401,
+        code: JSONRPC_ERROR_CODES.unauthenticated,
         // Fresh jar so the keeper cookie (cross-process) can't leak in.
         resolve: (f) => ({ transport: f.fresh_transport(), headers: {} })
     },
     {
         name: 'session',
         status: 403,
+        code: JSONRPC_ERROR_CODES.forbidden,
         reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
         resolve: (f) => ({ transport: f.transport, headers: f.create_session_headers() })
     },
     {
         name: 'bearer',
         status: 403,
+        code: JSONRPC_ERROR_CODES.forbidden,
         reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
         // Bearer is discarded in a browser context, so suppress Origin (empty
         // jar + no Origin) — the credential must actually resolve so the refusal
@@ -104,7 +122,7 @@ const principals = [
     }
 ];
 export const describe_testing_backdoor_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, ws } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('testing backdoor credential gate parity', () => {
         for (const { method, params } of backdoor_methods) {
@@ -124,12 +142,39 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                     assert.ok(!res.ok, `${label}: expected denial (${principal.status}) but the call succeeded`);
                     assert.strictEqual(res.status, principal.status, `${label}: status`);
                     // `!res.ok` narrows `res` to the error variant for `res.error`.
-                    if (principal.reason !== undefined && !res.ok) {
-                        const reason = res.error.data?.reason;
-                        assert.strictEqual(reason, principal.reason, `${label}: error.data.reason`);
+                    if (!res.ok) {
+                        assert.strictEqual(res.error.code, principal.code, `${label}: error.code`);
+                        if (principal.reason !== undefined) {
+                            const reason = res.error.data?.reason;
+                            assert.strictEqual(reason, principal.reason, `${label}: error.data.reason`);
+                        }
                     }
                 });
             }
         }
+        for (const { method, params } of backdoor_methods) {
+            test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
+                const fixture = await setup_test();
+                const client = await create_admitted_ws_transport({
+                    base_url: ws.base_url,
+                    ws_path: ws.ws_path,
+                    cookies: fixture.transport.cookies(),
+                    origin: ws.origin
+                });
+                try {
+                    const id = `backdoor_${method}`;
+                    await client.send({ jsonrpc: '2.0', id, method, params });
+                    const frame = await client.wait_for(is_response_for(id));
+                    const label = `${method} session socket`;
+                    assert.ok(frame.error, `${label}: expected a credential_type_required error but the call succeeded`);
+                    assert.strictEqual(frame.error.code, JSONRPC_ERROR_CODES.forbidden, `${label}: code`);
+                    const reason = frame.error.data?.reason;
+                    assert.strictEqual(reason, ERROR_CREDENTIAL_TYPE_REQUIRED, `${label}: error.data.reason`);
+                }
+                finally {
+                    await client.close();
+                }
+            });
+        }
     });
 };

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -163,9 +163,12 @@ export declare const testing_reset_action_spec: {
  * asserting on audit rows.
  *
  * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every mutation's fire-and-
- * forget audit emits are awaited before its response returns — by the time
- * a later drain call runs, prior emits are already durable. The action still
+ * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
+ * fire-and-forget audit emits are awaited before its response returns — by
+ * the time a later drain call runs, prior emits are already durable. A
+ * WS-dispatched mutation replies before its effects flush, so on TS this
+ * action is not a barrier for WS-originated emits; issue audit-asserting
+ * mutations over HTTP. The action still
  * exists so the cross-backend test body calls the same method on every
  * backend; the Rust spine (whose audit writes are detached tokio tasks)
  * does the real await in `AuditEmitter::drain_inflight`.

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -169,9 +169,12 @@ export const testing_reset_action_spec = {
  * asserting on audit rows.
  *
  * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every mutation's fire-and-
- * forget audit emits are awaited before its response returns — by the time
- * a later drain call runs, prior emits are already durable. The action still
+ * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
+ * fire-and-forget audit emits are awaited before its response returns — by
+ * the time a later drain call runs, prior emits are already durable. A
+ * WS-dispatched mutation replies before its effects flush, so on TS this
+ * action is not a barrier for WS-originated emits; issue audit-asserting
+ * mutations over HTTP. The action still
  * exists so the cross-backend test body calls the same method on every
  * backend; the Rust spine (whose audit writes are detached tokio tasks)
  * does the real await in `AuditEmitter::drain_inflight`.

package/dist/testing/cross_backend/testing_server_bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_bun.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_bun.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,QAAO,oBA0D5C,CAAC"}
+{"version":3,"file":"testing_server_bun.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_bun.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,QAAO,oBA8D5C,CAAC"}

package/dist/testing/cross_backend/testing_server_bun.js

@@ -32,7 +32,11 @@ export const create_bun_testing_adapter = () => ({
     // Bun's WS upgrade is module-level and stateless (like Deno) — no
     // post-serve attach. The `websocket` handler is threaded into `serve`
     // below, where `Bun.serve` wants it.
-    prepare_websocket: () => ({ upgrade_websocket: upgradeWebSocket }),
+    // TODO: `Bun.serve({websocket: {maxPayloadLength}})` (default 16 MiB) could
+    // carry the endpoint's `max_message_bytes` as a frame cap, like Node's
+    // `maxPayload`; until then the per-message check in `register_ws_endpoint`
+    // closes an oversized message with `WS_CLOSE_MESSAGE_TOO_BIG` (1009).
+    prepare_websocket: () => ({ create_upgrade_websocket: () => upgradeWebSocket }),
     serve: ({ fetch, port, hostname }) => {
         const server = Bun.serve({
             fetch: fetch,