@fuzdev/fuz_app 0.126.0 → 0.128.0

package/dist/testing/audit_drift_guard.js

@@ -44,8 +44,10 @@ export const install_audit_drift_guard = () => {
  * forward from the input envelope. Tests asserting on role-grant-shape
  * emissions read out of the same homogeneous `calls` array.
  * `notify` is a no-op; `add_listener` records into a local array that
- * `listener_count` reports (registered listeners never fire — this emitter
- * captures `emit` shapes, not fan-out).
+ * `listener_count` reports, and returns a remover with the production
+ * semantics (per registration, idempotent) — registered listeners never fire,
+ * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once:
+ * a recorded call writes nothing, so nothing is ever in flight.
  *
  * `emit` AND `emit_pool` both append to `calls`, so a test reads either
  * entry point's writes off the same array.
@@ -65,6 +67,7 @@ export const install_audit_drift_guard = () => {
  */
 export const create_recording_audit_emitter = (calls_ref) => {
     const calls = calls_ref ?? [];
+    // one entry per registration, as `create_audit_emitter` keeps them
     const listeners = [];
     const emitter = {
         emit: (_ctx, input) => {
@@ -88,9 +91,16 @@ export const create_recording_audit_emitter = (calls_ref) => {
         },
         notify: () => undefined,
         add_listener: (listener) => {
-            listeners.push(listener);
+            const entry = { listener };
+            listeners.push(entry);
+            return () => {
+                const index = listeners.indexOf(entry);
+                if (index !== -1)
+                    listeners.splice(index, 1);
+            };
         },
-        listener_count: () => listeners.length
+        listener_count: () => listeners.length,
+        drain_inflight: () => Promise.resolve()
     };
     return { emitter, calls };
 };

package/dist/testing/cross_backend/account_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAqUF,CAAC"}
+{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAoUF,CAAC"}

package/dist/testing/cross_backend/account_lifecycle.js

@@ -88,8 +88,7 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const del = await cross_rpc_call(t, rpc_path, 'account_delete', { account_id: fixture.account.id }, fixture.create_session_headers());
             assert.strictEqual(error_reason(del), ERROR_CANNOT_DELETE_KEEPER);
             // Deterministic barrier before reading: await in-flight
-            // fire-and-forget audit writes (the real await on the Rust spine;
-            // satisfied-by-construction on the TS spine via await_pending_effects).
+            // fire-and-forget audit writes on either spine.
             const td = fixture.fresh_transport({ origin: null });
             const drained = await cross_rpc_call(td, rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
             assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);

package/dist/testing/cross_backend/capabilities.d.ts

@@ -183,7 +183,9 @@ export interface BackendCapabilities {
      * (`account_session_revoke_all` among them), so a socket can revoke the
      * session it is running on. Gates the self-revocation case in
      * `describe_cross_process_ws_tests`: the socket reads the reply to its
-     * request, then is closed with `WS_CLOSE_SESSION_REVOKED`.
+     * request, then is closed with `WS_CLOSE_SESSION_REVOKED`. Also gates that
+     * suite's WS-mutation audit case (with `rpc_path`; it calls
+     * `_testing_drain_effects`).
      *
      * `true` on fuz_app's own spine presets — the TS spine binary mounts its
      * full action set on `/api/ws`, and the Rust `testing_spine_stub` serves

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -2,8 +2,8 @@ import '../assert_dev_env.js';
 /**
  * Family-shared `BackendConfig` builders for cross-process test backends.
  *
- * Two consumer-facing factories — {@link make_default_ts_backend_config}
- * and {@link make_default_rust_backend_config} — own the common shape
+ * Two consumer-facing factories — `make_default_ts_backend_config`
+ * and `make_default_rust_backend_config` — own the common shape
  * for the JS-runtime (Deno/Node on V8) and Rust families respectively.
  * Per-backend factories in consumer projects compose a small
  * declaration against one of these and add consumer-specific env vars
@@ -35,38 +35,7 @@ import '../assert_dev_env.js';
 import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
 import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
 import { type TestBackendPaths } from './build_test_backend_paths.js';
-/**
- * Env var both spine binaries read to enable their login rate limiters
- * (`'true'` on / unset off). The cross-language contract for the login-security
- * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
- * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
- * `std::env::var` — so one backend-config option drives both impls. Shared home
- * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
- * already import this module. (The spawned TS binary re-declares the literal
- * locally — it can't import this module, which transitively pulls `vitest` —
- * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
- */
-export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
-/**
- * Env var both spine binaries read to enable their action rate limiters
- * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
- * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
- * that charge in-handler). The cross-language contract for the action
- * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
- * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, the TS spine builds no action limiter
- * and the Rust stub keeps its default posture (only its auth families charge,
- * against an always-on per-account limiter at the production cap).
- */
-export declare const ACTION_RATE_LIMIT_ENABLED_ENV = "FUZ_ACTION_RATE_LIMIT_ENABLED";
-/**
- * Env var replacing both action limiters' `max_attempts` (a positive integer;
- * the windows stay `default_action_ip_rate_limit`'s /
- * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
- * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
- * integer, so a suite never asserts a throttle the backend didn't build.
- */
-export declare const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = "FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS";
-/** Options for {@link action_rate_limit_env}. */
+/** Options for `action_rate_limit_env`. */
 export interface ActionRateLimitEnvOptions {
     readonly enable_action_rate_limit?: boolean;
     readonly action_rate_limit_max_attempts?: number;

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF,iDAAiD;AACjD,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -1,37 +1,7 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { default_test_bootstrap_token, default_test_cookie_keys, default_test_keeper_password, default_test_keeper_username } from './default_secrets.js';
-/**
- * Env var both spine binaries read to enable their login rate limiters
- * (`'true'` on / unset off). The cross-language contract for the login-security
- * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
- * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
- * `std::env::var` — so one backend-config option drives both impls. Shared home
- * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
- * already import this module. (The spawned TS binary re-declares the literal
- * locally — it can't import this module, which transitively pulls `vitest` —
- * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
- */
-export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
-/**
- * Env var both spine binaries read to enable their action rate limiters
- * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
- * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
- * that charge in-handler). The cross-language contract for the action
- * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
- * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, the TS spine builds no action limiter
- * and the Rust stub keeps its default posture (only its auth families charge,
- * against an always-on per-account limiter at the production cap).
- */
-export const ACTION_RATE_LIMIT_ENABLED_ENV = 'FUZ_ACTION_RATE_LIMIT_ENABLED';
-/**
- * Env var replacing both action limiters' `max_attempts` (a positive integer;
- * the windows stay `default_action_ip_rate_limit`'s /
- * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
- * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
- * integer, so a suite never asserts a throttle the backend didn't build.
- */
-export const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = 'FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS';
+import { ACTION_RATE_LIMIT_ENABLED_ENV, ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV } from './spine_surface_constants.js';
 /**
  * The `extra_env` entries carrying the action rate-limit toggles, shared by the
  * TS and Rust backend configs so one option pair drives both impls.

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -13,7 +13,7 @@ export declare const RUST_SPINE_STUB_DATABASE_URL_ENV = "FUZ_TESTING_RUST_SPINE_
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
- * **same** fixture the TS spine reads ({@link SPINE_EXPECTED_SCHEMA_URL}) —
+ * **same** fixture the TS spine reads (`SPINE_EXPECTED_SCHEMA_URL`) —
  * column-presence is engine-portable, so one file is the cross-impl contract.
  */
 export declare const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = "FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH";

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -38,8 +38,8 @@ import '../assert_dev_env.js';
  */
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, action_rate_limit_env, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
+import { action_rate_limit_env, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -53,7 +53,7 @@ export const RUST_SPINE_STUB_DATABASE_URL_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_DAT
 /**
  * Env var the stub reads for the absolute path of the committed
  * `expected_schema.json` its `/ready` gate introspects against. Pointed at the
- * **same** fixture the TS spine reads ({@link SPINE_EXPECTED_SCHEMA_URL}) —
+ * **same** fixture the TS spine reads (`SPINE_EXPECTED_SCHEMA_URL`) —
  * column-presence is engine-portable, so one file is the cross-impl contract.
  */
 export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH';

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -1,7 +1,8 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface path + role constants — the hono-free leaf split out of
- * `default_spine_surface.ts`.
+ * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
+ * env-var names the backend configs set for the spawned spine binaries. A
+ * hono-free leaf split out of `default_spine_surface.ts`.
  *
  * Cross-process suite modules (which drive a separately-spawned backend binary
  * over HTTP) need only the wire path / role / fixture-URL, not the in-process
@@ -10,7 +11,13 @@ import '../assert_dev_env.js';
  * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
  * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
  * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ * peer. `default_spine_surface.ts` imports the ones it uses from here.
+ *
+ * The env-var names live here so both sides of each contract share one
+ * constant: the backend configs that set them (`default_backend_configs.ts`,
+ * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
+ * spawned TS spine binary that reads them, which imports this leaf rather than
+ * the config builders.
  *
  * @module
  */
@@ -56,4 +63,37 @@ export declare const SPINE_PARTICIPANT_ROLE = "participant";
  * engine-portable, so one fixture is the cross-impl contract.
  */
 export declare const SPINE_EXPECTED_SCHEMA_URL: URL;
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls
+ * (`ts_spine_backend_config` and `rust_spine_stub_backend_config` set it).
+ */
+export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
+/**
+ * Env var both spine binaries read to enable their action rate limiters
+ * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
+ * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
+ * that charge in-handler). The cross-language contract for the action
+ * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
+ * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, neither spine builds an action
+ * limiter.
+ */
+export declare const ACTION_RATE_LIMIT_ENABLED_ENV = "FUZ_ACTION_RATE_LIMIT_ENABLED";
+/**
+ * Env var replacing both action limiters' `max_attempts` (a positive integer;
+ * the windows stay `default_action_ip_rate_limit`'s /
+ * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
+ * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
+ * integer, so a suite never asserts a throttle the backend didn't build.
+ */
+export declare const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = "FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS";
+/**
+ * Env var naming the TS spine backend's root dir, set by
+ * `ts_spine_backend_config`; the spawned binary writes its daemon token to
+ * `{dir}/run/daemon_token`, which must match `bootstrap.daemon_token_path`.
+ */
+export declare const TS_SPINE_DIR_ENV = "FUZ_TESTING_TS_SPINE_DIR";
 //# sourceMappingURL=spine_surface_constants.d.ts.map

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -1,7 +1,8 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface path + role constants — the hono-free leaf split out of
- * `default_spine_surface.ts`.
+ * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
+ * env-var names the backend configs set for the spawned spine binaries. A
+ * hono-free leaf split out of `default_spine_surface.ts`.
  *
  * Cross-process suite modules (which drive a separately-spawned backend binary
  * over HTTP) need only the wire path / role / fixture-URL, not the in-process
@@ -10,7 +11,13 @@ import '../assert_dev_env.js';
  * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
  * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
  * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ * peer. `default_spine_surface.ts` imports the ones it uses from here.
+ *
+ * The env-var names live here so both sides of each contract share one
+ * constant: the backend configs that set them (`default_backend_configs.ts`,
+ * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
+ * spawned TS spine binary that reads them, which imports this leaf rather than
+ * the config builders.
  *
  * @module
  */
@@ -56,3 +63,36 @@ export const SPINE_PARTICIPANT_ROLE = 'participant';
  * engine-portable, so one fixture is the cross-impl contract.
  */
 export const SPINE_EXPECTED_SCHEMA_URL = new URL('./expected_schema.json', import.meta.url);
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls
+ * (`ts_spine_backend_config` and `rust_spine_stub_backend_config` set it).
+ */
+export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
+/**
+ * Env var both spine binaries read to enable their action rate limiters
+ * (`'true'` on / unset off) — one per-IP and one per-account limiter, shared by
+ * the RPC and WS endpoints (and, on the Rust stub, the auth-family handlers
+ * that charge in-handler). The cross-language contract for the action
+ * rate-limit cross suite (`ws_action_rate_limit.ts`); same delivery as
+ * `LOGIN_RATE_LIMIT_ENABLED_ENV`. Off, neither spine builds an action
+ * limiter.
+ */
+export const ACTION_RATE_LIMIT_ENABLED_ENV = 'FUZ_ACTION_RATE_LIMIT_ENABLED';
+/**
+ * Env var replacing both action limiters' `max_attempts` (a positive integer;
+ * the windows stay `default_action_ip_rate_limit`'s /
+ * `default_action_account_rate_limit`'s). Both spine binaries refuse to boot
+ * when it is set without `ACTION_RATE_LIMIT_ENABLED_ENV` or is not a positive
+ * integer, so a suite never asserts a throttle the backend didn't build.
+ */
+export const ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV = 'FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS';
+/**
+ * Env var naming the TS spine backend's root dir, set by
+ * `ts_spine_backend_config`; the spawned binary writes its daemon token to
+ * `{dir}/run/daemon_token`, which must match `bootstrap.daemon_token_path`.
+ */
+export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,6 +1,20 @@
 import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /** Options for the testing-backdoor negative-credential suite. */
-export type TestingBackdoorCrossTestOptions = RpcPathCrossSuiteOptions;
+export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /**
+     * Where the backend's WebSocket endpoint is, for the session-socket cases.
+     * Pass it when the backend serves the `_testing_*` actions on its WS
+     * endpoint too; omitted, those cases are skipped.
+     */
+    readonly ws?: {
+        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+        readonly base_url: string;
+        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+        readonly ws_path: string;
+        /** Origin for the upgrade. Defaults to `base_url`. */
+        readonly origin?: string;
+    };
+}
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -29,6 +29,14 @@ import '../assert_dev_env.js';
  *   `credential_type_required` — same ceiling; an api token cannot reach
  *   keeper operations.
  *
+ * Over WebSocket (when `ws` is supplied), the same methods sent on a socket
+ * opened with the keeper's **session** cookie answer the same `forbidden`
+ * error with `credential_type_required`: the upgrade admits a session, but
+ * each message runs the same per-action gates as HTTP RPC, so a socket is no
+ * way around the daemon-token channel. Anonymous and bearer have no WS case —
+ * an anonymous upgrade is refused before any message, and the upgrade client
+ * threads cookies.
+ *
  * Each method is sent with **valid** params so each case varies only the
  * credential. (Validation runs after the gates — the order is 401 → authz →
  * 403 → 429 → 400 — so the shapes are belt-and-suspenders here rather than load-
@@ -45,7 +53,9 @@ import '../assert_dev_env.js';
  * binary, not the in-process app — like the ws/sse suites. Wire from a
  * `*.cross.test.ts`. Requires the standard `_testing_*` actions mounted (the
  * same precondition `default_cross_process_setup` already imposes for its
- * per-test `_testing_reset`); ungated, since every cross backend mounts them.
+ * per-test `_testing_reset`); the HTTP cases are ungated, since every cross
+ * backend mounts them, and the WS cases run when `ws` is passed — for a
+ * backend that also serves them on its WS endpoint.
  *
  * `$lib`-free by contract (relative specifiers only), like the sibling
  * cross-backend suites.
@@ -54,7 +64,11 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { is_response_for } from '../transports/ws_client.js';
+import { test_if } from './capabilities.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
@@ -81,18 +95,21 @@ const principals = [
     {
         name: 'anonymous',
         status: 401,
+        code: JSONRPC_ERROR_CODES.unauthenticated,
         // Fresh jar so the keeper cookie (cross-process) can't leak in.
         resolve: (f) => ({ transport: f.fresh_transport(), headers: {} })
     },
     {
         name: 'session',
         status: 403,
+        code: JSONRPC_ERROR_CODES.forbidden,
         reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
         resolve: (f) => ({ transport: f.transport, headers: f.create_session_headers() })
     },
     {
         name: 'bearer',
         status: 403,
+        code: JSONRPC_ERROR_CODES.forbidden,
         reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
         // Bearer is discarded in a browser context, so suppress Origin (empty
         // jar + no Origin) — the credential must actually resolve so the refusal
@@ -105,7 +122,7 @@ const principals = [
     }
 ];
 export const describe_testing_backdoor_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, ws } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('testing backdoor credential gate parity', () => {
         for (const { method, params } of backdoor_methods) {
@@ -125,12 +142,39 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                     assert.ok(!res.ok, `${label}: expected denial (${principal.status}) but the call succeeded`);
                     assert.strictEqual(res.status, principal.status, `${label}: status`);
                     // `!res.ok` narrows `res` to the error variant for `res.error`.
-                    if (principal.reason !== undefined && !res.ok) {
-                        const reason = res.error.data?.reason;
-                        assert.strictEqual(reason, principal.reason, `${label}: error.data.reason`);
+                    if (!res.ok) {
+                        assert.strictEqual(res.error.code, principal.code, `${label}: error.code`);
+                        if (principal.reason !== undefined) {
+                            const reason = res.error.data?.reason;
+                            assert.strictEqual(reason, principal.reason, `${label}: error.data.reason`);
+                        }
                     }
                 });
             }
         }
+        for (const { method, params } of backdoor_methods) {
+            test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
+                const fixture = await setup_test();
+                const client = await create_admitted_ws_transport({
+                    base_url: ws.base_url,
+                    ws_path: ws.ws_path,
+                    cookies: fixture.transport.cookies(),
+                    origin: ws.origin
+                });
+                try {
+                    const id = `backdoor_${method}`;
+                    await client.send({ jsonrpc: '2.0', id, method, params });
+                    const frame = await client.wait_for(is_response_for(id));
+                    const label = `${method} session socket`;
+                    assert.ok(frame.error, `${label}: expected a credential_type_required error but the call succeeded`);
+                    assert.strictEqual(frame.error.code, JSONRPC_ERROR_CODES.forbidden, `${label}: code`);
+                    const reason = frame.error.data?.reason;
+                    assert.strictEqual(reason, ERROR_CREDENTIAL_TYPE_REQUIRED, `${label}: error.data.reason`);
+                }
+                finally {
+                    await client.close();
+                }
+            });
+        }
     });
 };

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -71,6 +71,7 @@ import '../assert_dev_env.js';
 import { z } from 'zod';
 import { type RpcAction } from '../../actions/action_rpc.js';
 import type { AppDeps } from '../../auth/deps.js';
+import type { AuditEmitter } from '../../auth/audit_emitter.js';
 import type { SessionOptions } from '../../auth/session_cookie.js';
 import type { DaemonTokenState } from '../../auth/daemon_token.js';
 import type { Db } from '../../db/db.js';
@@ -162,16 +163,21 @@ export declare const testing_reset_action_spec: {
  * the cross-backend conformance suite uses in place of a poll/sleep before
  * asserting on audit rows.
  *
- * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
- * fire-and-forget audit emits are awaited before its response returns — by
- * the time a later drain call runs, prior emits are already durable. A
- * WS-dispatched mutation replies before its effects flush, so on TS this
- * action is not a barrier for WS-originated emits; issue audit-asserting
- * mutations over HTTP. The action still
- * exists so the cross-backend test body calls the same method on every
- * backend; the Rust spine (whose audit writes are detached tokio tasks)
- * does the real await in `AuditEmitter::drain_inflight`.
+ * The handler awaits `AuditEmitter.drain_inflight`, which waits until no
+ * tracked `emit` write is outstanding — so the binary's emitter must be built
+ * with `track_inflight: true`, or the drain resolves at once and is no barrier.
+ * Tracking is what makes it a barrier whatever the transport: an **HTTP**
+ * mutation on a binary running `await_pending_effects: true` has its writes
+ * settled by the time it responds, but a **WS** mutation is answered before
+ * its effects flush (reply-then-close for a self-revocation), so its audit
+ * write can still be in flight when the caller reads the reply. The Rust
+ * spine does the same await in `AuditEmitter::drain_inflight`, over an
+ * emitter built with `new_with_inflight_tracking`.
+ *
+ * Covered: every `emit` that ran before the drain was dispatched, and any
+ * started while it waits. A write that starts after the drain resolves is
+ * not — nor are eager writes outside `emit` (session touch, token usage),
+ * which only the dispatching transport's own flush awaits.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
@@ -243,13 +249,15 @@ export declare const testing_mint_session_action_spec: {
     readonly description: string;
 };
 /**
- * Build the standalone `_testing_drain_effects` action. No deps — on TS the
- * barrier is satisfied by `await_pending_effects` (see the spec doc), so the
- * handler just returns `{ok: true}`. Mount it on any test endpoint whose
- * suite asserts on audit rows (the spine binary bundles it via
+ * Build the standalone `_testing_drain_effects` action over `audit` — the
+ * emitter the backend's handlers emit through (`deps.audit`), built with
+ * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
+ * whose suite asserts on audit rows (the spine binary bundles it via
  * `create_testing_actions`; in-process suites mount it directly).
+ *
+ * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
-export declare const create_testing_drain_effects_action: () => RpcAction;
+export declare const create_testing_drain_effects_action: (audit: AuditEmitter) => RpcAction;
 /**
  * `_testing_put_fact` — seed an **embedded** fact (`fact.bytes`) for the
  * cross-process fact-serving suite, which drives over real HTTP and has no
@@ -475,9 +483,10 @@ export interface CreateTestingActionsOptions {
 /**
  * Build the testing RPC actions for a test binary's registry.
  *
- * Returns `_testing_reset` — the single privileged action test binaries
- * register. The test binary calls this at server-assembly time and
- * registers the result on its dispatcher.
+ * Returns the bundled `_testing_*` actions (module doc). The test binary
+ * calls this at server-assembly time and registers the result on its
+ * dispatcher. `_testing_drain_effects` drains `deps.audit`, so the binary's
+ * `audit_factory` builds the emitter with `track_inflight: true`.
  *
  * The reset action's table-wipe list mirrors
  * `auth_integration_truncate_tables` from `testing/db.ts` — the

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}