@fuzdev/fuz_app 0.130.0 → 0.132.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (148) hide show
  1. package/dist/actions/action_dispatcher.js +0 -1
  2. package/dist/actions/action_event_data.d.ts +2 -2
  3. package/dist/actions/action_event_types.d.ts +2 -2
  4. package/dist/actions/action_rpc.js +0 -1
  5. package/dist/actions/action_spec.d.ts +19 -19
  6. package/dist/actions/perform_action.js +0 -1
  7. package/dist/actions/register_action_ws.d.ts.map +1 -1
  8. package/dist/actions/register_action_ws.js +3 -1
  9. package/dist/actions/rpc_client.d.ts.map +1 -1
  10. package/dist/actions/transports_http.d.ts +7 -0
  11. package/dist/actions/transports_http.d.ts.map +1 -1
  12. package/dist/actions/transports_http.js +18 -1
  13. package/dist/actions/transports_ws_backend.d.ts +4 -3
  14. package/dist/actions/transports_ws_backend.d.ts.map +1 -1
  15. package/dist/actions/transports_ws_backend.js +4 -3
  16. package/dist/auth/CLAUDE.md +1 -1
  17. package/dist/auth/account_routes.js +1 -1
  18. package/dist/auth/audit_log_routes.d.ts.map +1 -1
  19. package/dist/auth/audit_log_routes.js +3 -1
  20. package/dist/auth/audit_log_schema.d.ts +5 -5
  21. package/dist/auth/cell_action_specs.d.ts +3 -3
  22. package/dist/auth/credential_type_schema.d.ts +1 -1
  23. package/dist/auth/middleware.d.ts +13 -10
  24. package/dist/auth/middleware.d.ts.map +1 -1
  25. package/dist/auth/middleware.js +14 -10
  26. package/dist/auth/scope_kind_schema.d.ts.map +1 -1
  27. package/dist/auth/scope_kind_schema.js +1 -3
  28. package/dist/cli/daemon.js +0 -1
  29. package/dist/cli/logger.js +0 -1
  30. package/dist/db/db_pg.js +1 -1
  31. package/dist/env/load.js +0 -1
  32. package/dist/hono_context.d.ts +1 -1
  33. package/dist/http/CLAUDE.md +2 -1
  34. package/dist/http/auth_shape.d.ts +6 -6
  35. package/dist/http/error_schemas.d.ts +12 -2
  36. package/dist/http/error_schemas.d.ts.map +1 -1
  37. package/dist/http/error_schemas.js +10 -1
  38. package/dist/http/jsonrpc_errors.d.ts.map +1 -1
  39. package/dist/http/origin.d.ts +10 -6
  40. package/dist/http/origin.d.ts.map +1 -1
  41. package/dist/http/origin.js +10 -6
  42. package/dist/http/route_spec.d.ts +19 -12
  43. package/dist/http/route_spec.d.ts.map +1 -1
  44. package/dist/http/route_spec.js +33 -6
  45. package/dist/http/schema_helpers.d.ts +3 -1
  46. package/dist/http/schema_helpers.d.ts.map +1 -1
  47. package/dist/http/schema_helpers.js +3 -2
  48. package/dist/http/simple_request.d.ts +63 -0
  49. package/dist/http/simple_request.d.ts.map +1 -0
  50. package/dist/http/simple_request.js +84 -0
  51. package/dist/http/surface.js +0 -1
  52. package/dist/realtime/sse.js +0 -1
  53. package/dist/runtime/mock.js +1 -1
  54. package/dist/server/app_server.d.ts +2 -2
  55. package/dist/server/app_server.d.ts.map +1 -1
  56. package/dist/server/app_server.js +5 -2
  57. package/dist/testing/CLAUDE.md +21 -6
  58. package/dist/testing/admin_integration.d.ts.map +1 -1
  59. package/dist/testing/admin_integration.js +2 -1
  60. package/dist/testing/attack_surface.d.ts.map +1 -1
  61. package/dist/testing/attack_surface.js +14 -15
  62. package/dist/testing/audit_completeness.js +1 -1
  63. package/dist/testing/cross_backend/account_lifecycle.d.ts.map +1 -1
  64. package/dist/testing/cross_backend/account_lifecycle.js +0 -3
  65. package/dist/testing/cross_backend/action_manifest.d.ts +10 -14
  66. package/dist/testing/cross_backend/action_manifest.d.ts.map +1 -1
  67. package/dist/testing/cross_backend/action_manifest.js +0 -4
  68. package/dist/testing/cross_backend/actor_lookup.d.ts.map +1 -1
  69. package/dist/testing/cross_backend/actor_lookup.js +0 -3
  70. package/dist/testing/cross_backend/actor_search.d.ts.map +1 -1
  71. package/dist/testing/cross_backend/actor_search.js +0 -2
  72. package/dist/testing/cross_backend/app_settings.d.ts.map +1 -1
  73. package/dist/testing/cross_backend/app_settings.js +0 -2
  74. package/dist/testing/cross_backend/body_size.d.ts.map +1 -1
  75. package/dist/testing/cross_backend/body_size.js +0 -3
  76. package/dist/testing/cross_backend/body_size_smuggling.d.ts.map +1 -1
  77. package/dist/testing/cross_backend/body_size_smuggling.js +0 -2
  78. package/dist/testing/cross_backend/cell_cross_helpers.d.ts.map +1 -1
  79. package/dist/testing/cross_backend/cell_cross_helpers.js +0 -3
  80. package/dist/testing/cross_backend/cell_crud.d.ts.map +1 -1
  81. package/dist/testing/cross_backend/cell_crud.js +0 -3
  82. package/dist/testing/cross_backend/cell_gated_create.d.ts +0 -2
  83. package/dist/testing/cross_backend/cell_gated_create.d.ts.map +1 -1
  84. package/dist/testing/cross_backend/cell_gated_create.js +0 -4
  85. package/dist/testing/cross_backend/cell_grant_role.d.ts.map +1 -1
  86. package/dist/testing/cross_backend/cell_grant_role.js +0 -2
  87. package/dist/testing/cross_backend/cell_relations.d.ts.map +1 -1
  88. package/dist/testing/cross_backend/cell_relations.js +0 -3
  89. package/dist/testing/cross_backend/cookie_attributes.d.ts.map +1 -1
  90. package/dist/testing/cross_backend/cookie_attributes.js +0 -3
  91. package/dist/testing/cross_backend/credential_header_robustness.d.ts.map +1 -1
  92. package/dist/testing/cross_backend/credential_header_robustness.js +0 -2
  93. package/dist/testing/cross_backend/default_spine_surface.d.ts +0 -7
  94. package/dist/testing/cross_backend/default_spine_surface.d.ts.map +1 -1
  95. package/dist/testing/cross_backend/fact_serving.d.ts.map +1 -1
  96. package/dist/testing/cross_backend/fact_serving.js +0 -3
  97. package/dist/testing/cross_backend/full_spine_mount.d.ts +0 -5
  98. package/dist/testing/cross_backend/full_spine_mount.d.ts.map +1 -1
  99. package/dist/testing/cross_backend/identity_parity.d.ts.map +1 -1
  100. package/dist/testing/cross_backend/identity_parity.js +0 -2
  101. package/dist/testing/cross_backend/login_security.d.ts.map +1 -1
  102. package/dist/testing/cross_backend/login_security.js +0 -3
  103. package/dist/testing/cross_backend/origin.d.ts.map +1 -1
  104. package/dist/testing/cross_backend/origin.js +0 -3
  105. package/dist/testing/cross_backend/query_shape.d.ts.map +1 -1
  106. package/dist/testing/cross_backend/query_shape.js +0 -3
  107. package/dist/testing/cross_backend/ready.d.ts.map +1 -1
  108. package/dist/testing/cross_backend/ready.js +0 -3
  109. package/dist/testing/cross_backend/role_grant_offer_enumeration.d.ts.map +1 -1
  110. package/dist/testing/cross_backend/role_grant_offer_enumeration.js +0 -3
  111. package/dist/testing/cross_backend/role_grant_participation.d.ts.map +1 -1
  112. package/dist/testing/cross_backend/role_grant_participation.js +0 -3
  113. package/dist/testing/cross_backend/session_cap.d.ts.map +1 -1
  114. package/dist/testing/cross_backend/session_cap.js +0 -3
  115. package/dist/testing/cross_backend/simple_request.d.ts +11 -0
  116. package/dist/testing/cross_backend/simple_request.d.ts.map +1 -0
  117. package/dist/testing/cross_backend/simple_request.js +142 -0
  118. package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map +1 -1
  119. package/dist/testing/cross_backend/test_cell_gated_create_authorize.js +0 -3
  120. package/dist/testing/cross_backend/testing_backdoor.d.ts.map +1 -1
  121. package/dist/testing/cross_backend/testing_backdoor.js +0 -3
  122. package/dist/testing/cross_backend/testing_reset_actions.d.ts +5 -5
  123. package/dist/testing/cross_backend/testing_server_bun.js +1 -1
  124. package/dist/testing/cross_backend/token_lifetime.d.ts.map +1 -1
  125. package/dist/testing/cross_backend/token_lifetime.js +0 -4
  126. package/dist/testing/cross_backend/token_scope_surface.d.ts.map +1 -1
  127. package/dist/testing/cross_backend/token_scope_surface.js +0 -3
  128. package/dist/testing/cross_backend/ts_spine_backend_config.d.ts +1 -1
  129. package/dist/testing/cross_backend/ts_spine_backend_config.js +1 -1
  130. package/dist/testing/cross_backend/ws_action_rate_limit.d.ts.map +1 -1
  131. package/dist/testing/cross_backend/ws_action_rate_limit.js +0 -3
  132. package/dist/testing/cross_backend/ws_connection_cap.d.ts.map +1 -1
  133. package/dist/testing/cross_backend/ws_connection_cap.js +0 -3
  134. package/dist/testing/integration.d.ts.map +1 -1
  135. package/dist/testing/integration.js +40 -11
  136. package/dist/testing/rpc_helpers.d.ts.map +1 -1
  137. package/dist/testing/rpc_helpers.js +19 -7
  138. package/dist/testing/stubs.d.ts.map +1 -1
  139. package/dist/testing/stubs.js +3 -0
  140. package/dist/testing/transports/sse_frame_reader.d.ts.map +1 -1
  141. package/dist/testing/transports/sse_frame_reader.js +4 -1
  142. package/dist/testing/transports/ws_client.js +0 -1
  143. package/dist/ui/Datatable.svelte +2 -2
  144. package/dist/ui/auth_state.svelte.d.ts.map +1 -1
  145. package/dist/ui/auth_state.svelte.js +5 -1
  146. package/dist/ui/ui_format.d.ts.map +1 -1
  147. package/dist/ui/ui_format.js +2 -0
  148. package/package.json +19 -19
@@ -14,13 +14,6 @@ import '../assert_dev_env.js';
14
14
  * `create_app_server`), and
15
15
  * - the `cross_backend_ts_*` self-test projects.
16
16
  *
17
- * **`$lib`-free by contract.** This module and everything it imports use
18
- * relative specifiers (no `$lib` SvelteKit alias) so the spawned TS test
19
- * binary — run under Gro's loader, which resolves `.js`→`.ts` and package
20
- * imports but **not** the `$lib` alias — can import it transitively. Keep
21
- * it that way: a `$lib` import anywhere in this graph breaks the binary
22
- * spawn while still typechecking under vitest.
23
- *
24
17
  * @module
25
18
  */
26
19
  import type { Logger } from '@fuzdev/fuz_util/log.ts';
@@ -1 +1 @@
1
- {"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAI1F,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAe3E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,gBAGxB,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAgC/E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC+B,CAAC;AAE7F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAS1C,CAAC"}
1
+ {"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAI1F,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAe3E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,gBAGxB,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAgC/E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC+B,CAAC;AAE7F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAS1C,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAiOxF,CAAC"}
1
+ {"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8C9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAiOxF,CAAC"}
@@ -31,9 +31,6 @@ import '../assert_dev_env.js';
31
31
  * the TS spine binary and the Rust `testing_spine_stub` both mount the serve
32
32
  * routes + the seeder.
33
33
  *
34
- * `$lib`-free by contract (relative specifiers only) so it imports from the
35
- * spawnable cross-process test files.
36
- *
37
34
  * @module
38
35
  */
39
36
  import { describe, assert } from 'vitest';
@@ -30,11 +30,6 @@ import '../assert_dev_env.js';
30
30
  * enumerates `build_full_spine_rpc_actions` with stub deps and asserts the live method set equals the tagged coverage
31
31
  * manifest; see `src/test/cross_backend/spine_method_coverage.ts`.
32
32
  *
33
- * **`$lib`-free by contract** — like `default_spine_surface.ts`, this module
34
- * is reached by the spawned TS binary under Gro's loader (which resolves
35
- * `.js`→`.ts` but not the `$lib` alias), so every import is relative. Keep
36
- * it that way.
37
- *
38
33
  * @module
39
34
  */
40
35
  import type { RpcAction } from '../../actions/action_rpc.js';
@@ -1 +1 @@
1
- {"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAYvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoCjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}
1
+ {"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAYvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoCjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqG9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA6TF,CAAC"}
1
+ {"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmG9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA6TF,CAAC"}
@@ -85,8 +85,6 @@ import '../assert_dev_env.js';
85
85
  * cross-process leg (`cross_backend/identity_parity.cross.test.ts`, the TS spine
86
86
  * binaries + Rust `testing_spine_stub` over real HTTP).
87
87
  *
88
- * `$lib`-free by contract (relative specifiers only).
89
- *
90
88
  * @module
91
89
  */
92
90
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}
1
+ {"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}
@@ -46,9 +46,6 @@ import '../assert_dev_env.js';
46
46
  * (`describe_rate_limiting_tests` + the proxy middleware tests). Cited
47
47
  * property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
48
48
  *
49
- * `$lib`-free by contract (relative specifiers only), like the sibling
50
- * cross-backend suites.
51
- *
52
49
  * @module
53
50
  */
54
51
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAwC7E,CAAC"}
1
+ {"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAwC7E,CAAC"}
@@ -21,9 +21,6 @@ import '../assert_dev_env.js';
21
21
  * binaries + Rust `testing_spine_stub` over real HTTP). Origin middleware is
22
22
  * on every spine, so the suite is ungated.
23
23
  *
24
- * `$lib`-free by contract (relative specifiers only), like the sibling
25
- * cross-backend suites.
26
- *
27
24
  * @module
28
25
  */
29
26
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}
1
+ {"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}
@@ -28,9 +28,6 @@ import '../assert_dev_env.js';
28
28
  * `serve_fact_route.db.test.ts`); this suite is the cross-impl gate, so it is
29
29
  * cross-process only — like `login_security.ts` and `testing_backdoor.ts`.
30
30
  *
31
- * `$lib`-free by contract (relative specifiers only), like the sibling
32
- * cross-backend suites.
33
- *
34
31
  * @module
35
32
  */
36
33
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"ready.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ready.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAEnE,oDAAoD;AACpD,MAAM,WAAW,qBAAsB,SAAQ,gCAAgC;IAC9E,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,0BAA0B,GAAI,SAAS,qBAAqB,KAAG,IAuB3E,CAAC"}
1
+ {"version":3,"file":"ready.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ready.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAEnE,oDAAoD;AACpD,MAAM,WAAW,qBAAsB,SAAQ,gCAAgC;IAC9E,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,0BAA0B,GAAI,SAAS,qBAAqB,KAAG,IAuB3E,CAAC"}
@@ -22,9 +22,6 @@ import '../assert_dev_env.js';
22
22
  * the cross-process leg (`cross_backend/ready.cross.test.ts`, the TS spine
23
23
  * binaries + Rust `testing_spine_stub` over real HTTP).
24
24
  *
25
- * `$lib`-free by contract (relative specifiers only), like the sibling
26
- * cross-backend suites.
27
- *
28
25
  * @module
29
26
  */
30
27
  import { describe, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"role_grant_offer_enumeration.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_enumeration.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,sDAAsD;AACtD,MAAM,WAAW,yCAAyC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,yCAAyC,KAChD,IAqGF,CAAC"}
1
+ {"version":3,"file":"role_grant_offer_enumeration.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_enumeration.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,sDAAsD;AACtD,MAAM,WAAW,yCAAyC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,yCAAyC,KAChD,IAqGF,CAAC"}
@@ -37,9 +37,6 @@ import '../assert_dev_env.js';
37
37
  * cross-principal leaks; an intra-account sibling-actor offer stays a 403
38
38
  * `role_grant_offer_actor_mismatch`).
39
39
  *
40
- * `$lib`-free by contract (relative specifiers only), like the sibling
41
- * cross-backend suites.
42
- *
43
40
  * @module
44
41
  */
45
42
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA8IF,CAAC"}
1
+ {"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA8IF,CAAC"}
@@ -28,9 +28,6 @@ import '../assert_dev_env.js';
28
28
  * (`spine_roles` / the Rust stub's `RoleRegistry`), so the suite is ungated;
29
29
  * every spine mounts the standard RPC surface it drives.
30
30
  *
31
- * `$lib`-free by contract (relative specifiers only), like the sibling
32
- * cross-backend suites.
33
- *
34
31
  * @module
35
32
  */
36
33
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA4FtF,CAAC"}
1
+ {"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA4FtF,CAAC"}
@@ -43,9 +43,6 @@ import '../assert_dev_env.js';
43
43
  * the cap — see `query_session_enforce_limit`'s race note. That needs a
44
44
  * barrier-based test against one backend, not a parity case.
45
45
  *
46
- * `$lib`-free by contract (relative specifiers only), like the sibling
47
- * cross-backend suites.
48
- *
49
46
  * @module
50
47
  */
51
48
  import { describe, test, assert } from 'vitest';
@@ -0,0 +1,11 @@
1
+ import '../assert_dev_env.js';
2
+ import type { RpcPathCrossSuiteOptions } from './setup.js';
3
+ /** Options for the simple-request parity suite. */
4
+ export interface SimpleRequestCrossTestOptions extends RpcPathCrossSuiteOptions {
5
+ /** REST login route path. Default `/api/account/login` (the spine convention). */
6
+ readonly login_path?: string;
7
+ /** REST logout route path. Default `/api/account/logout` (the spine convention). */
8
+ readonly logout_path?: string;
9
+ }
10
+ export declare const describe_simple_request_cross_tests: (options: SimpleRequestCrossTestOptions) => void;
11
+ //# sourceMappingURL=simple_request.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"simple_request.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/simple_request.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE,mDAAmD;AACnD,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC9E,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAuHF,CAAC"}
@@ -0,0 +1,142 @@
1
+ import '../assert_dev_env.js';
2
+ /**
3
+ * Cross-backend parity suite for refusing CORS simple requests.
4
+ *
5
+ * A `POST` with no `Content-Type`, or a `text/plain` / form / multipart one,
6
+ * is what a browser sends cross-origin without a preflight — carrying the
7
+ * session cookie when the page is same-site, which any other `localhost`
8
+ * port is. Every spine's JSON routes require `application/json` and refuse
9
+ * anything else with a flat `415` `{error: 'unsupported_content_type'}`
10
+ * before reading a credential or the body: the TS spine per route
11
+ * (`apply_route_specs`, every `POST` that isn't `raw_body`), the Rust spine
12
+ * in each JSON handler. The cases carry an allowed `Origin` and, where it
13
+ * matters, the keeper's session — the exact shape of a same-site page's
14
+ * forged request, which the origin allowlist alone admits when it's a
15
+ * wildcard — and a refused request must leave that session untouched.
16
+ *
17
+ * Runs both legs via the shared `setup_test` protocol: in-process
18
+ * (`auth/simple_request_parity.db.test.ts`) and cross-process
19
+ * (`cross_backend/simple_request.cross.test.ts`). Every spine has the gate,
20
+ * so the suite is ungated.
21
+ *
22
+ * @module
23
+ */
24
+ import { describe, test, assert } from 'vitest';
25
+ import { account_verify_action_spec } from '../../auth/account_action_specs.js';
26
+ import { ERROR_UNSUPPORTED_CONTENT_TYPE } from '../../http/error_schemas.js';
27
+ import { SPINE_RPC_PATH } from './spine_surface_constants.js';
28
+ /** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
29
+ const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
30
+ /** Assert a flat `415` content-type refusal. */
31
+ const assert_refused = async (res, label) => {
32
+ assert.strictEqual(res.status, 415, `${label} must be refused with 415`);
33
+ const body = (await res.json().catch(() => undefined));
34
+ assert.strictEqual(body?.error, ERROR_UNSUPPORTED_CONTENT_TYPE, label);
35
+ };
36
+ export const describe_simple_request_cross_tests = (options) => {
37
+ const { setup_test } = options;
38
+ const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
39
+ const login_path = options.login_path ?? '/api/account/login';
40
+ const logout_path = options.logout_path ?? '/api/account/logout';
41
+ /** POST a JSON `account_verify` with the fixture's session — 200 while it's valid. */
42
+ const verify_session = async (fixture, id) => {
43
+ const res = await fixture.transport(rpc_path, {
44
+ method: 'POST',
45
+ headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
46
+ body: verify_envelope(id)
47
+ });
48
+ return res.status;
49
+ };
50
+ describe('CORS simple-request refusal parity', () => {
51
+ test('a CORS-safelisted RPC POST with a session → 415, in any spelling', async () => {
52
+ const fixture = await setup_test();
53
+ for (const content_type of [
54
+ 'text/plain;charset=UTF-8',
55
+ 'Text/Plain',
56
+ 'application/x-www-form-urlencoded',
57
+ 'multipart/form-data; boundary=x'
58
+ ]) {
59
+ const res = await fixture.transport(rpc_path, {
60
+ method: 'POST',
61
+ headers: { ...fixture.create_session_headers(), 'content-type': content_type },
62
+ body: verify_envelope('simple-safelisted')
63
+ });
64
+ await assert_refused(res, `a ${content_type} RPC POST`);
65
+ }
66
+ });
67
+ test('RPC POST with no Content-Type → 415', async () => {
68
+ const fixture = await setup_test();
69
+ // a byte body, so `fetch` adds no `Content-Type` of its own (a string
70
+ // body would get `text/plain;charset=UTF-8`)
71
+ const res = await fixture.transport(rpc_path, {
72
+ method: 'POST',
73
+ headers: fixture.create_session_headers(),
74
+ body: new TextEncoder().encode(verify_envelope('simple-untyped'))
75
+ });
76
+ await assert_refused(res, 'an untyped RPC POST');
77
+ });
78
+ test('a JSON route refuses any type but application/json', async () => {
79
+ const fixture = await setup_test();
80
+ for (const content_type of ['application/octet-stream', 'application/vnd.api+json', '']) {
81
+ const res = await fixture.transport(rpc_path, {
82
+ method: 'POST',
83
+ headers: { ...fixture.create_session_headers(), 'content-type': content_type },
84
+ body: verify_envelope('simple-not-json')
85
+ });
86
+ await assert_refused(res, `an RPC POST typed '${content_type}'`);
87
+ const login = await fixture.fresh_transport()(login_path, {
88
+ method: 'POST',
89
+ headers: { 'content-type': content_type },
90
+ body: JSON.stringify({ username: 'keeper', password: 'whatever' })
91
+ });
92
+ await assert_refused(login, `a login typed '${content_type}'`);
93
+ }
94
+ });
95
+ test('form-encoded login → 415', async () => {
96
+ const fixture = await setup_test();
97
+ const res = await fixture.fresh_transport()(login_path, {
98
+ method: 'POST',
99
+ headers: { 'content-type': 'application/x-www-form-urlencoded' },
100
+ body: 'username=keeper&password=whatever'
101
+ });
102
+ await assert_refused(res, 'a form-encoded login');
103
+ });
104
+ test('a forged text/plain logout with a session → 415, and the session survives', async () => {
105
+ const fixture = await setup_test();
106
+ const res = await fixture.transport(logout_path, {
107
+ method: 'POST',
108
+ headers: { ...fixture.create_session_headers(), 'content-type': 'text/plain' }
109
+ });
110
+ await assert_refused(res, 'a text/plain logout');
111
+ assert.strictEqual(await verify_session(fixture, 'after-forged-logout'), 200, 'the refused logout must not end the session');
112
+ });
113
+ test('an untyped logout with no session → 415, before the auth check', async () => {
114
+ const fixture = await setup_test();
115
+ const res = await fixture.fresh_transport()(logout_path, {
116
+ method: 'POST',
117
+ headers: { 'content-type': 'application/octet-stream' }
118
+ });
119
+ await assert_refused(res, 'an octet-stream logout');
120
+ });
121
+ test('JSON logout with no body and no session → 401, not 415', async () => {
122
+ const fixture = await setup_test();
123
+ const res = await fixture.fresh_transport()(logout_path, {
124
+ method: 'POST',
125
+ headers: { 'content-type': 'application/json' }
126
+ });
127
+ assert.strictEqual(res.status, 401, 'a bodyless JSON logout must reach the auth check');
128
+ });
129
+ test('application/json with a charset → dispatched', async () => {
130
+ const fixture = await setup_test();
131
+ const res = await fixture.transport(rpc_path, {
132
+ method: 'POST',
133
+ headers: {
134
+ ...fixture.create_session_headers(),
135
+ 'content-type': 'application/json; charset=utf-8'
136
+ },
137
+ body: verify_envelope('json-charset')
138
+ });
139
+ assert.strictEqual(res.status, 200, 'a JSON RPC POST must be dispatched');
140
+ });
141
+ });
142
+ };
@@ -1 +1 @@
1
- {"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}
1
+ {"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}
@@ -20,9 +20,6 @@ import '../assert_dev_env.js';
20
20
  * the predicate is **pure** — no DB read of its own (which also dodges the
21
21
  * single-connection PGlite deadlock a separate handle would hit).
22
22
  *
23
- * **`$lib`-free by contract** — reached by the spawned TS spine binary under
24
- * Gro's loader (no `$lib` alias). Keep every import relative.
25
- *
26
23
  * @module
27
24
  */
28
25
  import { has_scoped_role } from '../../auth/request_context.js';
@@ -1 +1 @@
1
- {"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
1
+ {"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
@@ -57,9 +57,6 @@ import '../assert_dev_env.js';
57
57
  * backend mounts them, and the WS cases run when `ws` is passed — for a
58
58
  * backend that also serves them on its WS endpoint.
59
59
  *
60
- * `$lib`-free by contract (relative specifiers only), like the sibling
61
- * cross-backend suites.
62
- *
63
60
  * @module
64
61
  */
65
62
  import { describe, test, assert } from 'vitest';
@@ -427,21 +427,21 @@ export declare const testing_action_manifest_action_spec: {
427
427
  method: z.ZodString;
428
428
  side_effects: z.ZodBoolean;
429
429
  account: z.ZodEnum<{
430
- optional: "optional";
431
- none: "none";
432
430
  required: "required";
431
+ none: "none";
432
+ optional: "optional";
433
433
  }>;
434
434
  actor: z.ZodEnum<{
435
- optional: "optional";
436
- none: "none";
437
435
  required: "required";
436
+ none: "none";
437
+ optional: "optional";
438
438
  }>;
439
439
  roles: z.ZodArray<z.ZodString>;
440
440
  credential_types: z.ZodArray<z.ZodString>;
441
441
  rate_limit: z.ZodNullable<z.ZodEnum<{
442
+ both: "both";
442
443
  account: "account";
443
444
  ip: "ip";
444
- both: "both";
445
445
  }>>;
446
446
  }, z.core.$strict>>;
447
447
  }, z.core.$strict>;
@@ -51,7 +51,7 @@ export const create_bun_testing_adapter = () => {
51
51
  },
52
52
  serve: ({ fetch, port, hostname }) => {
53
53
  const server = Bun.serve({
54
- fetch: fetch,
54
+ fetch,
55
55
  port,
56
56
  hostname,
57
57
  // Harmless for HTTP-only binaries — Bun only invokes it for sockets
@@ -1 +1 @@
1
- {"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAsHF,CAAC"}
1
+ {"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAsHF,CAAC"}
@@ -28,10 +28,6 @@ import '../assert_dev_env.js';
28
28
  * - **Out-of-range days are refused** — `days: 0` 400s identically, so the
29
29
  * two hand-rolled bounds checks can't drift.
30
30
  *
31
- * `$lib`-free by contract (relative specifiers only), like the sibling
32
- * cross-backend suites. Runs both legs — in-process (`gro test`) and
33
- * cross-process — through the shared `{setup_test}` protocol.
34
- *
35
31
  * @module
36
32
  */
37
33
  import { describe, test, assert } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}
1
+ {"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}
@@ -60,9 +60,6 @@ import '../assert_dev_env.js';
60
60
  * gate needs. The WS gate keeps its per-spine coverage (fuz_app's surface
61
61
  * census pins the call site; the Rust census pins its own).
62
62
  *
63
- * `$lib`-free by contract (relative specifiers only), like the sibling
64
- * cross-backend suites.
65
- *
66
63
  * @module
67
64
  */
68
65
  import { describe, assert } from 'vitest';
@@ -63,7 +63,7 @@ export interface TsSpineBackendConfigOptions {
63
63
  }
64
64
  /**
65
65
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`
66
- * (Gro's TS loader resolves the `$lib`-free entry's relative imports).
66
+ * (Gro's TS loader resolves the entry's relative imports).
67
67
  */
68
68
  export declare const ts_spine_node_backend_config: (options?: TsSpineBackendConfigOptions) => BackendConfig;
69
69
  /**
@@ -62,7 +62,7 @@ export const TS_SPINE_BUN_ENTRY = 'src/test/cross_backend/testing_spine_server_b
62
62
  const login_rate_limit_env = (enable) => enable ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {};
63
63
  /**
64
64
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`
65
- * (Gro's TS loader resolves the `$lib`-free entry's relative imports).
65
+ * (Gro's TS loader resolves the entry's relative imports).
66
66
  */
67
67
  export const ts_spine_node_backend_config = (options = {}) => {
68
68
  const { port = TS_SPINE_NODE_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
@@ -1 +1 @@
1
- {"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}
1
+ {"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}
@@ -48,9 +48,6 @@ import '../assert_dev_env.js';
48
48
  * (`create_app_server` threading one limiter pair to both mounts on TS; the
49
49
  * stub's dispatcher states plus its auth-family builders on Rust).
50
50
  *
51
- * `$lib`-free by contract (relative specifiers only), like the sibling
52
- * cross-backend suites.
53
- *
54
51
  * @module
55
52
  */
56
53
  import { assert, describe, test } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"ws_connection_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_connection_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,6DAA6D;AAC7D,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,+BAA+B,KACtC,IA4GF,CAAC"}
1
+ {"version":3,"file":"ws_connection_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_connection_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,6DAA6D;AAC7D,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,+BAA+B,KACtC,IA4GF,CAAC"}
@@ -38,9 +38,6 @@ import '../assert_dev_env.js';
38
38
  * which is why it's a separate call rather than more cases on the WS
39
39
  * round-trip suite.
40
40
  *
41
- * `$lib`-free by contract (relative specifiers only), like the sibling
42
- * cross-backend suites.
43
- *
44
41
  * @module
45
42
  */
46
43
  import { assert, describe } from 'vitest';
@@ -1 +1 @@
1
- {"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAs8CF,CAAC"}
1
+ {"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAw+CF,CAAC"}