@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/testing/cross_backend/capabilities.js

@@ -47,8 +47,8 @@ import { test } from 'vitest';
  * `create_ws_transport`, so the in-process driver never runs it — the
  * transport itself supports server-initiated requests),
  * `ws_handshake_pipelining` (raw bytes on a real socket),
- * `ws_account_actions` (a real socket's reply-then-close ordering), and
- * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * `ws_account_actions` (a real socket's reply-then-close ordering),
+ * `cell_gated_create`, and `ws_role_gated`. Cross-process consumers declare each flag explicitly
  * per backend.
  */
 export const in_process_capabilities = Object.freeze({
@@ -71,7 +71,13 @@ export const in_process_capabilities = Object.freeze({
     ws_self_revocation_reply: true,
     // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
     // spine binaries' full mount + the Rust stub, not the in-process default app.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Cross-process-only: the gated endpoint is a spine-binary mount, and the
+    // case reads a real socket's close.
+    ws_role_gated: false,
+    // Read only by the front-door table's WS rows, which skip in-process (no
+    // socket to upgrade); Hono's own refusals carry their bodies.
+    ws_refusal_body: true
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -66,6 +66,11 @@ import { z } from 'zod';
  *   be replayed from a browser — wire-indistinguishable from sending no
  *   credential (the `token` principal is the honored counterpart: it suppresses
  *   `Origin`, so the same token authenticates).
+ * - `malformed_bearer` — the keeper's bearer api-token with its last character
+ *   dropped, non-browser context, fresh jar. A value that cannot be a token
+ *   fails each spine's shape precheck and soft-fails before any database work,
+ *   so the request arrives anonymous — wire-indistinguishable from sending no
+ *   credential.
  * - `scoped_token` — the keeper authenticated via a bearer api-token minted
  *   with a **narrowed** `TokenScope` (`{kind: 'methods', methods:
  *   [SCOPED_TOKEN_ADMITTED_METHOD]}`), non-browser context. Minted through the
@@ -92,12 +97,13 @@ import { z } from 'zod';
 export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
-    anonymous: "anonymous";
     daemon: "daemon";
     invalid_daemon: "invalid_daemon";
     daemon_browser: "daemon_browser";
     bearer_browser: "bearer_browser";
+    malformed_bearer: "malformed_bearer";
     scoped_token: "scoped_token";
+    anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
     wrong_role: "wrong_role";
@@ -122,12 +128,13 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
     as: z.ZodEnum<{
         keeper: "keeper";
         token: "token";
-        anonymous: "anonymous";
         daemon: "daemon";
         invalid_daemon: "invalid_daemon";
         daemon_browser: "daemon_browser";
         bearer_browser: "bearer_browser";
+        malformed_bearer: "malformed_bearer";
         scoped_token: "scoped_token";
+        anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
         wrong_role: "wrong_role";
@@ -179,12 +186,13 @@ export declare const ConformanceCase: z.ZodObject<{
         as: z.ZodEnum<{
             keeper: "keeper";
             token: "token";
-            anonymous: "anonymous";
             daemon: "daemon";
             invalid_daemon: "invalid_daemon";
             daemon_browser: "daemon_browser";
             bearer_browser: "bearer_browser";
+            malformed_bearer: "malformed_bearer";
             scoped_token: "scoped_token";
+            anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";
             wrong_role: "wrong_role";

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;EAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;EAc/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -66,6 +66,11 @@ import { z } from 'zod';
  *   be replayed from a browser — wire-indistinguishable from sending no
  *   credential (the `token` principal is the honored counterpart: it suppresses
  *   `Origin`, so the same token authenticates).
+ * - `malformed_bearer` — the keeper's bearer api-token with its last character
+ *   dropped, non-browser context, fresh jar. A value that cannot be a token
+ *   fails each spine's shape precheck and soft-fails before any database work,
+ *   so the request arrives anonymous — wire-indistinguishable from sending no
+ *   credential.
  * - `scoped_token` — the keeper authenticated via a bearer api-token minted
  *   with a **narrowed** `TokenScope` (`{kind: 'methods', methods:
  *   [SCOPED_TOKEN_ADMITTED_METHOD]}`), non-browser context. Minted through the
@@ -96,6 +101,7 @@ export const ConformancePrincipal = z.enum([
     'daemon_browser',
     'token',
     'bearer_browser',
+    'malformed_bearer',
     'scoped_token',
     'anonymous',
     'fresh_non_admin',

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEN,KAAK,eAAe,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqPD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAwKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEN,KAAK,eAAe,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAIzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAmPD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAwKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -27,9 +27,10 @@ import '../assert_dev_env.js';
 import { assert, describe, test } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { find_auth_route, rest_auth_route_suffixes } from '../integration_helpers.js';
-import { find_rpc_action, headers_to_record, rpc_call, rpc_call_for_spec, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
+import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
 import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
 import { SCOPED_TOKEN_ADMITTED_METHOD } from './conformance_case.js';
+import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { xfail_until } from './xfail.js';
 /**
  * A deliberately malformed `X-Daemon-Token` value for the `invalid_daemon`
@@ -61,26 +62,13 @@ const mint_scoped_token = async (fixture, resolved_rpc_endpoints) => {
             `on the surface to mint its narrowed token, but the method is not registered on ` +
             `rpc_endpoints.`);
     }
-    // Spec-bound rather than a loose `rpc_call`: `params` type-checks against
-    // `TokenCreateInput` (so dropping `scope` is a compile error, not a runtime
-    // 400 in every test at once), and `result.token` comes back typed and
-    // output-validated — no cast, no hand-rolled presence check.
-    const res = await rpc_call_for_spec({
+    return mint_narrowed_api_token({
         app: fixture.transport,
-        path: found.path,
-        spec: account_token_create_action_spec,
-        params: {
-            name: 'conformance scoped token',
-            scope: { kind: 'methods', methods: [SCOPED_TOKEN_ADMITTED_METHOD] },
-            lifetime: { kind: 'eternal' }
-        },
-        headers: fixture.create_session_headers()
+        rpc_path: found.path,
+        session_headers: fixture.create_session_headers(),
+        methods: [SCOPED_TOKEN_ADMITTED_METHOD],
+        name: 'conformance scoped token'
     });
-    if (!res.ok) {
-        throw new Error(`conformance: minting the 'scoped_token' principal failed with ${res.status}: ` +
-            JSON.stringify(res.error));
-    }
-    return res.result.token;
 };
 /**
  * Map a `ConformancePrincipal` onto the transport + headers it
@@ -159,6 +147,19 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
                 transport: fixture.fresh_transport(),
                 headers: fixture.create_bearer_headers()
             };
+        case 'malformed_bearer': {
+            // The keeper's valid token minus its last character — prefixed, one char
+            // short — over the same no-Origin, empty-jar transport as `token`, so the
+            // shape precheck (not the browser-context discard) is what refuses it.
+            const valid = fixture.create_bearer_headers().authorization;
+            if (!valid)
+                throw new Error(`conformance: principal 'malformed_bearer' found no bearer header`);
+            return {
+                transport: fixture.fresh_transport({ origin: null }),
+                headers: { authorization: valid.slice(0, -1) },
+                suppress_default_origin: true
+            };
+        }
         case 'scoped_token': {
             // A narrowed bearer, otherwise identical to `token` — empty jar + no
             // Origin, so the credential is honored rather than browser-discarded

package/dist/testing/cross_backend/credential_deadline.d.ts

@@ -0,0 +1,25 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { SetupTest } from './setup.js';
+/** Configuration for `describe_credential_deadline_cross_tests`. */
+export interface CredentialDeadlineCrossTestOptions {
+    /** Per-test fixture producer (`default_cross_process_setup(handle)`). */
+    readonly setup_test: SetupTest;
+    /** Backend capability flags — the WebSocket cases gate on `ws`, the stream case on `sse`. */
+    readonly capabilities: BackendCapabilities;
+    /** Base URL the backend is reachable at. */
+    readonly base_url: string;
+    /** The WebSocket endpoint path (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** The audit-log stream path. Default `/api/admin/audit/stream`. */
+    readonly sse_path?: string;
+    /** JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
+    readonly rpc_path?: string;
+}
+/**
+ * Register the credential-deadline suite: a WebSocket on a session or an API
+ * token closes with 4001 "Credential expired" at its credential's expiry, an
+ * audit stream on a session ends there, and the expiry seam never extends.
+ */
+export declare const describe_credential_deadline_cross_tests: (options: CredentialDeadlineCrossTestOptions) => void;
+//# sourceMappingURL=credential_deadline.d.ts.map

package/dist/testing/cross_backend/credential_deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_deadline.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_deadline.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAsB7E,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,kCAAkC,KACzC,IAoKF,CAAC"}

package/dist/testing/cross_backend/credential_deadline.js

@@ -0,0 +1,185 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-process **credential deadline** suite — a long-lived connection
+ * closes when the credential it was opened with expires.
+ *
+ * A WebSocket or an audit stream is authorized once, at open, and closed on
+ * revocation by identity — but expiry writes nothing a revocation listener
+ * could hear. So each spine carries the credential's deadline onto the
+ * connection (`ResolvedAuth.credential_deadline`: the earlier of a session's
+ * cookie and row expiry, an API token's row expiry) and closes it there: a
+ * socket with `WS_CLOSE_SESSION_REVOKED` and
+ * `WS_CLOSE_CREDENTIAL_EXPIRED_REASON`, a stream by ending it as a revoked one
+ * ends.
+ *
+ * Each case pulls a fresh account's credential expiries in to
+ * `expiry_seconds` from now with the daemon-token
+ * `_testing_shorten_credential_expiry` seam, **before** opening the
+ * connection (the deadline is read when the credential resolves), then checks
+ * the connection is open short of the deadline and closed at it:
+ *
+ * 1. WebSocket × session — 4001, "Credential expired".
+ * 2. WebSocket × API token — the same.
+ * 3. Audit stream × session — the stream ends.
+ * 4. The seam only shortens: a second call asking for a later expiry moves
+ *    nothing, and the socket still closes at the first deadline.
+ *
+ * The fourth reachable combination, API token × audit stream, is not here:
+ * the stock audit stream admits sessions only on both spines. Each spine
+ * covers it below the wire — the Rust stream route on a widened credential
+ * gate, the TS deadline wait shared by both transports.
+ *
+ * Gated on `capabilities.ws` (cases 1, 2, 4) and `capabilities.sse` (case 3);
+ * cross-process only — the seam is mounted on the spine test binaries.
+ *
+ * @module
+ */
+import { assert, describe } from 'vitest';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
+import { WS_CLOSE_CREDENTIAL_EXPIRED_REASON, WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SSE_CONNECTED_COMMENT } from '../../realtime/sse_constants.js';
+import { rpc_call_non_browser } from '../rpc_helpers.js';
+import { create_sse_transport } from '../transports/sse_transport.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { test_if } from './capabilities.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** Default audit-log stream path. */
+const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+/** The shortened lifetime each case gives its credentials, in seconds. */
+const EXPIRY_SECONDS = 2;
+/**
+ * How long past the deadline a close may take before the case fails — wide
+ * for a loaded machine, and bounded so a missing close fails rather than
+ * hangs.
+ */
+const CLOSE_GRACE_MS = 4000;
+/**
+ * The deadline counts from the seam's call, and the connection opens after
+ * it; a close sooner than this after the call came before the deadline.
+ */
+const EARLIEST_CLOSE_MS = EXPIRY_SECONDS * 1000 - 300;
+/**
+ * Register the credential-deadline suite: a WebSocket on a session or an API
+ * token closes with 4001 "Credential expired" at its credential's expiry, an
+ * audit stream on a session ends there, and the expiry seam never extends.
+ */
+export const describe_credential_deadline_cross_tests = (options) => {
+    const { setup_test, capabilities, base_url, ws_path, sse_path = DEFAULT_SSE_PATH, rpc_path = SPINE_RPC_PATH } = options;
+    /**
+     * Pull `account`'s credential expiries in to `seconds` from now through the
+     * daemon-token seam, returning when it was called.
+     */
+    const shorten = async (fixture, account, seconds) => {
+        const called_at = performance.now();
+        const result = await rpc_call_non_browser({
+            app: fixture.fresh_transport({ origin: null }),
+            path: rpc_path,
+            method: '_testing_shorten_credential_expiry',
+            params: { account_id: account.account.id, seconds },
+            headers: fixture.create_daemon_token_headers()
+        });
+        if (!result.ok) {
+            assert.fail(`_testing_shorten_credential_expiry failed: ${JSON.stringify(result)}`);
+        }
+        const counts = result.result;
+        return { called_at, ...counts };
+    };
+    const cookie_of = (account) => {
+        const { cookie } = account.create_session_headers();
+        assert.ok(cookie, 'expected a session cookie');
+        return cookie;
+    };
+    /**
+     * Assert `client` is open short of the deadline, then closes with 4001
+     * "Credential expired" at it.
+     */
+    const assert_closes_at_deadline = async (client, called_at) => {
+        // open and dispatching before the deadline
+        assert.deepStrictEqual(await client.request(1, heartbeat_action_spec.method, {}), {});
+        assert.ok(await client.wait_for_close(EXPIRY_SECONDS * 1000 + CLOSE_GRACE_MS), 'the socket did not close at its credential deadline');
+        const elapsed = performance.now() - called_at;
+        assert.ok(elapsed >= EARLIEST_CLOSE_MS, `closed ${Math.round(elapsed)}ms in, before the deadline`);
+        assert.strictEqual(client.close_code, WS_CLOSE_SESSION_REVOKED);
+        assert.strictEqual(client.close_reason, WS_CLOSE_CREDENTIAL_EXPIRED_REASON);
+    };
+    describe('credential deadline (cross-process)', () => {
+        test_if(capabilities.ws, 'a session socket closes with 4001 "Credential expired" at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at, sessions } = await shorten(fixture, account, EXPIRY_SECONDS);
+            assert.ok(sessions >= 1, 'the seam shortened the account session');
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+        test_if(capabilities.ws, 'an API token socket closes with 4001 "Credential expired" at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at, api_tokens } = await shorten(fixture, account, EXPIRY_SECONDS);
+            assert.ok(api_tokens >= 1, 'the seam shortened the account API token');
+            // a bearer outside a browser context: no Origin, no cookie
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [],
+                origin: null,
+                headers: { Authorization: `Bearer ${account.api_token}` }
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+        test_if(capabilities.sse, 'a session audit stream ends at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account({ roles: [ROLE_ADMIN] });
+            const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
+            const sse = await create_sse_transport({
+                base_url,
+                sse_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                assert.strictEqual((await sse.read_frame()) + '\n\n', SSE_CONNECTED_COMMENT, 'the stream opened');
+                assert.ok(await sse.wait_for_close(EXPIRY_SECONDS * 1000 + CLOSE_GRACE_MS), 'the stream did not end at its credential deadline');
+                const elapsed = performance.now() - called_at;
+                assert.ok(elapsed >= EARLIEST_CLOSE_MS, `ended ${Math.round(elapsed)}ms in, before the deadline`);
+            }
+            finally {
+                await sse.close();
+            }
+        });
+        test_if(capabilities.ws, 'the expiry seam only shortens: a later expiry moves nothing', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
+            // asks for a minute; the credentials stay due at the first deadline
+            await shorten(fixture, account, 60);
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+    });
+};

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAmCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA6BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAkCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -53,7 +53,13 @@ export const ts_default_capabilities = Object.freeze({
     // Off by default — the `cell_gated_create` test policy is a fuz_app test
     // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
     // consumers.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Off by default — the second, role-gated WS endpoint is a spine-binary
+    // mount (`SPINE_ROLE_GATED_WS_PATH`); fuz_app's spine configs opt in.
+    ws_role_gated: false,
+    // Off by default: `@hono/node-ws` drops a refused upgrade's body, so a
+    // Node-served consumer sends none. A Deno- or Bun-served one may opt in.
+    ws_refusal_body: false
 });
 /**
  * Capabilities for the Rust family. The non-gating wiring facts live in
@@ -88,7 +94,12 @@ export const rust_default_capabilities = Object.freeze({
     ws_self_revocation_reply: false,
     // Off by default — the `testing_spine_stub` preset opts in (it mounts the
     // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Off by default — the `testing_spine_stub` preset opts in (it mounts the
+    // role-gated WS endpoint at `SPINE_ROLE_GATED_WS_PATH`).
+    ws_role_gated: false,
+    // axum sends a refused upgrade's response as built, body included.
+    ws_refusal_body: true
 });
 /**
  * Shape notes for TS-family backends — wiring facts, not gating flags.

package/dist/testing/cross_backend/full_spine_mount.d.ts

@@ -14,6 +14,9 @@ import '../assert_dev_env.js';
  * - the `_testing_*` daemon-token backdoors (`create_testing_actions`),
  * - the full cell verb set (CRUD + grant + field + item + audit),
  * - the opt-in `actor_lookup` / `actor_search` resolvers,
+ * - the `_testing_origin_check` probe the origin conformance table drives,
+ * - the `_testing_shorten_credential_expiry` seam the credential-deadline
+ *   suite drives,
  * - the `_testing_action_manifest` backdoor, appended last (it dumps the live
  *   method set for the cross-impl manifest-parity gate, so it must enumerate
  *   every method above it).

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAYvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoCjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAcvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,7 +5,7 @@ import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js'
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
-import { create_testing_action_manifest_action, create_testing_actions } from './testing_reset_actions.js';
+import { create_testing_action_manifest_action, create_testing_actions, create_testing_origin_check_action, create_testing_shorten_credential_expiry_action } from './testing_reset_actions.js';
 import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
 /**
@@ -39,6 +39,12 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),
+        // the origin conformance table's probe — kept out of
+        // `create_testing_actions` (see its spec doc)
+        create_testing_origin_check_action(),
+        // the credential-deadline suite's shorten-only seam — kept out of
+        // `create_testing_actions` for the same reason
+        create_testing_shorten_credential_expiry_action(),
         // `peer/ping` is mounted on the HTTP RPC endpoint too (not just WS) so an
         // HTTP invocation reaches the handler and refuses with `peer_no_transport`
         // rather than `method_not_found`. It's a protocol action, so it's filtered

package/dist/testing/cross_backend/narrowed_api_token.d.ts

@@ -0,0 +1,23 @@
+import '../assert_dev_env.js';
+import { type RpcCallApp } from '../rpc_helpers.js';
+/** Options for `mint_narrowed_api_token`. */
+export interface MintNarrowedApiTokenOptions {
+    /** Transport the mint goes over — it must carry an allowed `Origin` (the default `rpc_call` one does). */
+    readonly app: RpcCallApp;
+    /** RPC endpoint path `account_token_create` is mounted on. */
+    readonly rpc_path: string;
+    /** Session credential headers of the account that owns the token — the mint is session-only. */
+    readonly session_headers: Record<string, string>;
+    /** The RPC methods the token admits; every other method and every non-RPC surface refuses it. */
+    readonly methods: ReadonlyArray<string>;
+    /** Token label. Default `'narrowed test token'`. */
+    readonly name?: string;
+}
+/**
+ * Mint a narrowed api token and return its raw bearer value.
+ *
+ * @returns the raw token, for an `Authorization: Bearer` header
+ * @throws Error when the mint is refused, naming the status and error
+ */
+export declare const mint_narrowed_api_token: (options: MintNarrowedApiTokenOptions) => Promise<string>;
+//# sourceMappingURL=narrowed_api_token.d.ts.map

package/dist/testing/cross_backend/narrowed_api_token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrowed_api_token.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/narrowed_api_token.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiB9B,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEvE,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,2BAA2B,KAClC,OAAO,CAAC,MAAM,CAmBhB,CAAC"}

package/dist/testing/cross_backend/narrowed_api_token.js

@@ -0,0 +1,40 @@
+import '../assert_dev_env.js';
+/**
+ * Mint a narrowed (method-scoped) api token through the production
+ * `account_token_create` path, for suites that probe what a narrowed token is
+ * refused.
+ *
+ * Minted rather than seeded: the token comes out of the same handler a real
+ * minter uses, on whichever account owns the session the caller passes — so a
+ * suite can put a narrowed token on an account that lacks a gating role, and
+ * the mint itself asserts that a narrowed scope is accepted at the mint
+ * boundary, not merely stored.
+ *
+ * @module
+ */
+import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
+import { rpc_call_for_spec } from '../rpc_helpers.js';
+/**
+ * Mint a narrowed api token and return its raw bearer value.
+ *
+ * @returns the raw token, for an `Authorization: Bearer` header
+ * @throws Error when the mint is refused, naming the status and error
+ */
+export const mint_narrowed_api_token = async (options) => {
+    const { app, rpc_path, session_headers, methods, name = 'narrowed test token' } = options;
+    const res = await rpc_call_for_spec({
+        app,
+        path: rpc_path,
+        spec: account_token_create_action_spec,
+        params: {
+            name,
+            scope: { kind: 'methods', methods: [...methods] },
+            lifetime: { kind: 'eternal' }
+        },
+        headers: session_headers
+    });
+    if (!res.ok) {
+        throw new Error(`minting a narrowed api token failed with ${res.status}: ${JSON.stringify(res.error)}`);
+    }
+    return res.result.token;
+};

package/dist/testing/cross_backend/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAwC7E,CAAC"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAqB7E,CAAC"}

package/dist/testing/cross_backend/origin.js

@@ -3,18 +3,17 @@ import '../assert_dev_env.js';
  * Cross-backend parity suite for Origin verification.
  *
  * Origin checking is middleware that runs *before* the RPC dispatcher and
- * returns a flat REST `{error}` body — not a JSON-RPC envelope — so it
- * doesn't fit the envelope-shaped conformance-table runner. This dedicated
- * imperative suite drives raw transport calls instead, mirroring how the
- * in-process origin tests were already hand-rolled. Two cases:
+ * refuses only an `Origin` it doesn't allow. The case here needs a transport
+ * that sends no `Origin` at all (`fresh_transport({origin: null})`), so this
+ * is an imperative suite rather than a conformance-table row. The case:
  *
- * - **disallowed `Origin` → 403** `forbidden_origin`, refused before any
- *   handler runs (the allowlist rejects the cross-origin request even with
- *   a valid session cookie attached).
  * - **absent `Origin` → request passes** — non-browser / direct-access
  *   clients (curl, CLI, server-to-server) carry no `Origin` and must not be
  *   blocked; token auth is the control for those callers.
  *
+ * A disallowed `Origin` → 403 `forbidden_origin`, on every transport, is
+ * pinned by the front-door table (`transport_composition.ts`).
+ *
  * Runs both legs via the shared `setup_test` protocol: the
  * in-process leg (`auth/origin_parity.db.test.ts`, plain `gro test`) and the
  * cross-process leg (`cross_backend/origin.cross.test.ts`, the TS spine
@@ -25,7 +24,6 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_FORBIDDEN_ORIGIN } from '../../http/error_schemas.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
 const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
@@ -33,24 +31,6 @@ export const describe_origin_cross_tests = (options) => {
     const { setup_test } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('origin verification parity', () => {
-        test('disallowed Origin → 403 forbidden_origin (refused before dispatch)', async () => {
-            const fixture = await setup_test();
-            // Keeper session cookie attached + a rogue Origin header (overrides
-            // the transport's default allowed Origin). The allowlist must reject
-            // before the dispatcher, returning a flat REST error body.
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: {
-                    ...fixture.create_session_headers(),
-                    origin: 'http://evil.com',
-                    'content-type': 'application/json'
-                },
-                body: verify_envelope('evil-origin')
-            });
-            assert.strictEqual(res.status, 403, 'disallowed Origin must be rejected with 403');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
-        });
         test('absent Origin → request passes (non-browser direct access)', async () => {
             const fixture = await setup_test();
             // `origin: null` so no Origin header is sent at all (a header omission