@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -15,11 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * A further daemon-token action, **`_testing_action_manifest`** (dump the live
- * RPC registry for cross-impl method-set + auth-shape parity), lives here too
- * but is **not** bundled by `create_testing_actions` — it must enumerate
- * *every* mounted method, so it's appended at the full-mount layer
- * (`build_full_spine_rpc_actions`) where the complete list exists.
+ * Three further daemon-token actions live here but are **not** bundled by
+ * `create_testing_actions`, and are appended at the full-mount layer
+ * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
+ * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
+ * it must enumerate *every* mounted method, so it goes where the complete list
+ * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
+ * and request check for the cross-impl origin conformance table), and
+ * **`_testing_shorten_credential_expiry`** (pull an account's credential
+ * expiries in to seconds from now, shorten-only, for the credential-deadline
+ * cases) — the last two kept out of the bundle so a consumer whose Rust binary
+ * doesn't mount their mirrors keeps a green manifest gate.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -466,6 +472,175 @@ export declare const testing_migration_tracker_action_spec: {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export declare const create_testing_migration_tracker_action: () => RpcAction;
+/** Input of `_testing_origin_check`. */
+export declare const TestingOriginCheckInput: z.ZodObject<{
+    patterns: z.ZodString;
+    origin: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type TestingOriginCheckInput = z.infer<typeof TestingOriginCheckInput>;
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export declare const TestingOriginCheckOutput: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    allowed: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    errors: z.ZodArray<z.ZodObject<{
+        index: z.ZodOptional<z.ZodNumber>;
+        kind: z.ZodEnum<{
+            empty_entry: "empty_entry";
+            not_printable_ascii: "not_printable_ascii";
+            missing_scheme: "missing_scheme";
+            unsupported_scheme: "unsupported_scheme";
+            has_path: "has_path";
+            has_userinfo: "has_userinfo";
+            missing_host: "missing_host";
+            invalid_host_char: "invalid_host_char";
+            unbracketed_ipv6: "unbracketed_ipv6";
+            partial_wildcard: "partial_wildcard";
+            non_canonical_ipv4: "non_canonical_ipv4";
+            unclosed_ipv6: "unclosed_ipv6";
+            invalid_ipv6: "invalid_ipv6";
+            invalid_after_ipv6: "invalid_after_ipv6";
+            invalid_port: "invalid_port";
+            default_port: "default_port";
+            no_origins: "no_origins";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+export type TestingOriginCheckOutput = z.infer<typeof TestingOriginCheckOutput>;
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export declare const run_testing_origin_check: (input: TestingOriginCheckInput) => TestingOriginCheckOutput;
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export declare const testing_origin_check_action_spec: {
+    readonly method: "_testing_origin_check";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        patterns: z.ZodString;
+        origin: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        allowed: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        errors: z.ZodArray<z.ZodObject<{
+            index: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                empty_entry: "empty_entry";
+                not_printable_ascii: "not_printable_ascii";
+                missing_scheme: "missing_scheme";
+                unsupported_scheme: "unsupported_scheme";
+                has_path: "has_path";
+                has_userinfo: "has_userinfo";
+                missing_host: "missing_host";
+                invalid_host_char: "invalid_host_char";
+                unbracketed_ipv6: "unbracketed_ipv6";
+                partial_wildcard: "partial_wildcard";
+                non_canonical_ipv4: "non_canonical_ipv4";
+                unclosed_ipv6: "unclosed_ipv6";
+                invalid_ipv6: "invalid_ipv6";
+                invalid_after_ipv6: "invalid_after_ipv6";
+                invalid_port: "invalid_port";
+                default_port: "default_port";
+                no_origins: "no_origins";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>;
+    readonly async: true;
+    readonly description: string;
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export declare const create_testing_origin_check_action: () => RpcAction;
+/** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
+export declare const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
+/**
+ * The longest expiry `_testing_shorten_credential_expiry` sets, in seconds
+ * from now — a minute: the action exists to make a deadline arrive inside a
+ * test.
+ */
+export declare const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MAX_SECONDS = 60;
+/**
+ * `_testing_shorten_credential_expiry` — pull the expiry of an account's
+ * stored credentials (every `auth_session` and `api_token` row it owns) in to
+ * `seconds` from now, so the cross-backend credential-deadline suite can open
+ * a WebSocket or audit stream on a credential that expires a moment later and
+ * watch it close at the deadline (`ResolvedAuth.credential_deadline`) without
+ * waiting out a real lifetime.
+ *
+ * Applied **before the open**: it rewrites the stored rows, and a connection
+ * reads its deadline when its credential resolves, so only one opened
+ * afterwards sees the near deadline.
+ *
+ * **Shorten-only.** The new expiry is `LEAST(expires_at, NOW() + seconds)` —
+ * an eternal token gains one, and nothing already due sooner moves later, so
+ * the action can neither extend a credential's life nor revive an expired one;
+ * `seconds` is an integer from `TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS`
+ * to `TESTING_SHORTEN_CREDENTIAL_EXPIRY_MAX_SECONDS`. The Rust mirror is
+ * `fuz_testing::create_testing_shorten_credential_expiry_action_spec`.
+ *
+ * Like `_testing_origin_check`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export declare const testing_shorten_credential_expiry_action_spec: {
+    readonly method: "_testing_shorten_credential_expiry";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: true;
+    readonly input: z.ZodObject<{
+        account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+        seconds: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly output: z.ZodObject<{
+        sessions: z.ZodNumber;
+        api_tokens: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly async: true;
+    readonly description: string;
+};
+/** Build the standalone `_testing_shorten_credential_expiry` action (see the spec doc). */
+export declare const create_testing_shorten_credential_expiry_action: () => RpcAction;
 /**
  * `_testing_action_manifest` — dump the backend's live RPC method set as a
  * normalized `ActionManifest` (one entry per method: `{method, side_effects,

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAyCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;kBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAQnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,OAAO,uBAAuB,KAC5B,wBAcF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAO,SACyC,CAAC;AAEhG,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -15,11 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * A further daemon-token action, **`_testing_action_manifest`** (dump the live
- * RPC registry for cross-impl method-set + auth-shape parity), lives here too
- * but is **not** bundled by `create_testing_actions` — it must enumerate
- * *every* mounted method, so it's appended at the full-mount layer
- * (`build_full_spine_rpc_actions`) where the complete list exists.
+ * Three further daemon-token actions live here but are **not** bundled by
+ * `create_testing_actions`, and are appended at the full-mount layer
+ * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
+ * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
+ * it must enumerate *every* mounted method, so it goes where the complete list
+ * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
+ * and request check for the cross-impl origin conformance table), and
+ * **`_testing_shorten_credential_expiry`** (pull an account's credential
+ * expiries in to seconds from now, shorten-only, for the credential-deadline
+ * cases) — the last two kept out of the bundle so a consumer whose Rust binary
+ * doesn't mount their mirrors keeps a green manifest gate.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -83,6 +89,7 @@ import { ActionManifest, build_action_manifest } from './action_manifest.js';
 import { query_create_actor } from '../../auth/account_queries.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
 /**
  * Shared `auth` axis for every `_testing_*` action: keeper-only via the
  * daemon-token credential, no acting actor. This is the entire structural
@@ -452,6 +459,148 @@ export const testing_migration_tracker_action_spec = {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export const create_testing_migration_tracker_action = () => rpc_action(testing_migration_tracker_action_spec, async (_input, ctx) => query_migration_tracker(ctx.db));
+/** Input of `_testing_origin_check`. */
+export const TestingOriginCheckInput = z.strictObject({
+    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
+    patterns: z.string(),
+    /** One `Origin` header's value, or `null` for a request without one. */
+    origin: z.string().nullable()
+});
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export const TestingOriginCheckOutput = z.union([
+    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
+    z.strictObject({
+        ok: z.literal(false),
+        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
+    })
+]);
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export const run_testing_origin_check = (input) => {
+    const parsed = parse_allowed_origins(input.patterns);
+    if (!parsed.ok) {
+        return {
+            ok: false,
+            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
+        };
+    }
+    return {
+        ok: true,
+        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
+    };
+};
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export const testing_origin_check_action_spec = {
+    method: '_testing_origin_check',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: TestingOriginCheckInput,
+    output: TestingOriginCheckOutput,
+    async: true,
+    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
+        '{patterns, origin} pair, for the cross-impl origin conformance table.'
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));
+/** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
+export const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
+/**
+ * The longest expiry `_testing_shorten_credential_expiry` sets, in seconds
+ * from now — a minute: the action exists to make a deadline arrive inside a
+ * test.
+ */
+export const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MAX_SECONDS = 60;
+/**
+ * The new expiry: `$2` seconds from now, unless the row is due sooner. The
+ * `COALESCE` gives an eternal token (`NULL`) the near expiry too.
+ */
+const SHORTEN_EXPIRES_AT_SQL = "LEAST(COALESCE(expires_at, 'infinity'::timestamptz), NOW() + ($2::int4 * INTERVAL '1 second'))";
+/**
+ * `_testing_shorten_credential_expiry` — pull the expiry of an account's
+ * stored credentials (every `auth_session` and `api_token` row it owns) in to
+ * `seconds` from now, so the cross-backend credential-deadline suite can open
+ * a WebSocket or audit stream on a credential that expires a moment later and
+ * watch it close at the deadline (`ResolvedAuth.credential_deadline`) without
+ * waiting out a real lifetime.
+ *
+ * Applied **before the open**: it rewrites the stored rows, and a connection
+ * reads its deadline when its credential resolves, so only one opened
+ * afterwards sees the near deadline.
+ *
+ * **Shorten-only.** The new expiry is `LEAST(expires_at, NOW() + seconds)` —
+ * an eternal token gains one, and nothing already due sooner moves later, so
+ * the action can neither extend a credential's life nor revive an expired one;
+ * `seconds` is an integer from `TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS`
+ * to `TESTING_SHORTEN_CREDENTIAL_EXPIRY_MAX_SECONDS`. The Rust mirror is
+ * `fuz_testing::create_testing_shorten_credential_expiry_action_spec`.
+ *
+ * Like `_testing_origin_check`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export const testing_shorten_credential_expiry_action_spec = {
+    method: '_testing_shorten_credential_expiry',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: true,
+    input: z.strictObject({
+        account_id: Uuid,
+        seconds: z
+            .number()
+            .int()
+            .min(TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS)
+            .max(TESTING_SHORTEN_CREDENTIAL_EXPIRY_MAX_SECONDS)
+            .meta({
+            description: 'Seconds from now the credentials expire, unless already due sooner — this ' +
+                'backdoor can only shorten a credential, never extend it.'
+        })
+    }),
+    output: z.strictObject({
+        sessions: z.number().int().min(0),
+        api_tokens: z.number().int().min(0)
+    }),
+    async: true,
+    description: "Test-binary only — pull an account's session and API token expiries in to seconds from " +
+        'now (shorten-only), for the cross-impl credential-deadline cases.'
+};
+/** Build the standalone `_testing_shorten_credential_expiry` action (see the spec doc). */
+export const create_testing_shorten_credential_expiry_action = () => rpc_action(testing_shorten_credential_expiry_action_spec, async (input, ctx) => {
+    const params = [input.account_id, input.seconds];
+    const sessions = await ctx.db.query(`UPDATE auth_session SET expires_at = ${SHORTEN_EXPIRES_AT_SQL} WHERE account_id = $1 RETURNING id`, params);
+    const api_tokens = await ctx.db.query(`UPDATE api_token SET expires_at = ${SHORTEN_EXPIRES_AT_SQL} WHERE account_id = $1 RETURNING id`, params);
+    return { sessions: sessions.length, api_tokens: api_tokens.length };
+});
 /**
  * `_testing_action_manifest` — dump the backend's live RPC method set as a
  * normalized `ActionManifest` (one entry per method: `{method, side_effects,

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4HF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -63,10 +63,10 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call } from './cell_cross_helpers.js';
+import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Default audit-log SSE path — the `audit_stream` surface. */
 const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
@@ -84,22 +84,6 @@ const surface_denial_body = (surface) => ({
     error: ERROR_TOKEN_SCOPE_REQUIRED,
     required_scope: `surface:${surface}`
 });
-/**
- * Mint a narrowed bearer token over a session, through the production
- * `account_token_create` path.
- *
- * Deliberately not a fixture-level credential: minting it here means the token
- * is produced by the same handler a real minter would use, on whichever
- * account the caller chose — which is what lets the ordering case put a
- * narrowed token on an account that lacks the gating role.
- */
-const mint_narrowed_token = async (transport, rpc_path, session_headers) => {
-    const res = await cross_rpc_call(transport, rpc_path, account_token_create_action_spec.method, { scope: { kind: 'methods', methods: [ADMITTED_METHOD] }, lifetime: { kind: 'eternal' } }, session_headers);
-    assert.ok(res.ok, `minting a narrowed token failed: ${JSON.stringify(res.error)}`);
-    const token = res.result?.token;
-    assert.ok(typeof token === 'string' && token.length > 0, 'mint returned no token');
-    return token;
-};
 /**
  * Assert a bearer GET is refused with the canonical surface denial.
  *
@@ -145,18 +129,33 @@ export const describe_token_scope_surface_cross_tests = (options) => {
          */
         test_if(true, 'a narrowed token still reaches the method it names', async () => {
             const fixture = await setup_test();
-            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: fixture.create_session_headers(),
+                methods: [ADMITTED_METHOD]
+            });
             const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, ADMITTED_METHOD, undefined, { authorization: `Bearer ${token}` });
             assert.ok(res.ok, `admitted method must succeed: ${JSON.stringify(res.error)}`);
         });
         test_if(capabilities.sse, 'the audit stream refuses a bearer at the channel gate (credential_types)', async () => {
             const fixture = await setup_test();
-            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: fixture.create_session_headers(),
+                methods: [ADMITTED_METHOD]
+            });
             await assert_channel_denied(fixture.fresh_transport, sse_path, token, ['session']);
         });
         test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
             const fixture = await setup_test();
-            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: fixture.create_session_headers(),
+                methods: [ADMITTED_METHOD]
+            });
             await assert_surface_denied(fixture.fresh_transport, `/api/facts/${ABSENT_FACT_HASH}`, token, 'fact_bare');
         });
         /**
@@ -189,7 +188,12 @@ export const describe_token_scope_surface_cross_tests = (options) => {
         test_if(capabilities.fact_serving, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'scope_before_role' });
-            const token = await mint_narrowed_token(fixture.fresh_transport(), rpc_path, non_admin.create_session_headers());
+            const token = await mint_narrowed_api_token({
+                app: fixture.fresh_transport(),
+                rpc_path,
+                session_headers: non_admin.create_session_headers(),
+                methods: [ADMITTED_METHOD]
+            });
             await assert_surface_denied(fixture.fresh_transport, `/api/facts/${ABSENT_FACT_HASH}`, token, 'fact_bare');
         });
     });

package/dist/testing/cross_backend/transport_composition.d.ts

@@ -0,0 +1,60 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+/** A transport's front door, as the table's rows name it. */
+export type TransportCompositionSurface = 'rest_post' | 'rest_password' | 'rpc_post' | 'rpc_get' | 'ws_upgrade' | 'sse';
+/** What a probe sends, as the table's columns name it. */
+export type TransportCompositionProbe = 'foreign_origin' | 'unreadable_origin' | 'duplicated_origin' | 'over_cap_foreign_origin' | 'no_credential' | 'narrowed_token';
+/** The refusal a case expects. */
+export interface TransportCompositionExpect {
+    readonly status: number;
+    /** The refusal reason — the flat body's `error`, or the envelope's `error.data.reason`. */
+    readonly error: string;
+    /** Further fields the refusal must carry, beside the reason. */
+    readonly fields?: Readonly<Record<string, unknown>>;
+    /** `true` when the refusal is a JSON-RPC error envelope rather than a flat `{error}` body. */
+    readonly envelope?: boolean;
+}
+/** One cell of the front-door table. */
+export interface TransportCompositionCase {
+    readonly surface: TransportCompositionSurface;
+    readonly probe: TransportCompositionProbe;
+    readonly expect: TransportCompositionExpect;
+    /** The capability the surface needs; the case skips on a backend without it. */
+    readonly gate?: keyof BackendCapabilities;
+}
+/** The front-door table — one case per cell of the module doc's matrix. */
+export declare const transport_composition_cases: ReadonlyArray<TransportCompositionCase>;
+/** Options for `describe_transport_composition_cross_tests`. */
+export interface TransportCompositionCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
+    /**
+     * Base URL the spawned backend is reachable at, or `null` for an in-process
+     * run. Given a URL, every probe is written to the socket; with `null` the
+     * probes go through the fixture's transport and the WebSocket rows skip.
+     */
+    readonly base_url: string | null;
+    /**
+     * An `Origin` the backend allows. Default: the origin of `base_url`, or
+     * `http://localhost:5173` in-process (which `create_test_app`'s allow list
+     * admits).
+     */
+    readonly origin?: string;
+    /** Session-only REST `POST` route the REST row probes. Default `/api/account/logout`. */
+    readonly rest_path?: string;
+    /** Password-change route the `/password` row probes. Default `/api/account/password`. */
+    readonly password_path?: string;
+    /** WebSocket endpoint path. Default `/api/ws`. */
+    readonly ws_path?: string;
+    /** Audit-log SSE path. Default `/api/admin/audit/stream`. */
+    readonly sse_path?: string;
+}
+/**
+ * Register the front-door table's cases — one test per cell, each on a fresh
+ * fixture.
+ *
+ * This is the front-door contract: a backend that wires it answers each
+ * transport's probes as the table says — when one request trips several
+ * refusals, the one the table names answers.
+ */
+export declare const describe_transport_composition_cross_tests: (options: TransportCompositionCrossTestOptions) => void;
+//# sourceMappingURL=transport_composition.d.ts.map

package/dist/testing/cross_backend/transport_composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport_composition.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/transport_composition.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+E9B,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAGvF,6DAA6D;AAC7D,MAAM,MAAM,2BAA2B,GACtC,WAAW,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAClC,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,CAAC;AAEpB,kCAAkC;AAClC,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAsCD,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,EAAE,aAAa,CAAC,wBAAwB,CA4C/E,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,oCAAqC,SAAQ,uCAAuC;IACpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,GACtD,SAAS,oCAAoC,KAC3C,IA2KF,CAAC"}