@fuzdev/fuz_app 0.140.0 → 0.141.0

package/dist/testing/CLAUDE.md

@@ -33,11 +33,11 @@ time (never runtime), where a throwing guard would break `vite build`.
 - `stub_mw` — pass-through middleware (`async (_c, next) => next()`).
 - `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`, an empty `connection_closer`.
 - `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0, `drain_inflight` resolves immediately.
-- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
-- `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth — the same names, paths, order, and declared `errors` (`origin` declares a 403; `bearer_auth` and `daemon_token` declare none, since both soft-fail through `next()`), pinned against the real factory by `auth/middleware.mounted.test.ts`. The surface merges middleware errors into every route under the path, so a stub declaring more would widen the test surface with statuses the live server never returns. Each spec gets its own pass-through handler (not the shared `stub_mw`), so `assert_middleware_stack_mounted` tells the layers apart. See `auth/CLAUDE.md` §Middleware for the real stack.
+- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `required_role` is `admin`; `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
+- `create_stub_api_middleware({include_daemon_token?, origin_carve_outs?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth — the same names, paths, order, and declared `errors` (`origin` declares a 403; `bearer_auth` and `daemon_token` declare none, since both soft-fail through `next()`), pinned against the real factory by `auth/middleware.mounted.test.ts`. The surface merges middleware errors into every route under the path, so a stub declaring more would widen the test surface with statuses the live server never returns. Each spec gets its own pass-through handler (not the shared `stub_mw`), so `assert_middleware_stack_mounted` tells the layers apart. See `auth/CLAUDE.md` §Middleware for the real stack.
 - `create_stub_app_backend(options?)` — stub `AppBackend` with no database: `create_stub_app_deps()` (or `options.deps`), no migration results, a `close` that does nothing (or `options.close`). For assembling a server in tests that never reach the database.
 - `create_stub_app_server_context(session_options)` — stub `AppServerContext` over `create_stub_app_backend()`; rate limiters null, `bootstrap_status.available: false`.
-- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly, in its order (consumer routes, then bootstrap routes, RPC endpoint routes, and `GET /api/surface`, + stub middleware + surface generation). `GET /api/surface` is listed only with `surface_route: true`, as `create_app_server` mounts it only when opted in — pass the same value to both so the surface-derived suites probe it exactly when the live server serves it. `daemon_token: true` lists the `daemon_token` layer `create_app_server` mounts when given a `daemon_token_state` (`create_test_app` always passes one, and `default_in_process_suite_options` sets it, along with `app_options.surface_route`); `testing/test_app_server.db.test.ts` pins the stub's routes (order, auth, error schemas, applicable middleware) and middleware names against `create_test_app`'s for every `surface_route` setting. Its middleware list mirrors the real one — a stub `trusted_proxy` spec at `'*'`, then the stub auth stack — so every route's `applicable_middleware` starts with `trusted_proxy` (a route outside `/api/*` now lists just `['trusted_proxy']`), as on the live server. `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `transform_middleware?`, `bootstrap?`, `surface_route?`, `daemon_token?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`) and on a `transform_middleware` that moves, drops, duplicates, reorders, wraps, or replaces the stub proxy spec or a stub auth spec (`assert_middleware_stack_mounted`); the transform receives shallow copies in a fresh array, so an in-place mutation can't slip past the check. Throws on a `ws_endpoints` spec with no `allowed_origins` of its own when no `allowed_origins` option is given (there is no server list to default from). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
+- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly, in its order (consumer routes, then bootstrap routes, RPC endpoint routes, and `GET /api/surface`, + stub middleware + surface generation). `GET /api/surface` is listed only with `surface_route: true`, as `create_app_server` mounts it only when opted in — pass the same value to both so the surface-derived suites probe it exactly when the live server serves it. `daemon_token: true` lists the `daemon_token` layer `create_app_server` mounts when given a `daemon_token_state` (`create_test_app` always passes one, and `default_in_process_suite_options` sets it, along with `app_options.surface_route`); `testing/test_app_server.db.test.ts` pins the stub's routes (order, auth, error schemas, applicable middleware) and middleware names against `create_test_app`'s for every `surface_route` setting. Its middleware list mirrors the real one — a stub `trusted_proxy` spec at `'*'`, then the stub auth stack — so every route's `applicable_middleware` starts with `trusted_proxy` (a route outside `/api/*` lists `['trusted_proxy', 'origin']`, since the origin check covers every path, and a route under an origin carve-out drops `origin`), as on the live server. `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `origin_carve_outs?`, `transform_middleware?`, `bootstrap?`, `surface_route?`, `daemon_token?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`), on a route that reads or mints a credential outside it (`assert_credential_routes_in_auth_scope`), on an origin carve-out that overlaps that scope (`assert_origin_carve_outs_valid`), and on a `transform_middleware` that moves, drops, duplicates, reorders, wraps, or replaces the stub proxy spec or a stub auth spec (`assert_middleware_stack_mounted`); the transform receives shallow copies in a fresh array, so an in-place mutation can't slip past the check. Throws on a `ws_endpoints` spec with no `allowed_origins` of its own when no `allowed_origins` option is given (there is no server list to default from). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
 
 Throwing stubs surface mock escape: a test that accidentally reaches into
 stub territory breaks immediately with a label-scoped error rather than
@@ -51,12 +51,15 @@ set only the fields the test cares about. `create_test_*` prefix avoids
 collisions with real `account_queries.ts` factories. Override types widen
 branded `Uuid` fields to `string` so tests pass literal ids without per-site
 casts — the factory brands internally. Exported as `TestAccountOverrides` /
-`TestActorOverrides` / `TestRoleGrantOverrides` / `TestAuditEventOverrides`.
+`TestActorOverrides` / `TestRoleGrantOverrides` / `TestAuditEventOverrides` /
+`TestValidatedApiTokenOverrides`.
 
 - `create_test_account(overrides?)` — `{id: 'acct-test', username: 'test_user', …}`
 - `create_test_actor(overrides?)` — `{id: 'actor-test', account_id: 'acct-test', …}`
 - `create_test_role_grant(overrides?)` — `{id: 'role-grant-test', actor_id: 'actor-test', role: 'admin', scope_id: null, …}`
 - `create_test_context(role_grants?)` — `{account, actor, role_grants}`; pass `[{role: 'keeper'}, {role: 'admin'}]` for multi-role.
+- `create_test_raw_api_token(label?)` — a well-formed raw bearer value (`secret_fuz_token_` + `label` padded with `A` to 43 chars) that passes `is_api_token_shaped`, so a mocked-lookup test reaches token validation; distinct labels give distinct tokens.
+- `create_test_validated_api_token(overrides?)` — a `ValidatedApiToken` (what `query_validate_api_token` returns) with a `full` scope; override `scope` to test a narrowed one.
 - `create_test_audit_event(overrides?)` — `{id: 'evt-test', event_type: 'login', outcome: 'success', …}`, for SSE guard / audit tests.
 
 ### `mock_fs.ts` — in-memory filesystem
@@ -106,9 +109,9 @@ mismatch.
 
 ### `connection_closer_helpers.ts` — `ConnectionCloser` test doubles
 
-- `create_recording_closer()` — `{closer, calls}`; every method on `closer` records `{method, id}` into `calls` and closes nothing (`close_all_sockets` records `{method: 'all', id: null}`). To see a handler's closes, add it to the backend's closer (`ctx.deps.connection_closer.add(closer)`) or build the factory's deps with it. The closes are queued post-commit, so they have run by the time a `create_test_app` response is in hand (`await_pending_effects: true` flushes both queues).
+- `create_recording_closer()` — `{closer, calls}`; every method on `closer` records `{method, id}` into `calls` and closes nothing (`close_sockets_for_role` records `{method: 'role', id, role}`, `close_all_sockets` `{method: 'all', id: null}`). To see a handler's closes, add it to the backend's closer (`ctx.deps.connection_closer.add(closer)`) or build the factory's deps with it. The closes are queued post-commit, so they have run by the time a `create_test_app` response is in hand (`await_pending_effects: true` flushes both queues).
 - `assert_close_call(call, method, id)` — pins `{method, id}` on a recorded close call; handles the missing-element case.
-- `RecordedClose` — `{method: 'session' | 'token' | 'account', id: string} | {method: 'all', id: null}`.
+- `RecordedClose` — `{method: 'session' | 'token' | 'account', id: string} | {method: 'role', id: string, role: string} | {method: 'all', id: null}`.
 - `RecordingCloser` — `{closer, calls}`.
 
 ## Database — `db.ts`
@@ -483,7 +486,7 @@ file that imports from `middleware.ts` gets these mocks globally. Pair with
 - `BearerAuthTestOptions`, `BearerAuthTestCase` — test-case table shape for the bearer auth runner.
 - `create_bearer_auth_mocks(tc)` — configures the module-level mocks per test case; returns spy references.
 - `TEST_CLIENT_IP = '127.0.0.1'` — IP set by the proxy stub in `create_bearer_auth_test_app`.
-- `create_bearer_auth_test_app(tc)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, request_context_set}` — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
+- `create_bearer_auth_test_app(tc)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, token_scope, credential_deadline_in_ms, request_context_set}` (`credential_deadline_in_ms` — how far ahead `CREDENTIAL_DEADLINE_KEY` lies, `null` for none; `BearerAuthTestCase.expected_credential_deadline_ms` asserts it) — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
 - `describe_bearer_auth_cases(suite_name, cases)` — table-driven runner; one `test()` per case; asserts status, error, body fields, `api_token_id`, context preservation.
 - `TEST_MIDDLEWARE_PATH = '/api/test'` — path used by the echo route in the stack factory.
 - `create_test_middleware_stack_app(options?)` — real proxy + origin + bearer middleware for integration-shape testing. Echo route returns `{ok, client_ip, has_context}`.
@@ -532,7 +535,7 @@ method and assert the stream closes within 2s.
 
 `SseRouteTestSpec` per route: `{path, trigger, event_specs?, assert_closes_on_revoke?}`.
 A consumer registry closes on the revoke when its route joined it to the
-backend's closer (`ctx.deps.connection_closer.add(create_sse_connection_closer(registry))`)
+backend's closer (`ctx.deps.connection_closer.add(create_sse_connection_closer(registry, role))`)
 or when the suite's `on_audit_event` option wires a guard (e.g. `create_sse_auth_guard`); with
 neither, the revoke assertion fails.
 
@@ -929,9 +932,10 @@ source of truth for wire-shape conformance.
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
   `account_status` / `peer_request` /
-  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` —
-  each has a `test_if`
-  reader (`ws_self_revocation_reply` forks one case's assertion instead); `peer_request` (server-initiated requests — the ActionPeer
+  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` /
+  `ws_role_gated` / `ws_refusal_body` — each has a `test_if`
+  reader (`ws_self_revocation_reply` forks one case's assertion instead, and
+  `ws_refusal_body` how the front-door table reads a WS refusal); `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
   keeps it `false` like sse/ready until a backend wires the `peer/ping` HTTP +
@@ -1034,7 +1038,7 @@ error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case i
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
   closed `ConformancePrincipal` enum (`keeper` / `daemon` / `invalid_daemon` /
-  `daemon_browser` / `token` / `bearer_browser` / `anonymous` /
+  `daemon_browser` / `token` / `bearer_browser` / `malformed_bearer` / `scoped_token` / `anonymous` /
   `fresh_non_admin` / `role_holder` / `wrong_role` / `expired_session`) —
   fixture accessors, never inline credential minting.
   `invalid_daemon` sends a malformed `X-Daemon-Token` alongside the keeper
@@ -1054,8 +1058,11 @@ error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case i
   `bearer_browser` is the bearer twin: a _valid_ bearer api-token in a browser
   context (default `Origin` present), fresh jar (no session) — the bearer
   middleware discards it, so an authed action 401s, wire-indistinguishable from
-  `anonymous` (pinned by the `browser_bearer_replay` equivalence group). The
+  `anonymous` (pinned by the `bearer_soft_fail` equivalence group). The
   `token` principal is the honored counterpart (suppresses `Origin`).
+  `malformed_bearer` is the keeper's token minus its last character over a
+  no-Origin, empty-jar transport — refused by the shape precheck before any
+  database work, so it joins `bearer_soft_fail` too.
   `expired_session` is the keeper behind an expired server-side session
   (`fixture.mint_expired_session()`: a backdated `auth_session` row behind a
   still-valid signed cookie, so the DB-row expiry gate is what refuses it).
@@ -1157,7 +1164,7 @@ the seven server-initiated notifications (`received` → recipient,
 `role_grant_revoke` → revokee, and `role_grant_offer_supersede` → each
 superseded sibling's grantor on **both** the accept- and revoke-cascade paths).
 `describe_role_grant_offer_notification_ws_tests({setup_test, capabilities,
-base_url, ws_path})` opens the affected counterparty's socket
+base_url, ws_path, ws_required_roles?})` opens the affected counterparty's socket
 (`create_admitted_ws_transport` — a targeted notification reaches only an
 admitted connection, and the handshake alone doesn't say it is one), drives the
 lifecycle RPC over `fixture.transport`, then
@@ -1177,8 +1184,36 @@ Sends queue on the post-commit drain, so `WsClient.wait_for` polls + waits
 (method + predicate filter ignores unrelated frames). Accounts are seeded with
 `ROLE_ADMIN` (the only admin-grantable role) so they can open an admin-gated WS
 where one exists (forge) and be offered the role; harmless on the auth-only
-spine. Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
-`src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`.
+spine. A backend whose `ws_path` is gated on `ROLE_ADMIN` declares it in
+`ws_required_roles`: the revoke case then revokes the revokee's only admin
+grant and expects its socket to close with `WS_CLOSE_PERMISSION_REVOKED` (the
+notification may or may not land first, and is held to the flat shape when it
+does), where an ungated socket expects the frame. The offer/accept fixtures are `create_pending_role_grant_offer` /
+`create_active_role_grant` (`cross_backend/role_grant_cross_helpers.ts`).
+Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`, and
+`role_grant_offer_notification_ws_gated.cross.test.ts` runs it again over the
+spine binaries' role-gated endpoint with `ws_required_roles` declared.
+
+### `cross_backend/ws_role_gated.ts` — `describe_ws_role_gated_cross_tests`
+
+Real-upgrade parity for a **role-gated WebSocket losing its role**: a revoked
+global grant of a role an endpoint's `required_roles` lists closes the account's
+sockets on that endpoint with `WS_CLOSE_PERMISSION_REVOKED` (and its reason),
+while the account's ungated socket on the same transport stays open,
+dispatching, and receiving the account's pushes, and a re-upgrade is refused at
+the gate (403); a scoped revoke of a listed role closes nothing — the case
+first opens the gated socket on a global grant of `scoped_role` alone, which
+proves the endpoint lists it. That a closed registration is sent nothing more
+is beyond what a client sees once it has read the close frame; each spine's
+transport tests pin it.
+`describe_ws_role_gated_cross_tests({setup_test, capabilities, base_url,
+ws_path, gated_ws_path, gated_roles, scoped_role, rpc_path?})` — `gated_roles`
+must hold `ROLE_ADMIN` and `scoped_role` (a role an admin can grant scoped).
+fuz_app's spine binaries mount `SPINE_ROLE_GATED_WS_PATH` gated on
+`SPINE_ROLE_GATED_WS_ROLES` (`admin` + `participant`). Gated on
+`capabilities.ws` and `capabilities.ws_role_gated`; cross-process only.
+fuz_app's own wiring is `src/test/cross_backend/ws_role_gated.cross.test.ts`.
 
 ### `cross_backend/peer_ping_ws.ts` — `describe_peer_ping_ws_tests`
 
@@ -1565,6 +1600,27 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   payload-expiry tests never reached. Daemon-token-gated like its siblings; the
   Rust mirror is `fuz_testing::create_testing_mint_session_action_spec`.
 
+  Also in the module and **not** bundled: `_testing_origin_check`
+  (`create_testing_origin_check_action()`, `run_testing_origin_check(input)`,
+  `TestingOriginCheckInput` / `TestingOriginCheckOutput`) — answers the origin
+  allowlist's parse and request check for one `{patterns, origin}` pair:
+  `{ok: true, allowed}` or `{ok: false, errors: [{index?, kind}]}`. Pure, no
+  database. Kept out of the bundle so a consumer whose Rust binary doesn't
+  mount the mirror (`fuz_testing::create_testing_origin_check_action_spec`)
+  keeps an exact action-manifest gate; the spine binary appends it in
+  `build_full_spine_rpc_actions`.
+
+  Also **not** bundled: `_testing_shorten_credential_expiry`
+  (`create_testing_shorten_credential_expiry_action()`) — pulls an account's
+  `auth_session` and `api_token` expiries in to `seconds` (1–60) from now,
+  shorten-only (`LEAST`, an eternal token gaining one), answering
+  `{sessions, api_tokens}` counts. Applied before a connection opens, since
+  the deadline is read when the credential resolves. Backs
+  `describe_credential_deadline_cross_tests`; appended in
+  `build_full_spine_rpc_actions` for the same manifest reason as
+  `_testing_origin_check`. The Rust mirror is
+  `fuz_testing::create_testing_shorten_credential_expiry_action_spec`.
+
   Also in the module — but **not** bundled by `create_testing_actions` —
   `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
   dumps the live RPC registry as a normalized `ActionManifest` for the
@@ -1611,19 +1667,95 @@ serve a body-parity gate (its per-spine coverage stays in the two surface
 censuses). Cross-process only; fuz_app's own wiring is
 `src/test/cross_backend/token_scope_surface.cross.test.ts`.
 
+### Front-door contract — `cross_backend/transport_composition.ts`
+
+`describe_transport_composition_cross_tests({setup_test, capabilities, base_url,
+rpc_path?, origin?, rest_path?, password_path?, ws_path?, sse_path?})` — the per-transport
+composition table: what each transport answers before per-action dispatch,
+when one request trips several refusals. Rows are REST `POST` (session-only
+`/api/account/logout`), RPC `POST`, RPC `GET`, the WS upgrade (gated on
+`capabilities.ws`) and the audit stream (`capabilities.sse`); columns are a
+foreign `Origin` with the keeper's session (→ 403 `forbidden_origin`), an
+over-cap declared length with a foreign `Origin` and no credential (→ 413
+`payload_too_large`, body-carrying rows only), no credential (→ 401
+`authentication_required`), and a narrowed bearer with no `Origin` (→ 403
+`token_scope_required` naming `rpc:<method>` on RPC and `surface:ws_upgrade` on
+the upgrade; 403 `credential_type_required` on the session-only REST route and
+audit stream); a `/password` cell pins that route's 401 beside `/logout`'s.
+Each case asserts the status and the body — flat `{error}` or the JSON-RPC
+envelope's `error.data`. A WS refusal's body is required where the backend
+declares `capabilities.ws_refusal_body`; where it doesn't (Node's
+`@hono/node-ws` drops the body), an empty body passes on its status and a sent
+one is still asserted. The table
+is the exported `transport_composition_cases` data. Given `base_url`, every
+probe is written to the socket (`raw_http_exchange`) and an over-cap request
+sends its head alone; with `base_url: null` the probes go through the
+fixture's transport and the WS rows skip. Not in the standard bundle. fuz_app's
+own wiring is `src/test/cross_backend/transport_composition.cross.test.ts` and
+the in-process `src/test/auth/transport_composition_parity.db.test.ts`.
+
+`cross_backend/narrowed_api_token.ts` — `mint_narrowed_api_token({app,
+rpc_path, session_headers, methods, name?})` mints a method-scoped api token
+through the production `account_token_create` path and returns the raw bearer
+(throws when the mint is refused). Shared by the front-door table, the
+token-scope surface suite, and the conformance table's `scoped_token`
+principal.
+
+### Credential deadline parity — `cross_backend/credential_deadline.ts`
+
+`describe_credential_deadline_cross_tests({setup_test, capabilities, base_url,
+ws_path, sse_path?, rpc_path?})` — a connection closes when the credential it
+opened on expires: each case pulls a fresh account's credential expiries in to
+two seconds with `_testing_shorten_credential_expiry` before the open, then
+checks the connection still dispatches short of the deadline and closes at it.
+A WebSocket on a session and one on an API token (`capabilities.ws`) close with
+`WS_CLOSE_SESSION_REVOKED` and `WS_CLOSE_CREDENTIAL_EXPIRED_REASON`; an audit
+stream on a session (`capabilities.sse`) ends; and a second seam call asking
+for a later expiry moves nothing (the seam only shortens). API token × audit
+stream is not reachable over the wire — the stock stream is session-only — so
+the Rust spine pins it on a widened gate and the TS twin shares one deadline
+wait across both transports. Cross-process only; fuz_app's own wiring is
+`src/test/cross_backend/credential_deadline.cross.test.ts`.
+
+### Origin check scope parity — `cross_backend/origin_scope.ts`
+
+`describe_origin_scope_cross_tests({setup_test, capabilities, probe_path?})` —
+the origin check covers paths outside `/api`: on `GET /ready` (`probe_path`), a
+foreign `Origin` → 403 `forbidden_origin`, an absent or allowed one → 200. Gated
+on `capabilities.ready`. Runs both legs (the in-process
+`cross_backend/origin_scope_parity.db.test.ts` + the cross-process
+`origin_scope.cross.test.ts`).
+
 ### Origin verification parity — `cross_backend/origin.ts`
 
 `describe_origin_cross_tests({setup_test, rpc_path?})` — the
-imperative Origin-verification suite: disallowed `Origin` → 403 `forbidden_origin` (refused
-before dispatch), absent `Origin` → request passes (non-browser direct access).
-Imperative (not a conformance-table row) because origin rejection is
-middleware-level flat-REST, not the JSON-RPC envelope the table runner expects,
-and absent-Origin needs `fresh_transport({origin: null})`. Runs both legs (the
+imperative Origin-verification suite: absent `Origin` → request passes
+(non-browser direct access); the disallowed-`Origin` 403 is the front-door
+table's. Imperative (not a conformance-table row) because absent-Origin needs
+`fresh_transport({origin: null})`. Runs both legs (the
 in-process `auth/origin_parity.db.test.ts` + the cross-process
 `origin.cross.test.ts`). The promotion surfaced a twin-impl divergence — the
 Rust spine returned a plain-text body — now converged to the canonical TS
 `{error: "forbidden_origin"}` via `fuz_http::forbidden_origin_response()`.
 
+### Origin allowlist conformance — `cross_backend/origin_conformance.ts`
+
+`cross_backend/origin_conformance.json` is the shared table both spines' origin
+allowlist must satisfy: **parse** rows `{raw, ok: true}` or `{raw, errors:
+[{index?, kind}]}` (every refusal, 1-based position, `AllowedOriginsErrorKind`)
+and **match** rows `{patterns, origin, allowed}` (`origin: null` — no
+`Origin` — passes). A row may carry a `note`. `load_origin_conformance()` reads
+and validates it (`OriginConformance`), `to_origin_conformance_checks(table)`
+flattens it into `_testing_origin_check` inputs with their expected answers, and
+`assert_origin_conformance(checks, answers, backend)` fails once listing every
+row that disagrees. `describe_origin_conformance_cross_tests({setup_test,
+rpc_path?})` sends every row to a backend's `_testing_origin_check` over the
+keeper's daemon-token channel; the TS unit leg runs the same rows through
+`run_testing_origin_check` (`src/test/http/origin.conformance.test.ts`), so the
+Rust spine is held to the table without reading the file. Ungated; edit the
+table by hand — it is the statement of the grammar, not generated output.
+fuz_app's own wiring is `src/test/cross_backend/origin_conformance.cross.test.ts`.
+
 ### CORS simple-request parity — `cross_backend/simple_request.ts`
 
 `describe_simple_request_cross_tests({setup_test, rpc_path?, login_path?, logout_path?})`
@@ -1935,7 +2067,7 @@ re-roll the serve / daemon-info / WS-attach / drain boilerplate:
 - `testing/cross_backend/full_spine_mount.ts` — `build_full_spine_rpc_actions(deps, options)` — the **full** live RPC mount: the declared bundle **plus** the off-declared-surface families the binary live-mounts (`_testing_*` backdoors, the cell verb set, the opt-in `actor_lookup` / `actor_search` resolvers). `build_full_spine_mount(deps, options)` builds it once for both of the binary's endpoints, returning `FullSpineMount` (`{rpc_actions, ws_actions}`): the WS list is `protocol_actions` plus every RPC action not already among them, twinning the Rust `testing_spine_stub`, which serves one registry on RPC and WS (the one difference is `cancel` — a registered protocol action on TS, owned by the read loop on Rust). Single-sources the mount so the binary and the `spine_method_coverage` reconciliation test build the same list.
 - `testing/cross_backend/ts_spine_backend_config.ts` — `ts_spine_node_backend_config()` / `ts_spine_deno_backend_config()` / `ts_spine_bun_backend_config()` presets (in-memory pglet, no external infra), the TS analog of `rust_spine_stub_backend_config()`.
 
-fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` (`rate_limiters: 'disabled_for_testing'` plus whichever login / action limiters its env toggles built, `build_full_spine_mount`'s two lists on one `rpc_endpoints` entry and one `ws_endpoints` entry, whose `transport` is also the role-grant-offer `notification_sender`), reusing `default_spine_surface`. `src/test/cross_backend/testing_spine_server.db.test.ts` builds it with the Node adapter in-process and asserts its surface lists `/api/ws` and passes the surface invariants. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic. It leaves `create_app_server`'s `auth_cleanup` off, as the Rust `testing_spine_stub` leaves its twin unscheduled: a background pass would delete rows and write audit rows under a running suite. A consumer's cross-process test binary may schedule it when nothing its suites seed is already expired (the conformance table's `expired_session` principal seeds a backdated session row); an in-process harness leaves it off.
+fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` (`rate_limiters: 'disabled_for_testing'` plus whichever login / action limiters its env toggles built, `build_full_spine_mount`'s two lists on one `rpc_endpoints` entry and two `ws_endpoints` entries — `/api/ws` and the role-gated `SPINE_ROLE_GATED_WS_PATH` — sharing one `transport`, which is also the role-grant-offer `notification_sender`), reusing `default_spine_surface`. `src/test/cross_backend/testing_spine_server.db.test.ts` builds it with the Node adapter in-process and asserts its surface lists both WS endpoints (the gated one with its `required_roles`) and passes the surface invariants. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic. It leaves `create_app_server`'s `auth_cleanup` off, as the Rust `testing_spine_stub` leaves its twin unscheduled: a background pass would delete rows and write audit rows under a running suite. A consumer's cross-process test binary may schedule it when nothing its suites seed is already expired (the conformance table's `expired_session` principal seeds a backdated session row); an in-process harness leaves it off.
 
 ### Live-method coverage reconciliation — `method_coverage.ts`
 

package/dist/testing/adversarial_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}
+{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAYzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}

package/dist/testing/adversarial_headers.js

@@ -10,6 +10,13 @@ import './assert_dev_env.js';
 import { test, assert, describe } from 'vitest';
 import { ApiError, ERROR_FORBIDDEN_ORIGIN } from '../http/error_schemas.js';
 import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH } from './middleware.js';
+import { create_test_raw_api_token } from './entities.js';
+/**
+ * A well-formed bearer value — it passes the `is_api_token_shaped` precheck,
+ * so a `not_called` case proves an earlier layer short-circuited, not that the
+ * token's shape was refused.
+ */
+const ADVERSARIAL_BEARER_TOKEN = create_test_raw_api_token('adversarial');
 // --- Standard adversarial header cases ---
 /**
  * 7 standard adversarial header cases applicable to any middleware stack.
@@ -26,7 +33,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with Origin header is rejected before token validation',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: 'https://attacker.com'
         },
         expected_status: 403,
@@ -36,7 +43,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with allowed Origin — bearer silently discarded (browser context)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: allowed_origin
         },
         expected_status: 200,
@@ -51,7 +58,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'empty Origin header is rejected by origin middleware before bearer auth (defense-in-depth)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: ''
         },
         expected_status: 403,
@@ -61,7 +68,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235), soft-fails',
         headers: {
-            Authorization: 'bearer secret_fuz_token_test'
+            Authorization: `bearer ${ADVERSARIAL_BEARER_TOKEN}`
         },
         expected_status: 200,
         validate_expectation: 'called'
@@ -72,7 +79,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         // treats Referer presence as a browser-context indicator and discards
         // the token, so the request reaches the route as unauthenticated.
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Referer: 'https://attacker.com/page'
         },
         expected_status: 200,
@@ -81,7 +88,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with allowed Referer (no Origin) — bearer silently discarded (browser context)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Referer: `${allowed_origin}/page`
         },
         expected_status: 200,

package/dist/testing/connection_closer_helpers.d.ts

@@ -2,11 +2,16 @@ import './assert_dev_env.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
 /**
  * Record of a single `ConnectionCloser` method invocation — a credential
- * close carries the id it was given, `close_all_sockets` (`'all'`) none.
+ * close carries the id it was given, a role close (`'role'`) the account id
+ * and the role, `close_all_sockets` (`'all'`) none.
  */
 export type RecordedClose = {
     method: 'session' | 'token' | 'account';
     id: string;
+} | {
+    method: 'role';
+    id: string;
+    role: string;
 } | {
     method: 'all';
     id: null;

package/dist/testing/connection_closer_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;GAGG;AACH,MAAM,MAAM,aAAa,GACxB;IAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvF,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAO,eAqB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,aAAa,CAAC,QAAQ,CAAC,EAC/B,IAAI,MAAM,GAAG,IAAI,KACf,IAIF,CAAC"}
+{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAO,eAyB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,aAAa,CAAC,QAAQ,CAAC,EAC/B,IAAI,MAAM,GAAG,IAAI,KACf,IAIF,CAAC"}

package/dist/testing/connection_closer_helpers.js

@@ -25,6 +25,10 @@ export const create_recording_closer = () => {
             calls.push({ method: 'account', id });
             return 1;
         },
+        close_sockets_for_role: (id, role) => {
+            calls.push({ method: 'role', id, role });
+            return 1;
+        },
         close_all_sockets: () => {
             calls.push({ method: 'all', id: null });
             return 1;

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA2HD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAyLlF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAwHD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA+HlF,CAAC"}

package/dist/testing/cross_backend/body_size.js

@@ -9,8 +9,8 @@ import '../assert_dev_env.js';
  * `Content-Length` over the cap is refused on the header, *before* auth,
  * origin, or dispatch run (middleware step 4). Each impl unit-tests this in
  * isolation; this suite pins the cross-impl agreement on the status + body
- * shape, on the exact `>` cap boundary (not an off-by-one divergence), and on
- * the cap answering ahead of the origin check and of auth. The cases:
+ * shape, and on the exact `>` cap boundary (not an off-by-one divergence). The
+ * cases:
  *
  * - **over-limit POST (cap + 1 byte) → 413** `payload_too_large`, refused
  *   before any handler runs (the limit fires ahead of origin verification + the
@@ -25,11 +25,10 @@ import '../assert_dev_env.js';
  * - **under-limit POST (small) → 200** — a small, well-formed authenticated
  *   `account_verify` envelope sails through to a successful handler response,
  *   the positive control that the route works for normal traffic.
- * - **over-limit POST with a disallowed `Origin` → 413**, not the origin
- *   check's 403, and **over-limit POST with no credentials → 413**, not 401:
- *   the cap answers a declared length ahead of both. The control — the same
- *   disallowed `Origin` on an under-limit body → 403 `forbidden_origin` —
- *   shows the origin check still runs.
+ * - The cap answering a declared length ahead of the origin check and auth —
+ *   over-cap with a disallowed `Origin` and no credential → 413 — is pinned per
+ *   transport by the front-door table (`transport_composition.ts`), beside the
+ *   under-cap 403 that shows the origin check still runs.
  * - **over-limit chunked POST (no `Content-Length`), authenticated → 413** —
  *   a body with no declared length is refused by the bytes that arrive.
  *
@@ -83,7 +82,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
 import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
@@ -111,8 +110,6 @@ const sized_envelope = (id, target_bytes) => {
 };
 /** A small, well-formed nullary `account_verify` body — well under the cap. */
 const small_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
-/** An `Origin` no backend's allowlist admits. */
-const DISALLOWED_ORIGIN = 'http://evil.com';
 /** Chunk size of the streamed over-cap body. */
 const STREAM_CHUNK_BYTES = 64 * 1024;
 /**
@@ -191,19 +188,15 @@ export const describe_body_size_cross_tests = (options) => {
         body
     });
     /**
-     * POST with a declared `Content-Length` one byte over the cap. Over a
-     * socket only the head is sent; in-process, the whole body.
-     *
-     * `headers` carries the credential and any `Origin`, which defaults to the
-     * backend's own. `anonymous` picks the cookie-jar-free transport in-process;
-     * a raw head carries only what `headers` names either way.
+     * POST as the keeper, with the backend's own `Origin` and a declared
+     * `Content-Length` one byte over the cap. Over a socket only the head is
+     * sent; in-process, the whole body.
      */
-    const post_over_limit_declared = async (fixture, request) => {
-        const { id, headers, anonymous } = request;
+    const post_over_limit_declared = async (fixture, id) => {
+        const headers = fixture.create_session_headers();
         const content_length = BODY_LIMIT_DEFAULT_BYTES + 1;
         if (base_url === null) {
-            const transport = anonymous ? fixture.fresh_transport() : fixture.transport;
-            return to_sized_response(await transport(rpc_path, {
+            return to_sized_response(await fixture.transport(rpc_path, {
                 method: 'POST',
                 headers: { ...headers, 'content-type': 'application/json' },
                 body: sized_envelope(id, content_length)
@@ -258,11 +251,7 @@ export const describe_body_size_cross_tests = (options) => {
             // Keeper session cookie + the default allowed Origin, so neither auth
             // nor origin is the cause — only the size. One byte over the cap: both
             // impls reject on a strict `>`.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit',
-                headers: fixture.create_session_headers(),
-                anonymous: false
-            });
+            const res = await post_over_limit_declared(fixture, 'over-limit');
             assert_payload_too_large(res, 'a body one byte over the cap must be rejected with 413');
         });
         test('at-limit POST (exactly the cap) → not size-rejected', async () => {
@@ -281,46 +270,6 @@ export const describe_body_size_cross_tests = (options) => {
             const res = await post(fixture, small_envelope('under-limit'));
             assert.strictEqual(res.status, 200, 'an under-limit authenticated request must pass');
         });
-        test('over-limit POST with a disallowed Origin → 413, not 403', async () => {
-            const fixture = await setup_test();
-            // Keeper session + a rogue Origin: the origin check would answer 403,
-            // and the cap, which reads only the declared length, answers first.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit-evil-origin',
-                headers: { ...fixture.create_session_headers(), origin: DISALLOWED_ORIGIN },
-                anonymous: false
-            });
-            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of the origin check');
-        });
-        test('under-limit POST with a disallowed Origin → 403 forbidden_origin', async () => {
-            const fixture = await setup_test();
-            // The control for the case above: the same request minus the size is
-            // refused by the origin check, so the 413 there is the cap answering
-            // first, not the origin check being absent.
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: {
-                    ...fixture.create_session_headers(),
-                    origin: DISALLOWED_ORIGIN,
-                    'content-type': 'application/json'
-                },
-                body: small_envelope('under-limit-evil-origin')
-            });
-            assert.strictEqual(res.status, 403, 'a disallowed Origin on an under-limit body is refused');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
-        });
-        test('over-limit POST with no credentials → 413, not 401', async () => {
-            const fixture = await setup_test();
-            // No cookie, no token: the dispatcher would answer 401, and the cap
-            // answers first.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit-anonymous',
-                headers: {},
-                anonymous: true
-            });
-            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of auth');
-        });
         test('over-limit chunked POST (no Content-Length), authenticated → 413', async () => {
             const fixture = await setup_test();
             // Keeper session + the default allowed Origin, so nothing but the size

package/dist/testing/cross_backend/capabilities.d.ts

@@ -208,6 +208,30 @@ export interface BackendCapabilities {
      * mount it.
      */
     readonly cell_gated_create: boolean;
+    /**
+     * The backend mounts a second, role-gated WebSocket endpoint at
+     * `SPINE_ROLE_GATED_WS_PATH`, gated on `SPINE_ROLE_GATED_WS_ROLES`, beside
+     * its ungated `ws_path`. Gates `describe_ws_role_gated_cross_tests`: a
+     * revoked global grant of a listed role closes the account's gated socket
+     * with `WS_CLOSE_PERMISSION_REVOKED`, its ungated socket stays open and
+     * still receives the account's pushes, a re-upgrade is refused at the gate,
+     * and a scoped revoke closes nothing. `true` only on the reference spine binaries that
+     * mount that endpoint (the TS spine binary + the Rust `testing_spine_stub`).
+     */
+    readonly ws_role_gated: boolean;
+    /**
+     * A refused WebSocket upgrade carries its refusal body — the flat
+     * `{error, ...}` the same refusal answers over plain HTTP. Not a gate: it
+     * forks how `describe_transport_composition_cross_tests` reads its WS rows.
+     * `true`, an empty refusal body fails the case; `false`, an empty body is
+     * allowed (the case pins the status alone) and a non-empty one is still
+     * asserted.
+     *
+     * `false` on Node: `@hono/node-ws` writes a refused upgrade to the raw
+     * socket with `Content-Length: 0`, dropping the response body. `true` on
+     * Deno, Bun, and the Rust spine, which send the response as built.
+     */
+    readonly ws_refusal_body: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
@@ -218,8 +242,8 @@ export interface BackendCapabilities {
  * `create_ws_transport`, so the in-process driver never runs it — the
  * transport itself supports server-initiated requests),
  * `ws_handshake_pipelining` (raw bytes on a real socket),
- * `ws_account_actions` (a real socket's reply-then-close ordering), and
- * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * `ws_account_actions` (a real socket's reply-then-close ordering),
+ * `cell_gated_create`, and `ws_role_gated`. Cross-process consumers declare each flag explicitly
  * per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}