@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/CLAUDE.md

@@ -33,11 +33,11 @@ time (never runtime), where a throwing guard would break `vite build`.
 - `stub_mw` — pass-through middleware (`async (_c, next) => next()`).
 - `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`, an empty `connection_closer`.
 - `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0, `drain_inflight` resolves immediately.
-- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
-- `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth — the same names, paths, order, and declared `errors` (`origin` declares a 403; `bearer_auth` and `daemon_token` declare none, since both soft-fail through `next()`), pinned against the real factory by `auth/middleware.mounted.test.ts`. The surface merges middleware errors into every route under the path, so a stub declaring more would widen the test surface with statuses the live server never returns. Each spec gets its own pass-through handler (not the shared `stub_mw`), so `assert_middleware_stack_mounted` tells the layers apart. See `auth/CLAUDE.md` §Middleware for the real stack.
+- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `required_role` is `admin`; `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
+- `create_stub_api_middleware({include_daemon_token?, origin_carve_outs?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth — the same names, paths, order, and declared `errors` (`origin` declares a 403; `bearer_auth` and `daemon_token` declare none, since both soft-fail through `next()`), pinned against the real factory by `auth/middleware.mounted.test.ts`. The surface merges middleware errors into every route under the path, so a stub declaring more would widen the test surface with statuses the live server never returns. Each spec gets its own pass-through handler (not the shared `stub_mw`), so `assert_middleware_stack_mounted` tells the layers apart. See `auth/CLAUDE.md` §Middleware for the real stack.
 - `create_stub_app_backend(options?)` — stub `AppBackend` with no database: `create_stub_app_deps()` (or `options.deps`), no migration results, a `close` that does nothing (or `options.close`). For assembling a server in tests that never reach the database.
 - `create_stub_app_server_context(session_options)` — stub `AppServerContext` over `create_stub_app_backend()`; rate limiters null, `bootstrap_status.available: false`.
-- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly, in its order (consumer routes, then bootstrap routes, RPC endpoint routes, and `GET /api/surface`, + stub middleware + surface generation). `GET /api/surface` is listed only with `surface_route: true`, as `create_app_server` mounts it only when opted in — pass the same value to both so the surface-derived suites probe it exactly when the live server serves it. `daemon_token: true` lists the `daemon_token` layer `create_app_server` mounts when given a `daemon_token_state` (`create_test_app` always passes one, and `default_in_process_suite_options` sets it, along with `app_options.surface_route`); `testing/test_app_server.db.test.ts` pins the stub's routes (order, auth, error schemas, applicable middleware) and middleware names against `create_test_app`'s for every `surface_route` setting. Its middleware list mirrors the real one — a stub `trusted_proxy` spec at `'*'`, then the stub auth stack — so every route's `applicable_middleware` starts with `trusted_proxy` (a route outside `/api/*` now lists just `['trusted_proxy']`), as on the live server. `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `transform_middleware?`, `bootstrap?`, `surface_route?`, `daemon_token?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`) and on a `transform_middleware` that moves, drops, duplicates, reorders, wraps, or replaces the stub proxy spec or a stub auth spec (`assert_middleware_stack_mounted`); the transform receives shallow copies in a fresh array, so an in-place mutation can't slip past the check. Throws on a `ws_endpoints` spec with no `allowed_origins` of its own when no `allowed_origins` option is given (there is no server list to default from). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
+- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly, in its order (consumer routes, then bootstrap routes, RPC endpoint routes, and `GET /api/surface`, + stub middleware + surface generation). `GET /api/surface` is listed only with `surface_route: true`, as `create_app_server` mounts it only when opted in — pass the same value to both so the surface-derived suites probe it exactly when the live server serves it. `daemon_token: true` lists the `daemon_token` layer `create_app_server` mounts when given a `daemon_token_state` (`create_test_app` always passes one, and `default_in_process_suite_options` sets it, along with `app_options.surface_route`); `testing/test_app_server.db.test.ts` pins the stub's routes (order, auth, error schemas, applicable middleware) and middleware names against `create_test_app`'s for every `surface_route` setting. Its middleware list mirrors the real one — a stub `trusted_proxy` spec at `'*'`, then the stub auth stack — so every route's `applicable_middleware` starts with `trusted_proxy` (a route outside `/api/*` lists `['trusted_proxy', 'origin']`, since the origin check covers every path, and a route under an origin carve-out drops `origin`), as on the live server. `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `origin_carve_outs?`, `transform_middleware?`, `bootstrap?`, `surface_route?`, `daemon_token?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`), on a route that reads or mints a credential outside it (`assert_credential_routes_in_auth_scope`), on an origin carve-out that overlaps that scope (`assert_origin_carve_outs_valid`), and on a `transform_middleware` that moves, drops, duplicates, reorders, wraps, or replaces the stub proxy spec or a stub auth spec (`assert_middleware_stack_mounted`); the transform receives shallow copies in a fresh array, so an in-place mutation can't slip past the check. Throws on a `ws_endpoints` spec with no `allowed_origins` of its own when no `allowed_origins` option is given (there is no server list to default from). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
 
 Throwing stubs surface mock escape: a test that accidentally reaches into
 stub territory breaks immediately with a label-scoped error rather than
@@ -51,12 +51,15 @@ set only the fields the test cares about. `create_test_*` prefix avoids
 collisions with real `account_queries.ts` factories. Override types widen
 branded `Uuid` fields to `string` so tests pass literal ids without per-site
 casts — the factory brands internally. Exported as `TestAccountOverrides` /
-`TestActorOverrides` / `TestRoleGrantOverrides` / `TestAuditEventOverrides`.
+`TestActorOverrides` / `TestRoleGrantOverrides` / `TestAuditEventOverrides` /
+`TestValidatedApiTokenOverrides`.
 
 - `create_test_account(overrides?)` — `{id: 'acct-test', username: 'test_user', …}`
 - `create_test_actor(overrides?)` — `{id: 'actor-test', account_id: 'acct-test', …}`
 - `create_test_role_grant(overrides?)` — `{id: 'role-grant-test', actor_id: 'actor-test', role: 'admin', scope_id: null, …}`
 - `create_test_context(role_grants?)` — `{account, actor, role_grants}`; pass `[{role: 'keeper'}, {role: 'admin'}]` for multi-role.
+- `create_test_raw_api_token(label?)` — a well-formed raw bearer value (`secret_fuz_token_` + `label` padded with `A` to 43 chars) that passes `is_api_token_shaped`, so a mocked-lookup test reaches token validation; distinct labels give distinct tokens.
+- `create_test_validated_api_token(overrides?)` — a `ValidatedApiToken` (what `query_validate_api_token` returns) with a `full` scope; override `scope` to test a narrowed one.
 - `create_test_audit_event(overrides?)` — `{id: 'evt-test', event_type: 'login', outcome: 'success', …}`, for SSE guard / audit tests.
 
 ### `mock_fs.ts` — in-memory filesystem
@@ -106,9 +109,9 @@ mismatch.
 
 ### `connection_closer_helpers.ts` — `ConnectionCloser` test doubles
 
-- `create_recording_closer()` — `{closer, calls}`; every method on `closer` records `{method, id}` into `calls` and closes nothing (`close_all_sockets` records `{method: 'all', id: null}`). To see a handler's closes, add it to the backend's closer (`ctx.deps.connection_closer.add(closer)`) or build the factory's deps with it. The closes are queued post-commit, so they have run by the time a `create_test_app` response is in hand (`await_pending_effects: true` flushes both queues).
+- `create_recording_closer()` — `{closer, calls}`; every method on `closer` records `{method, id}` into `calls` and closes nothing (`close_sockets_for_role` records `{method: 'role', id, role}`, `close_all_sockets` `{method: 'all', id: null}`). To see a handler's closes, add it to the backend's closer (`ctx.deps.connection_closer.add(closer)`) or build the factory's deps with it. The closes are queued post-commit, so they have run by the time a `create_test_app` response is in hand (`await_pending_effects: true` flushes both queues).
 - `assert_close_call(call, method, id)` — pins `{method, id}` on a recorded close call; handles the missing-element case.
-- `RecordedClose` — `{method: 'session' | 'token' | 'account', id: string} | {method: 'all', id: null}`.
+- `RecordedClose` — `{method: 'session' | 'token' | 'account', id: string} | {method: 'role', id: string, role: string} | {method: 'all', id: null}`.
 - `RecordingCloser` — `{closer, calls}`.
 
 ## Database — `db.ts`
@@ -483,7 +486,7 @@ file that imports from `middleware.ts` gets these mocks globally. Pair with
 - `BearerAuthTestOptions`, `BearerAuthTestCase` — test-case table shape for the bearer auth runner.
 - `create_bearer_auth_mocks(tc)` — configures the module-level mocks per test case; returns spy references.
 - `TEST_CLIENT_IP = '127.0.0.1'` — IP set by the proxy stub in `create_bearer_auth_test_app`.
-- `create_bearer_auth_test_app(tc)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, request_context_set}` — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
+- `create_bearer_auth_test_app(tc)` — Hono app with bearer middleware + echo route at `/api/test` returning `{ok, account_id, credential_type, api_token_id, token_scope, credential_deadline_in_ms, request_context_set}` (`credential_deadline_in_ms` — how far ahead `CREDENTIAL_DEADLINE_KEY` lies, `null` for none; `BearerAuthTestCase.expected_credential_deadline_ms` asserts it) — the account-grain identity bearer auth writes, plus a flag for tests that pre-populate `REQUEST_CONTEXT_KEY` via `pre_context`.
 - `describe_bearer_auth_cases(suite_name, cases)` — table-driven runner; one `test()` per case; asserts status, error, body fields, `api_token_id`, context preservation.
 - `TEST_MIDDLEWARE_PATH = '/api/test'` — path used by the echo route in the stack factory.
 - `create_test_middleware_stack_app(options?)` — real proxy + origin + bearer middleware for integration-shape testing. Echo route returns `{ok, client_ip, has_context}`.
@@ -532,7 +535,7 @@ method and assert the stream closes within 2s.
 
 `SseRouteTestSpec` per route: `{path, trigger, event_specs?, assert_closes_on_revoke?}`.
 A consumer registry closes on the revoke when its route joined it to the
-backend's closer (`ctx.deps.connection_closer.add(create_sse_connection_closer(registry))`)
+backend's closer (`ctx.deps.connection_closer.add(create_sse_connection_closer(registry, role))`)
 or when the suite's `on_audit_event` option wires a guard (e.g. `create_sse_auth_guard`); with
 neither, the revoke assertion fails.
 
@@ -929,9 +932,10 @@ source of truth for wire-shape conformance.
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
   `account_status` / `peer_request` /
-  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` —
-  each has a `test_if`
-  reader (`ws_self_revocation_reply` forks one case's assertion instead); `peer_request` (server-initiated requests — the ActionPeer
+  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` /
+  `ws_role_gated` / `ws_refusal_body` — each has a `test_if`
+  reader (`ws_self_revocation_reply` forks one case's assertion instead, and
+  `ws_refusal_body` how the front-door table reads a WS refusal); `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
   keeps it `false` like sse/ready until a backend wires the `peer/ping` HTTP +
@@ -1034,7 +1038,7 @@ error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case i
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
   closed `ConformancePrincipal` enum (`keeper` / `daemon` / `invalid_daemon` /
-  `daemon_browser` / `token` / `bearer_browser` / `anonymous` /
+  `daemon_browser` / `token` / `bearer_browser` / `malformed_bearer` / `scoped_token` / `anonymous` /
   `fresh_non_admin` / `role_holder` / `wrong_role` / `expired_session`) —
   fixture accessors, never inline credential minting.
   `invalid_daemon` sends a malformed `X-Daemon-Token` alongside the keeper
@@ -1054,8 +1058,11 @@ error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case i
   `bearer_browser` is the bearer twin: a _valid_ bearer api-token in a browser
   context (default `Origin` present), fresh jar (no session) — the bearer
   middleware discards it, so an authed action 401s, wire-indistinguishable from
-  `anonymous` (pinned by the `browser_bearer_replay` equivalence group). The
+  `anonymous` (pinned by the `bearer_soft_fail` equivalence group). The
   `token` principal is the honored counterpart (suppresses `Origin`).
+  `malformed_bearer` is the keeper's token minus its last character over a
+  no-Origin, empty-jar transport — refused by the shape precheck before any
+  database work, so it joins `bearer_soft_fail` too.
   `expired_session` is the keeper behind an expired server-side session
   (`fixture.mint_expired_session()`: a backdated `auth_session` row behind a
   still-valid signed cookie, so the DB-row expiry gate is what refuses it).
@@ -1157,7 +1164,7 @@ the seven server-initiated notifications (`received` → recipient,
 `role_grant_revoke` → revokee, and `role_grant_offer_supersede` → each
 superseded sibling's grantor on **both** the accept- and revoke-cascade paths).
 `describe_role_grant_offer_notification_ws_tests({setup_test, capabilities,
-base_url, ws_path})` opens the affected counterparty's socket
+base_url, ws_path, ws_required_roles?})` opens the affected counterparty's socket
 (`create_admitted_ws_transport` — a targeted notification reaches only an
 admitted connection, and the handshake alone doesn't say it is one), drives the
 lifecycle RPC over `fixture.transport`, then
@@ -1177,8 +1184,36 @@ Sends queue on the post-commit drain, so `WsClient.wait_for` polls + waits
 (method + predicate filter ignores unrelated frames). Accounts are seeded with
 `ROLE_ADMIN` (the only admin-grantable role) so they can open an admin-gated WS
 where one exists (forge) and be offered the role; harmless on the auth-only
-spine. Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
-`src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`.
+spine. A backend whose `ws_path` is gated on `ROLE_ADMIN` declares it in
+`ws_required_roles`: the revoke case then revokes the revokee's only admin
+grant and expects its socket to close with `WS_CLOSE_PERMISSION_REVOKED` (the
+notification may or may not land first, and is held to the flat shape when it
+does), where an ungated socket expects the frame. The offer/accept fixtures are `create_pending_role_grant_offer` /
+`create_active_role_grant` (`cross_backend/role_grant_cross_helpers.ts`).
+Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`, and
+`role_grant_offer_notification_ws_gated.cross.test.ts` runs it again over the
+spine binaries' role-gated endpoint with `ws_required_roles` declared.
+
+### `cross_backend/ws_role_gated.ts` — `describe_ws_role_gated_cross_tests`
+
+Real-upgrade parity for a **role-gated WebSocket losing its role**: a revoked
+global grant of a role an endpoint's `required_roles` lists closes the account's
+sockets on that endpoint with `WS_CLOSE_PERMISSION_REVOKED` (and its reason),
+while the account's ungated socket on the same transport stays open,
+dispatching, and receiving the account's pushes, and a re-upgrade is refused at
+the gate (403); a scoped revoke of a listed role closes nothing — the case
+first opens the gated socket on a global grant of `scoped_role` alone, which
+proves the endpoint lists it. That a closed registration is sent nothing more
+is beyond what a client sees once it has read the close frame; each spine's
+transport tests pin it.
+`describe_ws_role_gated_cross_tests({setup_test, capabilities, base_url,
+ws_path, gated_ws_path, gated_roles, scoped_role, rpc_path?})` — `gated_roles`
+must hold `ROLE_ADMIN` and `scoped_role` (a role an admin can grant scoped).
+fuz_app's spine binaries mount `SPINE_ROLE_GATED_WS_PATH` gated on
+`SPINE_ROLE_GATED_WS_ROLES` (`admin` + `participant`). Gated on
+`capabilities.ws` and `capabilities.ws_role_gated`; cross-process only.
+fuz_app's own wiring is `src/test/cross_backend/ws_role_gated.cross.test.ts`.
 
 ### `cross_backend/peer_ping_ws.ts` — `describe_peer_ping_ws_tests`
 
@@ -1386,7 +1421,14 @@ moderation_required}`, with `moderation` set per the verdict (`pending`+private
   **visible** one **403**s; plain parentless creates stay open. The moderate
   suite then proves the `pending → approved | rejected` transition: an admin
   (root manager) approves → public, the **author** self-approve → 403
-  (anti-self-approval), a non-viewer → 404, reject → stays private. The
+  (anti-self-approval), a non-viewer → 404, reject → stays private. It also
+  pins the moderation read gate (a pending or rejected post reaches no
+  non-steward reader past its author and admins on `cell_get`, `cell_list`,
+  `cell_item_list`, and fact serving, even flipped public or granted while
+  approved), `cell_grant_create`'s
+  403 `cell_grant_unapproved`, and the steward arm (a non-admin root owner — a
+  non-`space` root the policy leaves open — reads the queue, `cell_get`, and
+  the fact, and moderates, but still 404s on clone and create-under). The
   authorizer _behavior_ adds no method/wire shape, so schema + manifest parity
   are **blind** to a divergence — these are the only gates that catch one (the
   `cell_moderate` verb itself is manifest-covered). In-process hook coverage is
@@ -1565,6 +1607,27 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   payload-expiry tests never reached. Daemon-token-gated like its siblings; the
   Rust mirror is `fuz_testing::create_testing_mint_session_action_spec`.
 
+  Also in the module and **not** bundled: `_testing_origin_check`
+  (`create_testing_origin_check_action()`, `run_testing_origin_check(input)`,
+  `TestingOriginCheckInput` / `TestingOriginCheckOutput`) — answers the origin
+  allowlist's parse and request check for one `{patterns, origin}` pair:
+  `{ok: true, allowed}` or `{ok: false, errors: [{index?, kind}]}`. Pure, no
+  database. Kept out of the bundle so a consumer whose Rust binary doesn't
+  mount the mirror (`fuz_testing::create_testing_origin_check_action_spec`)
+  keeps an exact action-manifest gate; the spine binary appends it in
+  `build_full_spine_rpc_actions`.
+
+  Also **not** bundled: `_testing_shorten_credential_expiry`
+  (`create_testing_shorten_credential_expiry_action()`) — pulls an account's
+  `auth_session` and `api_token` expiries in to `seconds` (1–60) from now,
+  shorten-only (`LEAST`, an eternal token gaining one), answering
+  `{sessions, api_tokens}` counts. Applied before a connection opens, since
+  the deadline is read when the credential resolves. Backs
+  `describe_credential_deadline_cross_tests`; appended in
+  `build_full_spine_rpc_actions` for the same manifest reason as
+  `_testing_origin_check`. The Rust mirror is
+  `fuz_testing::create_testing_shorten_credential_expiry_action_spec`.
+
   Also in the module — but **not** bundled by `create_testing_actions` —
   `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
   dumps the live RPC registry as a normalized `ActionManifest` for the
@@ -1611,19 +1674,95 @@ serve a body-parity gate (its per-spine coverage stays in the two surface
 censuses). Cross-process only; fuz_app's own wiring is
 `src/test/cross_backend/token_scope_surface.cross.test.ts`.
 
+### Front-door contract — `cross_backend/transport_composition.ts`
+
+`describe_transport_composition_cross_tests({setup_test, capabilities, base_url,
+rpc_path?, origin?, rest_path?, password_path?, ws_path?, sse_path?})` — the per-transport
+composition table: what each transport answers before per-action dispatch,
+when one request trips several refusals. Rows are REST `POST` (session-only
+`/api/account/logout`), RPC `POST`, RPC `GET`, the WS upgrade (gated on
+`capabilities.ws`) and the audit stream (`capabilities.sse`); columns are a
+foreign `Origin` with the keeper's session (→ 403 `forbidden_origin`), an
+over-cap declared length with a foreign `Origin` and no credential (→ 413
+`payload_too_large`, body-carrying rows only), no credential (→ 401
+`authentication_required`), and a narrowed bearer with no `Origin` (→ 403
+`token_scope_required` naming `rpc:<method>` on RPC and `surface:ws_upgrade` on
+the upgrade; 403 `credential_type_required` on the session-only REST route and
+audit stream); a `/password` cell pins that route's 401 beside `/logout`'s.
+Each case asserts the status and the body — flat `{error}` or the JSON-RPC
+envelope's `error.data`. A WS refusal's body is required where the backend
+declares `capabilities.ws_refusal_body`; where it doesn't (Node's
+`@hono/node-ws` drops the body), an empty body passes on its status and a sent
+one is still asserted. The table
+is the exported `transport_composition_cases` data. Given `base_url`, every
+probe is written to the socket (`raw_http_exchange`) and an over-cap request
+sends its head alone; with `base_url: null` the probes go through the
+fixture's transport and the WS rows skip. Not in the standard bundle. fuz_app's
+own wiring is `src/test/cross_backend/transport_composition.cross.test.ts` and
+the in-process `src/test/auth/transport_composition_parity.db.test.ts`.
+
+`cross_backend/narrowed_api_token.ts` — `mint_narrowed_api_token({app,
+rpc_path, session_headers, methods, name?})` mints a method-scoped api token
+through the production `account_token_create` path and returns the raw bearer
+(throws when the mint is refused). Shared by the front-door table, the
+token-scope surface suite, and the conformance table's `scoped_token`
+principal.
+
+### Credential deadline parity — `cross_backend/credential_deadline.ts`
+
+`describe_credential_deadline_cross_tests({setup_test, capabilities, base_url,
+ws_path, sse_path?, rpc_path?})` — a connection closes when the credential it
+opened on expires: each case pulls a fresh account's credential expiries in to
+two seconds with `_testing_shorten_credential_expiry` before the open, then
+checks the connection still dispatches short of the deadline and closes at it.
+A WebSocket on a session and one on an API token (`capabilities.ws`) close with
+`WS_CLOSE_SESSION_REVOKED` and `WS_CLOSE_CREDENTIAL_EXPIRED_REASON`; an audit
+stream on a session (`capabilities.sse`) ends; and a second seam call asking
+for a later expiry moves nothing (the seam only shortens). API token × audit
+stream is not reachable over the wire — the stock stream is session-only — so
+the Rust spine pins it on a widened gate and the TS twin shares one deadline
+wait across both transports. Cross-process only; fuz_app's own wiring is
+`src/test/cross_backend/credential_deadline.cross.test.ts`.
+
+### Origin check scope parity — `cross_backend/origin_scope.ts`
+
+`describe_origin_scope_cross_tests({setup_test, capabilities, probe_path?})` —
+the origin check covers paths outside `/api`: on `GET /ready` (`probe_path`), a
+foreign `Origin` → 403 `forbidden_origin`, an absent or allowed one → 200. Gated
+on `capabilities.ready`. Runs both legs (the in-process
+`cross_backend/origin_scope_parity.db.test.ts` + the cross-process
+`origin_scope.cross.test.ts`).
+
 ### Origin verification parity — `cross_backend/origin.ts`
 
 `describe_origin_cross_tests({setup_test, rpc_path?})` — the
-imperative Origin-verification suite: disallowed `Origin` → 403 `forbidden_origin` (refused
-before dispatch), absent `Origin` → request passes (non-browser direct access).
-Imperative (not a conformance-table row) because origin rejection is
-middleware-level flat-REST, not the JSON-RPC envelope the table runner expects,
-and absent-Origin needs `fresh_transport({origin: null})`. Runs both legs (the
+imperative Origin-verification suite: absent `Origin` → request passes
+(non-browser direct access); the disallowed-`Origin` 403 is the front-door
+table's. Imperative (not a conformance-table row) because absent-Origin needs
+`fresh_transport({origin: null})`. Runs both legs (the
 in-process `auth/origin_parity.db.test.ts` + the cross-process
 `origin.cross.test.ts`). The promotion surfaced a twin-impl divergence — the
 Rust spine returned a plain-text body — now converged to the canonical TS
 `{error: "forbidden_origin"}` via `fuz_http::forbidden_origin_response()`.
 
+### Origin allowlist conformance — `cross_backend/origin_conformance.ts`
+
+`cross_backend/origin_conformance.json` is the shared table both spines' origin
+allowlist must satisfy: **parse** rows `{raw, ok: true}` or `{raw, errors:
+[{index?, kind}]}` (every refusal, 1-based position, `AllowedOriginsErrorKind`)
+and **match** rows `{patterns, origin, allowed}` (`origin: null` — no
+`Origin` — passes). A row may carry a `note`. `load_origin_conformance()` reads
+and validates it (`OriginConformance`), `to_origin_conformance_checks(table)`
+flattens it into `_testing_origin_check` inputs with their expected answers, and
+`assert_origin_conformance(checks, answers, backend)` fails once listing every
+row that disagrees. `describe_origin_conformance_cross_tests({setup_test,
+rpc_path?})` sends every row to a backend's `_testing_origin_check` over the
+keeper's daemon-token channel; the TS unit leg runs the same rows through
+`run_testing_origin_check` (`src/test/http/origin.conformance.test.ts`), so the
+Rust spine is held to the table without reading the file. Ungated; edit the
+table by hand — it is the statement of the grammar, not generated output.
+fuz_app's own wiring is `src/test/cross_backend/origin_conformance.cross.test.ts`.
+
 ### CORS simple-request parity — `cross_backend/simple_request.ts`
 
 `describe_simple_request_cross_tests({setup_test, rpc_path?, login_path?, logout_path?})`
@@ -1714,9 +1853,9 @@ so one fixture is the cross-impl contract): the TS spine via
 `import.meta.url` constant off `spine_surface_constants.ts`; the Rust
 `testing_spine_stub` via the absolute path `rust_spine_stub_backend_config`
 passes through `FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH`. The fixture covers the full
-spine bootstrap (auth + cell + cell_history + fact) and is regenerated +
+spine bootstrap (auth + cell + fact) and is regenerated +
 drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
-(`UPDATE_SCHEMA_READY=1`, then `gro format`).
+(`UPDATE_SCHEMA_READY=1`).
 
 ### Testing-backdoor credential gate — `cross_backend/testing_backdoor.ts`
 
@@ -1935,7 +2074,7 @@ re-roll the serve / daemon-info / WS-attach / drain boilerplate:
 - `testing/cross_backend/full_spine_mount.ts` — `build_full_spine_rpc_actions(deps, options)` — the **full** live RPC mount: the declared bundle **plus** the off-declared-surface families the binary live-mounts (`_testing_*` backdoors, the cell verb set, the opt-in `actor_lookup` / `actor_search` resolvers). `build_full_spine_mount(deps, options)` builds it once for both of the binary's endpoints, returning `FullSpineMount` (`{rpc_actions, ws_actions}`): the WS list is `protocol_actions` plus every RPC action not already among them, twinning the Rust `testing_spine_stub`, which serves one registry on RPC and WS (the one difference is `cancel` — a registered protocol action on TS, owned by the read loop on Rust). Single-sources the mount so the binary and the `spine_method_coverage` reconciliation test build the same list.
 - `testing/cross_backend/ts_spine_backend_config.ts` — `ts_spine_node_backend_config()` / `ts_spine_deno_backend_config()` / `ts_spine_bun_backend_config()` presets (in-memory pglet, no external infra), the TS analog of `rust_spine_stub_backend_config()`.
 
-fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` (`rate_limiters: 'disabled_for_testing'` plus whichever login / action limiters its env toggles built, `build_full_spine_mount`'s two lists on one `rpc_endpoints` entry and one `ws_endpoints` entry, whose `transport` is also the role-grant-offer `notification_sender`), reusing `default_spine_surface`. `src/test/cross_backend/testing_spine_server.db.test.ts` builds it with the Node adapter in-process and asserts its surface lists `/api/ws` and passes the surface invariants. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic. It leaves `create_app_server`'s `auth_cleanup` off, as the Rust `testing_spine_stub` leaves its twin unscheduled: a background pass would delete rows and write audit rows under a running suite. A consumer's cross-process test binary may schedule it when nothing its suites seed is already expired (the conformance table's `expired_session` principal seeds a backdated session row); an in-process harness leaves it off.
+fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` (`rate_limiters: 'disabled_for_testing'` plus whichever login / action limiters its env toggles built, `build_full_spine_mount`'s two lists on one `rpc_endpoints` entry and two `ws_endpoints` entries — `/api/ws` and the role-gated `SPINE_ROLE_GATED_WS_PATH` — sharing one `transport`, which is also the role-grant-offer `notification_sender`), reusing `default_spine_surface`. `src/test/cross_backend/testing_spine_server.db.test.ts` builds it with the Node adapter in-process and asserts its surface lists both WS endpoints (the gated one with its `required_roles`) and passes the surface invariants. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic. It leaves `create_app_server`'s `auth_cleanup` off, as the Rust `testing_spine_stub` leaves its twin unscheduled: a background pass would delete rows and write audit rows under a running suite. A consumer's cross-process test binary may schedule it when nothing its suites seed is already expired (the conformance table's `expired_session` principal seeds a backdated session row); an in-process harness leaves it off.
 
 ### Live-method coverage reconciliation — `method_coverage.ts`
 

package/dist/testing/adversarial_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}
+{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAYzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}

package/dist/testing/adversarial_headers.js

@@ -10,6 +10,13 @@ import './assert_dev_env.js';
 import { test, assert, describe } from 'vitest';
 import { ApiError, ERROR_FORBIDDEN_ORIGIN } from '../http/error_schemas.js';
 import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH } from './middleware.js';
+import { create_test_raw_api_token } from './entities.js';
+/**
+ * A well-formed bearer value — it passes the `is_api_token_shaped` precheck,
+ * so a `not_called` case proves an earlier layer short-circuited, not that the
+ * token's shape was refused.
+ */
+const ADVERSARIAL_BEARER_TOKEN = create_test_raw_api_token('adversarial');
 // --- Standard adversarial header cases ---
 /**
  * 7 standard adversarial header cases applicable to any middleware stack.
@@ -26,7 +33,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with Origin header is rejected before token validation',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: 'https://attacker.com'
         },
         expected_status: 403,
@@ -36,7 +43,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with allowed Origin — bearer silently discarded (browser context)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: allowed_origin
         },
         expected_status: 200,
@@ -51,7 +58,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'empty Origin header is rejected by origin middleware before bearer auth (defense-in-depth)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Origin: ''
         },
         expected_status: 403,
@@ -61,7 +68,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235), soft-fails',
         headers: {
-            Authorization: 'bearer secret_fuz_token_test'
+            Authorization: `bearer ${ADVERSARIAL_BEARER_TOKEN}`
         },
         expected_status: 200,
         validate_expectation: 'called'
@@ -72,7 +79,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         // treats Referer presence as a browser-context indicator and discards
         // the token, so the request reaches the route as unauthenticated.
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Referer: 'https://attacker.com/page'
         },
         expected_status: 200,
@@ -81,7 +88,7 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
     {
         name: 'bearer token with allowed Referer (no Origin) — bearer silently discarded (browser context)',
         headers: {
-            Authorization: 'Bearer secret_fuz_token_test',
+            Authorization: `Bearer ${ADVERSARIAL_BEARER_TOKEN}`,
             Referer: `${allowed_origin}/page`
         },
         expected_status: 200,

package/dist/testing/connection_closer_helpers.d.ts

@@ -2,11 +2,16 @@ import './assert_dev_env.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
 /**
  * Record of a single `ConnectionCloser` method invocation — a credential
- * close carries the id it was given, `close_all_sockets` (`'all'`) none.
+ * close carries the id it was given, a role close (`'role'`) the account id
+ * and the role, `close_all_sockets` (`'all'`) none.
  */
 export type RecordedClose = {
     method: 'session' | 'token' | 'account';
     id: string;
+} | {
+    method: 'role';
+    id: string;
+    role: string;
 } | {
     method: 'all';
     id: null;

package/dist/testing/connection_closer_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;GAGG;AACH,MAAM,MAAM,aAAa,GACxB;IAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvF,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAO,eAqB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,aAAa,CAAC,QAAQ,CAAC,EAC/B,IAAI,MAAM,GAAG,IAAI,KACf,IAIF,CAAC"}
+{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAO,eAyB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,aAAa,CAAC,QAAQ,CAAC,EAC/B,IAAI,MAAM,GAAG,IAAI,KACf,IAIF,CAAC"}

package/dist/testing/connection_closer_helpers.js

@@ -25,6 +25,10 @@ export const create_recording_closer = () => {
             calls.push({ method: 'account', id });
             return 1;
         },
+        close_sockets_for_role: (id, role) => {
+            calls.push({ method: 'role', id, role });
+            return 1;
+        },
         close_all_sockets: () => {
             calls.push({ method: 'all', id: null });
             return 1;

package/dist/testing/cross_backend/account_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAoUF,CAAC"}
+{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAqZF,CAAC"}

package/dist/testing/cross_backend/account_lifecycle.js

@@ -2,7 +2,9 @@ import '../assert_dev_env.js';
 /**
  * Cross-backend parity suite for the account-lifecycle admin verbs:
  * `account_delete` (soft), `account_undelete` (reactivation), and
- * `account_purge` (keeper hard-delete), plus the keeper guard.
+ * `account_purge` (keeper hard-delete), plus the keeper guard and the
+ * session-only self-delete (an API token can't end its own account; an admin
+ * token still deletes another).
  *
  * Like the cell suites, these verbs can't ride the generic
  * `describe_rpc_round_trip_tests`: they're stateful and destructive (a
@@ -16,7 +18,8 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, AuditLogListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
-import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
+import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED, ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
@@ -55,6 +58,38 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             assert.strictEqual(purge.ok, false, 'purge of keeper account must be refused');
             assert.strictEqual(error_reason(purge), ERROR_CANNOT_DELETE_KEEPER);
         });
+        test_if(capabilities.account_lifecycle, 'self-delete is session-only; an admin bearer still deletes another account', async () => {
+            const fixture = await setup_test();
+            const member = await fixture.create_account({ username: 'lifecycle_self_bearer' });
+            // The member's own bearer may not end its account (handler-enforced,
+            // the dispatcher's credential-type refusal).
+            const refused = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', {}, member.create_bearer_headers());
+            assert.strictEqual(refused.ok, false, 'a bearer self-delete must be refused');
+            assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.forbidden);
+            assert.strictEqual(error_reason(refused), ERROR_CREDENTIAL_TYPE_REQUIRED);
+            assert.deepStrictEqual(refused.error?.data
+                ?.required_credential_types, ['session']);
+            // An explicit own id is self in either case (`Uuid` admits both) — the
+            // keeper's too, whose refusal is the credential one, not the keeper guard.
+            for (const [label, account_id, headers] of [
+                ['member', member.account.id, member.create_bearer_headers()],
+                ['keeper', fixture.account.id, fixture.create_bearer_headers()]
+            ]) {
+                const upper = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', { account_id: account_id.toUpperCase() }, headers);
+                assert.strictEqual(upper.ok, false, `${label}: an uppercased own id is self`);
+                assert.deepStrictEqual(upper.error, refused.error, label);
+            }
+            // Nothing was tombstoned: the member's session still verifies.
+            const still = await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'account_verify', undefined, member.create_session_headers());
+            assert.ok(still.ok, 'the refused self-delete leaves the account live');
+            // The keeper's bearer (admin-capable) deletes another account.
+            const deleted = expect_output(await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', { account_id: member.account.id }, fixture.create_bearer_headers()), AccountDeleteOutput);
+            assert.strictEqual(deleted.deleted, true);
+            // A self-delete over a session goes through.
+            const self = await fixture.create_account({ username: 'lifecycle_self_session' });
+            const self_deleted = expect_output(await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'account_delete', {}, self.create_session_headers()), AccountDeleteOutput);
+            assert.strictEqual(self_deleted.deleted, true);
+        });
         test_if(capabilities.account_lifecycle, 'fail-closed: a soft-deleted account’s session + bearer credentials no longer authenticate', async () => {
             const fixture = await setup_test();
             const victim = await fixture.create_account({ username: 'lifecycle_failclosed' });

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA2HD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAyLlF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAwHD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA+HlF,CAAC"}