@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/cross_backend/cell_relations.js

@@ -16,11 +16,23 @@ import '../assert_dev_env.js';
  * - **grant lifecycle** — owner grants an actor-shaped editor; the grantee
  *   gains edit (was 404 before the grant); `cell_grant_list` is manage-tier
  *   (owner sees it, the editor gets the IDOR 404); revoke drops the edit path.
+ * - **no owner principal** — a grant naming the cell's owner is refused
+ *   `cell_grant_principal_is_owner`, with the owner's actor id sent lowercase
+ *   or uppercase.
  * - **`cell_visibility_manage_only`** — the editor-grant holder can edit
  *   content but flipping `visibility` is 403 (the case the 5-verb CRUD cut
  *   couldn't reach without a grant principal).
  * - **fields** — `cell_field_set` UPSERT, forward + reverse `cell_field_list`,
  *   idempotent `cell_field_delete`.
+ * - **relation-list caps** — past the default page of inbound edges, a
+ *   reverse `cell_item_list` / `cell_field_list` with no `limit` answers the
+ *   default page, an explicit `limit` caps it in either direction, and the
+ *   forward list defaults the same — the same counts on both spines. A page is
+ *   visible edges: a page's worth of private ends older than one public end
+ *   still leaves the public one on an anonymous page, in all four lists. An
+ *   out-of-range or mistyped `limit` (`0`, `-1`, `1.5`, past the max, `null`,
+ *   a string) is `invalid_params` in every direction, and the reverse lists
+ *   read oldest edge first.
  * - **items** — `cell_item_insert` at fractional-index positions, forward
  *   (lex-ordered) + reverse `cell_item_list`, `cell_item_move`, idempotent
  *   `cell_item_delete`.
@@ -55,13 +67,15 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
+import { fractional_index_between, fractional_indices_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, CellListOutput } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
-import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
+import { ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
 import { CellFieldDeleteOutput, CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
 import { CellItemDeleteOutput, CellItemInsertOutput, CellItemListOutput, CellItemMoveOutput } from '../../auth/cell_item_action_specs.js';
 import { CellAuditListOutput } from '../../auth/cell_audit_action_specs.js';
+import { JSONRPC_INVALID_PARAMS } from '../../http/jsonrpc.js';
+import { CELL_RELATION_LIST_LIMIT_DEFAULT, CELL_RELATION_LIST_LIMIT_MAX } from '../../auth/cell_relation_list_limit.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -134,6 +148,20 @@ export const describe_cell_relations_cross_tests = (options) => {
             assert.ok(!post.ok, 'revoked editor still edited');
             assert.strictEqual(error_reason(post), 'cell_not_found');
         });
+        test_if(capabilities.cell_relations, 'a grant naming the owner is refused cell_grant_principal_is_owner, whatever the id case', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_grant_self_owner' });
+            const t = fixture.fresh_transport();
+            const owner_h = owner.create_session_headers();
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput).cell;
+            // both spines canonicalize the id before comparing it with
+            // `created_by`, so the uppercased owner id is the owner too
+            for (const actor_id of [owner.actor.id, owner.actor.id.toUpperCase()]) {
+                const res = await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id: cell.id, level: 'viewer', principal: { kind: 'actor', actor_id } }, owner_h);
+                assert.ok(!res.ok, `a grant to the owner must be refused (${actor_id})`);
+                assert.strictEqual(error_reason(res), ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, actor_id);
+            }
+        });
         test_if(capabilities.cell_relations, "cell_list shared_with: 'me' lists grant-admitted cells, excludes owned, enriches cell_grants", async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_shared_owner' });
@@ -219,6 +247,121 @@ export const describe_cell_relations_cross_tests = (options) => {
             const del2 = expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_delete', { source_id: source.id, name: 'cover' }, h), CellFieldDeleteOutput);
             assert.strictEqual(del2.deleted, false);
         });
+        test_if(capabilities.cell_relations, 'relation lists default to a capped page and honor limit, forward and reverse', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_cap_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            // one past the default page, so an omitted limit shows the cap
+            const inbound = CELL_RELATION_LIST_LIMIT_DEFAULT + 1;
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const hub = await make();
+            const parent = await make();
+            const source = await make();
+            const positions = fractional_indices_between(null, null, inbound);
+            for (let i = 0; i < inbound; i++) {
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: parent, child_id: hub, position: positions[i] }, h), CellItemInsertOutput);
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: source, name: `link_${i}`, target_id: hub }, h), CellFieldSetOutput);
+            }
+            const items = async (params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', params, h), CellItemListOutput).items.length;
+            const fields = async (params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_list', params, h), CellFieldListOutput).fields.length;
+            for (const [label, count] of [
+                ['reverse items, no limit', await items({ child_id: hub })],
+                ['reverse fields, no limit', await fields({ target_id: hub })],
+                ['forward items, no limit', await items({ parent_id: parent })],
+                ['forward fields, no limit', await fields({ source_id: source })]
+            ]) {
+                assert.strictEqual(count, CELL_RELATION_LIST_LIMIT_DEFAULT, label);
+            }
+            assert.strictEqual(await items({ child_id: hub, limit: 3 }), 3, 'reverse items, limit 3');
+            assert.strictEqual(await fields({ target_id: hub, limit: 3 }), 3, 'reverse fields, limit 3');
+            assert.strictEqual(await items({ child_id: hub, limit: inbound }), inbound, 'reverse items, limit past the default');
+            assert.strictEqual(await fields({ target_id: hub, limit: inbound }), inbound, 'reverse fields, limit past the default');
+        });
+        test_if(capabilities.cell_relations, 'a relation page is visible edges: hidden ends never crowd out a visible one', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_pad_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const anon = fixture.fresh_transport({ origin: null });
+            const make = async (visibility) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility }, h), CellCreateOutput).cell.id;
+            const call = async (method, params) => cross_rpc_call(t, rpc_path, method, params, h);
+            // A full default page of private edges, older (and, forward, named
+            // earlier) than one public edge, in all four lists.
+            const target = await make('public');
+            const child = await make('public');
+            const source = await make('public');
+            const parent = await make('public');
+            const padding = CELL_RELATION_LIST_LIMIT_DEFAULT + 1;
+            const positions = fractional_indices_between(null, null, padding + 1);
+            for (let i = 0; i <= padding; i++) {
+                const end = await make(i < padding ? 'private' : 'public');
+                const name = `link_${String(i).padStart(3, '0')}`;
+                expect_output(await call('cell_field_set', { source_id: end, name: 'link', target_id: target }), CellFieldSetOutput);
+                expect_output(await call('cell_item_insert', { parent_id: end, child_id: child, position: 'a0' }), CellItemInsertOutput);
+                expect_output(await call('cell_field_set', { source_id: source, name, target_id: end }), CellFieldSetOutput);
+                expect_output(await call('cell_item_insert', {
+                    parent_id: parent,
+                    child_id: end,
+                    position: positions[i]
+                }), CellItemInsertOutput);
+            }
+            const anon_fields = async (params) => expect_output(await cross_rpc_call(anon, rpc_path, 'cell_field_list', params, {}), CellFieldListOutput).fields;
+            const anon_items = async (params) => expect_output(await cross_rpc_call(anon, rpc_path, 'cell_item_list', params, {}), CellItemListOutput).items;
+            assert.strictEqual((await anon_fields({ target_id: target })).length, 1, 'reverse fields: the public source, past a page of private ones');
+            assert.strictEqual((await anon_items({ child_id: child })).length, 1, 'reverse items: the public parent, past a page of private ones');
+            assert.strictEqual((await anon_fields({ source_id: source })).length, 1, 'forward fields: the public target, past a page of private ones');
+            assert.strictEqual((await anon_items({ parent_id: parent })).length, 1, 'forward items: the public child, past a page of private ones');
+            // the owner views every end: a full default page
+            const owned = expect_output(await call('cell_field_list', { target_id: target }), CellFieldListOutput).fields;
+            assert.strictEqual(owned.length, CELL_RELATION_LIST_LIMIT_DEFAULT, "the owner's page");
+        });
+        test_if(capabilities.cell_relations, 'relation-list limit: out-of-range and mistyped values refused alike, forward and reverse', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_limit_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const directions = [
+                ['cell_field_list', { source_id: cell }],
+                ['cell_field_list', { target_id: cell }],
+                ['cell_item_list', { parent_id: cell }],
+                ['cell_item_list', { child_id: cell }]
+            ];
+            for (const [method, base] of directions) {
+                for (const limit of [0, -1, 1.5, CELL_RELATION_LIST_LIMIT_MAX + 1, null, '5']) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { ...base, limit }, h);
+                    const label = `${method} ${JSON.stringify(base)} limit ${JSON.stringify(limit)}`;
+                    assert.ok(!res.ok, `${label} must be refused`);
+                    assert.strictEqual(res.error?.code, JSONRPC_INVALID_PARAMS, label);
+                    assert.strictEqual(error_reason(res), undefined, label);
+                }
+                for (const limit of [1, CELL_RELATION_LIST_LIMIT_MAX]) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { ...base, limit }, h);
+                    assert.ok(res.ok, `${method} ${JSON.stringify(base)} limit ${limit}`);
+                }
+            }
+        });
+        test_if(capabilities.cell_relations, 'reverse relation lists read oldest edge first, so a page of one is the oldest', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_order_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const hub = await make();
+            // each edge its own call, so each has its own `created_at`, in order
+            const ends = [await make(), await make(), await make()];
+            for (const end of ends) {
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: end, child_id: hub, position: 'a0' }, h), CellItemInsertOutput);
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: end, name: 'link', target_id: hub }, h), CellFieldSetOutput);
+            }
+            const parents = async (limit) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', { child_id: hub, limit }, h), CellItemListOutput).items.map((i) => i.parent_id);
+            const sources = async (limit) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_list', { target_id: hub, limit }, h), CellFieldListOutput).fields.map((f) => f.source_id);
+            assert.deepStrictEqual(await parents(), ends, 'reverse items, oldest first');
+            assert.deepStrictEqual(await parents(1), [ends[0]], 'reverse items, a page of one');
+            assert.deepStrictEqual(await sources(), ends, 'reverse fields, oldest first');
+            assert.deepStrictEqual(await sources(1), [ends[0]], 'reverse fields, a page of one');
+        });
         test_if(capabilities.cell_relations, 'item insert → ordered forward + reverse list → move → idempotent delete', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_item_owner' });

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -66,6 +66,11 @@ import { z } from 'zod';
  *   be replayed from a browser — wire-indistinguishable from sending no
  *   credential (the `token` principal is the honored counterpart: it suppresses
  *   `Origin`, so the same token authenticates).
+ * - `malformed_bearer` — the keeper's bearer api-token with its last character
+ *   dropped, non-browser context, fresh jar. A value that cannot be a token
+ *   fails each spine's shape precheck and soft-fails before any database work,
+ *   so the request arrives anonymous — wire-indistinguishable from sending no
+ *   credential.
  * - `scoped_token` — the keeper authenticated via a bearer api-token minted
  *   with a **narrowed** `TokenScope` (`{kind: 'methods', methods:
  *   [SCOPED_TOKEN_ADMITTED_METHOD]}`), non-browser context. Minted through the
@@ -92,12 +97,13 @@ import { z } from 'zod';
 export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
-    anonymous: "anonymous";
     daemon: "daemon";
     invalid_daemon: "invalid_daemon";
     daemon_browser: "daemon_browser";
     bearer_browser: "bearer_browser";
+    malformed_bearer: "malformed_bearer";
     scoped_token: "scoped_token";
+    anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
     wrong_role: "wrong_role";
@@ -122,12 +128,13 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
     as: z.ZodEnum<{
         keeper: "keeper";
         token: "token";
-        anonymous: "anonymous";
         daemon: "daemon";
         invalid_daemon: "invalid_daemon";
         daemon_browser: "daemon_browser";
         bearer_browser: "bearer_browser";
+        malformed_bearer: "malformed_bearer";
         scoped_token: "scoped_token";
+        anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
         wrong_role: "wrong_role";
@@ -179,12 +186,13 @@ export declare const ConformanceCase: z.ZodObject<{
         as: z.ZodEnum<{
             keeper: "keeper";
             token: "token";
-            anonymous: "anonymous";
             daemon: "daemon";
             invalid_daemon: "invalid_daemon";
             daemon_browser: "daemon_browser";
             bearer_browser: "bearer_browser";
+            malformed_bearer: "malformed_bearer";
             scoped_token: "scoped_token";
+            anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";
             wrong_role: "wrong_role";

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;EAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;EAc/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -66,6 +66,11 @@ import { z } from 'zod';
  *   be replayed from a browser — wire-indistinguishable from sending no
  *   credential (the `token` principal is the honored counterpart: it suppresses
  *   `Origin`, so the same token authenticates).
+ * - `malformed_bearer` — the keeper's bearer api-token with its last character
+ *   dropped, non-browser context, fresh jar. A value that cannot be a token
+ *   fails each spine's shape precheck and soft-fails before any database work,
+ *   so the request arrives anonymous — wire-indistinguishable from sending no
+ *   credential.
  * - `scoped_token` — the keeper authenticated via a bearer api-token minted
  *   with a **narrowed** `TokenScope` (`{kind: 'methods', methods:
  *   [SCOPED_TOKEN_ADMITTED_METHOD]}`), non-browser context. Minted through the
@@ -96,6 +101,7 @@ export const ConformancePrincipal = z.enum([
     'daemon_browser',
     'token',
     'bearer_browser',
+    'malformed_bearer',
     'scoped_token',
     'anonymous',
     'fresh_non_admin',

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEN,KAAK,eAAe,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqPD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAwKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEN,KAAK,eAAe,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAIzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAmPD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAwKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -27,9 +27,10 @@ import '../assert_dev_env.js';
 import { assert, describe, test } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { find_auth_route, rest_auth_route_suffixes } from '../integration_helpers.js';
-import { find_rpc_action, headers_to_record, rpc_call, rpc_call_for_spec, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
+import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
 import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
 import { SCOPED_TOKEN_ADMITTED_METHOD } from './conformance_case.js';
+import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { xfail_until } from './xfail.js';
 /**
  * A deliberately malformed `X-Daemon-Token` value for the `invalid_daemon`
@@ -61,26 +62,13 @@ const mint_scoped_token = async (fixture, resolved_rpc_endpoints) => {
             `on the surface to mint its narrowed token, but the method is not registered on ` +
             `rpc_endpoints.`);
     }
-    // Spec-bound rather than a loose `rpc_call`: `params` type-checks against
-    // `TokenCreateInput` (so dropping `scope` is a compile error, not a runtime
-    // 400 in every test at once), and `result.token` comes back typed and
-    // output-validated — no cast, no hand-rolled presence check.
-    const res = await rpc_call_for_spec({
+    return mint_narrowed_api_token({
         app: fixture.transport,
-        path: found.path,
-        spec: account_token_create_action_spec,
-        params: {
-            name: 'conformance scoped token',
-            scope: { kind: 'methods', methods: [SCOPED_TOKEN_ADMITTED_METHOD] },
-            lifetime: { kind: 'eternal' }
-        },
-        headers: fixture.create_session_headers()
+        rpc_path: found.path,
+        session_headers: fixture.create_session_headers(),
+        methods: [SCOPED_TOKEN_ADMITTED_METHOD],
+        name: 'conformance scoped token'
     });
-    if (!res.ok) {
-        throw new Error(`conformance: minting the 'scoped_token' principal failed with ${res.status}: ` +
-            JSON.stringify(res.error));
-    }
-    return res.result.token;
 };
 /**
  * Map a `ConformancePrincipal` onto the transport + headers it
@@ -159,6 +147,19 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
                 transport: fixture.fresh_transport(),
                 headers: fixture.create_bearer_headers()
             };
+        case 'malformed_bearer': {
+            // The keeper's valid token minus its last character — prefixed, one char
+            // short — over the same no-Origin, empty-jar transport as `token`, so the
+            // shape precheck (not the browser-context discard) is what refuses it.
+            const valid = fixture.create_bearer_headers().authorization;
+            if (!valid)
+                throw new Error(`conformance: principal 'malformed_bearer' found no bearer header`);
+            return {
+                transport: fixture.fresh_transport({ origin: null }),
+                headers: { authorization: valid.slice(0, -1) },
+                suppress_default_origin: true
+            };
+        }
         case 'scoped_token': {
             // A narrowed bearer, otherwise identical to `token` — empty jar + no
             // Origin, so the credential is honored rather than browser-discarded

package/dist/testing/cross_backend/credential_deadline.d.ts

@@ -0,0 +1,25 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { SetupTest } from './setup.js';
+/** Configuration for `describe_credential_deadline_cross_tests`. */
+export interface CredentialDeadlineCrossTestOptions {
+    /** Per-test fixture producer (`default_cross_process_setup(handle)`). */
+    readonly setup_test: SetupTest;
+    /** Backend capability flags — the WebSocket cases gate on `ws`, the stream case on `sse`. */
+    readonly capabilities: BackendCapabilities;
+    /** Base URL the backend is reachable at. */
+    readonly base_url: string;
+    /** The WebSocket endpoint path (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** The audit-log stream path. Default `/api/admin/audit/stream`. */
+    readonly sse_path?: string;
+    /** JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
+    readonly rpc_path?: string;
+}
+/**
+ * Register the credential-deadline suite: a WebSocket on a session or an API
+ * token closes with 4001 "Credential expired" at its credential's expiry, an
+ * audit stream on a session ends there, and the expiry seam never extends.
+ */
+export declare const describe_credential_deadline_cross_tests: (options: CredentialDeadlineCrossTestOptions) => void;
+//# sourceMappingURL=credential_deadline.d.ts.map

package/dist/testing/cross_backend/credential_deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_deadline.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_deadline.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAsB7E,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,kCAAkC,KACzC,IAoKF,CAAC"}

package/dist/testing/cross_backend/credential_deadline.js

@@ -0,0 +1,185 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-process **credential deadline** suite — a long-lived connection
+ * closes when the credential it was opened with expires.
+ *
+ * A WebSocket or an audit stream is authorized once, at open, and closed on
+ * revocation by identity — but expiry writes nothing a revocation listener
+ * could hear. So each spine carries the credential's deadline onto the
+ * connection (`ResolvedAuth.credential_deadline`: the earlier of a session's
+ * cookie and row expiry, an API token's row expiry) and closes it there: a
+ * socket with `WS_CLOSE_SESSION_REVOKED` and
+ * `WS_CLOSE_CREDENTIAL_EXPIRED_REASON`, a stream by ending it as a revoked one
+ * ends.
+ *
+ * Each case pulls a fresh account's credential expiries in to
+ * `expiry_seconds` from now with the daemon-token
+ * `_testing_shorten_credential_expiry` seam, **before** opening the
+ * connection (the deadline is read when the credential resolves), then checks
+ * the connection is open short of the deadline and closed at it:
+ *
+ * 1. WebSocket × session — 4001, "Credential expired".
+ * 2. WebSocket × API token — the same.
+ * 3. Audit stream × session — the stream ends.
+ * 4. The seam only shortens: a second call asking for a later expiry moves
+ *    nothing, and the socket still closes at the first deadline.
+ *
+ * The fourth reachable combination, API token × audit stream, is not here:
+ * the stock audit stream admits sessions only on both spines. Each spine
+ * covers it below the wire — the Rust stream route on a widened credential
+ * gate, the TS deadline wait shared by both transports.
+ *
+ * Gated on `capabilities.ws` (cases 1, 2, 4) and `capabilities.sse` (case 3);
+ * cross-process only — the seam is mounted on the spine test binaries.
+ *
+ * @module
+ */
+import { assert, describe } from 'vitest';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
+import { WS_CLOSE_CREDENTIAL_EXPIRED_REASON, WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SSE_CONNECTED_COMMENT } from '../../realtime/sse_constants.js';
+import { rpc_call_non_browser } from '../rpc_helpers.js';
+import { create_sse_transport } from '../transports/sse_transport.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { test_if } from './capabilities.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** Default audit-log stream path. */
+const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+/** The shortened lifetime each case gives its credentials, in seconds. */
+const EXPIRY_SECONDS = 2;
+/**
+ * How long past the deadline a close may take before the case fails — wide
+ * for a loaded machine, and bounded so a missing close fails rather than
+ * hangs.
+ */
+const CLOSE_GRACE_MS = 4000;
+/**
+ * The deadline counts from the seam's call, and the connection opens after
+ * it; a close sooner than this after the call came before the deadline.
+ */
+const EARLIEST_CLOSE_MS = EXPIRY_SECONDS * 1000 - 300;
+/**
+ * Register the credential-deadline suite: a WebSocket on a session or an API
+ * token closes with 4001 "Credential expired" at its credential's expiry, an
+ * audit stream on a session ends there, and the expiry seam never extends.
+ */
+export const describe_credential_deadline_cross_tests = (options) => {
+    const { setup_test, capabilities, base_url, ws_path, sse_path = DEFAULT_SSE_PATH, rpc_path = SPINE_RPC_PATH } = options;
+    /**
+     * Pull `account`'s credential expiries in to `seconds` from now through the
+     * daemon-token seam, returning when it was called.
+     */
+    const shorten = async (fixture, account, seconds) => {
+        const called_at = performance.now();
+        const result = await rpc_call_non_browser({
+            app: fixture.fresh_transport({ origin: null }),
+            path: rpc_path,
+            method: '_testing_shorten_credential_expiry',
+            params: { account_id: account.account.id, seconds },
+            headers: fixture.create_daemon_token_headers()
+        });
+        if (!result.ok) {
+            assert.fail(`_testing_shorten_credential_expiry failed: ${JSON.stringify(result)}`);
+        }
+        const counts = result.result;
+        return { called_at, ...counts };
+    };
+    const cookie_of = (account) => {
+        const { cookie } = account.create_session_headers();
+        assert.ok(cookie, 'expected a session cookie');
+        return cookie;
+    };
+    /**
+     * Assert `client` is open short of the deadline, then closes with 4001
+     * "Credential expired" at it.
+     */
+    const assert_closes_at_deadline = async (client, called_at) => {
+        // open and dispatching before the deadline
+        assert.deepStrictEqual(await client.request(1, heartbeat_action_spec.method, {}), {});
+        assert.ok(await client.wait_for_close(EXPIRY_SECONDS * 1000 + CLOSE_GRACE_MS), 'the socket did not close at its credential deadline');
+        const elapsed = performance.now() - called_at;
+        assert.ok(elapsed >= EARLIEST_CLOSE_MS, `closed ${Math.round(elapsed)}ms in, before the deadline`);
+        assert.strictEqual(client.close_code, WS_CLOSE_SESSION_REVOKED);
+        assert.strictEqual(client.close_reason, WS_CLOSE_CREDENTIAL_EXPIRED_REASON);
+    };
+    describe('credential deadline (cross-process)', () => {
+        test_if(capabilities.ws, 'a session socket closes with 4001 "Credential expired" at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at, sessions } = await shorten(fixture, account, EXPIRY_SECONDS);
+            assert.ok(sessions >= 1, 'the seam shortened the account session');
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+        test_if(capabilities.ws, 'an API token socket closes with 4001 "Credential expired" at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at, api_tokens } = await shorten(fixture, account, EXPIRY_SECONDS);
+            assert.ok(api_tokens >= 1, 'the seam shortened the account API token');
+            // a bearer outside a browser context: no Origin, no cookie
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [],
+                origin: null,
+                headers: { Authorization: `Bearer ${account.api_token}` }
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+        test_if(capabilities.sse, 'a session audit stream ends at the deadline', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account({ roles: [ROLE_ADMIN] });
+            const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
+            const sse = await create_sse_transport({
+                base_url,
+                sse_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                assert.strictEqual((await sse.read_frame()) + '\n\n', SSE_CONNECTED_COMMENT, 'the stream opened');
+                assert.ok(await sse.wait_for_close(EXPIRY_SECONDS * 1000 + CLOSE_GRACE_MS), 'the stream did not end at its credential deadline');
+                const elapsed = performance.now() - called_at;
+                assert.ok(elapsed >= EARLIEST_CLOSE_MS, `ended ${Math.round(elapsed)}ms in, before the deadline`);
+            }
+            finally {
+                await sse.close();
+            }
+        });
+        test_if(capabilities.ws, 'the expiry seam only shortens: a later expiry moves nothing', async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account();
+            const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
+            // asks for a minute; the credentials stay due at the first deadline
+            await shorten(fixture, account, 60);
+            const client = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: [cookie_of(account)],
+                origin: base_url
+            });
+            try {
+                await assert_closes_at_deadline(client, called_at);
+            }
+            finally {
+                await client.close();
+            }
+        });
+    });
+};

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAmCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA6BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAkCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -53,7 +53,13 @@ export const ts_default_capabilities = Object.freeze({
     // Off by default — the `cell_gated_create` test policy is a fuz_app test
     // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
     // consumers.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Off by default — the second, role-gated WS endpoint is a spine-binary
+    // mount (`SPINE_ROLE_GATED_WS_PATH`); fuz_app's spine configs opt in.
+    ws_role_gated: false,
+    // Off by default: `@hono/node-ws` drops a refused upgrade's body, so a
+    // Node-served consumer sends none. A Deno- or Bun-served one may opt in.
+    ws_refusal_body: false
 });
 /**
  * Capabilities for the Rust family. The non-gating wiring facts live in
@@ -88,7 +94,12 @@ export const rust_default_capabilities = Object.freeze({
     ws_self_revocation_reply: false,
     // Off by default — the `testing_spine_stub` preset opts in (it mounts the
     // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Off by default — the `testing_spine_stub` preset opts in (it mounts the
+    // role-gated WS endpoint at `SPINE_ROLE_GATED_WS_PATH`).
+    ws_role_gated: false,
+    // axum sends a refused upgrade's response as built, body included.
+    ws_refusal_body: true
 });
 /**
  * Shape notes for TS-family backends — wiring facts, not gating flags.

package/dist/testing/cross_backend/expected_schema.json

@@ -76,7 +76,6 @@
 		"role",
 		"scope_id"
 	],
-	"cell_history": ["action_id", "cell_id", "created_at", "fact_hash", "id"],
 	"cell_item": ["child_id", "created_at", "parent_id", "position"],
 	"fact": ["bytes", "content_type", "created_at", "external_url", "hash", "size"],
 	"fact_ref": ["source_hash", "target_hash"],

package/dist/testing/cross_backend/full_spine_mount.d.ts

@@ -14,6 +14,9 @@ import '../assert_dev_env.js';
  * - the `_testing_*` daemon-token backdoors (`create_testing_actions`),
  * - the full cell verb set (CRUD + grant + field + item + audit),
  * - the opt-in `actor_lookup` / `actor_search` resolvers,
+ * - the `_testing_origin_check` probe the origin conformance table drives,
+ * - the `_testing_shorten_credential_expiry` seam the credential-deadline
+ *   suite drives,
  * - the `_testing_action_manifest` backdoor, appended last (it dumps the live
  *   method set for the cross-impl manifest-parity gate, so it must enumerate
  *   every method above it).

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAYvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoCjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAcvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}