@fuzdev/fuz_app 0.144.0 → 0.146.0

package/dist/testing/CLAUDE.md

@@ -932,10 +932,10 @@ source of truth for wire-shape conformance.
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
   `account_status` / `peer_request` /
-  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` /
+  `ws_handshake_pipelining` / `ws_account_actions` /
   `ws_role_gated` / `ws_refusal_body` — each has a `test_if`
-  reader (`ws_self_revocation_reply` forks one case's assertion instead, and
-  `ws_refusal_body` how the front-door table reads a WS refusal); `peer_request` (server-initiated requests — the ActionPeer
+  reader (`ws_refusal_body` picks how the front-door table reads a WS
+  refusal instead); `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
   keeps it `false` like sse/ready until a backend wires the `peer/ping` HTTP +
@@ -966,7 +966,8 @@ source of truth for wire-shape conformance.
   generic round-trip can't drive (it can't delete the subject). `true` on every
   spine. `fact_serving`
   gates `describe_fact_serving_cross_tests` (the cell-scoped per-reference +
-  admin-only bare-hash fact-serving parity suite); like cells it stays off the
+  admin-only bare-hash fact-serving parity suite, incl. the served fact's
+  hardening headers and bodyless masked 404s); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
   the `_testing_put_fact` seeder (whose optional `holder` records a
   `fact_holder` row, so a non-admin can reference what it seeds) — it also
@@ -991,11 +992,9 @@ source of truth for wire-shape conformance.
   write raw bytes to).
   `ws_account_actions` (the WS endpoint mounts the account actions — `true` on
   fuz_app's own spine presets, `false` in the family defaults) gates the WS
-  round-trip suite's self-revocation case and, with `rpc_path`, its
-  WS-mutation audit case (which calls `_testing_drain_effects`);
-  `ws_self_revocation_reply` says what the self-revocation case requires: the reply ahead of the close (`true`, the TS
-  family) or the close alone (`false`, the Rust family, whose socket loop
-  drops the response once the connection is closed — a recorded divergence).
+  round-trip suite's self-revocation case (which requires the reply ahead of
+  the close on every backend) and, with `rpc_path`, its WS-mutation audit case
+  (which calls `_testing_drain_effects`).
 
 ### `cross_backend/standard.ts` — `describe_standard_cross_process_tests`
 
@@ -1117,7 +1116,8 @@ call (not folded into `describe_standard_cross_process_tests`) because it
 needs raw `base_url` / `ws_path` the standard bundle doesn't carry, mirroring
 how `describe_ws_round_trip_tests` sits beside `describe_standard_tests`
 in-process. `describe_cross_process_ws_tests({setup_test, capabilities,
-base_url, ws_path, origin?, rpc_path?, max_message_bytes?})` opens a live
+base_url, ws_path, origin?, rpc_path?, max_message_bytes?, logout_path?,
+password_path?, max_tokens?})` opens a live
 `WebSocket` via `create_ws_transport` (the `ws` npm package) and asserts
 cases against the upgrade stack `register_ws_endpoint` wires (origin →
 `require_auth` → dispatch): authed upgrade round-trips `heartbeat`,
@@ -1135,8 +1135,19 @@ anonymous upgrade refused, disallowed-origin upgrade refused, and — gated on
 mid-connection (`account_session_revoke_all` over the keeper session channel;
 asserted via `WsClient.wait_for_close`) and when its account is deleted
 (`account_delete` by the keeper, also gated on
-`capabilities.account_lifecycle`; the close code is
-`WS_CLOSE_SESSION_REVOKED`). Per-connection auth is enforced **at upgrade
+`capabilities.account_lifecycle`), each with `WS_CLOSE_SESSION_REVOKED` and
+`WS_CLOSE_SESSION_REVOKED_REASON`. The rest of the revocation table closes a second
+account's socket with `WS_CLOSE_SESSION_REVOKED` and
+`WS_CLOSE_SESSION_REVOKED_REASON`: `account_token_revoke` its revoked token's
+bearer socket (a socket on its other token stays open);
+`admin_token_revoke_all`, `POST /logout` (`logout_path`), `POST /password`
+(`password_path`) and `account_purge` (also gated on
+`capabilities.account_lifecycle`) its bearer and session sockets; and
+`max_tokens` further mints (default `DEFAULT_MAX_TOKENS`; `null` skips) the
+bearer socket of the token the cap evicts. The account-wide rows come from
+`cross_backend/revocation_drivers.ts` (`create_account_revocations`, shared
+with the SSE suite), and a case that opens several sockets closes whichever
+opened when a later open fails. Per-connection auth is enforced **at upgrade
 time**, so the negative upgrade cases assert the upgrade itself rejects, not
 a per-message error; the close cases prove a revocation closes an
 already-open socket, since per-message dispatch never re-checks credential
@@ -1144,8 +1155,7 @@ validity. Omit `rpc_path` to skip the close cases (consumers without the
 standard account and admin actions on their RPC endpoint). Two cases are gated
 on `capabilities.ws_account_actions` (the WS endpoint mounts the account
 actions): a socket that revokes its own sessions over that socket is closed
-with `WS_CLOSE_SESSION_REVOKED`, and — where the backend declares
-`capabilities.ws_self_revocation_reply` — reads the reply first; and (with
+with `WS_CLOSE_SESSION_REVOKED` and its reason after reading the reply to its request; and (with
 `rpc_path`) a socket mints an API token over WS, and its `token_create` audit
 row is read back after `_testing_drain_effects` — a WS reply can precede its
 audit write, so the drain is the barrier (the binary mounts it via
@@ -1349,7 +1359,11 @@ account-wide close) and then just the one (`account_session_revoke`, the
 session-scoped close), each dropping the live stream (asserted via
 `SseTransport.wait_for_close`); the keeper soft-deletes a second admin whose
 stream is open (`account_delete`, also gated on
-`capabilities.account_lifecycle`), dropping it; and one stream past the per-session cap
+`capabilities.account_lifecycle`), dropping it; `admin_token_revoke_all`,
+`POST /logout` (`logout_path`), `POST /password` (`password_path`) and
+`account_purge` (also gated on `capabilities.account_lifecycle`) of a second
+admin each drop its stream — the rows `create_account_revocations`
+(`cross_backend/revocation_drivers.ts`) shares with the WS suite; and one stream past the per-session cap
 (`max_per_scope`, default `AUDIT_LOG_SSE_MAX_PER_SCOPE`; `null` skips) on one
 session closes the oldest and leaves the rest open. The data-frame + close
 cases gate on `rpc_path` (they drive the standard account/admin actions); all
@@ -1359,6 +1373,20 @@ cases gate on `capabilities.sse`. Cross-process only — wire from a
 TS spines wire `audit_log_sse` and the Rust `spine_stub` serves the same
 stream.
 
+### `cross_backend/revocation_drivers.ts` — shared revocation drivers
+
+The account-wide revocations both transport suites close a live connection on,
+as one table: `create_account_revocations({capabilities, rpc_path,
+logout_path, password_path})` → `AccountRevocation` rows (`{label, slug,
+gate, revoke(fixture, target)}`) for `admin_token_revoke_all`, `POST /logout`,
+`POST /password`, and `account_purge` (`gate` reads
+`capabilities.account_lifecycle`). `revoke` asserts the revocation succeeded;
+the target must hold `DEFAULT_TEST_PASSWORD`. A revocation added here is
+covered on WS and SSE at once. The drivers stand alone too: `cross_post_as`
+(a JSON `POST` on an account's session, asserting 200),
+`cross_admin_token_revoke_all`, and `cross_account_purge` (over the daemon
+token, no `Origin`).
+
 ### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
 The cell-layer parity coverage is split across two sibling suites. Cells
@@ -1669,7 +1697,8 @@ cases are `src/test/auth/cell_ref_admission{,.fact_less}.db.test.ts`.
 `describe_token_scope_surface_cross_tests({setup_test, capabilities, rpc_path?,
 sse_path?})` — the `surface:<name>` twin of the conformance slate's
 `token_scope_cases`, which cover only the `rpc:<method>` arm. Token scoping's
-RPC-only rule (_a narrowed api token reaches no non-RPC surface_) is the
+RPC-only rule (_a narrowed api token reaches no non-RPC surface that reads
+account data or carries authority_) is the
 load-bearing half of the design and had **no** cross-impl gate: the schema gate
 can't see it (no column), the action-manifest gate can't see it (no method), and
 the spec-derived suites can't see it (REST routes, off the declared RPC surface).
@@ -1682,7 +1711,12 @@ fact read (`capabilities.fact_serving`) — asserting the exact flat
 contract on (`token_scope_denied_body` ↔
 `fuz_auth::token_scope_surface_denied_response`).
 
-The fifth case is the one with no prior pin anywhere: **scope outranks role**. A
+The account status read (`capabilities.account_status`) answers anonymous
+callers, so rule 3 there is the anonymous answer: a narrowed token on
+`GET /api/account/status` gets the anonymous `401`, status and body byte for
+byte, while the same account's full-scope bearer reads the account.
+
+One case has no prior pin anywhere: **scope outranks role**. A
 narrowed token on an account that _also_ lacks the gating role must hear
 `token_scope_required`, not `insufficient_permissions` — the observable the
 TS↔Rust ordering divergence produced before both spines converged on running the
@@ -1911,16 +1945,18 @@ asserting each spec declares `credential_types: ['daemon_token']`) + the
 
 ### Identity-primitive parity — `cross_backend/identity_parity.ts`
 
-`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?})` —
+`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?, bootstrap_path?, password_path?})` —
 the imperative suite pinning the `primitive_schemas` twins (`Username`,
 `UsernameProvided`, `Email`) + login/signup input handling end-to-end over real
 HTTP (flat REST `/login` + `/signup`, so imperative, not a `conformance_table`
-row). Six facets, each a TS↔Rust reimplementation pair that the spec-derived
+row). The facets, each a TS↔Rust reimplementation pair that the spec-derived
 round-trip / conformance suites never vary:
 
 - **Login canonicalization** — case-insensitive + whitespace-trim lookup
-  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), plus a
-  Turkish-`İ` homograph **no-Unicode-fold-collision** negative.
+  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), the trimmed
+  set being JS `String.prototype.trim`'s on every spine (U+FEFF padding trimmed,
+  U+0085 not), plus a Turkish-`İ` homograph **no-Unicode-fold-collision**
+  negative.
 - **Username-or-email login** — an account created with an email logs in via
   that email, case-insensitively both directions; username login still works;
   non-existent email → 401. This is the corner that surfaced and closed the Rust
@@ -1933,7 +1969,11 @@ round-trip / conformance suites never vary:
   `account_login` (closed a cluster where three of these fell through to a
   lookup-miss 401 on Rust and a whitespace-only identifier 401'd on TS). Asserted
   by error reason, not just status.
-- **ASCII-only creation invariant** — non-ASCII username → 400 at signup.
+- **ASCII-only creation invariant** — non-ASCII username → 400 at signup, and a
+  padded creation name (space, tab, U+0085) → 400, never trimmed into a legal
+  one — at signup, and at bootstrap (`bootstrap_path`, default
+  `/api/account/bootstrap`, `null` to skip), where the body is validated ahead
+  of the window check, so the 400 holds after bootstrap completed.
 - **Length + format regex parity** — both `[USERNAME_LENGTH_MIN,
 USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
   just-inside → 403 no-matching-invite) and the creation regex shape (leading
@@ -1948,6 +1988,13 @@ USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
   Zod's `z.email()` rejects — the deliberately-looser shared rule. **Closed a
   real divergence**: the Rust spine previously length-checked the email only,
   accepting any non-empty string TS rejected.
+- **Malformed JSON body** — an unparseable (`{`) or non-object (`[]`) body typed
+  `application/json` → 400 `{error: "invalid_json_body"}` and nothing else, on
+  login, signup, bootstrap (ahead of its window check), and the password change
+  (`password_path`, default `/api/account/password`, `null` skips; parsed after
+  its credential and session-only gates, so the case sends a session and an
+  anonymous one still answers 401). A Rust backend needs the spine's
+  `parse_json_body`.
 
 Ungated (login + signup are on every spine). Runs both legs via the shared
 `{setup_test}` protocol: in-process (`identity_parity.db.test.ts`, plain
@@ -1970,6 +2017,10 @@ over real HTTP on both spines:
 - **XFF keying** — exhaust one forwarded IP to 429, then a _distinct_ forwarded IP
   → 401 (not 429), proving the limiter keys on the resolved `X-Forwarded-For` IP,
   not the loopback TCP peer (a backend ignoring XFF would 429 the fresh IP too).
+- **a malformed hop stops the walk** — after exhausting one forwarded IP, a
+  chain with that IP left of an `ip:port` entry → 401, not 429: the walk stops at
+  the malformed entry and keys on the connection IP (its audit row says so),
+  never on the client-written entry past it.
 - **a success does not refund the per-IP budget** — the distributed-spray
   backstop. Failed guesses against distinct usernames from one forwarded IP,
   interleaved with the attacker's own successful logins, must still 429 within a

package/dist/testing/cross_backend/capabilities.d.ts

@@ -176,24 +176,6 @@ export interface BackendCapabilities {
      * once the account actions are there.
      */
     readonly ws_account_actions: boolean;
-    /**
-     * A socket that revokes the credential it is running on reads the reply to
-     * that request **before** the revocation's close. Read by the
-     * self-revocation case in `describe_cross_process_ws_tests` (which
-     * `ws_account_actions` gates): with it `true` the case requires the reply
-     * frame ahead of the `WS_CLOSE_SESSION_REVOKED` close; with it `false` the
-     * case requires the close alone.
-     *
-     * `true` for the TS family — `register_action_ws` sends the response and
-     * only then flushes the request's post-commit queue, where the close is.
-     * `false` for the Rust family: its dispatch runs the post-commit queue
-     * before handing the response to the socket loop, and the loop, finding the
-     * connection already closed, writes the close frame and drops the response.
-     * The caller's revocation still took effect; it is not told so. The flag
-     * records that divergence so the suite stays green on both spines without
-     * hiding it — flip it once the Rust spine answers first.
-     */
-    readonly ws_self_revocation_reply: boolean;
     /**
      * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
      * layer — creating a `kind: 'gated'` cell requires the `participant` role

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAwBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -28,7 +28,7 @@ import '../assert_dev_env.js';
  *
  * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
  * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader,
- * or — `ws_self_revocation_reply` — forks one case's assertion).
+ * or — `ws_refusal_body` — picks how a case reads a refusal).
  * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
  * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
  * (`in_process_shape_notes` here, `ts_default_shape_notes` /
@@ -66,9 +66,6 @@ export const in_process_capabilities = Object.freeze({
     ws_handshake_pipelining: false,
     // Cross-process-only: the case reads a real socket's frames in wire order.
     ws_account_actions: false,
-    // Read only by the case `ws_account_actions` gates; the in-process
-    // dispatcher does answer first.
-    ws_self_revocation_reply: true,
     // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
     // spine binaries' full mount + the Rust stub, not the in-process default app.
     cell_gated_create: false,

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAkCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA8BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -47,9 +47,6 @@ export const ts_default_capabilities = Object.freeze({
     // fuz_app's spine configs opt in (the spine binary mounts the account
     // actions on `/api/ws`); a consumer does once its endpoint carries them.
     ws_account_actions: false,
-    // `register_action_ws` sends a request's response before it flushes the
-    // post-commit queue a self-revocation's close is on.
-    ws_self_revocation_reply: true,
     // Off by default — the `cell_gated_create` test policy is a fuz_app test
     // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
     // consumers.
@@ -88,10 +85,6 @@ export const rust_default_capabilities = Object.freeze({
     // Off by default, as on the TS family: a consumer opts in once its WS
     // endpoint mounts the account actions. The `testing_spine_stub` preset does.
     ws_account_actions: false,
-    // The Rust dispatch runs the post-commit queue — the self-revocation's
-    // close — before the socket loop writes the response, and the loop then
-    // drops it. A divergence from the TS spine; see the flag's doc.
-    ws_self_revocation_reply: false,
     // Off by default — the `testing_spine_stub` preset opts in (it mounts the
     // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
     cell_gated_create: false,

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgBR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAgOxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkRxF,CAAC"}

package/dist/testing/cross_backend/fact_serving.js

@@ -14,7 +14,11 @@ import '../assert_dev_env.js';
  *   though the identical bytes are world-readable via B's cell (one deduped
  *   `fact` row; authz lives on the `(cell, hash)` edge, never unioned);
  * - **404-mask** — a missing cell and a viewable cell that doesn't reference
- *   the hash both 404 (never 403, never "exists elsewhere");
+ *   the hash both 404 (never 403, never "exists elsewhere"), and every masked
+ *   404 is bodyless, so its shape names no branch;
+ * - **hardening headers** — a served fact carries `X-Content-Type-Options:
+ *   nosniff`, the `default-src 'none'; sandbox` CSP, and `Cache-Control:
+ *   private, max-age=300`, whatever its content type;
  * - **bare-hash admin-only** — `GET /api/facts/:hash` is admin (keeper) only:
  *   non-admin → 403, anonymous → 401;
  * - **multi-actor fallthrough** — a multi-actor caller resolves to a null
@@ -22,7 +26,10 @@ import '../assert_dev_env.js';
  *   read its own *private* fact there (admitted only by public cells). Opt-in
  *   (needs the multi-actor setup); every spine resolves the acting actor at the
  *   dispatcher's authorization phase from account-grain credentials, so the
- *   multi-actor account is drivable on TS and Rust alike.
+ *   multi-actor account is drivable on TS and Rust alike;
+ * - **narrowed-token downgrade** — a scope-narrowed API token on the
+ *   cell-scoped route is anonymous, not refused: its owner's private fact 404s
+ *   exactly as for an anonymous caller, while a public cell still serves.
  *
  * Facts are seeded **embedded** via `_testing_put_fact` (the cross-process
  * driver has no DB handle); the referencing cell via the `cell_create` RPC
@@ -40,8 +47,10 @@ import { describe, assert } from 'vitest';
 import { z } from 'zod';
 import { FactHashSchema } from '../../primitive_schemas.js';
 import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { FACT_CACHE_CONTROL, FACT_CONTENT_SECURITY_POLICY, FACT_X_CONTENT_TYPE_OPTIONS } from '../../server/fact_security_headers.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
+import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A blake3 hash that is a valid form but references no seeded fact. */
 const UNRELATED_HASH = `blake3:${'0'.repeat(64)}`;
@@ -70,15 +79,37 @@ export const cross_put_fact = async (fixture, rpc_path, input) => expect_output(
 // credential when an `Origin` / `Referer` is present (browser
 // context), and cross-process `fixture.transport` auto-adds `Origin`.
 fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', input, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
-/** GET a fact over a cross-process `FetchTransport`; returns `{status, content_type, text}`. */
+/** GET a fact over a cross-process `FetchTransport`; returns `{status, content_type, text, headers}`. */
 const fact_get = async (transport, path, headers) => {
     const res = await transport(path, { method: 'GET', headers });
     return {
         status: res.status,
         content_type: res.headers.get('content-type'),
-        text: await res.text()
+        text: await res.text(),
+        headers: res.headers
     };
 };
+/**
+ * Assert a served fact carries the hardening headers — `nosniff`, the
+ * sandboxing CSP — and the private cache policy. A spine that dropped either
+ * hardening header would serve a user-typed `content_type` (or a sniffable
+ * octet-stream) as executable HTML.
+ */
+const assert_fact_headers = (headers, label) => {
+    assert.strictEqual(headers.get('x-content-type-options'), FACT_X_CONTENT_TYPE_OPTIONS, `${label}: X-Content-Type-Options`);
+    assert.strictEqual(headers.get('content-security-policy'), FACT_CONTENT_SECURITY_POLICY, `${label}: Content-Security-Policy`);
+    assert.strictEqual(headers.get('cache-control'), FACT_CACHE_CONTROL, `${label}: Cache-Control`);
+};
+/**
+ * Assert a 404 is the masked one: no body, so the response says nothing about
+ * which check refused it.
+ */
+const assert_masked_404 = (got, label) => {
+    assert.strictEqual(got.status, 404, `${label} did not 404`);
+    assert.strictEqual(got.text, '', `${label}: a masked 404 has no body`);
+    // TODO: the content type isn't pinned — the Node TS spine answers the
+    // bodyless 404 with `text/plain; charset=UTF-8`, Deno, Bun and Rust with none
+};
 export const describe_fact_serving_cross_tests = (options) => {
     const { setup_test, setup_test_multi_actor, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -105,6 +136,7 @@ export const describe_fact_serving_cross_tests = (options) => {
             assert.strictEqual(got.text, 'public-fact-bytes');
             // The served `Content-Type` echoes the seeded value on both backends.
             assert.strictEqual(got.content_type, 'text/plain', 'served content-type drifted');
+            assert_fact_headers(got.headers, 'cell-scoped text/plain fact');
         });
         test_if(capabilities.fact_serving, 'cross-owner dedup does not leak: A’s private reference stays 404 while B publishes the same bytes', async () => {
             const fixture = await setup_test();
@@ -129,12 +161,13 @@ export const describe_fact_serving_cross_tests = (options) => {
             assert.strictEqual(via_b.status, 200, `B's public cell should serve the fact: ${via_b.text}`);
             // Seeded without a content_type → both backends fall back to octet-stream.
             assert.strictEqual(via_b.content_type, 'application/octet-stream', 'no-content-type fact should serve as octet-stream');
+            assert_fact_headers(via_b.headers, 'octet-stream fact');
             // A's PRIVATE reference must NOT leak — to anon or to B — even though
             // the identical bytes are world-readable via B's public cell.
             const a_via_anon = await fact_get(anon, cell_fact_path(a_cell, hash), {});
-            assert.strictEqual(a_via_anon.status, 404, "A's private reference leaked to anon");
+            assert_masked_404(a_via_anon, "A's private reference read by anon");
             const a_via_b = await fact_get(t, cell_fact_path(a_cell, hash), b.create_session_headers());
-            assert.strictEqual(a_via_b.status, 404, "A's private reference leaked to B");
+            assert_masked_404(a_via_b, "A's private reference read by B");
             // A can read its own private cell's fact.
             const a_via_a = await fact_get(t, cell_fact_path(a_cell, hash), a.create_session_headers());
             assert.strictEqual(a_via_a.status, 200, 'A could not read its own private fact');
@@ -146,29 +179,33 @@ export const describe_fact_serving_cross_tests = (options) => {
             const admin_headers = fixture.create_session_headers();
             // Missing cell → 404.
             const missing = await fact_get(t, cell_fact_path(NIL_UUID, hash), admin_headers);
-            assert.strictEqual(missing.status, 404, 'missing cell did not 404');
+            assert_masked_404(missing, 'missing cell');
             // A viewable (keeper-owned, public) cell that references a DIFFERENT
             // hash → 404 (missing cell→fact edge), even though the caller can view
             // the cell. `path` is admin-only and the keeper is admin.
             const unrelated_cell = await create_cell_with_ref(t, admin_headers, UNRELATED_HASH, 'public');
             const no_edge = await fact_get(t, cell_fact_path(unrelated_cell, hash), admin_headers);
-            assert.strictEqual(no_edge.status, 404, 'cell without the edge did not 404');
+            assert_masked_404(no_edge, 'cell without the edge');
             // Edge present but no `fact` row: the same cell DOES reference
             // `UNRELATED_HASH`, which was never seeded. Cell + edge + view all
             // pass, so this exercises the distinct serve-time "metadata missing"
             // 404 branch — masked identically to the authz 404s above.
             const edge_no_bytes = await fact_get(t, cell_fact_path(unrelated_cell, UNRELATED_HASH), admin_headers);
-            assert.strictEqual(edge_no_bytes.status, 404, 'edge to an absent fact did not 404');
+            assert_masked_404(edge_no_bytes, 'edge to an absent fact');
         });
         test_if(capabilities.fact_serving, 'bare-hash route is admin-only', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'fact_non_admin' });
-            const hash = await put_fact(fixture, 'bare-hash-bytes');
+            // stored as `text/html` — the type a dropped hardening header would let
+            // execute in the admin's session
+            const hash = await put_fact(fixture, 'bare-hash-bytes', 'text/html');
             const t = fixture.fresh_transport();
-            // keeper holds ROLE_ADMIN → 200 + the actual bytes.
+            // keeper holds ROLE_ADMIN → 200 + the actual bytes, hardened.
             const as_admin = await fact_get(t, `/api/facts/${hash}`, fixture.create_session_headers());
             assert.strictEqual(as_admin.status, 200, `admin bare-hash read failed: ${as_admin.text}`);
             assert.strictEqual(as_admin.text, 'bare-hash-bytes', 'bare-hash route served wrong bytes');
+            assert.strictEqual(as_admin.content_type, 'text/html', 'served content-type drifted');
+            assert_fact_headers(as_admin.headers, 'bare-hash text/html fact');
             // non-admin → 403.
             const as_non_admin = await fact_get(t, `/api/facts/${hash}`, non_admin.create_session_headers());
             assert.strictEqual(as_non_admin.status, 403, 'non-admin reached the bare-hash route');
@@ -177,6 +214,42 @@ export const describe_fact_serving_cross_tests = (options) => {
             const as_anon = await fact_get(anon, `/api/facts/${hash}`, {});
             assert.strictEqual(as_anon.status, 401, 'anon reached the bare-hash route');
         });
+        // A narrowed token reaches no non-RPC surface; on this anonymous-admitting
+        // route it is downgraded to anonymous rather than refused (a 403 would
+        // enforce nothing — the holder drops the header). So the owner's narrowed
+        // token reads exactly what an anonymous caller reads: its private fact
+        // 404s, a public cell still serves. The owner's full-scope bearer reading
+        // the private fact pins that the 404 is the scope, not the bearer.
+        test_if(capabilities.fact_serving, 'narrowed api token is treated as anonymous on the cell-scoped route', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'fact_narrowed_owner' });
+            const hash = await cross_put_fact(fixture, rpc_path, {
+                content: 'narrowed-token-bytes',
+                holder: owner.actor.id
+            });
+            const t = fixture.fresh_transport();
+            const session = owner.create_session_headers();
+            const private_cell = await create_cell_with_ref(t, session, hash, 'private');
+            const public_cell = await create_cell_with_ref(t, session, hash, 'public');
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: session,
+                methods: ['cell_get']
+            });
+            // no `Origin` — a bearer in a browser context is discarded
+            const bare = fixture.fresh_transport({ origin: null });
+            const narrowed = { authorization: `Bearer ${token}` };
+            const full = await fact_get(bare, cell_fact_path(private_cell, hash), owner.create_bearer_headers());
+            assert.strictEqual(full.status, 200, `full-scope bearer read failed: ${full.text}`);
+            const anon_private = await fact_get(bare, cell_fact_path(private_cell, hash), {});
+            const narrowed_private = await fact_get(bare, cell_fact_path(private_cell, hash), narrowed);
+            assert_masked_404(anon_private, 'anon read of a private fact');
+            assert_masked_404(narrowed_private, 'narrowed-token read of a private fact');
+            const narrowed_public = await fact_get(bare, cell_fact_path(public_cell, hash), narrowed);
+            assert.strictEqual(narrowed_public.status, 200, 'narrowed token refused a public cell');
+            assert.strictEqual(narrowed_public.text, 'narrowed-token-bytes');
+        });
         // The cell-scoped route is pure-public — no `acting?` slot — so the handler
         // can't disambiguate a multi-actor account and resolves it to a null
         // (anonymous) context. This pins that fallthrough: a multi-actor caller is
@@ -201,7 +274,7 @@ export const describe_fact_serving_cross_tests = (options) => {
             // Owns a PRIVATE cell, yet reading its own fact back resolves to a null
             // (anonymous) context → 404. The owner path never runs.
             const own_private = await fact_get(t, cell_fact_path(private_cell, hash), keeper);
-            assert.strictEqual(own_private.status, 404, "multi-actor owner's private read was admitted");
+            assert_masked_404(own_private, "multi-actor owner's private read");
             // A PUBLIC cell still admits the anonymous-treated caller → 200, proving
             // the 404 above is the multi-actor fallthrough, not a blanket block.
             const via_public = await fact_get(t, cell_fact_path(public_cell, hash), keeper);

package/dist/testing/cross_backend/identity_parity.d.ts

@@ -8,6 +8,17 @@ export interface IdentityParityCrossTestOptions {
     readonly login_path?: string;
     /** REST signup route path. Default `/api/account/signup` (the spine convention). */
     readonly signup_path?: string;
+    /**
+     * REST bootstrap route path. Default `/api/account/bootstrap` (the spine
+     * convention); `null` skips the bootstrap case, for a surface that mounts no
+     * bootstrap route.
+     */
+    readonly bootstrap_path?: string | null;
+    /**
+     * REST password-change route path, for the malformed-body case. Default
+     * `/api/account/password` (the spine convention); `null` skips that case.
+     */
+    readonly password_path?: string | null;
 }
 export declare const describe_identity_parity_cross_tests: (options: IdentityParityCrossTestOptions) => void;
 //# sourceMappingURL=identity_parity.d.ts.map

package/dist/testing/cross_backend/identity_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmG9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA6TF,CAAC"}
+{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoH9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IAieF,CAAC"}