@fuzdev/fuz_app 0.146.1 → 0.147.0

package/dist/testing/CLAUDE.md

@@ -154,7 +154,7 @@ Key module-scope values:
 
 - `stub_password_deps` — `PasswordHashDeps` hashing via `stub_hash_${password}` and verifying by equality. Deterministic, no Argon2 cost — use for every test not specifically exercising password hashing.
 - `create_loopback_app_server_options()` — the loopback `create_app_server` options an in-process test server takes (`localhost` origins, the loopback proxy trusted, an empty env schema), fresh per call; `create_test_app` and `create_test_app_for_bootstrap` spread it under their own defaults (`rate_limiters: 'disabled_for_testing'`, `await_pending_effects: true`).
-- `TEST_COOKIE_SECRET` — 64-hex-char deterministic cookie secret. Produces a valid `Keyring` via `create_validated_keyring`. Never used in production — the stub guard plus fixed value is the contract.
+- `TEST_COOKIE_SECRET` — 64-hex-char deterministic cookie secret. Produces a valid `Keyring` via `create_keyring`. Never used in production — the stub guard plus fixed value is the contract.
 - `fallback_db_factory` — module-level auth-only default factory (`create_default_db_factory`) `create_test_app_server` uses when no `db` is passed, reusing its driver's WASM cache. When `migration_namespaces` is supplied, a memoized sibling factory (keyed by namespace set) migrating `[auth_migration_ns, ...migration_namespaces]` is used instead — same shared WASM, extra tables.
 
 Two helpers share the "insert account + actor + roles + API token + session +
@@ -970,7 +970,9 @@ source of truth for wire-shape conformance.
   hardening headers and bodyless masked 404s); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
   the `_testing_put_fact` seeder (whose optional `holder` records a
-  `fact_holder` row, so a non-admin can reference what it seeds) — it also
+  `fact_holder` row, so a non-admin can reference what it seeds, and whose
+  optional `external_url` writes a bare external row naming that URL, so the
+  suite can pin that a URL naming another hash's file is refused) — it also
   gates `describe_cell_ref_admission_cross_tests`. `ready` gates `describe_ready_cross_tests`
   (anonymous `GET /ready` → `200 {ready: true}` on a clean spine bootstrap);
   like cells/sse the `/ready` deploy gate stays off the declared surface, `true`
@@ -1917,6 +1919,21 @@ spine bootstrap (auth + cell + fact) and is regenerated +
 drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 (`UPDATE_SCHEMA_READY=1`).
 
+### Session cookie codec parity — `cross_backend/session_cookie_codec.ts`
+
+`describe_session_cookie_codec_cross_tests({setup_test, cookie_name,
+cookie_keys, rpc_path?})` — both spines accept exactly one spelling of a signed
+session cookie. The suite holds the backend's `SECRET_FUZ_COOKIE_KEYS`
+(`cookie_keys`), signs `token:expires_at` itself, and probes `account_verify`
+with: a signature whose final character carries non-zero trailing bits (the
+same MAC under `atob`), an unpadded signature, and correctly signed
+`expires_at` values `+N`, ` N`, `N.0` and one past `u64::MAX` — each refused
+with `authentication_required`. Controls: re-signing the keeper cookie's
+payload reproduces it byte for byte and it authenticates, and a leading-zero
+`0N` authenticates (the `u64` bound is on the value, not the digit count).
+Ungated; cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/session_cookie_codec.cross.test.ts`.
+
 ### Testing-backdoor credential gate — `cross_backend/testing_backdoor.ts`
 
 `describe_testing_backdoor_cross_tests({setup_test, rpc_path?, ws?})` —

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA2CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAmHD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,2PAA2P;IAC3P,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAO,IAAI,CACzD,gBAAgB,EAChB,iBAAiB,GAAG,OAAO,GAAG,YAAY,CAKzC,CAAC;AAoCH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAqFpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,mHAAmH;IACnH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAqE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA2CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAmHD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,2PAA2P;IAC3P,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAO,IAAI,CACzD,gBAAgB,EAChB,iBAAiB,GAAG,OAAO,GAAG,YAAY,CAKzC,CAAC;AAoCH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAqFpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,mHAAmH;IACnH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAqE7B,CAAC"}

package/dist/testing/app_server.js

@@ -3,7 +3,7 @@ import { z } from 'zod';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
-import { create_validated_keyring } from '../auth/keyring.js';
+import { create_keyring } from '../auth/keyring.js';
 import { generate_api_token } from '../auth/api_token.js';
 import { query_create_account_with_actor } from '../auth/account_queries.js';
 import { query_create_role_grant } from '../auth/role_grant_queries.js';
@@ -182,7 +182,7 @@ const _build_test_backend = async (options) => {
         throw new Error('test app setup: pass either `db` (caller owns migrations) or `migration_namespaces` ' +
             '(harness migrates), not both');
     }
-    const keyring_result = create_validated_keyring(TEST_COOKIE_SECRET);
+    const keyring_result = create_keyring(TEST_COOKIE_SECRET);
     if (!keyring_result.ok) {
         throw new Error(`Test keyring failed: ${keyring_result.errors.join(', ')}`);
     }

package/dist/testing/cross_backend/bootstrap_backend.d.ts

@@ -25,6 +25,16 @@ import '../assert_dev_env.js';
  */
 import type { BackendConfig } from './backend_config.js';
 import type { BootstrappedBackendHandle } from './setup.js';
+/** Options for `bootstrap_backend`. */
+export interface BootstrapBackendOptions {
+    /**
+     * Runs after the binary is up and before the keeper bootstrap — the one
+     * window in a backend's life where `POST {bootstrap_path}` still answers on
+     * the token, so probes of the bootstrap route itself go here. A throw tears
+     * the backend down like a failed bootstrap.
+     */
+    readonly before_bootstrap?: (config: BackendConfig) => Promise<void>;
+}
 /**
  * Spawn the test binary described by `config`, bootstrap a keeper, and
  * return the enriched handle.
@@ -37,5 +47,5 @@ import type { BootstrappedBackendHandle } from './setup.js';
  * Mirrors the composition `default_cross_process_setup`'s caller would
  * otherwise hand-roll in every consumer's `globalSetup`.
  */
-export declare const bootstrap_backend: (config: BackendConfig) => Promise<BootstrappedBackendHandle>;
+export declare const bootstrap_backend: (config: BackendConfig, options?: BootstrapBackendOptions) => Promise<BootstrappedBackendHandle>;
 //# sourceMappingURL=bootstrap_backend.d.ts.map

package/dist/testing/cross_backend/bootstrap_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,KACnB,OAAO,CAAC,yBAAyB,CAwBnC,CAAC"}
+{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,uCAAuC;AACvC,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,EACrB,UAAU,uBAAuB,KAC/B,OAAO,CAAC,yBAAyB,CAyBnC,CAAC"}

package/dist/testing/cross_backend/bootstrap_backend.js

@@ -14,9 +14,10 @@ import { create_fetch_transport } from '../transports/fetch_transport.js';
  * Mirrors the composition `default_cross_process_setup`'s caller would
  * otherwise hand-roll in every consumer's `globalSetup`.
  */
-export const bootstrap_backend = async (config) => {
+export const bootstrap_backend = async (config, options) => {
     const handle = await spawn_backend(config);
     try {
+        await options?.before_bootstrap?.(config);
         const keeper_transport = create_fetch_transport({ base_url: config.base_url });
         const keeper = await bootstrap({ transport: keeper_transport, config });
         return {

package/dist/testing/cross_backend/fact_serving.d.ts

@@ -15,6 +15,11 @@ export interface CrossPutFactInput {
     readonly content_type?: string;
     /** The actor the put is on behalf of — recorded as a holder. Omit for a system put. */
     readonly holder?: string;
+    /**
+     * Store an external row naming this URL, verbatim and with no bytes, instead
+     * of an embedded one.
+     */
+    readonly external_url?: string;
 }
 /**
  * Seed an embedded fact over the daemon channel via `_testing_put_fact`;

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkRxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAsTxF,CAAC"}

package/dist/testing/cross_backend/fact_serving.js

@@ -21,6 +21,10 @@ import '../assert_dev_env.js';
  *   private, max-age=300`, whatever its content type;
  * - **bare-hash admin-only** — `GET /api/facts/:hash` is admin (keeper) only:
  *   non-admin → 403, anonymous → 401;
+ * - **URL bound to hash** — a row whose `external_url` is a well-formed
+ *   `file:` URL naming another hash's file is a masked 404 on both routes,
+ *   refused before any disk read (each spine's unit suite proves the bytes
+ *   behind such a URL never serve);
  * - **multi-actor fallthrough** — a multi-actor caller resolves to a null
  *   (anonymous) context on the (`acting`-less) cell-scoped route, so it can't
  *   read its own *private* fact there (admitted only by public cells). Opt-in
@@ -32,7 +36,8 @@ import '../assert_dev_env.js';
  *   exactly as for an anonymous caller, while a public cell still serves.
  *
  * Facts are seeded **embedded** via `_testing_put_fact` (the cross-process
- * driver has no DB handle); the referencing cell via the `cell_create` RPC
+ * driver has no DB handle), or as a bare external row through its
+ * `external_url`; the referencing cell via the `cell_create` RPC
  * (the hash, a whole string value in `data`, is derived into `cell.refs`). A
  * non-admin owner's cell may reference only a fact it holds, so a fact a
  * non-admin references is put with that owner as its `holder` (the keeper is
@@ -193,6 +198,25 @@ export const describe_fact_serving_cross_tests = (options) => {
             const edge_no_bytes = await fact_get(t, cell_fact_path(unrelated_cell, UNRELATED_HASH), admin_headers);
             assert_masked_404(edge_no_bytes, 'edge to an absent fact');
         });
+        test_if(capabilities.fact_serving, "an external_url naming another fact's file is a masked 404 on both routes", async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'fact_url_owner' });
+            // a row written past the store: well-formed `file:` URL, but the
+            // address of another hash, so serving it would hand out that fact's
+            // bytes under this one's name
+            const other = 'ab' + 'cd'.repeat(31);
+            const hash = await cross_put_fact(fixture, rpc_path, {
+                content: 'row-with-a-foreign-url',
+                content_type: 'text/plain',
+                holder: owner.actor.id,
+                external_url: `file:${other.slice(0, 2)}/${other.slice(2)}`
+            });
+            const t = fixture.fresh_transport();
+            const cell_id = await create_cell_with_ref(t, owner.create_session_headers(), hash, 'public');
+            const anon = fixture.fresh_transport({ origin: null });
+            assert_masked_404(await fact_get(anon, cell_fact_path(cell_id, hash), {}), 'foreign-url fact via a public cell');
+            assert_masked_404(await fact_get(t, `/api/facts/${hash}`, fixture.create_session_headers()), 'foreign-url fact by bare hash, as admin');
+        });
         test_if(capabilities.fact_serving, 'bare-hash route is admin-only', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'fact_non_admin' });

package/dist/testing/cross_backend/session_cookie_codec.d.ts

@@ -0,0 +1,19 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session cookie codec parity suite. */
+export interface SessionCookieCodecCrossTestOptions {
+    /** Per-test fixture producer (cross-process). */
+    readonly setup_test: SetupTest;
+    /** The spine's session cookie name (`handle.config.cookie_name`). */
+    readonly cookie_name: string;
+    /**
+     * The backend's `SECRET_FUZ_COOKIE_KEYS` value
+     * (`handle.config.env.SECRET_FUZ_COOKIE_KEYS`) — the suite signs with its
+     * primary key.
+     */
+    readonly cookie_keys: string;
+    /** JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
+    readonly rpc_path?: string;
+}
+export declare const describe_session_cookie_codec_cross_tests: (options: SessionCookieCodecCrossTestOptions) => void;
+//# sourceMappingURL=session_cookie_codec.d.ts.map

package/dist/testing/cross_backend/session_cookie_codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_cookie_codec.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cookie_codec.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAGzD,yDAAyD;AACzD,MAAM,WAAW,kCAAkC;IAClD,iDAAiD;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2BD,eAAO,MAAM,yCAAyC,GACrD,SAAS,kCAAkC,KACzC,IAsGF,CAAC"}

package/dist/testing/cross_backend/session_cookie_codec.js

@@ -0,0 +1,128 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **signed session cookie codec** over real
+ * HTTP: which spellings of a correctly signed cookie each spine accepts.
+ *
+ * The cookie is `${token}:${expires_at}.${signature}`, the signature the padded
+ * standard base64 of an HMAC-SHA256 MAC. Both spines must accept exactly one
+ * spelling of a given signed payload, or a cookie that one spine refuses would
+ * authenticate on the other. The suite holds the test keyring, so it signs
+ * payloads itself and sends variants a lenient decoder would take:
+ *
+ * - **signature spelling** — the last data character bumped so the trailing
+ *   bits are non-zero (`atob` decodes the same MAC), and the `=` padding
+ *   dropped. Both must be refused.
+ * - **`expires_at` spelling** — `+N`, ` N`, `N.0`, and an all-digit value past
+ *   `u64::MAX` (the Rust spine parses it as `u64`), each signed with the real
+ *   key. All must be refused. A leading-zero `0N` reads as `N` on both, so it
+ *   still authenticates — the bound is on the value, not the digit count.
+ *
+ * The positive controls run first: re-signing the keeper cookie's payload
+ * reproduces the cookie byte for byte (the suite's keyring is the backend's),
+ * and that cookie authenticates. Authentication is probed with the
+ * `account_verify` RPC action. The per-impl unit tests cover each codec
+ * directly; this suite is what catches the two drifting apart.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { create_keyring } from '../../auth/keyring.js';
+import { ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
+import { cross_rpc_call, error_reason } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** The base64 alphabet, in index order. */
+const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+/** `u64::MAX + 1`, the smallest all-digit `expires_at` the Rust spine cannot parse. */
+const U64_MAX_PLUS_ONE = '18446744073709551616';
+/** Split a signed cookie value on its last `.` into payload and signature. */
+const split_signed = (signed) => {
+    const dot = signed.lastIndexOf('.');
+    assert.ok(dot !== -1, `signed cookie value has no '.' separator: ${signed}`);
+    return { payload: signed.slice(0, dot), signature: signed.slice(dot + 1) };
+};
+/**
+ * Bump the signature's last data character (index 42, which carries the MAC's
+ * final 4 bits and 2 zero padding bits) to the next base64 character. That sets
+ * a padding bit, which `atob` ignores, so the decoded MAC is unchanged.
+ */
+const bump_trailing_bits = (signature) => {
+    const last_data = signature[42];
+    const index = BASE64_ALPHABET.indexOf(last_data);
+    assert.ok(index !== -1 && index % 4 === 0, `unexpected final signature character: ${last_data}`);
+    return signature.slice(0, 42) + BASE64_ALPHABET[index + 1] + signature.slice(43);
+};
+export const describe_session_cookie_codec_cross_tests = (options) => {
+    const { setup_test, cookie_name, cookie_keys } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const keyring_result = create_keyring(cookie_keys);
+    if (!keyring_result.ok) {
+        throw new Error(`cookie_keys is not a valid keyring: ${keyring_result.errors.join('; ')}`);
+    }
+    const keyring = keyring_result.keyring;
+    /** The keeper's signed cookie value, with its verified `token` and `expires_at`. */
+    const keeper_cookie = async (fixture) => {
+        const header = fixture.create_session_headers().cookie;
+        assert.ok(header, 'the keeper session headers carry a cookie');
+        const prefix = `${cookie_name}=`;
+        assert.ok(header.startsWith(prefix), `the keeper cookie is named '${cookie_name}'`);
+        const signed = header.slice(prefix.length);
+        const verified = await keyring.verify(signed);
+        assert.ok(verified, 'the keeper cookie verifies under cookie_keys');
+        const sep = verified.value.lastIndexOf(':');
+        assert.ok(sep !== -1, 'the keeper cookie payload is `token:expires_at`');
+        return {
+            signed,
+            token: verified.value.slice(0, sep),
+            expires_at: verified.value.slice(sep + 1)
+        };
+    };
+    const verify_with = (fixture, signed) => cross_rpc_call(fixture.fresh_transport(), rpc_path, 'account_verify', undefined, {
+        cookie: `${cookie_name}=${signed}`
+    });
+    const assert_unauthenticated = async (fixture, signed, label) => {
+        const result = await verify_with(fixture, signed);
+        assert.strictEqual(result.ok, false, `${label}: must not authenticate`);
+        assert.strictEqual(error_reason(result), ERROR_AUTHENTICATION_REQUIRED, label);
+    };
+    describe('session cookie codec parity', () => {
+        test('controls: re-signing the keeper payload reproduces its cookie, which authenticates', async () => {
+            const fixture = await setup_test();
+            const { signed, token, expires_at } = await keeper_cookie(fixture);
+            assert.strictEqual(await keyring.sign(`${token}:${expires_at}`), signed, 'the suite keyring signs as the backend does');
+            const result = await verify_with(fixture, signed);
+            assert.ok(result.ok, `the keeper cookie authenticates: ${JSON.stringify(result.error)}`);
+        });
+        test('a signature with non-zero trailing bits is refused', async () => {
+            const fixture = await setup_test();
+            const { payload, signature } = split_signed((await keeper_cookie(fixture)).signed);
+            await assert_unauthenticated(fixture, `${payload}.${bump_trailing_bits(signature)}`, 'non-zero trailing bits');
+        });
+        test('an unpadded signature is refused', async () => {
+            const fixture = await setup_test();
+            const { payload, signature } = split_signed((await keeper_cookie(fixture)).signed);
+            assert.ok(signature.endsWith('='), 'the canonical signature is padded');
+            await assert_unauthenticated(fixture, `${payload}.${signature.slice(0, -1)}`, 'unpadded');
+        });
+        test('a non-canonical expires_at is refused even when signed', async () => {
+            const fixture = await setup_test();
+            const { token, expires_at } = await keeper_cookie(fixture);
+            const variants = [
+                ['plus sign', `+${expires_at}`],
+                ['leading space', ` ${expires_at}`],
+                ['decimal', `${expires_at}.0`],
+                ['past u64::MAX', U64_MAX_PLUS_ONE]
+            ];
+            for (const [label, value] of variants) {
+                const signed = await keyring.sign(`${token}:${value}`);
+                await assert_unauthenticated(fixture, signed, `expires_at ${label} (${JSON.stringify(value)})`);
+            }
+        });
+        test('a leading-zero expires_at reads as its value and authenticates', async () => {
+            const fixture = await setup_test();
+            const { token, expires_at } = await keeper_cookie(fixture);
+            const signed = await keyring.sign(`${token}:0${expires_at}`);
+            const result = await verify_with(fixture, signed);
+            assert.ok(result.ok, `a leading zero authenticates: ${JSON.stringify(result.error)}`);
+        });
+    });
+};

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -265,9 +265,12 @@ export declare const create_testing_drain_effects_action: (audit: AuditEmitter)
  * the put is on behalf of — recorded in `fact_holder` (deduplicated puts
  * included), as a real upload records its uploader, so the suites can drive
  * cell ref admission; absent, the put is a system put with no holder. The
- * referencing cell is seeded separately via the `cell_create` RPC. Embedded-only is enough for the
- * authz assertions (cell-scoped admit, cross-owner-no-leak, 404-mask, bare-hash
- * admin-only); external / X-Accel parity stays covered by the forge's own gate.
+ * referencing cell is seeded separately via the `cell_create` RPC. Embedded is
+ * enough for the authz assertions (cell-scoped admit, cross-owner-no-leak,
+ * 404-mask, bare-hash admin-only); external / X-Accel parity stays covered by
+ * the forge's own gate. `external_url`, when given, writes the row the way a
+ * writer past the store could — no bytes, that URL verbatim, unvalidated — so
+ * the suite can prove a serve refuses a URL that is not its hash's own address.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset` — the
  * action does a direct `fact` insert the production wire never exposes. The
@@ -287,6 +290,7 @@ export declare const testing_put_fact_action_spec: {
         content: z.ZodString;
         content_type: z.ZodOptional<z.ZodString>;
         holder: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        external_url: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     readonly output: z.ZodObject<{
         hash: z.ZodString & z.ZodType<import("@fuzdev/fuz_util/hash_schemas.js").FactHash, string, z.core.$ZodTypeInternals<import("@fuzdev/fuz_util/hash_schemas.js").FactHash, string>>;

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;CAgBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAkJjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAkJjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -267,9 +267,12 @@ export const create_testing_drain_effects_action = (audit) => rpc_action(testing
  * the put is on behalf of — recorded in `fact_holder` (deduplicated puts
  * included), as a real upload records its uploader, so the suites can drive
  * cell ref admission; absent, the put is a system put with no holder. The
- * referencing cell is seeded separately via the `cell_create` RPC. Embedded-only is enough for the
- * authz assertions (cell-scoped admit, cross-owner-no-leak, 404-mask, bare-hash
- * admin-only); external / X-Accel parity stays covered by the forge's own gate.
+ * referencing cell is seeded separately via the `cell_create` RPC. Embedded is
+ * enough for the authz assertions (cell-scoped admit, cross-owner-no-leak,
+ * 404-mask, bare-hash admin-only); external / X-Accel parity stays covered by
+ * the forge's own gate. `external_url`, when given, writes the row the way a
+ * writer past the store could — no bytes, that URL verbatim, unvalidated — so
+ * the suite can prove a serve refuses a URL that is not its hash's own address.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset` — the
  * action does a direct `fact` insert the production wire never exposes. The
@@ -284,12 +287,14 @@ export const testing_put_fact_action_spec = {
     input: z.strictObject({
         content: z.string(),
         content_type: z.string().optional(),
-        holder: Uuid.optional()
+        holder: Uuid.optional(),
+        external_url: z.string().optional()
     }),
     output: z.strictObject({ hash: FactHashSchema }),
     async: true,
-    description: 'Test-binary only — seed an embedded fact (blake3 of the UTF-8 content) and return its hash, ' +
-        'so the cross-process fact-serving suite can store bytes without a DB handle.'
+    description: 'Test-binary only — seed a fact row for the blake3 of the UTF-8 content (embedded, or with ' +
+        'external_url an external row naming that URL) and return its hash, so the cross-process ' +
+        'fact-serving suite can store facts without a DB handle.'
 };
 /** The wire method of each notification `_testing_flood_notifications` queues. */
 export const TESTING_FLOOD_NOTIFICATION_METHOD = '_testing_flood';
@@ -719,8 +724,8 @@ export const create_testing_actions = (deps, options) => {
             const hash = fact_hash_bytes(bytes);
             await query_put_fact({ db: ctx.db }, {
                 hash,
-                bytes,
-                external_url: null,
+                bytes: input.external_url === undefined ? bytes : null,
+                external_url: input.external_url ?? null,
                 content_type: input.content_type ?? null,
                 size: bytes.length
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.146.1",
+  "version": "0.147.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -35,7 +35,7 @@
     "@fuzdev/blake3-wasm": ">=0.2.0",
     "@fuzdev/fuz_css": ">=0.70.0",
     "@fuzdev/fuz_schema": "^0.5.0",
-    "@fuzdev/fuz_util": ">=0.77.0",
+    "@fuzdev/fuz_util": ">=0.78.0",
     "@fuzdev/pglet-wasm": ">=0.1.2",
     "@hono/bun": ">=1",
     "@hono/deno": ">=1",
@@ -92,10 +92,10 @@
     "@electric-sql/pglite": "^0.5.8",
     "@fuzdev/blake3-wasm": "^0.2.0",
     "@fuzdev/fuz_code": "^0.54.0",
-    "@fuzdev/fuz_css": "^0.70.0",
+    "@fuzdev/fuz_css": "^0.71.0",
     "@fuzdev/fuz_schema": "^0.5.0",
-    "@fuzdev/fuz_ui": "^0.217.0",
-    "@fuzdev/fuz_util": "^0.77.0",
+    "@fuzdev/fuz_ui": "^0.220.0",
+    "@fuzdev/fuz_util": "^0.78.0",
     "@fuzdev/gro": "^0.220.0",
     "@fuzdev/mdz": "^0.6.0",
     "@fuzdev/pglet-wasm": "^0.1.2",
@@ -123,7 +123,7 @@
     "pg": "^8.20.0",
     "svelte": "^5.57.2",
     "svelte-check": "^4.7.6",
-    "svelte-docinfo": "^0.13.0",
+    "svelte-docinfo": "^0.16.0",
     "svelte2tsx": "^0.7.52",
     "tslib": "^2.8.1",
     "typescript": "^6.0.3",