@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/conformance_table.js

@@ -14,7 +14,7 @@ import '../assert_dev_env.js';
  * `output` schema from the live spec registry (RPC) or `RouteSpec` (the 6
  * REST auth routes) — the row never carries a schema. The principal the
  * row runs `as` resolves to a `TestFixture` accessor via
- * `resolve_principal` — no inline credential minting.
+ * `resolve_conformance_principal` — no inline credential minting.
  *
  * Every response also passes an always-on **no-fingerprint** invariant
  * (`assert_no_fingerprint_headers` over `FINGERPRINT_HEADERS` — `Server` /
@@ -22,16 +22,78 @@ import '../assert_dev_env.js';
  * a row may pin further header expectations via `expect.headers`. Headers are
  * deliberately kept out of the equivalence-group `{status, body}` comparison.
  *
+ * Given `ws`, the runner sends each case as a frame on a WebSocket instead:
+ * the principal opens an admitted socket and the frame meets the per-message
+ * gates. The frame carries the same JSON-RPC envelope the HTTP body does, so
+ * the same rows hold, read through the status the HTTP binding maps the
+ * frame's error code to; the cases a socket can't carry are left out
+ * (`is_ws_conformance_case`).
+ *
+ * A case binding `request.acting` gets `params.acting` filled with a real
+ * actor id at run time (`ConformanceActingBinding`), so rows can act as a
+ * named actor of a multi-actor keeper without knowing its id.
+ *
+ * A case's RPC method resolves from the declared `rpc_endpoints` first, then
+ * from `live_rpc_endpoints` when given — the methods a backend live-mounts
+ * off the declared surface (cell verbs, opt-in resolvers, `_testing_*`
+ * backdoors), so rows can reach them too.
+ *
  * @module
  */
 import { assert, describe, test } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { find_auth_route, rest_auth_route_suffixes } from '../integration_helpers.js';
-import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
+import { find_rpc_action, headers_to_record, parse_rpc_call_result, rpc_call_raw, resolve_rpc_endpoints_for_setup } from '../rpc_helpers.js';
 import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
+import { jsonrpc_error_code_to_http_status } from '../../http/jsonrpc_errors.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { is_response_for } from '../transports/ws_client.js';
 import { SCOPED_TOKEN_ADMITTED_METHOD } from './conformance_case.js';
 import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { xfail_until } from './xfail.js';
+/**
+ * Resolve the endpoints a conformance case's RPC method is looked up in: the
+ * declared `rpc_endpoints`, then `live_rpc_endpoints`. `find_rpc_action`
+ * takes the first match, so a declared method resolves from the declared
+ * surface even when the live mount repeats it.
+ *
+ * @param options - the declared and live endpoints, and the session options
+ * @returns the endpoints in lookup order
+ */
+export const resolve_conformance_rpc_endpoints = (options) => [
+    ...resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options),
+    ...(options.live_rpc_endpoints
+        ? resolve_rpc_endpoints_for_setup(options.live_rpc_endpoints, options.session_options)
+        : [])
+];
+/**
+ * Principals that cannot hold a socket: each presents no usable credential
+ * (`anonymous`, the browser-discarded and malformed bearers, the expired
+ * session) or one the upgrade refuses (`scoped_token` — a narrowed token is
+ * refused `surface:ws_upgrade`), so the upgrade answers before any frame.
+ * The front-door table (`describe_transport_composition_cross_tests`) pins
+ * those upgrade refusals.
+ */
+const WS_UNAVAILABLE_PRINCIPALS = new Set([
+    'anonymous',
+    'bearer_browser',
+    'malformed_bearer',
+    'expired_session',
+    'scoped_token'
+]);
+/**
+ * Whether a case can run over a WebSocket: an RPC method (not a REST auth
+ * route), sent as `POST` (a `GET` row pins the HTTP query path), pinning no
+ * header value (a frame has no headers; an absence pin holds vacuously), as
+ * a principal that can hold a socket.
+ *
+ * @param c - the case
+ * @returns whether the WS leg runs it
+ */
+export const is_ws_conformance_case = (c) => !c.request.method.startsWith('/') &&
+    (c.request.verb ?? 'POST') === 'POST' &&
+    !Object.values(c.expect.headers ?? {}).some((value) => value !== null) &&
+    !WS_UNAVAILABLE_PRINCIPALS.has(c.request.as);
 /**
  * A deliberately malformed `X-Daemon-Token` value for the `invalid_daemon`
  * principal. Fails the `DaemonToken` Zod schema (not 43 base64url chars), so
@@ -78,20 +140,33 @@ const mint_scoped_token = async (fixture, resolved_rpc_endpoints) => {
  * `role_holder` / `wrong_role` read a seeded `extra_accounts` entry named
  * via `options.principals` (throws a clear setup error when unconfigured);
  * `scoped_token` mints its narrowed credential over the production path.
+ * Also used outside the table by suites that send a principal's requests
+ * themselves (`describe_rpc_adversarial_cross_tests`).
+ *
+ * @param fixture - the per-test fixture
+ * @param as - the principal
+ * @param principals - usernames for `role_holder` / `wrong_role`
+ * @param resolved_rpc_endpoints - the endpoints `scoped_token` mints through
+ * @returns the transport and headers the principal sends with
  */
-const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints) => {
+export const resolve_conformance_principal = async (fixture, as, principals, resolved_rpc_endpoints = []) => {
     switch (as) {
         case 'keeper':
             // Keeper carries its session cookie via `create_session_headers`
             // (in-process the transport is stateless; cross-process the jar
             // also holds it — the explicit header is the same value).
-            return { transport: fixture.transport, headers: fixture.create_session_headers() };
+            return {
+                transport: fixture.transport,
+                headers: fixture.create_session_headers(),
+                actor_id: fixture.actor.id
+            };
         case 'daemon':
             // Daemon-token is a non-browser credential — empty jar + no Origin.
             return {
                 transport: fixture.fresh_transport({ origin: null }),
                 headers: fixture.create_daemon_token_headers(),
-                suppress_default_origin: true
+                suppress_default_origin: true,
+                actor_id: fixture.actor.id
             };
         case 'invalid_daemon':
             // A malformed `X-Daemon-Token` carried ALONGSIDE the keeper's session
@@ -109,7 +184,8 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
                 headers: fixture.create_session_headers({
                     [DAEMON_TOKEN_HEADER]: INVALID_DAEMON_TOKEN_VALUE
                 }),
-                suppress_default_origin: true
+                suppress_default_origin: true,
+                actor_id: fixture.actor.id
             };
         case 'daemon_browser':
             // A VALID `X-Daemon-Token` carried in a browser context (default Origin
@@ -124,14 +200,16 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
             // guard), the 403 here proves the valid token was discarded, not honored.
             return {
                 transport: fixture.transport,
-                headers: fixture.create_session_headers(fixture.create_daemon_token_headers())
+                headers: fixture.create_session_headers(fixture.create_daemon_token_headers()),
+                actor_id: fixture.actor.id
             };
         case 'token':
             // Bearer is discarded in a browser context — empty jar + no Origin.
             return {
                 transport: fixture.fresh_transport({ origin: null }),
                 headers: fixture.create_bearer_headers(),
-                suppress_default_origin: true
+                suppress_default_origin: true,
+                actor_id: fixture.actor.id
             };
         case 'bearer_browser':
             // A VALID bearer api-token in a browser context (default Origin
@@ -168,7 +246,8 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
             return {
                 transport: fixture.fresh_transport({ origin: null }),
                 headers: { authorization: `Bearer ${token}` },
-                suppress_default_origin: true
+                suppress_default_origin: true,
+                actor_id: fixture.actor.id
             };
         }
         case 'anonymous':
@@ -176,7 +255,11 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
             return { transport: fixture.fresh_transport(), headers: {} };
         case 'fresh_non_admin': {
             const account = await fixture.create_account();
-            return { transport: fixture.fresh_transport(), headers: account.create_session_headers() };
+            return {
+                transport: fixture.fresh_transport(),
+                headers: account.create_session_headers(),
+                actor_id: account.actor.id
+            };
         }
         case 'expired_session': {
             // The keeper presented via an expired server-side session — fresh
@@ -184,7 +267,11 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
             // minted cookie payload is valid; the backdated `auth_session` row
             // is what the DB-row expiry gate refuses.
             const cookie = await fixture.mint_expired_session();
-            return { transport: fixture.fresh_transport(), headers: { cookie } };
+            return {
+                transport: fixture.fresh_transport(),
+                headers: { cookie },
+                actor_id: fixture.actor.id
+            };
         }
         case 'role_holder':
         case 'wrong_role': {
@@ -198,7 +285,11 @@ const resolve_principal = async (fixture, as, principals, resolved_rpc_endpoints
                 throw new Error(`conformance: extra_accounts['${username}'] not seeded for principal '${as}' — ` +
                     `declare it in the suite's extra_accounts option.`);
             }
-            return { transport: fixture.fresh_transport(), headers: extra.create_session_headers() };
+            return {
+                transport: fixture.fresh_transport(),
+                headers: extra.create_session_headers(),
+                actor_id: extra.actor.id
+            };
         }
     }
 };
@@ -286,45 +377,198 @@ const assert_response_headers = (headers, c) => {
 };
 const is_success_status = (status) => status >= 200 && status < 300;
 /**
- * Run one conformance case end-to-end: resolve the principal, dispatch the
- * request, and assert the expected status / reason / fields. Returns the
- * normalized response so the caller can feed an equivalence group.
+ * Resolve a case's principal on `fixture` and send its request, asserting
+ * nothing about the response.
+ *
+ * The send half of the table runner, shared with the cross-backend
+ * differential (`describe_differential_conformance_tests`), which sends one
+ * case to two backends and compares what came back.
+ *
+ * @param c - the case
+ * @param options - the fixture, surface and endpoints to send through
+ * @returns the resolved target and the raw response
+ * @throws Error when the method is on neither the RPC surface nor the REST
+ *   auth routes
  */
-const run_case = async (c, options, resolved_rpc_endpoints) => {
-    const fixture = await options.setup_test();
-    const { transport, headers, suppress_default_origin } = await resolve_principal(fixture, c.request.as, options.principals, resolved_rpc_endpoints);
-    const normalized = c.request.method.startsWith('/')
-        ? await run_rest_case(c, options, transport, headers)
-        : await run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
-    // Negative-space field check, uniform across REST + RPC and success + error
-    // bodies: a sensitive column (`password_hash`, `token_hash`) must not appear
-    // anywhere in what the prober sees.
-    if (c.expect.absent_fields) {
-        assert_absent_fields(normalized.body, c.expect.absent_fields, c.name);
+export const send_conformance_case = async (c, options) => {
+    const { fixture, surface_source, principals, resolved_rpc_endpoints, ws } = options;
+    if (ws && !is_ws_conformance_case(c)) {
+        throw new Error(`conformance: case '${c.name}' cannot run over a WebSocket (is_ws_conformance_case) — ` +
+            `filter the cases before sending them on the WS leg.`);
+    }
+    const principal = await resolve_conformance_principal(fixture, c.request.as, principals, resolved_rpc_endpoints);
+    const { transport, headers, suppress_default_origin } = principal;
+    const params = c.request.acting
+        ? bind_acting(c, resolve_acting_binding(c, c.request.acting, fixture, principal))
+        : c.request.params;
+    if (c.request.method.startsWith('/')) {
+        const suffix = c.request.method;
+        if (!rest_auth_route_suffixes.includes(suffix)) {
+            throw new Error(`conformance: REST method '${c.request.method}' is not a known auth-route suffix ` +
+                `(${rest_auth_route_suffixes.join(', ')}). Use an RPC method name for RPC actions.`);
+        }
+        const verb = c.request.verb ?? 'POST';
+        const route = find_auth_route(surface_source.route_specs, suffix, verb);
+        if (!route) {
+            throw new Error(`conformance: no REST route spec for ${verb} ${suffix} on the surface.`);
+        }
+        const init = {
+            method: verb,
+            headers: { 'Content-Type': 'application/json', ...headers },
+            ...(verb !== 'GET' && params !== undefined && { body: JSON.stringify(params) })
+        };
+        const response = await transport(route.path, init);
+        const body = await response.json().catch(() => undefined);
+        return {
+            target: { kind: 'rest', route },
+            status: response.status,
+            headers: headers_to_record(response.headers),
+            body
+        };
     }
-    return normalized;
-};
-/** Dispatch + assert a case targeting an RPC method. */
-const run_rpc_case = async (c, transport, headers, suppress_default_origin, resolved_rpc_endpoints) => {
     const found = find_rpc_action(resolved_rpc_endpoints, c.request.method);
     if (!found) {
         throw new Error(`conformance: RPC method '${c.request.method}' not found on the surface — ` +
-            `check the method name or that the action is registered on rpc_endpoints.`);
+            `check the method name or that the action is registered on rpc_endpoints ` +
+            `(or, for a method off the declared surface, on live_rpc_endpoints).`);
+    }
+    if (ws) {
+        return {
+            target: { kind: 'rpc', ...found },
+            ...(await send_ws_frame(c.request.method, params, principal, ws))
+        };
     }
-    const res = await rpc_call({
+    const raw = await rpc_call_raw({
         app: transport,
         path: found.path,
         method: c.request.method,
-        params: c.request.params,
+        params,
         headers,
         ...(c.request.verb && { verb: c.request.verb }),
         ...(suppress_default_origin && { suppress_default_origin: true })
     });
-    assert_response_headers(res.headers, c);
+    return { target: { kind: 'rpc', ...found }, ...raw };
+};
+/**
+ * The request id the WS leg sends under — the id the HTTP leg's
+ * `rpc_call_raw` sends by default, so the two envelopes read alike.
+ */
+const CONFORMANCE_REQUEST_ID = 'test';
+/**
+ * Open an admitted socket as the principal, send one request frame, and read
+ * its response frame — the WS leg of `send_conformance_case`.
+ *
+ * The upgrade carries the principal's headers (its cookie, bearer or daemon
+ * token) and the `Origin` the HTTP leg would send: none for a principal that
+ * suppresses it, the target's otherwise. It also names the principal's own
+ * actor as `?acting=`. Only the TS spine resolves an actor at the upgrade,
+ * refusing a multi-actor account's upgrade without one (400
+ * `actor_required`); the Rust spine's upgrade resolves the account and
+ * ignores `?acting=`. Per-frame dispatch resolves the actor from each frame's
+ * own `acting` on both. Because the leg always sends `?acting=`, it does not
+ * cover that upgrade-level difference — the front-door table's multi-actor
+ * row does. The socket closes afterwards; a
+ * close error is not the case's subject (a request that revokes its own
+ * credential closes the socket after its reply).
+ */
+const send_ws_frame = async (method, params, principal, ws) => {
+    const client = await create_admitted_ws_transport({
+        base_url: ws.base_url,
+        ws_path: principal.actor_id === undefined
+            ? ws.ws_path
+            : `${ws.ws_path}?acting=${encodeURIComponent(principal.actor_id)}`,
+        cookies: [],
+        headers: principal.headers,
+        origin: principal.suppress_default_origin ? null : (ws.origin ?? ws.base_url)
+    });
+    try {
+        const frame = { jsonrpc: '2.0', id: CONFORMANCE_REQUEST_ID, method };
+        if (params !== undefined && params !== null)
+            frame.params = params;
+        await client.send(frame);
+        const body = await client.wait_for(is_response_for(CONFORMANCE_REQUEST_ID));
+        const code = body.error?.code;
+        const status = body.error === undefined
+            ? 200
+            : typeof code === 'number'
+                ? jsonrpc_error_code_to_http_status(code)
+                : 500;
+        return { status, headers: {}, body };
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+};
+/**
+ * The actor id a case's `acting` binding names on this fixture.
+ *
+ * @throws Error when the binding names an actor the fixture or principal lacks
+ */
+const resolve_acting_binding = (c, binding, fixture, principal) => {
+    switch (binding) {
+        case 'principal':
+            if (principal.actor_id === undefined) {
+                throw new Error(`conformance: case '${c.name}' binds acting to its principal, but '${c.request.as}' ` +
+                    `presents no account to take an actor from.`);
+            }
+            return principal.actor_id;
+        case 'extra_actor': {
+            const extra = fixture.extra_actors[0];
+            if (!extra) {
+                throw new Error(`conformance: case '${c.name}' binds acting to the keeper's extra actor, but the ` +
+                    `fixture seeds none — declare extra_actors at setup.`);
+            }
+            return extra.id;
+        }
+        case 'keeper_actor':
+            return fixture.actor.id;
+    }
+};
+/** A case's params with `acting` set to `actor_id`. */
+const bind_acting = (c, actor_id) => {
+    const { params } = c.request;
+    if (params === undefined)
+        return { acting: actor_id };
+    if (params === null || typeof params !== 'object' || Array.isArray(params)) {
+        throw new Error(`conformance: case '${c.name}' binds acting, so its params must be an object or omitted.`);
+    }
+    if ('acting' in params) {
+        throw new Error(`conformance: case '${c.name}' binds acting and also sets params.acting — pick one.`);
+    }
+    return { ...params, acting: actor_id };
+};
+/**
+ * Run one conformance case end-to-end: resolve the principal, dispatch the
+ * request, and assert the expected status / reason / fields. Returns the
+ * normalized response so the caller can feed an equivalence group.
+ */
+const run_case = async (c, options, resolved_rpc_endpoints) => {
+    const sent = await send_conformance_case(c, {
+        fixture: await options.setup_test(),
+        surface_source: options.surface_source,
+        ...(options.principals && { principals: options.principals }),
+        resolved_rpc_endpoints,
+        ...(options.ws && { ws: options.ws })
+    });
+    assert_response_headers(sent.headers, c);
+    const normalized = sent.target.kind === 'rest'
+        ? assert_rest_case(c, sent.target.route, sent)
+        : assert_rpc_case(c, sent.target.action, sent);
+    // Negative-space field check, uniform across REST + RPC and success + error
+    // bodies: a sensitive column (`password_hash`, `token_hash`) must not appear
+    // anywhere in what the prober sees.
+    if (c.expect.absent_fields) {
+        assert_absent_fields(normalized.body, c.expect.absent_fields, c.name);
+    }
+    return normalized;
+};
+/** Assert a case targeting an RPC method. */
+const assert_rpc_case = (c, action, sent) => {
+    const res = parse_rpc_call_result(sent, c.request.method);
     if (is_success_status(c.expect.status)) {
         assert.ok(res.ok, `${c.name}: expected success (${c.expect.status}) but got error ${JSON.stringify(res.ok ? undefined : res.error)}`);
         assert.strictEqual(res.status, c.expect.status, `${c.name}: status`);
-        const parsed = found.action.spec.output.safeParse(res.result);
+        const parsed = action.spec.output.safeParse(res.result);
         assert.ok(parsed.success, `${c.name}: result does not match spec.output: ${JSON.stringify(parsed.success ? undefined : parsed.error.issues)}`);
         if (c.expect.fields)
             assert_fields(res.result, c.expect.fields, c.name);
@@ -347,28 +591,10 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
         assert_fields(res.error.data, c.expect.fields, c.name);
     return { status: res.status, body: res.error };
 };
-/** Dispatch + assert a case targeting one of the 6 REST auth routes. */
-const run_rest_case = async (c, options, transport, headers) => {
-    const suffix = c.request.method;
-    if (!rest_auth_route_suffixes.includes(suffix)) {
-        throw new Error(`conformance: REST method '${c.request.method}' is not a known auth-route suffix ` +
-            `(${rest_auth_route_suffixes.join(', ')}). Use an RPC method name for RPC actions.`);
-    }
-    const verb = c.request.verb ?? 'POST';
-    const route = find_auth_route(options.surface_source.route_specs, suffix, verb);
-    if (!route) {
-        throw new Error(`conformance: no REST route spec for ${verb} ${suffix} on the surface.`);
-    }
-    const init = {
-        method: verb,
-        headers: { 'Content-Type': 'application/json', ...headers },
-        ...(verb !== 'GET' &&
-            c.request.params !== undefined && { body: JSON.stringify(c.request.params) })
-    };
-    const response = await transport(route.path, init);
-    assert_response_headers(headers_to_record(response.headers), c);
-    assert.strictEqual(response.status, c.expect.status, `${c.name}: status`);
-    const body = await response.json().catch(() => undefined);
+/** Assert a case targeting one of the 6 REST auth routes. */
+const assert_rest_case = (c, route, sent) => {
+    const { status, body } = sent;
+    assert.strictEqual(status, c.expect.status, `${c.name}: status`);
     if (is_success_status(c.expect.status)) {
         const parsed = route.output.safeParse(body);
         assert.ok(parsed.success, `${c.name}: body does not match route output: ${JSON.stringify(parsed.success ? undefined : parsed.error.issues)}`);
@@ -379,7 +605,7 @@ const run_rest_case = async (c, options, transport, headers) => {
     }
     if (c.expect.fields)
         assert_fields(body, c.expect.fields, c.name);
-    return { status: response.status, body };
+    return { status, body };
 };
 /**
  * Register a `describe` block running every `ConformanceCase` as a
@@ -388,24 +614,30 @@ const run_rest_case = async (c, options, transport, headers) => {
  * capabilities}` protocol.
  */
 export const describe_conformance_table_tests = (options) => {
-    const resolved_rpc_endpoints = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
+    const resolved_rpc_endpoints = resolve_conformance_rpc_endpoints(options);
     // Per-group normalized responses, populated as the member case tests run
     // and consulted by the per-group byte-identity assertions registered after
     // the case loop — vitest runs a describe's tests in registration order, so
     // the group assertions execute last, after every member has recorded.
     const equivalence_groups = new Map();
-    const group_names = new Set();
-    for (const c of options.cases) {
-        if (c.expect.equivalence_group)
-            group_names.add(c.expect.equivalence_group);
+    const cases = options.ws ? options.cases.filter(is_ws_conformance_case) : options.cases;
+    const group_sizes = new Map();
+    for (const c of cases) {
+        const group = c.expect.equivalence_group;
+        if (group)
+            group_sizes.set(group, (group_sizes.get(group) ?? 0) + 1);
     }
+    // a group the WS filter left a single member of has nothing to compare;
+    // on HTTP every group runs, so an undersized one still fails loud
+    const group_names = new Set([...group_sizes].filter(([, size]) => !options.ws || size >= 2).map(([group]) => group));
     describe(options.suite_name ?? 'conformance table', () => {
-        for (const c of options.cases) {
+        for (const c of cases) {
             const label = c.note ? `${c.name} — ${c.note}` : c.name;
             const group = c.expect.equivalence_group;
+            const recorded = group !== undefined && group_names.has(group);
             const body = async () => {
                 const normalized = await run_case(c, options, resolved_rpc_endpoints);
-                if (group) {
+                if (recorded && group) {
                     const members = equivalence_groups.get(group) ?? [];
                     members.push({ name: c.name, normalized });
                     equivalence_groups.set(group, members);

package/dist/testing/cross_backend/cookie_attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie_attributes.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cookie_attributes.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,6DAA6D;AAC7D,MAAM,WAAW,gCAAgC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoED,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAmFF,CAAC"}
+{"version":3,"file":"cookie_attributes.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cookie_attributes.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,6DAA6D;AAC7D,MAAM,WAAW,gCAAgC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoED,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAmFF,CAAC"}

package/dist/testing/cross_backend/cookie_attributes.js

@@ -39,6 +39,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { SPINE_ACCOUNT_LOGIN_PATH, SPINE_ACCOUNT_LOGOUT_PATH } from './spine_surface_constants.js';
 /**
  * Parse a single `Set-Cookie` header value into `{name, value, attributes}`.
  * Returns `null` for a malformed head (no `=`, empty name). Unlike the
@@ -93,8 +94,8 @@ const assert_hardened_flags = (cookie, label) => {
 };
 export const describe_cookie_attributes_cross_tests = (options) => {
     const { setup_test, cookie_name } = options;
-    const login_path = options.login_path ?? '/api/account/login';
-    const logout_path = options.logout_path ?? '/api/account/logout';
+    const login_path = options.login_path ?? SPINE_ACCOUNT_LOGIN_PATH;
+    const logout_path = options.logout_path ?? SPINE_ACCOUNT_LOGOUT_PATH;
     // Fresh-keeper-per-test wipes the DB between tests, so a literal username
     // never collides (see `setup.ts`). Each test mints it fresh.
     const username = 'cookie_attr_user';

package/dist/testing/cross_backend/create_cross_backend_global_setup.d.ts

@@ -6,8 +6,8 @@ import '../assert_dev_env.js';
  * sets its own `test.name`, and this factory derives the backend name from
  * that project name (vitest 4 passes the `TestProject` to globalSetup), picks
  * the matching `BackendConfig`, spawns + bootstraps it via `bootstrap_backend`,
- * and `provide`s a serializable handle that `*.cross.test.ts` files
- * `inject` and rebuild with `reconstruct_bootstrapped_handle`.
+ * and `provide`s a serializable handle that `*.cross.test.ts` files read
+ * with `inject_backend_handle` (`provided_context.ts`).
  *
  * A consumer's `global_setup.ts` collapses to:
  *
@@ -15,10 +15,11 @@ import '../assert_dev_env.js';
  * import {create_cross_backend_global_setup} from
  *   '@fuzdev/fuz_app/testing/cross_backend/create_cross_backend_global_setup.ts';
  * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
- * import './cross_test_types.js'; // augments inject('backend_handle')
  *
  * export default create_cross_backend_global_setup({
  *   configs: {deno: deno_backend_config, rust: rust_backend_config},
+ *   ensure_databases: true,
+ *   before_spawn: {rust: () => prepare_cargo_binary(my_cargo_binary)},
  * });
  * ```
  *
@@ -31,6 +32,7 @@ import '../assert_dev_env.js';
  */
 import type { TestProject } from 'vitest/node';
 import type { BackendConfig } from './backend_config.js';
+import { bootstrap_backend } from './bootstrap_backend.js';
 export interface CrossBackendGlobalSetupOptions {
     /**
      * Map of derived backend name → `BackendConfig` factory. The derived
@@ -45,13 +47,44 @@ export interface CrossBackendGlobalSetupOptions {
     readonly derive_name?: (project_name: string) => string;
     /**
      * Key passed to `project.provide` (and read by `inject` in test files).
-     * Default `'backend_handle'`. Augment vitest's `ProvidedContext` for it.
+     * Default `'backend_handle'`, which `provided_context.ts` declares on vitest's
+     * `ProvidedContext`; augment it yourself for another key.
      */
     readonly provide_key?: string;
+    /**
+     * Create the database the selected config's `env.DATABASE_URL` names, on
+     * the server it names, when it is missing and the URL is `postgres:`
+     * (`ensure_database_for_url` — idempotent `createdb`; a URL like
+     * `memory://` is left alone). Off by default, so a test role without
+     * `CREATEDB` is never required unless the setup asks.
+     *
+     * @default false
+     */
+    readonly ensure_databases?: boolean;
+    /**
+     * Hooks run before a backend's config is built and spawned, by backend
+     * name — the Cargo build of a Rust binary (`prepare_cargo_binary`), so it
+     * runs with its output shown and outside the spawn's startup window, and
+     * the config can spawn the built binary. Runs only for the selected
+     * backend; a key naming no config throws.
+     */
+    readonly before_spawn?: Readonly<Record<string, () => unknown>>;
+}
+/**
+ * What `create_cross_backend_global_setup` creates databases and spawns
+ * backends with — `ensure_database_for_url` and `bootstrap_backend` by default.
+ */
+export interface CrossBackendGlobalSetupDeps {
+    readonly ensure_database_for_url: (database_url: string) => unknown;
+    readonly bootstrap_backend: typeof bootstrap_backend;
 }
 /**
  * Build a vitest `globalSetup` default export. Returns the
  * `(project) => teardown` function vitest 4 expects.
+ *
+ * @param options - the configs, and what runs before the spawn
+ * @param deps - the database creator and the spawn, the shipped ones by default
+ * @throws Error when a `before_spawn` key names no config
  */
-export declare const create_cross_backend_global_setup: ({ configs, derive_name, provide_key }: CrossBackendGlobalSetupOptions) => ((project: TestProject) => Promise<() => Promise<void>>);
+export declare const create_cross_backend_global_setup: ({ configs, derive_name, provide_key, ensure_databases, before_spawn }: CrossBackendGlobalSetupOptions, deps?: CrossBackendGlobalSetupDeps) => ((project: TestProject) => Promise<() => Promise<void>>);
 //# sourceMappingURL=create_cross_backend_global_setup.d.ts.map

package/dist/testing/cross_backend/create_cross_backend_global_setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_cross_backend_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_cross_backend_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,aAAa,CAAC,CAAC,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAAI,uCAI/C,8BAA8B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAqB1F,CAAC"}
+{"version":3,"file":"create_cross_backend_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_cross_backend_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAY3D,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,aAAa,CAAC,CAAC,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC;CAChE;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IACpE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CACrD;AAOD;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,GAC7C,uEAMG,8BAA8B,EACjC,OAAM,2BAAqE,KACzE,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAiCzD,CAAC"}