@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -15,6 +15,26 @@ export const TESTING_ACTION_AUTH = {
 };
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export const SPINE_RPC_PATH = '/api/rpc';
+/** Ungated WebSocket endpoint mount path — matches the binaries' `/api/ws`. */
+export const SPINE_WS_PATH = '/api/ws';
+/**
+ * Mount prefix of the account REST routes (login, logout, password, status,
+ * signup, bootstrap) on both spine binaries. The `SPINE_ACCOUNT_*_PATH`
+ * constants below are the routes under it the suites drive.
+ */
+export const SPINE_ACCOUNT_PATH_PREFIX = '/api/account';
+/** REST login route. */
+export const SPINE_ACCOUNT_LOGIN_PATH = '/api/account/login';
+/** REST logout route. */
+export const SPINE_ACCOUNT_LOGOUT_PATH = '/api/account/logout';
+/** REST password-change route. */
+export const SPINE_ACCOUNT_PASSWORD_PATH = '/api/account/password';
+/** REST account-status route. */
+export const SPINE_ACCOUNT_STATUS_PATH = '/api/account/status';
+/** REST signup route. */
+export const SPINE_ACCOUNT_SIGNUP_PATH = '/api/account/signup';
+/** REST bootstrap route — the default `BackendConfig.bootstrap_path`. */
+export const SPINE_ACCOUNT_BOOTSTRAP_PATH = '/api/account/bootstrap';
 /**
  * Audit-log SSE stream path — `/api/admin` prefix + the
  * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
@@ -23,6 +43,15 @@ export const SPINE_RPC_PATH = '/api/rpc';
  * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
  */
 export const SPINE_SSE_PATH = '/api/admin/audit/stream';
+/**
+ * The request-body cap both spines ship by default, 1 MiB
+ * (`DEFAULT_MAX_BODY_SIZE` in TS, `DEFAULT_BODY_LIMIT_BYTES` in `fuz_http`).
+ * Kept here as the cross-impl contract value rather than imported from either
+ * impl — the boundary the body-size suites pin is the shared default, and a
+ * change to either is a deliberate cross-impl decision that would revisit them
+ * regardless.
+ */
+export const SPINE_BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
 /**
  * App role the role-shaped-`cell_grant` cross suite exercises. Registered
  * with no grant path (`grant_paths: []`) so it stays a valid registry member

package/dist/testing/cross_backend/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkF9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AA0BD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAyStF,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkF9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAO5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AA0BD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAyStF,CAAC"}

package/dist/testing/cross_backend/sse_round_trip.js

@@ -69,8 +69,7 @@ import { create_rpc_post_init } from '../rpc_helpers.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { test_if } from './capabilities.js';
 import { create_account_revocations } from './revocation_drivers.js';
-/** Default audit-log SSE stream path — the standard fuz_app `/api/admin/audit/stream`. */
-const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+import { SPINE_ACCOUNT_LOGOUT_PATH, SPINE_ACCOUNT_PASSWORD_PATH, SPINE_SSE_PATH } from './spine_surface_constants.js';
 /**
  * Assert a decoded SSE frame is a well-formed audit `{method, params}`
  * payload whose `params` validate against the matching `audit_log_event_specs`
@@ -94,8 +93,8 @@ const assert_audit_data_frame = (frame) => {
  * per-session cap.
  */
 export const describe_cross_process_sse_tests = (options) => {
-    const { setup_test, capabilities, base_url, rpc_path, origin, logout_path = '/api/account/logout', password_path = '/api/account/password' } = options;
-    const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    const { setup_test, capabilities, base_url, rpc_path, origin, logout_path = SPINE_ACCOUNT_LOGOUT_PATH, password_path = SPINE_ACCOUNT_PASSWORD_PATH } = options;
+    const sse_path = options.sse_path ?? SPINE_SSE_PATH;
     const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
     describe('cross-process sse', () => {
         test_if(capabilities.sse, 'connects and emits the connected comment', async () => {

package/dist/testing/cross_backend/standard.d.ts

@@ -41,6 +41,7 @@ import '../assert_dev_env.js';
 import type { SessionOptions } from '../../auth/session_cookie.js';
 import type { RoleSchemaResult } from '../../auth/role_schema.js';
 import type { AppSurfaceSpec } from '../../http/surface.js';
+import { type RpcSuccessFixtures } from '../rpc_round_trip.js';
 import type { RpcEndpointsSuiteOption } from '../rpc_helpers.js';
 import type { BackendCapabilities } from './capabilities.js';
 import type { SetupTest, TestFixture } from './setup.js';
@@ -112,7 +113,23 @@ export interface StandardCrossProcessTestOptions {
      * schema on each backend — the success-shape parity check. See
      * `RpcRoundTripTestOptions.success_fixtures`.
      */
-    rpc_success_fixtures?: Map<string, (fixture: TestFixture) => Promise<Record<string, unknown>>>;
+    rpc_success_fixtures?: RpcSuccessFixtures;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `skip_methods` — the
+     * consumer escape hatch for a method the generic round-trip can't drive at
+     * all (a handler whose test wiring stubs out the deps it reaches, or reads
+     * tables the suite's database doesn't migrate). Each entry hides the
+     * method from both the crash check and the envelope check, so name the
+     * reason beside it.
+     */
+    rpc_skip_methods?: Array<string>;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `input_overrides`
+     * (method name → params) — for a method whose generated params can't
+     * reach its handler cleanly. The response is held to the same rules as a
+     * generated one.
+     */
+    rpc_input_overrides?: Map<string, Record<string, unknown>>;
     /**
      * Forwarded to `describe_round_trip_validation` as `success_fixtures`
      * (`'METHOD /path'` → async `{url?, body?}` factory) for referential REST

package/dist/testing/cross_backend/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAqCF,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAI5D,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAuCF,CAAC"}

package/dist/testing/cross_backend/standard.js

@@ -29,6 +29,8 @@ export const describe_standard_cross_process_tests = (options) => {
         surface_source: options.surface_source,
         session_options: options.session_options,
         rpc_endpoints: options.rpc_endpoints,
+        skip_methods: options.rpc_skip_methods,
+        input_overrides: options.rpc_input_overrides,
         success_fixtures: options.rpc_success_fixtures
     });
     describe_data_exposure_tests({

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -8,6 +8,30 @@ export declare const SPACE_CELL_KIND = "space";
  * `"participant"` literal.
  */
 export declare const PARTICIPATION_ROLE = "participant";
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
+ * exists so a suite can create a comment under a post (`root_id !==
+ * parent_id`) and prove the policy resolves from the governing root (the
+ * space), not the immediate parent. Shared by the gated-create and moderate
+ * cross suites.
+ */
+export declare const TEST_SPACE_POLICY: {
+    readonly policy: {
+        readonly post: {
+            readonly min_role: "participant";
+            readonly moderation_required: true;
+        };
+        readonly react: {
+            readonly min_role: "participant";
+            readonly moderation_required: false;
+        };
+        readonly comment: {
+            readonly min_role: "participant";
+            readonly moderation_required: false;
+        };
+    };
+};
 /** A space's per-kind contribution rule (the shape stamped into `space.data.policy`). */
 export interface ContributionRule {
     min_role?: string;

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;CAMpB,CAAC;AAEX,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -33,6 +33,21 @@ export const SPACE_CELL_KIND = 'space';
  * `"participant"` literal.
  */
 export const PARTICIPATION_ROLE = SPINE_PARTICIPANT_ROLE;
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
+ * exists so a suite can create a comment under a post (`root_id !==
+ * parent_id`) and prove the policy resolves from the governing root (the
+ * space), not the immediate parent. Shared by the gated-create and moderate
+ * cross suites.
+ */
+export const TEST_SPACE_POLICY = {
+    policy: {
+        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
+    }
+};
 /** Pull the governing root's `data.policy[kind]` rule, defensively (loose `data`). */
 const get_contribution_rule = (data, kind) => {
     if (data === null || typeof data !== 'object')

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,5 +1,6 @@
 import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
+import { type WsEndpointTarget } from './ws_endpoint.js';
 /** Options for the testing-backdoor negative-credential suite. */
 export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
     /**
@@ -7,14 +8,7 @@ export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOption
      * Pass it when the backend serves the `_testing_*` actions on its WS
      * endpoint too; omitted, those cases are skipped.
      */
-    readonly ws?: {
-        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
-        readonly base_url: string;
-        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
-        readonly ws_path: string;
-        /** Origin for the upgrade. Defaults to `base_url`. */
-        readonly origin?: string;
-    };
+    readonly ws?: WsEndpointTarget;
 }
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAyFxE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAExE,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAwF1E,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAoEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -18,9 +18,11 @@ import '../assert_dev_env.js';
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
  * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
  * endpoint) but keeps them off the declared surface — so the spec-derived
- * `describe_rpc_attack_surface_tests` never enumerates them, and nothing
- * else fires them with a non-daemon credential to prove the gate holds
- * end-to-end. This suite does, against each impl's real auth resolution.
+ * `describe_rpc_attack_surface_tests` never enumerates them. This suite fires
+ * them with non-daemon credentials to prove the gate holds end-to-end, against
+ * each impl's real auth resolution; a conformance table given the live mount
+ * (`live_rpc_endpoints`) fires the same refusals through the auth rows
+ * `generate_rpc_auth_conformance_cases` generates for them.
  *
  * For every backdoor method, three principals:
  *
@@ -67,10 +69,10 @@ import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
-import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { is_response_for } from '../transports/ws_client.js';
 import { test_if } from './capabilities.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { open_session_ws } from './ws_endpoint.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**
@@ -171,12 +173,7 @@ export const describe_testing_backdoor_cross_tests = (options) => {
         for (const { method, params } of backdoor_methods) {
             test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
                 const fixture = await setup_test();
-                const client = await create_admitted_ws_transport({
-                    base_url: ws.base_url,
-                    ws_path: ws.ws_path,
-                    cookies: fixture.transport.cookies(),
-                    origin: ws.origin
-                });
+                const client = await open_session_ws(ws, fixture, { admitted: true });
                 try {
                     const id = `backdoor_${method}`;
                     await client.send({ jsonrpc: '2.0', id, method, params });

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -265,9 +265,12 @@ export declare const create_testing_drain_effects_action: (audit: AuditEmitter)
  * the put is on behalf of — recorded in `fact_holder` (deduplicated puts
  * included), as a real upload records its uploader, so the suites can drive
  * cell ref admission; absent, the put is a system put with no holder. The
- * referencing cell is seeded separately via the `cell_create` RPC. Embedded-only is enough for the
- * authz assertions (cell-scoped admit, cross-owner-no-leak, 404-mask, bare-hash
- * admin-only); external / X-Accel parity stays covered by the forge's own gate.
+ * referencing cell is seeded separately via the `cell_create` RPC. Embedded is
+ * enough for the authz assertions (cell-scoped admit, cross-owner-no-leak,
+ * 404-mask, bare-hash admin-only); external / X-Accel parity stays covered by
+ * the forge's own gate. `external_url`, when given, writes the row the way a
+ * writer past the store could — no bytes, that URL verbatim, unvalidated — so
+ * the suite can prove a serve refuses a URL that is not its hash's own address.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset` — the
  * action does a direct `fact` insert the production wire never exposes. The
@@ -287,6 +290,7 @@ export declare const testing_put_fact_action_spec: {
         content: z.ZodString;
         content_type: z.ZodOptional<z.ZodString>;
         holder: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        external_url: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     readonly output: z.ZodObject<{
         hash: z.ZodString & z.ZodType<import("@fuzdev/fuz_util/hash_schemas.js").FactHash, string, z.core.$ZodTypeInternals<import("@fuzdev/fuz_util/hash_schemas.js").FactHash, string>>;
@@ -628,8 +632,9 @@ export interface CreateTestingActionsOptions {
      * `db` rather than a separately-pooled connection — under the in-memory
      * drivers' single connection (pglet, PGlite) a second connection deadlocks against this still-open
      * transaction. `testing_zzz_server` clears in-memory workspace registry +
-     * terminals + scoped-FS scratch (ignores `db`); `testing_spine_stub` has
-     * no domain layer and omits the option. Runs inside the same RPC dispatch
+     * terminals + scoped-FS scratch (ignores `db`); the spine binaries
+     * (`testing/cross_backend/full_spine_mount.ts` and the Rust `testing_spine_stub`) empty
+     * the cell and fact tables. Runs inside the same RPC dispatch
      * as the auth-table writes, so a throw surfaces to the caller as a
      * JSON-RPC error and the per-test fixture short-circuits.
      */

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;CAgBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAkJjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsJjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -87,7 +87,7 @@ import { query_put_fact_holder } from '../../db/fact_holder_queries.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from '../../auth/role_schema.js';
 import { query_schema_snapshot, SchemaSnapshot, query_migration_tracker, MigrationTracker } from '../schema_introspect.js';
 import { ActionManifest, build_action_manifest } from './action_manifest.js';
-import { query_create_actor } from '../../auth/account_queries.js';
+import { create_test_extra_actor } from '../db_entities.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
@@ -267,9 +267,12 @@ export const create_testing_drain_effects_action = (audit) => rpc_action(testing
  * the put is on behalf of — recorded in `fact_holder` (deduplicated puts
  * included), as a real upload records its uploader, so the suites can drive
  * cell ref admission; absent, the put is a system put with no holder. The
- * referencing cell is seeded separately via the `cell_create` RPC. Embedded-only is enough for the
- * authz assertions (cell-scoped admit, cross-owner-no-leak, 404-mask, bare-hash
- * admin-only); external / X-Accel parity stays covered by the forge's own gate.
+ * referencing cell is seeded separately via the `cell_create` RPC. Embedded is
+ * enough for the authz assertions (cell-scoped admit, cross-owner-no-leak,
+ * 404-mask, bare-hash admin-only); external / X-Accel parity stays covered by
+ * the forge's own gate. `external_url`, when given, writes the row the way a
+ * writer past the store could — no bytes, that URL verbatim, unvalidated — so
+ * the suite can prove a serve refuses a URL that is not its hash's own address.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset` — the
  * action does a direct `fact` insert the production wire never exposes. The
@@ -284,12 +287,14 @@ export const testing_put_fact_action_spec = {
     input: z.strictObject({
         content: z.string(),
         content_type: z.string().optional(),
-        holder: Uuid.optional()
+        holder: Uuid.optional(),
+        external_url: z.string().optional()
     }),
     output: z.strictObject({ hash: FactHashSchema }),
     async: true,
-    description: 'Test-binary only — seed an embedded fact (blake3 of the UTF-8 content) and return its hash, ' +
-        'so the cross-process fact-serving suite can store bytes without a DB handle.'
+    description: 'Test-binary only — seed a fact row for the blake3 of the UTF-8 content (embedded, or with ' +
+        'external_url an external row naming that URL) and return its hash, so the cross-process ' +
+        'fact-serving suite can store facts without a DB handle.'
 };
 /** The wire method of each notification `_testing_flood_notifications` queues. */
 export const TESTING_FLOOD_NOTIFICATION_METHOD = '_testing_flood';
@@ -677,10 +682,13 @@ export const create_testing_actions = (deps, options) => {
             //    bypass as extra_accounts — no production wire path mints a
             //    second actor, so the multi-actor `acting` branches need this
             //    direct insert. Order-preserving so the fixture can address
-            //    them positionally.
+            //    them positionally, and seeded at the wall clock so they sort
+            //    after the keeper's bootstrap actor in insert order
+            //    (`create_test_extra_actor`), as on the Rust spine
+            //    (`query_create_actor_with_clock_timestamp`).
             const extra_actors = [];
             for (const name of input.extra_actors ?? []) {
-                const seeded_actor = await query_create_actor({ db: ctx.db }, keeper.account.id, name);
+                const seeded_actor = await create_test_extra_actor(ctx.db, keeper.account.id, name);
                 extra_actors.push({ id: seeded_actor.id, name: seeded_actor.name });
             }
             // 6. Refresh the daemon-token cache so subsequent daemon-token
@@ -696,7 +704,8 @@ export const create_testing_actions = (deps, options) => {
                 daemon_token_state.keeper_account_id = keeper_account_id;
             });
             // 7. Fire domain-state reset (zzz workspaces/terminals/scratch,
-            //    fuz_forge cell/fact/file truncation, or no-op for spine_stub).
+            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
+            //    fact wipe).
             //    Pass the transactional `ctx.db` so DB-domain truncation runs
             //    on the same connection — a separate pool connection deadlocks
             //    against this open transaction under the in-memory drivers.
@@ -719,8 +728,8 @@ export const create_testing_actions = (deps, options) => {
             const hash = fact_hash_bytes(bytes);
             await query_put_fact({ db: ctx.db }, {
                 hash,
-                bytes,
-                external_url: null,
+                bytes: input.external_url === undefined ? bytes : null,
+                external_url: input.external_url ?? null,
                 content_type: input.content_type ?? null,
                 size: bytes.length
             });

package/dist/testing/cross_backend/testing_server_bun.js

@@ -72,7 +72,7 @@ export const create_bun_testing_adapter = () => {
                 // hang), and the client runtime — a single server-closed WS is
                 // necessary and sufficient. Client-initiated close or leaving the
                 // socket open both stop cleanly in ~0ms. In this suite the trigger is
-                // any server-initiated WS close — a revocation's (the `ws.cross.test.ts`
+                // any server-initiated WS close — a revocation's (the WS round-trip suite's
                 // close-on-revoke cases), a cap eviction's, an oversized message's —
                 // which is why teardown hangs after those and not under HTTP-only or
                 // client-closed WS traffic.

package/dist/testing/cross_backend/token_lifetime.js

@@ -37,7 +37,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_token_create_action_spec, account_token_list_action_spec, API_TOKEN_NAME_LENGTH_MAX, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** TTL used by the bounded-mint case. */

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA+JF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAmB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAqKF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -70,13 +70,9 @@ import '../assert_dev_env.js';
 import { describe, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call } from './cell_cross_helpers.js';
+import { cross_rpc_call } from './cross_rpc.js';
 import { mint_narrowed_api_token } from './narrowed_api_token.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** Default audit-log SSE path — the `audit_stream` surface. */
-const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
-/** The account status read, which answers a narrowed token as anonymous. */
-const STATUS_PATH = '/api/account/status';
+import { SPINE_ACCOUNT_STATUS_PATH, SPINE_RPC_PATH, SPINE_SSE_PATH } from './spine_surface_constants.js';
 /**
  * A well-formed hash that no fact has. The scope gate is a pre-authorization
  * guard, so it fires before the handler ever looks the hash up — but *params*
@@ -127,7 +123,7 @@ const assert_channel_denied = async (fresh_transport, path, token, credential_ty
 export const describe_token_scope_surface_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    const sse_path = options.sse_path ?? SPINE_SSE_PATH;
     describe('token scope non-RPC surface parity', () => {
         /**
          * The non-vacuity control for every denial below: a narrowed token is
@@ -155,7 +151,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
             });
             await assert_channel_denied(fixture.fresh_transport, sse_path, token, ['session']);
         });
-        test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
             const fixture = await setup_test();
             const token = await mint_narrowed_api_token({
                 app: fixture.transport,
@@ -173,7 +169,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
          * scope denial satisfies the property, so the assertion is on what the
          * response must *not* be.
          */
-        test_if(capabilities.fact_serving, 'a full token is not refused by the scope gate on the same route', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'a full token is not refused by the scope gate on the same route', async () => {
             const fixture = await setup_test();
             const res = await fixture.fresh_transport({ origin: null })(`/api/facts/${ABSENT_FACT_HASH}`, { headers: fixture.create_bearer_headers() });
             const body = (await res.json().catch(() => undefined));
@@ -193,14 +189,14 @@ export const describe_token_scope_surface_cross_tests = (options) => {
                 session_headers: fixture.create_session_headers(),
                 methods: [ADMITTED_METHOD]
             });
-            const anonymous = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {});
-            const narrowed = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+            const anonymous = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {});
+            const narrowed = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {
                 headers: { authorization: `Bearer ${token}` }
             });
             assert.strictEqual(anonymous.status, 401, 'anonymous status must be 401');
             assert.strictEqual(narrowed.status, 401, 'a narrowed token must read status as anonymous');
             assert.strictEqual(await narrowed.text(), await anonymous.text(), 'the narrowed answer must be the anonymous one, byte for byte');
-            const full = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+            const full = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {
                 headers: fixture.create_bearer_headers()
             });
             assert.strictEqual(full.status, 200, 'a full-scope bearer must read the account');
@@ -218,7 +214,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
          * *holds* the role — so both orderings look identical there, which is
          * exactly why this divergence survived as long as it did.
          */
-        test_if(capabilities.fact_serving, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'scope_before_role' });
             const token = await mint_narrowed_api_token({

package/dist/testing/cross_backend/transport_composition.d.ts

@@ -1,10 +1,10 @@
 import '../assert_dev_env.js';
 import { type BackendCapabilities } from './capabilities.js';
-import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions, SetupTest } from './setup.js';
 /** A transport's front door, as the table's rows name it. */
 export type TransportCompositionSurface = 'rest_post' | 'rest_password' | 'rpc_post' | 'rpc_get' | 'ws_upgrade' | 'sse';
 /** What a probe sends, as the table's columns name it. */
-export type TransportCompositionProbe = 'foreign_origin' | 'unreadable_origin' | 'duplicated_origin' | 'over_cap_foreign_origin' | 'no_credential' | 'narrowed_token';
+export type TransportCompositionProbe = 'foreign_origin' | 'unreadable_origin' | 'duplicated_origin' | 'over_cap_foreign_origin' | 'no_credential' | 'narrowed_token' | 'multi_actor_no_acting';
 /** The refusal a case expects. */
 export interface TransportCompositionExpect {
     readonly status: number;
@@ -25,6 +25,21 @@ export interface TransportCompositionCase {
 }
 /** The front-door table — one case per cell of the module doc's matrix. */
 export declare const transport_composition_cases: ReadonlyArray<TransportCompositionCase>;
+/**
+ * The rows that need a multi-actor keeper — run only given
+ * `TransportCompositionCrossTestOptions.multi_actor`, on its fixture.
+ */
+export declare const transport_composition_multi_actor_cases: ReadonlyArray<TransportCompositionCase>;
+/** The multi-actor rows' fixture, and how a backend known to diverge runs them. */
+export interface TransportCompositionMultiActorOptions {
+    /** Per-test fixture whose keeper is seeded with at least one `extra_actors` entry. */
+    readonly setup_test: SetupTest;
+    /** Run the multi-actor rows as `xfail_until` — for a backend known to admit them. */
+    readonly xfail?: {
+        readonly tracking_id: string;
+        readonly reason: string;
+    };
+}
 /** Options for `describe_transport_composition_cross_tests`. */
 export interface TransportCompositionCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /**
@@ -47,6 +62,15 @@ export interface TransportCompositionCrossTestOptions extends RpcPathCapabilityG
     readonly ws_path?: string;
     /** Audit-log SSE path. Default `/api/admin/audit/stream`. */
     readonly sse_path?: string;
+    /** Run the multi-actor rows (`transport_composition_multi_actor_cases`). */
+    readonly multi_actor?: TransportCompositionMultiActorOptions;
+    /**
+     * The backend's request-body cap on `rpc_path`, in bytes; the RPC row's
+     * over-cap probe declares a length one past it. Default
+     * `SPINE_BODY_LIMIT_DEFAULT_BYTES`. The REST rows probe past that default,
+     * the cap a backend keeps off its RPC path.
+     */
+    readonly rpc_max_body_bytes?: number;
 }
 /**
  * Register the front-door table's cases — one test per cell, each on a fresh

package/dist/testing/cross_backend/transport_composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport_composition.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/transport_composition.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+E9B,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAGvF,6DAA6D;AAC7D,MAAM,MAAM,2BAA2B,GACtC,WAAW,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAClC,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,CAAC;AAEpB,kCAAkC;AAClC,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAsCD,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,EAAE,aAAa,CAAC,wBAAwB,CA4C/E,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,oCAAqC,SAAQ,uCAAuC;IACpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,GACtD,SAAS,oCAAoC,KAC3C,IA2KF,CAAC"}
+{"version":3,"file":"transport_composition.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/transport_composition.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgG9B,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAWlG,6DAA6D;AAC7D,MAAM,MAAM,2BAA2B,GACtC,WAAW,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAClC,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,GAChB,uBAAuB,CAAC;AAE3B,kCAAkC;AAClC,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAsCD,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,EAAE,aAAa,CAAC,wBAAwB,CA4C/E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,wBAAwB,CAO3F,CAAC;AAEF,mFAAmF;AACnF,MAAM,WAAW,qCAAqC;IACrD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,gEAAgE;AAChE,MAAM,WAAW,oCAAqC,SAAQ,uCAAuC;IACpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,qCAAqC,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AAqED;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,GACtD,SAAS,oCAAoC,KAC3C,IAiMF,CAAC"}