@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -59,15 +59,8 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
-import { raw_http_count_responses, raw_http_exchange } from '../transports/raw_http.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
-const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
-/**
- * How long each raw exchange waits for the server to finish answering. An
- * exchange the backend does not end by closing runs the whole window.
- */
-const RAW_READ_TIMEOUT_MS = 2000;
+import { raw_http_count_responses, raw_http_exchange, RAW_HTTP_READ_TIMEOUT_MS } from '../transports/raw_http.js';
+import { SPINE_BODY_LIMIT_DEFAULT_BYTES, SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -81,7 +74,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
             const two_requests = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n` +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
             const { received: response } = await raw_http_exchange(base_url, two_requests, {
-                read_timeout_ms: RAW_READ_TIMEOUT_MS
+                read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
             });
             const n = raw_http_count_responses(response);
             assert.ok(n >= 2, `expected ≥2 responses on one keep-alive connection (got ${n}); without ` +
@@ -89,7 +82,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 `assertion below is not a real signal. Raw head: ${response.slice(0, 120)}`);
         });
         test('oversized POST + pipelined GET → no request smuggled', async () => {
-            const oversized_len = BODY_LIMIT_DEFAULT_BYTES + 1024;
+            const oversized_len = (options.rpc_max_body_bytes ?? SPINE_BODY_LIMIT_DEFAULT_BYTES) + 1024;
             const pipelined_get = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
             // One write: an over-cap POST (rejected on Content-Length) immediately
             // followed by a GET.
@@ -101,7 +94,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 'x'.repeat(oversized_len) +
                 pipelined_get;
             const { received: response } = await raw_http_exchange(base_url, payload, {
-                read_timeout_ms: RAW_READ_TIMEOUT_MS
+                read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
             });
             const n = raw_http_count_responses(response);
             // The reject closes the connection, so the pipelined GET is never
@@ -140,7 +133,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                     chunked_envelope +
                     `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
                 const { received, closed_by_server } = await raw_http_exchange(base_url, payload, {
-                    read_timeout_ms: RAW_READ_TIMEOUT_MS
+                    read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
                 });
                 const n = raw_http_count_responses(received);
                 // Refused with 400 or answered — the status is the implementation's.
@@ -151,7 +144,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                     `Raw head: ${received.slice(0, 120)}`);
                 assert.ok(closed_by_server, `expected the server to close the connection after a request carrying both ` +
                     `Content-Length and Transfer-Encoding; it was still open after ` +
-                    `${RAW_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
+                    `${RAW_HTTP_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
             });
         }
     });

package/dist/testing/cross_backend/bootstrap_backend.d.ts

@@ -25,6 +25,16 @@ import '../assert_dev_env.js';
  */
 import type { BackendConfig } from './backend_config.js';
 import type { BootstrappedBackendHandle } from './setup.js';
+/** Options for `bootstrap_backend`. */
+export interface BootstrapBackendOptions {
+    /**
+     * Runs after the binary is up and before the keeper bootstrap — the one
+     * window in a backend's life where `POST {bootstrap_path}` still answers on
+     * the token, so probes of the bootstrap route itself go here. A throw tears
+     * the backend down like a failed bootstrap.
+     */
+    readonly before_bootstrap?: (config: BackendConfig) => Promise<void>;
+}
 /**
  * Spawn the test binary described by `config`, bootstrap a keeper, and
  * return the enriched handle.
@@ -37,5 +47,5 @@ import type { BootstrappedBackendHandle } from './setup.js';
  * Mirrors the composition `default_cross_process_setup`'s caller would
  * otherwise hand-roll in every consumer's `globalSetup`.
  */
-export declare const bootstrap_backend: (config: BackendConfig) => Promise<BootstrappedBackendHandle>;
+export declare const bootstrap_backend: (config: BackendConfig, options?: BootstrapBackendOptions) => Promise<BootstrappedBackendHandle>;
 //# sourceMappingURL=bootstrap_backend.d.ts.map

package/dist/testing/cross_backend/bootstrap_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,KACnB,OAAO,CAAC,yBAAyB,CAwBnC,CAAC"}
+{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,uCAAuC;AACvC,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,EACrB,UAAU,uBAAuB,KAC/B,OAAO,CAAC,yBAAyB,CAyBnC,CAAC"}

package/dist/testing/cross_backend/bootstrap_backend.js

@@ -14,9 +14,10 @@ import { create_fetch_transport } from '../transports/fetch_transport.js';
  * Mirrors the composition `default_cross_process_setup`'s caller would
  * otherwise hand-roll in every consumer's `globalSetup`.
  */
-export const bootstrap_backend = async (config) => {
+export const bootstrap_backend = async (config, options) => {
     const handle = await spawn_backend(config);
     try {
+        await options?.before_bootstrap?.(config);
         const keeper_transport = create_fetch_transport({ base_url: config.base_url });
         const keeper = await bootstrap({ transport: keeper_transport, config });
         return {

package/dist/testing/cross_backend/build_test_backend_paths.d.ts

@@ -8,7 +8,9 @@ import '../assert_dev_env.js';
  * - `bootstrap_token_path` — `FUZ_BOOTSTRAP_TOKEN_PATH`; harness writes
  *   the bootstrap token here before spawn.
  * - `daemon_token_path` — where `init_daemon_token` (Rust) and the TS
- *   server's daemon-token writer land the token (under `{root}/run/`).
+ *   server's daemon-token writer land the token (under `{root}/run/`);
+ *   `spawn_backend` deletes it before each spawn, so a token a previous run
+ *   left is never read.
  */
 export interface TestBackendPaths {
     readonly root: string;

package/dist/testing/cross_backend/build_test_backend_paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build_test_backend_paths.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/build_test_backend_paths.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,gBASzD,CAAC"}
+{"version":3,"file":"build_test_backend_paths.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/build_test_backend_paths.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,gBASzD,CAAC"}

package/dist/testing/cross_backend/capabilities.d.ts

@@ -1,43 +1,9 @@
 import '../assert_dev_env.js';
-/**
- * Backend wiring facts recorded for documentation — **not** gating flags.
- *
- * The companion to `BackendCapabilities`: where each capability flag is read
- * by a suite (a `test_if(capabilities.X, ...)` gate, or a fork of one case's
- * assertion), nothing reads these. They record middleware / limiter wiring that
- * differs between the TS and Rust families (a backend-shape record) but gates
- * no cross test today. They live in their own type precisely so
- * `BackendCapabilities` stops claiming gating power it doesn't have — fold a
- * flag in here the moment it has no `test_if` reader, and promote it back the
- * day a suite genuinely gates on it.
- */
-export interface BackendShapeNotes {
-    /**
-     * Bearer-token auth (`Authorization: Bearer <token>`) is wired through the
-     * backend's middleware stack. `true` on every spine — the bearer-token cases
-     * in `describe_standard_integration_tests` / `describe_rate_limiting_tests`
-     * run unconditionally.
-     */
-    readonly bearer_auth: boolean;
-    /**
-     * Trusted-proxy XFF parsing (`X-Forwarded-For` etc.) is wired. Records the
-     * proxy-default difference between the TS family (`false` — the test binary
-     * leaves proxy parsing off) and the Rust family (`true` — the client-IP
-     * middleware is always wired; the env-gate only chooses XFF vs the TCP peer).
-     */
-    readonly trusted_proxy: boolean;
-    /**
-     * Per-account login rate limiting is wired. `false` for the TS family (the
-     * canonical path leaves the limiter null in test mode), `true` for the Rust
-     * family (env-gated bucket on `/login` + `/password`).
-     */
-    readonly login_rate_limit: boolean;
-}
 /**
  * Optional behaviors a backend may support. Each flag's TSDoc names the
  * tests that gate on it; add a new flag here before referencing it from
- * a suite body, and document the gating tests inline. Wiring facts that gate
- * nothing belong in `BackendShapeNotes`, not here.
+ * a suite body, and document the gating tests inline. A wiring fact no
+ * suite reads doesn't belong here.
  */
 export interface BackendCapabilities {
     /**
@@ -93,15 +59,27 @@ export interface BackendCapabilities {
      */
     readonly account_lifecycle: boolean;
     /**
-     * The cell-gated fact-serving routes (`GET /api/cells/:cell_id/facts/:hash`
-     * + the admin-only `GET /api/facts/:hash`) are live-mounted on the backend,
-     * its DB carries the `fuz_facts` migration namespace, and it registers the
-     * `_testing_put_fact` seeder. Gates `describe_fact_serving_cross_tests` —
-     * the per-reference read model (cell-scoped admit via a viewable cell,
-     * cross-owner-dedup-no-leak, 404-mask, bare-hash admin-only). Like cells,
-     * the serve routes stay off the standard declared surface.
+     * The cell-gated fact-serving route (`GET /api/cells/:cell_id/facts/:hash`)
+     * is live-mounted on the backend, its DB carries the `fuz_facts` migration
+     * namespace, and it registers the `_testing_put_fact` seeder. Gates
+     * `describe_fact_serving_cross_tests`' per-reference read model (cell-scoped
+     * admit via a viewable cell, cross-owner-dedup-no-leak, 404-mask),
+     * `describe_cell_ref_admission_cross_tests`, and the fact cases of the
+     * moderation suite. Like cells, the serve route stays off the standard
+     * declared surface. The admin bare-hash route is its own flag,
+     * `fact_serving_admin_hash`.
      */
     readonly fact_serving: boolean;
+    /**
+     * The admin-only bare-hash fact route (`GET /api/facts/:hash`) is
+     * live-mounted. Gates the bare-hash cases of
+     * `describe_fact_serving_cross_tests` (with `fact_serving`, whose seeder
+     * they use), `describe_query_shape_cross_tests` and
+     * `describe_token_scope_surface_cross_tests`. A backend serving only the
+     * cell-gated route states `fact_serving: true, fact_serving_admin_hash:
+     * false`.
+     */
+    readonly fact_serving_admin_hash: boolean;
     /**
      * The `/ready` readiness deploy gate (`GET /ready`) is live-mounted on the
      * backend — the public column-presence schema-drift probe over the committed
@@ -130,13 +108,12 @@ export interface BackendCapabilities {
      * rejection, per-connection id isolation, never-replying `Timeout`,
      * wrong-shape reply rejection).
      *
-     * `true` for both the Rust spine (server-initiated requests landed
-     * Rust-first canonical) and the TS spine
-     * (`BackendWebsocketTransport.request_connection` drives the round-trip,
-     * correlated by `register_action_ws`). The conservative
-     * `ts_default_capabilities` keeps it `false` like sse/ready — a TS backend
-     * opts in once it mounts `peer/ping` on a WS endpoint **and** the HTTP RPC
-     * endpoint (the no-transport refusal). Like ws/sse/cells, `peer/ping` stays
+     * `true` on fuz_app's own spine presets — the Rust `testing_spine_stub` and
+     * the TS spine (`BackendWebsocketTransport.request_connection` drives the
+     * round-trip, correlated by `register_action_ws`). A `MountFlag`: a backend
+     * states `true` once it mounts `peer/ping` on a WS endpoint **and** the HTTP
+     * RPC endpoint (the no-transport refusal).
+     * Like ws/sse/cells, `peer/ping` stays
      * off the standard declared surface (it's a protocol action,
      * manifest-excluded), so this flag is the only opt-in into the peer parity
      * coverage.
@@ -171,9 +148,9 @@ export interface BackendCapabilities {
      *
      * `true` on fuz_app's own spine presets — the TS spine binary mounts its
      * full action set on `/api/ws`, and the Rust `testing_spine_stub` serves
-     * one action registry on RPC and WS. `false` in the family defaults:
-     * a consumer's WS endpoint carries whatever its domain mounts, so it opts in
-     * once the account actions are there.
+     * one action registry on RPC and WS. A `MountFlag`: a consumer's WS endpoint
+     * carries whatever its domain mounts, so it states `true` once the account
+     * actions are there.
      */
     readonly ws_account_actions: boolean;
     /**
@@ -215,6 +192,31 @@ export interface BackendCapabilities {
      */
     readonly ws_refusal_body: boolean;
 }
+/**
+ * The capabilities that describe a backend's own mounts, never a runtime
+ * trait: what a consumer chooses to serve. They have no family default —
+ * state each flag in your backend config's `capabilities`; a missing one
+ * would silently skip its suites, so leaving one out is a type error.
+ *
+ * `Pick` keeps the list honest: a name that is not a `BackendCapabilities`
+ * flag fails to compile.
+ */
+export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_crud' | 'cell_relations' | 'cell_gated_create' | 'fact_serving' | 'fact_serving_admin_hash' | 'ready' | 'peer_request' | 'ws_account_actions' | 'ws_role_gated'>;
+/**
+ * A family's default capabilities: every flag but the `MountFlag`s, which
+ * each backend config states itself. Spread one and add every mount flag:
+ *
+ * ```ts
+ * capabilities: {
+ *   ...rust_default_capabilities,
+ *   ws: true, sse: true, ready: true, peer_request: true,
+ *   cell_crud: false, cell_relations: false, cell_gated_create: false,
+ *   fact_serving: false, fact_serving_admin_hash: false,
+ *   ws_account_actions: false, ws_role_gated: false,
+ * }
+ * ```
+ */
+export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag>;
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
@@ -229,12 +231,6 @@ export interface BackendCapabilities {
  * per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
-/**
- * Shape notes for the in-process Hono transport — every wiring fact present
- * (the in-process app exercises the full middleware stack). Documentation
- * only, like every `BackendShapeNotes` (nothing reads it).
- */
-export declare const in_process_shape_notes: BackendShapeNotes;
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAwBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyBpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -18,22 +18,28 @@ import '../assert_dev_env.js';
  * - `in_process_capabilities` — here; every flag `true` except the
  *   cross-process-only ones.
  * - `ts_default_capabilities` / `rust_default_capabilities` — consumer-facing
- *   family defaults, in `default_backend_configs.ts` (full literals, so adding
- *   a capability is a compile error until each family declares it).
+ *   family defaults, in `default_backend_configs.ts` — every flag but the
+ *   `MountFlag`s (`FamilyDefaultCapabilities`), as full literals, so adding a
+ *   non-mount capability is a compile error until each family declares it.
  * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
- *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
- *   default; Bun flips `ws_handshake_pipelining`).
+ *   spine presets, in `ts_spine_backend_config.ts` (the family
+ *   default plus every mount flag; Bun flips `ws_handshake_pipelining`).
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
- *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
+ *   `rust_spine_stub_backend_config.ts` (the rust family default plus every mount flag).
  *
- * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
- * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader,
- * or — `ws_refusal_body` — picks how a case reads a refusal).
- * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
- * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
- * (`in_process_shape_notes` here, `ts_default_shape_notes` /
- * `rust_default_shape_notes` in `default_backend_configs.ts`) so the
- * capability type never claims gating power it doesn't have.
+ * **Mount flags have no default.** A flag naming something a backend mounts
+ * (a `MountFlag`) is never inherited: the family defaults are
+ * `FamilyDefaultCapabilities`, which omits them, so every backend config states
+ * each one. The family defaults carry only what the family guarantees — the
+ * declared spine surface's mounts (`account_lifecycle`, `account_status`) and
+ * the runtime behavior of its reference runtime (`ws_handshake_pipelining`,
+ * `ws_refusal_body`: Node for TS, hyper for Rust), which a backend on another
+ * runtime overrides.
+ *
+ * **Gating flags only.** `BackendCapabilities` holds only flags a suite
+ * actually gates on (each has a `test_if(capabilities.X, ...)` reader, or —
+ * `ws_refusal_body` — picks how a case reads a refusal). A wiring fact no suite
+ * reads is not a capability.
  *
  * @module
  */
@@ -58,6 +64,7 @@ export const in_process_capabilities = Object.freeze({
     cell_relations: true,
     account_lifecycle: true,
     fact_serving: true,
+    fact_serving_admin_hash: true,
     ready: true,
     account_status: true,
     peer_request: false,
@@ -76,16 +83,6 @@ export const in_process_capabilities = Object.freeze({
     // socket to upgrade); Hono's own refusals carry their bodies.
     ws_refusal_body: true
 });
-/**
- * Shape notes for the in-process Hono transport — every wiring fact present
- * (the in-process app exercises the full middleware stack). Documentation
- * only, like every `BackendShapeNotes` (nothing reads it).
- */
-export const in_process_shape_notes = Object.freeze({
-    bearer_auth: true,
-    trusted_proxy: true,
-    login_rate_limit: true
-});
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still

package/dist/testing/cross_backend/cargo_binary.d.ts

@@ -0,0 +1,70 @@
+import '../assert_dev_env.js';
+/**
+ * Env var skipping the build, for iteration on a known-current binary: `1` or
+ * `true` skips it, any other value (`0`, `false`, empty) builds.
+ */
+export declare const NO_REBUILD_ENV = "FUZ_TESTING_NO_REBUILD";
+/**
+ * Whether an `NO_REBUILD_ENV` value asks to skip the build — only an explicit
+ * `1` / `true`, so `FUZ_TESTING_NO_REBUILD=0` still builds.
+ *
+ * @param value - the variable's value, `undefined` when unset
+ */
+export declare const is_no_rebuild_requested: (value: string | undefined) => boolean;
+/** Options naming one Cargo-built binary. */
+export interface CargoBinaryOptions {
+    /** The Cargo workspace (or package) directory the build runs in. */
+    readonly workspace_dir: string;
+    /** The Cargo package holding the binary (`cargo build -p`). */
+    readonly package: string;
+    /** The binary target (`cargo build --bin`). Default the package name. */
+    readonly bin?: string;
+    /** The Cargo profile. Default `'dev'`, whose output is `debug/`. */
+    readonly profile?: string;
+}
+/**
+ * The directory under the target directory a profile's output lands in —
+ * `debug` for `dev`, the profile's own name otherwise (`release`, a custom
+ * `cross-test`).
+ *
+ * @param profile - the Cargo profile
+ */
+export declare const to_cargo_profile_dir: (profile: string) => string;
+/**
+ * The binary path `cargo build --profile <profile> --bin <bin>` writes, from
+ * `cargo metadata --no-deps --format-version 1` output.
+ *
+ * @param metadata_json - the `cargo metadata` output
+ * @param bin - the binary's name
+ * @param profile - the Cargo profile
+ * @returns the binary's absolute path
+ * @throws Error when the output carries no `target_directory`
+ */
+export declare const to_cargo_binary_path: (metadata_json: string, bin: string, profile: string) => string;
+/**
+ * The path of a Cargo-built binary, without building it — what a config's
+ * `start_command` names. Runs `cargo metadata` once per process per workspace,
+ * so it needs cargo on PATH.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path
+ * @throws Error when the workspace is missing or `cargo metadata` fails
+ */
+export declare const resolve_cargo_binary_path: (options: CargoBinaryOptions) => string;
+/**
+ * Build a Cargo binary before its backend spawns, unless `NO_REBUILD_ENV`
+ * asks to skip it, and return its path. The build's output is inherited, so a
+ * cold build shows its progress, and a failed build throws — the project fails
+ * loudly rather than spawning a stale binary. `cargo build` is incremental, so
+ * a build with nothing changed is quick.
+ *
+ * Synchronous: vitest awaits each project's `globalSetup` in turn, so one
+ * invocation selecting several projects builds once, then finds the build
+ * current.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path (`resolve_cargo_binary_path`)
+ * @throws Error when the workspace is missing, the build fails, or `cargo metadata` fails
+ */
+export declare const prepare_cargo_binary: (options: CargoBinaryOptions) => string;
+//# sourceMappingURL=cargo_binary.d.ts.map

package/dist/testing/cross_backend/cargo_binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo_binary.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cargo_binary.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyB9B;;;GAGG;AACH,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,OACnB,CAAC;AAElD,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MACjB,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,eAAe,MAAM,EACrB,KAAK,MAAM,EACX,SAAS,MAAM,KACb,MAMF,CAAC;AA2DF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,MAGvE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,kBAAkB,KAAG,MAUlE,CAAC"}

package/dist/testing/cross_backend/cargo_binary.js

@@ -0,0 +1,148 @@
+import '../assert_dev_env.js';
+/**
+ * Cargo-built test binaries for cross-backend projects — build before the
+ * spawn, then spawn the binary itself.
+ *
+ * A config that spawns `cargo run` builds inside `spawn_backend`'s health
+ * window, so a cold build can outlast the startup timeout, and the build's
+ * output is held in the spawn's stderr tail rather than shown.
+ * `prepare_cargo_binary` runs the build first, with its output inherited, as a
+ * pre-spawn hook (`create_cross_backend_global_setup`'s `before_spawn`), and
+ * the config's `start_command` names the built binary
+ * (`resolve_cargo_binary_path`), so the spawn starts at once.
+ *
+ * The binary's path comes from `cargo metadata`: under the workspace's
+ * resolved `target_directory`, so `CARGO_TARGET_DIR` and `build.target-dir`
+ * are honoured, in the profile's output directory.
+ *
+ * @module
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Env var skipping the build, for iteration on a known-current binary: `1` or
+ * `true` skips it, any other value (`0`, `false`, empty) builds.
+ */
+export const NO_REBUILD_ENV = 'FUZ_TESTING_NO_REBUILD';
+/**
+ * Whether an `NO_REBUILD_ENV` value asks to skip the build — only an explicit
+ * `1` / `true`, so `FUZ_TESTING_NO_REBUILD=0` still builds.
+ *
+ * @param value - the variable's value, `undefined` when unset
+ */
+export const is_no_rebuild_requested = (value) => value === '1' || value?.toLowerCase() === 'true';
+/**
+ * The directory under the target directory a profile's output lands in —
+ * `debug` for `dev`, the profile's own name otherwise (`release`, a custom
+ * `cross-test`).
+ *
+ * @param profile - the Cargo profile
+ */
+export const to_cargo_profile_dir = (profile) => profile === 'dev' ? 'debug' : profile;
+/**
+ * The binary path `cargo build --profile <profile> --bin <bin>` writes, from
+ * `cargo metadata --no-deps --format-version 1` output.
+ *
+ * @param metadata_json - the `cargo metadata` output
+ * @param bin - the binary's name
+ * @param profile - the Cargo profile
+ * @returns the binary's absolute path
+ * @throws Error when the output carries no `target_directory`
+ */
+export const to_cargo_binary_path = (metadata_json, bin, profile) => {
+    const metadata = JSON.parse(metadata_json);
+    if (typeof metadata.target_directory !== 'string' || !metadata.target_directory) {
+        throw new Error('`cargo metadata` output has no `target_directory`');
+    }
+    return join(metadata.target_directory, to_cargo_profile_dir(profile), bin);
+};
+/**
+ * Per-process memo of each workspace's target directory metadata. On
+ * `globalThis` rather than in module scope, so every project's `globalSetup` in
+ * one vitest process shares it whether or not they share this module's
+ * instance.
+ */
+const CARGO_METADATA_MEMO_KEY = '__fuz_app_cargo_metadata_memo';
+const get_metadata_memo = () => {
+    const holder = globalThis;
+    return (holder[CARGO_METADATA_MEMO_KEY] ??= new Map());
+};
+/**
+ * How long `cargo metadata` may take (ms). Usually well under a second, but
+ * the first run in a checkout can have rustup install the pinned toolchain.
+ */
+const CARGO_METADATA_TIMEOUT_MS = 120_000;
+/**
+ * Throw naming the workspace when its directory is missing — a spawn with a
+ * missing `cwd` otherwise fails as `spawnSync cargo ENOENT`, which reads as
+ * cargo not being installed.
+ */
+const assert_workspace_dir = (workspace_dir) => {
+    if (!existsSync(workspace_dir)) {
+        throw new Error(`the Cargo workspace ${workspace_dir} does not exist`);
+    }
+};
+const read_cargo_metadata = (workspace_dir) => {
+    const memo = get_metadata_memo();
+    let metadata_json = memo.get(workspace_dir);
+    if (metadata_json === undefined) {
+        assert_workspace_dir(workspace_dir);
+        try {
+            metadata_json = execFileSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], {
+                cwd: workspace_dir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'inherit'],
+                maxBuffer: 64 * 1024 * 1024,
+                timeout: CARGO_METADATA_TIMEOUT_MS
+            });
+        }
+        catch (error) {
+            const code = error.code;
+            throw new Error(code === 'ETIMEDOUT'
+                ? `\`cargo metadata\` in ${workspace_dir} took over ${CARGO_METADATA_TIMEOUT_MS}ms`
+                : `\`cargo metadata\` in ${workspace_dir} failed: ${error.message}`, { cause: error });
+        }
+        memo.set(workspace_dir, metadata_json);
+    }
+    return metadata_json;
+};
+/**
+ * The path of a Cargo-built binary, without building it — what a config's
+ * `start_command` names. Runs `cargo metadata` once per process per workspace,
+ * so it needs cargo on PATH.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path
+ * @throws Error when the workspace is missing or `cargo metadata` fails
+ */
+export const resolve_cargo_binary_path = (options) => {
+    const { workspace_dir, package: pkg, bin = pkg, profile = 'dev' } = options;
+    return to_cargo_binary_path(read_cargo_metadata(workspace_dir), bin, profile);
+};
+/**
+ * Build a Cargo binary before its backend spawns, unless `NO_REBUILD_ENV`
+ * asks to skip it, and return its path. The build's output is inherited, so a
+ * cold build shows its progress, and a failed build throws — the project fails
+ * loudly rather than spawning a stale binary. `cargo build` is incremental, so
+ * a build with nothing changed is quick.
+ *
+ * Synchronous: vitest awaits each project's `globalSetup` in turn, so one
+ * invocation selecting several projects builds once, then finds the build
+ * current.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path (`resolve_cargo_binary_path`)
+ * @throws Error when the workspace is missing, the build fails, or `cargo metadata` fails
+ */
+export const prepare_cargo_binary = (options) => {
+    const { workspace_dir, package: pkg, bin = pkg, profile = 'dev' } = options;
+    if (!is_no_rebuild_requested(process.env[NO_REBUILD_ENV])) {
+        assert_workspace_dir(workspace_dir);
+        execFileSync('cargo', ['build', '-p', pkg, '--bin', bin, '--profile', profile], {
+            cwd: workspace_dir,
+            stdio: 'inherit'
+        });
+    }
+    return resolve_cargo_binary_path(options);
+};

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IAggBF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6lBF,CAAC"}