@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/rpc_envelope_cases.d.ts

@@ -0,0 +1,111 @@
+import './assert_dev_env.js';
+import type { z } from 'zod';
+import type { AppSurfaceRpcEndpoint, AppSurfaceRpcMethod } from '../http/surface.js';
+import type { JsonrpcErrorCode, JsonrpcRequestId } from '../http/jsonrpc.js';
+import { type InputTestCase } from './adversarial_input_cases.js';
+/** The request id every envelope case sends where it sends one. */
+export declare const RPC_ENVELOPE_PROBE_ID = "envelope_probe";
+/**
+ * One malformed-envelope request and the refusal it owes.
+ *
+ * Data, so the in-process group here and the cross-process
+ * `describe_rpc_adversarial_cross_tests` run the same set.
+ */
+export interface RpcEnvelopeCase {
+    readonly name: string;
+    /**
+     * Who sends it: the principal `method`'s auth admits, so the envelope check
+     * is what refuses, or no credential at all — the ordering cases, where an
+     * answer of 401 would mean auth ran before the envelope check.
+     */
+    readonly as: 'authorized' | 'anonymous';
+    /** The declared method whose auth picks the principal (`'authorized'`). */
+    readonly method: AppSurfaceRpcMethod;
+    /** A raw POST body, or a GET query string starting with `?`. */
+    readonly request: {
+        readonly verb: 'POST';
+        readonly body: string;
+    } | {
+        readonly verb: 'GET';
+        readonly query: string;
+    };
+    readonly expect: {
+        readonly status: number;
+        readonly code: JsonrpcErrorCode;
+        /** The echoed `id` — `null` where the request carries none the server can read. */
+        readonly id: JsonrpcRequestId | null;
+        /** `error.data.reason` exactly, or `null` to require it absent. */
+        readonly reason: string | null;
+    };
+}
+/** Options for `create_rpc_envelope_cases`. */
+export interface RpcEnvelopeCaseOptions {
+    /** Method names never chosen as a case's method. */
+    readonly skip_methods?: ReadonlyArray<string>;
+}
+/**
+ * The JSON values that are neither an object nor `null`, one per JSON type —
+ * what a `GET` `?params=` can carry that no input schema admits.
+ */
+export declare const RPC_NON_OBJECT_PARAMS: ReadonlyArray<string>;
+/** The `data.reason` the dispatchers answer a `GET` of a `side_effects` method with. */
+export declare const rpc_get_side_effects_reason: (method: string) => string;
+/**
+ * Build the malformed-envelope cases for one RPC endpoint — the dispatcher's
+ * envelope parse, method lookup, and GET read restriction.
+ *
+ * The POST cases and the GET read cases ride the endpoint's first read method
+ * (`side_effects: false`), the GET mutation cases its first mutation that
+ * needs an account. `_testing_*` and protocol methods are never chosen. A case
+ * whose method the endpoint lacks is left out.
+ *
+ * Every read (`side_effects: false`) gets a `GET` with each of
+ * `RPC_NON_OBJECT_PARAMS` → `invalid_params`: the query string is no envelope,
+ * so the dispatcher's params validation is what refuses it.
+ *
+ * Three cases pin an order against auth, sent with no credential: a `GET` of
+ * a mutating method is refused `invalid_request` (the read restriction runs
+ * after the method lookup and before authorization), a batch array is
+ * refused `invalid_request` with `id: null` (the envelope parse runs first,
+ * and batches are unsupported), and a `GET` with non-object params on a
+ * read requiring an identity is the 401 (params validation runs after authorization).
+ *
+ * @param endpoint - the endpoint from the generated surface
+ * @param options - methods never chosen
+ * @returns the cases, in a fixed order
+ */
+export declare const create_rpc_envelope_cases: (endpoint: AppSurfaceRpcEndpoint, options?: RpcEnvelopeCaseOptions) => Array<RpcEnvelopeCase>;
+/**
+ * Build the `RequestInit` + path suffix for an envelope case.
+ *
+ * @param endpoint_path - the RPC endpoint path
+ * @param c - the case
+ * @param headers - auth headers to merge in
+ * @returns the URL (path + query for GET) and the init
+ */
+export declare const to_rpc_envelope_request: (endpoint_path: string, c: RpcEnvelopeCase, headers?: Record<string, string>) => {
+    url: string;
+    init: RequestInit;
+};
+/**
+ * Assert a response body is the refusal an envelope case owes: a well-formed
+ * JSON-RPC error envelope with the case's code, echoed id, and `data.reason`.
+ *
+ * @param status - the response's HTTP status
+ * @param body - the parsed response body
+ * @param c - the case
+ */
+export declare const assert_rpc_envelope_refusal: (status: number, body: unknown, c: RpcEnvelopeCase) => void;
+/**
+ * Generate the schema-invalid params cases for one RPC method's input.
+ *
+ * `generate_input_test_cases` minus its structural cases: a non-object body
+ * is a non-object `params`, which the JSON-RPC envelope refuses
+ * (`invalid_request`) before params validation runs, and the envelope cases
+ * cover it. Every case returned owes 400 `invalid_params`.
+ *
+ * @param input - the method's input schema
+ * @returns the cases, each a `params` object
+ */
+export declare const generate_rpc_params_test_cases: (input: z.ZodType) => Array<InputTestCase>;
+//# sourceMappingURL=rpc_envelope_cases.d.ts.map

package/dist/testing/rpc_envelope_cases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc_envelope_cases.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_envelope_cases.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK7E,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAI7F,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EACb;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,mFAAmF;QACnF,QAAQ,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACrC,mEAAmE;QACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACtC,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAEzF,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,GAAI,QAAQ,MAAM,KAAG,MACL,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,GACrC,UAAU,qBAAqB,EAC/B,UAAS,sBAA2B,KAClC,KAAK,CAAC,eAAe,CAmKvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,eAAe,MAAM,EACrB,GAAG,eAAe,EAClB,UAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAClC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAUgD,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,MAAM,EACd,MAAM,OAAO,EACb,GAAG,eAAe,KAChB,IAUF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAAI,OAAO,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CACU,CAAC"}

package/dist/testing/rpc_envelope_cases.js

@@ -0,0 +1,240 @@
+import './assert_dev_env.js';
+/**
+ * The malformed-envelope and invalid-params cases for a JSON-RPC endpoint, as
+ * data.
+ *
+ * Hono-free, so the in-process `describe_rpc_attack_surface_tests` and the
+ * cross-process `describe_rpc_adversarial_cross_tests` run one set: the
+ * envelope cases (`create_rpc_envelope_cases`) and the per-method params
+ * cases (`generate_rpc_params_test_cases`).
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { is_public_auth } from '../http/auth_shape.js';
+import { JSONRPC_ERROR_CODES } from '../http/jsonrpc_errors.js';
+import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
+import { PROTOCOL_ACTION_METHODS } from '../actions/action_codegen.js';
+import { TESTING_METHOD_PREFIX } from './surface_invariants.js';
+import { assert_jsonrpc_error_response } from './rpc_helpers.js';
+import { generate_input_test_cases } from './adversarial_input_cases.js';
+const PROTOCOL_METHODS = new Set(PROTOCOL_ACTION_METHODS);
+/** The request id every envelope case sends where it sends one. */
+export const RPC_ENVELOPE_PROBE_ID = 'envelope_probe';
+/**
+ * The JSON values that are neither an object nor `null`, one per JSON type —
+ * what a `GET` `?params=` can carry that no input schema admits.
+ */
+export const RPC_NON_OBJECT_PARAMS = ['42', '[1]', '"x"', 'true'];
+/** The `data.reason` the dispatchers answer a `GET` of a `side_effects` method with. */
+export const rpc_get_side_effects_reason = (method) => `method '${method}' has side effects and must use POST`;
+/**
+ * Build the malformed-envelope cases for one RPC endpoint — the dispatcher's
+ * envelope parse, method lookup, and GET read restriction.
+ *
+ * The POST cases and the GET read cases ride the endpoint's first read method
+ * (`side_effects: false`), the GET mutation cases its first mutation that
+ * needs an account. `_testing_*` and protocol methods are never chosen. A case
+ * whose method the endpoint lacks is left out.
+ *
+ * Every read (`side_effects: false`) gets a `GET` with each of
+ * `RPC_NON_OBJECT_PARAMS` → `invalid_params`: the query string is no envelope,
+ * so the dispatcher's params validation is what refuses it.
+ *
+ * Three cases pin an order against auth, sent with no credential: a `GET` of
+ * a mutating method is refused `invalid_request` (the read restriction runs
+ * after the method lookup and before authorization), a batch array is
+ * refused `invalid_request` with `id: null` (the envelope parse runs first,
+ * and batches are unsupported), and a `GET` with non-object params on a
+ * read requiring an identity is the 401 (params validation runs after authorization).
+ *
+ * @param endpoint - the endpoint from the generated surface
+ * @param options - methods never chosen
+ * @returns the cases, in a fixed order
+ */
+export const create_rpc_envelope_cases = (endpoint, options = {}) => {
+    const skip = new Set(options.skip_methods);
+    const eligible = endpoint.methods.filter((m) => !m.name.startsWith(TESTING_METHOD_PREFIX) &&
+        !PROTOCOL_METHODS.has(m.name) &&
+        !skip.has(m.name));
+    const read = eligible.find((m) => !m.side_effects);
+    const mutation = eligible.find((m) => m.side_effects && !is_public_auth(m.auth));
+    const id = RPC_ENVELOPE_PROBE_ID;
+    const cases = [];
+    if (read) {
+        const post = (name, body, expect) => {
+            cases.push({ name, as: 'authorized', method: read, request: { verb: 'POST', body }, expect });
+        };
+        const get = (name, query, expect) => {
+            cases.push({ name, as: 'authorized', method: read, request: { verb: 'GET', query }, expect });
+        };
+        const invalid_request = { status: 400, code: JSONRPC_ERROR_CODES.invalid_request };
+        const m = read.name;
+        const q = encodeURIComponent;
+        post('non-JSON body → parse_error', 'not-json', {
+            status: 400,
+            code: JSONRPC_ERROR_CODES.parse_error,
+            id: null,
+            reason: null
+        });
+        post('wrong jsonrpc version → invalid_request', JSON.stringify({ jsonrpc: '1.0', id, method: m }), { ...invalid_request, id, reason: null });
+        post('missing jsonrpc field → invalid_request', JSON.stringify({ id, method: m }), {
+            ...invalid_request,
+            id,
+            reason: null
+        });
+        post('missing method field → invalid_request', JSON.stringify({ jsonrpc: '2.0', id }), {
+            ...invalid_request,
+            id,
+            reason: null
+        });
+        post('missing id field → invalid_request', JSON.stringify({ jsonrpc: '2.0', method: m }), {
+            ...invalid_request,
+            id: null,
+            reason: null
+        });
+        post('batch (array) body → invalid_request', JSON.stringify([{ jsonrpc: '2.0', id, method: m }]), { ...invalid_request, id: null, reason: null });
+        post('unknown method name → method_not_found', JSON.stringify({ jsonrpc: '2.0', id, method: '__nonexistent_method__' }), { status: 404, code: JSONRPC_ERROR_CODES.method_not_found, id, reason: null });
+        get('GET missing method → invalid_request', `?id=${id}`, {
+            ...invalid_request,
+            id: null,
+            reason: 'missing method query parameter'
+        });
+        get('GET missing id → invalid_request', `?method=${q(m)}`, {
+            ...invalid_request,
+            id: null,
+            reason: 'missing id query parameter'
+        });
+        get('GET invalid JSON params → invalid_params', `?method=${q(m)}&id=${id}&params=not-json`, {
+            status: 400,
+            code: JSONRPC_ERROR_CODES.invalid_params,
+            id,
+            reason: null
+        });
+        // a present non-object `params` fails the envelope schema on POST
+        post('POST non-object params → invalid_request', JSON.stringify({ jsonrpc: '2.0', id, method: m, params: 42 }), { ...invalid_request, id, reason: null });
+    }
+    // The GET query string is no envelope, so a non-object `params` reaches the
+    // dispatcher's params validation — on every read, since a spine that decodes
+    // params per handler can drift on any of them.
+    for (const r of eligible) {
+        if (r.side_effects)
+            continue;
+        for (const value of RPC_NON_OBJECT_PARAMS) {
+            cases.push({
+                name: `GET non-object params (${value}) → invalid_params: ${r.name}`,
+                as: 'authorized',
+                method: r,
+                request: {
+                    verb: 'GET',
+                    query: `?method=${encodeURIComponent(r.name)}&id=${id}&params=${encodeURIComponent(value)}`
+                },
+                expect: { status: 400, code: JSONRPC_ERROR_CODES.invalid_params, id, reason: null }
+            });
+        }
+    }
+    // params validation runs after authorization: an anonymous non-object
+    // `params` hears the 401 of any anonymous call, not a 400 about its input.
+    // The read must require an identity — an identity-optional one admits the
+    // anonymous caller, whose params validation then refuses
+    const protected_read = eligible.find((r) => !r.side_effects && (r.auth.account === 'required' || r.auth.actor === 'required'));
+    if (protected_read) {
+        cases.push({
+            name: 'ordering: anonymous GET non-object params → 401, not invalid_params',
+            as: 'anonymous',
+            method: protected_read,
+            request: {
+                verb: 'GET',
+                query: `?method=${encodeURIComponent(protected_read.name)}&id=${id}&params=42`
+            },
+            expect: {
+                status: 401,
+                code: JSONRPC_ERROR_CODES.unauthenticated,
+                id,
+                reason: ERROR_AUTHENTICATION_REQUIRED
+            }
+        });
+    }
+    if (mutation) {
+        const query = `?method=${encodeURIComponent(mutation.name)}&id=${id}`;
+        const expect = {
+            status: 400,
+            code: JSONRPC_ERROR_CODES.invalid_request,
+            id,
+            reason: rpc_get_side_effects_reason(mutation.name)
+        };
+        cases.push({
+            name: 'GET mutation method → invalid_request (side effects)',
+            as: 'authorized',
+            method: mutation,
+            request: { verb: 'GET', query },
+            expect
+        });
+        cases.push({
+            name: 'ordering: anonymous GET mutation method → invalid_request, not 401',
+            as: 'anonymous',
+            method: mutation,
+            request: { verb: 'GET', query },
+            expect
+        });
+        cases.push({
+            name: 'ordering: anonymous batch (array) body → invalid_request, not 401',
+            as: 'anonymous',
+            method: mutation,
+            request: {
+                verb: 'POST',
+                body: JSON.stringify([{ jsonrpc: '2.0', id, method: mutation.name }])
+            },
+            expect: { status: 400, code: JSONRPC_ERROR_CODES.invalid_request, id: null, reason: null }
+        });
+    }
+    return cases;
+};
+/**
+ * Build the `RequestInit` + path suffix for an envelope case.
+ *
+ * @param endpoint_path - the RPC endpoint path
+ * @param c - the case
+ * @param headers - auth headers to merge in
+ * @returns the URL (path + query for GET) and the init
+ */
+export const to_rpc_envelope_request = (endpoint_path, c, headers = {}) => c.request.verb === 'POST'
+    ? {
+        url: endpoint_path,
+        init: {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...headers },
+            body: c.request.body
+        }
+    }
+    : { url: `${endpoint_path}${c.request.query}`, init: { method: 'GET', headers } };
+/**
+ * Assert a response body is the refusal an envelope case owes: a well-formed
+ * JSON-RPC error envelope with the case's code, echoed id, and `data.reason`.
+ *
+ * @param status - the response's HTTP status
+ * @param body - the parsed response body
+ * @param c - the case
+ */
+export const assert_rpc_envelope_refusal = (status, body, c) => {
+    const detail = `${c.name}: got ${status} ${JSON.stringify(body)}`;
+    assert.strictEqual(status, c.expect.status, detail);
+    assert_jsonrpc_error_response(body, c.expect.code);
+    const envelope = body;
+    assert.strictEqual(envelope.id, c.expect.id, `${detail} — echoed id`);
+    const data = envelope.error.data;
+    const reason = typeof data === 'object' && data !== null ? data.reason : undefined;
+    assert.strictEqual(reason ?? null, c.expect.reason, `${detail} — data.reason`);
+};
+/**
+ * Generate the schema-invalid params cases for one RPC method's input.
+ *
+ * `generate_input_test_cases` minus its structural cases: a non-object body
+ * is a non-object `params`, which the JSON-RPC envelope refuses
+ * (`invalid_request`) before params validation runs, and the envelope cases
+ * cover it. Every case returned owes 400 `invalid_params`.
+ *
+ * @param input - the method's input schema
+ * @returns the cases, each a `params` object
+ */
+export const generate_rpc_params_test_cases = (input) => generate_input_test_cases(input).filter((tc) => tc.expected_error !== ERROR_INVALID_JSON_BODY);

package/dist/testing/rpc_helpers.d.ts

@@ -156,6 +156,37 @@ export interface RpcCallArgs {
      */
     suppress_default_origin?: boolean;
 }
+/**
+ * The unparsed response `rpc_call_raw` returns: the HTTP status, the
+ * response-headers snapshot (lowercased keys), and the JSON body exactly as
+ * the server sent it — the whole envelope, `jsonrpc` and `id` included.
+ */
+export interface RpcCallRawResult {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+/**
+ * Send one JSON-RPC request the way `rpc_call` does — same defaults, verbs
+ * and header merging — and return the response unparsed.
+ *
+ * For callers that compare whole bodies (the cross-backend differential),
+ * where `rpc_call`'s envelope parse would hide anything outside `result` /
+ * `error`.
+ *
+ * @throws Error if the response body is not JSON
+ */
+export declare const rpc_call_raw: (args: RpcCallArgs) => Promise<RpcCallRawResult>;
+/**
+ * Parse a raw JSON-RPC response into `rpc_call`'s discriminated result.
+ *
+ * @param raw - the response `rpc_call_raw` returned
+ * @param method - the method called, for the error message
+ * @returns the success or error branch
+ * @throws Error if the body is neither a valid `JsonrpcResponse` nor
+ *   `JsonrpcErrorResponse` envelope
+ */
+export declare const parse_rpc_call_result: (raw: RpcCallRawResult, method: string) => RpcCallResult;
 /**
  * One-shot JSON-RPC call over a Hono app.
  *

package/dist/testing/rpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EACX,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAClC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAa1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9E;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,UAAU,GACnB;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAAE,GAC/E,gBAAgB,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,GAAG,EAAE,UAAU,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAgCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAyD,CAAC;AAElF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAE,GAC/F;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAoBrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAkBX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,SAOxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG,SAOvD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAcF,CAAC"}
+{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EACX,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAClC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAa1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9E;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,UAAU,GACnB;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAAE,GAC/E,gBAAgB,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,GAAG,EAAE,UAAU,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAgCD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,gBAAgB,CAiC9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,KAAK,gBAAgB,EAAE,QAAQ,MAAM,KAAG,aAwB7E,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CACX,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAyD,CAAC;AAElF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAE,GAC/F;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAoBrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAkBX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,SAOxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG,SAOvD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAcF,CAAC"}

package/dist/testing/rpc_helpers.js

@@ -169,18 +169,16 @@ const RPC_CALL_DEFAULT_HEADERS = {
     origin: 'http://localhost:5173'
 };
 /**
- * One-shot JSON-RPC call over a Hono app.
+ * Send one JSON-RPC request the way `rpc_call` does — same defaults, verbs
+ * and header merging — and return the response unparsed.
  *
- * Merges sensible defaults (`host`, `origin`, `Content-Type`) under
- * caller-provided headers, fires POST (default) or GET, parses the envelope,
- * and returns a discriminated result.
+ * For callers that compare whole bodies (the cross-backend differential),
+ * where `rpc_call`'s envelope parse would hide anything outside `result` /
+ * `error`.
  *
- * @throws Error if the response body is neither a valid `JsonrpcResponse`
- *   nor `JsonrpcErrorResponse` envelope — protocol-level failures the caller
- *   should never tolerate. All JSON-RPC errors come back via `{ok: false, error}`
- *   so assertions can focus on `error.code` / `error.data.reason`.
+ * @throws Error if the response body is not JSON
  */
-export const rpc_call = async (args) => {
+export const rpc_call_raw = async (args) => {
     const { app, path, method, params, headers, id = 'test', verb = 'POST', suppress_default_origin } = args;
     const defaults = suppress_default_origin
         ? RPC_CALL_DEFAULT_HEADERS_BASE
@@ -201,19 +199,29 @@ export const rpc_call = async (args) => {
         };
     }
     const res = await (typeof app === 'function' ? app(url, init) : app.request(url, init));
-    const status = res.status;
-    const response_headers = headers_to_record(res.headers);
-    const body = await res.json();
+    return { status: res.status, headers: headers_to_record(res.headers), body: await res.json() };
+};
+/**
+ * Parse a raw JSON-RPC response into `rpc_call`'s discriminated result.
+ *
+ * @param raw - the response `rpc_call_raw` returned
+ * @param method - the method called, for the error message
+ * @returns the success or error branch
+ * @throws Error if the body is neither a valid `JsonrpcResponse` nor
+ *   `JsonrpcErrorResponse` envelope
+ */
+export const parse_rpc_call_result = (raw, method) => {
+    const { status, headers, body } = raw;
     const success = JsonrpcResponse.safeParse(body);
     if (success.success) {
-        return { ok: true, status, headers: response_headers, result: success.data.result };
+        return { ok: true, status, headers, result: success.data.result };
     }
     const error = JsonrpcErrorResponse.safeParse(body);
     if (error.success) {
         return {
             ok: false,
             status,
-            headers: response_headers,
+            headers,
             error: {
                 code: error.data.error.code,
                 message: error.data.error.message,
@@ -223,6 +231,19 @@ export const rpc_call = async (args) => {
     }
     throw new Error(`rpc_call: response is not a valid JSON-RPC envelope (method=${method}, status=${status}): ${JSON.stringify(body)}`);
 };
+/**
+ * One-shot JSON-RPC call over a Hono app.
+ *
+ * Merges sensible defaults (`host`, `origin`, `Content-Type`) under
+ * caller-provided headers, fires POST (default) or GET, parses the envelope,
+ * and returns a discriminated result.
+ *
+ * @throws Error if the response body is neither a valid `JsonrpcResponse`
+ *   nor `JsonrpcErrorResponse` envelope — protocol-level failures the caller
+ *   should never tolerate. All JSON-RPC errors come back via `{ok: false, error}`
+ *   so assertions can focus on `error.code` / `error.data.reason`.
+ */
+export const rpc_call = async (args) => parse_rpc_call_result(await rpc_call_raw(args), args.method);
 /**
  * Same as `rpc_call` but without the default `origin` header. Use for
  * bearer-auth probes: `bearer_auth` discards the token when Origin or

package/dist/testing/rpc_round_trip.d.ts

@@ -1,6 +1,8 @@
 import './assert_dev_env.js';
-import type { AppSurfaceSpec } from '../http/surface.js';
+import type { TestAccount } from './app_server.js';
+import type { AppSurfaceSpec, AppSurfaceRpcMethod } from '../http/surface.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
+import { type AuthPrincipal, type KeeperHeaderProvider } from './integration_helpers.js';
 import type { SetupTest, TestFixture } from './cross_backend/setup.js';
 import type { SessionOptions } from '../auth/session_cookie.js';
 /** Options for `describe_rpc_round_trip_tests`. */
@@ -51,9 +53,58 @@ export interface RpcRoundTripTestOptions {
      *
      * Fired as POST. The factory runs against the shared per-describe fixture,
      * so it must not assume a clean slate between entries (seed unique state).
+     * By default the request carries the identity the generic loop picks for
+     * the method's auth (`authed` / `admin` / keeper); a case that returns
+     * `headers` sends those instead — for methods whose row must belong to the
+     * caller (revoking one's own token or session, retracting one's own offer).
+     * `create_spine_rpc_success_fixtures` (`cross_backend/rpc_success_fixtures.ts`)
+     * builds the map for the standard spine methods.
      */
-    success_fixtures?: Map<string, (fixture: TestFixture) => Promise<Record<string, unknown>>>;
+    success_fixtures?: RpcSuccessFixtures;
 }
+/** One success-fixture request: the params, and optionally the caller's headers. */
+export interface RpcSuccessFixtureCase {
+    /** Params that drive a success response. */
+    params: Record<string, unknown>;
+    /**
+     * Auth headers to send in place of the identity the suite picks from the
+     * method's auth — for a row that only its owner may act on.
+     */
+    headers?: Record<string, string>;
+}
+/** One success-fixture factory: builds the row against the per-test fixture, then returns the request. */
+export type RpcSuccessFixture = (fixture: TestFixture) => Promise<RpcSuccessFixtureCase>;
+/** Success-case fixtures, method name → async factory. See `RpcRoundTripTestOptions.success_fixtures`. */
+export type RpcSuccessFixtures = Map<string, RpcSuccessFixture>;
+/** A picked principal and the headers that carry its credential. */
+export interface RpcRoundTripAuth {
+    principal: AuthPrincipal;
+    headers: Record<string, string>;
+}
+/**
+ * Pick the principal matching an RPC method's auth requirement
+ * (`pick_auth_principal`, shared with the REST round-trip), and the headers
+ * carrying its credential. Accepts any `KeeperHeaderProvider` — both `TestApp`
+ * (in-process) and `TestFixture` (cross-backend) satisfy the shape
+ * structurally.
+ */
+export declare const pick_rpc_auth: (method: AppSurfaceRpcMethod, keeper: KeeperHeaderProvider, authed_account: TestAccount, admin_account: TestAccount) => RpcRoundTripAuth;
+/**
+ * Guard against a refusal that says the call carried no valid credential
+ * when it carried one (`is_unauthenticated_refusal`). The round-trip sends
+ * every non-public method a live credential its auth admits, so such a 401
+ * means the backend failed to authenticate it — most often because an earlier
+ * call destroyed it (a self-delete, a revoke-all), which would turn every
+ * later method's coverage into a vacuous refusal. A public method may still
+ * answer 401 (a login with a wrong password), and so may a handler refusing
+ * an authenticated call with a reason of its own (`invalid_credentials`).
+ *
+ * @param method - the RPC method name
+ * @param status - the HTTP status
+ * @param body - the parsed response body (or raw text when not JSON)
+ * @param principal - the principal the call was sent as
+ */
+export declare const assert_rpc_authenticated: (method: string, status: number, body: unknown, principal: AuthPrincipal) => void;
 /**
  * Run schema-driven round-trip validation for RPC endpoints.
  *
@@ -66,10 +117,15 @@ export interface RpcRoundTripTestOptions {
  *
  * Error responses (from missing DB state, etc.) are expected and validated
  * as well-formed JSON-RPC errors. Successful responses are validated against
- * `action.spec.output`. A `method not found` (-32601) error is the one
- * exception — it means the backend is missing a method the local surface
- * advertises, so the round-trip fails loud (`assert_method_implemented`)
- * rather than accepting it as a valid error envelope.
+ * `action.spec.output`. Two error classes fail loud instead of passing as a
+ * valid envelope: `method not found` (-32601) means the backend is missing a
+ * method the local surface advertises (`assert_method_implemented`), and a
+ * crash — HTTP 500, `internal_error` (-32603), or a ≥500 with no JSON-RPC
+ * envelope — means the backend failed on schema-valid input
+ * (`assert_not_crash`). A declared ≥500 code (`service_unavailable`,
+ * `timeout`) passes as a refusal. A method the suite can't drive generically
+ * goes in `skip_methods`; one whose generated params can't reach its handler
+ * gets an `input_overrides` entry.
  */
 export declare const describe_rpc_round_trip_tests: (options: RpcRoundTripTestOptions) => void;
 //# sourceMappingURL=rpc_round_trip.d.ts.map

package/dist/testing/rpc_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAyB7B,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA+JhF,CAAC"}
+{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAQN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAKN,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACrC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,0GAA0G;AAC1G,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEzF,0GAA0G;AAC1G,MAAM,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAEhE,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GACzB,QAAQ,mBAAmB,EAC3B,QAAQ,oBAAoB,EAC5B,gBAAgB,WAAW,EAC3B,eAAe,WAAW,KACxB,gBAMF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,QAAQ,MAAM,EACd,QAAQ,MAAM,EACd,MAAM,OAAO,EACb,WAAW,aAAa,KACtB,IAiBF,CAAC;AA+GF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IAiKhF,CAAC"}