@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/rpc_round_trip.js

@@ -9,38 +9,72 @@ import './assert_dev_env.js';
  * fixture-producing callback.
  *
  * Cadence: per-describe `setup_test()` call (see `testing/round_trip.ts` module
- * docstring). RPC round-trip tests fire one JSON-RPC envelope per
- * method-direction and don't mutate state in a way that contaminates the
- * next case.
+ * docstring). The generic POST and GET cases fire one JSON-RPC envelope per
+ * method-direction against shared principals (an authed account, an admin
+ * account, the keeper). A side-effecting method called as the authed account
+ * runs on a fresh account of its own (`round_trip_uses_fresh_account`):
+ * the generated params of a self-targeting method act on the caller — an
+ * `account_delete` with no `account_id` deletes it, an
+ * `account_session_revoke_all` ends its session — and on the shared account
+ * that would leave every later call refused as unauthenticated. A 401 to any
+ * non-public call fails (`assert_rpc_authenticated`), so a credential lost
+ * some other way goes red rather than vacuous. The `success_fixtures` case
+ * also mutates — each fixture builds a row and the call revokes, deletes, or
+ * decides it — so it runs last on the describe's fixture, and each factory
+ * seeds its own rows.
  *
  * @module
  */
 import { describe, test, beforeAll, assert } from 'vitest';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
-import { JSONRPC_METHOD_NOT_FOUND, JsonrpcErrorResponse } from '../http/jsonrpc.js';
+import { JSONRPC_INTERNAL_ERROR, JSONRPC_METHOD_NOT_FOUND, JsonrpcErrorResponse } from '../http/jsonrpc.js';
+import { JSONRPC_ERROR_CODE_TO_HTTP_STATUS } from '../http/jsonrpc_errors.js';
 import { generate_valid_body } from './schema_generators.js';
-import { is_public_auth } from '../http/auth_shape.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, assert_jsonrpc_success_response, resolve_rpc_endpoints_for_setup, find_rpc_action, find_rpc_method } from './rpc_helpers.js';
+import { is_unauthenticated_refusal, pick_auth_principal, round_trip_uses_fresh_account, to_principal_headers } from './integration_helpers.js';
 /**
- * Pick auth headers matching an RPC method's auth requirement. Accepts
- * any `KeeperHeaderProvider` — both `TestApp` (in-process) and
- * `TestFixture` (cross-backend) satisfy the shape structurally.
+ * Pick the principal matching an RPC method's auth requirement
+ * (`pick_auth_principal`, shared with the REST round-trip), and the headers
+ * carrying its credential. Accepts any `KeeperHeaderProvider` — both `TestApp`
+ * (in-process) and `TestFixture` (cross-backend) satisfy the shape
+ * structurally.
  */
-const pick_rpc_auth_headers = (method, keeper, authed_account, admin_account) => {
-    const { auth } = method;
-    if (is_public_auth(auth)) {
-        return { host: 'localhost', origin: 'http://localhost:5173' };
-    }
-    if (auth.credential_types?.includes('daemon_token')) {
-        return keeper.create_daemon_token_headers();
-    }
-    if (auth.roles?.length) {
-        if (auth.roles.includes(ROLE_ADMIN)) {
-            return admin_account.create_session_headers();
-        }
-        return keeper.create_session_headers();
-    }
-    return authed_account.create_session_headers();
+export const pick_rpc_auth = (method, keeper, authed_account, admin_account) => {
+    const principal = pick_auth_principal(method.auth);
+    return {
+        principal,
+        headers: to_principal_headers(principal, keeper, authed_account, admin_account)
+    };
+};
+/**
+ * Guard against a refusal that says the call carried no valid credential
+ * when it carried one (`is_unauthenticated_refusal`). The round-trip sends
+ * every non-public method a live credential its auth admits, so such a 401
+ * means the backend failed to authenticate it — most often because an earlier
+ * call destroyed it (a self-delete, a revoke-all), which would turn every
+ * later method's coverage into a vacuous refusal. A public method may still
+ * answer 401 (a login with a wrong password), and so may a handler refusing
+ * an authenticated call with a reason of its own (`invalid_credentials`).
+ *
+ * @param method - the RPC method name
+ * @param status - the HTTP status
+ * @param body - the parsed response body (or raw text when not JSON)
+ * @param principal - the principal the call was sent as
+ */
+export const assert_rpc_authenticated = (method, status, body, principal) => {
+    if (principal === 'public')
+        return;
+    const parsed = JsonrpcErrorResponse.safeParse(body);
+    const data = parsed.success ? parsed.data.error.data : undefined;
+    const reason = data !== null && typeof data === 'object' ? data.reason : undefined;
+    if (!is_unauthenticated_refusal(status, reason))
+        return;
+    const detail = parsed.success
+        ? `code ${parsed.data.error.code}, message ${JSON.stringify(parsed.data.error.message)}${data === undefined ? '' : `, data ${JSON.stringify(data)}`}`
+        : `body ${typeof body === 'string' ? body.slice(0, 500) : JSON.stringify(body).slice(0, 500)}`;
+    assert.fail(`method '${method}' answered 401 to the ${principal} principal's credential (${detail})` +
+        ' — the call carried a credential its auth admits, so the backend owed an' +
+        ' authenticated answer; a 401 here means that credential stopped working');
 };
 /**
  * Guard against silent parity gaps: a method enumerated from the local action
@@ -62,6 +96,76 @@ const assert_method_implemented = (method, body) => {
             ` returned method-not-found — backend is missing this method (parity gap)`);
     }
 };
+/**
+ * Read a response body as JSON, falling back to the raw text — a crashed
+ * backend may answer with a non-JSON body (an HTML or plain-text 500), and
+ * the round-trip must report that response, not a JSON parse error with no
+ * method attached.
+ */
+const read_rpc_body = async (res) => {
+    const text = await res.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+};
+/** The HTTP status an `internal_error` maps to, read off the shared status table. */
+const INTERNAL_ERROR_HTTP_STATUS = JSONRPC_ERROR_CODE_TO_HTTP_STATUS[JSONRPC_INTERNAL_ERROR];
+/**
+ * Guard against a backend that crashes on schema-valid input. A response is
+ * a crash when any of these holds:
+ *
+ * - its HTTP status is the one `internal_error` maps to (500) — what an
+ *   uncaught throw and an unmapped error code both answer
+ * - its JSON-RPC code is `internal_error` (-32603)
+ * - its status is ≥500 and its body is not a well-formed JSON-RPC error
+ *   envelope (an HTML or plain-text crash page)
+ *
+ * Any other ≥500 that carries a well-formed envelope with a declared code
+ * passes like a 4xx: `service_unavailable` (503), `timeout` (504), or a
+ * consumer's own code mapped in `JSONRPC_ERROR_CODE_TO_HTTP_STATUS` (a 502).
+ * Those are server conditions a handler declares on purpose — a dependency
+ * the test environment doesn't provide — while an undeclared 500 or -32603
+ * is a handler that failed where it owed an answer.
+ *
+ * @param method - the RPC method name
+ * @param status - the HTTP status
+ * @param body - the parsed response body (or raw text when not JSON)
+ * @param expected - what the call owed: a refusal (the generic nil-id loop)
+ *   or a success (a declared success fixture), for the failure message
+ */
+const assert_not_crash = (method, status, body, expected) => {
+    const parsed = JsonrpcErrorResponse.safeParse(body);
+    const code = parsed.success ? parsed.data.error.code : null;
+    const crashed = parsed.success
+        ? status === INTERNAL_ERROR_HTTP_STATUS || code === JSONRPC_INTERNAL_ERROR
+        : status >= 500;
+    if (!crashed)
+        return;
+    const message = parsed.success
+        ? parsed.data.error.message
+        : typeof body === 'string'
+            ? body.slice(0, 500)
+            : JSON.stringify(body).slice(0, 500);
+    assert.fail(`method '${method}' crashed on ${expected === 'success' ? 'its success fixture' : 'schema-valid params'} (status ${status}, code ${code ?? 'none'}, message ${JSON.stringify(message)})` +
+        (expected === 'success'
+            ? ' — the fixture built a real row, so the backend owed a success here'
+            : ' — the backend owes a declared refusal here (a 4xx, or a declared 5xx code)'));
+};
+/**
+ * Assert a non-ok response is an acceptable refusal: the method exists, the
+ * failure is not a crash (`assert_not_crash`), an authenticated call was not
+ * refused as unauthenticated (`assert_rpc_authenticated`), and the body is a
+ * well-formed JSON-RPC error envelope.
+ */
+const assert_rpc_refusal = (method, status, body, principal) => {
+    assert_method_implemented(method, body);
+    assert_not_crash(method, status, body, 'refusal');
+    assert_rpc_authenticated(method, status, body, principal);
+    assert_jsonrpc_error_response(body);
+};
 /**
  * Run schema-driven round-trip validation for RPC endpoints.
  *
@@ -74,10 +178,15 @@ const assert_method_implemented = (method, body) => {
  *
  * Error responses (from missing DB state, etc.) are expected and validated
  * as well-formed JSON-RPC errors. Successful responses are validated against
- * `action.spec.output`. A `method not found` (-32601) error is the one
- * exception — it means the backend is missing a method the local surface
- * advertises, so the round-trip fails loud (`assert_method_implemented`)
- * rather than accepting it as a valid error envelope.
+ * `action.spec.output`. Two error classes fail loud instead of passing as a
+ * valid envelope: `method not found` (-32601) means the backend is missing a
+ * method the local surface advertises (`assert_method_implemented`), and a
+ * crash — HTTP 500, `internal_error` (-32603), or a ≥500 with no JSON-RPC
+ * envelope — means the backend failed on schema-valid input
+ * (`assert_not_crash`). A declared ≥500 code (`service_unavailable`,
+ * `timeout`) passes as a refusal. A method the suite can't drive generically
+ * goes in `skip_methods`; one whose generated params can't reach its handler
+ * gets an `input_overrides` entry.
  */
 export const describe_rpc_round_trip_tests = (options) => {
     const skip_set = new Set(options.skip_methods);
@@ -116,18 +225,20 @@ export const describe_rpc_round_trip_tests = (options) => {
                         continue;
                     const override = options.input_overrides?.get(action.spec.method);
                     const params = override ?? generate_valid_body(action.spec.input) ?? null;
-                    const headers = pick_rpc_auth_headers(surface_method, fixture, authed_account, admin_account);
+                    const picked = pick_rpc_auth(surface_method, fixture, authed_account, admin_account);
+                    const { principal, headers } = round_trip_uses_fresh_account(picked.principal, action.spec.side_effects)
+                        ? pick_rpc_auth(surface_method, fixture, await fixture.create_account({ roles: [] }), admin_account)
+                        : picked;
                     const init = create_rpc_post_init(action.spec.method, params);
                     Object.assign(init.headers, headers);
                     const res = await fixture.transport(ep_spec.path, init);
-                    const body = await res.json();
+                    const body = await read_rpc_body(res);
                     try {
                         if (res.ok) {
                             assert_jsonrpc_success_response(body, action.spec.output);
                         }
                         else {
-                            assert_method_implemented(action.spec.method, body);
-                            assert_jsonrpc_error_response(body);
+                            assert_rpc_refusal(action.spec.method, res.status, body, principal);
                         }
                     }
                     catch (e) {
@@ -150,17 +261,16 @@ export const describe_rpc_round_trip_tests = (options) => {
                         continue;
                     const override = options.input_overrides?.get(action.spec.method);
                     const params = override ?? generate_valid_body(action.spec.input) ?? undefined;
-                    const headers = pick_rpc_auth_headers(surface_method, fixture, authed_account, admin_account);
+                    const { principal, headers } = pick_rpc_auth(surface_method, fixture, authed_account, admin_account);
                     const url = create_rpc_get_url(ep_spec.path, action.spec.method, params);
                     const res = await fixture.transport(url, { headers });
-                    const body = await res.json();
+                    const body = await read_rpc_body(res);
                     try {
                         if (res.ok) {
                             assert_jsonrpc_success_response(body, action.spec.output);
                         }
                         else {
-                            assert_method_implemented(action.spec.method, body);
-                            assert_jsonrpc_error_response(body);
+                            assert_rpc_refusal(action.spec.method, res.status, body, principal);
                         }
                     }
                     catch (e) {
@@ -178,14 +288,16 @@ export const describe_rpc_round_trip_tests = (options) => {
                 assert.ok(located, `success_fixtures references unknown RPC method '${method}'`);
                 const surface = find_rpc_method(surface_rpc_endpoints, method);
                 assert.ok(surface, `success_fixtures method '${method}' missing from generated surface`);
-                const params = await build(fixture);
-                const headers = pick_rpc_auth_headers(surface.method_spec, fixture, authed_account, admin_account);
-                const init = create_rpc_post_init(method, params);
+                const fixture_case = await build(fixture);
+                const headers = fixture_case.headers ??
+                    pick_rpc_auth(surface.method_spec, fixture, authed_account, admin_account).headers;
+                const init = create_rpc_post_init(method, fixture_case.params);
                 Object.assign(init.headers, headers);
                 const res = await fixture.transport(located.path, init);
-                const body = await res.json();
+                const body = await read_rpc_body(res);
                 try {
                     assert_method_implemented(method, body);
+                    assert_not_crash(method, res.status, body, 'success');
                     assert.ok(res.ok, `success fixture expected a success response, got status ${res.status}: ${JSON.stringify(body)}`);
                     assert_jsonrpc_success_response(body, located.action.spec.output);
                 }

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,WAAW,CAAC;AAInB;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MACL,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,WAAW,CAAC;AAInB;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OA8GnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MACL,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}

package/dist/testing/schema_generators.js

@@ -174,8 +174,28 @@ export const generate_valid_value = (field, field_schema) => {
                 return '2020-01-01T00:00:00.000Z';
             return generate_valid_string(field_schema);
         case 'number':
-        case 'int':
-            return 1;
+        case 'int': {
+            // 1, unless the schema's bounds rule it out (`.negative()`, `.min(10)`)
+            for (const candidate of [1, -1, 0]) {
+                if (field_schema.safeParse(candidate).success)
+                    return candidate;
+            }
+            try {
+                const json = z.toJSONSchema(field_schema);
+                if (typeof json.minimum === 'number')
+                    return Math.ceil(json.minimum);
+                if (typeof json.exclusiveMinimum === 'number')
+                    return Math.floor(json.exclusiveMinimum) + 1;
+                if (typeof json.maximum === 'number')
+                    return Math.floor(json.maximum);
+                if (typeof json.exclusiveMaximum === 'number')
+                    return Math.ceil(json.exclusiveMaximum) - 1;
+            }
+            catch {
+                // no bounds to read
+            }
+            return 1; // fall through — generate_valid_body will report the failure
+        }
         case 'boolean':
             return true;
         case 'array': {

package/dist/testing/standard.d.ts

@@ -21,6 +21,7 @@ import type { RoleSchemaResult } from '../auth/role_schema.js';
 import type { BootstrapServerOptions } from '../server/app_server.js';
 import type { AppServerContext } from '../server/app_server_context.js';
 import type { RouteSpec } from '../http/route_spec.js';
+import { type RpcSuccessFixtures } from './rpc_round_trip.js';
 import type { RpcEndpointsSuiteOption } from './rpc_helpers.js';
 import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest } from './cross_backend/setup.js';
@@ -85,6 +86,31 @@ export interface StandardTestOptions {
     error_coverage_min?: number;
     /** Override the bootstrap-success suite's synthetic token. */
     bootstrap_token?: string;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `success_fixtures`
+     * (method name → async params factory) — drives a populated **success**
+     * body for methods that act on an existing row, validated against the
+     * method's `output` schema. `create_spine_rpc_success_fixtures`
+     * (`cross_backend/rpc_success_fixtures.ts`) builds the map for the
+     * standard spine methods. See `RpcRoundTripTestOptions.success_fixtures`.
+     */
+    rpc_success_fixtures?: RpcSuccessFixtures;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `skip_methods` — the
+     * consumer escape hatch for a method the generic round-trip can't drive at
+     * all (a handler whose test wiring stubs out the deps it reaches, or reads
+     * tables the suite's database doesn't migrate). Each entry hides the
+     * method from both the crash check and the envelope check, so name the
+     * reason beside it.
+     */
+    rpc_skip_methods?: Array<string>;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `input_overrides`
+     * (method name → params) — for a method whose generated params can't
+     * reach its handler cleanly. The response is held to the same rules as a
+     * generated one.
+     */
+    rpc_input_overrides?: Map<string, Record<string, unknown>>;
 }
 /**
  * Run the full standard test bundle — integration, admin (when `roles`

package/dist/testing/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IAsDtE,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAI7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IAyDtE,CAAC"}

package/dist/testing/standard.js

@@ -30,7 +30,10 @@ export const describe_standard_tests = (options) => {
         setup_test: options.setup_test,
         surface_source: options.surface_source,
         session_options: options.session_options,
-        rpc_endpoints: options.rpc_endpoints
+        rpc_endpoints: options.rpc_endpoints,
+        skip_methods: options.rpc_skip_methods,
+        input_overrides: options.rpc_input_overrides,
+        success_fixtures: options.rpc_success_fixtures
     });
     describe_data_exposure_tests({
         setup_test: options.setup_test,

package/dist/testing/transports/raw_http.d.ts

@@ -1,4 +1,11 @@
 import '../assert_dev_env.js';
+/**
+ * The read window a raw exchange gets by default in the cross suites. The
+ * server holds every byte it will get when the wait starts, so a backend that
+ * answers on what it has answers at once, and one that waits for more runs the
+ * whole window.
+ */
+export declare const RAW_HTTP_READ_TIMEOUT_MS = 2000;
 /** What a raw exchange read back, and how it ended. */
 export interface RawHttpExchange {
     /** Every byte the server sent, `latin1`-decoded. */
@@ -53,6 +60,20 @@ export interface RawHttpResponse {
  * @param request_bytes - the bytes to send, `latin1`-encoded
  */
 export declare const raw_http_exchange: (base_url: string, request_bytes: string, options: RawHttpExchangeOptions) => Promise<RawHttpExchange>;
+/**
+ * Render request headers as raw HTTP/1.1 header lines, each ending in CRLF.
+ *
+ * @param headers - header names to values, sent in iteration order
+ * @returns the lines, concatenated
+ */
+export declare const raw_http_header_lines: (headers: Record<string, string>) => string;
+/**
+ * Parse a response body as JSON.
+ *
+ * @param body - the body text
+ * @returns the parsed value, or `undefined` when the body is not JSON
+ */
+export declare const raw_http_parse_json: (body: string) => unknown;
 /**
  * Count HTTP response status lines in a raw byte stream. Deliberately
  * **unanchored** (no `^`/`m`): a second pipelined response is concatenated

package/dist/testing/transports/raw_http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw_http.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/raw_http.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CACtC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC7B,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,SAAS,sBAAsB,KAC7B,OAAO,CAAC,eAAe,CAwBvB,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,MAAM,KAAG,MACN,CAAC;AAElD,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAG5D,CAAC;AAyBF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,eAAe,GAAG,IAyBvE,CAAC"}
+{"version":3,"file":"raw_http.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/raw_http.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CACtC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC7B,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,SAAS,sBAAsB,KAC7B,OAAO,CAAC,eAAe,CAwBvB,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAG7D,CAAC;AAEZ;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,KAAG,OAMlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,MAAM,KAAG,MACN,CAAC;AAElD,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAG5D,CAAC;AAyBF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,eAAe,GAAG,IAyBvE,CAAC"}

package/dist/testing/transports/raw_http.js

@@ -18,6 +18,13 @@ import '../assert_dev_env.js';
  * @module
  */
 import { connect } from 'node:net';
+/**
+ * The read window a raw exchange gets by default in the cross suites. The
+ * server holds every byte it will get when the wait starts, so a backend that
+ * answers on what it has answers at once, and one that waits for more runs the
+ * whole window.
+ */
+export const RAW_HTTP_READ_TIMEOUT_MS = 2000;
 /**
  * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
  * what the server sends back until it closes the connection, a whole response
@@ -59,6 +66,29 @@ export const raw_http_exchange = (base_url, request_bytes, options) => new Promi
     socket.on('error', () => { }); // EPIPE/ECONNRESET on a mid-write close is expected
     socket.on('close', () => finish(true));
 });
+/**
+ * Render request headers as raw HTTP/1.1 header lines, each ending in CRLF.
+ *
+ * @param headers - header names to values, sent in iteration order
+ * @returns the lines, concatenated
+ */
+export const raw_http_header_lines = (headers) => Object.entries(headers)
+    .map(([name, value]) => `${name}: ${value}\r\n`)
+    .join('');
+/**
+ * Parse a response body as JSON.
+ *
+ * @param body - the body text
+ * @returns the parsed value, or `undefined` when the body is not JSON
+ */
+export const raw_http_parse_json = (body) => {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+};
 /**
  * Count HTTP response status lines in a raw byte stream. Deliberately
  * **unanchored** (no `^`/`m`): a second pipelined response is concatenated

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.147.0",
+  "version": "0.148.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -14,10 +14,12 @@
     "build": "gro build",
     "check": "gro check",
     "test": "gro test",
+    "test:cross": "node --conditions=development src/test/cross_backend/run_cross.ts",
     "test:cross:ts": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_ts_node --project cross_backend_ts_deno --project cross_backend_ts_bun",
     "test:cross:rust-spine-stub": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_rust_spine_stub",
     "test:cross:parity": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_parity",
     "test:cross:security": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_security",
+    "test:cross:ts-differential": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_ts_differential",
     "benchmark:cross-impl": "gro run src/benchmarks/cross_impl.bench.ts",
     "preview": "vite preview",
     "deploy": "gro deploy"
@@ -33,7 +35,7 @@
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.4",
     "@fuzdev/blake3-wasm": ">=0.2.0",
-    "@fuzdev/fuz_css": ">=0.70.0",
+    "@fuzdev/fuz_css": ">=0.71.1",
     "@fuzdev/fuz_schema": "^0.5.0",
     "@fuzdev/fuz_util": ">=0.78.0",
     "@fuzdev/pglet-wasm": ">=0.1.2",
@@ -92,11 +94,11 @@
     "@electric-sql/pglite": "^0.5.8",
     "@fuzdev/blake3-wasm": "^0.2.0",
     "@fuzdev/fuz_code": "^0.54.0",
-    "@fuzdev/fuz_css": "^0.71.0",
+    "@fuzdev/fuz_css": "^0.71.1",
     "@fuzdev/fuz_schema": "^0.5.0",
     "@fuzdev/fuz_ui": "^0.220.0",
     "@fuzdev/fuz_util": "^0.78.0",
-    "@fuzdev/gro": "^0.220.0",
+    "@fuzdev/gro": "^0.222.0",
     "@fuzdev/mdz": "^0.6.0",
     "@fuzdev/pglet-wasm": "^0.1.2",
     "@hono/bun": "^1.0.1",

package/dist/testing/cross_backend/actor_search.d.ts

@@ -1,6 +0,0 @@
-import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
-/** Options for the actor-search parity suite (the standard RPC-dispatched shape). */
-export type ActorSearchCrossTestOptions = RpcPathCrossSuiteOptions;
-export declare const describe_actor_search_cross_tests: (options: ActorSearchCrossTestOptions) => void;
-//# sourceMappingURL=actor_search.d.ts.map

package/dist/testing/cross_backend/actor_search.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"actor_search.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_search.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAyDxF,CAAC"}

package/dist/testing/cross_backend/actor_search.js

@@ -1,90 +0,0 @@
-import '../assert_dev_env.js';
-/**
- * Cross-backend parity suite for `actor_search`.
- *
- * `actor_search` is an opt-in case-insensitive prefix search over
- * `actor.name` (`{query, scope_ids?, limit?} → {actors: [{id, username,
- * display_name?}]}`), not folded into the standard bundle. Like
- * `actor_lookup` / cells, it's live-mounted on the spine RPC path but kept
- * off the declared surface, so this dedicated suite is its validator. The
- * security property under test is the **empty-`scope_ids` admin gate**:
- *
- * - **anonymous → 401** — the account-grain auth gate refuses an
- *   unauthenticated caller before the handler runs.
- * - **non-admin + no `scope_ids` → 400** `actor_search_scope_required` — an
- *   unbounded global search is admin-only; a non-admin must scope the query.
- *   This is the core security assertion, exercised against each impl's real
- *   auth resolution.
- * - **non-admin + `scope_ids` → 200** — passing a scope bypasses the admin
- *   requirement (results are filtered to actors holding active role_grants on
- *   those scopes); an unheld scope simply yields an empty result, not a
- *   rejection — proving the gate keys on `scope_ids` presence, not identity.
- * - **admin + no `scope_ids` → 200** — the admin path reaches the unbounded
- *   search.
- *
- * Cites `security.md` §Authorization (the `actor_search` scope gate).
- *
- * Runs both legs via the shared `{setup_test}` protocol: in-process
- * (`auth/actor_search_parity.db.test.ts`) + cross-process
- * (`cross_backend/actor_search.cross.test.ts`, TS spine binaries + Rust
- * `testing_spine_stub`). Mounted on every spine, so the suite is ungated.
- *
- * @module
- */
-import { describe, test, assert } from 'vitest';
-import { actor_search_action_spec, ERROR_ACTOR_SEARCH_SCOPE_REQUIRED } from '../../auth/actor_search_action_specs.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** Nil UUID — an unheld scope id (no actor holds a role_grant on it). */
-const NIL_UUID = '00000000-0000-0000-0000-000000000000';
-/** Build the JSON-RPC envelope body for an `actor_search` call. */
-const search_envelope = (params, id) => JSON.stringify({ jsonrpc: '2.0', method: actor_search_action_spec.method, params, id });
-export const describe_actor_search_cross_tests = (options) => {
-    const { setup_test } = options;
-    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    describe('actor_search parity', () => {
-        test('anonymous → 401 (account-grain auth gate)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'anon-search')
-            });
-            assert.strictEqual(res.status, 401, 'unauthenticated actor_search must be refused');
-        });
-        test('non-admin + no scope_ids → 400 actor_search_scope_required', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { ...account.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'nonadmin-noscope')
-            });
-            assert.strictEqual(res.status, 400, 'non-admin unbounded search must be rejected');
-            const body = (await res.json());
-            assert.strictEqual(body.error?.data?.reason, ERROR_ACTOR_SEARCH_SCOPE_REQUIRED, 'rejection carries the scope-required reason');
-        });
-        test('non-admin + scope_ids → 200 (scope bypasses admin gate)', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { ...account.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a', scope_ids: [NIL_UUID] }, 'nonadmin-scope')
-            });
-            assert.strictEqual(res.status, 200, 'non-admin with a scope filter is allowed');
-            const body = (await res.json());
-            assert(Array.isArray(body.result?.actors), 'response carries an actors array');
-        });
-        test('admin + no scope_ids → 200 (admin reaches unbounded search)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'admin-noscope')
-            });
-            assert.strictEqual(res.status, 200, 'admin unbounded search is allowed');
-            const body = (await res.json());
-            assert(Array.isArray(body.result?.actors), 'response carries an actors array');
-        });
-    });
-};

package/dist/testing/cross_backend/cell_cross_helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cell_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAMnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}