@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/account_lifecycle.js

@@ -17,11 +17,12 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, AuditLogListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
+import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED, ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { assert_audit_metadata_fields, list_audit_events } from './audit_cross_helpers.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_account_lifecycle_cross_tests = (options) => {
@@ -38,6 +39,15 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             assert.strictEqual(deleted.deleted, true);
             const undeleted = expect_output(await cross_rpc_call(t, rpc_path, 'account_undelete', { account_id: victim.account.id }, admin_headers), AccountUndeleteOutput);
             assert.strictEqual(undeleted.undeleted, true);
+            // each verb audits the victim's identity snapshot, attributed to
+            // the admin (`list_audit_events` parses the metadata)
+            for (const event_type of ['account_delete', 'account_undelete']) {
+                const events = await list_audit_events(fixture, { event_type }, rpc_path);
+                const row = events.find((e) => e.outcome === 'success' && e.target_account_id === victim.account.id);
+                assert.ok(row, `${event_type} writes a success row targeting the victim`);
+                assert.strictEqual(row.account_id, fixture.account.id, event_type);
+                assert.strictEqual(row.metadata?.username, victim.account.username, `${event_type} snapshots the username`);
+            }
         });
         test_if(capabilities.account_lifecycle, 'purge (keeper, confirmed)', async () => {
             const fixture = await setup_test();
@@ -46,6 +56,11 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             // Purge is keeper-gated: daemon-token credential, not a session.
             const purged = expect_output(await cross_rpc_call(t, rpc_path, 'account_purge', { account_id: victim.account.id, confirm: true }, fixture.create_daemon_token_headers()), AccountPurgeOutput);
             assert.strictEqual(purged.purged, true);
+            // the purge row outlives the account it names, carrying its identity
+            const events = await list_audit_events(fixture, { event_type: 'account_purge' }, rpc_path);
+            const row = events.find((e) => e.outcome === 'success' && e.target_account_id === victim.account.id);
+            assert.ok(row, 'account_purge writes a success row targeting the victim');
+            assert.strictEqual(row.metadata?.username, victim.account.username, 'account_purge snapshots the username');
         });
         test_if(capabilities.account_lifecycle, 'keeper guard: delete + purge refuse the keeper account', async () => {
             const fixture = await setup_test();
@@ -119,16 +134,11 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             // and emits a forensic `outcome: failure` audit row.
             const del = await cross_rpc_call(t, rpc_path, 'account_delete', { account_id: fixture.account.id }, fixture.create_session_headers());
             assert.strictEqual(error_reason(del), ERROR_CANNOT_DELETE_KEEPER);
-            // Deterministic barrier before reading: await in-flight
-            // fire-and-forget audit writes on either spine.
-            const td = fixture.fresh_transport({ origin: null });
-            const drained = await cross_rpc_call(td, rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
-            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
-            // The failure row is now authoritative on both spines. `_testing_reset`
-            // wiped audit_log at setup, so the refused delete is the only
-            // account_delete event.
-            const listed = expect_output(await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type: 'account_delete' }, fixture.create_session_headers()), AuditLogListOutput);
-            const failure = listed.events.find((e) => e.outcome === 'failure' &&
+            // Read behind the drain barrier, so the failure row is authoritative
+            // on both spines. `_testing_reset` wiped audit_log at setup, so the
+            // refused delete is the only account_delete event.
+            const events = await list_audit_events(fixture, { event_type: 'account_delete' }, rpc_path);
+            const failure = events.find((e) => e.outcome === 'failure' &&
                 e.metadata?.reason === ERROR_CANNOT_DELETE_KEEPER);
             assert.ok(failure, 'keeper-removal guard must emit an account_delete outcome=failure audit row with reason cannot_delete_keeper');
             // Byte-shape gate on the audit row's timestamp — `z.string()` in
@@ -151,6 +161,13 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const again = await cross_rpc_call(t, rpc_path, 'account_undelete', { account_id: victim.account.id }, admin_headers);
             assert.strictEqual(again.ok, false, 'double-undelete must not silently succeed');
             assert.strictEqual(error_reason(again), ERROR_ACCOUNT_NOT_FOUND);
+            // the refused undelete is audited as a failure naming the probed id
+            const events = await list_audit_events(fixture, { event_type: 'account_undelete', outcome: 'failure' }, rpc_path);
+            assert.strictEqual(events.length, 1, 'one account_undelete failure row');
+            assert_audit_metadata_fields(fixture, events[0].metadata, {
+                reason: ERROR_ACCOUNT_NOT_FOUND,
+                attempted_account_id: victim.account.id
+            });
         });
         // The last-admin guard (`ERROR_CANNOT_DELETE_LAST_ADMIN`) is **not**
         // cross-process-testable against this fixture: the per-test keeper

package/dist/testing/cross_backend/actor_lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkDxF,CAAC"}
+{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8BxF,CAAC"}

package/dist/testing/cross_backend/actor_lookup.js

@@ -6,22 +6,22 @@ import '../assert_dev_env.js';
  * (`{ids} → {actors: [{id, username, display_name?}]}`), not folded into the
  * standard bundle. It's live-mounted on the spine RPC path but kept off the
  * declared surface (`create_spine_surface_spec`) — like cells / ws / sse — so
- * the standard cross suite's generic round-trip never drives it; this
- * dedicated suite is its validator. Three cases over raw transport calls:
+ * the standard cross suite's generic round-trip never drives it.
+ *
+ * Its single-request refusals are conformance-table rows on a table given the
+ * live mount (`live_rpc_endpoints`): the anonymous 401 a generated auth row,
+ * the empty-`ids` 400 a hand-written one. This suite holds what a row can't
+ * say, because it names the fixture's own actor:
  *
- * - **anonymous → 401** — the account-grain auth gate refuses an
- *   unauthenticated caller before the handler runs.
  * - **keeper resolves own actor → 200** — the populated round trip: the
  *   returned row carries the keeper's `id` + `username`, and **no**
  *   `account_id` / `email` / timestamp / role field (the wire shape's
  *   deliberate info-leak posture). This is the assertion that exercises the
  *   Rust row→JSON mapping against the TS canonical shape.
- * - **empty `ids` → 400** — the `min(1)` input bound is enforced on both
- *   spines (TS Zod, Rust `parse_ids`).
  *
  * Runs both legs via the shared `{setup_test}` protocol: the in-process leg
  * (`auth/actor_lookup_parity.db.test.ts`, plain `gro test`) and the
- * cross-process leg (`cross_backend/actor_lookup.cross.test.ts`, the TS spine
+ * cross-process leg (`cross_backend/spine_suites.cross.test.ts`, the TS spine
  * binaries + Rust `testing_spine_stub` over real HTTP). `actor_lookup` is
  * mounted on every spine, so the suite is ungated.
  *
@@ -38,15 +38,6 @@ export const describe_actor_lookup_cross_tests = (options) => {
     const { setup_test } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('actor_lookup parity', () => {
-        test('anonymous → 401 (account-grain auth gate)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                body: lookup_envelope([fixture.actor.id], 'anon-lookup')
-            });
-            assert.strictEqual(res.status, 401, 'unauthenticated actor_lookup must be refused');
-        });
         test('keeper resolves own actor → 200 with id + username, no control fields', async () => {
             const fixture = await setup_test();
             const res = await fixture.transport(rpc_path, {
@@ -67,14 +58,5 @@ export const describe_actor_lookup_cross_tests = (options) => {
                 assert(!(key in row), `actor_lookup row must not leak '${key}'`);
             }
         });
-        test('empty ids → 400 (min(1) input bound)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
-                body: lookup_envelope([], 'empty-lookup')
-            });
-            assert.strictEqual(res.status, 400, 'empty ids must fail input validation');
-        });
     });
 };

package/dist/testing/cross_backend/app_settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_settings.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/app_settings.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAiBnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8DxF,CAAC"}
+{"version":3,"file":"app_settings.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/app_settings.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAcnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8DxF,CAAC"}

package/dist/testing/cross_backend/app_settings.js

@@ -22,7 +22,7 @@ import '../assert_dev_env.js';
  *
  * Cites `security.md` §Signup. Runs both legs via the shared `{setup_test}`
  * protocol: in-process (`auth/app_settings_parity.db.test.ts`) +
- * cross-process (`cross_backend/app_settings.cross.test.ts`, TS spine
+ * cross-process (`cross_backend/spine_suites.cross.test.ts`, TS spine
  * binaries + Rust `testing_spine_stub`). Mounted on every spine, so the
  * suite is ungated.
  *
@@ -31,9 +31,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { app_settings_update_action_spec } from '../../auth/admin_action_specs.js';
 import { ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** REST signup path on the spine surface (`/api/account` prefix + `/signup`). */
-const SIGNUP_PATH = '/api/account/signup';
+import { SPINE_ACCOUNT_SIGNUP_PATH, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A password that satisfies the creation-strength schema (min 12). */
 const SIGNUP_PASSWORD = 'securepassword123';
 /** Build the JSON-RPC envelope for an `app_settings_update` call. */
@@ -55,7 +53,7 @@ export const describe_app_settings_cross_tests = (options) => {
                 body: update_envelope(true, 'enable-open-signup')
             });
             assert.strictEqual(enable.status, 200, 'admin app_settings_update must succeed');
-            const res = await fixture.fresh_transport()(SIGNUP_PATH, {
+            const res = await fixture.fresh_transport()(SPINE_ACCOUNT_SIGNUP_PATH, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ username: 'open_signup_user', password: SIGNUP_PASSWORD })
@@ -80,7 +78,7 @@ export const describe_app_settings_cross_tests = (options) => {
                 body: update_envelope(false, 'disable-open-signup')
             });
             assert.strictEqual(disable.status, 200, 'admin app_settings_update (disable) must succeed');
-            const res = await fixture.fresh_transport()(SIGNUP_PATH, {
+            const res = await fixture.fresh_transport()(SPINE_ACCOUNT_SIGNUP_PATH, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ username: 'closed_signup_user', password: SIGNUP_PASSWORD })

package/dist/testing/cross_backend/audit_cross_helpers.d.ts

@@ -0,0 +1,51 @@
+import '../assert_dev_env.js';
+import type { AuditLogEventWithUsernamesJson } from '../../auth/audit_log_schema.js';
+import type { FetchTransport } from '../transports/fetch_transport.js';
+/** The fixture members an audit read uses — every `TestFixture` has them. */
+export interface AuditReadFixture {
+    readonly fresh_transport: (options?: {
+        readonly origin?: string | null;
+    }) => FetchTransport;
+    /** The keeper's session headers — the keeper holds the admin role the audit read needs. */
+    readonly create_session_headers: (extra?: Record<string, string>) => Record<string, string>;
+    readonly create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
+    /** Refuse undeclared metadata keys — see `TestFixture.reject_unknown_audit_metadata_keys`. */
+    readonly reject_unknown_audit_metadata_keys?: boolean;
+}
+/**
+ * Await the backend's in-flight audit writes via `_testing_drain_effects`, so
+ * a following `audit_log_list` sees every row emitted before the call. The
+ * backend must mount the action — every spine test binary does; in-process
+ * suites mount `create_testing_drain_effects_action`.
+ *
+ * @param fixture - the per-test fixture, whose daemon token authorizes the drain
+ * @param rpc_path - the RPC endpoint the drain action is mounted on
+ */
+export declare const cross_drain_effects: (fixture: AuditReadFixture, rpc_path?: string) => Promise<void>;
+/**
+ * Assert an audit row's `metadata` carries `expected` — each field compared
+ * on its own, so a consumer's added key passes — and none of `absent`. When
+ * the fixture's setup closed the world (`reject_unknown_audit_metadata_keys`),
+ * the whole object must equal `expected`, so an undeclared key fails too.
+ *
+ * @param fixture - the per-test fixture, whose flag picks the comparison
+ * @param metadata - the row's `metadata`
+ * @param expected - the declared fields and their values
+ * @param absent - keys the row must not carry, e.g. an optional field left unset
+ */
+export declare const assert_audit_metadata_fields: (fixture: Pick<AuditReadFixture, "reject_unknown_audit_metadata_keys">, metadata: Record<string, unknown> | null, expected: Record<string, unknown>, absent?: ReadonlyArray<string>) => void;
+/**
+ * Drain the backend's audit writes (`cross_drain_effects`), then list audit rows as
+ * the keeper, parse them against `AuditLogListOutput`, and parse each row's
+ * `metadata` against its event type's schema (`assert_audit_event_metadata`),
+ * with unknown keys refused when `fixture.reject_unknown_audit_metadata_keys`
+ * is set. The wire schema leaves `metadata` a loose record, so without this a
+ * spine's metadata drift reaches no assertion.
+ *
+ * @param fixture - the per-test fixture; the list runs on the keeper's session
+ * @param params - `audit_log_list` params, e.g. `{event_type: 'login', outcome: 'failure'}`
+ * @param rpc_path - the RPC endpoint both actions are mounted on
+ * @returns the listed events
+ */
+export declare const list_audit_events: (fixture: AuditReadFixture, params: Record<string, unknown>, rpc_path?: string) => Promise<Array<AuditLogEventWithUsernamesJson>>;
+//# sourceMappingURL=audit_cross_helpers.d.ts.map

package/dist/testing/cross_backend/audit_cross_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}

package/dist/testing/cross_backend/audit_cross_helpers.js

@@ -0,0 +1,78 @@
+import '../assert_dev_env.js';
+/**
+ * Audit-row reads for the cross-backend suites, behind the
+ * `_testing_drain_effects` barrier.
+ *
+ * Both spines write audit rows off the request path — a WS mutation is
+ * answered before its effects flush, and the Rust spine's emits are
+ * fire-and-forget — so a suite that reads `audit_log_list` right after the
+ * call it audits can miss the row, and an assertion that a row is absent then
+ * passes vacuously. `list_audit_events` drains before it lists, so no reader
+ * can skip the barrier, and holds every row it lists to its event type's
+ * metadata schema (`assert_audit_event_metadata`), so every reader checks the
+ * metadata of the rows it reads, on every spine — closed to undeclared keys
+ * when the fixture's setup asked for it.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { assert_audit_event_metadata } from '../audit_drift_guard.js';
+import { cross_rpc_call, expect_output } from './cross_rpc.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * Await the backend's in-flight audit writes via `_testing_drain_effects`, so
+ * a following `audit_log_list` sees every row emitted before the call. The
+ * backend must mount the action — every spine test binary does; in-process
+ * suites mount `create_testing_drain_effects_action`.
+ *
+ * @param fixture - the per-test fixture, whose daemon token authorizes the drain
+ * @param rpc_path - the RPC endpoint the drain action is mounted on
+ */
+export const cross_drain_effects = async (fixture, rpc_path = SPINE_RPC_PATH) => {
+    const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+    assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+};
+/**
+ * Assert an audit row's `metadata` carries `expected` — each field compared
+ * on its own, so a consumer's added key passes — and none of `absent`. When
+ * the fixture's setup closed the world (`reject_unknown_audit_metadata_keys`),
+ * the whole object must equal `expected`, so an undeclared key fails too.
+ *
+ * @param fixture - the per-test fixture, whose flag picks the comparison
+ * @param metadata - the row's `metadata`
+ * @param expected - the declared fields and their values
+ * @param absent - keys the row must not carry, e.g. an optional field left unset
+ */
+export const assert_audit_metadata_fields = (fixture, metadata, expected, absent = []) => {
+    assert.ok(metadata, 'the audit row carries metadata');
+    for (const [key, value] of Object.entries(expected)) {
+        assert.deepStrictEqual(metadata[key], value, `metadata.${key}`);
+    }
+    for (const key of absent)
+        assert.notProperty(metadata, key, `metadata.${key} is absent`);
+    if (fixture.reject_unknown_audit_metadata_keys) {
+        assert.deepStrictEqual(metadata, expected, 'metadata carries only the declared fields');
+    }
+};
+/**
+ * Drain the backend's audit writes (`cross_drain_effects`), then list audit rows as
+ * the keeper, parse them against `AuditLogListOutput`, and parse each row's
+ * `metadata` against its event type's schema (`assert_audit_event_metadata`),
+ * with unknown keys refused when `fixture.reject_unknown_audit_metadata_keys`
+ * is set. The wire schema leaves `metadata` a loose record, so without this a
+ * spine's metadata drift reaches no assertion.
+ *
+ * @param fixture - the per-test fixture; the list runs on the keeper's session
+ * @param params - `audit_log_list` params, e.g. `{event_type: 'login', outcome: 'failure'}`
+ * @param rpc_path - the RPC endpoint both actions are mounted on
+ * @returns the listed events
+ */
+export const list_audit_events = async (fixture, params, rpc_path = SPINE_RPC_PATH) => {
+    await cross_drain_effects(fixture, rpc_path);
+    const { events } = expect_output(await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'audit_log_list', params, fixture.create_session_headers()), AuditLogListOutput);
+    const reject_unknown_keys = fixture.reject_unknown_audit_metadata_keys ?? false;
+    for (const event of events)
+        assert_audit_event_metadata(event, { reject_unknown_keys });
+    return events;
+};

package/dist/testing/cross_backend/backend_config.d.ts

@@ -44,7 +44,8 @@ export interface BackendBootstrapConfig {
      * (env: `*_DAEMON_TOKEN_PATH`). `spawn_backend` reads this file once
      * after the health probe succeeds and threads the token onto
      * `BackendHandle.daemon_token` for `_testing_reset` calls plus any
-     * other admin/keeper-gated cross-process tests.
+     * other admin/keeper-gated cross-process tests. `spawn_backend` deletes
+     * the file before each spawn, so a token a previous run left is never read.
      */
     readonly daemon_token_path: string;
 }

package/dist/testing/cross_backend/backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C"}
+{"version":3,"file":"backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C"}

package/dist/testing/cross_backend/body_size.d.ts

@@ -20,6 +20,12 @@ export interface BodySizeCrossTestOptions extends RpcPathCrossSuiteOptions {
      * time.
      */
     readonly base_url: string | null;
+    /**
+     * The backend's request-body cap on `rpc_path`, in bytes — the boundary the
+     * cases probe. Default `SPINE_BODY_LIMIT_DEFAULT_BYTES`; pass the backend's
+     * value when it caps its RPC path elsewhere.
+     */
+    readonly rpc_max_body_bytes?: number;
 }
 export declare const describe_body_size_cross_tests: (options: BodySizeCrossTestOptions) => void;
 //# sourceMappingURL=body_size.d.ts.map

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAwHD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA+HlF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiG9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AA8FD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAkIlF,CAAC"}

package/dist/testing/cross_backend/body_size.js

@@ -4,7 +4,8 @@ import '../assert_dev_env.js';
  *
  * `create_app_server` (TS) and the Rust spine both cap the request body at a
  * 1 MiB default (`DEFAULT_MAX_BODY_SIZE` / `fuz_http`'s
- * `DEFAULT_BODY_LIMIT_BYTES`) and reject oversized payloads with `413` and the
+ * `DEFAULT_BODY_LIMIT_BYTES`; a backend capping its RPC path elsewhere passes
+ * `rpc_max_body_bytes`) and reject oversized payloads with `413` and the
  * canonical flat REST body `{error: 'payload_too_large'}`. A declared
  * `Content-Length` over the cap is refused on the header, *before* auth,
  * origin, or dispatch run (middleware step 4). Each impl unit-tests this in
@@ -55,7 +56,7 @@ import '../assert_dev_env.js';
  *
  * - a **declared** over-cap length is sent as the request head alone —
  *   `Content-Length` one over the cap and not one body byte. The 413 must
- *   arrive within `RAW_READ_TIMEOUT_MS`, which also pins that the refusal is
+ *   arrive within `RAW_HTTP_READ_TIMEOUT_MS`, which also pins that the refusal is
  *   made on the header: a backend that reads the body before refusing, or has
  *   no cap, waits for bytes that never come and fails the case.
  * - the **chunked** body is sent up to one byte past the cap and never
@@ -72,7 +73,7 @@ import '../assert_dev_env.js';
  * imperative suite, not a `conformance_table` row. Runs both legs via the
  * shared `setup_test` protocol: the in-process leg
  * (`auth/body_size_parity.db.test.ts`, plain `gro test`) and the cross-process
- * leg (`cross_backend/body_size.cross.test.ts`, the TS spine binaries + Rust
+ * leg (`cross_backend/spine_suites.cross.test.ts`, the TS spine binaries + Rust
  * `testing_spine_stub` over real HTTP). The body-size limit is on every spine,
  * so the suite is ungated.
  *
@@ -83,16 +84,8 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
 import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
-import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/**
- * The shared 1 MiB default both impls ship (`DEFAULT_MAX_BODY_SIZE` in TS,
- * `DEFAULT_BODY_LIMIT_BYTES` in `fuz_http`). Kept as a local cross-impl
- * contract value rather than imported from either impl — the boundary it
- * pins is the shared default, and a change to either is a deliberate
- * cross-impl decision that would revisit this suite regardless.
- */
-const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
+import { raw_http_exchange, raw_http_header_lines, raw_http_parse_json, raw_http_parse_response, RAW_HTTP_READ_TIMEOUT_MS } from '../transports/raw_http.js';
+import { SPINE_BODY_LIMIT_DEFAULT_BYTES, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * Build an `account_verify` JSON-RPC envelope whose serialized length is
  * *exactly* `target_bytes`, by growing a `params.pad` string to fill. Every
@@ -101,6 +94,10 @@ const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
  * middleware measures. `account_verify` takes no params, but at/over the cap
  * the size check fires before input validation, so the padded shape is never
  * reached on the rejection path.
+ *
+ * The envelope with an empty pad is already 70-odd bytes (more with a longer
+ * `id`), so a smaller target overshoots: the body comes out at that floor, not
+ * at `target_bytes`.
  */
 const sized_envelope = (id, target_bytes) => {
     const method = account_verify_action_spec.method;
@@ -131,28 +128,10 @@ const streamed_body = (total_bytes) => {
         }
     });
 };
-/**
- * How long a raw over-cap exchange waits for the refusal. The server has every
- * byte it will get when the wait starts, so a backend that refuses on what it
- * has answers at once and one that waits for more runs the whole window.
- */
-const RAW_READ_TIMEOUT_MS = 2000;
 const to_sized_response = async (res) => ({
     status: res.status,
     body: await res.json().catch(() => undefined)
 });
-const parse_json = (text) => {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-};
-/** Render request headers as raw header lines. */
-const to_header_lines = (headers) => Object.entries(headers)
-    .map(([name, value]) => `${name}: ${value}\r\n`)
-    .join('');
 /**
  * Write `request_bytes` to the backend's socket and read the one response it
  * must answer with — without being sent anything more.
@@ -161,17 +140,17 @@ const to_header_lines = (headers) => Object.entries(headers)
  */
 const exchange_withholding = async (base_url, request_bytes, withheld) => {
     const { received, closed_by_server } = await raw_http_exchange(base_url, request_bytes, {
-        read_timeout_ms: RAW_READ_TIMEOUT_MS,
+        read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS,
         until: 'response'
     });
     const response = raw_http_parse_response(received);
     assert.ok(response, `expected a whole response with ${withheld} withheld; ` +
         (closed_by_server
             ? `the server closed the connection first`
-            : `none arrived within ${RAW_READ_TIMEOUT_MS}ms — the backend is waiting for bytes ` +
+            : `none arrived within ${RAW_HTTP_READ_TIMEOUT_MS}ms — the backend is waiting for bytes ` +
                 `it should refuse without`) +
         `. Received: ${received ? received.slice(0, 120) : 'nothing'}`);
-    return { status: response.status, body: parse_json(response.body) };
+    return { status: response.status, body: raw_http_parse_json(response.body) };
 };
 /** Assert a response is the canonical over-cap refusal. */
 const assert_payload_too_large = (res, message) => {
@@ -181,6 +160,7 @@ const assert_payload_too_large = (res, message) => {
 export const describe_body_size_cross_tests = (options) => {
     const { setup_test, base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const cap = options.rpc_max_body_bytes ?? SPINE_BODY_LIMIT_DEFAULT_BYTES;
     /** POST `body` to the RPC path as the keeper. */
     const post = (fixture, body) => fixture.transport(rpc_path, {
         method: 'POST',
@@ -194,7 +174,7 @@ export const describe_body_size_cross_tests = (options) => {
      */
     const post_over_limit_declared = async (fixture, id) => {
         const headers = fixture.create_session_headers();
-        const content_length = BODY_LIMIT_DEFAULT_BYTES + 1;
+        const content_length = cap + 1;
         if (base_url === null) {
             return to_sized_response(await fixture.transport(rpc_path, {
                 method: 'POST',
@@ -204,7 +184,7 @@ export const describe_body_size_cross_tests = (options) => {
         }
         const url = new URL(base_url);
         return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
-            to_header_lines({
+            raw_http_header_lines({
                 host: url.host,
                 origin: url.origin,
                 ...headers,
@@ -223,18 +203,19 @@ export const describe_body_size_cross_tests = (options) => {
             return to_sized_response(await fixture.transport(rpc_path, {
                 method: 'POST',
                 headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
-                body: streamed_body(BODY_LIMIT_DEFAULT_BYTES + 1024),
+                body: streamed_body(cap + 1024),
                 // a streamed request body needs half-duplex `fetch`
                 duplex: 'half'
             }));
         }
         const url = new URL(base_url);
-        // whole chunks up to exactly the cap, then a one-byte chunk's size line
-        // and its byte — and neither that chunk's closing CRLF nor the
-        // terminating chunk, so the last byte sent is the first one past the cap
-        const whole_chunk = `${STREAM_CHUNK_BYTES.toString(16)}\r\n${'x'.repeat(STREAM_CHUNK_BYTES)}\r\n`;
+        // chunks up to exactly the cap, then a one-byte chunk's size line and its
+        // byte — and neither that chunk's closing CRLF nor the terminating chunk,
+        // so the last byte sent is the first one past the cap
+        const to_chunk = (size) => `${size.toString(16)}\r\n${'x'.repeat(size)}\r\n`;
+        const remainder = cap % STREAM_CHUNK_BYTES;
         return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
-            to_header_lines({
+            raw_http_header_lines({
                 host: url.host,
                 origin: url.origin,
                 ...fixture.create_session_headers(),
@@ -242,7 +223,8 @@ export const describe_body_size_cross_tests = (options) => {
                 'transfer-encoding': 'chunked'
             }) +
             `\r\n` +
-            whole_chunk.repeat(BODY_LIMIT_DEFAULT_BYTES / STREAM_CHUNK_BYTES) +
+            to_chunk(STREAM_CHUNK_BYTES).repeat(Math.floor(cap / STREAM_CHUNK_BYTES)) +
+            (remainder === 0 ? '' : to_chunk(remainder)) +
             `1\r\nx`, `the chunked body's end`);
     };
     describe('body-size limit parity', () => {
@@ -259,7 +241,7 @@ export const describe_body_size_cross_tests = (options) => {
             // Exactly at the cap is one byte under the `>` threshold, so it clears
             // the size gate and reaches the dispatcher. Whatever the dispatcher
             // then returns, it must not be the 413 — that's the lower boundary.
-            const res = await post(fixture, sized_envelope('at-limit', BODY_LIMIT_DEFAULT_BYTES));
+            const res = await post(fixture, sized_envelope('at-limit', cap));
             assert.notStrictEqual(res.status, 413, 'a body exactly at the cap must not be size-rejected');
         });
         test('under-limit POST (small) → 200', async () => {

package/dist/testing/cross_backend/body_size_smuggling.d.ts

@@ -5,6 +5,11 @@ export interface BodySizeSmugglingCrossTestOptions {
     readonly base_url: string;
     /** RPC endpoint path to target. Default `/api/rpc`. */
     readonly rpc_path?: string;
+    /**
+     * The backend's request-body cap on `rpc_path`, in bytes; the oversized
+     * `POST` declares a length past it. Default `SPINE_BODY_LIMIT_DEFAULT_BYTES`.
+     */
+    readonly rpc_max_body_bytes?: number;
 }
 export declare const describe_body_size_smuggling_cross_tests: (options: BodySizeSmugglingCrossTestOptions) => void;
 //# sourceMappingURL=body_size_smuggling.d.ts.map

package/dist/testing/cross_backend/body_size_smuggling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAWD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4GF,CAAC"}
+{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4GF,CAAC"}

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -59,15 +59,8 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
-import { raw_http_count_responses, raw_http_exchange } from '../transports/raw_http.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
-const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
-/**
- * How long each raw exchange waits for the server to finish answering. An
- * exchange the backend does not end by closing runs the whole window.
- */
-const RAW_READ_TIMEOUT_MS = 2000;
+import { raw_http_count_responses, raw_http_exchange, RAW_HTTP_READ_TIMEOUT_MS } from '../transports/raw_http.js';
+import { SPINE_BODY_LIMIT_DEFAULT_BYTES, SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -81,7 +74,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
             const two_requests = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n` +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
             const { received: response } = await raw_http_exchange(base_url, two_requests, {
-                read_timeout_ms: RAW_READ_TIMEOUT_MS
+                read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
             });
             const n = raw_http_count_responses(response);
             assert.ok(n >= 2, `expected ≥2 responses on one keep-alive connection (got ${n}); without ` +
@@ -89,7 +82,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 `assertion below is not a real signal. Raw head: ${response.slice(0, 120)}`);
         });
         test('oversized POST + pipelined GET → no request smuggled', async () => {
-            const oversized_len = BODY_LIMIT_DEFAULT_BYTES + 1024;
+            const oversized_len = (options.rpc_max_body_bytes ?? SPINE_BODY_LIMIT_DEFAULT_BYTES) + 1024;
             const pipelined_get = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
             // One write: an over-cap POST (rejected on Content-Length) immediately
             // followed by a GET.
@@ -101,7 +94,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 'x'.repeat(oversized_len) +
                 pipelined_get;
             const { received: response } = await raw_http_exchange(base_url, payload, {
-                read_timeout_ms: RAW_READ_TIMEOUT_MS
+                read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
             });
             const n = raw_http_count_responses(response);
             // The reject closes the connection, so the pipelined GET is never
@@ -140,7 +133,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                     chunked_envelope +
                     `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
                 const { received, closed_by_server } = await raw_http_exchange(base_url, payload, {
-                    read_timeout_ms: RAW_READ_TIMEOUT_MS
+                    read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS
                 });
                 const n = raw_http_count_responses(received);
                 // Refused with 400 or answered — the status is the implementation's.
@@ -151,7 +144,7 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                     `Raw head: ${received.slice(0, 120)}`);
                 assert.ok(closed_by_server, `expected the server to close the connection after a request carrying both ` +
                     `Content-Length and Transfer-Encoding; it was still open after ` +
-                    `${RAW_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
+                    `${RAW_HTTP_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
             });
         }
     });