@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/build_test_backend_paths.d.ts

@@ -8,7 +8,9 @@ import '../assert_dev_env.js';
  * - `bootstrap_token_path` — `FUZ_BOOTSTRAP_TOKEN_PATH`; harness writes
  *   the bootstrap token here before spawn.
  * - `daemon_token_path` — where `init_daemon_token` (Rust) and the TS
- *   server's daemon-token writer land the token (under `{root}/run/`).
+ *   server's daemon-token writer land the token (under `{root}/run/`);
+ *   `spawn_backend` deletes it before each spawn, so a token a previous run
+ *   left is never read.
  */
 export interface TestBackendPaths {
     readonly root: string;

package/dist/testing/cross_backend/build_test_backend_paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build_test_backend_paths.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/build_test_backend_paths.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,gBASzD,CAAC"}
+{"version":3,"file":"build_test_backend_paths.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/build_test_backend_paths.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,gBASzD,CAAC"}

package/dist/testing/cross_backend/capabilities.d.ts

@@ -1,43 +1,9 @@
 import '../assert_dev_env.js';
-/**
- * Backend wiring facts recorded for documentation — **not** gating flags.
- *
- * The companion to `BackendCapabilities`: where each capability flag is read
- * by a suite (a `test_if(capabilities.X, ...)` gate, or a fork of one case's
- * assertion), nothing reads these. They record middleware / limiter wiring that
- * differs between the TS and Rust families (a backend-shape record) but gates
- * no cross test today. They live in their own type precisely so
- * `BackendCapabilities` stops claiming gating power it doesn't have — fold a
- * flag in here the moment it has no `test_if` reader, and promote it back the
- * day a suite genuinely gates on it.
- */
-export interface BackendShapeNotes {
-    /**
-     * Bearer-token auth (`Authorization: Bearer <token>`) is wired through the
-     * backend's middleware stack. `true` on every spine — the bearer-token cases
-     * in `describe_standard_integration_tests` / `describe_rate_limiting_tests`
-     * run unconditionally.
-     */
-    readonly bearer_auth: boolean;
-    /**
-     * Trusted-proxy XFF parsing (`X-Forwarded-For` etc.) is wired. Records the
-     * proxy-default difference between the TS family (`false` — the test binary
-     * leaves proxy parsing off) and the Rust family (`true` — the client-IP
-     * middleware is always wired; the env-gate only chooses XFF vs the TCP peer).
-     */
-    readonly trusted_proxy: boolean;
-    /**
-     * Per-account login rate limiting is wired. `false` for the TS family (the
-     * canonical path leaves the limiter null in test mode), `true` for the Rust
-     * family (env-gated bucket on `/login` + `/password`).
-     */
-    readonly login_rate_limit: boolean;
-}
 /**
  * Optional behaviors a backend may support. Each flag's TSDoc names the
  * tests that gate on it; add a new flag here before referencing it from
- * a suite body, and document the gating tests inline. Wiring facts that gate
- * nothing belong in `BackendShapeNotes`, not here.
+ * a suite body, and document the gating tests inline. A wiring fact no
+ * suite reads doesn't belong here.
  */
 export interface BackendCapabilities {
     /**
@@ -93,15 +59,27 @@ export interface BackendCapabilities {
      */
     readonly account_lifecycle: boolean;
     /**
-     * The cell-gated fact-serving routes (`GET /api/cells/:cell_id/facts/:hash`
-     * + the admin-only `GET /api/facts/:hash`) are live-mounted on the backend,
-     * its DB carries the `fuz_facts` migration namespace, and it registers the
-     * `_testing_put_fact` seeder. Gates `describe_fact_serving_cross_tests` —
-     * the per-reference read model (cell-scoped admit via a viewable cell,
-     * cross-owner-dedup-no-leak, 404-mask, bare-hash admin-only). Like cells,
-     * the serve routes stay off the standard declared surface.
+     * The cell-gated fact-serving route (`GET /api/cells/:cell_id/facts/:hash`)
+     * is live-mounted on the backend, its DB carries the `fuz_facts` migration
+     * namespace, and it registers the `_testing_put_fact` seeder. Gates
+     * `describe_fact_serving_cross_tests`' per-reference read model (cell-scoped
+     * admit via a viewable cell, cross-owner-dedup-no-leak, 404-mask),
+     * `describe_cell_ref_admission_cross_tests`, and the fact cases of the
+     * moderation suite. Like cells, the serve route stays off the standard
+     * declared surface. The admin bare-hash route is its own flag,
+     * `fact_serving_admin_hash`.
      */
     readonly fact_serving: boolean;
+    /**
+     * The admin-only bare-hash fact route (`GET /api/facts/:hash`) is
+     * live-mounted. Gates the bare-hash cases of
+     * `describe_fact_serving_cross_tests` (with `fact_serving`, whose seeder
+     * they use), `describe_query_shape_cross_tests` and
+     * `describe_token_scope_surface_cross_tests`. A backend serving only the
+     * cell-gated route states `fact_serving: true, fact_serving_admin_hash:
+     * false`.
+     */
+    readonly fact_serving_admin_hash: boolean;
     /**
      * The `/ready` readiness deploy gate (`GET /ready`) is live-mounted on the
      * backend — the public column-presence schema-drift probe over the committed
@@ -130,13 +108,12 @@ export interface BackendCapabilities {
      * rejection, per-connection id isolation, never-replying `Timeout`,
      * wrong-shape reply rejection).
      *
-     * `true` for both the Rust spine (server-initiated requests landed
-     * Rust-first canonical) and the TS spine
-     * (`BackendWebsocketTransport.request_connection` drives the round-trip,
-     * correlated by `register_action_ws`). The conservative
-     * `ts_default_capabilities` keeps it `false` like sse/ready — a TS backend
-     * opts in once it mounts `peer/ping` on a WS endpoint **and** the HTTP RPC
-     * endpoint (the no-transport refusal). Like ws/sse/cells, `peer/ping` stays
+     * `true` on fuz_app's own spine presets — the Rust `testing_spine_stub` and
+     * the TS spine (`BackendWebsocketTransport.request_connection` drives the
+     * round-trip, correlated by `register_action_ws`). A `MountFlag`: a backend
+     * states `true` once it mounts `peer/ping` on a WS endpoint **and** the HTTP
+     * RPC endpoint (the no-transport refusal).
+     * Like ws/sse/cells, `peer/ping` stays
      * off the standard declared surface (it's a protocol action,
      * manifest-excluded), so this flag is the only opt-in into the peer parity
      * coverage.
@@ -171,9 +148,9 @@ export interface BackendCapabilities {
      *
      * `true` on fuz_app's own spine presets — the TS spine binary mounts its
      * full action set on `/api/ws`, and the Rust `testing_spine_stub` serves
-     * one action registry on RPC and WS. `false` in the family defaults:
-     * a consumer's WS endpoint carries whatever its domain mounts, so it opts in
-     * once the account actions are there.
+     * one action registry on RPC and WS. A `MountFlag`: a consumer's WS endpoint
+     * carries whatever its domain mounts, so it states `true` once the account
+     * actions are there.
      */
     readonly ws_account_actions: boolean;
     /**
@@ -215,6 +192,31 @@ export interface BackendCapabilities {
      */
     readonly ws_refusal_body: boolean;
 }
+/**
+ * The capabilities that describe a backend's own mounts, never a runtime
+ * trait: what a consumer chooses to serve. They have no family default —
+ * state each flag in your backend config's `capabilities`; a missing one
+ * would silently skip its suites, so leaving one out is a type error.
+ *
+ * `Pick` keeps the list honest: a name that is not a `BackendCapabilities`
+ * flag fails to compile.
+ */
+export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_crud' | 'cell_relations' | 'cell_gated_create' | 'fact_serving' | 'fact_serving_admin_hash' | 'ready' | 'peer_request' | 'ws_account_actions' | 'ws_role_gated'>;
+/**
+ * A family's default capabilities: every flag but the `MountFlag`s, which
+ * each backend config states itself. Spread one and add every mount flag:
+ *
+ * ```ts
+ * capabilities: {
+ *   ...rust_default_capabilities,
+ *   ws: true, sse: true, ready: true, peer_request: true,
+ *   cell_crud: false, cell_relations: false, cell_gated_create: false,
+ *   fact_serving: false, fact_serving_admin_hash: false,
+ *   ws_account_actions: false, ws_role_gated: false,
+ * }
+ * ```
+ */
+export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag>;
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
@@ -229,12 +231,6 @@ export interface BackendCapabilities {
  * per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
-/**
- * Shape notes for the in-process Hono transport — every wiring fact present
- * (the in-process app exercises the full middleware stack). Documentation
- * only, like every `BackendShapeNotes` (nothing reads it).
- */
-export declare const in_process_shape_notes: BackendShapeNotes;
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAwBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyBpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -18,22 +18,28 @@ import '../assert_dev_env.js';
  * - `in_process_capabilities` — here; every flag `true` except the
  *   cross-process-only ones.
  * - `ts_default_capabilities` / `rust_default_capabilities` — consumer-facing
- *   family defaults, in `default_backend_configs.ts` (full literals, so adding
- *   a capability is a compile error until each family declares it).
+ *   family defaults, in `default_backend_configs.ts` — every flag but the
+ *   `MountFlag`s (`FamilyDefaultCapabilities`), as full literals, so adding a
+ *   non-mount capability is a compile error until each family declares it.
  * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
- *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
- *   default; Bun flips `ws_handshake_pipelining`).
+ *   spine presets, in `ts_spine_backend_config.ts` (the family
+ *   default plus every mount flag; Bun flips `ws_handshake_pipelining`).
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
- *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
+ *   `rust_spine_stub_backend_config.ts` (the rust family default plus every mount flag).
  *
- * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
- * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader,
- * or — `ws_refusal_body` — picks how a case reads a refusal).
- * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
- * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
- * (`in_process_shape_notes` here, `ts_default_shape_notes` /
- * `rust_default_shape_notes` in `default_backend_configs.ts`) so the
- * capability type never claims gating power it doesn't have.
+ * **Mount flags have no default.** A flag naming something a backend mounts
+ * (a `MountFlag`) is never inherited: the family defaults are
+ * `FamilyDefaultCapabilities`, which omits them, so every backend config states
+ * each one. The family defaults carry only what the family guarantees — the
+ * declared spine surface's mounts (`account_lifecycle`, `account_status`) and
+ * the runtime behavior of its reference runtime (`ws_handshake_pipelining`,
+ * `ws_refusal_body`: Node for TS, hyper for Rust), which a backend on another
+ * runtime overrides.
+ *
+ * **Gating flags only.** `BackendCapabilities` holds only flags a suite
+ * actually gates on (each has a `test_if(capabilities.X, ...)` reader, or —
+ * `ws_refusal_body` — picks how a case reads a refusal). A wiring fact no suite
+ * reads is not a capability.
  *
  * @module
  */
@@ -58,6 +64,7 @@ export const in_process_capabilities = Object.freeze({
     cell_relations: true,
     account_lifecycle: true,
     fact_serving: true,
+    fact_serving_admin_hash: true,
     ready: true,
     account_status: true,
     peer_request: false,
@@ -76,16 +83,6 @@ export const in_process_capabilities = Object.freeze({
     // socket to upgrade); Hono's own refusals carry their bodies.
     ws_refusal_body: true
 });
-/**
- * Shape notes for the in-process Hono transport — every wiring fact present
- * (the in-process app exercises the full middleware stack). Documentation
- * only, like every `BackendShapeNotes` (nothing reads it).
- */
-export const in_process_shape_notes = Object.freeze({
-    bearer_auth: true,
-    trusted_proxy: true,
-    login_rate_limit: true
-});
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still

package/dist/testing/cross_backend/cargo_binary.d.ts

@@ -0,0 +1,70 @@
+import '../assert_dev_env.js';
+/**
+ * Env var skipping the build, for iteration on a known-current binary: `1` or
+ * `true` skips it, any other value (`0`, `false`, empty) builds.
+ */
+export declare const NO_REBUILD_ENV = "FUZ_TESTING_NO_REBUILD";
+/**
+ * Whether an `NO_REBUILD_ENV` value asks to skip the build — only an explicit
+ * `1` / `true`, so `FUZ_TESTING_NO_REBUILD=0` still builds.
+ *
+ * @param value - the variable's value, `undefined` when unset
+ */
+export declare const is_no_rebuild_requested: (value: string | undefined) => boolean;
+/** Options naming one Cargo-built binary. */
+export interface CargoBinaryOptions {
+    /** The Cargo workspace (or package) directory the build runs in. */
+    readonly workspace_dir: string;
+    /** The Cargo package holding the binary (`cargo build -p`). */
+    readonly package: string;
+    /** The binary target (`cargo build --bin`). Default the package name. */
+    readonly bin?: string;
+    /** The Cargo profile. Default `'dev'`, whose output is `debug/`. */
+    readonly profile?: string;
+}
+/**
+ * The directory under the target directory a profile's output lands in —
+ * `debug` for `dev`, the profile's own name otherwise (`release`, a custom
+ * `cross-test`).
+ *
+ * @param profile - the Cargo profile
+ */
+export declare const to_cargo_profile_dir: (profile: string) => string;
+/**
+ * The binary path `cargo build --profile <profile> --bin <bin>` writes, from
+ * `cargo metadata --no-deps --format-version 1` output.
+ *
+ * @param metadata_json - the `cargo metadata` output
+ * @param bin - the binary's name
+ * @param profile - the Cargo profile
+ * @returns the binary's absolute path
+ * @throws Error when the output carries no `target_directory`
+ */
+export declare const to_cargo_binary_path: (metadata_json: string, bin: string, profile: string) => string;
+/**
+ * The path of a Cargo-built binary, without building it — what a config's
+ * `start_command` names. Runs `cargo metadata` once per process per workspace,
+ * so it needs cargo on PATH.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path
+ * @throws Error when the workspace is missing or `cargo metadata` fails
+ */
+export declare const resolve_cargo_binary_path: (options: CargoBinaryOptions) => string;
+/**
+ * Build a Cargo binary before its backend spawns, unless `NO_REBUILD_ENV`
+ * asks to skip it, and return its path. The build's output is inherited, so a
+ * cold build shows its progress, and a failed build throws — the project fails
+ * loudly rather than spawning a stale binary. `cargo build` is incremental, so
+ * a build with nothing changed is quick.
+ *
+ * Synchronous: vitest awaits each project's `globalSetup` in turn, so one
+ * invocation selecting several projects builds once, then finds the build
+ * current.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path (`resolve_cargo_binary_path`)
+ * @throws Error when the workspace is missing, the build fails, or `cargo metadata` fails
+ */
+export declare const prepare_cargo_binary: (options: CargoBinaryOptions) => string;
+//# sourceMappingURL=cargo_binary.d.ts.map

package/dist/testing/cross_backend/cargo_binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo_binary.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cargo_binary.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyB9B;;;GAGG;AACH,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,OACnB,CAAC;AAElD,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MACjB,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,eAAe,MAAM,EACrB,KAAK,MAAM,EACX,SAAS,MAAM,KACb,MAMF,CAAC;AA2DF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,MAGvE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,kBAAkB,KAAG,MAUlE,CAAC"}

package/dist/testing/cross_backend/cargo_binary.js

@@ -0,0 +1,148 @@
+import '../assert_dev_env.js';
+/**
+ * Cargo-built test binaries for cross-backend projects — build before the
+ * spawn, then spawn the binary itself.
+ *
+ * A config that spawns `cargo run` builds inside `spawn_backend`'s health
+ * window, so a cold build can outlast the startup timeout, and the build's
+ * output is held in the spawn's stderr tail rather than shown.
+ * `prepare_cargo_binary` runs the build first, with its output inherited, as a
+ * pre-spawn hook (`create_cross_backend_global_setup`'s `before_spawn`), and
+ * the config's `start_command` names the built binary
+ * (`resolve_cargo_binary_path`), so the spawn starts at once.
+ *
+ * The binary's path comes from `cargo metadata`: under the workspace's
+ * resolved `target_directory`, so `CARGO_TARGET_DIR` and `build.target-dir`
+ * are honoured, in the profile's output directory.
+ *
+ * @module
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Env var skipping the build, for iteration on a known-current binary: `1` or
+ * `true` skips it, any other value (`0`, `false`, empty) builds.
+ */
+export const NO_REBUILD_ENV = 'FUZ_TESTING_NO_REBUILD';
+/**
+ * Whether an `NO_REBUILD_ENV` value asks to skip the build — only an explicit
+ * `1` / `true`, so `FUZ_TESTING_NO_REBUILD=0` still builds.
+ *
+ * @param value - the variable's value, `undefined` when unset
+ */
+export const is_no_rebuild_requested = (value) => value === '1' || value?.toLowerCase() === 'true';
+/**
+ * The directory under the target directory a profile's output lands in —
+ * `debug` for `dev`, the profile's own name otherwise (`release`, a custom
+ * `cross-test`).
+ *
+ * @param profile - the Cargo profile
+ */
+export const to_cargo_profile_dir = (profile) => profile === 'dev' ? 'debug' : profile;
+/**
+ * The binary path `cargo build --profile <profile> --bin <bin>` writes, from
+ * `cargo metadata --no-deps --format-version 1` output.
+ *
+ * @param metadata_json - the `cargo metadata` output
+ * @param bin - the binary's name
+ * @param profile - the Cargo profile
+ * @returns the binary's absolute path
+ * @throws Error when the output carries no `target_directory`
+ */
+export const to_cargo_binary_path = (metadata_json, bin, profile) => {
+    const metadata = JSON.parse(metadata_json);
+    if (typeof metadata.target_directory !== 'string' || !metadata.target_directory) {
+        throw new Error('`cargo metadata` output has no `target_directory`');
+    }
+    return join(metadata.target_directory, to_cargo_profile_dir(profile), bin);
+};
+/**
+ * Per-process memo of each workspace's target directory metadata. On
+ * `globalThis` rather than in module scope, so every project's `globalSetup` in
+ * one vitest process shares it whether or not they share this module's
+ * instance.
+ */
+const CARGO_METADATA_MEMO_KEY = '__fuz_app_cargo_metadata_memo';
+const get_metadata_memo = () => {
+    const holder = globalThis;
+    return (holder[CARGO_METADATA_MEMO_KEY] ??= new Map());
+};
+/**
+ * How long `cargo metadata` may take (ms). Usually well under a second, but
+ * the first run in a checkout can have rustup install the pinned toolchain.
+ */
+const CARGO_METADATA_TIMEOUT_MS = 120_000;
+/**
+ * Throw naming the workspace when its directory is missing — a spawn with a
+ * missing `cwd` otherwise fails as `spawnSync cargo ENOENT`, which reads as
+ * cargo not being installed.
+ */
+const assert_workspace_dir = (workspace_dir) => {
+    if (!existsSync(workspace_dir)) {
+        throw new Error(`the Cargo workspace ${workspace_dir} does not exist`);
+    }
+};
+const read_cargo_metadata = (workspace_dir) => {
+    const memo = get_metadata_memo();
+    let metadata_json = memo.get(workspace_dir);
+    if (metadata_json === undefined) {
+        assert_workspace_dir(workspace_dir);
+        try {
+            metadata_json = execFileSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], {
+                cwd: workspace_dir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'inherit'],
+                maxBuffer: 64 * 1024 * 1024,
+                timeout: CARGO_METADATA_TIMEOUT_MS
+            });
+        }
+        catch (error) {
+            const code = error.code;
+            throw new Error(code === 'ETIMEDOUT'
+                ? `\`cargo metadata\` in ${workspace_dir} took over ${CARGO_METADATA_TIMEOUT_MS}ms`
+                : `\`cargo metadata\` in ${workspace_dir} failed: ${error.message}`, { cause: error });
+        }
+        memo.set(workspace_dir, metadata_json);
+    }
+    return metadata_json;
+};
+/**
+ * The path of a Cargo-built binary, without building it — what a config's
+ * `start_command` names. Runs `cargo metadata` once per process per workspace,
+ * so it needs cargo on PATH.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path
+ * @throws Error when the workspace is missing or `cargo metadata` fails
+ */
+export const resolve_cargo_binary_path = (options) => {
+    const { workspace_dir, package: pkg, bin = pkg, profile = 'dev' } = options;
+    return to_cargo_binary_path(read_cargo_metadata(workspace_dir), bin, profile);
+};
+/**
+ * Build a Cargo binary before its backend spawns, unless `NO_REBUILD_ENV`
+ * asks to skip it, and return its path. The build's output is inherited, so a
+ * cold build shows its progress, and a failed build throws — the project fails
+ * loudly rather than spawning a stale binary. `cargo build` is incremental, so
+ * a build with nothing changed is quick.
+ *
+ * Synchronous: vitest awaits each project's `globalSetup` in turn, so one
+ * invocation selecting several projects builds once, then finds the build
+ * current.
+ *
+ * @param options - the workspace, package, binary and profile
+ * @returns the binary's absolute path (`resolve_cargo_binary_path`)
+ * @throws Error when the workspace is missing, the build fails, or `cargo metadata` fails
+ */
+export const prepare_cargo_binary = (options) => {
+    const { workspace_dir, package: pkg, bin = pkg, profile = 'dev' } = options;
+    if (!is_no_rebuild_requested(process.env[NO_REBUILD_ENV])) {
+        assert_workspace_dir(workspace_dir);
+        execFileSync('cargo', ['build', '-p', pkg, '--bin', bin, '--profile', profile], {
+            cwd: workspace_dir,
+            stdio: 'inherit'
+        });
+    }
+    return resolve_cargo_binary_path(options);
+};

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IAggBF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6lBF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -23,6 +23,9 @@ import '../assert_dev_env.js';
  * - a non-owner non-admin editing / reading / deleting another's private cell
  *   gets 404 (IDOR mask), never 403;
  * - admin reaches any cell;
+ * - `cell_list` pages honor `limit` + `offset`, and a page is visible rows:
+ *   a newer run of cells the caller can't see never crowds the visible ones
+ *   out, for a non-owner and for anon, and an admin's pages tile every row;
  * - duplicate active `path` → 409 (`cell_path_taken`);
  * - `path` write by a non-admin → 403 (`cell_path_admin_only`), on both create
  *   and update (even by the owner);
@@ -47,7 +50,7 @@ import '../assert_dev_env.js';
 import { describe, assert } from 'vitest';
 import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_cell_crud_cross_tests = (options) => {
@@ -194,6 +197,59 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!update_path.ok, 'non-admin set a path on update');
             assert.strictEqual(error_reason(update_path), 'cell_path_admin_only');
         });
+        test_if(capabilities.cell_crud, 'cell_list pages: limit + offset honored; hidden rows never crowd visible ones out of a page', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_page_owner' });
+            const other = await fixture.create_account({ username: 'cell_page_other' });
+            const viewer = await fixture.create_account({ username: 'cell_page_viewer' });
+            const t = fixture.fresh_transport();
+            const kind = 'page_probe';
+            const create = async (headers, visibility) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind, data: {}, visibility }, headers), CellCreateOutput).cell.id;
+            const owner_h = owner.create_session_headers();
+            const other_h = other.create_session_headers();
+            // oldest first: the visible rows, then a newer run of hidden ones —
+            // two owners' private cells — longer than a page, so the newest
+            // `limit` rows are all hidden from the viewer
+            const visible = [];
+            for (let i = 0; i < 5; i++) {
+                visible.push(await create(i % 2 === 0 ? owner_h : other_h, 'public'));
+            }
+            const hidden = [];
+            for (let i = 0; i < 6; i++) {
+                hidden.push(await create(i % 2 === 0 ? owner_h : other_h, 'private'));
+            }
+            const limit = 3;
+            const page = async (transport, headers, params) => expect_output(await cross_rpc_call(transport, rpc_path, 'cell_list', { kind, ...params }, headers), CellListOutput).cells.map((c) => c.id);
+            // newest first (the default order), so the visible rows, newest first
+            const visible_desc = [...visible].reverse();
+            for (const [label, transport, headers] of [
+                ['a non-owner viewer', t, viewer.create_session_headers()],
+                ['anon', fixture.fresh_transport({ origin: null }), {}]
+            ]) {
+                const first = await page(transport, headers, { limit });
+                assert.deepStrictEqual(first, visible_desc.slice(0, limit), `${label}: the first page is the newest visible rows, full to limit`);
+                const second = await page(transport, headers, { limit, offset: limit });
+                assert.deepStrictEqual(second, visible_desc.slice(limit), `${label}: the next page is the rest of the visible rows`);
+                const past = await page(transport, headers, { limit, offset: visible.length });
+                assert.deepStrictEqual(past, [], `${label}: a page past the visible rows is empty`);
+                for (const id of [...first, ...second]) {
+                    assert.ok(!hidden.includes(id), `${label}: a page leaked a hidden row`);
+                }
+            }
+            // an admin sees every row, paged the same way
+            const admin_h = fixture.create_session_headers();
+            const all_desc = [...visible, ...hidden].reverse();
+            const admin_pages = [];
+            for (let offset = 0; offset < all_desc.length; offset += 4) {
+                const rows = await page(t, admin_h, { limit: 4, offset });
+                assert.ok(rows.length <= 4, `admin page at offset ${offset} exceeds limit`);
+                admin_pages.push(...rows);
+            }
+            assert.deepStrictEqual(admin_pages, all_desc, 'admin pages tile the whole list in order');
+            // the owner sees its own private rows beside every public one
+            const owner_rows = await page(t, owner_h, { limit: 50 });
+            assert.deepStrictEqual(owner_rows, all_desc.filter((id) => visible.includes(id) || hidden.indexOf(id) % 2 === 0), 'the owner reads public rows plus its own private ones');
+        });
         test_if(capabilities.cell_crud, 'cell_get without id or path → invalid_params', async () => {
             const fixture = await setup_test();
             const bad = await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'cell_get', {}, fixture.create_session_headers());

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -1,64 +1,4 @@
 import '../assert_dev_env.js';
 import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
-/**
- * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
- *
- * Builds a moderated public space (admin) + a `participant`'s `post` (born
- * `pending` + private under the `moderation_required: true` policy), then
- * proves both spines agree:
- *
- * - **a root manager (admin) approves** → `moderation: 'approved'` +
- *   `visibility: 'public'` (the contribution goes live).
- * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
- *   author can *view* their own pending cell, so they reach the gate, and are
- *   denied — moderation authority is over the governing root, not the
- *   contribution).
- * - **a non-viewer is 404-masked** → a stranger who can't see the pending
- *   contribution gets `cell_not_found`, never learns it exists.
- * - **reject** → `moderation: 'rejected'`, visibility stays private.
- *
- * And that moderation gates reads — a cell's effective audience is its
- * visibility or grants **and** its moderation admission (unmoderated or
- * `approved`), so a pending or rejected contribution reaches no one past its
- * author and admins:
- *
- * - **an author's self-flip to public admits nobody** — a pending post its
- *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
- *   and out of their `cell_list`; the author and admin still read it.
- * - **rejection holds a public post back** — pending → rejected → public, and
- *   approved → rejected (approval made it public, rejection leaves visibility
- *   alone), both 404 past the author; a grant made while the post was approved
- *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
- * - **an approved post is live** — the control.
- * - **relation reads follow** — a pending post in a public collection is
- *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
- *   the far end of all four relation lists, a pending post is hidden from
- *   anon even flipped public, and a rejected one from its grant holder.
- * - **fact serving follows** — a pending post's fact is 404 to anon, even
- *   with the post flipped public (also gated on `capabilities.fact_serving`).
- *
- * And the steward arm — the owner of a **non-admin** root (a parentless
- * non-`space` kind carrying the same policy, which the test authorizer leaves
- * open) reads the pending posts under it and moderates them:
- *
- * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
- *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
- * - **moderation** — the root owner approves → 200; the author 403, a
- *   stranger 404.
- * - **the arm stops there** — the root owner's `cell_clone` of the pending
- *   post and a contribution under it are both 404.
- * - **fact serving** — the root owner fetches a pending post's fact → 200,
- *   anon 404 (also gated on `capabilities.fact_serving`).
- *
- * And that `cell_grant_create` refuses a pending contribution — **403**
- * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
- * while a non-manager keeps the **404** mask; the same grant lands once the
- * post is approved.
- *
- * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
- * exists when the directory authorizer is mounted (reference spine binaries).
- */
-export declare const describe_cell_moderate_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAs6BF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC"}