@fuzdev/fuz_app 0.147.0 → 0.149.0

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -13,8 +13,43 @@ export declare const TESTING_ACTION_AUTH: {
     readonly actor: "none";
     readonly credential_types: readonly ["daemon_token"];
 };
+/**
+ * Every `_testing_*` backdoor the shipped cross suites know: the daemon-token
+ * actions a test binary may mount for the harness to drive. The one list a
+ * backend's `capabilities.testing_backdoors` declares from, the
+ * testing-backdoor suite probes, and `describe_spine_cross_suites` gates suites
+ * on. A consumer's own seams stay off it — the testing-backdoor suite takes
+ * those as `extra_methods`.
+ *
+ * `spine_surface_constants.testing_backdoors.test.ts` holds it to the `_testing_*` methods
+ * fuz_app's spine binary mounts, so an action added there fails until it is
+ * listed here.
+ */
+export declare const TESTING_BACKDOOR_METHODS: readonly ["_testing_reset", "_testing_drain_effects", "_testing_mint_session", "_testing_put_fact", "_testing_flood_notifications", "_testing_schema_snapshot", "_testing_migration_tracker", "_testing_action_manifest", "_testing_origin_check", "_testing_shorten_credential_expiry"];
+/** A `_testing_*` backdoor the shipped cross suites know — see `TESTING_BACKDOOR_METHODS`. */
+export type TestingBackdoorMethod = (typeof TESTING_BACKDOOR_METHODS)[number];
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export declare const SPINE_RPC_PATH = "/api/rpc";
+/** Ungated WebSocket endpoint mount path — matches the binaries' `/api/ws`. */
+export declare const SPINE_WS_PATH = "/api/ws";
+/**
+ * Mount prefix of the account REST routes (login, logout, password, status,
+ * signup, bootstrap) on both spine binaries. The `SPINE_ACCOUNT_*_PATH`
+ * constants below are the routes under it the suites drive.
+ */
+export declare const SPINE_ACCOUNT_PATH_PREFIX = "/api/account";
+/** REST login route. */
+export declare const SPINE_ACCOUNT_LOGIN_PATH = "/api/account/login";
+/** REST logout route. */
+export declare const SPINE_ACCOUNT_LOGOUT_PATH = "/api/account/logout";
+/** REST password-change route. */
+export declare const SPINE_ACCOUNT_PASSWORD_PATH = "/api/account/password";
+/** REST account-status route. */
+export declare const SPINE_ACCOUNT_STATUS_PATH = "/api/account/status";
+/** REST signup route. */
+export declare const SPINE_ACCOUNT_SIGNUP_PATH = "/api/account/signup";
+/** REST bootstrap route — the default `BackendConfig.bootstrap_path`. */
+export declare const SPINE_ACCOUNT_BOOTSTRAP_PATH = "/api/account/bootstrap";
 /**
  * Audit-log SSE stream path — `/api/admin` prefix + the
  * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
@@ -23,6 +58,15 @@ export declare const SPINE_RPC_PATH = "/api/rpc";
  * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
  */
 export declare const SPINE_SSE_PATH = "/api/admin/audit/stream";
+/**
+ * The request-body cap both spines ship by default, 1 MiB
+ * (`DEFAULT_MAX_BODY_SIZE` in TS, `DEFAULT_BODY_LIMIT_BYTES` in `fuz_http`).
+ * Kept here as the cross-impl contract value rather than imported from either
+ * impl — the boundary the body-size suites pin is the shared default, and a
+ * change to either is a deliberate cross-impl decision that would revisit them
+ * regardless.
+ */
+export declare const SPINE_BODY_LIMIT_DEFAULT_BYTES: number;
 /**
  * App role the role-shaped-`cell_grant` cross suite exercises. Registered
  * with no grant path (`grant_paths: []`) so it stays a valid registry member

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;CAIF,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;CAIF,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,0RAW3B,CAAC;AAEX,8FAA8F;AAC9F,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,+EAA+E;AAC/E,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD,wBAAwB;AACxB,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,yBAAyB;AACzB,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,kCAAkC;AAClC,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,iCAAiC;AACjC,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,yBAAyB;AACzB,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,QAAc,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -13,8 +13,52 @@ export const TESTING_ACTION_AUTH = {
     actor: 'none',
     credential_types: ['daemon_token']
 };
+/**
+ * Every `_testing_*` backdoor the shipped cross suites know: the daemon-token
+ * actions a test binary may mount for the harness to drive. The one list a
+ * backend's `capabilities.testing_backdoors` declares from, the
+ * testing-backdoor suite probes, and `describe_spine_cross_suites` gates suites
+ * on. A consumer's own seams stay off it — the testing-backdoor suite takes
+ * those as `extra_methods`.
+ *
+ * `spine_surface_constants.testing_backdoors.test.ts` holds it to the `_testing_*` methods
+ * fuz_app's spine binary mounts, so an action added there fails until it is
+ * listed here.
+ */
+export const TESTING_BACKDOOR_METHODS = [
+    '_testing_reset',
+    '_testing_drain_effects',
+    '_testing_mint_session',
+    '_testing_put_fact',
+    '_testing_flood_notifications',
+    '_testing_schema_snapshot',
+    '_testing_migration_tracker',
+    '_testing_action_manifest',
+    '_testing_origin_check',
+    '_testing_shorten_credential_expiry'
+];
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export const SPINE_RPC_PATH = '/api/rpc';
+/** Ungated WebSocket endpoint mount path — matches the binaries' `/api/ws`. */
+export const SPINE_WS_PATH = '/api/ws';
+/**
+ * Mount prefix of the account REST routes (login, logout, password, status,
+ * signup, bootstrap) on both spine binaries. The `SPINE_ACCOUNT_*_PATH`
+ * constants below are the routes under it the suites drive.
+ */
+export const SPINE_ACCOUNT_PATH_PREFIX = '/api/account';
+/** REST login route. */
+export const SPINE_ACCOUNT_LOGIN_PATH = '/api/account/login';
+/** REST logout route. */
+export const SPINE_ACCOUNT_LOGOUT_PATH = '/api/account/logout';
+/** REST password-change route. */
+export const SPINE_ACCOUNT_PASSWORD_PATH = '/api/account/password';
+/** REST account-status route. */
+export const SPINE_ACCOUNT_STATUS_PATH = '/api/account/status';
+/** REST signup route. */
+export const SPINE_ACCOUNT_SIGNUP_PATH = '/api/account/signup';
+/** REST bootstrap route — the default `BackendConfig.bootstrap_path`. */
+export const SPINE_ACCOUNT_BOOTSTRAP_PATH = '/api/account/bootstrap';
 /**
  * Audit-log SSE stream path — `/api/admin` prefix + the
  * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
@@ -23,6 +67,15 @@ export const SPINE_RPC_PATH = '/api/rpc';
  * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
  */
 export const SPINE_SSE_PATH = '/api/admin/audit/stream';
+/**
+ * The request-body cap both spines ship by default, 1 MiB
+ * (`DEFAULT_MAX_BODY_SIZE` in TS, `DEFAULT_BODY_LIMIT_BYTES` in `fuz_http`).
+ * Kept here as the cross-impl contract value rather than imported from either
+ * impl — the boundary the body-size suites pin is the shared default, and a
+ * change to either is a deliberate cross-impl decision that would revisit them
+ * regardless.
+ */
+export const SPINE_BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
 /**
  * App role the role-shaped-`cell_grant` cross suite exercises. Registered
  * with no grant path (`grant_paths: []`) so it stays a valid registry member

package/dist/testing/cross_backend/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkF9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AA0BD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAyStF,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkF9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAO5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AA0BD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAyStF,CAAC"}

package/dist/testing/cross_backend/sse_round_trip.js

@@ -69,8 +69,7 @@ import { create_rpc_post_init } from '../rpc_helpers.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { test_if } from './capabilities.js';
 import { create_account_revocations } from './revocation_drivers.js';
-/** Default audit-log SSE stream path — the standard fuz_app `/api/admin/audit/stream`. */
-const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+import { SPINE_ACCOUNT_LOGOUT_PATH, SPINE_ACCOUNT_PASSWORD_PATH, SPINE_SSE_PATH } from './spine_surface_constants.js';
 /**
  * Assert a decoded SSE frame is a well-formed audit `{method, params}`
  * payload whose `params` validate against the matching `audit_log_event_specs`
@@ -94,8 +93,8 @@ const assert_audit_data_frame = (frame) => {
  * per-session cap.
  */
 export const describe_cross_process_sse_tests = (options) => {
-    const { setup_test, capabilities, base_url, rpc_path, origin, logout_path = '/api/account/logout', password_path = '/api/account/password' } = options;
-    const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    const { setup_test, capabilities, base_url, rpc_path, origin, logout_path = SPINE_ACCOUNT_LOGOUT_PATH, password_path = SPINE_ACCOUNT_PASSWORD_PATH } = options;
+    const sse_path = options.sse_path ?? SPINE_SSE_PATH;
     const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
     describe('cross-process sse', () => {
         test_if(capabilities.sse, 'connects and emits the connected comment', async () => {

package/dist/testing/cross_backend/standard.d.ts

@@ -41,6 +41,7 @@ import '../assert_dev_env.js';
 import type { SessionOptions } from '../../auth/session_cookie.js';
 import type { RoleSchemaResult } from '../../auth/role_schema.js';
 import type { AppSurfaceSpec } from '../../http/surface.js';
+import { type RpcSuccessFixtures } from '../rpc_round_trip.js';
 import type { RpcEndpointsSuiteOption } from '../rpc_helpers.js';
 import type { BackendCapabilities } from './capabilities.js';
 import type { SetupTest, TestFixture } from './setup.js';
@@ -112,7 +113,23 @@ export interface StandardCrossProcessTestOptions {
      * schema on each backend — the success-shape parity check. See
      * `RpcRoundTripTestOptions.success_fixtures`.
      */
-    rpc_success_fixtures?: Map<string, (fixture: TestFixture) => Promise<Record<string, unknown>>>;
+    rpc_success_fixtures?: RpcSuccessFixtures;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `skip_methods` — the
+     * consumer escape hatch for a method the generic round-trip can't drive at
+     * all (a handler whose test wiring stubs out the deps it reaches, or reads
+     * tables the suite's database doesn't migrate). Each entry hides the
+     * method from both the crash check and the envelope check, so name the
+     * reason beside it.
+     */
+    rpc_skip_methods?: Array<string>;
+    /**
+     * Forwarded to `describe_rpc_round_trip_tests` as `input_overrides`
+     * (method name → params) — for a method whose generated params can't
+     * reach its handler cleanly. The response is held to the same rules as a
+     * generated one.
+     */
+    rpc_input_overrides?: Map<string, Record<string, unknown>>;
     /**
      * Forwarded to `describe_round_trip_validation` as `success_fixtures`
      * (`'METHOD /path'` → async `{url?, body?}` factory) for referential REST

package/dist/testing/cross_backend/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAqCF,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAI5D,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAuCF,CAAC"}

package/dist/testing/cross_backend/standard.js

@@ -29,6 +29,8 @@ export const describe_standard_cross_process_tests = (options) => {
         surface_source: options.surface_source,
         session_options: options.session_options,
         rpc_endpoints: options.rpc_endpoints,
+        skip_methods: options.rpc_skip_methods,
+        input_overrides: options.rpc_input_overrides,
         success_fixtures: options.rpc_success_fixtures
     });
     describe_data_exposure_tests({

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -8,6 +8,30 @@ export declare const SPACE_CELL_KIND = "space";
  * `"participant"` literal.
  */
 export declare const PARTICIPATION_ROLE = "participant";
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
+ * exists so a suite can create a comment under a post (`root_id !==
+ * parent_id`) and prove the policy resolves from the governing root (the
+ * space), not the immediate parent. Shared by the gated-create and moderate
+ * cross suites.
+ */
+export declare const TEST_SPACE_POLICY: {
+    readonly policy: {
+        readonly post: {
+            readonly min_role: "participant";
+            readonly moderation_required: true;
+        };
+        readonly react: {
+            readonly min_role: "participant";
+            readonly moderation_required: false;
+        };
+        readonly comment: {
+            readonly min_role: "participant";
+            readonly moderation_required: false;
+        };
+    };
+};
 /** A space's per-kind contribution rule (the shape stamped into `space.data.policy`). */
 export interface ContributionRule {
     min_role?: string;

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;CAMpB,CAAC;AAEX,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAsB9C,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -33,6 +33,21 @@ export const SPACE_CELL_KIND = 'space';
  * `"participant"` literal.
  */
 export const PARTICIPATION_ROLE = SPINE_PARTICIPANT_ROLE;
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
+ * exists so a suite can create a comment under a post (`root_id !==
+ * parent_id`) and prove the policy resolves from the governing root (the
+ * space), not the immediate parent. Shared by the gated-create and moderate
+ * cross suites.
+ */
+export const TEST_SPACE_POLICY = {
+    policy: {
+        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
+    }
+};
 /** Pull the governing root's `data.policy[kind]` rule, defensively (loose `data`). */
 const get_contribution_rule = (data, kind) => {
     if (data === null || typeof data !== 'object')

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,20 +1,37 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
-/** Options for the testing-backdoor negative-credential suite. */
-export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+import { type WsEndpointTarget } from './ws_endpoint.js';
+/**
+ * A backdoor the suite fires: its method and a params payload its input
+ * schema accepts, so a refusal lands on the credential gate, not on validation.
+ */
+export interface TestingBackdoorProbe {
+    readonly method: string;
+    readonly params?: unknown;
+}
+/** Options for the testing-backdoor suite. */
+export interface TestingBackdoorCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /**
      * Where the backend's WebSocket endpoint is, for the session-socket cases.
-     * Pass it when the backend serves the `_testing_*` actions on its WS
+     * Pass it when the backend serves its `_testing_*` actions on its WS
      * endpoint too; omitted, those cases are skipped.
      */
-    readonly ws?: {
-        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
-        readonly base_url: string;
-        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
-        readonly ws_path: string;
-        /** Origin for the upgrade. Defaults to `base_url`. */
-        readonly origin?: string;
-    };
+    readonly ws?: WsEndpointTarget;
+    /**
+     * The backend's own daemon-token seams beyond `TESTING_BACKDOOR_METHODS`,
+     * each with params its input accepts — fired with the same refused
+     * principals as the known backdoors. Each must start with `_testing_` and
+     * not be a known backdoor; the call throws otherwise.
+     */
+    readonly extra_methods?: ReadonlyArray<TestingBackdoorProbe>;
 }
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAyFxE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2F9B,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAMvF,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0C1E;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkDD,8CAA8C;AAC9C,MAAM,WAAW,+BAAgC,SAAQ,uCAAuC;IAC/F;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC7D;AAqDD;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAgHF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -1,28 +1,43 @@
 import '../assert_dev_env.js';
 /**
- * Cross-backend negative-credential suite for the `_testing_*` backdoor
- * actions.
+ * Cross-backend suite for the `_testing_*` backdoor actions: the backend's
+ * declaration of which it mounts, and the credential gate on each.
  *
- * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_flood_notifications` / `_testing_schema_snapshot` /
- * `_testing_migration_tracker` / `_testing_action_manifest` /
- * `_testing_origin_check` / `_testing_shorten_credential_expiry` are
+ * `TESTING_BACKDOOR_METHODS` (`_testing_reset`, `_testing_drain_effects`,
+ * `_testing_mint_session`, `_testing_put_fact`,
+ * `_testing_flood_notifications`, `_testing_schema_snapshot`,
+ * `_testing_migration_tracker`, `_testing_action_manifest`,
+ * `_testing_origin_check`, `_testing_shorten_credential_expiry`) are
  * privileged test-binary actions the production
  * wire never exposes — direct DB writes (full auth wipe, forged session row,
- * raw fact insert), a flood of the caller's own connection, introspection
- * reads (the live schema, the `schema_version` migration tracker, and the live
- * RPC registry — the highest info-leak of the set were the gate to break), a
- * probe of the origin allowlist parser, and a rewrite of an account's
- * credential expiries. Their only structural fence
+ * raw fact insert), the audit barrier, a flood of the caller's own connection,
+ * introspection reads (the live schema, the `schema_version` migration
+ * tracker, and the live RPC registry — the highest info-leak of the set were
+ * the gate to break), a probe of the origin allowlist parser, and a rewrite of
+ * an account's credential expiries. Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
  * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
  * endpoint) but keeps them off the declared surface — so the spec-derived
- * `describe_rpc_attack_surface_tests` never enumerates them, and nothing
- * else fires them with a non-daemon credential to prove the gate holds
- * end-to-end. This suite does, against each impl's real auth resolution.
+ * `describe_rpc_attack_surface_tests` never enumerates them. This suite fires
+ * them with non-daemon credentials to prove the gate holds end-to-end, against
+ * each impl's real auth resolution; a conformance table given the live mount
+ * (`live_rpc_endpoints`) fires the same refusals through the auth rows
+ * `generate_rpc_auth_conformance_cases` generates for them.
  *
- * For every backdoor method, three principals:
+ * **The declaration.** A backend states which it mounts in
+ * `capabilities.testing_backdoors`, and the suite holds it to that: each known
+ * backdoor the declaration leaves out is sent anonymously and must answer
+ * `method_not_found` (404) — both spines look a method up before they
+ * authenticate the caller, so an unmounted method answers that whatever the
+ * credential — and each declared one runs the rows below, whose anonymous row
+ * (a 401, not `method_not_found`) proves it mounted. A wrong declaration fails
+ * either way, so the suites that skip on an undeclared backdoor
+ * (`describe_spine_cross_suites`) skip only what the backend truly lacks. The
+ * check runs on every backend, one mounting none of them included.
+ *
+ * For every declared backdoor, and each `extra_methods` seam (a consumer's own
+ * daemon-token action), three principals:
  *
  * - **anonymous** (no credential) → `401` (pre-authorization auth refuses an
  *   account-less caller before anything else).
@@ -53,13 +68,13 @@ import '../assert_dev_env.js';
  * on both impls. Cited property: `security.md` §Test Backdoor Actions
  * (daemon-token-gated, off-surface, DEV-excluded).
  *
- * Cross-process only — the `_testing_*` actions are mounted on the spawned
- * binary, not the in-process app — like the ws/sse suites. Wire from a
- * `*.cross.test.ts`. Requires the standard `_testing_*` actions mounted (the
- * same precondition `default_cross_process_setup` already imposes for its
- * per-test `_testing_reset`); the HTTP cases are ungated, since every cross
- * backend mounts them, and the WS cases run when `ws` is passed — for a
- * backend that also serves them on its WS endpoint.
+ * The credential rows run cross-process only — the `_testing_*` actions are
+ * mounted on the spawned binary, not the in-process app — like the ws/sse
+ * suites; there, wire from a `*.cross.test.ts`, whose setup fires
+ * `_testing_reset`, so the backend must mount that one. In-process, an app
+ * mounting none declares none, and the suite runs the declaration rows alone,
+ * one per known backdoor. The WS cases run when `ws` is passed — for a
+ * backend that also serves its backdoors on its WS endpoint.
  *
  * @module
  */
@@ -67,46 +82,49 @@ import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
-import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { TESTING_METHOD_PREFIX } from '../surface_invariants.js';
 import { is_response_for } from '../transports/ws_client.js';
 import { test_if } from './capabilities.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { SPINE_RPC_PATH, TESTING_BACKDOOR_METHODS } from './spine_surface_constants.js';
+import { open_session_ws } from './ws_endpoint.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**
- * The backdoor methods + a **valid** params payload each (so the
- * session/bearer cases reach the 403 credential gate rather than a 400 on
- * input validation). The handlers never run — the gate refuses first.
+ * A **valid** params payload for each known backdoor (so the session/bearer
+ * cases reach the 403 credential gate rather than a 400 on input validation).
+ * The handlers never run — the gate refuses first. Keyed by
+ * `TestingBackdoorMethod`, so a method added to `TESTING_BACKDOOR_METHODS`
+ * fails typecheck here until it has its params.
  */
-const backdoor_methods = [
-    { method: '_testing_reset', params: {} },
+const BACKDOOR_PARAMS = {
+    _testing_reset: {},
     // The audit barrier — its input is void, so the call carries no params.
-    { method: '_testing_drain_effects', params: undefined },
-    { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
-    { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    _testing_drain_effects: undefined,
+    _testing_mint_session: { account_id: NIL_UUID, expires_in_seconds: -60 },
+    _testing_put_fact: { content: 'backdoor-probe' },
     // An empty burst — valid input, so it clears the 400 phase; a refused
     // caller never reaches the handler that would queue it.
-    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
+    _testing_flood_notifications: { count: 0, size: 0 },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
-    { method: '_testing_schema_snapshot', params: {} },
+    _testing_schema_snapshot: {},
     // The migration-tracker-dump read — input is an empty strict object, so `{}`
     // is valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_migration_tracker', params: {} },
+    _testing_migration_tracker: {},
     // The RPC-registry-dump read — input is an empty strict object, so `{}` is
     // valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_action_manifest', params: {} },
+    _testing_action_manifest: {},
     // The origin conformance probe — a valid `{patterns, origin}` pair, so it
     // clears the 400 phase like the rest.
-    { method: '_testing_origin_check', params: { patterns: 'http://localhost:*', origin: null } },
+    _testing_origin_check: { patterns: 'http://localhost:*', origin: null },
     // The credential-expiry rewrite — a valid `{account_id, seconds}` pair (a
     // syntactically valid UUID; no row needs to match), so it clears the 400
     // phase like the rest.
-    {
-        method: '_testing_shorten_credential_expiry',
-        params: { account_id: '00000000-0000-4000-8000-000000000000', seconds: 30 }
+    _testing_shorten_credential_expiry: {
+        account_id: '00000000-0000-4000-8000-000000000000',
+        seconds: 30
     }
-];
+};
 const principals = [
     {
         name: 'anonymous',
@@ -137,11 +155,89 @@ const principals = [
         })
     }
 ];
+/**
+ * The known backdoors a backend declares, checked against the known list,
+ * and its extra seams, checked against the `_testing_` prefix and the list.
+ *
+ * @throws Error - on a declared method that isn't a known backdoor, an extra
+ *   method outside the `_testing_` namespace or naming a known backdoor, or a
+ *   duplicate
+ */
+const resolve_backdoor_probes = (declared, extra_methods) => {
+    const known = new Set(TESTING_BACKDOOR_METHODS);
+    const seen = new Set();
+    for (const method of declared) {
+        if (!known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares ` +
+                `'${method}', which is not in TESTING_BACKDOOR_METHODS — pass a consumer seam as extra_methods`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares '${method}' twice`);
+        }
+        seen.add(method);
+    }
+    for (const { method } of extra_methods) {
+        if (!method.startsWith(TESTING_METHOD_PREFIX) || known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' must start with ` +
+                `'${TESTING_METHOD_PREFIX}' and not be a known backdoor (declare those in capabilities.testing_backdoors)`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' is listed twice`);
+        }
+        seen.add(method);
+    }
+    return [
+        ...TESTING_BACKDOOR_METHODS.filter((method) => declared.includes(method)).map((method) => ({
+            method,
+            params: BACKDOOR_PARAMS[method]
+        })),
+        ...extra_methods
+    ];
+};
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export const describe_testing_backdoor_cross_tests = (options) => {
-    const { setup_test, ws } = options;
+    const { setup_test, capabilities, ws, extra_methods = [] } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const declared = capabilities.testing_backdoors;
+    const probes = resolve_backdoor_probes(declared, extra_methods);
+    // a declared backdoor's mount is pinned by its anonymous row below (a 401,
+    // not `method_not_found`); an undeclared one must not be mounted, so a
+    // backend can't mount one its declaration leaves out
+    const undeclared = TESTING_BACKDOOR_METHODS.filter((method) => !declared.includes(method));
+    // vitest fails a describe holding no test, so a full declaration registers none
+    if (undeclared.length > 0) {
+        describe('testing backdoor declaration', () => {
+            for (const method of undeclared) {
+                test(`${method} is undeclared → method_not_found`, async () => {
+                    const fixture = await setup_test();
+                    const res = await rpc_call({
+                        app: fixture.fresh_transport(),
+                        path: rpc_path,
+                        method,
+                        params: BACKDOOR_PARAMS[method]
+                    });
+                    assert.ok(!res.ok, `${method}: undeclared in capabilities.testing_backdoors, but the call succeeded`);
+                    if (!res.ok) {
+                        assert.strictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${method}: undeclared in capabilities.testing_backdoors, but it answers ` +
+                            `${res.status} (${res.error.code}) — the backend mounts it, so declare it`);
+                    }
+                    assert.strictEqual(res.status, 404, `${method}: status`);
+                });
+            }
+        });
+    }
+    // none declared and no extra seam: no rows, and vitest fails an empty describe
+    if (probes.length === 0)
+        return;
     describe('testing backdoor credential gate parity', () => {
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             for (const principal of principals) {
                 test(`${method} rejects ${principal.name} → ${principal.status}`, async () => {
                     const fixture = await setup_test();
@@ -156,9 +252,10 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                     });
                     const label = `${method} ${principal.name}`;
                     assert.ok(!res.ok, `${label}: expected denial (${principal.status}) but the call succeeded`);
-                    assert.strictEqual(res.status, principal.status, `${label}: status`);
                     // `!res.ok` narrows `res` to the error variant for `res.error`.
                     if (!res.ok) {
+                        assert.notStrictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${label}: declared but not mounted — the backend answers method_not_found`);
+                        assert.strictEqual(res.status, principal.status, `${label}: status`);
                         assert.strictEqual(res.error.code, principal.code, `${label}: error.code`);
                         if (principal.reason !== undefined) {
                             const reason = res.error.data?.reason;
@@ -168,15 +265,10 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                 });
             }
         }
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
                 const fixture = await setup_test();
-                const client = await create_admitted_ws_transport({
-                    base_url: ws.base_url,
-                    ws_path: ws.ws_path,
-                    cookies: fixture.transport.cookies(),
-                    origin: ws.origin
-                });
+                const client = await open_session_ws(ws, fixture, { admitted: true });
                 try {
                     const id = `backdoor_${method}`;
                     await client.send({ jsonrpc: '2.0', id, method, params });