@fuzdev/fuz_app 0.147.0 → 0.149.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.147.0",
+  "version": "0.149.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -14,10 +14,12 @@
     "build": "gro build",
     "check": "gro check",
     "test": "gro test",
+    "test:cross": "node --conditions=development src/test/cross_backend/run_cross.ts",
     "test:cross:ts": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_ts_node --project cross_backend_ts_deno --project cross_backend_ts_bun",
     "test:cross:rust-spine-stub": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_rust_spine_stub",
     "test:cross:parity": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_parity",
     "test:cross:security": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_security",
+    "test:cross:ts-differential": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_ts_differential",
     "benchmark:cross-impl": "gro run src/benchmarks/cross_impl.bench.ts",
     "preview": "vite preview",
     "deploy": "gro deploy"
@@ -33,7 +35,7 @@
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.4",
     "@fuzdev/blake3-wasm": ">=0.2.0",
-    "@fuzdev/fuz_css": ">=0.70.0",
+    "@fuzdev/fuz_css": ">=0.71.1",
     "@fuzdev/fuz_schema": "^0.5.0",
     "@fuzdev/fuz_util": ">=0.78.0",
     "@fuzdev/pglet-wasm": ">=0.1.2",
@@ -92,11 +94,11 @@
     "@electric-sql/pglite": "^0.5.8",
     "@fuzdev/blake3-wasm": "^0.2.0",
     "@fuzdev/fuz_code": "^0.54.0",
-    "@fuzdev/fuz_css": "^0.71.0",
+    "@fuzdev/fuz_css": "^0.71.1",
     "@fuzdev/fuz_schema": "^0.5.0",
     "@fuzdev/fuz_ui": "^0.220.0",
     "@fuzdev/fuz_util": "^0.78.0",
-    "@fuzdev/gro": "^0.220.0",
+    "@fuzdev/gro": "^0.222.0",
     "@fuzdev/mdz": "^0.6.0",
     "@fuzdev/pglet-wasm": "^0.1.2",
     "@hono/bun": "^1.0.1",

package/dist/testing/cross_backend/actor_search.d.ts

@@ -1,6 +0,0 @@
-import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
-/** Options for the actor-search parity suite (the standard RPC-dispatched shape). */
-export type ActorSearchCrossTestOptions = RpcPathCrossSuiteOptions;
-export declare const describe_actor_search_cross_tests: (options: ActorSearchCrossTestOptions) => void;
-//# sourceMappingURL=actor_search.d.ts.map

package/dist/testing/cross_backend/actor_search.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"actor_search.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_search.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAyDxF,CAAC"}

package/dist/testing/cross_backend/actor_search.js

@@ -1,90 +0,0 @@
-import '../assert_dev_env.js';
-/**
- * Cross-backend parity suite for `actor_search`.
- *
- * `actor_search` is an opt-in case-insensitive prefix search over
- * `actor.name` (`{query, scope_ids?, limit?} → {actors: [{id, username,
- * display_name?}]}`), not folded into the standard bundle. Like
- * `actor_lookup` / cells, it's live-mounted on the spine RPC path but kept
- * off the declared surface, so this dedicated suite is its validator. The
- * security property under test is the **empty-`scope_ids` admin gate**:
- *
- * - **anonymous → 401** — the account-grain auth gate refuses an
- *   unauthenticated caller before the handler runs.
- * - **non-admin + no `scope_ids` → 400** `actor_search_scope_required` — an
- *   unbounded global search is admin-only; a non-admin must scope the query.
- *   This is the core security assertion, exercised against each impl's real
- *   auth resolution.
- * - **non-admin + `scope_ids` → 200** — passing a scope bypasses the admin
- *   requirement (results are filtered to actors holding active role_grants on
- *   those scopes); an unheld scope simply yields an empty result, not a
- *   rejection — proving the gate keys on `scope_ids` presence, not identity.
- * - **admin + no `scope_ids` → 200** — the admin path reaches the unbounded
- *   search.
- *
- * Cites `security.md` §Authorization (the `actor_search` scope gate).
- *
- * Runs both legs via the shared `{setup_test}` protocol: in-process
- * (`auth/actor_search_parity.db.test.ts`) + cross-process
- * (`cross_backend/actor_search.cross.test.ts`, TS spine binaries + Rust
- * `testing_spine_stub`). Mounted on every spine, so the suite is ungated.
- *
- * @module
- */
-import { describe, test, assert } from 'vitest';
-import { actor_search_action_spec, ERROR_ACTOR_SEARCH_SCOPE_REQUIRED } from '../../auth/actor_search_action_specs.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** Nil UUID — an unheld scope id (no actor holds a role_grant on it). */
-const NIL_UUID = '00000000-0000-0000-0000-000000000000';
-/** Build the JSON-RPC envelope body for an `actor_search` call. */
-const search_envelope = (params, id) => JSON.stringify({ jsonrpc: '2.0', method: actor_search_action_spec.method, params, id });
-export const describe_actor_search_cross_tests = (options) => {
-    const { setup_test } = options;
-    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    describe('actor_search parity', () => {
-        test('anonymous → 401 (account-grain auth gate)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'anon-search')
-            });
-            assert.strictEqual(res.status, 401, 'unauthenticated actor_search must be refused');
-        });
-        test('non-admin + no scope_ids → 400 actor_search_scope_required', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { ...account.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'nonadmin-noscope')
-            });
-            assert.strictEqual(res.status, 400, 'non-admin unbounded search must be rejected');
-            const body = (await res.json());
-            assert.strictEqual(body.error?.data?.reason, ERROR_ACTOR_SEARCH_SCOPE_REQUIRED, 'rejection carries the scope-required reason');
-        });
-        test('non-admin + scope_ids → 200 (scope bypasses admin gate)', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { ...account.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a', scope_ids: [NIL_UUID] }, 'nonadmin-scope')
-            });
-            assert.strictEqual(res.status, 200, 'non-admin with a scope filter is allowed');
-            const body = (await res.json());
-            assert(Array.isArray(body.result?.actors), 'response carries an actors array');
-        });
-        test('admin + no scope_ids → 200 (admin reaches unbounded search)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
-                body: search_envelope({ query: 'a' }, 'admin-noscope')
-            });
-            assert.strictEqual(res.status, 200, 'admin unbounded search is allowed');
-            const body = (await res.json());
-            assert(Array.isArray(body.result?.actors), 'response carries an actors array');
-        });
-    });
-};

package/dist/testing/cross_backend/cell_cross_helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cell_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAMnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}