@fuzdev/fuz_app 0.147.0 → 0.149.0

package/dist/testing/audit_drift_guard.js

@@ -1,7 +1,9 @@
 import './assert_dev_env.js';
 import { assert, beforeEach, afterEach } from 'vitest';
+import { z } from 'zod';
 import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures } from '../auth/audit_log_queries.js';
 import { get_audit_write_failures, reset_audit_write_failures } from '../auth/audit_emitter.js';
+import { audit_metadata_schemas } from '../auth/audit_log_schema.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
@@ -62,8 +64,9 @@ export const assert_no_audit_drift = () => {
  * `notify` is a no-op; `add_listener` records into a local array that
  * `listener_count` reports, and returns a remover with the production
  * semantics (per registration, idempotent) — registered listeners never fire,
- * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once:
- * a recorded call writes nothing, so nothing is ever in flight.
+ * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once
+ * and `is_tracking_inflight` answers `false`: a recorded call writes nothing, so nothing is
+ * ever in flight.
  *
  * `emit` AND `emit_pool` both append to `calls`, so a test reads either
  * entry point's writes off the same array.
@@ -116,7 +119,56 @@ export const create_recording_audit_emitter = (calls_ref) => {
             };
         },
         listener_count: () => listeners.length,
-        drain_inflight: () => Promise.resolve()
+        drain_inflight: () => Promise.resolve(),
+        is_tracking_inflight: () => false
     };
     return { emitter, calls };
 };
+/**
+ * The closed-world twin of a builtin event's `audit_metadata_schemas` entry:
+ * the same fields, with unknown keys refused. The registry's schemas are
+ * `z.looseObject` so a consumer can add fields to a builtin event (a builtin's
+ * schema can't be overridden), so this is opt-in.
+ */
+const to_closed_metadata_schema = (schema) => {
+    if (schema instanceof z.ZodNullable) {
+        return to_closed_metadata_schema(schema.unwrap()).nullable();
+    }
+    if (schema instanceof z.ZodObject)
+        return z.strictObject(schema.shape);
+    return schema;
+};
+const declared_metadata_schemas = new Map(Object.entries(audit_metadata_schemas));
+const closed_metadata_schemas = new Map(Object.entries(audit_metadata_schemas).map(([event_type, schema]) => [
+    event_type,
+    to_closed_metadata_schema(schema)
+]));
+/**
+ * Assert an audit row read off the wire carries the metadata its event type
+ * declares — parsed against `audit_metadata_schemas[event_type]` as declared,
+ * so a mistyped, `null`, or missing field fails, and with
+ * `reject_unknown_keys` so does a key the event doesn't declare. The wire
+ * schema (`AuditLogEventJson.metadata`) is a loose record, and only the TS
+ * spine validates metadata, at insert and fail-open, so this is the check that
+ * holds a spine's rows to their event's contract.
+ *
+ * Builtin event types only: a consumer-registered type has no entry here, and
+ * passes unexamined.
+ *
+ * @param event - an audit row from `audit_log_list` or an audit read like it
+ * @param options - `reject_unknown_keys` for the closed-world check
+ * @throws AssertionError naming the event type and the schema issues
+ */
+export const assert_audit_event_metadata = (event, options) => {
+    const schema = (options?.reject_unknown_keys ? closed_metadata_schemas : declared_metadata_schemas).get(event.event_type);
+    if (!schema)
+        return;
+    const parsed = schema.safeParse(event.metadata);
+    if (parsed.success)
+        return;
+    assert.fail(`audit row ${event.event_type} (outcome=${event.outcome}) carries metadata outside its ` +
+        `audit_metadata_schemas entry: ${JSON.stringify(event.metadata)} — ` +
+        parsed.error.issues
+            .map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)
+            .join('; '));
+};

package/dist/testing/cross_backend/account_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAqZF,CAAC"}
+{"version":3,"file":"account_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/account_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAEvF,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAwaF,CAAC"}

package/dist/testing/cross_backend/account_lifecycle.js

@@ -17,11 +17,12 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, AuditLogListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
+import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED, ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { assert_audit_metadata_fields, list_audit_events } from './audit_cross_helpers.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_account_lifecycle_cross_tests = (options) => {
@@ -38,6 +39,15 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             assert.strictEqual(deleted.deleted, true);
             const undeleted = expect_output(await cross_rpc_call(t, rpc_path, 'account_undelete', { account_id: victim.account.id }, admin_headers), AccountUndeleteOutput);
             assert.strictEqual(undeleted.undeleted, true);
+            // each verb audits the victim's identity snapshot, attributed to
+            // the admin (`list_audit_events` parses the metadata)
+            for (const event_type of ['account_delete', 'account_undelete']) {
+                const events = await list_audit_events(fixture, { event_type }, rpc_path);
+                const row = events.find((e) => e.outcome === 'success' && e.target_account_id === victim.account.id);
+                assert.ok(row, `${event_type} writes a success row targeting the victim`);
+                assert.strictEqual(row.account_id, fixture.account.id, event_type);
+                assert.strictEqual(row.metadata?.username, victim.account.username, `${event_type} snapshots the username`);
+            }
         });
         test_if(capabilities.account_lifecycle, 'purge (keeper, confirmed)', async () => {
             const fixture = await setup_test();
@@ -46,6 +56,11 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             // Purge is keeper-gated: daemon-token credential, not a session.
             const purged = expect_output(await cross_rpc_call(t, rpc_path, 'account_purge', { account_id: victim.account.id, confirm: true }, fixture.create_daemon_token_headers()), AccountPurgeOutput);
             assert.strictEqual(purged.purged, true);
+            // the purge row outlives the account it names, carrying its identity
+            const events = await list_audit_events(fixture, { event_type: 'account_purge' }, rpc_path);
+            const row = events.find((e) => e.outcome === 'success' && e.target_account_id === victim.account.id);
+            assert.ok(row, 'account_purge writes a success row targeting the victim');
+            assert.strictEqual(row.metadata?.username, victim.account.username, 'account_purge snapshots the username');
         });
         test_if(capabilities.account_lifecycle, 'keeper guard: delete + purge refuse the keeper account', async () => {
             const fixture = await setup_test();
@@ -119,16 +134,11 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             // and emits a forensic `outcome: failure` audit row.
             const del = await cross_rpc_call(t, rpc_path, 'account_delete', { account_id: fixture.account.id }, fixture.create_session_headers());
             assert.strictEqual(error_reason(del), ERROR_CANNOT_DELETE_KEEPER);
-            // Deterministic barrier before reading: await in-flight
-            // fire-and-forget audit writes on either spine.
-            const td = fixture.fresh_transport({ origin: null });
-            const drained = await cross_rpc_call(td, rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
-            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
-            // The failure row is now authoritative on both spines. `_testing_reset`
-            // wiped audit_log at setup, so the refused delete is the only
-            // account_delete event.
-            const listed = expect_output(await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type: 'account_delete' }, fixture.create_session_headers()), AuditLogListOutput);
-            const failure = listed.events.find((e) => e.outcome === 'failure' &&
+            // Read behind the drain barrier, so the failure row is authoritative
+            // on both spines. `_testing_reset` wiped audit_log at setup, so the
+            // refused delete is the only account_delete event.
+            const events = await list_audit_events(fixture, { event_type: 'account_delete' }, rpc_path);
+            const failure = events.find((e) => e.outcome === 'failure' &&
                 e.metadata?.reason === ERROR_CANNOT_DELETE_KEEPER);
             assert.ok(failure, 'keeper-removal guard must emit an account_delete outcome=failure audit row with reason cannot_delete_keeper');
             // Byte-shape gate on the audit row's timestamp — `z.string()` in
@@ -151,6 +161,13 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             const again = await cross_rpc_call(t, rpc_path, 'account_undelete', { account_id: victim.account.id }, admin_headers);
             assert.strictEqual(again.ok, false, 'double-undelete must not silently succeed');
             assert.strictEqual(error_reason(again), ERROR_ACCOUNT_NOT_FOUND);
+            // the refused undelete is audited as a failure naming the probed id
+            const events = await list_audit_events(fixture, { event_type: 'account_undelete', outcome: 'failure' }, rpc_path);
+            assert.strictEqual(events.length, 1, 'one account_undelete failure row');
+            assert_audit_metadata_fields(fixture, events[0].metadata, {
+                reason: ERROR_ACCOUNT_NOT_FOUND,
+                attempted_account_id: victim.account.id
+            });
         });
         // The last-admin guard (`ERROR_CANNOT_DELETE_LAST_ADMIN`) is **not**
         // cross-process-testable against this fixture: the per-test keeper

package/dist/testing/cross_backend/actor_lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkDxF,CAAC"}
+{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8BxF,CAAC"}

package/dist/testing/cross_backend/actor_lookup.js

@@ -6,22 +6,22 @@ import '../assert_dev_env.js';
  * (`{ids} → {actors: [{id, username, display_name?}]}`), not folded into the
  * standard bundle. It's live-mounted on the spine RPC path but kept off the
  * declared surface (`create_spine_surface_spec`) — like cells / ws / sse — so
- * the standard cross suite's generic round-trip never drives it; this
- * dedicated suite is its validator. Three cases over raw transport calls:
+ * the standard cross suite's generic round-trip never drives it.
+ *
+ * Its single-request refusals are conformance-table rows on a table given the
+ * live mount (`live_rpc_endpoints`): the anonymous 401 a generated auth row,
+ * the empty-`ids` 400 a hand-written one. This suite holds what a row can't
+ * say, because it names the fixture's own actor:
  *
- * - **anonymous → 401** — the account-grain auth gate refuses an
- *   unauthenticated caller before the handler runs.
  * - **keeper resolves own actor → 200** — the populated round trip: the
  *   returned row carries the keeper's `id` + `username`, and **no**
  *   `account_id` / `email` / timestamp / role field (the wire shape's
  *   deliberate info-leak posture). This is the assertion that exercises the
  *   Rust row→JSON mapping against the TS canonical shape.
- * - **empty `ids` → 400** — the `min(1)` input bound is enforced on both
- *   spines (TS Zod, Rust `parse_ids`).
  *
  * Runs both legs via the shared `{setup_test}` protocol: the in-process leg
  * (`auth/actor_lookup_parity.db.test.ts`, plain `gro test`) and the
- * cross-process leg (`cross_backend/actor_lookup.cross.test.ts`, the TS spine
+ * cross-process leg (`cross_backend/spine_suites.cross.test.ts`, the TS spine
  * binaries + Rust `testing_spine_stub` over real HTTP). `actor_lookup` is
  * mounted on every spine, so the suite is ungated.
  *
@@ -38,15 +38,6 @@ export const describe_actor_lookup_cross_tests = (options) => {
     const { setup_test } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('actor_lookup parity', () => {
-        test('anonymous → 401 (account-grain auth gate)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.fresh_transport()(rpc_path, {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                body: lookup_envelope([fixture.actor.id], 'anon-lookup')
-            });
-            assert.strictEqual(res.status, 401, 'unauthenticated actor_lookup must be refused');
-        });
         test('keeper resolves own actor → 200 with id + username, no control fields', async () => {
             const fixture = await setup_test();
             const res = await fixture.transport(rpc_path, {
@@ -67,14 +58,5 @@ export const describe_actor_lookup_cross_tests = (options) => {
                 assert(!(key in row), `actor_lookup row must not leak '${key}'`);
             }
         });
-        test('empty ids → 400 (min(1) input bound)', async () => {
-            const fixture = await setup_test();
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
-                body: lookup_envelope([], 'empty-lookup')
-            });
-            assert.strictEqual(res.status, 400, 'empty ids must fail input validation');
-        });
     });
 };

package/dist/testing/cross_backend/app_settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_settings.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/app_settings.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAiBnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8DxF,CAAC"}
+{"version":3,"file":"app_settings.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/app_settings.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAcnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8DxF,CAAC"}

package/dist/testing/cross_backend/app_settings.js

@@ -22,7 +22,7 @@ import '../assert_dev_env.js';
  *
  * Cites `security.md` §Signup. Runs both legs via the shared `{setup_test}`
  * protocol: in-process (`auth/app_settings_parity.db.test.ts`) +
- * cross-process (`cross_backend/app_settings.cross.test.ts`, TS spine
+ * cross-process (`cross_backend/spine_suites.cross.test.ts`, TS spine
  * binaries + Rust `testing_spine_stub`). Mounted on every spine, so the
  * suite is ungated.
  *
@@ -31,9 +31,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { app_settings_update_action_spec } from '../../auth/admin_action_specs.js';
 import { ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** REST signup path on the spine surface (`/api/account` prefix + `/signup`). */
-const SIGNUP_PATH = '/api/account/signup';
+import { SPINE_ACCOUNT_SIGNUP_PATH, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A password that satisfies the creation-strength schema (min 12). */
 const SIGNUP_PASSWORD = 'securepassword123';
 /** Build the JSON-RPC envelope for an `app_settings_update` call. */
@@ -55,7 +53,7 @@ export const describe_app_settings_cross_tests = (options) => {
                 body: update_envelope(true, 'enable-open-signup')
             });
             assert.strictEqual(enable.status, 200, 'admin app_settings_update must succeed');
-            const res = await fixture.fresh_transport()(SIGNUP_PATH, {
+            const res = await fixture.fresh_transport()(SPINE_ACCOUNT_SIGNUP_PATH, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ username: 'open_signup_user', password: SIGNUP_PASSWORD })
@@ -80,7 +78,7 @@ export const describe_app_settings_cross_tests = (options) => {
                 body: update_envelope(false, 'disable-open-signup')
             });
             assert.strictEqual(disable.status, 200, 'admin app_settings_update (disable) must succeed');
-            const res = await fixture.fresh_transport()(SIGNUP_PATH, {
+            const res = await fixture.fresh_transport()(SPINE_ACCOUNT_SIGNUP_PATH, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ username: 'closed_signup_user', password: SIGNUP_PASSWORD })

package/dist/testing/cross_backend/audit_cross_helpers.d.ts

@@ -0,0 +1,57 @@
+import '../assert_dev_env.js';
+import type { AuditLogEventWithUsernamesJson } from '../../auth/audit_log_schema.js';
+import type { FetchTransport } from '../transports/fetch_transport.js';
+/** The fixture members an audit read uses — every `TestFixture` has them. */
+export interface AuditReadFixture {
+    readonly fresh_transport: (options?: {
+        readonly origin?: string | null;
+    }) => FetchTransport;
+    /** The keeper's session headers — the keeper holds the admin role the audit read needs. */
+    readonly create_session_headers: (extra?: Record<string, string>) => Record<string, string>;
+    readonly create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
+    /** Refuse undeclared metadata keys — see `TestFixture.reject_unknown_audit_metadata_keys`. */
+    readonly reject_unknown_audit_metadata_keys?: boolean;
+}
+/**
+ * Await the backend's in-flight audit writes via `_testing_drain_effects`, so
+ * a following `audit_log_list` sees every row emitted before the call. The
+ * backend must mount the action — every spine test binary does; in-process
+ * suites mount `create_testing_drain_effects_action`.
+ *
+ * Refuses an answer without `tracked: true`. A binary whose audit emitter was
+ * built without in-flight tracking answers the drain at once, waiting on
+ * nothing, and its audit reads race the writes — an absent row then reads as
+ * a pass. Every audit read runs through here, so each one checks the barrier
+ * is live.
+ *
+ * @param fixture - the per-test fixture, whose daemon token authorizes the drain
+ * @param rpc_path - the RPC endpoint the drain action is mounted on
+ */
+export declare const cross_drain_effects: (fixture: AuditReadFixture, rpc_path?: string) => Promise<void>;
+/**
+ * Assert an audit row's `metadata` carries `expected` — each field compared
+ * on its own, so a consumer's added key passes — and none of `absent`. When
+ * the fixture's setup closed the world (`reject_unknown_audit_metadata_keys`),
+ * the whole object must equal `expected`, so an undeclared key fails too.
+ *
+ * @param fixture - the per-test fixture, whose flag picks the comparison
+ * @param metadata - the row's `metadata`
+ * @param expected - the declared fields and their values
+ * @param absent - keys the row must not carry, e.g. an optional field left unset
+ */
+export declare const assert_audit_metadata_fields: (fixture: Pick<AuditReadFixture, "reject_unknown_audit_metadata_keys">, metadata: Record<string, unknown> | null, expected: Record<string, unknown>, absent?: ReadonlyArray<string>) => void;
+/**
+ * Drain the backend's audit writes (`cross_drain_effects`), then list audit rows as
+ * the keeper, parse them against `AuditLogListOutput`, and parse each row's
+ * `metadata` against its event type's schema (`assert_audit_event_metadata`),
+ * with unknown keys refused when `fixture.reject_unknown_audit_metadata_keys`
+ * is set. The wire schema leaves `metadata` a loose record, so without this a
+ * spine's metadata drift reaches no assertion.
+ *
+ * @param fixture - the per-test fixture; the list runs on the keeper's session
+ * @param params - `audit_log_list` params, e.g. `{event_type: 'login', outcome: 'failure'}`
+ * @param rpc_path - the RPC endpoint both actions are mounted on
+ * @returns the listed events
+ */
+export declare const list_audit_events: (fixture: AuditReadFixture, params: Record<string, unknown>, rpc_path?: string) => Promise<Array<AuditLogEventWithUsernamesJson>>;
+//# sourceMappingURL=audit_cross_helpers.d.ts.map

package/dist/testing/cross_backend/audit_cross_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CAmBd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}

package/dist/testing/cross_backend/audit_cross_helpers.js

@@ -0,0 +1,89 @@
+import '../assert_dev_env.js';
+/**
+ * Audit-row reads for the cross-backend suites, behind the
+ * `_testing_drain_effects` barrier.
+ *
+ * Both spines write audit rows off the request path — a WS mutation is
+ * answered before its effects flush, and the Rust spine's emits are
+ * fire-and-forget — so a suite that reads `audit_log_list` right after the
+ * call it audits can miss the row, and an assertion that a row is absent then
+ * passes vacuously. `list_audit_events` drains before it lists, so no reader
+ * can skip the barrier, and holds every row it lists to its event type's
+ * metadata schema (`assert_audit_event_metadata`), so every reader checks the
+ * metadata of the rows it reads, on every spine — closed to undeclared keys
+ * when the fixture's setup asked for it.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { assert_audit_event_metadata } from '../audit_drift_guard.js';
+import { cross_rpc_call, expect_output } from './cross_rpc.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * Await the backend's in-flight audit writes via `_testing_drain_effects`, so
+ * a following `audit_log_list` sees every row emitted before the call. The
+ * backend must mount the action — every spine test binary does; in-process
+ * suites mount `create_testing_drain_effects_action`.
+ *
+ * Refuses an answer without `tracked: true`. A binary whose audit emitter was
+ * built without in-flight tracking answers the drain at once, waiting on
+ * nothing, and its audit reads race the writes — an absent row then reads as
+ * a pass. Every audit read runs through here, so each one checks the barrier
+ * is live.
+ *
+ * @param fixture - the per-test fixture, whose daemon token authorizes the drain
+ * @param rpc_path - the RPC endpoint the drain action is mounted on
+ */
+export const cross_drain_effects = async (fixture, rpc_path = SPINE_RPC_PATH) => {
+    const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+    assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+    const tracked = typeof drained.result === 'object' && drained.result !== null
+        ? drained.result.tracked
+        : undefined;
+    assert.strictEqual(tracked, true, "_testing_drain_effects must answer tracked: true — the backend's audit emitter does not " +
+        `track in-flight writes, so the drain waits on nothing (got ${JSON.stringify(drained.result)})`);
+};
+/**
+ * Assert an audit row's `metadata` carries `expected` — each field compared
+ * on its own, so a consumer's added key passes — and none of `absent`. When
+ * the fixture's setup closed the world (`reject_unknown_audit_metadata_keys`),
+ * the whole object must equal `expected`, so an undeclared key fails too.
+ *
+ * @param fixture - the per-test fixture, whose flag picks the comparison
+ * @param metadata - the row's `metadata`
+ * @param expected - the declared fields and their values
+ * @param absent - keys the row must not carry, e.g. an optional field left unset
+ */
+export const assert_audit_metadata_fields = (fixture, metadata, expected, absent = []) => {
+    assert.ok(metadata, 'the audit row carries metadata');
+    for (const [key, value] of Object.entries(expected)) {
+        assert.deepStrictEqual(metadata[key], value, `metadata.${key}`);
+    }
+    for (const key of absent)
+        assert.notProperty(metadata, key, `metadata.${key} is absent`);
+    if (fixture.reject_unknown_audit_metadata_keys) {
+        assert.deepStrictEqual(metadata, expected, 'metadata carries only the declared fields');
+    }
+};
+/**
+ * Drain the backend's audit writes (`cross_drain_effects`), then list audit rows as
+ * the keeper, parse them against `AuditLogListOutput`, and parse each row's
+ * `metadata` against its event type's schema (`assert_audit_event_metadata`),
+ * with unknown keys refused when `fixture.reject_unknown_audit_metadata_keys`
+ * is set. The wire schema leaves `metadata` a loose record, so without this a
+ * spine's metadata drift reaches no assertion.
+ *
+ * @param fixture - the per-test fixture; the list runs on the keeper's session
+ * @param params - `audit_log_list` params, e.g. `{event_type: 'login', outcome: 'failure'}`
+ * @param rpc_path - the RPC endpoint both actions are mounted on
+ * @returns the listed events
+ */
+export const list_audit_events = async (fixture, params, rpc_path = SPINE_RPC_PATH) => {
+    await cross_drain_effects(fixture, rpc_path);
+    const { events } = expect_output(await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'audit_log_list', params, fixture.create_session_headers()), AuditLogListOutput);
+    const reject_unknown_keys = fixture.reject_unknown_audit_metadata_keys ?? false;
+    for (const event of events)
+        assert_audit_event_metadata(event, { reject_unknown_keys });
+    return events;
+};

package/dist/testing/cross_backend/backend_config.d.ts

@@ -44,7 +44,8 @@ export interface BackendBootstrapConfig {
      * (env: `*_DAEMON_TOKEN_PATH`). `spawn_backend` reads this file once
      * after the health probe succeeds and threads the token onto
      * `BackendHandle.daemon_token` for `_testing_reset` calls plus any
-     * other admin/keeper-gated cross-process tests.
+     * other admin/keeper-gated cross-process tests. `spawn_backend` deletes
+     * the file before each spawn, so a token a previous run left is never read.
      */
     readonly daemon_token_path: string;
 }

package/dist/testing/cross_backend/backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C"}
+{"version":3,"file":"backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C"}

package/dist/testing/cross_backend/body_size.d.ts

@@ -20,6 +20,12 @@ export interface BodySizeCrossTestOptions extends RpcPathCrossSuiteOptions {
      * time.
      */
     readonly base_url: string | null;
+    /**
+     * The backend's request-body cap on `rpc_path`, in bytes — the boundary the
+     * cases probe. Default `SPINE_BODY_LIMIT_DEFAULT_BYTES`; pass the backend's
+     * value when it caps its RPC path elsewhere.
+     */
+    readonly rpc_max_body_bytes?: number;
 }
 export declare const describe_body_size_cross_tests: (options: BodySizeCrossTestOptions) => void;
 //# sourceMappingURL=body_size.d.ts.map

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAwHD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA+HlF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiG9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AA8FD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAkIlF,CAAC"}