@fuzdev/fuz_app 0.148.0 → 0.149.0

package/dist/testing/adversarial_input_cases.js

@@ -14,9 +14,10 @@ import './assert_dev_env.js';
  */
 import { z } from 'zod';
 import { zod_unwrap_to_object, zod_extract_fields } from '../zod.js';
+import { resolve_invalid_reason } from '../schema_meta.js';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
-import { detect_format, generate_valid_value } from './schema_generators.js';
+import { detect_format, detect_json_schema_format, format_zod_issues, generate_valid_object, generate_valid_object_with_field, generate_valid_string_param, to_field_json_schema } from './schema_generators.js';
 // --- Payload generation ---
 /** One wrong-type value per base type — one representative is sufficient. */
 const wrong_type_for = (base_type) => {
@@ -55,7 +56,17 @@ const format_violation = (format) => {
             return null;
     }
 };
-// --- Input test case generation ---
+/**
+ * `value` moved by `step`, up when that stays inside the field's numeric range
+ * and down otherwise — a number off the integer or `multipleOf` grid that
+ * still meets the range, so the grid check is the one a refusal names.
+ */
+const off_grid_in_range = (json, value, step) => {
+    const up = value + step;
+    const over = (typeof json.maximum === 'number' && up > json.maximum) ||
+        (typeof json.exclusiveMaximum === 'number' && up >= json.exclusiveMaximum);
+    return over ? value - step : up;
+};
 /**
  * Generate adversarial test cases for a route's input schema.
  *
@@ -65,12 +76,34 @@ const format_violation = (format) => {
  * - One wrong-type value per field
  * - Null for required non-nullable fields
  * - One format violation per constrained field
+ * - String length (empty, one under `minLength`, one over `maxLength`), numeric
+ *   (out of range, non-integer, off a `multipleOf` grid) and array-length
+ *   (empty, one under `minItems`, one over `maxItems`) boundaries
+ *
+ * Format and boundaries come from the field's input-side JSON Schema
+ * (`to_field_json_schema`), so a field carrying a `.transform()` or pipe and a
+ * `.nullable()` / `.nullish()` field get them too. A bound only a `.refine()`
+ * enforces generates nothing — JSON Schema can't express it.
  *
- * @throws Error if the seed body built by `generate_valid_value` fails
- *   `input_schema.safeParse` — surfaces broken generation logic with the
- *   Zod issues path rather than producing nonsense adversarial cases.
+ * Each per-field case is single-fault: valid except for the field it breaks.
+ * It changes one field of a valid base body — `options.base` when given, else
+ * one built by `generate_valid_object` — or, for a field that base omits, of
+ * the valid body `generate_valid_object_with_field` builds around it, so a case
+ * can't also break an object-level rule (adding `scope_kind` without its
+ * paired `scope_id`, or `slug` beside an exactly-one-of `id`). A field no valid
+ * body carries keeps its wrong-type and null cases on the base and gets no
+ * format or boundary cases, which would test no bound. A per-field case is
+ * emitted only when the field refuses its value, so no case is accidentally
+ * valid.
+ *
+ * @param input_schema - the input schema to attack
+ * @param options - a base body to seed the cases, and a label for errors
+ * @throws Error if the base body fails `input_schema.safeParse` — a seeded
+ *   base the schema refuses, or a generated one that surfaces broken
+ *   generation logic — naming the issues rather than producing nonsense
+ *   adversarial cases.
  */
-export const generate_input_test_cases = (input_schema) => {
+export const generate_input_test_cases = (input_schema, options) => {
     if (is_null_schema(input_schema))
         return [];
     const object_schema = zod_unwrap_to_object(input_schema);
@@ -78,33 +111,24 @@ export const generate_input_test_cases = (input_schema) => {
         return [];
     const fields = zod_extract_fields(object_schema);
     const cases = [];
-    // build a base object with valid-ish values — must pass validation itself
-    // skip optional fields without defaults to avoid generating invalid nested values
-    const base = {};
-    for (const field of fields) {
-        if (!field.required && !field.has_default)
-            continue;
-        base[field.name] = generate_valid_value(field, object_schema.shape[field.name]);
-    }
-    let base_result = input_schema.safeParse(base);
-    if (!base_result.success) {
-        // Fallback for schemas with a top-level `.refine()` that requires at
-        // least one of N optional fields. Fill optional fields until the base
-        // satisfies validation; surfaces a clear error if no combination works.
-        for (const field of fields) {
-            if (field.required || field.has_default || field.name in base)
-                continue;
-            base[field.name] = generate_valid_value(field, object_schema.shape[field.name]);
-            base_result = input_schema.safeParse(base);
-            if (base_result.success)
-                break;
+    const for_label = options?.label === undefined ? '' : ` for '${options.label}'`;
+    // the base object every case breaks one field of — must pass validation itself
+    let base;
+    if (options?.base) {
+        base = { ...options.base };
+        const base_result = input_schema.safeParse(base);
+        if (!base_result.success) {
+            throw new Error(`adversarial_input: the seeded base${for_label} fails validation — ` +
+                `fix the base for: ${format_zod_issues(base_result.error)}`);
         }
     }
-    if (!base_result.success) {
-        throw new Error(`adversarial_input: generated base object fails validation for schema — ` +
-            `fix generate_valid_value for: ${base_result.error.issues
-                .map((i) => `${i.path.join('.')}: ${i.message}`)
-                .join(', ')}`);
+    else {
+        const generated = generate_valid_object(object_schema, input_schema);
+        if (!generated.result.success) {
+            throw new Error(`adversarial_input: generated base object fails validation${for_label} — ` +
+                `fix generate_valid_value for: ${format_zod_issues(generated.result.error)}`);
+        }
+        base = generated.value;
     }
     // whole-body structural: send array instead of object
     cases.push({
@@ -124,8 +148,33 @@ export const generate_input_test_cases = (input_schema) => {
     }
     for (const field of fields) {
         const field_schema = object_schema.shape[field.name];
+        // the valid body every case on this field changes only the field of: the
+        // base, or for a field the base omits, one that carries it — so the case
+        // can't also break an object-level rule (exactly one of, both or neither)
+        const field_base = generate_valid_object_with_field(object_schema, input_schema, base, field);
+        // every per-field case breaks the field, so the field itself must refuse
+        // its value — a candidate it accepts (a `z.coerce` field given a wrong
+        // type, a pattern that admits the violation string) is no invalid case.
+        // A type case (wrong type, null) on a field no valid body carries falls
+        // back to the base; a value case — a format or a bound — is built only on
+        // a body that is valid but for the field, or it tests no bound at all
+        const push_field_case = (label, value, kind) => {
+            if (field_schema.safeParse(value).success)
+                return;
+            const body_base = field_base ?? (kind === 'type' ? base : null);
+            if (!body_base)
+                return;
+            cases.push({
+                label,
+                body: { ...body_base, [field.name]: value },
+                field: field.name,
+                expected_error: ERROR_INVALID_REQUEST_BODY
+            });
+        };
+        // the field's valid value the value cases start from
+        const valid_value = field_base?.[field.name];
         // missing required field (skip fields with defaults — Zod fills them)
-        if (field.required && !field.has_default) {
+        if (field.required && !field.has_default && !field_schema.safeParse(undefined).success) {
             const without = {};
             for (const [k, v] of Object.entries(base)) {
                 if (k !== field.name)
@@ -134,159 +183,162 @@ export const generate_input_test_cases = (input_schema) => {
             cases.push({
                 label: `missing: ${field.name}`,
                 body: without,
+                field: field.name,
                 expected_error: ERROR_INVALID_REQUEST_BODY
             });
         }
         // one wrong-type value
         const wrong = wrong_type_for(field.base_type);
-        if (wrong) {
-            cases.push({
-                label: `wrong type: ${field.name} (${wrong.label})`,
-                body: { ...base, [field.name]: wrong.value },
-                expected_error: ERROR_INVALID_REQUEST_BODY
-            });
-        }
+        if (wrong)
+            push_field_case(`wrong type: ${field.name} (${wrong.label})`, wrong.value, 'type');
         // null for required non-nullable fields
         if (field.required && !field.nullable && field.base_type !== 'null') {
-            cases.push({
-                label: `null: ${field.name}`,
-                body: { ...base, [field.name]: null },
-                expected_error: ERROR_INVALID_REQUEST_BODY
-            });
+            push_field_case(`null: ${field.name}`, null, 'type');
         }
+        // the field's input-side JSON Schema — format, pattern and bounds, read
+        // through a transform or pipe and under a nullable's `anyOf`
+        const json = to_field_json_schema(field_schema);
+        if (!json || !field_base)
+            continue; // no constraints, or no body to break them on
         // format violation for constrained string fields
-        const format = detect_format(field_schema);
+        const format = detect_json_schema_format(json);
         if (format) {
             const violation = format_violation(format);
             if (violation) {
-                cases.push({
-                    label: `format: ${field.name} (${violation.label})`,
-                    body: { ...base, [field.name]: violation.value },
-                    expected_error: ERROR_INVALID_REQUEST_BODY
-                });
+                push_field_case(`format: ${field.name} (${violation.label})`, violation.value, 'value');
+            }
+        }
+        // string length boundaries — `x`s are one UTF-16 unit and one code point
+        // each, so the over-`maxLength` string is over in either count
+        if (field.base_type === 'string' || field.base_type === 'uuid' || field.base_type === 'email') {
+            if (typeof json.minLength === 'number' && json.minLength > 0) {
+                push_field_case(`empty string: ${field.name}`, '', 'value');
+            }
+            // one short of the minimum, distinct from the empty string — a prefix of
+            // the valid value where there is one, so a pattern it met still holds
+            if (typeof json.minLength === 'number' && json.minLength > 1) {
+                const under = json.minLength - 1;
+                push_field_case(`under minLength: ${field.name} (${under} chars)`, typeof valid_value === 'string' && valid_value.length >= under
+                    ? valid_value.slice(0, under)
+                    : 'x'.repeat(under), 'value');
+            }
+            if (typeof json.maxLength === 'number') {
+                push_field_case(`over maxLength: ${field.name} (${json.maxLength + 1} chars)`, 'x'.repeat(json.maxLength + 1), 'value');
             }
         }
-        // --- Boundary cases via JSON Schema introspection ---
-        try {
-            const json = z.toJSONSchema(field_schema);
-            // string length boundaries
-            if (field.base_type === 'string' ||
-                field.base_type === 'uuid' ||
-                field.base_type === 'email') {
-                if (typeof json.minLength === 'number' && json.minLength > 0) {
-                    cases.push({
-                        label: `empty string: ${field.name}`,
-                        body: { ...base, [field.name]: '' },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maxLength === 'number') {
-                    cases.push({
-                        label: `over maxLength: ${field.name} (${json.maxLength + 1} chars)`,
-                        body: { ...base, [field.name]: 'x'.repeat(json.maxLength + 1) },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
+        // numeric boundaries
+        if (field.base_type === 'number' || field.base_type === 'int') {
+            if (typeof json.minimum === 'number') {
+                push_field_case(`below minimum: ${field.name} (${json.minimum - 1})`, json.minimum - 1, 'value');
+            }
+            if (typeof json.maximum === 'number') {
+                push_field_case(`above maximum: ${field.name} (${json.maximum + 1})`, json.maximum + 1, 'value');
+            }
+            if (typeof json.exclusiveMinimum === 'number') {
+                push_field_case(`at exclusive minimum: ${field.name} (${json.exclusiveMinimum})`, json.exclusiveMinimum, 'value');
+            }
+            if (typeof json.exclusiveMaximum === 'number') {
+                push_field_case(`at exclusive maximum: ${field.name} (${json.exclusiveMaximum})`, json.exclusiveMaximum, 'value');
+            }
+            // 0 and negative for positive-only fields
+            if (typeof json.minimum === 'number' && json.minimum > 0) {
+                push_field_case(`zero for positive-only: ${field.name}`, 0, 'value');
+                push_field_case(`negative for positive-only: ${field.name}`, -1, 'value');
             }
-            // numeric boundaries
-            if (field.base_type === 'number' || field.base_type === 'int') {
-                if (typeof json.minimum === 'number') {
-                    cases.push({
-                        label: `below minimum: ${field.name} (${json.minimum - 1})`,
-                        body: { ...base, [field.name]: json.minimum - 1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maximum === 'number') {
-                    cases.push({
-                        label: `above maximum: ${field.name} (${json.maximum + 1})`,
-                        body: { ...base, [field.name]: json.maximum + 1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.exclusiveMinimum === 'number') {
-                    cases.push({
-                        label: `at exclusive minimum: ${field.name} (${json.exclusiveMinimum})`,
-                        body: { ...base, [field.name]: json.exclusiveMinimum },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.exclusiveMaximum === 'number') {
-                    cases.push({
-                        label: `at exclusive maximum: ${field.name} (${json.exclusiveMaximum})`,
-                        body: { ...base, [field.name]: json.exclusiveMaximum },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                // 0 and negative for positive-only fields
-                if (typeof json.minimum === 'number' && json.minimum > 0) {
-                    cases.push({
-                        label: `zero for positive-only: ${field.name}`,
-                        body: { ...base, [field.name]: 0 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                    cases.push({
-                        label: `negative for positive-only: ${field.name}`,
-                        body: { ...base, [field.name]: -1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
+            // off the grid by half a step from the valid value, inside the range,
+            // so the integer or `multipleOf` check is the one that refuses
+            const valid_number = typeof valid_value === 'number' ? valid_value : 1;
+            if (json.type === 'integer') {
+                const value = off_grid_in_range(json, valid_number, 0.5);
+                push_field_case(`non-integer: ${field.name} (${value})`, value, 'value');
             }
-            // array length boundaries
-            if (field.base_type === 'array') {
-                if (typeof json.minItems === 'number' && json.minItems > 0) {
-                    cases.push({
-                        label: `empty array for minItems > 0: ${field.name}`,
-                        body: { ...base, [field.name]: [] },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maxItems === 'number') {
-                    // generate an array one item over the max (items are null — schema-agnostic)
-                    cases.push({
-                        label: `over maxItems: ${field.name} (${json.maxItems + 1} items)`,
-                        body: { ...base, [field.name]: Array.from({ length: json.maxItems + 1 }, () => null) },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
+            if (typeof json.multipleOf === 'number' && json.multipleOf > 0) {
+                // a whole step for an integer field, so the integer check still holds
+                const step = json.type === 'integer' && json.multipleOf > 1 ? 1 : json.multipleOf / 2;
+                const value = off_grid_in_range(json, valid_number, step);
+                push_field_case(`not multipleOf: ${field.name} (${value}, multipleOf ${json.multipleOf})`, value, 'value');
             }
         }
-        catch {
-            // schema can't be converted to JSON Schema, skip boundary cases
+        // array length boundaries
+        if (field.base_type === 'array') {
+            if (typeof json.minItems === 'number' && json.minItems > 0) {
+                push_field_case(`empty array for minItems > 0: ${field.name}`, [], 'value');
+            }
+            // one short of the minimum, distinct from the empty array — the valid
+            // value's own items, so only the count is wrong
+            if (typeof json.minItems === 'number' &&
+                json.minItems > 1 &&
+                Array.isArray(valid_value) &&
+                valid_value.length >= json.minItems - 1) {
+                push_field_case(`under minItems: ${field.name} (${json.minItems - 1} items)`, valid_value.slice(0, json.minItems - 1), 'value');
+            }
+            if (typeof json.maxItems === 'number') {
+                // one item over the max (items are null — schema-agnostic)
+                push_field_case(`over maxItems: ${field.name} (${json.maxItems + 1} items)`, Array.from({ length: json.maxItems + 1 }, () => null), 'value');
+            }
         }
     }
     return cases;
 };
-// --- Params test case generation ---
+/**
+ * The `error.data.reason` an RPC refusal of `test_case` owes: the declared
+ * `invalid_reason` of the field it breaks, resolved as the dispatcher resolves
+ * a failure on that field (`resolve_invalid_reason`), or `undefined` — no
+ * reason — for an undeclared field or a whole-body case.
+ *
+ * @param input_schema - the input schema the case was generated from
+ * @param test_case - a case `generate_input_test_cases` produced from it
+ * @returns the owed reason, or `undefined` when the refusal carries none
+ */
+export const expected_invalid_reason = (input_schema, test_case) => test_case.field === undefined
+    ? undefined
+    : resolve_invalid_reason(input_schema, [test_case.field]);
+// --- Params and query test case generation ---
+/**
+ * A valid string record for a route's params or query schema — each field the
+ * string `generate_valid_string_param` finds for it — checked against the
+ * whole schema, so a case changing one field breaks that field only.
+ *
+ * @throws Error if a field has no string it accepts, or the record fails the
+ *   schema, naming the issues
+ */
+const generate_string_record_base = (schema, kind) => {
+    const base = {};
+    for (const field of zod_extract_fields(schema)) {
+        const value = generate_valid_string_param(field, schema.shape[field.name]);
+        if (value === null) {
+            throw new Error(`adversarial_input: no generated ${kind} value passes field '${field.name}'`);
+        }
+        base[field.name] = value;
+    }
+    const result = schema.safeParse(base);
+    if (!result.success) {
+        throw new Error(`adversarial_input: generated ${kind} base fails validation — ` +
+            `fix generate_valid_string_param for: ${format_zod_issues(result.error)}`);
+    }
+    return base;
+};
 /**
  * Generate adversarial test cases for a route's params schema.
  *
  * Params are always strings from URL segments. Only generates cases for
  * format-constrained fields (uuid, pattern) since unconstrained string
- * params accept any string value.
+ * params accept any string value, and only a violation the field refuses.
+ * Each case breaks one field of a valid params record.
+ *
+ * @throws Error if no valid params record can be generated
  */
 export const generate_params_test_cases = (params_schema) => {
     const fields = zod_extract_fields(params_schema);
     const cases = [];
-    // build base params with valid-ish values
-    const base_params = {};
-    for (const field of fields) {
-        const field_schema = params_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (format === 'uuid' || field.base_type === 'uuid') {
-            base_params[field.name] = '00000000-0000-0000-0000-000000000000';
-        }
-        else {
-            base_params[field.name] = 'test_value';
-        }
-    }
+    const base_params = generate_string_record_base(params_schema, 'params');
     for (const field of fields) {
         const field_schema = params_schema.shape[field.name];
         const format = detect_format(field_schema);
         if (!format)
             continue; // unconstrained string — any value passes
         const violation = format_violation(format);
-        if (violation) {
+        if (violation && !field_schema.safeParse(violation.value).success) {
             cases.push({
                 label: `${violation.label}: param ${field.name}`,
                 params: { ...base_params, [field.name]: violation.value }
@@ -295,32 +347,26 @@ export const generate_params_test_cases = (params_schema) => {
     }
     return cases;
 };
-// --- Query test case generation ---
 /**
  * Generate adversarial test cases for a route's query schema.
  *
  * Query params are always strings from the URL. Generates cases for:
- * - Missing required fields
- * - Format violations on constrained fields (uuid, pattern)
+ * - Missing required fields the field refuses to go without (a preprocessed
+ *   field with a default accepts its absence)
+ * - Format violations on constrained fields (uuid, pattern) the field refuses
+ *
+ * Each case breaks one field of a valid query record.
+ *
+ * @throws Error if no valid query record can be generated
  */
 export const generate_query_test_cases = (query_schema) => {
     const fields = zod_extract_fields(query_schema);
     const cases = [];
-    // build base query with valid-ish values
-    const base_query = {};
+    const base_query = generate_string_record_base(query_schema, 'query');
     for (const field of fields) {
         const field_schema = query_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (format === 'uuid' || field.base_type === 'uuid') {
-            base_query[field.name] = '00000000-0000-0000-0000-000000000000';
-        }
-        else {
-            base_query[field.name] = 'test_value';
-        }
-    }
-    for (const field of fields) {
         // missing required field
-        if (field.required && !field.has_default) {
+        if (field.required && !field.has_default && !field_schema.safeParse(undefined).success) {
             const without = {};
             for (const [k, v] of Object.entries(base_query)) {
                 if (k !== field.name)
@@ -332,12 +378,11 @@ export const generate_query_test_cases = (query_schema) => {
             });
         }
         // format violation for constrained string fields
-        const field_schema = query_schema.shape[field.name];
         const format = detect_format(field_schema);
         if (!format)
             continue;
         const violation = format_violation(format);
-        if (violation) {
+        if (violation && !field_schema.safeParse(violation.value).success) {
             cases.push({
                 label: `${violation.label}: query ${field.name}`,
                 query: { ...base_query, [field.name]: violation.value }

package/dist/testing/audit_drift_guard.d.ts

@@ -61,8 +61,9 @@ export interface RecordingAuditEmitter {
  * `notify` is a no-op; `add_listener` records into a local array that
  * `listener_count` reports, and returns a remover with the production
  * semantics (per registration, idempotent) — registered listeners never fire,
- * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once:
- * a recorded call writes nothing, so nothing is ever in flight.
+ * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once
+ * and `is_tracking_inflight` answers `false`: a recorded call writes nothing, so nothing is
+ * ever in flight.
  *
  * `emit` AND `emit_pool` both append to `calls`, so a test reads either
  * entry point's writes off the same array.

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAW7B,OAAO,EAGN,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAO5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAO,IAgBxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC;AA2BF,iDAAiD;AACjD,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,GACvC,OAAO,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC,EACrE,UAAU,+BAA+B,KACvC,IAcF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAW7B,OAAO,EAGN,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAO5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAO,IAgBxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAsCF,CAAC;AA2BF,iDAAiD;AACjD,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,GACvC,OAAO,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC,EACrE,UAAU,+BAA+B,KACvC,IAcF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -64,8 +64,9 @@ export const assert_no_audit_drift = () => {
  * `notify` is a no-op; `add_listener` records into a local array that
  * `listener_count` reports, and returns a remover with the production
  * semantics (per registration, idempotent) — registered listeners never fire,
- * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once:
- * a recorded call writes nothing, so nothing is ever in flight.
+ * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once
+ * and `is_tracking_inflight` answers `false`: a recorded call writes nothing, so nothing is
+ * ever in flight.
  *
  * `emit` AND `emit_pool` both append to `calls`, so a test reads either
  * entry point's writes off the same array.
@@ -118,7 +119,8 @@ export const create_recording_audit_emitter = (calls_ref) => {
             };
         },
         listener_count: () => listeners.length,
-        drain_inflight: () => Promise.resolve()
+        drain_inflight: () => Promise.resolve(),
+        is_tracking_inflight: () => false
     };
     return { emitter, calls };
 };

package/dist/testing/cross_backend/audit_cross_helpers.d.ts

@@ -18,6 +18,12 @@ export interface AuditReadFixture {
  * backend must mount the action — every spine test binary does; in-process
  * suites mount `create_testing_drain_effects_action`.
  *
+ * Refuses an answer without `tracked: true`. A binary whose audit emitter was
+ * built without in-flight tracking answers the drain at once, waiting on
+ * nothing, and its audit reads race the writes — an absent row then reads as
+ * a pass. Every audit read runs through here, so each one checks the barrier
+ * is live.
+ *
  * @param fixture - the per-test fixture, whose daemon token authorizes the drain
  * @param rpc_path - the RPC endpoint the drain action is mounted on
  */

package/dist/testing/cross_backend/audit_cross_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}
+{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CAmBd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}

package/dist/testing/cross_backend/audit_cross_helpers.js

@@ -26,12 +26,23 @@ import { SPINE_RPC_PATH } from './spine_surface_constants.js';
  * backend must mount the action — every spine test binary does; in-process
  * suites mount `create_testing_drain_effects_action`.
  *
+ * Refuses an answer without `tracked: true`. A binary whose audit emitter was
+ * built without in-flight tracking answers the drain at once, waiting on
+ * nothing, and its audit reads race the writes — an absent row then reads as
+ * a pass. Every audit read runs through here, so each one checks the barrier
+ * is live.
+ *
  * @param fixture - the per-test fixture, whose daemon token authorizes the drain
  * @param rpc_path - the RPC endpoint the drain action is mounted on
  */
 export const cross_drain_effects = async (fixture, rpc_path = SPINE_RPC_PATH) => {
     const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
     assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+    const tracked = typeof drained.result === 'object' && drained.result !== null
+        ? drained.result.tracked
+        : undefined;
+    assert.strictEqual(tracked, true, "_testing_drain_effects must answer tracked: true — the backend's audit emitter does not " +
+        `track in-flight writes, so the drain waits on nothing (got ${JSON.stringify(drained.result)})`);
 };
 /**
  * Assert an audit row's `metadata` carries `expected` — each field compared