@fuzdev/fuz_app 0.148.0 → 0.149.0

package/dist/testing/cross_backend/capabilities.d.ts

@@ -1,4 +1,5 @@
 import '../assert_dev_env.js';
+import type { TestingBackdoorMethod } from './spine_surface_constants.js';
 /**
  * Optional behaviors a backend may support. Each flag's TSDoc names the
  * tests that gate on it; add a new flag here before referencing it from
@@ -61,7 +62,8 @@ export interface BackendCapabilities {
     /**
      * The cell-gated fact-serving route (`GET /api/cells/:cell_id/facts/:hash`)
      * is live-mounted on the backend, its DB carries the `fuz_facts` migration
-     * namespace, and it registers the `_testing_put_fact` seeder. Gates
+     * namespace, and it mounts the `_testing_put_fact` seeder — declared in
+     * `testing_backdoors`, which `describe_spine_cross_suites` requires. Gates
      * `describe_fact_serving_cross_tests`' per-reference read model (cell-scoped
      * admit via a viewable cell, cross-owner-dedup-no-leak, 404-mask),
      * `describe_cell_ref_admission_cross_tests`, and the fact cases of the
@@ -191,6 +193,25 @@ export interface BackendCapabilities {
      * Deno, Bun, and the Rust spine, which send the response as built.
      */
     readonly ws_refusal_body: boolean;
+    /**
+     * The `_testing_*` backdoors the backend mounts on its RPC endpoint, from
+     * `TESTING_BACKDOOR_METHODS` (a consumer's own seams stay off it). Not a
+     * flag, but declared like a `MountFlag`: no family default, so every config
+     * states it. `describe_testing_backdoor_cross_tests` checks the declaration
+     * against the backend — a declared method must be mounted, an undeclared one
+     * must answer `method_not_found` — and runs its credential-gate rows over
+     * the declared ones; `describe_spine_cross_suites` requires `_testing_reset`
+     * and `_testing_drain_effects` (the per-test reset and the audit barrier),
+     * skips a suite whose backdoor is undeclared, naming it — `credential_deadline`
+     * (`_testing_shorten_credential_expiry`), `origin_conformance`
+     * (`_testing_origin_check`), `ws_outbound_overflow`
+     * (`_testing_flood_notifications`) — and requires `_testing_put_fact` of a
+     * backend declaring `fact_serving`.
+     *
+     * fuz_app's spine presets declare every one; the in-process transport none
+     * (the backdoor suites are cross-process only).
+     */
+    readonly testing_backdoors: ReadonlyArray<TestingBackdoorMethod>;
 }
 /**
  * The capabilities that describe a backend's own mounts, never a runtime
@@ -203,8 +224,9 @@ export interface BackendCapabilities {
  */
 export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_crud' | 'cell_relations' | 'cell_gated_create' | 'fact_serving' | 'fact_serving_admin_hash' | 'ready' | 'peer_request' | 'ws_account_actions' | 'ws_role_gated'>;
 /**
- * A family's default capabilities: every flag but the `MountFlag`s, which
- * each backend config states itself. Spread one and add every mount flag:
+ * A family's default capabilities: every flag but the `MountFlag`s and the
+ * `testing_backdoors` list, which each backend config states itself. Spread
+ * one and add every mount flag and the backdoor list:
  *
  * ```ts
  * capabilities: {
@@ -213,10 +235,11 @@ export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_cru
  *   cell_crud: false, cell_relations: false, cell_gated_create: false,
  *   fact_serving: false, fact_serving_admin_hash: false,
  *   ws_account_actions: false, ws_role_gated: false,
+ *   testing_backdoors: ['_testing_reset', '_testing_drain_effects'],
  * }
  * ```
  */
-export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag>;
+export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag | 'testing_backdoors'>;
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyBpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,mBAAmB,CAAC,CAAC;AAEnG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA4BpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -28,9 +28,9 @@ import '../assert_dev_env.js';
  *   `rust_spine_stub_backend_config.ts` (the rust family default plus every mount flag).
  *
  * **Mount flags have no default.** A flag naming something a backend mounts
- * (a `MountFlag`) is never inherited: the family defaults are
- * `FamilyDefaultCapabilities`, which omits them, so every backend config states
- * each one. The family defaults carry only what the family guarantees — the
+ * (a `MountFlag`) is never inherited, nor is the `testing_backdoors` list: the
+ * family defaults are `FamilyDefaultCapabilities`, which omits them, so every
+ * backend config states each one. The family defaults carry only what the family guarantees — the
  * declared spine surface's mounts (`account_lifecycle`, `account_status`) and
  * the runtime behavior of its reference runtime (`ws_handshake_pipelining`,
  * `ws_refusal_body`: Node for TS, hyper for Rust), which a backend on another
@@ -38,8 +38,9 @@ import '../assert_dev_env.js';
  *
  * **Gating flags only.** `BackendCapabilities` holds only flags a suite
  * actually gates on (each has a `test_if(capabilities.X, ...)` reader, or —
- * `ws_refusal_body` — picks how a case reads a refusal). A wiring fact no suite
- * reads is not a capability.
+ * `ws_refusal_body` — picks how a case reads a refusal), plus the
+ * `testing_backdoors` list the backdoor suite and `describe_spine_cross_suites`
+ * read. A wiring fact no suite reads is not a capability.
  *
  * @module
  */
@@ -81,7 +82,10 @@ export const in_process_capabilities = Object.freeze({
     ws_role_gated: false,
     // Read only by the front-door table's WS rows, which skip in-process (no
     // socket to upgrade); Hono's own refusals carry their bodies.
-    ws_refusal_body: true
+    ws_refusal_body: true,
+    // The in-process app mounts no `_testing_*` action; the suites reading this
+    // are cross-process only.
+    testing_backdoors: Object.freeze([])
 });
 /**
  * Conditional `test()` wrapper — registers a vitest case only when

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6lBF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAgE1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA4uBF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -38,7 +38,13 @@ import '../assert_dev_env.js';
  *   accepted as a list filter that matches nothing;
  * - a `kind` of exactly `CELL_KIND_LENGTH_MAX` UTF-16 code units is stored
  *   whole, and one unit past it is `invalid_params` on create and as a list
- *   filter.
+ *   filter;
+ * - a `data` that is no `CellData` — not an object, or a `label` / `summary`
+ *   that is no string — is 400 `invalid_params` with the generic message and
+ *   no reason on `cell_create`, `cell_update` and (with
+ *   `capabilities.cell_relations`) `cell_clone`'s `with_data_patch`, ahead of
+ *   every cell check (a missing or hidden cell refuses it the same way, never
+ *   with the 404 mask), and writes no cell.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -48,11 +54,64 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { jsonrpc_error_messages } from '../../http/jsonrpc_errors.js';
+import { CELL_KIND_LENGTH_MAX, CELL_LIST_LIMIT_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * `data` values that are no `CellData` — not an object, or an object whose
+ * `label` / `summary` is no string. Twin of the Rust spine's mistyped-data
+ * table in its cell authz tests.
+ */
+const MISTYPED_CELL_DATA = [
+    'not_an_object',
+    42,
+    true,
+    [1],
+    { label: 123 },
+    { label: null },
+    { summary: {} },
+    { summary: false }
+];
+/** The message every schema refusal answers, naming no field. */
+const INVALID_PARAMS_MESSAGE = jsonrpc_error_messages.invalid_params().message;
+/**
+ * Assert `r` is a schema refusal: 400 `invalid_params` with the generic
+ * message and no `data`, save the Zod `issues` a TS spine adds under DEV
+ * alone — an array of issue objects, each with a string `code` and
+ * `message`, and never a `reason`.
+ */
+const assert_schema_refusal = (r, label) => {
+    const detail = `${label}: got ${r.status} ${JSON.stringify(r.error ?? r.result)}`;
+    assert.strictEqual(r.status, 400, detail);
+    const { error } = r;
+    assert.ok(error, detail);
+    assert.strictEqual(error.code, -32602, detail);
+    assert.strictEqual(error.message, INVALID_PARAMS_MESSAGE, detail);
+    const { data } = error;
+    if (data === undefined)
+        return;
+    assert.ok(typeof data === 'object' && data !== null && Object.keys(data).join() === 'issues', `${detail} — data beyond the DEV-only issues`);
+    const { issues } = data;
+    assert.ok(Array.isArray(issues), `${detail} — DEV-only issues that are no array`);
+    for (const issue of issues) {
+        assert.ok(typeof issue === 'object' &&
+            issue !== null &&
+            typeof issue.code === 'string' &&
+            typeof issue.message === 'string', `${detail} — a DEV-only issue that is no Zod issue`);
+    }
+};
+/**
+ * Assert `r` is the IDOR mask: 404 with reason `cell_not_found` — the
+ * well-typed control beside a schema refusal of the same call.
+ */
+const assert_cell_not_found = (r, label) => {
+    const detail = `${label}: got ${r.status} ${JSON.stringify(r.error ?? r.result)}`;
+    assert.strictEqual(r.status, 404, detail);
+    assert.strictEqual(error_reason(r), 'cell_not_found', detail);
+};
 export const describe_cell_crud_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -327,5 +386,61 @@ export const describe_cell_crud_cross_tests = (options) => {
                 }
             }
         });
+        describe('mistyped data', () => {
+            /** Count every cell, read as the keeper (an admin sees every row). */
+            const count_cells = async (t, keeper_headers) => {
+                const { cells } = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { limit: CELL_LIST_LIMIT_MAX }, keeper_headers), CellListOutput);
+                assert.ok(cells.length < CELL_LIST_LIMIT_MAX, 'the count needs a page that holds every cell');
+                return cells.length;
+            };
+            test_if(capabilities.cell_crud, 'cell_create and cell_update refuse it as invalid_params before any cell check', async () => {
+                const fixture = await setup_test();
+                const writer = await fixture.create_account({ username: 'cell_data_writer' });
+                const stranger = await fixture.create_account({ username: 'cell_data_stranger' });
+                const t = fixture.fresh_transport();
+                const keeper_headers = fixture.create_session_headers();
+                const writer_headers = writer.create_session_headers();
+                // the keeper's private cell, hidden from the stranger; the keeper
+                // creates it so a backend that refuses a non-admin root runs the case
+                const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, keeper_headers), CellCreateOutput).cell.id;
+                const missing = crypto.randomUUID();
+                const before = await count_cells(t, keeper_headers);
+                for (const data of MISTYPED_CELL_DATA) {
+                    const shown = JSON.stringify(data);
+                    assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_create', { data }, writer_headers), `cell_create data ${shown}`);
+                    for (const [cell_id, headers, who] of [
+                        [missing, writer_headers, 'a missing cell'],
+                        [hidden, stranger.create_session_headers(), 'a hidden cell']
+                    ]) {
+                        assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data }, headers), `cell_update of ${who} data ${shown}`);
+                    }
+                }
+                // the control: well-typed, the same call meets the 404 mask, so the
+                // 400s above came before the cell check
+                assert_cell_not_found(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: hidden, data: {} }, stranger.create_session_headers()), 'cell_update of a hidden cell data {}');
+                assert.strictEqual(await count_cells(t, keeper_headers), before, 'a refused write wrote a cell');
+            });
+            test_if(capabilities.cell_crud && capabilities.cell_relations, 'cell_clone refuses it in with_data_patch as invalid_params before any cell check', async () => {
+                const fixture = await setup_test();
+                const writer = await fixture.create_account({ username: 'cell_patch_writer' });
+                const stranger = await fixture.create_account({ username: 'cell_patch_stranger' });
+                const t = fixture.fresh_transport();
+                const keeper_headers = fixture.create_session_headers();
+                const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, keeper_headers), CellCreateOutput).cell.id;
+                const missing = crypto.randomUUID();
+                const before = await count_cells(t, keeper_headers);
+                for (const with_data_patch of MISTYPED_CELL_DATA) {
+                    for (const [source_id, headers, who] of [
+                        [missing, writer.create_session_headers(), 'a missing cell'],
+                        [hidden, stranger.create_session_headers(), 'a hidden cell']
+                    ]) {
+                        assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id, with_data_patch }, headers), `cell_clone of ${who} with_data_patch ${JSON.stringify(with_data_patch)}`);
+                    }
+                }
+                // the control: well-typed, the same clone meets the 404 mask
+                assert_cell_not_found(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: hidden, with_data_patch: { label: 'patched' } }, stranger.create_session_headers()), 'cell_clone of a hidden cell with_data_patch {label}');
+                assert.strictEqual(await count_cells(t, keeper_headers), before, 'a refused clone wrote a cell');
+            });
+        });
     });
 };

package/dist/testing/cross_backend/cross_rpc.d.ts

@@ -3,6 +3,8 @@ import type { z } from 'zod';
 import type { FetchTransport } from '../transports/fetch_transport.js';
 /** Minimal JSON-RPC envelope shape the suites read off responses. */
 export interface RpcResult {
+    /** The HTTP status the reply carried. */
+    readonly status: number;
     readonly ok: boolean;
     readonly result?: unknown;
     readonly error?: {
@@ -22,7 +24,7 @@ export interface RpcResult {
  * @param method - the JSON-RPC method
  * @param params - the request params
  * @param headers - auth and other headers, merged over the JSON defaults
- * @returns the response's `ok`, `result` and `error`
+ * @returns the response's HTTP `status`, `ok`, `result` and `error`
  * @throws Error when the reply is not a JSON object — naming the method, the
  *   HTTP status and the head of the body, so a proxy page or a crash reads
  *   as what it is

package/dist/testing/cross_backend/cross_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cross_rpc.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAmBnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}
+{"version":3,"file":"cross_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cross_rpc.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAmBnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}

package/dist/testing/cross_backend/cross_rpc.js

@@ -26,7 +26,7 @@ const BODY_HEAD_LENGTH = 200;
  * @param method - the JSON-RPC method
  * @param params - the request params
  * @param headers - auth and other headers, merged over the JSON defaults
- * @returns the response's `ok`, `result` and `error`
+ * @returns the response's HTTP `status`, `ok`, `result` and `error`
  * @throws Error when the reply is not a JSON object — naming the method, the
  *   HTTP status and the head of the body, so a proxy page or a crash reads
  *   as what it is
@@ -48,7 +48,7 @@ export const cross_rpc_call = async (transport, path, method, params, headers) =
             JSON.stringify(text.slice(0, BODY_HEAD_LENGTH)));
     }
     const envelope = body;
-    return { ok: res.ok, result: envelope.result, error: envelope.error };
+    return { status: res.status, ok: res.ok, result: envelope.result, error: envelope.error };
 };
 /** Pull `error.data.reason` off an RPC error envelope (undefined if absent). */
 export const error_reason = (r) => r.error && typeof r.error.data === 'object' && r.error.data !== null

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -34,14 +34,14 @@ export declare const action_rate_limit_env: (options: ActionRateLimitEnvOptions)
 /**
  * Capabilities shared by TS-family backends — only what the family
  * guarantees: the declared spine surface's mounts and the behavior of its
- * reference runtime, Node. Carries no `MountFlag`; each backend config states
- * those itself (`FamilyDefaultCapabilities`).
+ * reference runtime, Node. Carries no `MountFlag` and no `testing_backdoors`;
+ * each backend config states those itself (`FamilyDefaultCapabilities`).
  */
 export declare const ts_default_capabilities: FamilyDefaultCapabilities;
 /**
  * Capabilities for the Rust family — only what the family guarantees, as with
  * `ts_default_capabilities`: the declared spine surface's mounts and the
- * behavior of hyper. Carries no `MountFlag`.
+ * behavior of hyper. Carries no `MountFlag` and no `testing_backdoors`.
  */
 export declare const rust_default_capabilities: FamilyDefaultCapabilities;
 export interface MakeDefaultTsBackendConfigOptions {
@@ -57,8 +57,9 @@ export interface MakeDefaultTsBackendConfigOptions {
     readonly extra_env?: Readonly<Record<string, string>>;
     /**
      * Every capability, stated: spread `ts_default_capabilities` and add each
-     * `MountFlag`. Required, so a mount flag left out is a type error rather
-     * than a suite that silently skips.
+     * `MountFlag` and the `testing_backdoors` list. Required, so a mount flag or
+     * the backdoor list left out is a type error rather than a suite that
+     * silently skips.
      */
     readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */
@@ -113,8 +114,9 @@ export interface MakeDefaultRustBackendConfigOptions {
     readonly extra_env?: Readonly<Record<string, string>>;
     /**
      * Every capability, stated: spread `rust_default_capabilities` and add each
-     * `MountFlag`. Required, so a mount flag left out is a type error rather
-     * than a suite that silently skips.
+     * `MountFlag` and the `testing_backdoors` list. Required, so a mount flag or
+     * the backdoor list left out is a type error rather than a suite that
+     * silently skips.
      */
     readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAehG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,mBAAmB,MAAM,KAAG,MAS/D,CAAC;AAcF,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBAgBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,yBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAuCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA+CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAehG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,mBAAmB,MAAM,KAAG,MAS/D,CAAC;AAcF,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBAgBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,yBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAuCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA+CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -81,8 +81,8 @@ export const action_rate_limit_env = (options) => ({
 /**
  * Capabilities shared by TS-family backends — only what the family
  * guarantees: the declared spine surface's mounts and the behavior of its
- * reference runtime, Node. Carries no `MountFlag`; each backend config states
- * those itself (`FamilyDefaultCapabilities`).
+ * reference runtime, Node. Carries no `MountFlag` and no `testing_backdoors`;
+ * each backend config states those itself (`FamilyDefaultCapabilities`).
  */
 export const ts_default_capabilities = Object.freeze({
     // The account-lifecycle verbs are on the declared surface
@@ -104,7 +104,7 @@ export const ts_default_capabilities = Object.freeze({
 /**
  * Capabilities for the Rust family — only what the family guarantees, as with
  * `ts_default_capabilities`: the declared spine surface's mounts and the
- * behavior of hyper. Carries no `MountFlag`.
+ * behavior of hyper. Carries no `MountFlag` and no `testing_backdoors`.
  */
 export const rust_default_capabilities = Object.freeze({
     // The account-lifecycle verbs are in the spine's admin action set, on the

package/dist/testing/cross_backend/rpc_adversarial.d.ts

@@ -14,6 +14,15 @@ export interface RpcAdversarialCrossTestOptions extends RpcPathCrossSuiteOptions
     readonly live_rpc_endpoints?: ReadonlyArray<RpcEndpointSpec>;
     /** Methods to leave out, beyond the protocol actions always skipped. */
     readonly skip_methods?: ReadonlyArray<string>;
+    /**
+     * Valid params per method (method name → params) to build its params cases
+     * from, in place of the generated base — for an input whose valid shape
+     * the generator can't reach. Each must pass the method's input schema; one
+     * that doesn't throws at collection, naming the method. The cases are sent
+     * as a single-actor principal, so an override omits `acting`.
+     * `describe_spine_cross_suites` passes its `rpc_input_overrides` here.
+     */
+    readonly input_overrides?: ReadonlyMap<string, Record<string, unknown>>;
     /**
      * Generated params cases a backend is known to answer otherwise, each run
      * as its own `xfail_until` test; the method's other cases keep their test.

package/dist/testing/cross_backend/rpc_adversarial.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_adversarial.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rpc_adversarial.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyE9B,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,uBAAuB,CAAC;AAoB/B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAKxE,0DAA0D;AAC1D,MAAM,WAAW,8BAA+B,SAAQ,wBAAwB;IAC/E,qGAAqG;IACrG,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7D,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAmGD;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA8JF,CAAC"}
+{"version":3,"file":"rpc_adversarial.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rpc_adversarial.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6E9B,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,uBAAuB,CAAC;AAoB/B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAKxE,0DAA0D;AAC1D,MAAM,WAAW,8BAA+B,SAAQ,wBAAwB;IAC/E,qGAAqG;IACrG,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7D,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAmGD;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IAqKF,CAAC"}

package/dist/testing/cross_backend/rpc_adversarial.js

@@ -30,8 +30,10 @@ import '../assert_dev_env.js';
  * - **Params** — for each declared method (and each live-mounted one, below),
  *   `generate_rpc_params_test_cases`
  *   (the in-process generator minus its structural cases), each sent as the
- *   method's authorized principal and owing 400 `invalid_params` with no
- *   `data.reason`. One test per method, reporting every case that answers
+ *   method's authorized principal and owing 400 `invalid_params` with the
+ *   `data.reason` the broken field declares (`invalid_reason` in its
+ *   `.meta()`, read by `expected_invalid_reason`) — none for an undeclared
+ *   field or a whole-body case. One test per method, reporting every case that answers
  *   otherwise; `xfail_params` runs named cases of a method as their own
  *   `xfail_until` tests, for a known divergence on one backend.
  *
@@ -42,7 +44,9 @@ import '../assert_dev_env.js';
  * role a declared method gates on (`default_cross_process_setup` seeds
  * `keeper` and `admin`; pass `extra_keeper_roles` for others), and it has a
  * single actor. No generated body carries a valid `acting` — the generator's
- * base fills only required and defaulted fields — and a malformed `acting` is
+ * base fills required and defaulted fields, and an optional one only where a
+ * refinement needs it (each alone first, so an `acting` declared ahead of an
+ * at-least-one or exactly-one-of pair stays out) — and a malformed `acting` is
  * read as omitted ahead of validation on both spines, so a single-actor
  * keeper resolves its actor and validation is what refuses. A keeper with a
  * second actor answers `actor_required` first; such a suite lists the
@@ -78,6 +82,7 @@ import { assert_rpc_envelope_refusal, create_rpc_envelope_cases, generate_rpc_pa
 import { resolve_conformance_principal } from './conformance_table.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 import { xfail_until } from './xfail.js';
+import { expected_invalid_reason } from '../adversarial_input_cases.js';
 const PROTOCOL_METHODS = new Set(PROTOCOL_ACTION_METHODS);
 /** The keeper principal on each builtin credential channel. */
 const CHANNEL_PRINCIPALS = {
@@ -231,12 +236,14 @@ export const describe_rpc_adversarial_cross_tests = (options) => {
         const check_case = async (fixture, action, tc) => {
             const { status, body } = await send_as(fixture, action.spec.auth, 'authorized', rpc_path, create_rpc_post_init(action.spec.method, tc.body));
             const code = body?.error?.code;
+            const expected_reason = expected_invalid_reason(action.spec.input, tc);
             if (status === 400 &&
                 code === JSONRPC_ERROR_CODES.invalid_params &&
-                reason_of(body) === undefined) {
+                reason_of(body) === expected_reason) {
                 return null;
             }
-            return `[${tc.label}] params ${JSON.stringify(tc.body)} → ${status} ${JSON.stringify(body)}`;
+            const owed = expected_reason === undefined ? 'no reason' : `reason '${expected_reason}'`;
+            return `[${tc.label}] params ${JSON.stringify(tc.body)} → ${status} ${JSON.stringify(body)} (owed 400 invalid_params, ${owed})`;
         };
         // the declared methods, then the live-mounted ones the declared surface lacks
         const declared_actions = endpoint_spec.actions.filter((action) => !action.spec.method.startsWith(TESTING_METHOD_PREFIX) &&
@@ -247,7 +254,10 @@ export const describe_rpc_adversarial_cross_tests = (options) => {
                 continue;
             if (skip.has(method))
                 continue;
-            const all_cases = generate_rpc_params_test_cases(input);
+            const all_cases = generate_rpc_params_test_cases(input, {
+                base: options.input_overrides?.get(method),
+                label: method
+            });
             if (all_cases.length === 0)
                 continue;
             total += all_cases.length;

package/dist/testing/cross_backend/rust_spine_consumer_surface.d.ts

@@ -10,7 +10,7 @@ import '../assert_dev_env.js';
  * actions plus the consumer's own. This module builds that surface from the
  * hono-free route shapes and the consumer's action specs, so a consumer
  * supplies only what is its own. A server that mounts no signup router (a
- * single-keeper daemon such as mageguild's) is not this shape.
+ * single-keeper daemon) is not this shape.
  *
  * The route shapes come from `create_account_route_shapes` and friends, never
  * the live route factories, which statically pull `hono/cookie` and

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAiCnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAoCnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -36,7 +36,7 @@ import '../assert_dev_env.js';
  */
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_EXPECTED_SCHEMA_URL, TESTING_BACKDOOR_METHODS } from './spine_surface_constants.js';
 import { action_rate_limit_env, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
@@ -66,7 +66,9 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
  * serves one action registry on `/api/rpc` and `/api/ws`), `cell_gated_create`
  * (it mounts the `TestCellGatedCreateAuthorize` policy on its cell layer), and
  * `ws_role_gated` (it mounts the role-gated WS endpoint at
- * `SPINE_ROLE_GATED_WS_PATH`, sharing its connection registry). Named
+ * `SPINE_ROLE_GATED_WS_PATH`, sharing its connection registry), and every
+ * `TESTING_BACKDOOR_METHODS` entry as `testing_backdoors` (it mounts them all,
+ * on one registry for both transports). Named
  * (not inline) so every spine preset is greppable, mirroring
  * `ts_spine_capabilities`.
  */
@@ -82,7 +84,8 @@ const rust_spine_stub_capabilities = Object.freeze({
     ready: true,
     ws_account_actions: true,
     cell_gated_create: true,
-    ws_role_gated: true
+    ws_role_gated: true,
+    testing_backdoors: TESTING_BACKDOOR_METHODS
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;

package/dist/testing/cross_backend/setup.d.ts

@@ -229,7 +229,7 @@ export interface CapabilityGatedCrossSuiteOptions extends CrossSuiteOptions {
  * `CrossSuiteOptions` plus the RPC endpoint path the suite dispatches
  * against — the shape every JSON-RPC-driven imperative suite takes (cell
  * verbs, origin, body-size, actor lookup, account lifecycle, app
- * settings, testing backdoor). Suites alias this under a self-documenting
+ * settings). Suites alias this under a self-documenting
  * per-suite name (e.g. `OriginCrossTestOptions = RpcPathCrossSuiteOptions`).
  */
 export interface RpcPathCrossSuiteOptions extends CrossSuiteOptions {
@@ -241,7 +241,7 @@ export interface RpcPathCrossSuiteOptions extends CrossSuiteOptions {
  * of `RpcPathCrossSuiteOptions` and `CapabilityGatedCrossSuiteOptions`, and
  * the most common option shape among the imperative cross suites (every
  * `cell_*` suite, `query_shape`, `token_scope_surface`, `fact_serving`,
- * `account_lifecycle`).
+ * `account_lifecycle`, `testing_backdoor`).
  */
 export interface RpcPathCapabilityGatedCrossSuiteOptions extends RpcPathCrossSuiteOptions, CapabilityGatedCrossSuiteOptions {
 }