@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/testing/cross_backend/cell_moderate.js

@@ -23,7 +23,8 @@ import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 import { PARTICIPATION_ROLE, SPACE_CELL_KIND, TEST_SPACE_POLICY } from './test_cell_gated_create_authorize.js';
 /**
  * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
+ * approved | rejected` decision and the `approved → rejected` takedown) —
+ * root-authority-gated.
  *
  * Builds a moderated public space (admin) + a `participant`'s `post` (born
  * `pending` + private under the `moderation_required: true` policy), then
@@ -41,6 +42,11 @@ import { PARTICIPATION_ROLE, SPACE_CELL_KIND, TEST_SPACE_POLICY } from './test_c
  * - **a cell with no governing root** → `400 cell_not_a_contribution` for any
  *   viewer (owner, admin), the cell left unmoderated; a non-viewer gets the
  *   `cell_not_found` mask first.
+ * - **approval needs a pending contribution, rejection a pending or approved
+ *   one** → else `400 cell_not_pending`, the cell left as it was: a root owner
+ *   a private, born-approved contribution was shared with can't publish it by
+ *   "approving" it; an approved post is not approved again but can be taken
+ *   down (rejected, visibility untouched); a rejected post is final.
  *
  * And that moderation gates reads — a cell's effective audience is its
  * visibility or grants **and** its moderation admission (unmoderated or
@@ -102,7 +108,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     // participant's pending post under it, optionally carrying a fact the
     // author put.
     const setup_pending_post_on = async (fixture, post_fact_content) => {
-        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'moderate_author',
             roles: [PARTICIPATION_ROLE]
@@ -118,7 +124,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     // put.
     const setup_stewarded_post_on = async (fixture, post_fact_content) => {
         const root_owner = await fixture.create_account({ username: 'steward_root_owner' });
-        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
+        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'steward_author',
             roles: [PARTICIPATION_ROLE]
@@ -208,6 +214,64 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.strictEqual(got.cell.moderation, null);
             assert.strictEqual(got.cell.visibility, 'private');
         });
+        test_if(capabilities.cell_gated_create, 'a root owner shown a private approved contribution cannot publish it → 400 cell_not_pending', async () => {
+            // the contribution is approved at birth (`comment` is unmoderated
+            // under the policy), so it was never pending; its author shares it
+            // with the root owner, who "approves" it
+            const fixture = await setup_test();
+            const root_owner = await fixture.create_account({ username: 'not_pending_root_owner' });
+            const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
+            const author = await fixture.create_account({
+                username: 'not_pending_author',
+                roles: [PARTICIPATION_ROLE]
+            });
+            const author_h = author.create_session_headers();
+            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: root.cell.id, visibility: 'private' }, author_h), CellCreateOutput);
+            assert.strictEqual(comment.cell.moderation, 'approved', 'born approved');
+            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                cell_id: comment.cell.id,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: root_owner.actor.id }
+            }, author_h), CellGrantCreateOutput);
+            const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: comment.cell.id, moderation: 'approved' }, root_owner.create_session_headers());
+            assert.ok(!refused.ok, 'an approved contribution is not approved again');
+            assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.invalid_params);
+            assert.strictEqual(error_reason(refused), 'cell_not_pending');
+            const after = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: comment.cell.id }, author_h), CellGetOutput).cell;
+            assert.strictEqual(after.visibility, 'private', 'the refusal publishes nothing');
+            assert.strictEqual(after.moderation, 'approved');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: comment.cell.id }, null), 'cell_not_found', 'still hidden from anon');
+        });
+        test_if(capabilities.cell_gated_create, 'approval needs a pending post, rejection a pending or approved one → else 400 cell_not_pending', async () => {
+            const try_moderate = async (fixture, cell_id, moderation) => outcome(fixture, 'cell_moderate', { cell_id, moderation }, fixture.create_session_headers());
+            const state = async (fixture, id) => {
+                const { cell } = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id }, fixture.create_session_headers()), CellGetOutput);
+                return [cell.moderation, cell.visibility];
+            };
+            // approved: approving again is refused; the takedown is not
+            {
+                const { fixture, post } = await setup_pending_post();
+                await moderate(fixture, post.cell.id, 'approved');
+                assert.strictEqual(await try_moderate(fixture, post.cell.id, 'approved'), 'cell_not_pending', 'approved, approve');
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['approved', 'public']);
+                assert.strictEqual(await try_moderate(fixture, post.cell.id, 'rejected'), 'ok', 'approved, reject');
+                // rejected is terminal
+                for (const again of ['approved', 'rejected']) {
+                    assert.strictEqual(await try_moderate(fixture, post.cell.id, again), 'cell_not_pending', `taken down, ${again}`);
+                }
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['rejected', 'public']);
+            }
+            // rejected from pending: neither decision moves it
+            {
+                const { fixture, post } = await setup_pending_post();
+                await moderate(fixture, post.cell.id, 'rejected');
+                for (const again of ['approved', 'rejected']) {
+                    assert.strictEqual(await try_moderate(fixture, post.cell.id, again), 'cell_not_pending', `rejected, ${again}`);
+                }
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['rejected', 'private']);
+                assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
+            }
+        });
     });
     describe('moderation gates reads (parity)', () => {
         test_if(capabilities.cell_gated_create, 'a pending post its author flips public stays hidden past the author and admins', async () => {
@@ -493,7 +557,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     describe('cell_clone runs the creation authorizer (parity)', () => {
         test_if(capabilities.cell_gated_create, 'a non-admin clone of a viewable `space` root → 403, admin clone succeeds', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             // Every cell a clone writes is a parentless create of the source's
             // kind, gated like `cell_create` — so a caller denied a `space` root
             // can't clone one they can see into one they own.

package/dist/testing/cross_backend/cell_ref_admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ref_admission.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_ref_admission.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AA6B1E,eAAO,MAAM,uCAAuC,GACnD,SAAS,uCAAuC,KAC9C,IA8eF,CAAC"}
+{"version":3,"file":"cell_ref_admission.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_ref_admission.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AA6B1E,eAAO,MAAM,uCAAuC,GACnD,SAAS,uCAAuC,KAC9C,IA2fF,CAAC"}

package/dist/testing/cross_backend/cell_ref_admission.js

@@ -31,7 +31,9 @@ import '../assert_dev_env.js';
  *
  * Facts are put through `_testing_put_fact`, with `holder` naming the actor a
  * real upload would record. Gated on `capabilities.fact_serving` (the
- * seeder + the serve routes); runs under every `cross_backend_*` project.
+ * seeder + the serve routes), and the cases driving a grant, item, or clone
+ * verb on `capabilities.cell_relations` as well; runs under every
+ * `cross_backend_*` project.
  *
  * @module
  */
@@ -101,7 +103,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             }), uploaded);
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { cover: uploaded } }, bob_headers), CellCreateOutput);
         });
-        test_if(capabilities.fact_serving, 'update keeps existing refs and refuses new unheld ones', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'update keeps existing refs and refuses new unheld ones', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_upd_alice' });
             const bob = await fixture.create_account({ username: 'ref_upd_bob' });
@@ -135,7 +137,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'dropped' } }, bob_headers), CellUpdateOutput);
             assert_not_held(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { cover: alices } }, bob_headers), 'update restoring a dropped ref');
         });
-        test_if(capabilities.fact_serving, 'clone carries source refs per row without holding them', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'clone carries source refs per row without holding them', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_clone_alice' });
             const bob = await fixture.create_account({ username: 'ref_clone_bob' });
@@ -184,7 +186,7 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
                 assert.deepStrictEqual(created.cell.refs, [named]);
             }
         });
-        test_if(capabilities.fact_serving, 'a revoked grantee cannot re-reference a fact it read', async () => {
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'a revoked grantee cannot re-reference a fact it read', async () => {
             const fixture = await setup_test();
             const alice = await fixture.create_account({ username: 'ref_rev_alice' });
             const bob = await fixture.create_account({ username: 'ref_rev_bob' });
@@ -242,17 +244,21 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             const prose = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: not_refs }, bob.create_session_headers()), CellCreateOutput);
             assert.strictEqual(prose.cell.refs, null);
         });
-        test_if(capabilities.fact_serving, 'ref admission answers after the 404 masks', async () => {
+        /** Alice's private cell over her own fact, which Bob cannot see. */
+        const setup_hidden_cell = async (prefix) => {
             const fixture = await setup_test();
-            const alice = await fixture.create_account({ username: 'ref_mask_alice' });
-            const bob = await fixture.create_account({ username: 'ref_mask_bob' });
+            const alice = await fixture.create_account({ username: `${prefix}_alice` });
+            const bob = await fixture.create_account({ username: `${prefix}_bob` });
             const t = fixture.fresh_transport();
-            const bob_headers = bob.create_session_headers();
             const alices = await cross_put_fact(fixture, rpc_path, {
-                content: 'alice hidden bytes',
+                content: `${prefix} hidden bytes`,
                 holder: alice.actor.id
             });
             const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { file: alices }, visibility: 'private' }, alice.create_session_headers()), CellCreateOutput).cell.id;
+            return { t, bob_headers: bob.create_session_headers(), alices, hidden };
+        };
+        test_if(capabilities.fact_serving, 'ref admission answers after the 404 masks', async () => {
+            const { t, bob_headers, alices, hidden } = await setup_hidden_cell('ref_mask');
             // An update of a hidden cell answers its mask whatever `data` names —
             // an unheld new ref or the hidden cell's own ref alike.
             for (const named of [UNSTORED_HASH, alices]) {
@@ -261,6 +267,9 @@ export const describe_cell_ref_admission_cross_tests = (options) => {
             }
             const under = await cross_rpc_call(t, rpc_path, 'cell_create', { data: { file: UNSTORED_HASH }, parent_id: hidden }, bob_headers);
             assert.strictEqual(error_reason(under), 'cell_not_found', 'create under a hidden parent');
+        });
+        test_if(capabilities.fact_serving && capabilities.cell_relations, 'clone ref admission answers after the 404 mask', async () => {
+            const { t, bob_headers, hidden } = await setup_hidden_cell('ref_clone_mask');
             const clone = await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: hidden, with_data_patch: { extra: UNSTORED_HASH } }, bob_headers);
             assert.strictEqual(error_reason(clone), 'cell_not_found', 'clone of a hidden source');
         });

package/dist/testing/cross_backend/conformance_table.d.ts

@@ -154,6 +154,11 @@ export interface SendConformanceCaseOptions {
     readonly resolved_rpc_endpoints: ReturnType<typeof resolve_rpc_endpoints_for_setup>;
     /** Send the request as a frame on a socket at this endpoint instead of over HTTP. */
     readonly ws?: WsEndpointTarget;
+    /**
+     * Headers added to the HTTP request beneath the principal's, which win on
+     * a name clash. Not sent on the WS leg (a frame carries no headers).
+     */
+    readonly request_headers?: Readonly<Record<string, string>>;
 }
 /** The spec a sent case resolved to — the RPC action, or the REST route. */
 export type ConformanceCaseTarget = {

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8C9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAe,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,+BAA+B,EAC/B,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAGN,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,8BAA8B;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,8BAA8B,KACrC,KAAK,CAAC,eAAe,CAKvB,CAAC;AAkBF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,GAAG,eAAe,KAAG,OAIf,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,WAAW,EACpB,IAAI,oBAAoB,EACxB,aAAa,0BAA0B,EACvC,yBAAwB,UAAU,CAAC,OAAO,+BAA+B,CAAM,KAC7E,OAAO,CAAC,4BAA4B,CAmJtC,CAAC;AA4CF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AA0BF,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC;IACpF,qFAAqF;IACrF,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,eAAe,EAClB,SAAS,0BAA0B,KACjC,OAAO,CAAC,uBAAuB,CAuEjC,CAAC;AAsNF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAuEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8C9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAe,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,OAAO,EAKN,+BAA+B,EAC/B,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAGN,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,8BAA8B;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,8BAA8B,KACrC,KAAK,CAAC,eAAe,CAKvB,CAAC;AAkBF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,GAAG,eAAe,KAAG,OAIf,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,WAAW,EACpB,IAAI,oBAAoB,EACxB,aAAa,0BAA0B,EACvC,yBAAwB,UAAU,CAAC,OAAO,+BAA+B,CAAM,KAC7E,OAAO,CAAC,4BAA4B,CAmJtC,CAAC;AA4CF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AA0BF,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC;IACpF,qFAAqF;IACrF,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,eAAe,EAClB,SAAS,0BAA0B,KACjC,OAAO,CAAC,uBAAuB,CA2EjC,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAuEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -391,13 +391,16 @@ const is_success_status = (status) => status >= 200 && status < 300;
  *   auth routes
  */
 export const send_conformance_case = async (c, options) => {
-    const { fixture, surface_source, principals, resolved_rpc_endpoints, ws } = options;
+    const { fixture, surface_source, principals, resolved_rpc_endpoints, ws, request_headers } = options;
     if (ws && !is_ws_conformance_case(c)) {
         throw new Error(`conformance: case '${c.name}' cannot run over a WebSocket (is_ws_conformance_case) — ` +
             `filter the cases before sending them on the WS leg.`);
     }
     const principal = await resolve_conformance_principal(fixture, c.request.as, principals, resolved_rpc_endpoints);
-    const { transport, headers, suppress_default_origin } = principal;
+    const { transport, suppress_default_origin } = principal;
+    const headers = request_headers
+        ? { ...request_headers, ...principal.headers }
+        : principal.headers;
     const params = c.request.acting
         ? bind_acting(c, resolve_acting_binding(c, c.request.acting, fixture, principal))
         : c.request.params;
@@ -461,15 +464,14 @@ const CONFORMANCE_REQUEST_ID = 'test';
  * The upgrade carries the principal's headers (its cookie, bearer or daemon
  * token) and the `Origin` the HTTP leg would send: none for a principal that
  * suppresses it, the target's otherwise. It also names the principal's own
- * actor as `?acting=`. Only the TS spine resolves an actor at the upgrade,
- * refusing a multi-actor account's upgrade without one (400
- * `actor_required`); the Rust spine's upgrade resolves the account and
- * ignores `?acting=`. Per-frame dispatch resolves the actor from each frame's
+ * actor as `?acting=`, which both spines resolve at the upgrade (a
+ * multi-actor account's upgrade without one is refused 400
+ * `actor_required`). Per-frame dispatch resolves the actor from each frame's
  * own `acting` on both. Because the leg always sends `?acting=`, it does not
- * cover that upgrade-level difference — the front-door table's multi-actor
- * row does. The socket closes afterwards; a
- * close error is not the case's subject (a request that revokes its own
- * credential closes the socket after its reply).
+ * cover the upgrade's own refusal — the front-door table's multi-actor row
+ * does. The socket closes afterwards; a close error is not the case's subject
+ * (a request that revokes its own credential closes the socket after its
+ * reply).
  */
 const send_ws_frame = async (method, params, principal, ws) => {
     const client = await create_admitted_ws_transport({

package/dist/testing/cross_backend/cross_rpc.d.ts

@@ -3,6 +3,8 @@ import type { z } from 'zod';
 import type { FetchTransport } from '../transports/fetch_transport.js';
 /** Minimal JSON-RPC envelope shape the suites read off responses. */
 export interface RpcResult {
+    /** The HTTP status the reply carried. */
+    readonly status: number;
     readonly ok: boolean;
     readonly result?: unknown;
     readonly error?: {
@@ -22,7 +24,7 @@ export interface RpcResult {
  * @param method - the JSON-RPC method
  * @param params - the request params
  * @param headers - auth and other headers, merged over the JSON defaults
- * @returns the response's `ok`, `result` and `error`
+ * @returns the response's HTTP `status`, `ok`, `result` and `error`
  * @throws Error when the reply is not a JSON object — naming the method, the
  *   HTTP status and the head of the body, so a proxy page or a crash reads
  *   as what it is

package/dist/testing/cross_backend/cross_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cross_rpc.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAmBnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}
+{"version":3,"file":"cross_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cross_rpc.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAmBnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}

package/dist/testing/cross_backend/cross_rpc.js

@@ -26,7 +26,7 @@ const BODY_HEAD_LENGTH = 200;
  * @param method - the JSON-RPC method
  * @param params - the request params
  * @param headers - auth and other headers, merged over the JSON defaults
- * @returns the response's `ok`, `result` and `error`
+ * @returns the response's HTTP `status`, `ok`, `result` and `error`
  * @throws Error when the reply is not a JSON object — naming the method, the
  *   HTTP status and the head of the body, so a proxy page or a crash reads
  *   as what it is
@@ -48,7 +48,7 @@ export const cross_rpc_call = async (transport, path, method, params, headers) =
             JSON.stringify(text.slice(0, BODY_HEAD_LENGTH)));
     }
     const envelope = body;
-    return { ok: res.ok, result: envelope.result, error: envelope.error };
+    return { status: res.status, ok: res.ok, result: envelope.result, error: envelope.error };
 };
 /** Pull `error.data.reason` off an RPC error envelope (undefined if absent). */
 export const error_reason = (r) => r.error && typeof r.error.data === 'object' && r.error.data !== null

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -34,14 +34,14 @@ export declare const action_rate_limit_env: (options: ActionRateLimitEnvOptions)
 /**
  * Capabilities shared by TS-family backends — only what the family
  * guarantees: the declared spine surface's mounts and the behavior of its
- * reference runtime, Node. Carries no `MountFlag`; each backend config states
- * those itself (`FamilyDefaultCapabilities`).
+ * reference runtime, Node. Carries no `MountFlag` and no `testing_backdoors`;
+ * each backend config states those itself (`FamilyDefaultCapabilities`).
  */
 export declare const ts_default_capabilities: FamilyDefaultCapabilities;
 /**
  * Capabilities for the Rust family — only what the family guarantees, as with
  * `ts_default_capabilities`: the declared spine surface's mounts and the
- * behavior of hyper. Carries no `MountFlag`.
+ * behavior of hyper. Carries no `MountFlag` and no `testing_backdoors`.
  */
 export declare const rust_default_capabilities: FamilyDefaultCapabilities;
 export interface MakeDefaultTsBackendConfigOptions {
@@ -57,8 +57,9 @@ export interface MakeDefaultTsBackendConfigOptions {
     readonly extra_env?: Readonly<Record<string, string>>;
     /**
      * Every capability, stated: spread `ts_default_capabilities` and add each
-     * `MountFlag`. Required, so a mount flag left out is a type error rather
-     * than a suite that silently skips.
+     * `MountFlag` and the `testing_backdoors` list. Required, so a mount flag or
+     * the backdoor list left out is a type error rather than a suite that
+     * silently skips.
      */
     readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */
@@ -113,8 +114,9 @@ export interface MakeDefaultRustBackendConfigOptions {
     readonly extra_env?: Readonly<Record<string, string>>;
     /**
      * Every capability, stated: spread `rust_default_capabilities` and add each
-     * `MountFlag`. Required, so a mount flag left out is a type error rather
-     * than a suite that silently skips.
+     * `MountFlag` and the `testing_backdoors` list. Required, so a mount flag or
+     * the backdoor list left out is a type error rather than a suite that
+     * silently skips.
      */
     readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAehG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,mBAAmB,MAAM,KAAG,MAS/D,CAAC;AAcF,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBAgBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,yBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAuCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA+CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAehG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,mBAAmB,MAAM,KAAG,MAS/D,CAAC;AAcF,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBAgBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,yBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAuCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA+CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -81,8 +81,8 @@ export const action_rate_limit_env = (options) => ({
 /**
  * Capabilities shared by TS-family backends — only what the family
  * guarantees: the declared spine surface's mounts and the behavior of its
- * reference runtime, Node. Carries no `MountFlag`; each backend config states
- * those itself (`FamilyDefaultCapabilities`).
+ * reference runtime, Node. Carries no `MountFlag` and no `testing_backdoors`;
+ * each backend config states those itself (`FamilyDefaultCapabilities`).
  */
 export const ts_default_capabilities = Object.freeze({
     // The account-lifecycle verbs are on the declared surface
@@ -104,7 +104,7 @@ export const ts_default_capabilities = Object.freeze({
 /**
  * Capabilities for the Rust family — only what the family guarantees, as with
  * `ts_default_capabilities`: the declared spine surface's mounts and the
- * behavior of hyper. Carries no `MountFlag`.
+ * behavior of hyper. Carries no `MountFlag` and no `testing_backdoors`.
  */
 export const rust_default_capabilities = Object.freeze({
     // The account-lifecycle verbs are in the spine's admin action set, on the

package/dist/testing/cross_backend/differential.d.ts

@@ -6,6 +6,13 @@ import type { ConformanceCase } from './conformance_case.js';
 import { type ConformancePrincipalConfig } from './conformance_table.js';
 import type { SetupTest } from './setup.js';
 import type { WsEndpointTarget } from './ws_endpoint.js';
+/**
+ * Headers every HTTP request the differential sends carries, beneath the
+ * principal's: `accept-encoding: identity`, so each backend answers
+ * uncompressed and a runtime's own compression (`Deno.serve` compresses for a
+ * request that accepts gzip) never reads as a header difference.
+ */
+export declare const DIFFERENTIAL_REQUEST_HEADERS: Readonly<Record<string, string>>;
 /** One side of the differential. */
 export interface DifferentialBackend {
     /** Short label used in failure output (`ts`, `rust`). */

package/dist/testing/cross_backend/differential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"differential.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/differential.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6C9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAIN,KAAK,0BAA0B,EAC/B,MAAM,wBAAwB,CAAC;AAShC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG;IACpD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;CACnE,CAAC;AAEF,6DAA6D;AAC7D,MAAM,WAAW,8BAA8B;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACvE,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,oDAAoD;IACpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,aAAa,CAAC,eAAe,CAAC,EACrC,QAAQ,aAAa,CAAC,eAAe,CAAC,KACpC,KAAK,CAAC,MAAM,CA0Bd,CAAC;AA6BF;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,8BAA8B,KACrC,IA0GF,CAAC"}
+{"version":3,"file":"differential.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/differential.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoD9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAIN,KAAK,0BAA0B,EAC/B,MAAM,wBAAwB,CAAC;AAShC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE,CAAC;AAEF,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG;IACpD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;CACnE,CAAC;AAEF,6DAA6D;AAC7D,MAAM,WAAW,8BAA8B;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACvE,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,oDAAoD;IACpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,aAAa,CAAC,eAAe,CAAC,EACrC,QAAQ,aAAa,CAAC,eAAe,CAAC,KACpC,KAAK,CAAC,MAAM,CA0Bd,CAAC;AA6BF;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,8BAA8B,KACrC,IA2GF,CAAC"}

package/dist/testing/cross_backend/differential.js

@@ -19,6 +19,13 @@ import '../assert_dev_env.js';
  * each backend's conformance leg already holds them; the differential holds
  * the two answers to each other.
  *
+ * Every HTTP request asks for an uncompressed response
+ * (`DIFFERENTIAL_REQUEST_HEADERS`): content negotiation is the transport's,
+ * not the app's — Deno's `Deno.serve` compresses a response whose request
+ * accepts gzip, as Node's `fetch` sends by default, while other servers send
+ * it as is — so letting a server choose would read as a `content-encoding` and
+ * `vary` difference on every case.
+ *
  * A difference that is tracked and accepted goes in the **known-divergence
  * ledger** (`KnownDivergence`), matched by case names or by methods, naming
  * the paths that differ (`what_differs`), each optionally with the value each
@@ -42,6 +49,15 @@ import '../assert_dev_env.js';
 import { assert, describe, test } from 'vitest';
 import { is_ws_conformance_case, resolve_conformance_rpc_endpoints, send_conformance_case } from './conformance_table.js';
 import { diff_differential_responses, differential_path_covers, format_differential_diffs, normalize_differential_response } from './differential_normalize.js';
+/**
+ * Headers every HTTP request the differential sends carries, beneath the
+ * principal's: `accept-encoding: identity`, so each backend answers
+ * uncompressed and a runtime's own compression (`Deno.serve` compresses for a
+ * request that accepts gzip) never reads as a header difference.
+ */
+export const DIFFERENTIAL_REQUEST_HEADERS = {
+    'accept-encoding': 'identity'
+};
 const as_list = (value) => typeof value === 'string' ? [value] : value;
 /** The ledger entries matching a case. */
 const find_known_divergences = (c, ledger) => ledger.filter((d) => d.case_name !== undefined
@@ -126,6 +142,7 @@ export const describe_differential_conformance_tests = (options) => {
         surface_source,
         ...(principals && { principals }),
         resolved_rpc_endpoints,
+        request_headers: DIFFERENTIAL_REQUEST_HEADERS,
         ...(backend.ws && { ws: backend.ws })
     }));
     describe(options.suite_name ?? 'differential conformance', () => {

package/dist/testing/cross_backend/expected_schema.json

@@ -72,6 +72,7 @@
 		"moderation",
 		"parent_id",
 		"path",
+		"policy",
 		"refs",
 		"root_id",
 		"updated_at",

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkC7D,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA2CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,eAAe,CAOvE,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkC7D,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA4CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,eAAe,CAOvE,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -56,10 +56,11 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         // Mount the directory-model `cell_gated_create` test policy (twin of the
         // Rust stub's `TestCellGatedCreateAuthorize`) so the cross-backend
         // authorizer-parity suite has a known gate: `kind: 'space'` roots are
-        // admin-only, contributions are gated by the root's `data.policy`, and
-        // plain parentless creates stay open (the other cell suites are
-        // unaffected). The handler hands the governing root's `data` to the
-        // (pure) authorizer.
+        // admin-only, contributions are gated by the root's `policy`, and plain
+        // parentless creates stay open (the other cell suites are unaffected).
+        // The handler hands the governing root's `policy` to the (pure)
+        // authorizer, whose `validate_policy` accepts or refuses each policy
+        // write.
         ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),

package/dist/testing/cross_backend/role_grant_offer_lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAMxE,qEAAqE;AACrE,MAAM,WAAW,uCAAwC,SAAQ,wBAAwB;IACxF;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAyRF,CAAC"}
+{"version":3,"file":"role_grant_offer_lifecycle.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAMxE,qEAAqE;AACrE,MAAM,WAAW,uCAAwC,SAAQ,wBAAwB;IACxF;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAyYF,CAAC"}

package/dist/testing/cross_backend/role_grant_offer_lifecycle.js

@@ -17,6 +17,13 @@ import '../assert_dev_env.js';
  * - **already decided → 400** `invalid_request` with reason
  *   `role_grant_offer_terminal` — a decline or retract after an accept, a
  *   second decline, a second retract, and either one after the other.
+ * - **a grantor's lost authority ends its pending offers.** Revoking a
+ *   grantor's grant, or deleting its account, supersedes every pending offer
+ *   it made — gone from the recipient's inbox, an accept answers
+ *   `role_grant_offer_terminal`, and a `role_grant_offer_supersede` row records
+ *   it (`role_grant_revoked` with the grant as cause, `account_deleted` with
+ *   the account). The keeper's own `admin` grant refuses a revoke, 403
+ *   `cannot_revoke_keeper_admin`.
  * - **one audit row per success, none per refusal.** A decline writes
  *   `role_grant_offer_decline` attributed to the recipient and targeting the
  *   grantor, a retract `role_grant_offer_retract` attributed to the grantor
@@ -37,11 +44,14 @@ import '../assert_dev_env.js';
  */
 import { assert, describe, test } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
-import { ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { ERROR_CANNOT_REVOKE_KEEPER_ADMIN, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { AdminAccountListOutput } from '../../auth/admin_action_specs.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { expect_output } from './cross_rpc.js';
 import { JSONRPC_INVALID_REQUEST } from '../../http/jsonrpc.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { assert_audit_metadata_fields, list_audit_events } from './audit_cross_helpers.js';
-import { create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
+import { create_active_role_grant, create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
 import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that names no offer. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
@@ -200,4 +210,66 @@ export const describe_role_grant_offer_lifecycle_cross_tests = (options) => {
             assert.strictEqual(after.retracts.length, before.retracts.length, 'no retract row added');
         });
     });
+    describe("a grantor's lost authority ends its pending offers", () => {
+        /** A grantor holding a global `admin` grant (offer authority) and its id. */
+        const setup_grantor = async (fixture, username) => {
+            const grantor = await fixture.create_account({ username });
+            const grant_id = await create_active_role_grant(fixture, grantor, {
+                role: ROLE_ADMIN,
+                rpc_path
+            });
+            return { grantor, grant_id };
+        };
+        /** The pending `role` offer `grantor` makes to `recipient`. */
+        const offer_from = (fixture, grantor, recipient) => create_pending_role_grant_offer(fixture, recipient.account.id, grantor.create_session_headers(), { role, rpc_path });
+        const assert_superseded = async (fixture, recipient, offer_id, cause) => {
+            assert.ok(!(await is_pending(fixture, recipient, offer_id)), 'gone from the recipient inbox');
+            assert_terminal(await accept(fixture, offer_id, recipient.create_session_headers()), 'an accept of the superseded offer');
+            const rows = (await list_audit_events(fixture, { event_type: 'role_grant_offer_supersede' }, rpc_path)).filter((e) => e.metadata?.offer_id === offer_id);
+            assert.strictEqual(rows.length, 1, 'one role_grant_offer_supersede row');
+            assert_audit_metadata_fields(fixture, rows[0].metadata, {
+                offer_id,
+                role,
+                scope_id: null,
+                ...cause
+            });
+        };
+        test("revoking the grantor's grant supersedes its pending offers", async () => {
+            const fixture = await setup_test();
+            const { grantor, grant_id } = await setup_grantor(fixture, 'lost_authority_revoked');
+            const recipient = await fixture.create_account({ username: 'lost_authority_to' });
+            const offer = await offer_from(fixture, grantor, recipient);
+            // another grantor's offer to the same recipient is the control
+            const control = await create_offer(fixture, recipient);
+            assert_ok(await rpc(fixture, 'role_grant_revoke', { actor_id: grantor.actor.id, role_grant_id: grant_id }, fixture.create_session_headers()), 'revoke');
+            await assert_superseded(fixture, recipient, offer.id, {
+                reason: 'role_grant_revoked',
+                cause_id: grant_id
+            });
+            assert.ok(await is_pending(fixture, recipient, control.id), "the keeper's offer stays");
+        });
+        test("deleting the grantor's account supersedes its pending offers", async () => {
+            const fixture = await setup_test();
+            const { grantor } = await setup_grantor(fixture, 'lost_authority_deleted');
+            const recipient = await fixture.create_account({ username: 'lost_authority_del_to' });
+            const offer = await offer_from(fixture, grantor, recipient);
+            assert_ok(await rpc(fixture, 'account_delete', { account_id: grantor.account.id }, fixture.create_session_headers()), 'account_delete');
+            await assert_superseded(fixture, recipient, offer.id, {
+                reason: 'account_deleted',
+                cause_id: grantor.account.id
+            });
+        });
+        test("the keeper's admin grant refuses a revoke → 403 cannot_revoke_keeper_admin", async () => {
+            const fixture = await setup_test();
+            const listed = expect_output(await rpc(fixture, 'admin_account_list', {}, fixture.create_session_headers()), AdminAccountListOutput);
+            const keeper = listed.accounts.find((a) => a.account.id === fixture.account.id);
+            const keeper_admin = keeper?.role_grants.find((g) => g.role === ROLE_ADMIN && g.scope_id === null);
+            assert.ok(keeper_admin, "the keeper's global admin grant");
+            const refused = await rpc(fixture, 'role_grant_revoke', { actor_id: fixture.actor.id, role_grant_id: keeper_admin.id }, fixture.create_session_headers());
+            assert.ok(!refused.ok, 'the keeper keeps its admin grant');
+            assert.strictEqual(refused.status, 403);
+            assert.strictEqual(refused.error.code, JSONRPC_ERROR_CODES.forbidden);
+            assert.deepStrictEqual(refused.error.data, { reason: ERROR_CANNOT_REVOKE_KEEPER_ADMIN });
+        });
+    });
 };