@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -13,17 +13,24 @@ import '../assert_dev_env.js';
  *   every other parentless kind stays open, so the plain-create `cell_crud` /
  *   `cell_relations` suites are unaffected.
  * - **Contribution** (`root_id` set): the governing root's
- *   `data.policy[kind] = {min_role?, moderation_required?}` decides — a missing
- *   entry denies, a present `min_role` the actor lacks globally denies, and otherwise it
- *   admits with the entry's `moderation_required` folded into the verdict. The
- *   root's `data` arrives in `input.root_data` (the handler read it in-tx), so
- *   the predicate is **pure** — no DB read of its own (which also dodges the
- *   single-connection in-memory deadlock a separate handle would hit — pglet, PGlite).
+ *   `policy[kind] = {min_role?, moderation_required?}` decides — a missing
+ *   entry (or no policy) denies, a present `min_role` the actor lacks globally
+ *   denies, and otherwise it admits with the entry's `moderation_required`
+ *   folded into the verdict. The root's policy arrives in `input.root_policy`
+ *   (the handler read it in-tx), so the predicate is **pure** — no DB read of
+ *   its own (which also dodges the single-connection in-memory deadlock a
+ *   separate handle would hit — pglet, PGlite).
+ *
+ * Its `validate_policy` accepts a policy whose every entry is an object with
+ * an optional string `min_role` and an optional boolean `moderation_required`,
+ * and refuses any other with `ERROR_CELL_POLICY_INVALID`.
  *
  * @module
  */
 import { has_scoped_role } from '../../auth/request_context.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { ERROR_CELL_POLICY_INVALID } from '../../auth/cell_action_specs.js';
+import { jsonrpc_errors } from '../../http/jsonrpc_errors.js';
 import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
 /** The admin-only root kind the test policy gates (talk's `space` analog). */
 export const SPACE_CELL_KIND = 'space';
@@ -34,26 +41,32 @@ export const SPACE_CELL_KIND = 'space';
  */
 export const PARTICIPATION_ROLE = SPINE_PARTICIPANT_ROLE;
 /**
- * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * A space `policy` mirroring the test ladder: gated `post` (moderated) +
  * `react` (live) + `comment` (live), each on `PARTICIPATION_ROLE`. `comment`
  * exists so a suite can create a comment under a post (`root_id !==
  * parent_id`) and prove the policy resolves from the governing root (the
  * space), not the immediate parent. Shared by the gated-create and moderate
- * cross suites.
+ * cross suites, which pass it as a root's `cell_create` `policy`.
  */
 export const TEST_SPACE_POLICY = {
-    policy: {
-        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
-        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
-        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
-    }
+    post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+    react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+    comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
 };
-/** Pull the governing root's `data.policy[kind]` rule, defensively (loose `data`). */
-const get_contribution_rule = (data, kind) => {
-    if (data === null || typeof data !== 'object')
-        return undefined;
-    const policy = data.policy;
-    if (policy === null || typeof policy !== 'object')
+/** Whether `value` is a `ContributionRule` — an object of only those two keys, each its type. */
+const is_contribution_rule = (value) => value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.entries(value).every(([key, v]) => {
+        if (key === 'min_role')
+            return typeof v === 'string';
+        if (key === 'moderation_required')
+            return typeof v === 'boolean';
+        return false;
+    });
+/** Pull the governing root's `policy[kind]` rule, defensively. */
+const get_contribution_rule = (policy, kind) => {
+    if (policy === null)
         return undefined;
     const rule = policy[kind];
     if (rule === null || typeof rule !== 'object')
@@ -61,29 +74,40 @@ const get_contribution_rule = (data, kind) => {
     return rule;
 };
 /**
- * The directory-model test authorizer — a **pure** function of the input (it
- * reads the governing root's policy off `input.root_data`, supplied by the
- * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
+ * The directory-model test authorizer — `authorize` is a **pure** function of
+ * the input (it reads the governing root's policy off `input.root_policy`,
+ * supplied by the handler). Byte-equivalent with the Rust
+ * `TestCellGatedCreateAuthorize`.
  */
-export const test_cell_gated_create_authorize = (auth, input) => {
-    // Admin bypass — admins create roots + any kind, live immediately. The
-    // global grant only: a scoped `admin` row bypasses nothing.
-    if (has_scoped_role(auth, ROLE_ADMIN, null))
-        return { allow: true, moderation_required: false };
-    // Root creation (no governing root): `space` is admin-only; other parentless
-    // kinds stay open (the plain-create suites).
-    if (input.root_id === null) {
-        return input.kind === SPACE_CELL_KIND
-            ? { allow: false }
-            : { allow: true, moderation_required: false };
+export const test_cell_gated_create_authorize = {
+    authorize: (auth, input) => {
+        // Admin bypass — admins create roots + any kind, live immediately. The
+        // global grant only: a scoped `admin` row bypasses nothing.
+        if (has_scoped_role(auth, ROLE_ADMIN, null)) {
+            return { allow: true, moderation_required: false };
+        }
+        // Root creation (no governing root): `space` is admin-only; other
+        // parentless kinds stay open (the plain-create suites).
+        if (input.root_id === null) {
+            return input.kind === SPACE_CELL_KIND
+                ? { allow: false }
+                : { allow: true, moderation_required: false };
+        }
+        // Contribution: resolve the governing root's per-kind policy.
+        const rule = get_contribution_rule(input.root_policy, input.kind ?? '');
+        if (!rule)
+            return { allow: false };
+        // `min_role` names no scope, so only the global grant satisfies it.
+        const admitted = rule.min_role === undefined || has_scoped_role(auth, rule.min_role, null);
+        return admitted
+            ? { allow: true, moderation_required: rule.moderation_required ?? false }
+            : { allow: false };
+    },
+    validate_policy: (policy) => {
+        if (!Object.values(policy).every(is_contribution_rule)) {
+            throw jsonrpc_errors.invalid_params('invalid space policy', {
+                reason: ERROR_CELL_POLICY_INVALID
+            });
+        }
     }
-    // Contribution: resolve the governing root's per-kind policy.
-    const rule = get_contribution_rule(input.root_data, input.kind ?? '');
-    if (!rule)
-        return { allow: false };
-    // `min_role` names no scope, so only the global grant satisfies it.
-    const admitted = rule.min_role === undefined || has_scoped_role(auth, rule.min_role, null);
-    return admitted
-        ? { allow: true, moderation_required: rule.moderation_required ?? false }
-        : { allow: false };
 };

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,14 +1,37 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 import { type WsEndpointTarget } from './ws_endpoint.js';
-/** Options for the testing-backdoor negative-credential suite. */
-export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
+/**
+ * A backdoor the suite fires: its method and a params payload its input
+ * schema accepts, so a refusal lands on the credential gate, not on validation.
+ */
+export interface TestingBackdoorProbe {
+    readonly method: string;
+    readonly params?: unknown;
+}
+/** Options for the testing-backdoor suite. */
+export interface TestingBackdoorCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /**
      * Where the backend's WebSocket endpoint is, for the session-socket cases.
-     * Pass it when the backend serves the `_testing_*` actions on its WS
+     * Pass it when the backend serves its `_testing_*` actions on its WS
      * endpoint too; omitted, those cases are skipped.
      */
     readonly ws?: WsEndpointTarget;
+    /**
+     * The backend's own daemon-token seams beyond `TESTING_BACKDOOR_METHODS`,
+     * each with params its input accepts — fired with the same refused
+     * principals as the known backdoors. Each must start with `_testing_` and
+     * not be a known backdoor; the call throws otherwise.
+     */
+    readonly extra_methods?: ReadonlyArray<TestingBackdoorProbe>;
 }
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAExE,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAwF1E,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAoEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2F9B,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAMvF,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0C1E;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkDD,8CAA8C;AAC9C,MAAM,WAAW,+BAAgC,SAAQ,uCAAuC;IAC/F;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC7D;AAqDD;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAgHF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -1,19 +1,20 @@
 import '../assert_dev_env.js';
 /**
- * Cross-backend negative-credential suite for the `_testing_*` backdoor
- * actions.
+ * Cross-backend suite for the `_testing_*` backdoor actions: the backend's
+ * declaration of which it mounts, and the credential gate on each.
  *
- * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_flood_notifications` / `_testing_schema_snapshot` /
- * `_testing_migration_tracker` / `_testing_action_manifest` /
- * `_testing_origin_check` / `_testing_shorten_credential_expiry` are
+ * `TESTING_BACKDOOR_METHODS` (`_testing_reset`, `_testing_drain_effects`,
+ * `_testing_mint_session`, `_testing_put_fact`,
+ * `_testing_flood_notifications`, `_testing_schema_snapshot`,
+ * `_testing_migration_tracker`, `_testing_action_manifest`,
+ * `_testing_origin_check`, `_testing_shorten_credential_expiry`) are
  * privileged test-binary actions the production
  * wire never exposes — direct DB writes (full auth wipe, forged session row,
- * raw fact insert), a flood of the caller's own connection, introspection
- * reads (the live schema, the `schema_version` migration tracker, and the live
- * RPC registry — the highest info-leak of the set were the gate to break), a
- * probe of the origin allowlist parser, and a rewrite of an account's
- * credential expiries. Their only structural fence
+ * raw fact insert), the audit barrier, a flood of the caller's own connection,
+ * introspection reads (the live schema, the `schema_version` migration
+ * tracker, and the live RPC registry — the highest info-leak of the set were
+ * the gate to break), a probe of the origin allowlist parser, and a rewrite of
+ * an account's credential expiries. Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
  * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
@@ -24,7 +25,19 @@ import '../assert_dev_env.js';
  * (`live_rpc_endpoints`) fires the same refusals through the auth rows
  * `generate_rpc_auth_conformance_cases` generates for them.
  *
- * For every backdoor method, three principals:
+ * **The declaration.** A backend states which it mounts in
+ * `capabilities.testing_backdoors`, and the suite holds it to that: each known
+ * backdoor the declaration leaves out is sent anonymously and must answer
+ * `method_not_found` (404) — both spines look a method up before they
+ * authenticate the caller, so an unmounted method answers that whatever the
+ * credential — and each declared one runs the rows below, whose anonymous row
+ * (a 401, not `method_not_found`) proves it mounted. A wrong declaration fails
+ * either way, so the suites that skip on an undeclared backdoor
+ * (`describe_spine_cross_suites`) skip only what the backend truly lacks. The
+ * check runs on every backend, one mounting none of them included.
+ *
+ * For every declared backdoor, and each `extra_methods` seam (a consumer's own
+ * daemon-token action), three principals:
  *
  * - **anonymous** (no credential) → `401` (pre-authorization auth refuses an
  *   account-less caller before anything else).
@@ -55,13 +68,13 @@ import '../assert_dev_env.js';
  * on both impls. Cited property: `security.md` §Test Backdoor Actions
  * (daemon-token-gated, off-surface, DEV-excluded).
  *
- * Cross-process only — the `_testing_*` actions are mounted on the spawned
- * binary, not the in-process app — like the ws/sse suites. Wire from a
- * `*.cross.test.ts`. Requires the standard `_testing_*` actions mounted (the
- * same precondition `default_cross_process_setup` already imposes for its
- * per-test `_testing_reset`); the HTTP cases are ungated, since every cross
- * backend mounts them, and the WS cases run when `ws` is passed — for a
- * backend that also serves them on its WS endpoint.
+ * The credential rows run cross-process only — the `_testing_*` actions are
+ * mounted on the spawned binary, not the in-process app — like the ws/sse
+ * suites; there, wire from a `*.cross.test.ts`, whose setup fires
+ * `_testing_reset`, so the backend must mount that one. In-process, an app
+ * mounting none declares none, and the suite runs the declaration rows alone,
+ * one per known backdoor. The WS cases run when `ws` is passed — for a
+ * backend that also serves its backdoors on its WS endpoint.
  *
  * @module
  */
@@ -69,46 +82,49 @@ import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
+import { TESTING_METHOD_PREFIX } from '../surface_invariants.js';
 import { is_response_for } from '../transports/ws_client.js';
 import { test_if } from './capabilities.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { SPINE_RPC_PATH, TESTING_BACKDOOR_METHODS } from './spine_surface_constants.js';
 import { open_session_ws } from './ws_endpoint.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**
- * The backdoor methods + a **valid** params payload each (so the
- * session/bearer cases reach the 403 credential gate rather than a 400 on
- * input validation). The handlers never run — the gate refuses first.
+ * A **valid** params payload for each known backdoor (so the session/bearer
+ * cases reach the 403 credential gate rather than a 400 on input validation).
+ * The handlers never run — the gate refuses first. Keyed by
+ * `TestingBackdoorMethod`, so a method added to `TESTING_BACKDOOR_METHODS`
+ * fails typecheck here until it has its params.
  */
-const backdoor_methods = [
-    { method: '_testing_reset', params: {} },
+const BACKDOOR_PARAMS = {
+    _testing_reset: {},
     // The audit barrier — its input is void, so the call carries no params.
-    { method: '_testing_drain_effects', params: undefined },
-    { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
-    { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    _testing_drain_effects: undefined,
+    _testing_mint_session: { account_id: NIL_UUID, expires_in_seconds: -60 },
+    _testing_put_fact: { content: 'backdoor-probe' },
     // An empty burst — valid input, so it clears the 400 phase; a refused
     // caller never reaches the handler that would queue it.
-    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
+    _testing_flood_notifications: { count: 0, size: 0 },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
-    { method: '_testing_schema_snapshot', params: {} },
+    _testing_schema_snapshot: {},
     // The migration-tracker-dump read — input is an empty strict object, so `{}`
     // is valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_migration_tracker', params: {} },
+    _testing_migration_tracker: {},
     // The RPC-registry-dump read — input is an empty strict object, so `{}` is
     // valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_action_manifest', params: {} },
+    _testing_action_manifest: {},
     // The origin conformance probe — a valid `{patterns, origin}` pair, so it
     // clears the 400 phase like the rest.
-    { method: '_testing_origin_check', params: { patterns: 'http://localhost:*', origin: null } },
+    _testing_origin_check: { patterns: 'http://localhost:*', origin: null },
     // The credential-expiry rewrite — a valid `{account_id, seconds}` pair (a
     // syntactically valid UUID; no row needs to match), so it clears the 400
     // phase like the rest.
-    {
-        method: '_testing_shorten_credential_expiry',
-        params: { account_id: '00000000-0000-4000-8000-000000000000', seconds: 30 }
+    _testing_shorten_credential_expiry: {
+        account_id: '00000000-0000-4000-8000-000000000000',
+        seconds: 30
     }
-];
+};
 const principals = [
     {
         name: 'anonymous',
@@ -139,11 +155,89 @@ const principals = [
         })
     }
 ];
+/**
+ * The known backdoors a backend declares, checked against the known list,
+ * and its extra seams, checked against the `_testing_` prefix and the list.
+ *
+ * @throws Error - on a declared method that isn't a known backdoor, an extra
+ *   method outside the `_testing_` namespace or naming a known backdoor, or a
+ *   duplicate
+ */
+const resolve_backdoor_probes = (declared, extra_methods) => {
+    const known = new Set(TESTING_BACKDOOR_METHODS);
+    const seen = new Set();
+    for (const method of declared) {
+        if (!known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares ` +
+                `'${method}', which is not in TESTING_BACKDOOR_METHODS — pass a consumer seam as extra_methods`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares '${method}' twice`);
+        }
+        seen.add(method);
+    }
+    for (const { method } of extra_methods) {
+        if (!method.startsWith(TESTING_METHOD_PREFIX) || known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' must start with ` +
+                `'${TESTING_METHOD_PREFIX}' and not be a known backdoor (declare those in capabilities.testing_backdoors)`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' is listed twice`);
+        }
+        seen.add(method);
+    }
+    return [
+        ...TESTING_BACKDOOR_METHODS.filter((method) => declared.includes(method)).map((method) => ({
+            method,
+            params: BACKDOOR_PARAMS[method]
+        })),
+        ...extra_methods
+    ];
+};
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export const describe_testing_backdoor_cross_tests = (options) => {
-    const { setup_test, ws } = options;
+    const { setup_test, capabilities, ws, extra_methods = [] } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const declared = capabilities.testing_backdoors;
+    const probes = resolve_backdoor_probes(declared, extra_methods);
+    // a declared backdoor's mount is pinned by its anonymous row below (a 401,
+    // not `method_not_found`); an undeclared one must not be mounted, so a
+    // backend can't mount one its declaration leaves out
+    const undeclared = TESTING_BACKDOOR_METHODS.filter((method) => !declared.includes(method));
+    // vitest fails a describe holding no test, so a full declaration registers none
+    if (undeclared.length > 0) {
+        describe('testing backdoor declaration', () => {
+            for (const method of undeclared) {
+                test(`${method} is undeclared → method_not_found`, async () => {
+                    const fixture = await setup_test();
+                    const res = await rpc_call({
+                        app: fixture.fresh_transport(),
+                        path: rpc_path,
+                        method,
+                        params: BACKDOOR_PARAMS[method]
+                    });
+                    assert.ok(!res.ok, `${method}: undeclared in capabilities.testing_backdoors, but the call succeeded`);
+                    if (!res.ok) {
+                        assert.strictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${method}: undeclared in capabilities.testing_backdoors, but it answers ` +
+                            `${res.status} (${res.error.code}) — the backend mounts it, so declare it`);
+                    }
+                    assert.strictEqual(res.status, 404, `${method}: status`);
+                });
+            }
+        });
+    }
+    // none declared and no extra seam: no rows, and vitest fails an empty describe
+    if (probes.length === 0)
+        return;
     describe('testing backdoor credential gate parity', () => {
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             for (const principal of principals) {
                 test(`${method} rejects ${principal.name} → ${principal.status}`, async () => {
                     const fixture = await setup_test();
@@ -158,9 +252,10 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                     });
                     const label = `${method} ${principal.name}`;
                     assert.ok(!res.ok, `${label}: expected denial (${principal.status}) but the call succeeded`);
-                    assert.strictEqual(res.status, principal.status, `${label}: status`);
                     // `!res.ok` narrows `res` to the error variant for `res.error`.
                     if (!res.ok) {
+                        assert.notStrictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${label}: declared but not mounted — the backend answers method_not_found`);
+                        assert.strictEqual(res.status, principal.status, `${label}: status`);
                         assert.strictEqual(res.error.code, principal.code, `${label}: error.code`);
                         if (principal.reason !== undefined) {
                             const reason = res.error.data?.reason;
@@ -170,7 +265,7 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                 });
             }
         }
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
                 const fixture = await setup_test();
                 const client = await open_session_ws(ws, fixture, { admitted: true });

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -177,6 +180,11 @@ export declare const testing_reset_action_spec: {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export declare const testing_drain_effects_action_spec: {
@@ -192,6 +200,7 @@ export declare const testing_drain_effects_action_spec: {
     readonly input: z.ZodVoid;
     readonly output: z.ZodObject<{
         ok: z.ZodBoolean;
+        tracked: z.ZodBoolean;
     }, z.core.$strict>;
     readonly async: true;
     readonly description: "Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.";
@@ -251,7 +260,8 @@ export declare const testing_mint_session_action_spec: {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
@@ -626,17 +636,22 @@ export interface CreateTestingActionsOptions {
      */
     readonly daemon_token_state: DaemonTokenState;
     /**
-     * Consumer-supplied callback invoked after the auth-table reset, passed
-     * the same transactional `Db` the auth wipes ran on. DB-domain consumers
+     * Consumer-supplied callback invoked first, before the auth-table wipe and
+     * keeper re-seed, passed the same transactional `Db` the auth wipes then
+     * run on. It runs while the previous test's accounts and actors still
+     * exist, so a domain table with a restricting FK to `actor` / `account`
+     * empties before the auth wipe deletes what it references; it must not
+     * depend on the fresh keeper, which doesn't exist yet. DB-domain consumers
      * (e.g. fuz_forge truncating its cell / fact / file tables) MUST use this
      * `db` rather than a separately-pooled connection — under the in-memory
-     * drivers' single connection (pglet, PGlite) a second connection deadlocks against this still-open
-     * transaction. `testing_zzz_server` clears in-memory workspace registry +
-     * terminals + scoped-FS scratch (ignores `db`); the spine binaries
-     * (`testing/cross_backend/full_spine_mount.ts` and the Rust `testing_spine_stub`) empty
-     * the cell and fact tables. Runs inside the same RPC dispatch
-     * as the auth-table writes, so a throw surfaces to the caller as a
-     * JSON-RPC error and the per-test fixture short-circuits.
+     * drivers' single connection (pglet, PGlite) a second connection deadlocks
+     * against this still-open transaction. `testing_zzz_server` clears
+     * in-memory workspace registry + terminals + scoped-FS scratch (ignores
+     * `db`); the spine binaries (`testing/cross_backend/full_spine_mount.ts` and
+     * the Rust `testing_spine_stub`) empty the cell and fact tables. Runs inside
+     * the same RPC dispatch as the auth-table writes, so a throw rolls the whole
+     * reset back and surfaces to the caller as a JSON-RPC error and the per-test
+     * fixture short-circuits.
      */
     readonly reset_state?: (db: Db) => Promise<void> | void;
 }

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsJjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;CAkBA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAwJjB,CAAC"}