@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -179,6 +182,11 @@ export const testing_reset_action_spec = {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export const testing_drain_effects_action_spec = {
@@ -188,7 +196,13 @@ export const testing_drain_effects_action_spec = {
     auth: TESTING_ACTION_AUTH,
     side_effects: false,
     input: z.void(),
-    output: z.strictObject({ ok: z.boolean() }),
+    output: z.strictObject({
+        ok: z.boolean(),
+        tracked: z.boolean().meta({
+            description: "Whether the backend's audit emitter tracks in-flight writes — false means the drain " +
+                'waited on nothing and is no barrier.'
+        })
+    }),
     async: true,
     description: 'Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.'
 };
@@ -250,13 +264,14 @@ export const testing_mint_session_action_spec = {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
 export const create_testing_drain_effects_action = (audit) => rpc_action(testing_drain_effects_action_spec, async () => {
     await audit.drain_inflight();
-    return { ok: true };
+    return { ok: true, tracked: audit.is_tracking_inflight() };
 });
 /**
  * `_testing_put_fact` — seed an **embedded** fact (`fact.bytes`) for the
@@ -613,8 +628,18 @@ export const create_testing_actions = (deps, options) => {
     const log = deps.log;
     return [
         rpc_action(testing_reset_action_spec, async (input, ctx) => {
-            log.info('[_testing_reset] resetting auth state + re-seeding keeper');
-            // 1. Wipe every auth-namespace row. No keeper-preserve filter —
+            log.info('[_testing_reset] resetting domain + auth state + re-seeding keeper');
+            // 1. Fire domain-state reset (zzz workspaces/terminals/scratch,
+            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
+            //    fact wipe) first: domain rows depend on auth rows, so a domain
+            //    table with a restricting FK to `actor` would make the auth wipe
+            //    below fail once it holds a row.
+            //    Pass the transactional `ctx.db` so DB-domain truncation runs
+            //    on the same connection — a separate pool connection deadlocks
+            //    against this open transaction under the in-memory drivers.
+            if (reset_state)
+                await reset_state(ctx.db);
+            // 2. Wipe every auth-namespace row. No keeper-preserve filter —
             //    the fresh-keeper-per-test contract means mutation-cascade
             //    tests (password change, revoke-all) and hardcoded-username
             //    signup-uniqueness tests can't leak between cases.
@@ -631,13 +656,13 @@ export const create_testing_actions = (deps, options) => {
             await ctx.db.query('DELETE FROM role_grant');
             await ctx.db.query('DELETE FROM actor');
             await ctx.db.query('DELETE FROM account');
-            // 2. Reset singleton `app_settings` to production defaults
+            // 3. Reset singleton `app_settings` to production defaults
             //    (matches in-process `_build_test_backend` behavior in
             //    `app_server.ts`). Tests that flipped `open_signup` mid-run
             //    revert.
             await ctx.db.query('UPDATE app_settings SET open_signup = false, updated_at = NULL, updated_by = NULL ' +
                 'WHERE open_signup = true OR updated_at IS NOT NULL');
-            // 3. Flip `bootstrap_lock` to its post-bootstrap shape. Production
+            // 4. Flip `bootstrap_lock` to its post-bootstrap shape. Production
             //    `bootstrap_account` flips this to `true` on success; the
             //    in-process `bootstrap_test_keeper` mirrors the flip. We're
             //    about to seed the keeper here, so the final state needs to
@@ -645,7 +670,7 @@ export const create_testing_actions = (deps, options) => {
             //    to `false` — nothing reads it between our DELETEs and the
             //    UPDATE.
             await ctx.db.query('UPDATE bootstrap_lock SET bootstrapped = true WHERE id = 1');
-            // 4. Seed the fresh keeper inline. Reuses the same primitive
+            // 5. Seed the fresh keeper inline. Reuses the same primitive
             //    in-process tests use (`create_test_account_with_credentials`)
             //    so cross-process and in-process write semantics stay in
             //    parity — same hash, same account+actor+role_grants+
@@ -662,7 +687,19 @@ export const create_testing_actions = (deps, options) => {
                 password_value: DEFAULT_TEST_PASSWORD,
                 roles: [ROLE_KEEPER, ROLE_ADMIN, ...(input.extra_keeper_roles ?? [])]
             });
-            // 5. Seed any caller-requested extras. These are bootstrap-time
+            // 6. Refresh the daemon-token cache so subsequent daemon-token
+            //    requests resolve to the freshly seeded keeper. The
+            //    middleware's lazy-refresh path only fires when the cached
+            //    id is null, so the reset sets it — after the commit, queued as
+            //    soon as the keeper exists, so a reset that rolls back after it
+            //    (a failing extra seed, a failed COMMIT) leaves the cache on the
+            //    keeper still in the database rather than one that never
+            //    landed, and the next reset can still authenticate.
+            const keeper_account_id = keeper.account.id;
+            emit_after_commit(ctx, () => {
+                daemon_token_state.keeper_account_id = keeper_account_id;
+            });
+            // 7. Seed any caller-requested extras. These are bootstrap-time
             //    secondaries — the bypass exists in the same cradle the
             //    keeper does, not as a free-form runtime action.
             const extras = [];
@@ -678,7 +715,7 @@ export const create_testing_actions = (deps, options) => {
                 });
                 extras.push(seeded);
             }
-            // 5b. Seed any additional keeper actors. Same bootstrap-cradle
+            // 8. Seed any additional keeper actors. Same bootstrap-cradle
             //    bypass as extra_accounts — no production wire path mints a
             //    second actor, so the multi-actor `acting` branches need this
             //    direct insert. Order-preserving so the fixture can address
@@ -691,26 +728,6 @@ export const create_testing_actions = (deps, options) => {
                 const seeded_actor = await create_test_extra_actor(ctx.db, keeper.account.id, name);
                 extra_actors.push({ id: seeded_actor.id, name: seeded_actor.name });
             }
-            // 6. Refresh the daemon-token cache so subsequent daemon-token
-            //    requests resolve to the freshly seeded keeper. The
-            //    middleware's lazy-refresh path only fires when the cached
-            //    id is null, so the reset sets it — after the commit, so a
-            //    reset that rolls back (a throwing `reset_state`, a failed
-            //    COMMIT) leaves the cache on the keeper still in the database
-            //    rather than one that never landed, and the next reset can
-            //    still authenticate.
-            const keeper_account_id = keeper.account.id;
-            emit_after_commit(ctx, () => {
-                daemon_token_state.keeper_account_id = keeper_account_id;
-            });
-            // 7. Fire domain-state reset (zzz workspaces/terminals/scratch,
-            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
-            //    fact wipe).
-            //    Pass the transactional `ctx.db` so DB-domain truncation runs
-            //    on the same connection — a separate pool connection deadlocks
-            //    against this open transaction under the in-memory drivers.
-            if (reset_state)
-                await reset_state(ctx.db);
             return { ...keeper, extra_accounts: extras, extra_actors };
         }),
         rpc_action(testing_mint_session_action_spec, async (input, ctx) => {

package/dist/testing/cross_backend/transport_composition.js

@@ -60,9 +60,9 @@ import '../assert_dev_env.js';
  * **Multi-actor upgrade.** One more WS row needs a keeper seeded with a
  * second actor (`extra_actors`), so it runs only given `multi_actor`: a
  * multi-actor keeper's session upgrading with no `?acting=` → 400
- * `actor_required`, the flat body the TS spine's upgrade-time authorization
- * phase answers. The upgrade resolves an actor there, and a multi-actor
- * account must name one. A backend whose upgrade resolves no actor admits
+ * `actor_required`, the flat body both spines' upgrade-time actor resolution
+ * answers. The upgrade resolves an actor there, and a multi-actor account
+ * must name one. A backend whose upgrade resolves no actor admits
  * the socket instead; `multi_actor.xfail` runs the row as `xfail_until` for
  * it.
  *

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4EzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAqCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgFzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAqCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,7 +1,7 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { action_rate_limit_env, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_SSE_PATH, TS_SPINE_DIR_ENV } from './spine_surface_constants.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_SSE_PATH, TESTING_BACKDOOR_METHODS, TS_SPINE_DIR_ENV } from './spine_surface_constants.js';
 /**
  * Capabilities for the TS spine binary — `ts_default_capabilities` with every `MountFlag` stated, all `true`: `ws`
  * (the binary mounts `/api/ws` through `create_app_server`'s `ws_endpoints`),
@@ -16,7 +16,9 @@ import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_SSE_PATH, TS_SPINE_DIR_ENV } from '
  * the account actions among them),
  * `cell_gated_create` (the binary's `full_spine_mount` mounts the
  * `test_cell_gated_create_authorize` policy), and `ws_role_gated` (the binary
- * mounts the role-gated WS endpoint at `SPINE_ROLE_GATED_WS_PATH`). The Node
+ * mounts the role-gated WS endpoint at `SPINE_ROLE_GATED_WS_PATH`), and every
+ * `TESTING_BACKDOOR_METHODS` entry as `testing_backdoors` (`full_spine_mount`
+ * mounts them all, on `/api/rpc` and `/api/ws`). The Node
  * binary's preset; `ws_refusal_body` stays `false`, as `@hono/node-ws` drops a
  * refused upgrade's body.
  */
@@ -32,7 +34,8 @@ const ts_spine_capabilities = Object.freeze({
     peer_request: true,
     ws_account_actions: true,
     cell_gated_create: true,
-    ws_role_gated: true
+    ws_role_gated: true,
+    testing_backdoors: TESTING_BACKDOOR_METHODS
 });
 /**
  * Capabilities for the **Deno** spine binary — `ts_spine_capabilities` with

package/dist/testing/rpc_attack_surface.d.ts

@@ -6,6 +6,16 @@ export interface RpcAttackSurfaceOptions {
     build: () => AppSurfaceSpec;
     /** All roles in the app (e.g. `['admin', 'keeper']`). */
     roles: Array<string>;
+    /**
+     * Valid params per method (method name → params) to build its adversarial
+     * params cases from, in place of the generated base — for an input whose
+     * valid shape the generator can't reach. Each must pass the method's input
+     * schema; one that doesn't throws at collection, naming the method. The
+     * cases are sent as a single-actor principal, so an override omits
+     * `acting`. The cross-process twin is
+     * `RpcAdversarialCrossTestOptions.input_overrides`.
+     */
+    input_overrides?: ReadonlyMap<string, Record<string, unknown>>;
 }
 /**
  * Run the standard RPC attack surface test suite.

package/dist/testing/rpc_attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAGX,cAAc,EACd,MAAM,oBAAoB,CAAC;AA8B5B,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AA2UD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}
+{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAGX,cAAc,EACd,MAAM,oBAAoB,CAAC;AA+B5B,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA2VD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}

package/dist/testing/rpc_attack_surface.js

@@ -19,6 +19,7 @@ import { create_auth_test_apps, create_test_app_from_specs, create_test_request_
 import { generate_valid_body } from './schema_generators.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response } from './rpc_helpers.js';
 import { assert_rpc_envelope_refusal, create_rpc_envelope_cases, generate_rpc_params_test_cases, to_rpc_envelope_request } from './rpc_envelope_cases.js';
+import { expected_invalid_reason } from './adversarial_input_cases.js';
 // --- Helpers ---
 /** Filter RPC methods that require any form of authentication. */
 const filter_protected_rpc_methods = (endpoint) => endpoint.methods.filter((m) => !is_public_auth(m.auth));
@@ -201,8 +202,10 @@ const describe_rpc_adversarial_envelopes = (options) => {
  *
  * For each method with a non-null input schema, generates test cases
  * from the schema (wrong types, missing fields, format violations)
- * and wraps them in valid JSON-RPC envelopes. Reuses
- * `generate_input_test_cases` from `testing/adversarial_input.ts`.
+ * and wraps them in valid JSON-RPC envelopes, via `generate_rpc_params_test_cases`;
+ * a method's `input_overrides` entry, when given, is the base they're built from.
+ * Each owes 400 `invalid_params` with the broken field's declared
+ * `invalid_reason` as `data.reason`, or no reason (`expected_invalid_reason`).
  */
 const describe_rpc_adversarial_params = (options) => {
     const { build, roles } = options;
@@ -226,7 +229,10 @@ const describe_rpc_adversarial_params = (options) => {
                         });
                         continue;
                     }
-                    const test_cases = generate_rpc_params_test_cases(action.spec.input);
+                    const test_cases = generate_rpc_params_test_cases(action.spec.input, {
+                        base: options.input_overrides?.get(method.name),
+                        label: method.name
+                    });
                     if (test_cases.length === 0)
                         continue;
                     total_cases += test_cases.length;
@@ -238,6 +244,12 @@ const describe_rpc_adversarial_params = (options) => {
                                 assert.strictEqual(res.status, 400, `Expected 400 for ${method.name} [${tc.label}], got ${res.status}`);
                                 const body = await res.json();
                                 assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.invalid_params);
+                                // the broken field's declared reason, or none
+                                const data = body.error.data;
+                                const reason = typeof data === 'object' && data !== null
+                                    ? data.reason
+                                    : undefined;
+                                assert.strictEqual(reason, expected_invalid_reason(action.spec.input, tc), `data.reason for ${method.name} [${tc.label}]`);
                             });
                         }
                     });

package/dist/testing/rpc_envelope_cases.d.ts

@@ -2,7 +2,7 @@ import './assert_dev_env.js';
 import type { z } from 'zod';
 import type { AppSurfaceRpcEndpoint, AppSurfaceRpcMethod } from '../http/surface.js';
 import type { JsonrpcErrorCode, JsonrpcRequestId } from '../http/jsonrpc.js';
-import { type InputTestCase } from './adversarial_input_cases.js';
+import { type InputTestCase, type InputTestCaseOptions } from './adversarial_input_cases.js';
 /** The request id every envelope case sends where it sends one. */
 export declare const RPC_ENVELOPE_PROBE_ID = "envelope_probe";
 /**
@@ -105,7 +105,10 @@ export declare const assert_rpc_envelope_refusal: (status: number, body: unknown
  * cover it. Every case returned owes 400 `invalid_params`.
  *
  * @param input - the method's input schema
+ * @param options - a valid base `params` to seed the cases (`InputTestCaseOptions.base`),
+ *   and the method name for error messages
  * @returns the cases, each a `params` object
+ * @throws Error if the base `params`, seeded or generated, fails the input schema
  */
-export declare const generate_rpc_params_test_cases: (input: z.ZodType) => Array<InputTestCase>;
+export declare const generate_rpc_params_test_cases: (input: z.ZodType, options?: InputTestCaseOptions) => Array<InputTestCase>;
 //# sourceMappingURL=rpc_envelope_cases.d.ts.map

package/dist/testing/rpc_envelope_cases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_envelope_cases.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_envelope_cases.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK7E,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAI7F,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EACb;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,mFAAmF;QACnF,QAAQ,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACrC,mEAAmE;QACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACtC,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAEzF,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,GAAI,QAAQ,MAAM,KAAG,MACL,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,GACrC,UAAU,qBAAqB,EAC/B,UAAS,sBAA2B,KAClC,KAAK,CAAC,eAAe,CAmKvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,eAAe,MAAM,EACrB,GAAG,eAAe,EAClB,UAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAClC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAUgD,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,MAAM,EACd,MAAM,OAAO,EACb,GAAG,eAAe,KAChB,IAUF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAAI,OAAO,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CACU,CAAC"}
+{"version":3,"file":"rpc_envelope_cases.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_envelope_cases.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK7E,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,MAAM,8BAA8B,CAAC;AAItC,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EACb;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,mFAAmF;QACnF,QAAQ,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACrC,mEAAmE;QACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACtC,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAEzF,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,GAAI,QAAQ,MAAM,KAAG,MACL,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,GACrC,UAAU,qBAAqB,EAC/B,UAAS,sBAA2B,KAClC,KAAK,CAAC,eAAe,CAmKvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,eAAe,MAAM,EACrB,GAAG,eAAe,EAClB,UAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAClC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAUgD,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,MAAM,EACd,MAAM,OAAO,EACb,GAAG,eAAe,KAChB,IAUF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,CAAC,CAAC,OAAO,EAChB,UAAU,oBAAoB,KAC5B,KAAK,CAAC,aAAa,CAGpB,CAAC"}

package/dist/testing/rpc_envelope_cases.js

@@ -235,6 +235,9 @@ export const assert_rpc_envelope_refusal = (status, body, c) => {
  * cover it. Every case returned owes 400 `invalid_params`.
  *
  * @param input - the method's input schema
+ * @param options - a valid base `params` to seed the cases (`InputTestCaseOptions.base`),
+ *   and the method name for error messages
  * @returns the cases, each a `params` object
+ * @throws Error if the base `params`, seeded or generated, fails the input schema
  */
-export const generate_rpc_params_test_cases = (input) => generate_input_test_cases(input).filter((tc) => tc.expected_error !== ERROR_INVALID_JSON_BODY);
+export const generate_rpc_params_test_cases = (input, options) => generate_input_test_cases(input, options).filter((tc) => tc.expected_error !== ERROR_INVALID_JSON_BODY);

package/dist/testing/rpc_round_trip.js

@@ -28,7 +28,7 @@ import './assert_dev_env.js';
 import { describe, test, beforeAll, assert } from 'vitest';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
 import { JSONRPC_INTERNAL_ERROR, JSONRPC_METHOD_NOT_FOUND, JsonrpcErrorResponse } from '../http/jsonrpc.js';
-import { JSONRPC_ERROR_CODE_TO_HTTP_STATUS } from '../http/jsonrpc_errors.js';
+import { jsonrpc_error_code_to_http_status } from '../http/jsonrpc_errors.js';
 import { generate_valid_body } from './schema_generators.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, assert_jsonrpc_success_response, resolve_rpc_endpoints_for_setup, find_rpc_action, find_rpc_method } from './rpc_helpers.js';
 import { is_unauthenticated_refusal, pick_auth_principal, round_trip_uses_fresh_account, to_principal_headers } from './integration_helpers.js';
@@ -112,7 +112,7 @@ const read_rpc_body = async (res) => {
     }
 };
 /** The HTTP status an `internal_error` maps to, read off the shared status table. */
-const INTERNAL_ERROR_HTTP_STATUS = JSONRPC_ERROR_CODE_TO_HTTP_STATUS[JSONRPC_INTERNAL_ERROR];
+const INTERNAL_ERROR_HTTP_STATUS = jsonrpc_error_code_to_http_status(JSONRPC_INTERNAL_ERROR);
 /**
  * Guard against a backend that crashes on schema-valid input. A response is
  * a crash when any of these holds:
@@ -125,7 +125,7 @@ const INTERNAL_ERROR_HTTP_STATUS = JSONRPC_ERROR_CODE_TO_HTTP_STATUS[JSONRPC_INT
  *
  * Any other ≥500 that carries a well-formed envelope with a declared code
  * passes like a 4xx: `service_unavailable` (503), `timeout` (504), or a
- * consumer's own code mapped in `JSONRPC_ERROR_CODE_TO_HTTP_STATUS` (a 502).
+ * consumer's own code declared with `register_jsonrpc_error_code` (a 502).
  * Those are server conditions a handler declares on purpose — a dependency
  * the test environment doesn't provide — while an undeclared 500 or -32603
  * is a handler that failed where it owed an answer.

package/dist/testing/schema_generators.d.ts

@@ -11,12 +11,109 @@ import './assert_dev_env.js';
 import { z } from 'zod';
 import { type ZodFieldInfo } from '../zod.js';
 /**
- * Detect format constraints on a field by converting to JSON Schema.
- * Returns format string (e.g. 'uuid', 'email') or null.
+ * The JSON Schema of a field's input side — where its format, pattern and
+ * bounds live — or `null` when JSON Schema can't render the field or any part
+ * of it (`z.date()`, `z.custom()`, a union with a `z.date()` branch).
+ *
+ * Rendered with `io: 'input'`, so a field carrying a `.transform()` or a pipe
+ * (`Username`) still yields the constraints its input is checked against;
+ * the default output side throws on a transform. A pipe yields its input
+ * side only, so constraints of the stage after it are not here. A
+ * `.nullable()` / `.nullish()` field renders as
+ * `anyOf: [{…}, {type: 'null'}]`; its one non-null branch is returned, so
+ * the bounds and pattern read the same as on the bare field. A union of two
+ * or more non-null branches returns the whole schema — its branches' bounds
+ * are no single field's bounds.
+ *
+ * A `.refine()` is never here: JSON Schema can't express one, so a bound a
+ * refinement enforces (a code-point length, a cross-field rule) generates no
+ * boundary case.
+ *
+ * @param field_schema - the field to read
+ * @returns the field's input-side JSON Schema, or `null` when it can't be rendered
+ */
+export declare const to_field_json_schema: (field_schema: z.ZodType) => Record<string, unknown> | null;
+/**
+ * The format constraint a field's input-side JSON Schema carries: its
+ * `format` (e.g. `'uuid'`, `'email'`), `'pattern'` for a regex, or `null`.
+ * A union (`anyOf` of several non-null branches) answers its first branch
+ * carrying one — a value violating every branch is what the caller needs,
+ * and the generators check the field refuses the candidate.
+ *
+ * @param json - a field's JSON Schema, as `to_field_json_schema` returns it
+ * @returns the format, `'pattern'`, or `null`
+ */
+export declare const detect_json_schema_format: (json: Record<string, unknown>) => string | null;
+/**
+ * Detect format constraints on a field from its input-side JSON Schema
+ * (`to_field_json_schema`). Returns the format string (e.g. `'uuid'`,
+ * `'email'`), `'pattern'` for a regex, or `null`.
  */
 export declare const detect_format: (field_schema: z.ZodType) => string | null;
 /** Generate a valid-ish value for a field based on its base type. */
 export declare const generate_valid_value: (field: ZodFieldInfo, field_schema: z.ZodType) => unknown;
+/**
+ * Generate a valid object for an object schema: its required and defaulted
+ * fields first; when `schema` still refuses it, each optional field alone on
+ * top of those, in declaration order, taking the first that parses; and
+ * failing that, the optional fields added one at a time, in declaration
+ * order, until it parses. The fill covers a `.refine()` over optional fields
+ * (at least one of, exactly one of, both of), which the required-only object
+ * can't satisfy, and the single-field pass keeps an unrelated optional field
+ * declared ahead of the refined ones (an `acting`, a note) out of the object.
+ *
+ * Shared by the top-level body generators and `generate_valid_value`'s
+ * nested-object case, so a refined object validates the same way at any depth.
+ *
+ * @param object_schema - the unwrapped object whose fields are generated
+ * @param schema - the schema the object must satisfy, refinements included
+ *   (`object_schema` or a schema wrapping it)
+ * @returns the generated object and its last `safeParse` result — the caller
+ *   decides whether a failure throws
+ */
+export declare const generate_valid_object: (object_schema: z.ZodObject, schema: z.ZodType) => {
+    value: Record<string, unknown>;
+    result: z.ZodSafeParseResult<unknown>;
+};
+/**
+ * A valid object that carries `field`, built from `base`, a valid object of
+ * `object_schema` — the body a case breaking `field` changes, so the case
+ * breaks that field and nothing else. `base` itself when it carries the
+ * field. Otherwise the field takes a generated value and joins `base`, with
+ * the optional fields `base` omits filled as `generate_valid_object` fills
+ * them (a pair rule: adding `scope_kind` needs `scope_id`); failing that, it
+ * replaces `base`'s optional fields, refilled the same way around it (an
+ * exactly-one-of rule: adding `slug` means dropping `id`).
+ *
+ * @param object_schema - the unwrapped object `base` is an instance of
+ * @param schema - the schema the object must satisfy, refinements included
+ * @param base - a valid object, the generated or seeded base
+ * @param field - the field the object must carry
+ * @returns the object, or `null` when no object the generator can build
+ *   carries the field and passes `schema`
+ */
+export declare const generate_valid_object_with_field: (object_schema: z.ZodObject, schema: z.ZodType, base: Record<string, unknown>, field: ZodFieldInfo) => Record<string, unknown> | null;
+/**
+ * A string a URL-sourced field accepts — a route param or a query value, which
+ * arrive as strings whatever the schema parses them into. The nil UUID for a
+ * UUID field; else the first the field accepts of `test_value`, the generated
+ * valid value written as a string, `1`, `0`, `true` and `false`, the field's
+ * JSON Schema `default` or lower bound written as a string (a preprocessed
+ * integer whose minimum is above one), and a string synthesized from the
+ * field's constraints.
+ *
+ * @param field - the field's info, from `zod_extract_fields`
+ * @param field_schema - the field's schema
+ * @returns the string, or `null` when no candidate passes
+ */
+export declare const generate_valid_string_param: (field: ZodFieldInfo, field_schema: z.ZodType) => string | null;
+/**
+ * Format Zod issues as `path: message` pairs for a generator's error message.
+ *
+ * @param error - the failed parse's error
+ * @returns the issues, comma-separated
+ */
+export declare const format_zod_issues: (error: z.ZodError) => string;
 /**
  * The `Content-Type` a well-formed request to a route sends: `application/json`,
  * or `application/octet-stream` for a `raw_body` route. Every `POST` route

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,WAAW,CAAC;AAInB;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OA8GnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MACL,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAcxF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,GAAG,IAWlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAGhE,CAAC;AAqHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAkGnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,eAAe,CAAC,CAAC,SAAS,EAC1B,QAAQ,CAAC,CAAC,OAAO,KACf;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;CASzE,CAAC;AAsCF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,eAAe,CAAC,CAAC,SAAS,EAC1B,QAAQ,CAAC,CAAC,OAAO,EACjB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,YAAY,KACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IA0B5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACvC,OAAO,YAAY,EACnB,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,GAAG,IA6BX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,CAAC,CAAC,QAAQ,KAAG,MACkB,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MACL,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAY5B,CAAC"}