@fuzdev/fuz_app 0.88.0 → 0.89.0

package/dist/auth/account_route_schema.d.ts

@@ -84,10 +84,16 @@ export declare const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export declare const DEFAULT_MAX_TOKENS = 10;
 /**
- * The `GET /api/account/status` route shape minus its handler — pure
- * hono-free data. `create_account_status_route_spec` spreads this and
- * attaches the live handler (which reads the account id off the request
- * context); surface generation spreads it with a stub handler.
+ * The `GET /status` route shape minus its handler — pure hono-free data.
+ * `create_account_status_route_spec` spreads this and attaches the live handler
+ * (which reads the account id off the request context); surface generation
+ * spreads it with a stub handler.
+ *
+ * The path is **relative** like the sibling account shapes (`/login`,
+ * `/verify`), so it composes under `prefix_route_specs('/api/account', …)` into
+ * `/api/account/status`. `create_account_route_specs` bundles it (so every
+ * account surface serves `/status`, matching the Rust `account_router`);
+ * mirror Rust by mounting it as part of the account family, not separately.
  */
 export declare const account_status_route_shape: {
     method: "GET";

package/dist/auth/account_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}
+{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}

package/dist/auth/account_route_schema.js

@@ -61,14 +61,20 @@ export const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export const DEFAULT_MAX_TOKENS = 10;
 /**
- * The `GET /api/account/status` route shape minus its handler — pure
- * hono-free data. `create_account_status_route_spec` spreads this and
- * attaches the live handler (which reads the account id off the request
- * context); surface generation spreads it with a stub handler.
+ * The `GET /status` route shape minus its handler — pure hono-free data.
+ * `create_account_status_route_spec` spreads this and attaches the live handler
+ * (which reads the account id off the request context); surface generation
+ * spreads it with a stub handler.
+ *
+ * The path is **relative** like the sibling account shapes (`/login`,
+ * `/verify`), so it composes under `prefix_route_specs('/api/account', …)` into
+ * `/api/account/status`. `create_account_route_specs` bundles it (so every
+ * account surface serves `/status`, matching the Rust `account_router`);
+ * mirror Rust by mounting it as part of the account family, not separately.
  */
 export const account_status_route_shape = {
     method: 'GET',
-    path: '/api/account/status',
+    path: '/status',
     auth: { account: 'none', actor: 'none' },
     description: 'Current account info (unauthenticated: 401 with bootstrap status)',
     input: AccountStatusInput,

package/dist/auth/account_routes.d.ts

@@ -107,16 +107,30 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
      * `audit.on_event_chain`) runs.
      */
     connection_closer?: ConnectionCloser | null;
+    /**
+     * Runtime bootstrap status for the bundled `GET /status` route — when
+     * `available`, its unauthenticated 401 carries `bootstrap_available: true`
+     * so a fresh frontend can route to the bootstrap flow. Pass
+     * `ctx.bootstrap_status` (the live `BootstrapStatus` ref) so the flag tracks
+     * the one-shot bootstrap completing. Omit when no bootstrap flow is wired —
+     * `/status` is still served, just without the flag.
+     */
+    bootstrap_status?: {
+        available: boolean;
+    };
 }
 /**
  * Create account route specs for session-based auth.
  *
- * The returned specs cover the three flows that stay REST after the RPC
- * migration (login, logout, password change). Self-service session/token
- * management and verify are on `auth/account_actions.ts`.
+ * The returned specs cover the REST flows that stay after the RPC migration:
+ * `/status` (account info + bootstrap availability), `/verify` (nginx
+ * `auth_request` shim), `/login`, `/logout`, `/password`. `/status` is bundled
+ * here (relative path, prefixed to `/api/account/status` by the caller) so
+ * every account surface serves it, matching the Rust `account_router`.
+ * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter)
+ * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export declare const create_account_route_specs: (deps: RouteFactoryDeps, options: AccountRouteOptions) => Array<RouteSpec>;

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AA4BxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAkRjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AA4BxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAwRjB,CAAC"}

package/dist/auth/account_routes.js

@@ -147,21 +147,29 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
 /**
  * Create account route specs for session-based auth.
  *
- * The returned specs cover the three flows that stay REST after the RPC
- * migration (login, logout, password change). Self-service session/token
- * management and verify are on `auth/account_actions.ts`.
+ * The returned specs cover the REST flows that stay after the RPC migration:
+ * `/status` (account info + bootstrap availability), `/verify` (nginx
+ * `auth_request` shim), `/login`, `/logout`, `/password`. `/status` is bundled
+ * here (relative path, prefixed to `/api/account/status` by the caller) so
+ * every account surface serves it, matching the Rust `account_router`.
+ * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter)
+ * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export const create_account_route_specs = (deps, options) => {
     const { keyring, password } = deps;
-    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, } = options;
+    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status, } = options;
     const [verify_shape, login_shape, logout_shape, password_shape] = create_account_route_shapes({
         login_account_rate_limited: login_account_rate_limiter !== null,
     });
     return [
+        // `/status` is bundled into the account family (relative path, prefixed
+        // to `/api/account/status` by the caller) so every account surface serves
+        // it — matching the Rust `account_router`. The standalone
+        // `create_account_status_route_spec` stays the building block.
+        create_account_status_route_spec({ bootstrap_status }),
         {
             ...verify_shape,
             handler: (c) => {

package/dist/testing/CLAUDE.md

@@ -858,7 +858,7 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (`bearer_auth` / `trusted_proxy` / `login_rate_limit` / `ws` / `sse` /
   `cell_crud` / `cell_relations` / `account_lifecycle` / `fact_serving` /
-  `ready`),
+  `ready` / `account_status` / `oversized_reject_closes_connection`),
   `test_if(cond, name, fn)`
   for capability-gated cases, and `in_process_capabilities` preset. `cell_crud`
   gates the CRUD parity suite, `cell_relations` the relation / ACL / audit
@@ -875,6 +875,14 @@ source of truth for wire-shape conformance.
   (anonymous `GET /ready` → `200 {ready: true}` on a clean spine bootstrap);
   like cells/sse the `/ready` deploy gate stays off the declared surface, `true`
   on every spine that live-mounts it over the shared `expected_schema.json`.
+  `account_status` gates the integration suite's `account status response body`
+  case — `GET /api/account/status` is bundled into `create_account_route_specs`,
+  so every spine serves it (`true`); the gate fails loud if a declaring backend
+  doesn't mount it (replacing the old runtime 404-sniff-skip).
+  `oversized_reject_closes_connection` gates the strong half of the body-size
+  smuggling probe (`true` Node/Deno/Rust — they close on an oversized reject;
+  `false` Bun — `Bun.serve` drains + keepalives but frames correctly, so the
+  suite's no-desync half still runs).
 
 ### `cross_backend/standard.ts` — `describe_standard_cross_process_tests`
 

package/dist/testing/cross_backend/body_size_smuggling.d.ts

@@ -5,6 +5,18 @@ export interface BodySizeSmugglingCrossTestOptions {
     readonly base_url: string;
     /** RPC endpoint path to target. Default `/api/rpc`. */
     readonly rpc_path?: string;
+    /**
+     * Whether the backend closes the connection on an oversized-body reject
+     * without reading the body (`capabilities.oversized_reject_closes_connection`).
+     * `true` (default) demands the strong posture — the pipelined GET is never
+     * reached, so **at most one** response comes back. `false` (Bun) relaxes to
+     * the no-desync property: the body is drained on `Content-Length` and the
+     * pipelined GET is framed correctly, so **at most two** responses come back
+     * and the body bytes are never reparsed as a request. Default `true` so a
+     * consumer that forgets to declare the flag fails loud rather than silently
+     * accepting a drain.
+     */
+    readonly closes_connection?: boolean;
 }
 export declare const describe_body_size_smuggling_cross_tests: (options: BodySizeSmugglingCrossTestOptions) => void;
 //# sourceMappingURL=body_size_smuggling.d.ts.map

package/dist/testing/cross_backend/body_size_smuggling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAqDD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4DF,CAAC"}
+{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0D9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAqDD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAiFF,CAAC"}

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -4,37 +4,45 @@ import '../assert_dev_env.js';
  * handling — the security sibling of `body_size.ts`.
  *
  * When the server caps the request body it answers `413` on the
- * `Content-Length` header and closes the connection *without reading the
- * oversized body*. That close is load-bearing: HTTP/1.1 forbids reusing a
- * keep-alive connection whose request body wasn't consumed, because the unread
- * body bytes would otherwise be parsed as the start of the next request — a
- * classic request-smuggling vector. This suite proves the mitigation holds end
- * to end by **pipelining**: it opens a raw TCP socket and sends, in one write,
- * an oversized `POST` immediately followed by a second `GET` request. A correct
- * server rejects the POST with `413` and never processes the trailing GET (the
- * connection closes with the GET bytes unconsumed); a vulnerable one would
- * drain past the body and answer the smuggled GET too. The assertion is
- * therefore "**at most one** HTTP response comes back" — a *second* response is
- * the smuggle. It's `<= 1` rather than "exactly the 413" because the impls close
- * differently at the TCP level (node-server graceful close delivers the 413
- * first; hyper's RST can drop the in-flight 413 before the client reads it), so
- * demanding a cleanly-read 413 would be flaky; the 413-ness itself is pinned
- * reliably over `fetch` by `describe_body_size_cross_tests`. A **positive
- * control** (two pipelined requests → >= 2 responses) proves a second response
- * *would* be seen if the trailing request were processed — without it the
- * `<= 1` assertion would be vacuous on a server that never reuses connections,
- * and it also proves the response counter isn't undercounting.
+ * `Content-Length` header. The strong (defense-in-depth) posture is to close
+ * the connection *without reading the oversized body*: HTTP/1.1 forbids reusing
+ * a keep-alive connection whose request body wasn't consumed, because unread
+ * body bytes would be parsed as the start of the next request — a classic
+ * request-smuggling vector. This suite probes the boundary by **pipelining**:
+ * it opens a raw TCP socket and sends, in one write, an oversized `POST`
+ * immediately followed by a second `GET`. The assertion forks on the backend's
+ * declared `oversized_reject_closes_connection` capability:
+ *
+ * - **Closes (Node / Deno / hyper)** — the reject closes the socket with the
+ *   GET bytes unconsumed, so **at most one** response comes back. `<= 1` rather
+ *   than "exactly the 413" because the impls close differently at the TCP level
+ *   (node-server graceful close delivers the 413 first; hyper's RST can drop the
+ *   in-flight 413 before the client reads it), so demanding a cleanly-read 413
+ *   would be flaky.
+ * - **Drains + keepalives (Bun)** — `Bun.serve` reads the full declared
+ *   `Content-Length` body and answers the *correctly-framed* pipelined GET, so
+ *   **two** responses come back. This is **not** a smuggle: the GET is delimited
+ *   by the body's `Content-Length`, not the unread body reinterpreted as a
+ *   request — Bun answers it with a clean `400` (`missing method`), not the `x`
+ *   body bytes reparsed. The security property asserted here is **no desync**
+ *   (`<= 2`): a real desync would reframe the 1 MiB of `x` into bogus request
+ *   lines and push the count past two.
+ *
+ * Either way the oversized body is rejected *with* a 413 — pinned reliably over
+ * `fetch` by `describe_body_size_cross_tests`; this test owns only the
+ * connection-handling half. A **positive control** (two pipelined requests →
+ * `>= 2` responses) proves a second response *would* be seen if a trailing
+ * request were processed — without it the close-posture `<= 1` would be vacuous
+ * on a server that never reuses connections — and that the counter isn't
+ * undercounting.
  *
  * Raw-socket by necessity (the `FetchTransport` can't pipeline two requests on
  * one connection), so — unlike `body_size.ts` — this is **cross-process only**
- * (no in-process leg; there is no socket in-process) and ungated (the limit is
- * on every spine). Robust by construction: it counts responses until the
- * socket closes or a short read timeout, so a server that closes (the expected
- * path) and one that merely holds the connection open without smuggling both
- * read as one response; only an actual second response fails.
+ * (no in-process leg; there is no socket in-process). The connection-close half
+ * is capability-gated; the no-desync half holds on every spine.
  *
- * Cited property: `docs/security.md` §"Body Size Limiting" (connection close on
- * oversized reject).
+ * Cited property: `docs/security.md` §"Body Size Limiting" (connection handling
+ * on oversized reject).
  *
  * `$lib`-free by contract (relative + `node:` specifiers only).
  *
@@ -90,6 +98,7 @@ const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).lengt
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const closes_connection = options.closes_connection ?? true;
     const host = new URL(base_url).host;
     describe('body-size limit — request-smuggling resistance', () => {
         // Positive control: prove the server returns >1 response on a single
@@ -118,21 +127,39 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 'x'.repeat(oversized_len) +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
             const response = await send_raw(base_url, payload, 2000);
-            // The security property is "the pipelined GET is not processed", i.e.
-            // **at most one** response comes back (the 413, or none if the close
-            // raced the read). A *second* response is the smuggle. We assert `<= 1`
-            // rather than "exactly the 413" because the two impls close the
-            // connection differently at the TCP level — node-server closes
-            // gracefully (the 413 is delivered first), hyper sends an RST that can
-            // drop the in-flight 413 before the client reads it — and demanding a
-            // cleanly-read 413 here would be flaky. That the oversized body is
-            // rejected *with* a 413 is pinned reliably (over `fetch`) by
-            // `describe_body_size_cross_tests`; this test owns only the no-smuggle
-            // half. The control above proves a second response *would* be seen if
-            // the GET were processed, so `<= 1` is a real signal, not a vacuous one.
             const n = count_responses(response);
-            assert.ok(n <= 1, `expected at most one response (the GET must not be smuggled in off the ` +
-                `unread body); a second response means it was. Saw ${n}. Raw head: ${response.slice(0, 120)}`);
+            if (closes_connection) {
+                // Strong posture (Node / Deno / hyper): the reject closes the
+                // connection *without reading the body*, so the pipelined GET is
+                // never reached — **at most one** response comes back (the 413, or
+                // none if the close raced the read). A *second* response would mean
+                // the body was drained and the GET processed. We assert `<= 1` rather
+                // than "exactly the 413" because the impls close differently at the
+                // TCP level — node-server closes gracefully (413 delivered first),
+                // hyper sends an RST that can drop the in-flight 413 before the client
+                // reads it — and demanding a cleanly-read 413 would be flaky. The
+                // 413-ness itself is pinned reliably (over `fetch`) by
+                // `describe_body_size_cross_tests`. The control above proves a second
+                // response *would* be seen if the GET were processed, so `<= 1` is a
+                // real signal, not vacuous.
+                assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
+                    `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
+            }
+            else {
+                // Drain-and-keepalive posture (Bun): `Bun.serve` reads the full
+                // declared `Content-Length` body and keeps the socket alive, so it
+                // answers the *correctly-framed* pipelined GET — **two** responses
+                // (the 413 + a well-formed reply to the GET). This is not a smuggle:
+                // the GET is delimited by the body's `Content-Length`, not the unread
+                // body reinterpreted as request bytes. The security property here is
+                // **no desync** — the body bytes are never reparsed as request(s). A
+                // real desync would reframe the 1 MiB of `x` into bogus request
+                // lines, pushing the count past two; `<= 2` is the no-desync bound,
+                // and the control above proves the counter isn't undercounting.
+                assert.ok(n <= 2, `expected at most two responses (the 413 + one framed reply to the ` +
+                    `pipelined GET); more means the oversized body was reparsed as requests ` +
+                    `(a desync). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
+            }
         });
     });
 };

package/dist/testing/cross_backend/capabilities.d.ts

@@ -99,6 +99,35 @@ export interface BackendCapabilities {
      * readiness parity coverage. The drift → `503` path stays per-impl unit tests.
      */
     readonly ready: boolean;
+    /**
+     * The account surface serves `GET /api/account/status` (account info +
+     * `bootstrap_available` flag). Bundled into `create_account_route_specs`, so
+     * any backend mounting the account routes serves it — `true` for every
+     * spine. Gates the `account status response body` case in
+     * `describe_standard_integration_tests`: when `true` the case asserts the
+     * route is present (fail-loud on 404, no silent skip); when `false` it skips
+     * explicitly (a backend that deliberately omits the route).
+     */
+    readonly account_status: boolean;
+    /**
+     * On an oversized-body `413` reject the backend **closes the connection
+     * without reading the body** (the defense-in-depth posture), rather than
+     * draining the declared `Content-Length` and keeping the socket alive.
+     * Gates the strong half of `describe_body_size_smuggling_cross_tests`: when
+     * `true`, the pipelined GET is never reached (at most one response); when
+     * `false`, the suite instead asserts the weaker but still-load-bearing
+     * no-desync property (the body is framed on `Content-Length`, not reparsed
+     * as request bytes).
+     *
+     * `true` for the Node / Deno (`@hono/node-server` graceful close) and Rust
+     * (hyper RST) backends; `false` for Bun — `Bun.serve` reads the full body
+     * and processes the correctly-framed pipelined request even when the `413`
+     * carries `Connection: close`. Bun is not insecure (no desync — it answers
+     * the cleanly-delimited GET with a proper `400`); the flag records the
+     * connection-handling divergence so the suite stays green without losing the
+     * smuggle detector. See `docs/security.md` §"Body Size Limiting".
+     */
+    readonly oversized_reject_closes_connection: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Every flag

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmB9B;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgC9B;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAapC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -11,6 +11,19 @@ import '../assert_dev_env.js';
  * capability `true` (see `in_process_capabilities`). Cross-process
  * backends opt in per-flag on their `BackendConfig`.
  *
+ * **Where the per-backend declarations live** (this file owns only the
+ * vocabulary + the in-process preset):
+ *
+ * - `in_process_capabilities` — here; every flag `true`.
+ * - `ts_default_capabilities` / `rust_default_capabilities` — consumer-facing
+ *   family defaults, in `default_backend_configs.ts` (full literals, so adding
+ *   a capability is a compile error until each family declares it).
+ * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
+ *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
+ *   default; Bun flips `oversized_reject_closes_connection`).
+ * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
+ *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
+ *
  * @module
  */
 import { test } from 'vitest';
@@ -31,6 +44,8 @@ export const in_process_capabilities = Object.freeze({
     account_lifecycle: true,
     fact_serving: true,
     ready: true,
+    account_status: true,
+    oversized_reject_closes_connection: true,
 });
 /**
  * Conditional `test()` wrapper — registers a vitest case only when

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAapC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAoBpC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -20,6 +20,13 @@ export const ts_default_capabilities = Object.freeze({
     // Off by default like `sse` — a generic TS consumer backend may not mount
     // `/ready`. fuz_app's own spine configs (`ts_spine_*`) opt in.
     ready: false,
+    // `GET /api/account/status` is bundled into `create_account_route_specs`, so
+    // every TS backend mounting account routes serves it.
+    account_status: true,
+    // Node/Deno close the socket on an oversized-body reject (the default
+    // posture). A Bun-served consumer overrides to `false` (see the bun spine
+    // config) — fail-loud rather than silently skipping the smuggle detector.
+    oversized_reject_closes_connection: true,
 });
 /**
  * Capabilities for the Rust family. Adds `trusted_proxy: true` (the
@@ -40,6 +47,12 @@ export const rust_default_capabilities = Object.freeze({
     // Off by default like `sse`; the spine-stub preset opts in (it mounts
     // `/ready` over the env-supplied fixture path).
     ready: false,
+    // The Rust `account_router` bundles `/status` into the account routes, so
+    // every Rust spine serving the account surface serves it.
+    account_status: true,
+    // hyper sends an RST on the oversized-body reject — the connection closes
+    // and the pipelined request is never reached.
+    oversized_reject_closes_connection: true,
 });
 /** Bootstrap block built from the default secrets + supplied paths. */
 const build_default_bootstrap = (paths, overrides) => ({

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAiB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAkB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -80,6 +80,7 @@ export const create_spine_route_specs = (ctx) => [
             ip_rate_limiter: null,
             login_account_rate_limiter: null,
             login_fail_floor_ms: 0,
+            bootstrap_status: ctx.bootstrap_status,
         }),
         ...create_signup_route_specs(ctx.deps, {
             session_options: spine_session_options,

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAEnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aA6CF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAwCF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -46,6 +46,18 @@ export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
  * column-presence is engine-portable, so one file is the cross-impl contract.
  */
 export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH';
+/**
+ * Capabilities for the Rust `testing_spine_stub` — `rust_default_capabilities`
+ * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
+ * `fuz_realtime::SseRegistry` + audit listener) and `ready` (it live-mounts
+ * `/ready` over the env-supplied fixture path). Named (not inline) so every
+ * spine preset is greppable, mirroring `ts_spine_capabilities`.
+ */
+const rust_spine_stub_capabilities = Object.freeze({
+    ...rust_default_capabilities,
+    sse: true,
+    ready: true,
+});
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;
 /** Default Postgres database — real PG (PGlite isn't reachable from `tokio-postgres`). */
@@ -78,12 +90,7 @@ export const rust_spine_stub_backend_config = (options = {}) => {
         // is the lower-precedence fallback — both carry the same value.
         start_command: [binary_path, '--port', String(port)],
         database_url,
-        // The stub serves `GET /api/admin/audit/stream` (the spine
-        // `fuz_realtime::SseRegistry` + audit listener), so it advertises `sse`
-        // like the TS spines — the cross-process SSE suite's three cases run. It
-        // also live-mounts `/ready` over the env-supplied fixture path, so it
-        // advertises `ready` for `describe_ready_cross_tests`.
-        capabilities: { ...rust_default_capabilities, sse: true, ready: true },
+        capabilities: rust_spine_stub_capabilities,
         port_env_var: 'FUZ_RUST_SPINE_STUB_PORT',
         rust_log: 'info,testing_spine_stub=info',
         paths,

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAOvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAS3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aA6BF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAOvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAyB3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aA6BF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -20,6 +20,21 @@ export const TS_SPINE_SSE_PATH = '/api/admin/audit/stream';
  * `/ready` deploy gate in `build_spine_app`).
  */
 const ts_spine_capabilities = Object.freeze({ ...ts_default_capabilities, sse: true, ready: true });
+/**
+ * Capabilities for the **Bun** spine binary — `ts_spine_capabilities` with
+ * `oversized_reject_closes_connection: false`. `Bun.serve` drains the declared
+ * `Content-Length` of an oversized-body `413` reject and keeps the socket
+ * alive (processing the correctly-framed pipelined request) even when the
+ * response carries `Connection: close`, unlike `@hono/node-server` / Deno /
+ * hyper, which close. Bun is not insecure — it frames on `Content-Length`, so
+ * there is no desync — but the smuggling suite's strong "connection closes"
+ * assertion doesn't hold; this flag routes Bun onto the suite's no-desync arm.
+ * See `docs/security.md` §"Body Size Limiting".
+ */
+const ts_spine_bun_capabilities = Object.freeze({
+    ...ts_spine_capabilities,
+    oversized_reject_closes_connection: false,
+});
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */
 export const TS_SPINE_NODE_DEFAULT_PORT = 1178;
 /** Default port for the Deno TS spine binary. */
@@ -71,7 +86,7 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             database_url,
             paths,
             extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
-            capabilities: ts_spine_capabilities,
+            capabilities: ts_spine_bun_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,
     };

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAM9D,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAC,KAAK,mBAAmB,EAAC,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAGxD;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAw6CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAM9D,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAU,KAAK,mBAAmB,EAAC,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAGxD;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA66CF,CAAC"}

package/dist/testing/integration.js

@@ -24,7 +24,7 @@ import { is_public_auth } from '../http/auth_shape.js';
 import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec, } from '../auth/account_action_specs.js';
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 import { LoginOutput, AccountStatusOutput } from '../auth/account_route_schema.js';
-import {} from './cross_backend/capabilities.js';
+import { test_if } from './cross_backend/capabilities.js';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 /**
  * Standard integration test suite for fuz_app auth routes.
@@ -316,15 +316,15 @@ export const describe_standard_integration_tests = (options) => {
             // fixture keeper is single-actor, so `actor` must be non-null and
             // `role_grants` populated (keeper holds keeper + admin globally).
             //
-            // `/status` is mounted at `create_app_server` time (it needs the
-            // `bootstrap_available` runtime state), not by `create_account_route_specs`
-            // and not listed in the declared surface, so we can't gate on `route_specs`.
-            // A backend that mounts only the account-route factory (e.g. a minimal
-            // in-process route set) doesn't serve it — probe at runtime and skip on
-            // 404. The full spine surfaces (in-process + cross-process) serve it, so
-            // the gate runs there. `find_auth_route` can't be used: `/status` isn't a
-            // `RestAuthRouteSuffix`.
-            test('authenticated status body strict-parses against AccountStatusOutput', async (ctx) => {
+            // `/status` is bundled into `create_account_route_specs` (relative
+            // `/status`, prefixed to `/api/account/status`), so every account
+            // surface serves it — matching the Rust `account_router`. Gated on the
+            // declared `account_status` capability rather than a runtime 404-sniff:
+            // a backend that mounts account routes declares `account_status: true`
+            // and the gate **fails loud** if `/status` is missing (no more silent
+            // skip swallowing the coverage); a backend without it skips explicitly.
+            // `find_auth_route` can't be used: `/status` isn't a `RestAuthRouteSuffix`.
+            test_if(options.capabilities.account_status, 'authenticated status body strict-parses against AccountStatusOutput', async () => {
                 const fixture = await options.setup_test();
                 const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
@@ -334,12 +334,9 @@ export const describe_standard_integration_tests = (options) => {
                     method: 'GET',
                     headers: fixture.create_session_headers({ host: 'localhost' }),
                 });
-                if (res.status === 404) {
-                    // Backend doesn't mount /status (minimal route set) — nothing to gate.
-                    ctx.skip();
-                    return;
-                }
-                assert.strictEqual(res.status, 200);
+                assert.strictEqual(res.status, 200, `expected 200 from ${status_path} — capabilities.account_status is true, so the ` +
+                    `account surface must bundle GET /status. A 404 means the backend declares the ` +
+                    `capability but doesn't mount the route.`);
                 const body = await res.json();
                 // Throws on any extra/missing field across account/actor/role_grants.
                 const parsed = AccountStatusOutput.parse(body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -69,9 +69,9 @@
   "devDependencies": {
     "@electric-sql/pglite": "^0.4.5",
     "@fuzdev/blake3_wasm": "^0.1.1",
-    "@fuzdev/fuz_code": "^0.46.0",
+    "@fuzdev/fuz_code": "^0.46.1",
     "@fuzdev/fuz_css": "^0.63.2",
-    "@fuzdev/fuz_ui": "^0.205.0",
+    "@fuzdev/fuz_ui": "^0.205.1",
     "@fuzdev/fuz_util": "^0.65.1",
     "@fuzdev/gro": "^0.204.0",
     "@fuzdev/mdz": "^0.1.0",