@fuzdev/fuz_app 0.89.0 → 0.90.0

package/dist/auth/account_action_specs.d.ts

@@ -99,7 +99,7 @@ export declare const account_verify_action_spec: {
     output: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;

package/dist/auth/account_route_schema.d.ts

@@ -21,7 +21,7 @@ export declare const AccountStatusOutput: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;
@@ -108,7 +108,7 @@ export declare const account_status_route_shape: {
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
         }, z.core.$strict>;

package/dist/auth/account_schema.d.ts

@@ -124,7 +124,7 @@ export interface ApiToken {
 export declare const SessionAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
 }, z.core.$strict>;
@@ -170,7 +170,7 @@ export type ActorSummaryJson = z.infer<typeof ActorSummaryJson>;
 export declare const AdminAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
     updated_at: z.ZodString;
@@ -207,7 +207,7 @@ export declare const AdminAccountEntryJson: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
         updated_at: z.ZodString;

package/dist/auth/admin_action_specs.d.ts

@@ -37,7 +37,7 @@ export declare const AdminAccountListOutput: z.ZodObject<{
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
             updated_at: z.ZodString;
@@ -184,7 +184,7 @@ export declare const AuditLogRoleGrantHistoryOutput: z.ZodObject<{
 export type AuditLogRoleGrantHistoryOutput = z.infer<typeof AuditLogRoleGrantHistoryOutput>;
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export declare const InviteCreateInput: z.ZodObject<{
-    email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
     acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
@@ -194,7 +194,7 @@ export declare const InviteCreateOutput: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     invite: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -212,7 +212,7 @@ export type InviteListInput = z.infer<typeof InviteListInput>;
 export declare const InviteListOutput: z.ZodObject<{
     invites: z.ZodArray<z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -368,7 +368,7 @@ export declare const admin_account_list_action_spec: {
             account: z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-                email: z.ZodNullable<z.ZodEmail>;
+                email: z.ZodNullable<z.ZodString>;
                 email_verified: z.ZodBoolean;
                 created_at: z.ZodString;
                 updated_at: z.ZodString;
@@ -590,7 +590,7 @@ export declare const invite_create_action_spec: {
     };
     side_effects: true;
     input: z.ZodObject<{
-        email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
         acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
@@ -598,7 +598,7 @@ export declare const invite_create_action_spec: {
         ok: z.ZodLiteral<true>;
         invite: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;
@@ -632,7 +632,7 @@ export declare const invite_list_action_spec: {
     output: z.ZodObject<{
         invites: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/audit_log_schema.d.ts

@@ -83,7 +83,7 @@ export declare const audit_metadata_schemas: Readonly<{
         invite_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         open_signup: z.ZodOptional<z.ZodBoolean>;
         reason: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodEmail>;
+        email: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
     password_change: z.ZodNullable<z.ZodObject<{
         sessions_revoked: z.ZodOptional<z.ZodNumber>;

package/dist/auth/invite_schema.d.ts

@@ -22,7 +22,7 @@ export interface Invite {
 /** Zod schema for client-safe invite data. */
 export declare const InviteJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;
@@ -33,7 +33,7 @@ export type InviteJson = z.infer<typeof InviteJson>;
 /** Zod schema for invite data with resolved creator/claimer usernames. */
 export declare const InviteWithUsernamesJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/signup_route_schema.d.ts

@@ -13,11 +13,11 @@
  */
 import { z } from 'zod';
 import type { RouteSpec } from '../http/route_spec.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export declare const SignupInput: z.ZodObject<{
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     password: z.ZodString;
-    email: z.ZodOptional<z.ZodEmail>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strict>;
 export type SignupInput = z.infer<typeof SignupInput>;
 /**

package/dist/auth/signup_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,0FAA0F;AAC1F,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}
+{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,wHAAwH;AACxH,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}

package/dist/auth/signup_route_schema.js

@@ -16,11 +16,11 @@ import { Uuid } from '@fuzdev/fuz_util/id.js';
 import { Username, Email } from '../primitive_schemas.js';
 import { Password } from './password.js';
 import { ERROR_NO_MATCHING_INVITE, ERROR_SIGNUP_CONFLICT, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, } from '../http/error_schemas.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export const SignupInput = z.strictObject({
     username: Username,
     password: Password,
-    email: Email.optional(),
+    email: Email.nullish(),
 });
 /**
  * Output for `POST /signup`.

package/dist/primitive_schemas.d.ts

@@ -40,16 +40,42 @@ export type Username = z.infer<typeof Username>;
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export declare const UsernameProvided: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 export type UsernameProvided = z.infer<typeof UsernameProvided>;
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export declare const EMAIL_LENGTH_MAX = 254;
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export declare const Email: z.ZodEmail;
+export declare const Email: z.ZodString;
 export type Email = z.infer<typeof Email>;
 //# sourceMappingURL=primitive_schemas.d.ts.map

package/dist/primitive_schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wDAIa,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,YAAY,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,wDAKmE,CAAC;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAqBpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,KAAK,aAYhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/primitive_schemas.js

@@ -45,17 +45,70 @@ export const Username = z
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export const UsernameProvided = z
     .string()
     .min(1)
     .max(USERNAME_PROVIDED_LENGTH_MAX)
-    .transform((s) => s.trim().toLowerCase());
+    .transform((s) => s.trim().toLowerCase())
+    .refine((s) => s.length > 0, { message: 'Username must not be empty after trimming whitespace' });
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export const EMAIL_LENGTH_MAX = 254;
+/**
+ * Loose email shape `local@domain.tld`: a non-empty local part, exactly one
+ * `@`, a domain with an interior dot (a non-empty label on each side), and
+ * no whitespace. Accepts `a@b.c` (single-char TLDs are fine) and
+ * `user+tag@a.co`; rejects `notanemail`, `@x.com`, `user@`, `user@host`, and
+ * any whitespace.
+ *
+ * The negated class excludes `\s` **plus** U+0085 (NEL): JS's `\s` omits
+ * U+0085 but Unicode `White_Space` (Rust's `char::is_whitespace`) includes
+ * it, so excluding it keeps the whitespace set identical across the twins.
+ * (The Rust side correspondingly also rejects U+FEFF, which JS `\s` treats as
+ * whitespace but Unicode `White_Space` does not — so both spines reject
+ * exactly `White_Space ∪ {U+FEFF}`.)
+ */
+const EMAIL_REGEX = /^[^\s\u0085@]+@[^\s\u0085@]+\.[^\s\u0085@]+$/;
+/** UTF-8 encoder for the `EMAIL_LENGTH_MAX` byte (octet) bound. */
+const utf8_encoder = new TextEncoder();
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export const Email = z.email();
+export const Email = z
+    .string()
+    .regex(EMAIL_REGEX)
+    // `s.length` (UTF-16 units) is a cheap upper bound that short-circuits the
+    // `encode` on absurd inputs: a valid (<= 254-byte) address is necessarily
+    // <= 254 code units, so this never rejects one — the byte count is the real
+    // RFC-5321 octet bound, matching the Rust spine's `s.len()`.
+    .refine((s) => s.length <= EMAIL_LENGTH_MAX && utf8_encoder.encode(s).length <= EMAIL_LENGTH_MAX, {
+    message: `Email must be at most ${EMAIL_LENGTH_MAX} bytes`,
+});

package/dist/server/env.d.ts

@@ -33,7 +33,7 @@ export declare const BaseServerEnv: z.ZodObject<{
     PUBLIC_FUZ_CONTACT_EMAIL: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
     FUZ_BOOTSTRAP_TOKEN_PATH: z.ZodOptional<z.ZodString>;
     SMTP_HOST: z.ZodOptional<z.ZodString>;
-    SMTP_USER: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
+    SMTP_USER: z.ZodOptional<z.ZodString>;
     SMTP_PASSWORD: z.ZodOptional<z.ZodString>;
     FUZ_FACTS_DIR: z.ZodDefault<z.ZodString>;
     FUZ_FACTS_X_ACCEL_REDIRECT_PREFIX: z.ZodOptional<z.ZodString>;

package/dist/server/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAwCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}

package/dist/server/env.js

@@ -21,7 +21,13 @@ import { parse_allowed_origins } from '../http/origin.js';
  */
 export const BaseServerEnv = z.strictObject({
     NODE_ENV: z.enum(['development', 'production']).meta({ description: 'Runtime environment mode' }),
-    PORT: z.coerce.number().default(4040).meta({ description: 'HTTP server port' }),
+    PORT: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(65535)
+        .default(4040)
+        .meta({ description: 'HTTP server port' }),
     HOST: z.string().default('localhost').meta({ description: 'HTTP server bind address' }),
     DATABASE_URL: z.string().min(1).meta({
         description: 'Database URL (postgres://, file://, or memory://)',
@@ -45,10 +51,16 @@ export const BaseServerEnv = z.strictObject({
         .optional()
         .meta({ description: 'Path to one-shot admin bootstrap token', sensitivity: 'secret' }),
     SMTP_HOST: z.string().optional().meta({ description: 'SMTP server hostname' }),
+    // SMTP usernames are frequently not emails (SendGrid uses "apikey",
+    // AWS SES / Postmark use token-style credentials), so validate as a plain
+    // string — `z.email()` here would reject valid provider configs. Marked
+    // `secret`: those token-style usernames are credentials (Postmark reuses
+    // the server token as both user and password), so the value is masked in
+    // the startup summary / logs like `SMTP_PASSWORD`.
     SMTP_USER: z
-        .union([z.email(), z.literal('')])
+        .string()
         .optional()
-        .meta({ description: 'SMTP authentication username' }),
+        .meta({ description: 'SMTP authentication username', sensitivity: 'secret' }),
     SMTP_PASSWORD: z
         .string()
         .optional()

package/dist/testing/CLAUDE.md

@@ -840,7 +840,12 @@ source of truth for wire-shape conformance.
   whose `RoleSpec.grant_paths` don't include `'admin'` reject loudly at
   offer-create time (`ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE`); those
   roles must be seeded via `extra_accounts` at bootstrap-equivalent time
-  instead. Caller-supplied `username`s pass through _as-is_ now that the DB
+  instead. `create_account({email})` threads an email onto the signup body
+  (the username-scoped invite matches regardless of email), so the account
+  lands with an email set — the hook the username-or-email login parity suite
+  uses; the in-process path sets it directly on the inserted row. Must be a
+  valid, per-test-unique `Email` (the `LOWER(email)` partial-unique index
+  rejects collisions). Caller-supplied `username`s pass through _as-is_ now that the DB
   wipes between tests — hardcoded names like `'user_two'` work and the
   earlier uniquification prefix is gone. Every `TestFixture` also exposes
   `fresh_transport({origin?: string | null})` — cookie-jar-free probe;
@@ -1247,6 +1252,53 @@ in-process spec-level gate test (`src/test/testing/testing_actions_auth.test.ts`
 asserting each spec declares `credential_types: ['daemon_token']`) + the
 `assert_no_testing_methods` surface invariant.
 
+### Identity-primitive parity — `cross_backend/identity_parity.ts`
+
+`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?})` —
+the imperative suite pinning the `primitive_schemas` twins (`Username`,
+`UsernameProvided`, `Email`) + login/signup input handling end-to-end over real
+HTTP (flat REST `/login` + `/signup`, so imperative, not a `conformance_table`
+row). Six facets, each a TS↔Rust reimplementation pair that the spec-derived
+round-trip / conformance suites never vary:
+
+- **Login canonicalization** — case-insensitive + whitespace-trim lookup
+  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), plus a
+  Turkish-`İ` homograph **no-Unicode-fold-collision** negative.
+- **Username-or-email login** — an account created with an email logs in via
+  that email, case-insensitively both directions; username login still works;
+  non-existent email → 401. This is the corner that surfaced and closed the Rust
+  spine's username-only divergence (it now mirrors TS's
+  `query_account_by_username_or_email`).
+- **Login input validation** — malformed login input → 400 `invalid_request_body`
+  on every spine: whitespace-only username (empty after trim), over-long username
+  (> 255), empty password, unknown body key (strict object). TS runs the full
+  `LoginInput` Zod schema; the Rust spine enforces the same shape in
+  `account_login` (closed a cluster where three of these fell through to a
+  lookup-miss 401 on Rust and a whitespace-only identifier 401'd on TS). Asserted
+  by error reason, not just status.
+- **ASCII-only creation invariant** — non-ASCII username → 400 at signup.
+- **Length + format regex parity** — both `[USERNAME_LENGTH_MIN,
+USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
+  just-inside → 403 no-matching-invite) and the creation regex shape (leading
+  non-letter / trailing punctuation / embedded disallowed char → 400; mid-string
+  `_`/`-` accepted), catching an off-by-one or position bug in the TS Zod
+  `.min/.max/.regex` vs the Rust byte-scan `is_valid_username_for_creation`.
+- **Email format (creation)** — the optional signup `email` validated to the
+  loose `local@domain.tld` shape (TS `Email` `^[^\s@]+@[^\s@]+\.[^\s@]+$` + 254-byte
+  bound, Rust `is_valid_email`): malformed (no `@` / no domain dot / empty
+  side / dot at a domain edge / whitespace / over-length) → 400, well-formed →
+  403 no-invite. Accepted siblings include the single-char-TLD `a@b.c` that
+  Zod's `z.email()` rejects — the deliberately-looser shared rule. **Closed a
+  real divergence**: the Rust spine previously length-checked the email only,
+  accepting any non-empty string TS rejected.
+
+Ungated (login + signup are on every spine). Runs both legs via the shared
+`{setup_test}` protocol: in-process (`identity_parity.db.test.ts`, plain
+`gro test`) and cross-process (`identity_parity.cross.test.ts`). `$lib`-free.
+The accepted-case 403s rely on `create_spine_route_specs` zeroing
+`signup_fail_floor_ms` (mirroring `login_fail_floor_ms: 0`) so they don't each
+pay the 250ms denial floor.
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test

package/dist/testing/app_server.d.ts

@@ -48,6 +48,8 @@ export interface CreateTestAccountWithCredentialsOptions {
     username?: string;
     password_value?: string;
     roles?: Array<string>;
+    /** Optional email stored on the account row — exercises the username-or-email login lookup. */
+    email?: string;
 }
 /** Alias for the keeper-flavored call site. Same shape. */
 export type BootstrapTestKeeperOptions = CreateTestAccountWithCredentialsOptions;
@@ -269,6 +271,19 @@ export interface TestAccount {
     /** Build request headers with this account's Bearer token. */
     create_bearer_headers: (extra?: Record<string, string>) => Record<string, string>;
 }
+/**
+ * Args for `TestApp.create_account` — mint an additional account alongside the
+ * keeper. Mirrors the cross-process `CreateTestAccountOptions` (the two
+ * `create_account` paths share a shape so fixture call sites read identically),
+ * kept local to avoid a cross-module cycle with `cross_backend/setup.ts`.
+ */
+export interface CreateTestAppAccountArgs {
+    username?: string;
+    password_value?: string;
+    roles?: Array<string>;
+    /** Optional email stored on the account row — exercises the username-or-email login lookup. */
+    email?: string;
+}
 /**
  * A fully assembled test app — Hono app + backend + helpers.
  */
@@ -285,11 +300,7 @@ export interface TestApp {
     /** Build request headers with the daemon token (keeper auth). */
     create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
-    create_account: (options?: {
-        username?: string;
-        password_value?: string;
-        roles?: Array<string>;
-    }) => Promise<TestAccount>;
+    create_account: (options?: CreateTestAppAccountArgs) => Promise<TestAccount>;
     /** Cleanup resources (delegates to TestAppServer.cleanup). */
     cleanup: () => Promise<void>;
 }

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAG/B,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAIjD,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAiB,KAAK,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAOrD,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CA4CA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAQlC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAuE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAG/B,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAIjD,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAiB,KAAK,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAOrD,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CA8CA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAQlC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAmGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAuE7B,CAAC"}

package/dist/testing/app_server.js

@@ -78,12 +78,13 @@ const resolve_fallback_factory = (migration_namespaces) => {
  *   `role_grant` (one per role), `api_token`, and `auth_session`.
  */
 export const create_test_account_with_credentials = async (options) => {
-    const { db, keyring, session_options, password, username = 'keeper', password_value = DEFAULT_TEST_PASSWORD, roles = [], } = options;
+    const { db, keyring, session_options, password, username = 'keeper', password_value = DEFAULT_TEST_PASSWORD, roles = [], email, } = options;
     const deps = { db };
     const password_hash = await password.hash_password(password_value);
     const { account, actor } = await query_create_account_with_actor(deps, {
         username,
         password_hash,
+        ...(email !== undefined && { email }),
     });
     // Grant roles
     for (const role of roles) {
@@ -315,6 +316,7 @@ export const create_test_app = async (options) => {
             username: account_options?.username ?? `test_user_${account_counter}`,
             password_value: account_options?.password_value ?? DEFAULT_TEST_PASSWORD,
             roles: account_options?.roles ?? [],
+            ...(account_options?.email !== undefined && { email: account_options.email }),
         });
         return {
             ...bootstrapped,

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAkB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAwB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -86,6 +86,12 @@ export const create_spine_route_specs = (ctx) => [
             session_options: spine_session_options,
             ip_rate_limiter: null,
             signup_account_rate_limiter: null,
+            // Disable the denial floor so the identity-parity suite's accepted
+            // cases (valid username/email, no invite → 403 no-matching-invite)
+            // don't each pay the 250ms timing floor. Mirrors `login_fail_floor_ms: 0`
+            // above — the floor is a production timing-oracle defense, not
+            // behavior any cross test asserts.
+            signup_fail_floor_ms: 0,
         }),
     ]),
     ...(ctx.audit_sse

package/dist/testing/cross_backend/identity_parity.d.ts

@@ -0,0 +1,13 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the identity-primitive parity suite. */
+export interface IdentityParityCrossTestOptions {
+    /** Per-test fixture producer (in-process or cross-process). */
+    readonly setup_test: SetupTest;
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+    /** REST signup route path. Default `/api/account/signup` (the spine convention). */
+    readonly signup_path?: string;
+}
+export declare const describe_identity_parity_cross_tests: (options: IdentityParityCrossTestOptions) => void;
+//# sourceMappingURL=identity_parity.d.ts.map

package/dist/testing/cross_backend/identity_parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqG9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAkB1C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA2TF,CAAC"}

package/dist/testing/cross_backend/identity_parity.js

@@ -0,0 +1,465 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend identity-primitive parity for fuz_app's own spine over real
+ * HTTP — the `primitive_schemas` twins (`Username`, `UsernameProvided`,
+ * `Email`) and the login/signup input handling that enforces them, pinned
+ * facet-by-facet so a TS↔Rust divergence in any one surfaces as a failure:
+ * how usernames are **canonicalized** on the login lookup, the **ASCII-only
+ * creation invariant** that bounds what can ever be stored, and the **email
+ * format** rule applied at signup.
+ *
+ * `UsernameProvided` (login/lookup) canonicalizes the submitted username via
+ * `.trim().toLowerCase()`, and the DB matches case-insensitively
+ * (`LOWER(username) = LOWER($1)`); `Username` (creation) lowercases at store
+ * **and** restricts to ASCII via `^[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]$`. The
+ * Rust spine must produce the same canonical form, the same case-insensitive
+ * lookup, **and** the same ASCII-only rejection — or a username that logs in on
+ * TS silently 401s on Rust, or a non-ASCII username storable on one backend
+ * reopens the homograph-collision surface. The spec-derived round-trip +
+ * conformance suites never vary username casing or charset, so this corner was
+ * unpinned.
+ *
+ * **Canonicalization (login lookup):**
+ *
+ * - **case-insensitive login** — an account created `Mixed_Case` logs in via an
+ *   all-uppercase submission (proves the *lookup* folds case, not merely that
+ *   the stored form was lowercased).
+ * - **whitespace-trim login** — the same shape logs in with surrounding
+ *   whitespace (proves `.trim()` on the lookup path).
+ * - **no Unicode case-fold collision (negative)** — a Turkish-`İ` (U+0130)
+ *   variant of an existing ASCII username must NOT match. Both JS
+ *   `.toLowerCase()` and Rust `str::to_lowercase()` map `İ` → `i` + U+0307
+ *   (combining dot above), never plain `i`, so the cased homograph stays a
+ *   distinct, non-existent username → 401 on every backend.
+ *
+ * **Username-or-email login lookup:** the login identifier resolves against
+ * **username or email** — TS `query_account_by_username_or_email`, Rust the
+ * converged `query_account_with_password_hash` OR-lookup (this was the
+ * divergence the suite closed: the Rust spine previously matched username
+ * only). An account created with an email logs in via that email,
+ * case-insensitively (`Email` stores the original case; folding rides the
+ * `LOWER(email) = LOWER($1)` lookup), and username login keeps working when an
+ * email is present. A non-existent email → 401.
+ *
+ * **Login input validation:** malformed login input → 400 `invalid_request_body`
+ * on every spine — whitespace-only username (empty after trim), over-long
+ * username (> 255), empty password, and an unknown body key (strict object).
+ * TS runs the full `LoginInput` Zod schema; the Rust spine enforces the same
+ * shape in `account_login` (the convergence the suite closed: the Rust spine
+ * previously let three of these fall through to a lookup-miss 401, and TS let a
+ * whitespace-only identifier through to a 401). Asserted via the error reason,
+ * not just the status, so a same-status-wrong-body backend still fails.
+ *
+ * **ASCII-only creation invariant:** a non-ASCII username is rejected at signup
+ * input validation → 400 on every backend, so no Unicode username is ever
+ * stored — the precondition the login no-collision case relies on. (ASCII-only
+ * is the intended invariant for both spines, not an accident of the TS regex.)
+ *
+ * **Length + format creation parity:** the full `Username` shape —
+ * `[USERNAME_LENGTH_MIN, USERNAME_LENGTH_MAX]` = `[3, 39]` and the regex
+ * `^[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]$` — pinned across both backends. The TS
+ * Zod `.min()/.max()/.regex()` and the Rust hand-rolled byte-scan
+ * (`is_valid_username_for_creation`) are independent reimplementations of the
+ * same rule, so each length boundary is tested just-outside (→ 400) and
+ * just-inside (→ 403 no-matching-invite, the settle for a valid username on a
+ * spine with `open_signup` at its `false` default), and each format violation
+ * (leading non-letter, trailing punctuation, embedded disallowed char) → 400,
+ * with mid-string `_`/`-` accepted siblings as the don't-over-reject control.
+ * Signup is also strict-object on both spines (TS `z.strictObject`, Rust
+ * `#[serde(deny_unknown_fields)]`), so an unknown signup body key → 400.
+ *
+ * **Email format (creation):** the optional signup `email` is validated to a
+ * loose `local@domain.tld` shape on both spines — TS `Email`
+ * (`^[^\s@]+@[^\s@]+\.[^\s@]+$` plus a 254-byte (RFC 5321 octet) length bound; whitespace `White_Space ∪ {U+FEFF}`), Rust the
+ * hand-rolled `is_valid_email`. A malformed email → 400, a well-formed one →
+ * 403 no-matching-invite (the same accept/reject settle the username tables
+ * use). The accepted siblings include the single-char-TLD `a@b.c` that Zod's
+ * `z.email()` would reject — the deliberately-looser rule both spines now
+ * share. This closed a real divergence: the Rust spine previously
+ * length-checked the email only, accepting any non-empty string TS rejected.
+ *
+ * Both surfaces are flat REST on every spine, so this is an imperative suite
+ * (not a `conformance_table` row) and ungated. Runs both legs via the shared
+ * `{setup_test}` protocol: the in-process leg
+ * (`cross_backend/identity_parity.db.test.ts`, plain `gro test`) and the
+ * cross-process leg (`cross_backend/identity_parity.cross.test.ts`, the TS spine
+ * binaries + Rust `testing_spine_stub` over real HTTP).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { ERROR_INVALID_CREDENTIALS, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE, } from '../../http/error_schemas.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+/**
+ * The flat-REST `{error}` reason each terminal login/signup status carries on
+ * every spine — the assertion target that turns a status-only check into a
+ * body-shape check. `200` carries no `error` field (`{ok: true}`), so its
+ * expected reason is `undefined`. Asserting the reason (not just the status)
+ * catches a backend that returns the right status with a wrong, renamed, or
+ * info-leaking body — drift the status comparison is blind to. Wire constants,
+ * not literals, so a rename in `error_schemas.ts` fails the typecheck here.
+ */
+const REASON_BY_STATUS = {
+    200: undefined,
+    400: ERROR_INVALID_REQUEST_BODY,
+    401: ERROR_INVALID_CREDENTIALS,
+    403: ERROR_NO_MATCHING_INVITE,
+};
+/**
+ * U+0130 LATIN CAPITAL LETTER I WITH DOT ABOVE. Its Unicode default lowercase
+ * is `i` + U+0307 (combining dot above), never plain `i` — the property the
+ * negative case relies on for a stable cross-impl result.
+ */
+const TURKISH_DOTTED_I = 'İ';
+/**
+ * Representative non-ASCII usernames spanning distinct scripts — accented Latin
+ * (mid-string), Greek (leading), CJK (leading). Each fails the `Username` regex
+ * at a different position, so a Rust regex that admitted any one script (but not
+ * another) is caught. All → 400 at signup input validation.
+ */
+const USERNAME_NON_ASCII_CASES = [
+    { username: 'café_user', label: 'accented Latin mid-string', status: 400 },
+    { username: 'Ωmega_user', label: 'leading Greek', status: 400 },
+    { username: '日本_user', label: 'leading CJK', status: 400 },
+];
+/**
+ * Status a signup with a **valid** username (but no matching invite, on a
+ * spine whose `open_signup` stays at the production default `false`) settles
+ * to: the username cleared input validation and reached the invite gate, which
+ * finds no match → 403 `no_matching_invite`. The accepted boundary/format
+ * cases below assert this (not 200): the point is that the username was *not*
+ * rejected at validation, distinguishing it from the 400 cases.
+ */
+const VALID_USERNAME_NO_INVITE_STATUS = 403;
+/**
+ * Username length boundary pairs for the creation schema, pinning both edges of
+ * `[USERNAME_LENGTH_MIN, USERNAME_LENGTH_MAX]` = `[3, 39]`. Each pair is a
+ * just-outside length (rejected at input validation → 400) and its just-inside
+ * sibling (cleared validation → 403). Pinning both sides on both backends
+ * catches an off-by-one in either impl's min/max check — the TS `.min()/.max()`
+ * vs the Rust `s.len() < MIN || s.len() > MAX` byte-length scan. Every value is
+ * otherwise valid (leading letter, alphanumeric tail, alphanumeric body) so the
+ * only variable is length.
+ */
+const USERNAME_LENGTH_CASES = [
+    { username: 'ab', label: '2 chars — below min', status: 400 },
+    { username: 'abc', label: '3 chars — at min', status: VALID_USERNAME_NO_INVITE_STATUS },
+    {
+        username: `a${'b'.repeat(38)}`,
+        label: '39 chars — at max',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+    { username: `a${'b'.repeat(39)}`, label: '40 chars — above max', status: 400 },
+];
+/**
+ * Username format edge cases for the creation regex
+ * `^[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]$`. The rejected cases each violate the
+ * shape at a different position — leading non-letter, trailing punctuation,
+ * embedded disallowed char — so a Rust byte-scan that policed only one position
+ * is caught. The two accepted siblings (`_` / `-` *mid-string*) are the
+ * non-divergence control: the same characters that are illegal at the end are
+ * legal in the body, so they must clear validation (→ 403) on every backend —
+ * pinning that neither impl over-rejects them.
+ */
+const USERNAME_FORMAT_CASES = [
+    { username: '1user', label: 'leading digit', status: 400 },
+    { username: '_user', label: 'leading underscore', status: 400 },
+    { username: '-user', label: 'leading dash', status: 400 },
+    { username: 'user_', label: 'trailing underscore', status: 400 },
+    { username: 'user-', label: 'trailing dash', status: 400 },
+    { username: 'us er', label: 'embedded space', status: 400 },
+    { username: 'user@x', label: 'embedded at-sign', status: 400 },
+    { username: 'user.x', label: 'embedded dot', status: 400 },
+    {
+        username: 'us_er',
+        label: 'underscore mid-string (valid)',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+    { username: 'us-er', label: 'dash mid-string (valid)', status: VALID_USERNAME_NO_INVITE_STATUS },
+];
+/**
+ * Signup email-format cases for the loose `Email` shape `local@domain.tld`
+ * (TS `^[^\s@]+@[^\s@]+\.[^\s@]+$` plus the 254 length bound; Rust the
+ * hand-rolled `is_valid_email`). The rejected cases each violate the shape at
+ * a different point — no `@`, no dot in the domain, empty local/domain, a dot
+ * at a domain edge, surrounding whitespace, over the length bound — so a
+ * backend policing only one of them is caught. The accepted siblings are the
+ * don't-over-reject control and include the shapes Zod's `z.email()` rejects
+ * but our looser rule accepts — single-char TLD `a@b.c` and consecutive dots
+ * `a..b@c.d` — pinning the deliberately-looser shared rule in both directions.
+ * Every case rides a valid username so the rejection (or the 403 no-invite
+ * settle) isolates the email.
+ */
+const SIGNUP_EMAIL_CASES = [
+    { email: 'not-an-email', label: 'no @ or dot', status: 400 },
+    { email: 'user@host', label: 'no dot in domain', status: 400 },
+    { email: '@example.com', label: 'empty local part', status: 400 },
+    { email: 'user@', label: 'empty domain', status: 400 },
+    { email: 'user@.com', label: 'domain starts with a dot', status: 400 },
+    { email: 'user@com.', label: 'domain ends with a dot', status: 400 },
+    { email: 'a@@b.c', label: 'two @', status: 400 },
+    { email: ' user@example.com', label: 'leading whitespace', status: 400 },
+    { email: 'user@example.com ', label: 'trailing whitespace', status: 400 },
+    { email: 'us er@example.com', label: 'internal whitespace', status: 400 },
+    { email: 'a\u0085b@c.d', label: 'NEL U+0085 (Unicode ws JS \\s omits)', status: 400 },
+    { email: 'a\ufeffb@c.d', label: 'BOM/ZWNBSP U+FEFF', status: 400 },
+    // 255 bytes total (243-char local + "@example.com") — one over the 254-byte bound.
+    { email: `${'a'.repeat(243)}@example.com`, label: 'over the 254-byte bound (ASCII)', status: 400 },
+    // Multibyte: the bound is UTF-8 BYTES, not code units. `\u00fc` (ü) is 2
+    // bytes / 1 code unit, so 121×ü + "@example.com" is 254 bytes (accepted) and
+    // 122×ü is 256 bytes (rejected) — both far under 254 code units, so a
+    // code-unit `.max(254)` would wrongly accept the over case. Pins the byte
+    // bound across both spines (the Rust `is_valid_email` `s.len()`).
+    {
+        email: `${'\u00fc'.repeat(121)}@example.com`,
+        label: 'multibyte at the 254-byte bound',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+    {
+        email: `${'\u00fc'.repeat(122)}@example.com`,
+        label: 'multibyte over the 254-byte bound',
+        status: 400,
+    },
+    { email: 'user@example.com', label: 'well-formed', status: VALID_USERNAME_NO_INVITE_STATUS },
+    {
+        email: 'a@b.c',
+        label: 'single-char TLD (looser than z.email)',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+    {
+        email: 'a..b@c.d',
+        label: 'consecutive dots (looser than z.email)',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+    {
+        email: 'user+tag@example.co.uk',
+        label: 'plus-tag + multi-label',
+        status: VALID_USERNAME_NO_INVITE_STATUS,
+    },
+];
+export const describe_identity_parity_cross_tests = (options) => {
+    const { setup_test } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    const signup_path = options.signup_path ?? '/api/account/signup';
+    /**
+     * POST JSON on a fresh (cookie-jar-free) transport; return the status and the
+     * parsed flat-REST `{error}` reason (`undefined` for success / non-JSON
+     * bodies). Always reads the body so the cross-process socket releases.
+     */
+    const post_json = async (fixture, path, body) => {
+        const res = await fixture.fresh_transport()(path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        const text = await res.text().catch(() => '');
+        let error;
+        try {
+            const parsed = text ? JSON.parse(text) : undefined;
+            if (parsed &&
+                typeof parsed === 'object' &&
+                typeof parsed.error === 'string') {
+                error = parsed.error;
+            }
+        }
+        catch {
+            // non-JSON body — leave `error` undefined.
+        }
+        return { status: res.status, error };
+    };
+    /** POST a login with the given identifier (username or email). */
+    const login = (fixture, username, password = DEFAULT_TEST_PASSWORD) => post_json(fixture, login_path, { username, password });
+    /** POST a signup with a valid password and the given username. */
+    const signup = (fixture, username, password = DEFAULT_TEST_PASSWORD) => post_json(fixture, signup_path, { username, password });
+    /**
+     * Assert an attempt settled to `status` **and** carried the flat-REST error
+     * reason that status implies on every spine (see {@link REASON_BY_STATUS}) —
+     * a body-shape check, not just a status check, so a backend can't pass by
+     * returning the right status with the wrong/leaky body.
+     */
+    const assert_attempt = (actual, status, label) => {
+        assert.strictEqual(actual.status, status, `${label} — expected status ${status}, got ${actual.status}`);
+        const expected_reason = REASON_BY_STATUS[status];
+        assert.strictEqual(actual.error, expected_reason, `${label} — status ${status} must carry error reason ${expected_reason ?? '(none)'}, got ${actual.error ?? '(none)'}`);
+    };
+    /** Run a table of signup username cases, asserting each settles to its expected `{status, reason}`. */
+    const describe_signup_username_cases = (suite_name, cases) => {
+        describe(suite_name, () => {
+            for (const { username, label, status } of cases) {
+                test(`${label} — "${username}" → ${status}`, async () => {
+                    const fixture = await setup_test();
+                    assert_attempt(await signup(fixture, username), status, `username "${username}" (${label})`);
+                });
+            }
+        });
+    };
+    describe('username canonicalization parity', () => {
+        test('case-insensitive login — uppercase submission matches a mixed-case account', async () => {
+            const fixture = await setup_test();
+            // Mixed-case ASCII username (valid per the `Username` regex), stored
+            // lowercase; an all-uppercase submission matches only if the lookup
+            // folds case on this backend.
+            await fixture.create_account({ username: 'Canon_Mixed_User' });
+            assert_attempt(await login(fixture, 'CANON_MIXED_USER'), 200, 'uppercase login');
+        });
+        test('whitespace-trim login — surrounding whitespace is trimmed on lookup', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username: 'Canon_Trim_User' });
+            assert_attempt(await login(fixture, '  canon_trim_user  '), 200, 'whitespace-trim login');
+        });
+        test('no Unicode case-fold collision — Turkish İ variant of an ASCII username → 401', async () => {
+            const fixture = await setup_test();
+            // `canon_admin_user` carries an ASCII `i`; the probe replaces it with İ
+            // (U+0130). A backend that folded İ → plain `i` would match the stored
+            // username and authenticate (the bug); both impls fold İ → `i` + U+0307,
+            // so the canonical form differs and the lookup misses → 401
+            // `invalid_credentials` (asserted, not just the status — a backend that
+            // 401'd with a different body would still be wrong).
+            await fixture.create_account({ username: 'canon_admin_user' });
+            const homograph = `canon_adm${TURKISH_DOTTED_I}n_user`;
+            assert_attempt(await login(fixture, homograph), 401, 'Turkish-İ homograph');
+        });
+    });
+    describe('username-or-email login parity', () => {
+        // The login identifier matches against **username or email** (TS
+        // `query_account_by_username_or_email`, Rust the converged
+        // `query_account_with_password_hash` OR-lookup). An account that carries
+        // an email logs in via that email, case-insensitively, on every backend —
+        // the property that was unpinned (and divergent: the Rust spine matched
+        // username only) until this suite. Email is stored with its original case
+        // (`Email` does not lowercase), so case folding rides entirely on the
+        // `LOWER(email) = LOWER($1)` lookup, exercised by the mixed-case cases.
+        test('login by exact email — an account created with an email logs in via that email', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({
+                username: 'email_exact_user',
+                email: 'email-exact@example.com',
+            });
+            assert_attempt(await login(fixture, 'email-exact@example.com'), 200, 'exact-email login');
+        });
+        test('email login is case-insensitive — mixed-case stored email, lowercase submission', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({
+                username: 'email_mixed_user',
+                email: 'Email.Mixed@Example.COM',
+            });
+            assert_attempt(await login(fixture, 'email.mixed@example.com'), 200, 'mixed-case-email login');
+        });
+        test('email login is case-insensitive — lowercase stored email, uppercase submission', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({
+                username: 'email_upper_user',
+                email: 'email-upper@example.com',
+            });
+            assert_attempt(await login(fixture, 'EMAIL-UPPER@EXAMPLE.COM'), 200, 'uppercase-email login');
+        });
+        test('username login still works when the account also has an email', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({
+                username: 'email_dual_user',
+                email: 'email-dual@example.com',
+            });
+            assert_attempt(await login(fixture, 'email_dual_user'), 200, 'username login with email present');
+        });
+        test('login by a non-existent email → 401', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({
+                username: 'email_present_user',
+                email: 'email-present@example.com',
+            });
+            assert_attempt(await login(fixture, 'email-absent@example.com'), 401, 'non-existent-email login');
+        });
+    });
+    describe('login input validation parity', () => {
+        // Malformed login input → 400 `invalid_request_body` on every spine. TS
+        // runs the full `LoginInput` Zod schema (`UsernameProvided` non-empty /
+        // max 255 / non-empty-after-trim, `PasswordProvided` non-empty / max 300,
+        // `z.strictObject`); the Rust spine enforces the same shape in
+        // `account_login` (an extra key fails `deny_unknown_fields` → 400, not
+        // axum's 422). These each previously fell through to a lookup-miss 401 (or
+        // a bespoke-string 400) on one backend — a status *and* body divergence the
+        // strengthened `assert_attempt` (reason-checked) now pins.
+        test('whitespace-only username → 400 (empty after trim, not a lookup miss)', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, '   '), 400, 'whitespace-only username');
+        });
+        test('over-long username (>255) → 400', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, 'a'.repeat(256)), 400, 'over-long username');
+        });
+        test('empty password → 400 (rejected as malformed, not a wrong credential)', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, 'some_user', ''), 400, 'empty password');
+        });
+        test('over-long password (>300) → 400', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, 'some_user', 'a'.repeat(301)), 400, 'over-long password');
+        });
+        test('unknown body key → 400 (strict object on both spines)', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await post_json(fixture, login_path, {
+                username: 'some_user',
+                password: DEFAULT_TEST_PASSWORD,
+                unexpected_field: 'x',
+            }), 400, 'unknown body key');
+        });
+    });
+    // The `Username` creation schema is ASCII-only by regex; both spines reject a
+    // non-ASCII username at signup input validation → 400, so no Unicode username
+    // is ever stored (the precondition the no-collision login case relies on).
+    describe_signup_username_cases('username creation ASCII-only invariant parity', USERNAME_NON_ASCII_CASES);
+    // Both edges of `[USERNAME_LENGTH_MIN, USERNAME_LENGTH_MAX]` = [3, 39], each
+    // side just-outside (→ 400) and just-inside (→ 403). Catches an off-by-one in
+    // either backend's length check.
+    describe_signup_username_cases('username creation length boundary parity', USERNAME_LENGTH_CASES);
+    // The creation regex `^[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]$` — rejected shapes
+    // (→ 400) and the mid-string `_`/`-` controls that must be accepted (→ 403),
+    // proving neither backend over- or under-rejects.
+    describe_signup_username_cases('username creation format parity', USERNAME_FORMAT_CASES);
+    // The optional signup `email` is validated to the loose `local@domain.tld`
+    // shape on both spines (TS `Email` regex + 254-byte bound, Rust `is_valid_email`):
+    // malformed → 400, well-formed → 403 no-invite. The username is fixed-valid so
+    // each case isolates the email; the `a@b.c` accept pins the deliberately
+    // looser-than-`z.email()` rule the validator port converged on.
+    describe('signup email format parity', () => {
+        for (const { email, label, status } of SIGNUP_EMAIL_CASES) {
+            test(`${label} → ${status}`, async () => {
+                const fixture = await setup_test();
+                assert_attempt(await post_json(fixture, signup_path, {
+                    username: 'email_fmt_user',
+                    password: DEFAULT_TEST_PASSWORD,
+                    email,
+                }), status, `email "${email}" (${label})`);
+            });
+        }
+        // `null` email (not just absent) — TS `Email.nullish()` + the Rust
+        // `Option<String>` (serde maps JSON null → None) both treat it as
+        // "no email", so signup reaches the invite gate → 403, not a 400.
+        // Pins the null-vs-absent convergence the `.nullish()` loosening made.
+        test('null email is treated as absent (403, not 400)', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await post_json(fixture, signup_path, {
+                username: 'email_null_user',
+                password: DEFAULT_TEST_PASSWORD,
+                email: null,
+            }), VALID_USERNAME_NO_INVITE_STATUS, 'null email');
+        });
+    });
+    describe('signup input validation parity', () => {
+        // Signup is `z.strictObject` on TS and `#[serde(deny_unknown_fields)]` on
+        // the Rust spine — an unknown body key → 400 `invalid_request_body` on
+        // both (the Rust spine previously ignored it via serde). The username is
+        // valid so the rejection isolates the unknown key (a valid body would
+        // otherwise reach the invite gate → 403).
+        test('unknown body key → 400 (strict object on both spines)', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await post_json(fixture, signup_path, {
+                username: 'strict_signup_user',
+                password: DEFAULT_TEST_PASSWORD,
+                unexpected_field: 'x',
+            }), 400, 'signup unknown body key');
+        });
+    });
+};

package/dist/testing/cross_backend/setup.d.ts

@@ -15,6 +15,15 @@ export interface CreateTestAccountOptions {
     readonly username?: string;
     readonly password_value?: string;
     readonly roles?: Array<string>;
+    /**
+     * Optional email to store on the account, exercising the username-or-email
+     * login lookup. Cross-process this rides the production signup body
+     * (claimed against the username-scoped invite, which matches regardless of
+     * the email); in-process it lands directly on the inserted row. Must be a
+     * valid `Email` (the cross-process signup validates it) and unique per test
+     * (the `LOWER(email)` partial-unique index rejects collisions).
+     */
+    readonly email?: string;
 }
 /**
  * Shape returned by `TestFixture.create_account`. Aliased to the

package/dist/testing/cross_backend/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAUD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAkSlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SAsIF,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAUD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8SlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SAqIF,CAAC"}

package/dist/testing/cross_backend/setup.js

@@ -279,10 +279,22 @@ const mint_account = async (handle, options) => {
         throw new Error(`invite_create(${handle.config.name}, username=${username}) returned unexpected result: ` +
             JSON.stringify(invite_result));
     }
+    // Thread the optional email onto the production signup body — the
+    // username-scoped invite above matches on username regardless of the
+    // email, so the account lands with the email set (exercising the
+    // username-or-email login lookup). Guard on `!== undefined` (not truthy)
+    // to match the other three email guards (`create_account` here +
+    // `app_server.ts`): "requested" is `undefined` vs present, so a
+    // caller-supplied value is forwarded verbatim and signup validates it,
+    // rather than the truthy form silently dropping an empty string.
     const signup_response = await transport('/api/account/signup', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, password }),
+        body: JSON.stringify({
+            username,
+            password,
+            ...(options.email !== undefined && { email: options.email }),
+        }),
     });
     if (!signup_response.ok) {
         const body = await signup_response.text().catch(() => '<unreadable>');
@@ -422,6 +434,7 @@ export const default_cross_process_setup = (handle, options) => {
                 ...(account_options?.password_value !== undefined && {
                     password_value: account_options.password_value,
                 }),
+                ...(account_options?.email !== undefined && { email: account_options.email }),
             });
             if (account_options?.roles && account_options.roles.length > 0) {
                 await grant_roles_via_offer_accept(refreshed_handle, other, account_options.roles);

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AA+FF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA6B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAsGF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA6B5B,CAAC"}

package/dist/testing/schema_generators.js

@@ -127,6 +127,13 @@ const generate_valid_string = (field_schema) => {
         if (slug !== null && field_schema.safeParse(slug).success)
             return slug;
     }
+    // Email-shaped refinement (the `Email` primitive: loose `local@domain.tld`).
+    // The base `x`-fill has no `@`, so an email-pattern field needs a shaped
+    // candidate — the `z.string().regex()` form exposes a `pattern`, not the
+    // `format: 'email'` the `case 'email'` switch arm keys on.
+    const as_email = 'test@example.com';
+    if (field_schema.safeParse(as_email).success)
+        return as_email;
     // Absolute path refinement (e.g. DiskfilePath)
     const with_slash = '/' + base;
     if (field_schema.safeParse(with_slash).success)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.89.0",
+  "version": "0.90.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",