@fuzdev/fuz_app 0.89.0 → 0.91.0

package/dist/testing/CLAUDE.md

@@ -222,7 +222,37 @@ test-only by construction.
 - `assert_schema_snapshots_equal(a, b, labels?)` — throws on drift with a fully-formatted diff message.
 - `SchemaDiff` — tagged-union per drift kind: `table_only_in`, `column_only_in`, `column_field_differs`, `index_only_in`, `index_definition_differs`, `constraint_only_in`, `constraint_differs`, `sequence_only_in`, `sequence_data_type_differs`, `enum_only_in`, `enum_labels_differ` (enum labels compared positionally — declared order is significant).
 
-fuz_app's own spine gates this cross-process via the `cross_backend_schema_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:schema-parity`. The forge has its own deno↔rust parity gate.
+fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. The forge has its own deno↔rust parity gate.
+
+## Cross-impl RPC-manifest parity
+
+The action-surface sibling of schema parity. Where schema parity diffs the live
+_database_ shape, this diffs the live _RPC registry_ shape — proving the TS
+spine and the Rust `testing_spine_stub` mount the same method set with the same
+per-method auth shape.
+
+- `cross_backend/action_manifest.ts` — `ActionManifest` / `ActionManifestEntry`
+  Zod schema (the `_testing_action_manifest` wire validator) + `build_action_manifest(specs)`,
+  which normalizes each spec to `{method, side_effects, account, actor, roles,
+credential_types}` (auth axes pass through; `roles` / `credential_types` flatten
+  to sorted arrays). Twin of `schema_introspect.ts`. Excludes the protocol actions
+  (`heartbeat` / `cancel`) by construction — the two impls organize them
+  differently (TS WS-only; Rust on one shared registry), so the caller passes a
+  protocol-free list.
+- `cross_backend/action_manifest_parity.ts` — `diff_action_manifests` /
+  `format_action_manifest_diffs` / `assert_action_manifests_equal` (twin of
+  `schema_parity.ts`) — asserts exact method-set + per-method auth-shape parity.
+- `cross_backend/setup.ts` `capture_action_manifest(handle)` — dumps a backend's
+  manifest over the daemon-token `_testing_action_manifest` channel (twin of
+  `capture_schema_snapshot`).
+
+It runs under the same dual-spawn `cross_backend_parity` project (one TS-spine +
+Rust-stub spawn serves both gates). It complements the in-repo
+`spine_method_coverage` reconciliation gate (which proves _mounted ⟹ covered_);
+this proves _TS-mount-set ≡ Rust-mount-set_. The gate asserts **exact** parity —
+every mounted method and its full auth shape (side-effects + the four auth axes)
+must match across the two impls, with no allowlisted divergences (see
+`action_manifest_parity.cross.test.ts`).
 
 **Cross-impl gate pattern** — a dual-impl consumer running two backends
 (a TS Hono server and a Rust spine server) against a shared schema, plus
@@ -840,7 +870,12 @@ source of truth for wire-shape conformance.
   whose `RoleSpec.grant_paths` don't include `'admin'` reject loudly at
   offer-create time (`ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE`); those
   roles must be seeded via `extra_accounts` at bootstrap-equivalent time
-  instead. Caller-supplied `username`s pass through _as-is_ now that the DB
+  instead. `create_account({email})` threads an email onto the signup body
+  (the username-scoped invite matches regardless of email), so the account
+  lands with an email set — the hook the username-or-email login parity suite
+  uses; the in-process path sets it directly on the inserted row. Must be a
+  valid, per-test-unique `Email` (the `LOWER(email)` partial-unique index
+  rejects collisions). Caller-supplied `username`s pass through _as-is_ now that the DB
   wipes between tests — hardcoded names like `'user_two'` work and the
   earlier uniquification prefix is gone. Every `TestFixture` also exposes
   `fresh_transport({origin?: string | null})` — cookie-jar-free probe;
@@ -856,18 +891,26 @@ source of truth for wire-shape conformance.
   deliver it.
 
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
-  (`bearer_auth` / `trusted_proxy` / `login_rate_limit` / `ws` / `sse` /
-  `cell_crud` / `cell_relations` / `account_lifecycle` / `fact_serving` /
-  `ready` / `account_status` / `oversized_reject_closes_connection`),
+  (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
+  `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
+  `oversized_reject_closes_connection` — each has a `test_if` reader),
   `test_if(cond, name, fn)`
-  for capability-gated cases, and `in_process_capabilities` preset. `cell_crud`
+  for capability-gated cases, and `in_process_capabilities` preset. The
+  non-gating wiring facts (`bearer_auth` / `trusted_proxy` / `login_rate_limit`,
+  no `test_if` readers) live in the parallel `BackendShapeNotes` record
+  (`in_process_shape_notes`; `ts_default_shape_notes` / `rust_default_shape_notes`
+  in `default_backend_configs.ts`) — split out so the capability type stops
+  claiming gating it doesn't do. `cell_crud`
   gates the CRUD parity suite, `cell_relations` the relation / ACL / audit
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
-  `account_delete` / `account_undelete` / `account_purge` parity suite) — also
-  off the declared surface like cells, `true` on every spine. `fact_serving`
+  `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
+  cells those verbs **are** on the declared surface (in `create_admin_actions`,
+  auto-enumerated for shape/auth) — the flag gates the behavioral parity the
+  generic round-trip can't drive (it can't delete the subject). `true` on every
+  spine. `fact_serving`
   gates `describe_fact_serving_cross_tests` (the cell-scoped per-reference +
   admin-only bare-hash fact-serving parity suite); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
@@ -1186,6 +1229,16 @@ in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.t
   payload-expiry tests never reached. Daemon-token-gated like its siblings; the
   Rust mirror is `fuz_testing::create_testing_mint_session_action_spec`.
 
+  Also in the module — but **not** bundled by `create_testing_actions` —
+  `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
+  dumps the live RPC registry as a normalized `ActionManifest` for the
+  cross-impl manifest-parity gate (see §Cross-impl RPC-manifest parity). It must
+  enumerate _every_ mounted method, which `create_testing_actions` (one
+  sub-factory) can't see, so it's appended at the full-mount layer
+  (`full_spine_mount.ts` `build_full_spine_rpc_actions`), closing over the
+  complete action list plus its own spec. Daemon-token-gated like its siblings;
+  the Rust mirror is `fuz_testing::create_testing_action_manifest_action_spec`.
+
 ### Origin verification parity — `cross_backend/origin.ts`
 
 `describe_origin_cross_tests({setup_test, capabilities, rpc_path?})` — the
@@ -1247,6 +1300,53 @@ in-process spec-level gate test (`src/test/testing/testing_actions_auth.test.ts`
 asserting each spec declares `credential_types: ['daemon_token']`) + the
 `assert_no_testing_methods` surface invariant.
 
+### Identity-primitive parity — `cross_backend/identity_parity.ts`
+
+`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?})` —
+the imperative suite pinning the `primitive_schemas` twins (`Username`,
+`UsernameProvided`, `Email`) + login/signup input handling end-to-end over real
+HTTP (flat REST `/login` + `/signup`, so imperative, not a `conformance_table`
+row). Six facets, each a TS↔Rust reimplementation pair that the spec-derived
+round-trip / conformance suites never vary:
+
+- **Login canonicalization** — case-insensitive + whitespace-trim lookup
+  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), plus a
+  Turkish-`İ` homograph **no-Unicode-fold-collision** negative.
+- **Username-or-email login** — an account created with an email logs in via
+  that email, case-insensitively both directions; username login still works;
+  non-existent email → 401. This is the corner that surfaced and closed the Rust
+  spine's username-only divergence (it now mirrors TS's
+  `query_account_by_username_or_email`).
+- **Login input validation** — malformed login input → 400 `invalid_request_body`
+  on every spine: whitespace-only username (empty after trim), over-long username
+  (> 255), empty password, unknown body key (strict object). TS runs the full
+  `LoginInput` Zod schema; the Rust spine enforces the same shape in
+  `account_login` (closed a cluster where three of these fell through to a
+  lookup-miss 401 on Rust and a whitespace-only identifier 401'd on TS). Asserted
+  by error reason, not just status.
+- **ASCII-only creation invariant** — non-ASCII username → 400 at signup.
+- **Length + format regex parity** — both `[USERNAME_LENGTH_MIN,
+USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
+  just-inside → 403 no-matching-invite) and the creation regex shape (leading
+  non-letter / trailing punctuation / embedded disallowed char → 400; mid-string
+  `_`/`-` accepted), catching an off-by-one or position bug in the TS Zod
+  `.min/.max/.regex` vs the Rust byte-scan `is_valid_username_for_creation`.
+- **Email format (creation)** — the optional signup `email` validated to the
+  loose `local@domain.tld` shape (TS `Email` `^[^\s@]+@[^\s@]+\.[^\s@]+$` + 254-byte
+  bound, Rust `is_valid_email`): malformed (no `@` / no domain dot / empty
+  side / dot at a domain edge / whitespace / over-length) → 400, well-formed →
+  403 no-invite. Accepted siblings include the single-char-TLD `a@b.c` that
+  Zod's `z.email()` rejects — the deliberately-looser shared rule. **Closed a
+  real divergence**: the Rust spine previously length-checked the email only,
+  accepting any non-empty string TS rejected.
+
+Ungated (login + signup are on every spine). Runs both legs via the shared
+`{setup_test}` protocol: in-process (`identity_parity.db.test.ts`, plain
+`gro test`) and cross-process (`identity_parity.cross.test.ts`). `$lib`-free.
+The accepted-case 403s rely on `create_spine_route_specs` zeroing
+`signup_fail_floor_ms` (mirroring `login_fail_floor_ms: 0`) so they don't each
+pay the 250ms denial floor.
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test
@@ -1257,10 +1357,35 @@ re-roll the serve / daemon-info / WS-attach / drain boilerplate:
 - `testing/cross_backend/testing_server_node.ts` — `create_node_testing_adapter()` (`@hono/node-server` + `@hono/node-ws`). Optional peer deps (like `ws`); only test binaries import them.
 - `testing/cross_backend/testing_server_deno.ts` — `create_deno_testing_adapter()` (`Deno.serve` + `hono/deno`; `Deno` declared locally so it typechecks under the Node toolchain). Spawn the entry with `--sloppy-imports` (Deno doesn't do `.js`→`.ts`; Gro's loader does, so the Node path needs no flag).
 - `testing/cross_backend/testing_server_bun.ts` — `create_bun_testing_adapter()` (`Bun.serve` + `hono/bun`'s module-level `upgradeWebSocket` + `websocket`; `Bun.serve` declared locally so it typechecks under the Node toolchain). **No extra deps** (`hono/bun` ships with `hono`; `Bun.serve` is built in, unlike Node's `@hono/node-server` + `@hono/node-ws`), and Bun resolves `.js`→`.ts` natively (no flag, unlike Deno). Reuses `create_node_runtime` (Bun implements the `node:fs`/`node:process` surface). WS is module-level + stateless (like Deno) — the `websocket` handler is threaded into `serve`, where `Bun.serve` wants it, so no post-serve attach.
-- `testing/cross_backend/default_spine_surface.ts` — the canonical no-domain spine surface (account/admin/audit/signup + bootstrap): `spine_session_options`, `spine_roles`, `create_spine_route_specs`, `spine_rpc_endpoints`, `create_spine_surface_spec`. `$lib`-free (it's reached by the spawned binary under Gro's loader, which doesn't resolve `$lib`), so keep it on relative imports. Shared by the spine_stub cross test, the TS cross tests, and the binary.
+- `testing/cross_backend/default_spine_surface.ts` — the canonical no-domain spine surface (account/admin/audit/signup + bootstrap): `spine_session_options`, `spine_roles`, `create_spine_route_specs`, `spine_rpc_endpoints`, `create_spine_surface_spec`. This is the **declared** surface — the `create_standard_rpc_actions` bundle the spec-derived suites auto-enumerate. `$lib`-free (it's reached by the spawned binary under Gro's loader, which doesn't resolve `$lib`), so keep it on relative imports. Shared by the spine_stub cross test, the TS cross tests, and the binary.
+- `testing/cross_backend/full_spine_mount.ts` — `build_full_spine_rpc_actions(deps, options)` / `full_spine_rpc_endpoints(ctx, options)` — the **full** live RPC mount: the declared bundle **plus** the off-declared-surface families the binary live-mounts (`_testing_*` backdoors, the cell verb set, the opt-in `actor_lookup` / `actor_search` resolvers). Single-sources what was an inline assembly in `testing_spine_server.ts`, so the binary and the `spine_method_coverage` reconciliation test build the same list. Also `$lib`-free.
 - `testing/cross_backend/ts_spine_backend_config.ts` — `ts_spine_node_backend_config()` / `ts_spine_deno_backend_config()` / `ts_spine_bun_backend_config()` presets (in-memory PGlite, no external infra), the TS analog of `rust_spine_stub_backend_config()`.
 
-fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `_testing_reset` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic.
+fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `full_spine_rpc_endpoints` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic.
+
+### Live-method coverage reconciliation — `method_coverage.ts`
+
+`assert_rpc_method_coverage({live_methods, declared_methods, manifest})` keeps
+the **off-declared-surface** methods as drift-proof as the declared ones. The
+spec-derived suites auto-enumerate the declared surface, but a backend's live
+RPC endpoint also mounts methods kept off it (stateful cell verbs, opt-in
+resolvers, `_testing_*` backdoors) that rely on hand-wired imperative suites —
+nothing structurally guaranteed every live method was actually claimed by one.
+
+The assertion diffs the live method set against a `MethodCoverageEntry`
+manifest both directions (a mounted-but-unclaimed method **and** a stale
+manifest row both fail loud) and checks each entry's `tier`
+(`declared` / `off_surface` / `backdoor`) is consistent with the declared
+surface + the `_testing_` prefix. `off_surface` rows must name the covering
+`suite`; `capability` is typed `keyof BackendCapabilities` so a stale flag is a
+compile error. The manifest is the forcing function — a method can't reach the
+live mount without a row naming its coverage.
+
+Pairs with `surface_invariants.ts` `assert_no_testing_methods` (the _reverse_
+guard — a backdoor must never leak _onto_ the declared surface). fuz_app's own
+wiring is the manifest `src/test/cross_backend/spine_method_coverage.ts` + the
+no-DB reconciliation test `spine_method_coverage.test.ts`, which enumerates
+`build_full_spine_rpc_actions` with stub deps against `create_spine_surface_spec`.
 
 The in-process `ws_round_trip` harness stays (it drives the dispatcher
 against a fake upgrade, no wire), but the real-upgrade coverage now lives in

package/dist/testing/app_server.d.ts

@@ -48,6 +48,8 @@ export interface CreateTestAccountWithCredentialsOptions {
     username?: string;
     password_value?: string;
     roles?: Array<string>;
+    /** Optional email stored on the account row — exercises the username-or-email login lookup. */
+    email?: string;
 }
 /** Alias for the keeper-flavored call site. Same shape. */
 export type BootstrapTestKeeperOptions = CreateTestAccountWithCredentialsOptions;
@@ -269,6 +271,19 @@ export interface TestAccount {
     /** Build request headers with this account's Bearer token. */
     create_bearer_headers: (extra?: Record<string, string>) => Record<string, string>;
 }
+/**
+ * Args for `TestApp.create_account` — mint an additional account alongside the
+ * keeper. Mirrors the cross-process `CreateTestAccountOptions` (the two
+ * `create_account` paths share a shape so fixture call sites read identically),
+ * kept local to avoid a cross-module cycle with `cross_backend/setup.ts`.
+ */
+export interface CreateTestAppAccountArgs {
+    username?: string;
+    password_value?: string;
+    roles?: Array<string>;
+    /** Optional email stored on the account row — exercises the username-or-email login lookup. */
+    email?: string;
+}
 /**
  * A fully assembled test app — Hono app + backend + helpers.
  */
@@ -285,11 +300,7 @@ export interface TestApp {
     /** Build request headers with the daemon token (keeper auth). */
     create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
-    create_account: (options?: {
-        username?: string;
-        password_value?: string;
-        roles?: Array<string>;
-    }) => Promise<TestAccount>;
+    create_account: (options?: CreateTestAppAccountArgs) => Promise<TestAccount>;
     /** Cleanup resources (delegates to TestAppServer.cleanup). */
     cleanup: () => Promise<void>;
 }

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAG/B,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAIjD,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAiB,KAAK,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAOrD,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CA4CA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAQlC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAuE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAG/B,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAIjD,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAiB,KAAK,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAOrD,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CA8CA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAQlC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAuID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAmGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAuE7B,CAAC"}

package/dist/testing/app_server.js

@@ -78,12 +78,13 @@ const resolve_fallback_factory = (migration_namespaces) => {
  *   `role_grant` (one per role), `api_token`, and `auth_session`.
  */
 export const create_test_account_with_credentials = async (options) => {
-    const { db, keyring, session_options, password, username = 'keeper', password_value = DEFAULT_TEST_PASSWORD, roles = [], } = options;
+    const { db, keyring, session_options, password, username = 'keeper', password_value = DEFAULT_TEST_PASSWORD, roles = [], email, } = options;
     const deps = { db };
     const password_hash = await password.hash_password(password_value);
     const { account, actor } = await query_create_account_with_actor(deps, {
         username,
         password_hash,
+        ...(email !== undefined && { email }),
     });
     // Grant roles
     for (const role of roles) {
@@ -315,6 +316,7 @@ export const create_test_app = async (options) => {
             username: account_options?.username ?? `test_user_${account_counter}`,
             password_value: account_options?.password_value ?? DEFAULT_TEST_PASSWORD,
             roles: account_options?.roles ?? [],
+            ...(account_options?.email !== undefined && { email: account_options.email }),
         });
         return {
             ...bootstrapped,

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -0,0 +1,113 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl RPC **action-manifest** introspection — a normalized,
+ * JSON-serializable dump of a backend's live RPC method set, one entry per
+ * method carrying its auth shape + side-effect flag.
+ *
+ * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
+ * captures the live *database* shape for the schema-parity gate, this
+ * captures the live *RPC registry* shape for the action-manifest parity gate.
+ * Both are dumped over a daemon-token `_testing_*` introspection action
+ * (`_testing_action_manifest` here, `_testing_schema_snapshot` there) and
+ * diffed across the TS spine and the Rust `testing_spine_stub` so a
+ * method-set or per-method auth-shape divergence fails loud. This complements
+ * the in-repo `spine_method_coverage` gate: that proves *mounted ⟹ covered*;
+ * this proves *TS-mount-set ≡ Rust-mount-set* (method set + auth shape).
+ *
+ * **Scope — domain + testing surface, not wire protocol.** The manifest is
+ * built from exactly the spec list its caller passes
+ * (`build_full_spine_rpc_actions` on the TS spine; the spec list minus
+ * `PROTOCOL_ACTION_SPECS` on the Rust stub). The protocol actions
+ * (`heartbeat` / `cancel`) are excluded by the caller on purpose: the two
+ * impls organize them differently (the TS spine mounts them on the WS
+ * endpoint only, never the HTTP-RPC endpoint; the Rust stub compiles one
+ * shared registry serving both transports), so including them would be a
+ * spurious cross-impl diff. This matches the scope of the in-repo
+ * `spine_method_coverage` gate (also over `build_full_spine_rpc_actions`).
+ *
+ * Paired with `action_manifest_parity.ts` for the diff + assertion helpers.
+ *
+ * `$lib`-free by contract — reached by the spawned TS binary (via
+ * `testing_reset_actions.ts` → `full_spine_mount.ts`), so every import is
+ * relative.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { type RouteAuth } from '../../http/auth_shape.js';
+import type { RequestResponseActionSpec } from '../../actions/action_spec.js';
+/**
+ * One method's normalized RPC metadata — the cross-impl-comparable unit.
+ * `roles` / `credential_types` are always present + sorted (an absent gate
+ * and an empty list both serialize to `[]`) so the diff never trips on a
+ * `undefined`-vs-`[]` or declaration-order difference between impls; the
+ * auth axes reuse the canonical `AuthAxisState` enum.
+ */
+export declare const ActionManifestEntry: z.ZodObject<{
+    /** RPC method name (`spec.method`). */
+    method: z.ZodString;
+    /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+    side_effects: z.ZodBoolean;
+    /** The `account` auth axis. */
+    account: z.ZodEnum<{
+        optional: "optional";
+        none: "none";
+        required: "required";
+    }>;
+    /** The `actor` auth axis. */
+    actor: z.ZodEnum<{
+        optional: "optional";
+        none: "none";
+        required: "required";
+    }>;
+    /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+    roles: z.ZodArray<z.ZodString>;
+    /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+    credential_types: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
+/** The full action manifest — every entry, sorted by `method`. */
+export declare const ActionManifest: z.ZodObject<{
+    methods: z.ZodArray<z.ZodObject<{
+        /** RPC method name (`spec.method`). */
+        method: z.ZodString;
+        /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+        side_effects: z.ZodBoolean;
+        /** The `account` auth axis. */
+        account: z.ZodEnum<{
+            optional: "optional";
+            none: "none";
+            required: "required";
+        }>;
+        /** The `actor` auth axis. */
+        actor: z.ZodEnum<{
+            optional: "optional";
+            none: "none";
+            required: "required";
+        }>;
+        /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+        roles: z.ZodArray<z.ZodString>;
+        /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+        credential_types: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ActionManifest = z.infer<typeof ActionManifest>;
+/**
+ * Normalize one spec's auth + side-effects into a manifest entry. Pulls the
+ * four auth axes off `RouteAuth` (the same shape the Rust `AuthSpec` mirrors)
+ * and flattens optional `roles` / `credential_types` to sorted arrays.
+ */
+export declare const action_manifest_entry: (spec: {
+    readonly method: string;
+    readonly auth: RouteAuth;
+    readonly side_effects: boolean;
+}) => ActionManifestEntry;
+/**
+ * Build the normalized `ActionManifest` from a list of request-response
+ * specs. Entries are sorted by `method` so two impls producing the same set
+ * serialize identically regardless of mount order. The caller owns the scope
+ * it passes (the TS spine passes its full mount; the Rust stub filters
+ * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
+ */
+export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects">>) => ActionManifest;
+//# sourceMappingURL=action_manifest.d.ts.map

package/dist/testing/cross_backend/action_manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAgB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,8BAA8B,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;kBAEhF,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAhB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;;kBAQhF,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B,KAAG,mBAOF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,KACvF,cAED,CAAC"}

package/dist/testing/cross_backend/action_manifest.js

@@ -0,0 +1,89 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl RPC **action-manifest** introspection — a normalized,
+ * JSON-serializable dump of a backend's live RPC method set, one entry per
+ * method carrying its auth shape + side-effect flag.
+ *
+ * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
+ * captures the live *database* shape for the schema-parity gate, this
+ * captures the live *RPC registry* shape for the action-manifest parity gate.
+ * Both are dumped over a daemon-token `_testing_*` introspection action
+ * (`_testing_action_manifest` here, `_testing_schema_snapshot` there) and
+ * diffed across the TS spine and the Rust `testing_spine_stub` so a
+ * method-set or per-method auth-shape divergence fails loud. This complements
+ * the in-repo `spine_method_coverage` gate: that proves *mounted ⟹ covered*;
+ * this proves *TS-mount-set ≡ Rust-mount-set* (method set + auth shape).
+ *
+ * **Scope — domain + testing surface, not wire protocol.** The manifest is
+ * built from exactly the spec list its caller passes
+ * (`build_full_spine_rpc_actions` on the TS spine; the spec list minus
+ * `PROTOCOL_ACTION_SPECS` on the Rust stub). The protocol actions
+ * (`heartbeat` / `cancel`) are excluded by the caller on purpose: the two
+ * impls organize them differently (the TS spine mounts them on the WS
+ * endpoint only, never the HTTP-RPC endpoint; the Rust stub compiles one
+ * shared registry serving both transports), so including them would be a
+ * spurious cross-impl diff. This matches the scope of the in-repo
+ * `spine_method_coverage` gate (also over `build_full_spine_rpc_actions`).
+ *
+ * Paired with `action_manifest_parity.ts` for the diff + assertion helpers.
+ *
+ * `$lib`-free by contract — reached by the spawned TS binary (via
+ * `testing_reset_actions.ts` → `full_spine_mount.ts`), so every import is
+ * relative.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { AuthAxisState } from '../../http/auth_shape.js';
+/**
+ * One method's normalized RPC metadata — the cross-impl-comparable unit.
+ * `roles` / `credential_types` are always present + sorted (an absent gate
+ * and an empty list both serialize to `[]`) so the diff never trips on a
+ * `undefined`-vs-`[]` or declaration-order difference between impls; the
+ * auth axes reuse the canonical `AuthAxisState` enum.
+ */
+export const ActionManifestEntry = z.strictObject({
+    /** RPC method name (`spec.method`). */
+    method: z.string(),
+    /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+    side_effects: z.boolean(),
+    /** The `account` auth axis. */
+    account: AuthAxisState,
+    /** The `actor` auth axis. */
+    actor: AuthAxisState,
+    /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+    roles: z.array(z.string()),
+    /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+    credential_types: z.array(z.string()),
+});
+/** The full action manifest — every entry, sorted by `method`. */
+export const ActionManifest = z.strictObject({
+    methods: z.array(ActionManifestEntry),
+});
+/** Sorted copy of a readonly string list (stable cross-impl ordering). */
+const sorted_strings = (xs) => [...(xs ?? [])].sort();
+/**
+ * Normalize one spec's auth + side-effects into a manifest entry. Pulls the
+ * four auth axes off `RouteAuth` (the same shape the Rust `AuthSpec` mirrors)
+ * and flattens optional `roles` / `credential_types` to sorted arrays.
+ */
+export const action_manifest_entry = (spec) => ({
+    method: spec.method,
+    side_effects: spec.side_effects,
+    account: spec.auth.account,
+    actor: spec.auth.actor,
+    roles: sorted_strings(spec.auth.roles),
+    credential_types: sorted_strings(spec.auth.credential_types),
+});
+/** Deterministic byte-lexicographic method order — matches the Rust `str::cmp` the stub sorts by. */
+const compare_method = (a, b) => a.method < b.method ? -1 : a.method > b.method ? 1 : 0;
+/**
+ * Build the normalized `ActionManifest` from a list of request-response
+ * specs. Entries are sorted by `method` so two impls producing the same set
+ * serialize identically regardless of mount order. The caller owns the scope
+ * it passes (the TS spine passes its full mount; the Rust stub filters
+ * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
+ */
+export const build_action_manifest = (specs) => ({
+    methods: specs.map(action_manifest_entry).sort(compare_method),
+});

package/dist/testing/cross_backend/action_manifest_parity.d.ts

@@ -0,0 +1,67 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl action-manifest parity — structural diff + assertion over two
+ * `ActionManifest`s captured via the `_testing_action_manifest` RPC action.
+ *
+ * The action-surface twin of `schema_parity.ts`: two live impls (the TS
+ * fuz_app spine and the Rust `testing_spine_stub`) are each other's parity
+ * reference. After both bootstrap, dump each one's live RPC method set, diff,
+ * fail loudly on drift. The diff entries name the specific divergence (a
+ * method only one impl mounts, a per-method auth-axis or side-effect
+ * mismatch) so the error message points at the source.
+ *
+ * ```ts
+ * const manifest_a = await capture_action_manifest(ts_handle);
+ * const manifest_b = await capture_action_manifest(rust_handle);
+ * assert_action_manifests_equal(manifest_a, manifest_b, {a: 'ts', b: 'rust'});
+ * ```
+ *
+ * Non-coverage: the manifest captures `{method, side_effects, account, actor,
+ * roles, credential_types}` — the wire-relevant auth shape. It does **not**
+ * capture input/output schemas (the declared-surface wire shape is gated by
+ * `rpc_round_trip`) nor the protocol actions `heartbeat` / `cancel` (excluded
+ * by construction — see `action_manifest.ts`).
+ *
+ * @module
+ */
+import type { ActionManifest } from './action_manifest.js';
+/** Structured drift entry. `where` is the named source impl ('a' or 'b'). */
+export type ActionManifestDiff = {
+    readonly kind: 'method_only_in';
+    readonly where: 'a' | 'b';
+    readonly method: string;
+} | {
+    readonly kind: 'side_effects_differ';
+    readonly method: string;
+    readonly a: boolean;
+    readonly b: boolean;
+} | {
+    readonly kind: 'auth_field_differs';
+    readonly method: string;
+    readonly field: 'account' | 'actor' | 'roles' | 'credential_types';
+    readonly a: unknown;
+    readonly b: unknown;
+};
+/**
+ * Structural diff between two manifests — empty array means parity holds.
+ *
+ * Order is deterministic: methods in sorted order, with each method's
+ * side-effect + auth-field sub-diffs grouped together.
+ */
+export declare const diff_action_manifests: (a: ActionManifest, b: ActionManifest) => Array<ActionManifestDiff>;
+/** Labels used in formatted output — defaults to `'a'` and `'b'`. */
+export interface ActionManifestDiffLabels {
+    readonly a?: string;
+    readonly b?: string;
+}
+/**
+ * Render a diff list as a human-readable multi-line string. Empty diffs
+ * produce an empty string.
+ */
+export declare const format_action_manifest_diffs: (diffs: ReadonlyArray<ActionManifestDiff>, labels?: ActionManifestDiffLabels) => string;
+/**
+ * Throw if the two manifests disagree. The error message names the impls
+ * (via `labels`) and lists every diff, so the failure is self-diagnosing.
+ */
+export declare const assert_action_manifests_equal: (a: ActionManifest, b: ActionManifest, labels?: ActionManifestDiffLabels) => void;
+//# sourceMappingURL=action_manifest_parity.d.ts.map

package/dist/testing/cross_backend/action_manifest_parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAsB,MAAM,sBAAsB,CAAC;AAW9E,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACrF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CA+B1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MA4BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAQF,CAAC"}