@fuzdev/fuz_app 0.90.0 → 0.91.0

package/dist/auth/CLAUDE.md

@@ -211,6 +211,13 @@ auth, ids)`: batched strict relation-read filter. Every relation read —
   `cell_item_actions.ts` / `cell_audit_actions.ts` — the relation + ACL +
   audit handlers, exporting `to_grant_json` / `to_field_json` /
   `to_item_json` reused by the `cell_get` bundle.
+- `auth/all_cell_actions.ts` — `create_all_cell_actions(deps, {roles})`, the
+  handler-side twin of `all_cell_action_specs` and sibling of
+  `create_standard_rpc_actions`: bundles all five cell factories (CRUD + grant
+  - field + item + audit) into one list. Reach for this whenever a backend
+    mounts the full cell layer — a single source so an HTTP-RPC mount and a WS
+    mount (or two backends) can't diverge on which cell verbs they expose.
+    Distinct from `create_cell_actions` (the CRUD-only factory it bundles).
 - `auth/cell_audit_metadata.ts` + `cell_grant_audit_metadata.ts` +
   `cell_field_audit_metadata.ts` + `cell_item_audit_metadata.ts` — audit
   metadata envelopes (IDs only), registered via `extra_events:` on the

package/dist/auth/all_cell_actions.d.ts

@@ -0,0 +1,35 @@
+import type { RpcAction } from '../actions/action_rpc.js';
+import { type CellActionDeps } from './cell_actions.js';
+import type { RoleSchemaResult } from './role_schema.js';
+/**
+ * Options for `create_all_cell_actions`.
+ *
+ * `roles` flows to the `cell_grant_*` sub-factory — actor-shaped grants are
+ * role-validated against this registry, so callers thread their app's role
+ * schema (the same one `create_standard_rpc_actions` takes).
+ */
+export interface AllCellActionsOptions {
+    readonly roles: RoleSchemaResult;
+}
+/**
+ * Build the full cell RPC action set — CRUD (`create_cell_actions`,
+ * which also carries `cell_clone`) + grant ACL + field + item relations +
+ * per-cell audit — as a single handler-bound bundle.
+ *
+ * The handler-side twin of the `all_cell_action_specs` spec bundle and the
+ * sibling of `create_standard_rpc_actions`. Assembling the five cell factories
+ * here means an HTTP-RPC mount and a WS mount (or two different backends)
+ * can't silently diverge on which cell verbs they expose — the
+ * `spine_method_coverage` reconciliation gate enforces that the spine's live
+ * mount matches its coverage manifest, and this aggregator is the single list
+ * every mount draws from.
+ *
+ * Distinct from `create_cell_actions` (the CRUD-only factory this bundles) —
+ * reach for this whenever a backend mounts the complete cell layer.
+ *
+ * @param deps - `CellActionDeps` (`log`, `audit`, optional `validate_data`)
+ * @param options - the role schema for grant validation
+ * @returns every cell `RpcAction`, in mount order
+ */
+export declare const create_all_cell_actions: (deps: CellActionDeps, options: AllCellActionsOptions) => Array<RpcAction>;
+//# sourceMappingURL=all_cell_actions.d.ts.map

package/dist/auth/all_cell_actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"all_cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_cell_actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,mBAAmB,CAAC;AAK3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,cAAc,EACpB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAMjB,CAAC"}

package/dist/auth/all_cell_actions.js

@@ -0,0 +1,32 @@
+import { create_cell_actions } from './cell_actions.js';
+import { create_cell_grant_actions } from './cell_grant_actions.js';
+import { create_cell_field_actions } from './cell_field_actions.js';
+import { create_cell_item_actions } from './cell_item_actions.js';
+import { create_cell_audit_actions } from './cell_audit_actions.js';
+/**
+ * Build the full cell RPC action set — CRUD (`create_cell_actions`,
+ * which also carries `cell_clone`) + grant ACL + field + item relations +
+ * per-cell audit — as a single handler-bound bundle.
+ *
+ * The handler-side twin of the `all_cell_action_specs` spec bundle and the
+ * sibling of `create_standard_rpc_actions`. Assembling the five cell factories
+ * here means an HTTP-RPC mount and a WS mount (or two different backends)
+ * can't silently diverge on which cell verbs they expose — the
+ * `spine_method_coverage` reconciliation gate enforces that the spine's live
+ * mount matches its coverage manifest, and this aggregator is the single list
+ * every mount draws from.
+ *
+ * Distinct from `create_cell_actions` (the CRUD-only factory this bundles) —
+ * reach for this whenever a backend mounts the complete cell layer.
+ *
+ * @param deps - `CellActionDeps` (`log`, `audit`, optional `validate_data`)
+ * @param options - the role schema for grant validation
+ * @returns every cell `RpcAction`, in mount order
+ */
+export const create_all_cell_actions = (deps, options) => [
+    ...create_cell_actions(deps),
+    ...create_cell_grant_actions({ ...deps, roles: options.roles }),
+    ...create_cell_field_actions(deps),
+    ...create_cell_item_actions(deps),
+    ...create_cell_audit_actions(),
+];

package/dist/testing/CLAUDE.md

@@ -222,7 +222,37 @@ test-only by construction.
 - `assert_schema_snapshots_equal(a, b, labels?)` — throws on drift with a fully-formatted diff message.
 - `SchemaDiff` — tagged-union per drift kind: `table_only_in`, `column_only_in`, `column_field_differs`, `index_only_in`, `index_definition_differs`, `constraint_only_in`, `constraint_differs`, `sequence_only_in`, `sequence_data_type_differs`, `enum_only_in`, `enum_labels_differ` (enum labels compared positionally — declared order is significant).
 
-fuz_app's own spine gates this cross-process via the `cross_backend_schema_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:schema-parity`. The forge has its own deno↔rust parity gate.
+fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. The forge has its own deno↔rust parity gate.
+
+## Cross-impl RPC-manifest parity
+
+The action-surface sibling of schema parity. Where schema parity diffs the live
+_database_ shape, this diffs the live _RPC registry_ shape — proving the TS
+spine and the Rust `testing_spine_stub` mount the same method set with the same
+per-method auth shape.
+
+- `cross_backend/action_manifest.ts` — `ActionManifest` / `ActionManifestEntry`
+  Zod schema (the `_testing_action_manifest` wire validator) + `build_action_manifest(specs)`,
+  which normalizes each spec to `{method, side_effects, account, actor, roles,
+credential_types}` (auth axes pass through; `roles` / `credential_types` flatten
+  to sorted arrays). Twin of `schema_introspect.ts`. Excludes the protocol actions
+  (`heartbeat` / `cancel`) by construction — the two impls organize them
+  differently (TS WS-only; Rust on one shared registry), so the caller passes a
+  protocol-free list.
+- `cross_backend/action_manifest_parity.ts` — `diff_action_manifests` /
+  `format_action_manifest_diffs` / `assert_action_manifests_equal` (twin of
+  `schema_parity.ts`) — asserts exact method-set + per-method auth-shape parity.
+- `cross_backend/setup.ts` `capture_action_manifest(handle)` — dumps a backend's
+  manifest over the daemon-token `_testing_action_manifest` channel (twin of
+  `capture_schema_snapshot`).
+
+It runs under the same dual-spawn `cross_backend_parity` project (one TS-spine +
+Rust-stub spawn serves both gates). It complements the in-repo
+`spine_method_coverage` reconciliation gate (which proves _mounted ⟹ covered_);
+this proves _TS-mount-set ≡ Rust-mount-set_. The gate asserts **exact** parity —
+every mounted method and its full auth shape (side-effects + the four auth axes)
+must match across the two impls, with no allowlisted divergences (see
+`action_manifest_parity.cross.test.ts`).
 
 **Cross-impl gate pattern** — a dual-impl consumer running two backends
 (a TS Hono server and a Rust spine server) against a shared schema, plus
@@ -861,18 +891,26 @@ source of truth for wire-shape conformance.
   deliver it.
 
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
-  (`bearer_auth` / `trusted_proxy` / `login_rate_limit` / `ws` / `sse` /
-  `cell_crud` / `cell_relations` / `account_lifecycle` / `fact_serving` /
-  `ready` / `account_status` / `oversized_reject_closes_connection`),
+  (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
+  `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
+  `oversized_reject_closes_connection` — each has a `test_if` reader),
   `test_if(cond, name, fn)`
-  for capability-gated cases, and `in_process_capabilities` preset. `cell_crud`
+  for capability-gated cases, and `in_process_capabilities` preset. The
+  non-gating wiring facts (`bearer_auth` / `trusted_proxy` / `login_rate_limit`,
+  no `test_if` readers) live in the parallel `BackendShapeNotes` record
+  (`in_process_shape_notes`; `ts_default_shape_notes` / `rust_default_shape_notes`
+  in `default_backend_configs.ts`) — split out so the capability type stops
+  claiming gating it doesn't do. `cell_crud`
   gates the CRUD parity suite, `cell_relations` the relation / ACL / audit
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
-  `account_delete` / `account_undelete` / `account_purge` parity suite) — also
-  off the declared surface like cells, `true` on every spine. `fact_serving`
+  `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
+  cells those verbs **are** on the declared surface (in `create_admin_actions`,
+  auto-enumerated for shape/auth) — the flag gates the behavioral parity the
+  generic round-trip can't drive (it can't delete the subject). `true` on every
+  spine. `fact_serving`
   gates `describe_fact_serving_cross_tests` (the cell-scoped per-reference +
   admin-only bare-hash fact-serving parity suite); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
@@ -1191,6 +1229,16 @@ in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.t
   payload-expiry tests never reached. Daemon-token-gated like its siblings; the
   Rust mirror is `fuz_testing::create_testing_mint_session_action_spec`.
 
+  Also in the module — but **not** bundled by `create_testing_actions` —
+  `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
+  dumps the live RPC registry as a normalized `ActionManifest` for the
+  cross-impl manifest-parity gate (see §Cross-impl RPC-manifest parity). It must
+  enumerate _every_ mounted method, which `create_testing_actions` (one
+  sub-factory) can't see, so it's appended at the full-mount layer
+  (`full_spine_mount.ts` `build_full_spine_rpc_actions`), closing over the
+  complete action list plus its own spec. Daemon-token-gated like its siblings;
+  the Rust mirror is `fuz_testing::create_testing_action_manifest_action_spec`.
+
 ### Origin verification parity — `cross_backend/origin.ts`
 
 `describe_origin_cross_tests({setup_test, capabilities, rpc_path?})` — the
@@ -1309,10 +1357,35 @@ re-roll the serve / daemon-info / WS-attach / drain boilerplate:
 - `testing/cross_backend/testing_server_node.ts` — `create_node_testing_adapter()` (`@hono/node-server` + `@hono/node-ws`). Optional peer deps (like `ws`); only test binaries import them.
 - `testing/cross_backend/testing_server_deno.ts` — `create_deno_testing_adapter()` (`Deno.serve` + `hono/deno`; `Deno` declared locally so it typechecks under the Node toolchain). Spawn the entry with `--sloppy-imports` (Deno doesn't do `.js`→`.ts`; Gro's loader does, so the Node path needs no flag).
 - `testing/cross_backend/testing_server_bun.ts` — `create_bun_testing_adapter()` (`Bun.serve` + `hono/bun`'s module-level `upgradeWebSocket` + `websocket`; `Bun.serve` declared locally so it typechecks under the Node toolchain). **No extra deps** (`hono/bun` ships with `hono`; `Bun.serve` is built in, unlike Node's `@hono/node-server` + `@hono/node-ws`), and Bun resolves `.js`→`.ts` natively (no flag, unlike Deno). Reuses `create_node_runtime` (Bun implements the `node:fs`/`node:process` surface). WS is module-level + stateless (like Deno) — the `websocket` handler is threaded into `serve`, where `Bun.serve` wants it, so no post-serve attach.
-- `testing/cross_backend/default_spine_surface.ts` — the canonical no-domain spine surface (account/admin/audit/signup + bootstrap): `spine_session_options`, `spine_roles`, `create_spine_route_specs`, `spine_rpc_endpoints`, `create_spine_surface_spec`. `$lib`-free (it's reached by the spawned binary under Gro's loader, which doesn't resolve `$lib`), so keep it on relative imports. Shared by the spine_stub cross test, the TS cross tests, and the binary.
+- `testing/cross_backend/default_spine_surface.ts` — the canonical no-domain spine surface (account/admin/audit/signup + bootstrap): `spine_session_options`, `spine_roles`, `create_spine_route_specs`, `spine_rpc_endpoints`, `create_spine_surface_spec`. This is the **declared** surface — the `create_standard_rpc_actions` bundle the spec-derived suites auto-enumerate. `$lib`-free (it's reached by the spawned binary under Gro's loader, which doesn't resolve `$lib`), so keep it on relative imports. Shared by the spine_stub cross test, the TS cross tests, and the binary.
+- `testing/cross_backend/full_spine_mount.ts` — `build_full_spine_rpc_actions(deps, options)` / `full_spine_rpc_endpoints(ctx, options)` — the **full** live RPC mount: the declared bundle **plus** the off-declared-surface families the binary live-mounts (`_testing_*` backdoors, the cell verb set, the opt-in `actor_lookup` / `actor_search` resolvers). Single-sources what was an inline assembly in `testing_spine_server.ts`, so the binary and the `spine_method_coverage` reconciliation test build the same list. Also `$lib`-free.
 - `testing/cross_backend/ts_spine_backend_config.ts` — `ts_spine_node_backend_config()` / `ts_spine_deno_backend_config()` / `ts_spine_bun_backend_config()` presets (in-memory PGlite, no external infra), the TS analog of `rust_spine_stub_backend_config()`.
 
-fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `_testing_reset` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic.
+fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `full_spine_rpc_endpoints` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic.
+
+### Live-method coverage reconciliation — `method_coverage.ts`
+
+`assert_rpc_method_coverage({live_methods, declared_methods, manifest})` keeps
+the **off-declared-surface** methods as drift-proof as the declared ones. The
+spec-derived suites auto-enumerate the declared surface, but a backend's live
+RPC endpoint also mounts methods kept off it (stateful cell verbs, opt-in
+resolvers, `_testing_*` backdoors) that rely on hand-wired imperative suites —
+nothing structurally guaranteed every live method was actually claimed by one.
+
+The assertion diffs the live method set against a `MethodCoverageEntry`
+manifest both directions (a mounted-but-unclaimed method **and** a stale
+manifest row both fail loud) and checks each entry's `tier`
+(`declared` / `off_surface` / `backdoor`) is consistent with the declared
+surface + the `_testing_` prefix. `off_surface` rows must name the covering
+`suite`; `capability` is typed `keyof BackendCapabilities` so a stale flag is a
+compile error. The manifest is the forcing function — a method can't reach the
+live mount without a row naming its coverage.
+
+Pairs with `surface_invariants.ts` `assert_no_testing_methods` (the _reverse_
+guard — a backdoor must never leak _onto_ the declared surface). fuz_app's own
+wiring is the manifest `src/test/cross_backend/spine_method_coverage.ts` + the
+no-DB reconciliation test `spine_method_coverage.test.ts`, which enumerates
+`build_full_spine_rpc_actions` with stub deps against `create_spine_surface_spec`.
 
 The in-process `ws_round_trip` harness stays (it drives the dispatcher
 against a fake upgrade, no wire), but the real-upgrade coverage now lives in

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -0,0 +1,113 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl RPC **action-manifest** introspection — a normalized,
+ * JSON-serializable dump of a backend's live RPC method set, one entry per
+ * method carrying its auth shape + side-effect flag.
+ *
+ * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
+ * captures the live *database* shape for the schema-parity gate, this
+ * captures the live *RPC registry* shape for the action-manifest parity gate.
+ * Both are dumped over a daemon-token `_testing_*` introspection action
+ * (`_testing_action_manifest` here, `_testing_schema_snapshot` there) and
+ * diffed across the TS spine and the Rust `testing_spine_stub` so a
+ * method-set or per-method auth-shape divergence fails loud. This complements
+ * the in-repo `spine_method_coverage` gate: that proves *mounted ⟹ covered*;
+ * this proves *TS-mount-set ≡ Rust-mount-set* (method set + auth shape).
+ *
+ * **Scope — domain + testing surface, not wire protocol.** The manifest is
+ * built from exactly the spec list its caller passes
+ * (`build_full_spine_rpc_actions` on the TS spine; the spec list minus
+ * `PROTOCOL_ACTION_SPECS` on the Rust stub). The protocol actions
+ * (`heartbeat` / `cancel`) are excluded by the caller on purpose: the two
+ * impls organize them differently (the TS spine mounts them on the WS
+ * endpoint only, never the HTTP-RPC endpoint; the Rust stub compiles one
+ * shared registry serving both transports), so including them would be a
+ * spurious cross-impl diff. This matches the scope of the in-repo
+ * `spine_method_coverage` gate (also over `build_full_spine_rpc_actions`).
+ *
+ * Paired with `action_manifest_parity.ts` for the diff + assertion helpers.
+ *
+ * `$lib`-free by contract — reached by the spawned TS binary (via
+ * `testing_reset_actions.ts` → `full_spine_mount.ts`), so every import is
+ * relative.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { type RouteAuth } from '../../http/auth_shape.js';
+import type { RequestResponseActionSpec } from '../../actions/action_spec.js';
+/**
+ * One method's normalized RPC metadata — the cross-impl-comparable unit.
+ * `roles` / `credential_types` are always present + sorted (an absent gate
+ * and an empty list both serialize to `[]`) so the diff never trips on a
+ * `undefined`-vs-`[]` or declaration-order difference between impls; the
+ * auth axes reuse the canonical `AuthAxisState` enum.
+ */
+export declare const ActionManifestEntry: z.ZodObject<{
+    /** RPC method name (`spec.method`). */
+    method: z.ZodString;
+    /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+    side_effects: z.ZodBoolean;
+    /** The `account` auth axis. */
+    account: z.ZodEnum<{
+        optional: "optional";
+        none: "none";
+        required: "required";
+    }>;
+    /** The `actor` auth axis. */
+    actor: z.ZodEnum<{
+        optional: "optional";
+        none: "none";
+        required: "required";
+    }>;
+    /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+    roles: z.ZodArray<z.ZodString>;
+    /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+    credential_types: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
+/** The full action manifest — every entry, sorted by `method`. */
+export declare const ActionManifest: z.ZodObject<{
+    methods: z.ZodArray<z.ZodObject<{
+        /** RPC method name (`spec.method`). */
+        method: z.ZodString;
+        /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+        side_effects: z.ZodBoolean;
+        /** The `account` auth axis. */
+        account: z.ZodEnum<{
+            optional: "optional";
+            none: "none";
+            required: "required";
+        }>;
+        /** The `actor` auth axis. */
+        actor: z.ZodEnum<{
+            optional: "optional";
+            none: "none";
+            required: "required";
+        }>;
+        /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+        roles: z.ZodArray<z.ZodString>;
+        /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+        credential_types: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ActionManifest = z.infer<typeof ActionManifest>;
+/**
+ * Normalize one spec's auth + side-effects into a manifest entry. Pulls the
+ * four auth axes off `RouteAuth` (the same shape the Rust `AuthSpec` mirrors)
+ * and flattens optional `roles` / `credential_types` to sorted arrays.
+ */
+export declare const action_manifest_entry: (spec: {
+    readonly method: string;
+    readonly auth: RouteAuth;
+    readonly side_effects: boolean;
+}) => ActionManifestEntry;
+/**
+ * Build the normalized `ActionManifest` from a list of request-response
+ * specs. Entries are sorted by `method` so two impls producing the same set
+ * serialize identically regardless of mount order. The caller owns the scope
+ * it passes (the TS spine passes its full mount; the Rust stub filters
+ * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
+ */
+export declare const build_action_manifest: (specs: ReadonlyArray<Pick<RequestResponseActionSpec, "method" | "auth" | "side_effects">>) => ActionManifest;
+//# sourceMappingURL=action_manifest.d.ts.map

package/dist/testing/cross_backend/action_manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action_manifest.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAgB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,8BAA8B,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;IAC/B,uCAAuC;;IAEvC,iGAAiG;;IAEjG,+BAA+B;;;;;;IAE/B,6BAA6B;;;;;;IAE7B,mFAAmF;;IAEnF,iFAAiF;;kBAEhF,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kEAAkE;AAClE,eAAO,MAAM,cAAc;;QAhB1B,uCAAuC;;QAEvC,iGAAiG;;QAEjG,+BAA+B;;;;;;QAE/B,6BAA6B;;;;;;QAE7B,mFAAmF;;QAEnF,iFAAiF;;;kBAQhF,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B,KAAG,mBAOF,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,aAAa,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,KACvF,cAED,CAAC"}

package/dist/testing/cross_backend/action_manifest.js

@@ -0,0 +1,89 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl RPC **action-manifest** introspection — a normalized,
+ * JSON-serializable dump of a backend's live RPC method set, one entry per
+ * method carrying its auth shape + side-effect flag.
+ *
+ * The sibling of `schema_introspect.ts`'s `SchemaSnapshot`: where that
+ * captures the live *database* shape for the schema-parity gate, this
+ * captures the live *RPC registry* shape for the action-manifest parity gate.
+ * Both are dumped over a daemon-token `_testing_*` introspection action
+ * (`_testing_action_manifest` here, `_testing_schema_snapshot` there) and
+ * diffed across the TS spine and the Rust `testing_spine_stub` so a
+ * method-set or per-method auth-shape divergence fails loud. This complements
+ * the in-repo `spine_method_coverage` gate: that proves *mounted ⟹ covered*;
+ * this proves *TS-mount-set ≡ Rust-mount-set* (method set + auth shape).
+ *
+ * **Scope — domain + testing surface, not wire protocol.** The manifest is
+ * built from exactly the spec list its caller passes
+ * (`build_full_spine_rpc_actions` on the TS spine; the spec list minus
+ * `PROTOCOL_ACTION_SPECS` on the Rust stub). The protocol actions
+ * (`heartbeat` / `cancel`) are excluded by the caller on purpose: the two
+ * impls organize them differently (the TS spine mounts them on the WS
+ * endpoint only, never the HTTP-RPC endpoint; the Rust stub compiles one
+ * shared registry serving both transports), so including them would be a
+ * spurious cross-impl diff. This matches the scope of the in-repo
+ * `spine_method_coverage` gate (also over `build_full_spine_rpc_actions`).
+ *
+ * Paired with `action_manifest_parity.ts` for the diff + assertion helpers.
+ *
+ * `$lib`-free by contract — reached by the spawned TS binary (via
+ * `testing_reset_actions.ts` → `full_spine_mount.ts`), so every import is
+ * relative.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { AuthAxisState } from '../../http/auth_shape.js';
+/**
+ * One method's normalized RPC metadata — the cross-impl-comparable unit.
+ * `roles` / `credential_types` are always present + sorted (an absent gate
+ * and an empty list both serialize to `[]`) so the diff never trips on a
+ * `undefined`-vs-`[]` or declaration-order difference between impls; the
+ * auth axes reuse the canonical `AuthAxisState` enum.
+ */
+export const ActionManifestEntry = z.strictObject({
+    /** RPC method name (`spec.method`). */
+    method: z.string(),
+    /** `true` when the action declares `side_effects` (mutation; POST-only on the RPC transport). */
+    side_effects: z.boolean(),
+    /** The `account` auth axis. */
+    account: AuthAxisState,
+    /** The `actor` auth axis. */
+    actor: AuthAxisState,
+    /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
+    roles: z.array(z.string()),
+    /** Permitted credential channels, sorted; `[]` when ungated (any credential). */
+    credential_types: z.array(z.string()),
+});
+/** The full action manifest — every entry, sorted by `method`. */
+export const ActionManifest = z.strictObject({
+    methods: z.array(ActionManifestEntry),
+});
+/** Sorted copy of a readonly string list (stable cross-impl ordering). */
+const sorted_strings = (xs) => [...(xs ?? [])].sort();
+/**
+ * Normalize one spec's auth + side-effects into a manifest entry. Pulls the
+ * four auth axes off `RouteAuth` (the same shape the Rust `AuthSpec` mirrors)
+ * and flattens optional `roles` / `credential_types` to sorted arrays.
+ */
+export const action_manifest_entry = (spec) => ({
+    method: spec.method,
+    side_effects: spec.side_effects,
+    account: spec.auth.account,
+    actor: spec.auth.actor,
+    roles: sorted_strings(spec.auth.roles),
+    credential_types: sorted_strings(spec.auth.credential_types),
+});
+/** Deterministic byte-lexicographic method order — matches the Rust `str::cmp` the stub sorts by. */
+const compare_method = (a, b) => a.method < b.method ? -1 : a.method > b.method ? 1 : 0;
+/**
+ * Build the normalized `ActionManifest` from a list of request-response
+ * specs. Entries are sorted by `method` so two impls producing the same set
+ * serialize identically regardless of mount order. The caller owns the scope
+ * it passes (the TS spine passes its full mount; the Rust stub filters
+ * `PROTOCOL_ACTION_SPECS` first) — see the module doc.
+ */
+export const build_action_manifest = (specs) => ({
+    methods: specs.map(action_manifest_entry).sort(compare_method),
+});

package/dist/testing/cross_backend/action_manifest_parity.d.ts

@@ -0,0 +1,67 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-impl action-manifest parity — structural diff + assertion over two
+ * `ActionManifest`s captured via the `_testing_action_manifest` RPC action.
+ *
+ * The action-surface twin of `schema_parity.ts`: two live impls (the TS
+ * fuz_app spine and the Rust `testing_spine_stub`) are each other's parity
+ * reference. After both bootstrap, dump each one's live RPC method set, diff,
+ * fail loudly on drift. The diff entries name the specific divergence (a
+ * method only one impl mounts, a per-method auth-axis or side-effect
+ * mismatch) so the error message points at the source.
+ *
+ * ```ts
+ * const manifest_a = await capture_action_manifest(ts_handle);
+ * const manifest_b = await capture_action_manifest(rust_handle);
+ * assert_action_manifests_equal(manifest_a, manifest_b, {a: 'ts', b: 'rust'});
+ * ```
+ *
+ * Non-coverage: the manifest captures `{method, side_effects, account, actor,
+ * roles, credential_types}` — the wire-relevant auth shape. It does **not**
+ * capture input/output schemas (the declared-surface wire shape is gated by
+ * `rpc_round_trip`) nor the protocol actions `heartbeat` / `cancel` (excluded
+ * by construction — see `action_manifest.ts`).
+ *
+ * @module
+ */
+import type { ActionManifest } from './action_manifest.js';
+/** Structured drift entry. `where` is the named source impl ('a' or 'b'). */
+export type ActionManifestDiff = {
+    readonly kind: 'method_only_in';
+    readonly where: 'a' | 'b';
+    readonly method: string;
+} | {
+    readonly kind: 'side_effects_differ';
+    readonly method: string;
+    readonly a: boolean;
+    readonly b: boolean;
+} | {
+    readonly kind: 'auth_field_differs';
+    readonly method: string;
+    readonly field: 'account' | 'actor' | 'roles' | 'credential_types';
+    readonly a: unknown;
+    readonly b: unknown;
+};
+/**
+ * Structural diff between two manifests — empty array means parity holds.
+ *
+ * Order is deterministic: methods in sorted order, with each method's
+ * side-effect + auth-field sub-diffs grouped together.
+ */
+export declare const diff_action_manifests: (a: ActionManifest, b: ActionManifest) => Array<ActionManifestDiff>;
+/** Labels used in formatted output — defaults to `'a'` and `'b'`. */
+export interface ActionManifestDiffLabels {
+    readonly a?: string;
+    readonly b?: string;
+}
+/**
+ * Render a diff list as a human-readable multi-line string. Empty diffs
+ * produce an empty string.
+ */
+export declare const format_action_manifest_diffs: (diffs: ReadonlyArray<ActionManifestDiff>, labels?: ActionManifestDiffLabels) => string;
+/**
+ * Throw if the two manifests disagree. The error message names the impls
+ * (via `labels`) and lists every diff, so the failure is self-diagnosing.
+ */
+export declare const assert_action_manifests_equal: (a: ActionManifest, b: ActionManifest, labels?: ActionManifestDiffLabels) => void;
+//# sourceMappingURL=action_manifest_parity.d.ts.map

package/dist/testing/cross_backend/action_manifest_parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action_manifest_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/action_manifest_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAsB,MAAM,sBAAsB,CAAC;AAW9E,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC3B;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACrF;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,kBAAkB,CAAC;IACnE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAML;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,GAAG,cAAc,EACjB,GAAG,cAAc,KACf,KAAK,CAAC,kBAAkB,CA+B1B,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,aAAa,CAAC,kBAAkB,CAAC,EACxC,SAAQ,wBAA6B,KACnC,MA4BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,wBAA6B,KACnC,IAQF,CAAC"}

package/dist/testing/cross_backend/action_manifest_parity.js

@@ -0,0 +1,88 @@
+import '../assert_dev_env.js';
+/** The auth axes compared as scalars (`'none' | 'optional' | 'required'`). */
+const AUTH_SCALAR_FIELDS = ['account', 'actor'];
+/** The auth axes compared as sorted string lists. */
+const AUTH_LIST_FIELDS = ['roles', 'credential_types'];
+/** Positional string-list equality (entries are pre-sorted by `build_action_manifest`). */
+const string_lists_equal = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+/**
+ * Structural diff between two manifests — empty array means parity holds.
+ *
+ * Order is deterministic: methods in sorted order, with each method's
+ * side-effect + auth-field sub-diffs grouped together.
+ */
+export const diff_action_manifests = (a, b) => {
+    const diffs = [];
+    const a_by = new Map(a.methods.map((m) => [m.method, m]));
+    const b_by = new Map(b.methods.map((m) => [m.method, m]));
+    const all_methods = new Set([...a_by.keys(), ...b_by.keys()]);
+    for (const method of [...all_methods].sort()) {
+        const ea = a_by.get(method);
+        const eb = b_by.get(method);
+        if (!ea) {
+            diffs.push({ kind: 'method_only_in', where: 'b', method });
+            continue;
+        }
+        if (!eb) {
+            diffs.push({ kind: 'method_only_in', where: 'a', method });
+            continue;
+        }
+        if (ea.side_effects !== eb.side_effects) {
+            diffs.push({ kind: 'side_effects_differ', method, a: ea.side_effects, b: eb.side_effects });
+        }
+        for (const field of AUTH_SCALAR_FIELDS) {
+            if (ea[field] !== eb[field]) {
+                diffs.push({ kind: 'auth_field_differs', method, field, a: ea[field], b: eb[field] });
+            }
+        }
+        for (const field of AUTH_LIST_FIELDS) {
+            if (!string_lists_equal(ea[field], eb[field])) {
+                diffs.push({ kind: 'auth_field_differs', method, field, a: ea[field], b: eb[field] });
+            }
+        }
+    }
+    return diffs;
+};
+/**
+ * Render a diff list as a human-readable multi-line string. Empty diffs
+ * produce an empty string.
+ */
+export const format_action_manifest_diffs = (diffs, labels = {}) => {
+    if (diffs.length === 0)
+        return '';
+    const label_a = labels.a ?? 'a';
+    const label_b = labels.b ?? 'b';
+    const where_label = (where) => (where === 'a' ? label_a : label_b);
+    const lines = [];
+    for (const d of diffs) {
+        switch (d.kind) {
+            case 'method_only_in':
+                lines.push(`  method ${d.method} only in ${where_label(d.where)}`);
+                break;
+            case 'side_effects_differ':
+                lines.push(`  ${d.method} side_effects differs: ${label_a}=${d.a}, ${label_b}=${d.b}`);
+                break;
+            case 'auth_field_differs':
+                lines.push(`  ${d.method} auth.${d.field} differs: ${label_a}=${JSON.stringify(d.a)}, ${label_b}=${JSON.stringify(d.b)}`);
+                break;
+            default:
+                // Compile-time exhaustiveness — a new variant without a case here
+                // makes `d` non-never and fails type-check.
+                d;
+                break;
+        }
+    }
+    return lines.join('\n');
+};
+/**
+ * Throw if the two manifests disagree. The error message names the impls
+ * (via `labels`) and lists every diff, so the failure is self-diagnosing.
+ */
+export const assert_action_manifests_equal = (a, b, labels = {}) => {
+    const diffs = diff_action_manifests(a, b);
+    if (diffs.length === 0)
+        return;
+    const label_a = labels.a ?? 'a';
+    const label_b = labels.b ?? 'b';
+    throw new Error(`Action-manifest parity failed: ${diffs.length} diff(s) between ${label_a} and ${label_b}\n${format_action_manifest_diffs(diffs, labels)}`);
+};