@fuzdev/fuz_app 0.90.0 → 0.91.0

package/dist/testing/cross_backend/capabilities.d.ts

@@ -1,40 +1,45 @@
 import '../assert_dev_env.js';
 /**
- * Optional behaviors a backend may support. Each flag's TSDoc names the
- * tests that gate on it; add a new flag here before referencing it from
- * a suite body, and document the gating tests inline.
+ * Backend wiring facts recorded for documentation — **not** gating flags.
+ *
+ * The companion to `BackendCapabilities`: where each capability flag has a
+ * `test_if(capabilities.X, ...)` reader that skips a suite the backend doesn't
+ * implement, nothing reads these. They record middleware / limiter wiring that
+ * differs between the TS and Rust families (a backend-shape record) but gates
+ * no cross test today. They live in their own type precisely so
+ * `BackendCapabilities` stops claiming gating power it doesn't have — fold a
+ * flag in here the moment it has no `test_if` reader, and promote it back the
+ * day a suite genuinely gates on it.
  */
-export interface BackendCapabilities {
+export interface BackendShapeNotes {
     /**
-     * Bearer token auth (`Authorization: Bearer <token>`) is wired through
-     * the backend's middleware stack.
-     *
-     * **Declared for backend-shape documentation, not gating.** No suite reads
-     * this flag — the bearer-token cases in `describe_standard_integration_tests`
-     * / `describe_rate_limiting_tests` run unconditionally (every spine wires
-     * bearer auth). Fold into a typed capability taxonomy if these gain real
-     * gating readers.
+     * Bearer-token auth (`Authorization: Bearer <token>`) is wired through the
+     * backend's middleware stack. `true` on every spine — the bearer-token cases
+     * in `describe_standard_integration_tests` / `describe_rate_limiting_tests`
+     * run unconditionally.
      */
     readonly bearer_auth: boolean;
     /**
-     * Trusted-proxy XFF parsing is wired (`X-Forwarded-For` etc.).
-     *
-     * **Declared for backend-shape documentation, not gating.** No suite reads
-     * this flag (there is no cross-process proxy-resolution suite); it records
-     * the proxy-default difference between the TS family (`false`) and the Rust
-     * family (`true`). Fold into a typed capability taxonomy if it gains real
-     * gating readers.
+     * Trusted-proxy XFF parsing (`X-Forwarded-For` etc.) is wired. Records the
+     * proxy-default difference between the TS family (`false` — the test binary
+     * leaves proxy parsing off) and the Rust family (`true` — the client-IP
+     * middleware is always wired; the env-gate only chooses XFF vs the TCP peer).
      */
     readonly trusted_proxy: boolean;
     /**
-     * Per-account login rate limiting is wired.
-     *
-     * **Declared for backend-shape documentation, not gating.** No suite reads
-     * this flag; the `describe_rate_limiting_tests` per-account cases are
-     * in-process-only and don't cross a process boundary. Fold into a typed
-     * capability taxonomy if it gains real gating readers.
+     * Per-account login rate limiting is wired. `false` for the TS family (the
+     * canonical path leaves the limiter null in test mode), `true` for the Rust
+     * family (env-gated bucket on `/login` + `/password`).
      */
     readonly login_rate_limit: boolean;
+}
+/**
+ * Optional behaviors a backend may support. Each flag's TSDoc names the
+ * tests that gate on it; add a new flag here before referencing it from
+ * a suite body, and document the gating tests inline. Wiring facts that gate
+ * nothing belong in `BackendShapeNotes`, not here.
+ */
+export interface BackendCapabilities {
     /**
      * WebSocket transport is reachable end-to-end. Gates the cross-process
      * WS round-trip suite; the in-process `describe_ws_round_trip_tests`
@@ -73,10 +78,16 @@ export interface BackendCapabilities {
      * The account-lifecycle admin verbs (`account_delete` soft-delete,
      * `account_undelete` reactivation, `account_purge` keeper hard-delete)
      * are live-mounted on the backend's RPC path. Gates the dedicated
-     * `describe_account_lifecycle_cross_tests` suite. Like cells, these
-     * destructive/stateful verbs stay off the standard declared surface (the
-     * generic round-trip can't drive them — they delete the subject), so
-     * this flag opts a backend into the lifecycle parity coverage.
+     * `describe_account_lifecycle_cross_tests` suite.
+     *
+     * Unlike cells / fact-serving / ws / sse, these verbs **are** on the
+     * standard declared surface — they live in `create_admin_actions`, so
+     * `create_spine_surface_spec` carries them and the spec-derived round-trip
+     * + attack-surface suites already auto-enumerate their wire shape + auth.
+     * This flag gates the *behavioral* parity the generic round-trip can't
+     * provide: it can't drive verbs that delete their own subject (soft-delete →
+     * undelete round-trip, keeper-confirmed purge, the keeper-guard refusal), so
+     * the dedicated cross suite adds them.
      */
     readonly account_lifecycle: boolean;
     /**
@@ -136,13 +147,19 @@ export interface BackendCapabilities {
  * declare each flag explicitly per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
+/**
+ * Shape notes for the in-process Hono transport — every wiring fact present
+ * (the in-process app exercises the full middleware stack). Documentation
+ * only, like every `BackendShapeNotes` (nothing reads it).
+ */
+export declare const in_process_shape_notes: BackendShapeNotes;
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still
  * surfaces the gated coverage in the report.
  *
  * Thin wrapper around vitest's `test.skipIf(!cond)` with the argument
- * order flipped to match the more readable `test_if(capabilities.bearer_auth, ...)`
+ * order flipped to match the more readable `test_if(capabilities.ws, ...)`
  * call pattern.
  */
 export declare const test_if: (cond: boolean, name: string, fn: () => void | Promise<void>) => void;

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgC9B;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAapC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAUpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -24,6 +24,14 @@ import '../assert_dev_env.js';
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
  *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
  *
+ * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
+ * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader).
+ * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
+ * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
+ * (`in_process_shape_notes` here, `ts_default_shape_notes` /
+ * `rust_default_shape_notes` in `default_backend_configs.ts`) so the
+ * capability type never claims gating power it doesn't have.
+ *
  * @module
  */
 import { test } from 'vitest';
@@ -34,9 +42,6 @@ import { test } from 'vitest';
  * declare each flag explicitly per backend.
  */
 export const in_process_capabilities = Object.freeze({
-    bearer_auth: true,
-    trusted_proxy: true,
-    login_rate_limit: true,
     ws: true,
     sse: true,
     cell_crud: true,
@@ -47,13 +52,23 @@ export const in_process_capabilities = Object.freeze({
     account_status: true,
     oversized_reject_closes_connection: true,
 });
+/**
+ * Shape notes for the in-process Hono transport — every wiring fact present
+ * (the in-process app exercises the full middleware stack). Documentation
+ * only, like every `BackendShapeNotes` (nothing reads it).
+ */
+export const in_process_shape_notes = Object.freeze({
+    bearer_auth: true,
+    trusted_proxy: true,
+    login_rate_limit: true,
+});
 /**
  * Conditional `test()` wrapper — registers a vitest case only when
  * `cond` is true; otherwise registers it as `.skip` so the run still
  * surfaces the gated coverage in the report.
  *
  * Thin wrapper around vitest's `test.skipIf(!cond)` with the argument
- * order flipped to match the more readable `test_if(capabilities.bearer_auth, ...)`
+ * order flipped to match the more readable `test_if(capabilities.ws, ...)`
  * call pattern.
  */
 export const test_if = (cond, name, fn) => {

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -11,13 +11,15 @@ import '../assert_dev_env.js';
  *
  * Defaults baked in by family:
  *
- * - **TS** — `'memory://'` PGlite, 30s startup window, capabilities
- *   without trusted_proxy/login_rate_limit. The TS canonical path
- *   leaves these limiters null in test mode.
+ * - **TS** — `'memory://'` PGlite, 30s startup window. Its shape notes
+ *   (`ts_default_shape_notes`) record `trusted_proxy: false` /
+ *   `login_rate_limit: false` — the TS canonical path leaves those limiters
+ *   null in test mode.
  * - **Rust** — caller-supplied real Postgres URL (PGlite isn't reachable
- *   from `tokio-postgres`), 120s startup window (cargo first-build cost),
- *   capabilities including trusted_proxy + login_rate_limit + the
- *   `FUZ_TESTING_RESET_DB_ON_STARTUP=true` self-wipe gate.
+ *   from `tokio-postgres`), 120s startup window (cargo first-build cost), the
+ *   `FUZ_TESTING_RESET_DB_ON_STARTUP=true` self-wipe gate, and shape notes
+ *   (`rust_default_shape_notes`) recording `trusted_proxy: true` +
+ *   `login_rate_limit: true`.
  *
  * Both builders default `port_env_var` to `'PORT'`. Consumers whose
  * binary reads a different name (e.g. zzz's `ZZZ_PORT`) override.
@@ -31,22 +33,36 @@ import '../assert_dev_env.js';
  * @module
  */
 import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
-import type { BackendCapabilities } from './capabilities.js';
+import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
 import { type TestBackendPaths } from './build_test_backend_paths.js';
 /**
- * Capabilities shared by TS-family backends — same canonical
- * implementation, same feature set. No trusted-proxy phase (the test
- * binary doesn't enable proxy parsing) and no per-account login rate
- * limit (the TS canonical path leaves the limiter null in test mode).
+ * Capabilities shared by TS-family backends — same canonical implementation,
+ * same feature set. The non-gating wiring facts (`bearer_auth` /
+ * `trusted_proxy` / `login_rate_limit`) live in `ts_default_shape_notes`.
  */
 export declare const ts_default_capabilities: BackendCapabilities;
 /**
- * Capabilities for the Rust family. Adds `trusted_proxy: true` (the
- * Rust spine's client-IP middleware is always wired; the env-gate just
- * controls whether XFF is consulted vs the TCP peer IP) and
- * `login_rate_limit: true` (env-gated bucket on `/login` + `/password`).
+ * Capabilities for the Rust family. The non-gating wiring facts live in
+ * `rust_default_shape_notes` (which records the family's `trusted_proxy` +
+ * `login_rate_limit` differences from the TS family).
  */
 export declare const rust_default_capabilities: BackendCapabilities;
+/**
+ * Shape notes for TS-family backends — wiring facts, not gating flags.
+ * `trusted_proxy: false` (the test binary doesn't enable proxy parsing) and
+ * `login_rate_limit: false` (the TS canonical path leaves the limiter null in
+ * test mode); bearer auth is always wired. Documentation only — see
+ * `BackendShapeNotes`.
+ */
+export declare const ts_default_shape_notes: BackendShapeNotes;
+/**
+ * Shape notes for Rust-family backends — wiring facts, not gating flags. Adds
+ * `trusted_proxy: true` (the Rust spine's client-IP middleware is always wired;
+ * the env-gate only chooses XFF vs the TCP peer IP) and `login_rate_limit: true`
+ * (env-gated bucket on `/login` + `/password`). Documentation only — see
+ * `BackendShapeNotes`.
+ */
+export declare const rust_default_shape_notes: BackendShapeNotes;
 export interface MakeDefaultTsBackendConfigOptions {
     /** Diagnostic label; also used as the tmpdir prefix when `paths` is omitted. */
     readonly name: string;

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAoBpC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -2,15 +2,11 @@ import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { default_test_bootstrap_token, default_test_cookie_keys, default_test_keeper_password, default_test_keeper_username, } from './default_secrets.js';
 /**
- * Capabilities shared by TS-family backends — same canonical
- * implementation, same feature set. No trusted-proxy phase (the test
- * binary doesn't enable proxy parsing) and no per-account login rate
- * limit (the TS canonical path leaves the limiter null in test mode).
+ * Capabilities shared by TS-family backends — same canonical implementation,
+ * same feature set. The non-gating wiring facts (`bearer_auth` /
+ * `trusted_proxy` / `login_rate_limit`) live in `ts_default_shape_notes`.
  */
 export const ts_default_capabilities = Object.freeze({
-    bearer_auth: true,
-    trusted_proxy: false,
-    login_rate_limit: false,
     ws: true,
     sse: false,
     cell_crud: true,
@@ -29,15 +25,11 @@ export const ts_default_capabilities = Object.freeze({
     oversized_reject_closes_connection: true,
 });
 /**
- * Capabilities for the Rust family. Adds `trusted_proxy: true` (the
- * Rust spine's client-IP middleware is always wired; the env-gate just
- * controls whether XFF is consulted vs the TCP peer IP) and
- * `login_rate_limit: true` (env-gated bucket on `/login` + `/password`).
+ * Capabilities for the Rust family. The non-gating wiring facts live in
+ * `rust_default_shape_notes` (which records the family's `trusted_proxy` +
+ * `login_rate_limit` differences from the TS family).
  */
 export const rust_default_capabilities = Object.freeze({
-    bearer_auth: true,
-    trusted_proxy: true,
-    login_rate_limit: true,
     ws: true,
     sse: false,
     cell_crud: true,
@@ -54,6 +46,30 @@ export const rust_default_capabilities = Object.freeze({
     // and the pipelined request is never reached.
     oversized_reject_closes_connection: true,
 });
+/**
+ * Shape notes for TS-family backends — wiring facts, not gating flags.
+ * `trusted_proxy: false` (the test binary doesn't enable proxy parsing) and
+ * `login_rate_limit: false` (the TS canonical path leaves the limiter null in
+ * test mode); bearer auth is always wired. Documentation only — see
+ * `BackendShapeNotes`.
+ */
+export const ts_default_shape_notes = Object.freeze({
+    bearer_auth: true,
+    trusted_proxy: false,
+    login_rate_limit: false,
+});
+/**
+ * Shape notes for Rust-family backends — wiring facts, not gating flags. Adds
+ * `trusted_proxy: true` (the Rust spine's client-IP middleware is always wired;
+ * the env-gate only chooses XFF vs the TCP peer IP) and `login_rate_limit: true`
+ * (env-gated bucket on `/login` + `/password`). Documentation only — see
+ * `BackendShapeNotes`.
+ */
+export const rust_default_shape_notes = Object.freeze({
+    bearer_auth: true,
+    trusted_proxy: true,
+    login_rate_limit: true,
+});
 /** Bootstrap block built from the default secrets + supplied paths. */
 const build_default_bootstrap = (paths, overrides) => ({
     token_path: paths.bootstrap_token_path,

package/dist/testing/cross_backend/full_spine_mount.d.ts

@@ -0,0 +1,81 @@
+import '../assert_dev_env.js';
+/**
+ * The **full** live RPC mount for fuz_app's own spine test binary — the
+ * complete action set `testing_spine_server.ts` exposes on a single RPC
+ * endpoint, in one place.
+ *
+ * Where `default_spine_surface.ts` defines the **declared** surface
+ * (`create_spine_surface_spec` / `spine_rpc_endpoints` — the
+ * `create_standard_rpc_actions` bundle the spec-derived suites
+ * auto-enumerate), this module defines its superset: the standard bundle
+ * **plus** the families the binary live-mounts but keeps off the declared
+ * surface —
+ *
+ * - the `_testing_*` daemon-token backdoors (`create_testing_actions`),
+ * - the full cell verb set (CRUD + grant + field + item + audit),
+ * - the opt-in `actor_lookup` / `actor_search` resolvers,
+ * - the `_testing_action_manifest` backdoor, appended last (it dumps the live
+ *   method set for the cross-impl manifest-parity gate, so it must enumerate
+ *   every method above it).
+ *
+ * Single-sourcing the mount here lets the binary, the in-process parity
+ * setup, and the `spine_method_coverage` reconciliation test all build the
+ * same list — so a method can never be mounted in one place and forgotten
+ * in another. The reconciliation test enumerates `build_full_spine_rpc_actions`
+ * with stub deps and asserts the live method set equals the tagged coverage
+ * manifest; see `src/test/cross_backend/spine_method_coverage.ts`.
+ *
+ * **`$lib`-free by contract** — like `default_spine_surface.ts`, this module
+ * is reached by the spawned TS binary under Gro's loader (which resolves
+ * `.js`→`.ts` but not the `$lib` alias), so every import is relative. Keep
+ * it that way.
+ *
+ * @module
+ */
+import type { RpcAction } from '../../actions/action_rpc.js';
+import type { AppDeps } from '../../auth/deps.js';
+import type { DaemonTokenState } from '../../auth/daemon_token.js';
+import type { NotificationSender } from '../../auth/role_grant_offer_notifications.js';
+import type { RpcEndpointSpec } from '../../http/surface.js';
+import type { AppServerContext } from '../../server/app_server_context.js';
+/** Options for {@link build_full_spine_rpc_actions} / {@link full_spine_rpc_endpoints}. */
+export interface FullSpineMountOptions {
+    /**
+     * Daemon-token runtime state threaded into `create_testing_actions` — the
+     * `_testing_reset` handler mutates `keeper_account_id` after re-seeding.
+     * Pass the same instance the daemon-token middleware reads. For the
+     * coverage test (method enumeration only, handlers never run) any stub
+     * state satisfies it.
+     */
+    readonly daemon_token_state: DaemonTokenState;
+    /**
+     * WS notification sender for the role-grant-offer fan-out. Pass the SAME
+     * `BackendWebsocketTransport` the WS endpoint registers connections against
+     * (the transport is the connection registry). Omitted for enumeration.
+     */
+    readonly notification_sender?: NotificationSender | null;
+}
+/**
+ * Build the complete live RPC action list the spine test binary mounts on
+ * its single endpoint: the declared `create_standard_rpc_actions` bundle plus
+ * the off-surface families (`_testing_*` backdoors, cells, actor resolvers).
+ *
+ * Mirrors the previous inline assembly in `testing_spine_server.ts` exactly —
+ * `session_options` is pinned to `spine_session_options` (the binary's cookie
+ * config) and `roles` to `spine_roles` (carrying `cell_editor`), so the only
+ * runtime-varying inputs are the daemon-token state + notification sender.
+ *
+ * @param deps - the backend `AppDeps` (stub deps suffice for method enumeration)
+ * @param options - daemon-token state + optional WS notification sender
+ * @returns every `RpcAction` the binary exposes, in mount order
+ */
+export declare const build_full_spine_rpc_actions: (deps: AppDeps, options: FullSpineMountOptions) => Array<RpcAction>;
+/**
+ * Factory-form full mount at {@link SPINE_RPC_PATH}, the shape
+ * `create_app_server`'s `rpc_endpoints` slot accepts. The spine binary wires
+ * this directly; the surface builder (`create_spine_surface_spec`) keeps using
+ * the narrower `spine_rpc_endpoints` so the declared surface stays the
+ * standard bundle only.
+ */
+export declare const full_spine_rpc_endpoints: (ctx: AppServerContext, options: FullSpineMountOptions) => Array<RpcEndpointSpec>;
+//# sourceMappingURL=full_spine_mount.d.ts.map

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAOzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoBjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -0,0 +1,49 @@
+import '../assert_dev_env.js';
+import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js';
+import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
+import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
+import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
+import { create_testing_action_manifest_action, create_testing_actions, } from './testing_reset_actions.js';
+import { SPINE_RPC_PATH, spine_roles, spine_session_options } from './default_spine_surface.js';
+/**
+ * Build the complete live RPC action list the spine test binary mounts on
+ * its single endpoint: the declared `create_standard_rpc_actions` bundle plus
+ * the off-surface families (`_testing_*` backdoors, cells, actor resolvers).
+ *
+ * Mirrors the previous inline assembly in `testing_spine_server.ts` exactly —
+ * `session_options` is pinned to `spine_session_options` (the binary's cookie
+ * config) and `roles` to `spine_roles` (carrying `cell_editor`), so the only
+ * runtime-varying inputs are the daemon-token state + notification sender.
+ *
+ * @param deps - the backend `AppDeps` (stub deps suffice for method enumeration)
+ * @param options - daemon-token state + optional WS notification sender
+ * @returns every `RpcAction` the binary exposes, in mount order
+ */
+export const build_full_spine_rpc_actions = (deps, options) => {
+    const actions = [
+        ...create_standard_rpc_actions({ ...deps, notification_sender: options.notification_sender ?? null }, { roles: spine_roles }),
+        ...create_testing_actions(deps, {
+            session_options: spine_session_options,
+            daemon_token_state: options.daemon_token_state,
+        }),
+        ...create_all_cell_actions(deps, { roles: spine_roles }),
+        ...create_actor_lookup_actions(deps),
+        ...create_actor_search_actions(deps),
+    ];
+    // Append the `_testing_action_manifest` backdoor last — it closes over the
+    // complete `actions` list (plus its own spec) to dump the live method set
+    // for the cross-impl manifest-parity gate, so it must come after every
+    // method it enumerates.
+    actions.push(create_testing_action_manifest_action(actions));
+    return actions;
+};
+/**
+ * Factory-form full mount at {@link SPINE_RPC_PATH}, the shape
+ * `create_app_server`'s `rpc_endpoints` slot accepts. The spine binary wires
+ * this directly; the surface builder (`create_spine_surface_spec`) keeps using
+ * the narrower `spine_rpc_endpoints` so the declared surface stays the
+ * standard bundle only.
+ */
+export const full_spine_rpc_endpoints = (ctx, options) => [
+    { path: SPINE_RPC_PATH, actions: build_full_spine_rpc_actions(ctx.deps, options) },
+];

package/dist/testing/cross_backend/method_coverage.d.ts

@@ -0,0 +1,71 @@
+import '../assert_dev_env.js';
+import type { BackendCapabilities } from './capabilities.js';
+/** How a live-mounted RPC method earns its cross-backend coverage. */
+export type MethodCoverageTier = 
+/**
+ * On the declared surface (`create_spine_surface_spec`). Auto-enumerated by
+ * the spec-derived round-trip + attack-surface suites — no bespoke suite
+ * needed.
+ */
+'declared'
+/**
+ * Live-mounted but deliberately off the declared surface (stateful or
+ * opt-in). Covered only by a dedicated imperative `describe_*_cross_tests`
+ * suite, so the entry must name it.
+ */
+ | 'off_surface'
+/**
+ * A `_testing_*` daemon-token backdoor — live-mounted on the test binary,
+ * never on the declared surface. Coverage is the credential-gate suite plus
+ * the in-process spec-level gate test.
+ */
+ | 'backdoor';
+/** One row of the live-RPC-method coverage manifest. */
+export interface MethodCoverageEntry {
+    /** The RPC method name (`action.spec.method`). */
+    readonly method: string;
+    /** How this method is covered. */
+    readonly tier: MethodCoverageTier;
+    /**
+     * The `BackendCapabilities` flag gating this method's cross suite, when it
+     * is capability-gated. Typed against the real interface so a stale flag is a
+     * compile error. Omit for ungated off-surface families (always-mounted, the
+     * suite runs unconditionally) and for declared / backdoor tiers.
+     */
+    readonly capability?: keyof BackendCapabilities;
+    /**
+     * The cross-backend suite (or test file) that covers this method.
+     * **Required** for `off_surface` — the manifest's whole point is to name the
+     * suite a method without auto-enumeration relies on. Optional for
+     * `declared` (auto-enumerated) / `backdoor` (infra).
+     */
+    readonly suite?: string;
+    /** Optional free-text note printed nowhere — documentation for the reader. */
+    readonly note?: string;
+}
+/** Inputs for {@link assert_rpc_method_coverage}. */
+export interface RpcMethodCoverageInput {
+    /** Every method the live RPC endpoint mounts (`action.spec.method`). */
+    readonly live_methods: ReadonlyArray<string>;
+    /** The declared-surface method names (from `create_*_surface_spec`). */
+    readonly declared_methods: ReadonlyArray<string>;
+    /** The tagged manifest the live set must reconcile against. */
+    readonly manifest: ReadonlyArray<MethodCoverageEntry>;
+    /** Backdoor method prefix. Defaults to `'_testing_'`. */
+    readonly testing_method_prefix?: string;
+}
+/**
+ * Assert the live RPC method set reconciles exactly with the coverage
+ * manifest, and that every manifest entry's tier is internally consistent.
+ *
+ * Fails loud on: a live method missing from the manifest (mounted-but-unclaimed),
+ * a manifest row naming a method the live mount no longer exposes (stale row),
+ * a declared-surface method absent from the live mount (the full mount must be
+ * a superset), a duplicate manifest entry, or any tier/declared/backdoor
+ * inconsistency (e.g. an `off_surface` row that is actually on the declared
+ * surface, or one missing its `suite`).
+ *
+ * @throws AssertionError naming the specific divergence.
+ */
+export declare const assert_rpc_method_coverage: (input: RpcMethodCoverageInput) => void;
+//# sourceMappingURL=method_coverage.d.ts.map

package/dist/testing/cross_backend/method_coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method_coverage.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/method_coverage.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiC9B,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAE3D,sEAAsE;AACtE,MAAM,MAAM,kBAAkB;AAC7B;;;;GAIG;AACD,UAAU;AACZ;;;;GAIG;GACD,aAAa;AACf;;;;GAIG;GACD,UAAU,CAAC;AAEd,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IACnC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,mBAAmB,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACtD,yDAAyD;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACxC;AAID;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,sBAAsB,KAAG,IAsF1E,CAAC"}

package/dist/testing/cross_backend/method_coverage.js

@@ -0,0 +1,89 @@
+import '../assert_dev_env.js';
+/**
+ * Reconcile a backend's **live-mounted** RPC method set against a tagged
+ * coverage manifest, so the off-declared-surface methods stay as drift-proof
+ * as the declared ones.
+ *
+ * The spec-derived suites (`describe_rpc_round_trip_tests` /
+ * `describe_rpc_attack_surface_tests`) auto-enumerate the **declared**
+ * surface — add a method to a registry in `create_spine_surface_spec` and it
+ * is tested automatically. But a backend's live RPC endpoint also mounts
+ * methods kept *off* that surface (stateful cell verbs, opt-in resolvers,
+ * `_testing_*` backdoors); those rely on hand-wired imperative suites and get
+ * no auto-enumeration. Nothing structurally guaranteed every live method was
+ * actually claimed by a suite — so a newly mounted-but-untested method could
+ * ship silently.
+ *
+ * {@link assert_rpc_method_coverage} closes that gap: it diffs the live method
+ * set against a {@link MethodCoverageEntry} manifest (both directions — a
+ * mounted-but-unclaimed method *and* a stale manifest row both fail loud) and
+ * checks each entry's tier is consistent with the declared surface + the
+ * backdoor prefix. The manifest becomes the forcing function — a new method
+ * can't reach the live mount without a manifest row naming the suite that
+ * covers it.
+ *
+ * Pairs with `surface_invariants.ts` `assert_no_testing_methods` (which guards
+ * the *reverse* — a backdoor must never leak *onto* the declared surface).
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+const sorted = (set) => [...set].sort().join('\n  ');
+/**
+ * Assert the live RPC method set reconciles exactly with the coverage
+ * manifest, and that every manifest entry's tier is internally consistent.
+ *
+ * Fails loud on: a live method missing from the manifest (mounted-but-unclaimed),
+ * a manifest row naming a method the live mount no longer exposes (stale row),
+ * a declared-surface method absent from the live mount (the full mount must be
+ * a superset), a duplicate manifest entry, or any tier/declared/backdoor
+ * inconsistency (e.g. an `off_surface` row that is actually on the declared
+ * surface, or one missing its `suite`).
+ *
+ * @throws AssertionError naming the specific divergence.
+ */
+export const assert_rpc_method_coverage = (input) => {
+    const prefix = input.testing_method_prefix ?? '_testing_';
+    const live = new Set(input.live_methods);
+    const declared = new Set(input.declared_methods);
+    const manifest_methods = new Set();
+    for (const entry of input.manifest) {
+        assert.ok(!manifest_methods.has(entry.method), `method coverage: duplicate manifest entry for '${entry.method}'`);
+        manifest_methods.add(entry.method);
+    }
+    const unclaimed = [...live].filter((m) => !manifest_methods.has(m));
+    assert.ok(unclaimed.length === 0, `method coverage: ${unclaimed.length} live-mounted RPC method(s) absent from the coverage ` +
+        `manifest — add a {method, tier, suite} entry for each (or stop mounting it):\n  ${sorted(unclaimed)}`);
+    const stale = [...manifest_methods].filter((m) => !live.has(m));
+    assert.ok(stale.length === 0, `method coverage: ${stale.length} manifest entr(y/ies) name a method the live mount no longer ` +
+        `exposes — remove the stale row(s):\n  ${sorted(stale)}`);
+    const declared_not_live = [...declared].filter((m) => !live.has(m));
+    assert.ok(declared_not_live.length === 0, `method coverage: ${declared_not_live.length} declared-surface method(s) not present in the ` +
+        `live mount — the full mount must be a superset of the declared surface:\n  ${sorted(declared_not_live)}`);
+    for (const entry of input.manifest) {
+        const is_backdoor = entry.method.startsWith(prefix);
+        const is_declared = declared.has(entry.method);
+        switch (entry.tier) {
+            case 'declared':
+                assert.ok(is_declared, `method coverage: '${entry.method}' is tagged 'declared' but is not on the declared ` +
+                    `surface (create_*_surface_spec) — retag it 'off_surface' or 'backdoor'`);
+                assert.ok(!is_backdoor, `method coverage: '${entry.method}' is tagged 'declared' but starts with '${prefix}' ` +
+                    `(backdoors must never reach the declared surface) — retag it 'backdoor'`);
+                break;
+            case 'backdoor':
+                assert.ok(is_backdoor, `method coverage: '${entry.method}' is tagged 'backdoor' but does not start with ` +
+                    `'${prefix}'`);
+                assert.ok(!is_declared, `method coverage: '${entry.method}' is tagged 'backdoor' but appears on the declared ` +
+                    `surface — a '${prefix}*' action must be live-mounted only`);
+                break;
+            case 'off_surface':
+                assert.ok(!is_declared, `method coverage: '${entry.method}' is tagged 'off_surface' but is on the declared ` +
+                    `surface — retag it 'declared' (the spec-derived suites already enumerate it)`);
+                assert.ok(!is_backdoor, `method coverage: '${entry.method}' is tagged 'off_surface' but starts with '${prefix}' ` +
+                    `— retag it 'backdoor'`);
+                assert.ok(!!entry.suite, `method coverage: off-surface method '${entry.method}' must name the cross-backend ` +
+                    `'suite' that covers it — it gets no auto-enumeration`);
+                break;
+        }
+    }
+};