@fuzdev/fuz_app 0.92.0 → 0.94.0

package/dist/http/db_routes.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db, DbType } from '../db/db.js';
 import { type RouteSpec } from './route_spec.js';
 /**

package/dist/http/origin.js

@@ -9,7 +9,7 @@
  *
  * @module
  */
-import { escape_regexp } from '@fuzdev/fuz_util/regexp.js';
+import { escape_regexp } from '@fuzdev/fuz_util/regexp.ts';
 import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
 /**
  * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.

package/dist/http/pending_effects.d.ts

@@ -39,7 +39,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Minimal structural context required by `emit_after_commit`. Both
  * `RouteContext` and `ActionContext` satisfy this — they each carry

package/dist/http/proxy.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from 'hono';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { MiddlewareSpec } from './middleware_spec.js';
 /**
  * Normalize an IP address for consistent matching and storage.

package/dist/http/route_spec.d.ts

@@ -14,7 +14,7 @@
  */
 import type { Context, Hono, MiddlewareHandler } from 'hono';
 import type { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db } from '../db/db.js';
 import { type RouteErrorSchemas, type RateLimitKey } from './error_schemas.js';
 import type { MiddlewareSpec } from './middleware_spec.js';

package/dist/rate_limiter.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { LruMap } from '@fuzdev/fuz_util/lru_map.js';
+import { LruMap } from '@fuzdev/fuz_util/lru_map.ts';
 import { ERROR_RATE_LIMIT_EXCEEDED } from './http/error_schemas.js';
 /**
  * Default tracked-key cap: bounds worst-case memory under key-enumeration

package/dist/realtime/sse.d.ts

@@ -8,7 +8,7 @@
  */
 import type { Context } from 'hono';
 import { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Generic SSE stream controller interface.
  *

package/dist/realtime/sse_auth_guard.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type AuditLogEvent } from '../auth/audit_log_schema.js';
 import { SubscriberRegistry, type SubscribeOptions } from './subscriber_registry.js';
 import type { SseStream, SseNotification, EventSpec } from './sse.js';

package/dist/runtime/deno.js

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 /**
  * Create a runtime backed by Deno APIs.
  *

package/dist/server/app_backend.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppDeps } from '../auth/deps.js';
 import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { DbType, Db } from '../db/db.js';

package/dist/server/app_backend.js

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_audit_emitter } from '../auth/audit_emitter.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns, reserved_migration_namespaces } from '../auth/migrations.js';

package/dist/server/env.js

@@ -9,7 +9,7 @@
  * @module
  */
 import { z } from 'zod';
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_validated_keyring } from '../auth/keyring.js';
 import { parse_allowed_origins } from '../http/origin.js';
 /**

package/dist/server/fact_write.d.ts

@@ -10,8 +10,8 @@
  *
  * @module
  */
-import { type FactHash } from '@fuzdev/fuz_util/fact_hash.js';
-import type { FactStore } from '@fuzdev/fuz_util/fact_store.js';
+import { type FactHash } from '@fuzdev/fuz_util/fact_hash.ts';
+import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
 export interface WriteFactOptions {
     content_type: string;
 }

package/dist/server/fact_write.js

@@ -13,7 +13,7 @@
 import { randomBytes } from 'node:crypto';
 import { writeFile, rename, mkdir, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
-import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.js';
+import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
 import { mint_file_fact_url } from '../db/file_fact_url.js';
 /**
  * Write `bytes` as a fact, choosing embedded (PG) vs external (disk +

package/dist/server/serve_fact_route.d.ts

@@ -72,7 +72,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RouteSpec } from '../http/route_spec.js';
 import type { AppDeps } from '../auth/deps.js';
 export interface CreateServeFactRouteSpecOptions {

package/dist/server/serve_fact_route.js

@@ -75,8 +75,8 @@
 import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
 import { join } from 'node:path';
-import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.js';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
+import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { z } from 'zod';
 import { build_request_context, get_request_context, has_role, } from '../auth/request_context.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';

package/dist/server/startup.d.ts

@@ -5,7 +5,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppSurface } from '../http/surface.js';
 /**
  * Log a startup summary from an `AppSurface`.

package/dist/testing/CLAUDE.md

@@ -13,7 +13,7 @@ testing-patterns. This file is a reference index for the helpers themselves.
 
 ## Production guard — always the first import
 
-Every runtime-reachable module here starts with `import './assert_dev_env.js';`
+Every runtime-reachable module here starts with `import './assert_dev_env.ts';`
 — reads `DEV` from `esm-env` and throws if false, preventing production-bundle
 inclusion. Make this the first line in new modules. Enforced by
 `src/test/testing/assert_dev_env_coverage.test.ts`, which fails if any module
@@ -770,7 +770,8 @@ One-shot transport:
 
 - `RpcTestTransport = (url, init) => Promise<Response>` — duck type `Hono.request` already satisfies.
 - `http_transport(app)` — adapter for anything with a `request()` method.
-- `RpcCallResult` — discriminated `{ok: true, status, result}` / `{ok: false, status, error: {code, message, data?}}`.
+- `RpcCallResult` — discriminated `{ok: true, status, headers, result}` / `{ok: false, status, headers, error: {code, message, data?}}`. `headers` is the lowercased-key response-header snapshot so callers can assert header-level properties (e.g. the conformance runner's no-fingerprint invariant).
+- `headers_to_record(headers)` — snapshot a `Headers` into a lowercased-key `Record<string, string>` (multi-value collapses to the comma-joined form; `Set-Cookie` excluded). Used by `rpc_call` and the conformance table's REST branch to thread response headers through for assertions.
 - `RpcCallArgs` — `{app, path, method, params?, headers?, id?, verb?}`. `verb` defaults to `'POST'`; use `'GET'` for `side_effects: false` methods.
 - `rpc_call(args)` — merges `RPC_CALL_DEFAULT_HEADERS` (`host: 'localhost'`, `origin: 'http://localhost:5173'`, `Content-Type: 'application/json'`) under caller headers. Envelope-shape violations throw; JSON-RPC errors return `{ok: false, error}` so callers assert on `error.code` / `error.data.reason`.
 - `rpc_call_typed<T>(args, output_schema)` — parses the success `result` through the schema; throws on envelope failure, error response, or schema mismatch. Use `rpc_call` when the test needs to assert on error shapes.
@@ -822,7 +823,7 @@ points:
 
 - **`await_pending_effects: true`** is set by `create_test_app`. Fire-and-forget effects (audit logs, session touches, WS fan-out via `emit_after_commit`) resolve before the response returns, so tests can assert on side effects inline without manual flushing.
 - **Deep-path imports only.** Import from the canonical module (`testing/db.js`, `testing/rpc_helpers.js`, etc.); fuz_app's `dist/` ships no barrel.
-- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.js`.
+- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.ts`.
 - **Keep the shared echo routes in sync with public surface.** When middleware or public API gains a new context variable, header, or field, update the echo in `middleware.ts` (`create_bearer_auth_test_app`, `create_test_middleware_stack_app`) alongside the assertions in `src/test/auth/*.test.ts`. Drift surfaces as a missed assertion, not a test failure.
 
 ## Cross-backend integration layer
@@ -966,7 +967,7 @@ wire-shape check passes green on even when behavior is wrong.
 
 - `conformance_case.ts` — `ConformanceCase` Zod schema:
   `{name, request: {method, params?, as, verb?}, expect: {status,
-error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
+error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case is **data** — `method`
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
   closed `ConformancePrincipal` enum (`keeper` / `daemon` / `token` /
@@ -978,7 +979,24 @@ error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
   `error_reason` is the imported
   `ERROR_*` constant (asserted against the RPC `error.data.reason` or the
   REST flat-body `error`; the bare `unauthenticated()` 401 carries no
-  reason, so `status` pins that denial class).
+  reason, so `status` pins that denial class). `equivalence_group` is the
+  **negative-space** axis: every case tagged with the same group string must
+  produce a **byte-identical** normalized response (`{status, body}`),
+  asserted per impl after the case loop. It promotes a masked pair
+  (wrong-password ≡ account-not-found, found-but-unauthorized ≡ not-found)
+  from "same status + reason" to "wire-indistinguishable", so a prober
+  hitting either spine can't tell the members apart — the twin of the
+  positive `output`-schema parity the runner already enforces. The
+  per-case status/reason assertions stay the non-vacuous positive control
+  (a both-paths-identically-broken group still fails the per-case checks).
+  `headers` is the **header** negative-space axis: a string value pins a
+  header present-and-equal (case-insensitive name), `null` pins it absent.
+  Independent of it, the runner enforces an always-on **no-fingerprint**
+  invariant on _every_ response (`conformance_table.ts` `FINGERPRINT_HEADERS`
+  — `Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both
+  spines, so a framework upgrade adding one can't become a silent
+  backend-fingerprinting oracle). Headers are deliberately kept out of the
+  `equivalence_group` `{status, body}` comparison (`Set-Cookie` / `Date` vary).
 - `conformance_table.ts` — `describe_conformance_table_tests({cases,
 setup_test, surface_source, capabilities, rpc_endpoints, session_options,
 principals?, suite_name?})`. Same `{setup_test, surface_source,
@@ -1347,6 +1365,33 @@ The accepted-case 403s rely on `create_spine_route_specs` zeroing
 `signup_fail_floor_ms` (mirroring `login_fail_floor_ms: 0`) so they don't each
 pay the 250ms denial floor.
 
+### Login rate-limit + trusted-proxy parity — `cross_backend/login_security.ts`
+
+`describe_login_security_cross_tests({setup_test, login_path?})` — the imperative
+suite pinning **login rate limiting + `X-Forwarded-For` client-IP resolution**
+over real HTTP on both spines. Two cases:
+
+- **per-IP limit fires** — `default_login_ip_rate_limit.max_attempts` (5, the
+  shared cap on both impls) failed logins from one forwarded IP → 401, the next →
+  `429` with the canonical `{error: "rate_limit_exceeded", retry_after}` body +
+  `Retry-After: ceil(retry_after)` header (TS `rate_limit_exceeded_response` ↔
+  Rust `route_response::rate_limit_exceeded`).
+- **XFF keying** — exhaust one forwarded IP to 429, then a _distinct_ forwarded IP
+  → 401 (not 429), proving the limiter keys on the resolved `X-Forwarded-For` IP,
+  not the loopback TCP peer (a backend ignoring XFF would 429 the fresh IP too).
+
+**Cross-process only**, on a **dedicated dual-spawn project** (`cross_backend_security`
+via `global_setup_login_security.ts`) — the limiters can't be enabled on a backend
+the standard suites share (they fire many loopback logins a live limiter would
+429), so the standard backends keep every limiter null. Determinism without a
+limiter reset: each case uses its own forwarded IP (a fresh bucket) plus its own
+non-existent username. Zero Rust code change — the stub's `FUZ_LOGIN_RATE_LIMIT_ENABLED`
+and `FUZ_TRUSTED_PROXIES` env-gates were already wired; the TS side env-gates the
+limiters in the binary, and `create_spine_route_specs` honors `ctx.ip_rate_limiter`.
+The in-process counterparts already exist (`describe_rate_limiting_tests` plus the
+proxy middleware tests), so there's no in-process leg. `npm run test:cross:security`.
+Cited property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test

package/dist/testing/adversarial_input.js

@@ -14,7 +14,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
-import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.js';
+import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.ts';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS, } from '../http/error_schemas.js';

package/dist/testing/app_server.d.ts

@@ -13,7 +13,7 @@ import './assert_dev_env.js';
  * @module
  */
 import type { Hono } from 'hono';
-import type { Uuid } from '@fuzdev/fuz_util/id.js';
+import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type Keyring } from '../auth/keyring.js';
 import type { Db, DbType } from '../db/db.js';
 import type { PasswordHashDeps } from '../auth/password.js';

package/dist/testing/app_server.js

@@ -1,6 +1,6 @@
 import './assert_dev_env.js';
 import { z } from 'zod';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { create_validated_keyring } from '../auth/keyring.js';

package/dist/testing/auth_apps.js

@@ -8,7 +8,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { Hono } from 'hono';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_route_specs } from '../http/route_spec.js';
 import { is_public_auth } from '../http/auth_shape.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';

package/dist/testing/cross_backend/bench/bench_report.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.ts';
 import type { CrossImplBenchResult } from './run_cross_impl_bench.js';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's

package/dist/testing/cross_backend/bench/bench_report.js

@@ -1,6 +1,6 @@
 import '../../assert_dev_env.js';
-import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.js';
-import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.ts';
+import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.ts';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's
  * formatters + Welch comparison. Markdown for human eyeballs, a per-scenario

package/dist/testing/cross_backend/bench/run_cross_impl_bench.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.js';
+import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.ts';
 import type { BootstrappedBackendHandle } from '../setup.js';
 import type { BenchScenario } from './scenario.js';
 /**

package/dist/testing/cross_backend/bench/run_cross_impl_bench.js

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { Benchmark } from '@fuzdev/fuz_util/benchmark.js';
+import { Benchmark } from '@fuzdev/fuz_util/benchmark.ts';
 /**
  * Network-tuned defaults — fuz_util's micro-benchmark defaults (warmup 10,
  * min 30, duration 1000ms) are sized for sub-microsecond functions. RPC round

package/dist/testing/cross_backend/bootstrap_backend.d.ts

@@ -6,7 +6,7 @@ import '../assert_dev_env.js';
  * consumer's vitest `globalSetup` reduces to a single await:
  *
  * ```ts
- * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.js';
+ * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.ts';
  *
  * export default async function ({provide}) {
  *   const bootstrapped = await bootstrap_backend(deno_backend_config());

package/dist/testing/cross_backend/cell_relations.js

@@ -52,7 +52,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.js';
+import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput, } from '../../auth/cell_grant_action_specs.js';

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -85,6 +85,8 @@ export declare const ConformanceCaseExpectation: z.ZodObject<{
     status: z.ZodNumber;
     error_reason: z.ZodOptional<z.ZodString>;
     fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+    equivalence_group: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ConformanceCaseExpectation = z.infer<typeof ConformanceCaseExpectation>;
 /**
@@ -133,6 +135,8 @@ export declare const ConformanceCase: z.ZodObject<{
         status: z.ZodNumber;
         error_reason: z.ZodOptional<z.ZodString>;
         fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        equivalence_group: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     note: z.ZodOptional<z.ZodString>;
     xfail: z.ZodOptional<z.ZodObject<{

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;kBAqBrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -96,6 +96,32 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Specific field-value assertions on the success `result` (2xx) or the error ' +
             '`error.data` (non-2xx). Each key must deep-equal the corresponding response field.',
     }),
+    headers: z
+        .record(z.string(), z.string().nullable())
+        .optional()
+        .meta({
+        description: 'Per-header expectations on the response. Each key is a header name ' +
+            '(case-insensitive); a string value asserts the header is present and equals ' +
+            'it exactly, `null` asserts the header is ABSENT. Independent of this, the ' +
+            'runner enforces an unconditional no-fingerprint invariant on EVERY response ' +
+            '(`Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both ' +
+            'spines), so a case only needs `headers` to pin a header beyond that ' +
+            'always-on floor.',
+    }),
+    equivalence_group: z
+        .string()
+        .optional()
+        .meta({
+        description: 'Tags this case as a member of an indistinguishability group. After all cases ' +
+            'run, the runner asserts every member of a group produced a BYTE-IDENTICAL ' +
+            'normalized response (`{status, body}`) — checked per impl. This promotes a ' +
+            'masked pair (found-but-unauthorized ≡ not-found, wrong-password ≡ ' +
+            'account-not-found) from "same status + reason" to "wire-indistinguishable", ' +
+            'and holds BOTH impls to it: a prober hitting either spine cannot tell the ' +
+            'members apart. A group needs >= 2 members; a member may still set `fields`. ' +
+            'The negative-space twin of the positive `output`-schema parity the runner ' +
+            'already asserts.',
+    }),
 });
 /**
  * Marks a case as a deferred-by-design gap. The runner routes it through

package/dist/testing/cross_backend/conformance_table.d.ts

@@ -36,6 +36,27 @@ export interface ConformanceTableOptions {
     /** `describe` block label. Defaults to `'conformance table'`. */
     readonly suite_name?: string;
 }
+/**
+ * Response headers that fingerprint the backend implementation or framework.
+ * Neither spine emits these; the runner asserts they stay absent on EVERY
+ * conformance response so a framework upgrade or consumer middleware that adds
+ * (say) `Server:` to one spine can't silently become a backend-identifying
+ * oracle. Lowercased — matched against the lowercased-key snapshot
+ * `headers_to_record` produces.
+ */
+export declare const FINGERPRINT_HEADERS: ReadonlyArray<string>;
+/**
+ * Assert a response carries none of the `FINGERPRINT_HEADERS`. Run on every
+ * case unconditionally — the always-on no-fingerprint floor.
+ */
+export declare const assert_no_fingerprint_headers: (headers: Record<string, string>, label: string) => void;
+/**
+ * Assert each declared header expectation: a string value must be present and
+ * equal (header name matched case-insensitively), `null` must be absent. The
+ * negative-space twin for headers — `expect.headers` pins a header beyond the
+ * always-on no-fingerprint floor.
+ */
+export declare const assert_expected_headers: (headers: Record<string, string>, expected: Record<string, string | null>, label: string) => void;
 /**
  * Register a `describe` block running every `ConformanceCase` as a
  * vitest `test` (or `xfail_until` for deferred-by-design rows). Drives

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwB9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkOD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAgBnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}