@fuzdev/fuz_app 0.93.0 → 0.94.0

package/dist/http/db_routes.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db, DbType } from '../db/db.js';
 import { type RouteSpec } from './route_spec.js';
 /**

package/dist/http/origin.js

@@ -9,7 +9,7 @@
  *
  * @module
  */
-import { escape_regexp } from '@fuzdev/fuz_util/regexp.js';
+import { escape_regexp } from '@fuzdev/fuz_util/regexp.ts';
 import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
 /**
  * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.

package/dist/http/pending_effects.d.ts

@@ -39,7 +39,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Minimal structural context required by `emit_after_commit`. Both
  * `RouteContext` and `ActionContext` satisfy this — they each carry

package/dist/http/proxy.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from 'hono';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { MiddlewareSpec } from './middleware_spec.js';
 /**
  * Normalize an IP address for consistent matching and storage.

package/dist/http/route_spec.d.ts

@@ -14,7 +14,7 @@
  */
 import type { Context, Hono, MiddlewareHandler } from 'hono';
 import type { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db } from '../db/db.js';
 import { type RouteErrorSchemas, type RateLimitKey } from './error_schemas.js';
 import type { MiddlewareSpec } from './middleware_spec.js';

package/dist/rate_limiter.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { LruMap } from '@fuzdev/fuz_util/lru_map.js';
+import { LruMap } from '@fuzdev/fuz_util/lru_map.ts';
 import { ERROR_RATE_LIMIT_EXCEEDED } from './http/error_schemas.js';
 /**
  * Default tracked-key cap: bounds worst-case memory under key-enumeration

package/dist/realtime/sse.d.ts

@@ -8,7 +8,7 @@
  */
 import type { Context } from 'hono';
 import { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Generic SSE stream controller interface.
  *

package/dist/realtime/sse_auth_guard.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type AuditLogEvent } from '../auth/audit_log_schema.js';
 import { SubscriberRegistry, type SubscribeOptions } from './subscriber_registry.js';
 import type { SseStream, SseNotification, EventSpec } from './sse.js';

package/dist/runtime/deno.js

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 /**
  * Create a runtime backed by Deno APIs.
  *

package/dist/server/app_backend.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppDeps } from '../auth/deps.js';
 import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { DbType, Db } from '../db/db.js';

package/dist/server/app_backend.js

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_audit_emitter } from '../auth/audit_emitter.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns, reserved_migration_namespaces } from '../auth/migrations.js';

package/dist/server/env.js

@@ -9,7 +9,7 @@
  * @module
  */
 import { z } from 'zod';
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_validated_keyring } from '../auth/keyring.js';
 import { parse_allowed_origins } from '../http/origin.js';
 /**

package/dist/server/fact_write.d.ts

@@ -10,8 +10,8 @@
  *
  * @module
  */
-import { type FactHash } from '@fuzdev/fuz_util/fact_hash.js';
-import type { FactStore } from '@fuzdev/fuz_util/fact_store.js';
+import { type FactHash } from '@fuzdev/fuz_util/fact_hash.ts';
+import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
 export interface WriteFactOptions {
     content_type: string;
 }

package/dist/server/fact_write.js

@@ -13,7 +13,7 @@
 import { randomBytes } from 'node:crypto';
 import { writeFile, rename, mkdir, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
-import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.js';
+import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
 import { mint_file_fact_url } from '../db/file_fact_url.js';
 /**
  * Write `bytes` as a fact, choosing embedded (PG) vs external (disk +

package/dist/server/serve_fact_route.d.ts

@@ -72,7 +72,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RouteSpec } from '../http/route_spec.js';
 import type { AppDeps } from '../auth/deps.js';
 export interface CreateServeFactRouteSpecOptions {

package/dist/server/serve_fact_route.js

@@ -75,8 +75,8 @@
 import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
 import { join } from 'node:path';
-import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.js';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
+import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { z } from 'zod';
 import { build_request_context, get_request_context, has_role, } from '../auth/request_context.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';

package/dist/server/startup.d.ts

@@ -5,7 +5,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppSurface } from '../http/surface.js';
 /**
  * Log a startup summary from an `AppSurface`.

package/dist/testing/CLAUDE.md

@@ -13,7 +13,7 @@ testing-patterns. This file is a reference index for the helpers themselves.
 
 ## Production guard — always the first import
 
-Every runtime-reachable module here starts with `import './assert_dev_env.js';`
+Every runtime-reachable module here starts with `import './assert_dev_env.ts';`
 — reads `DEV` from `esm-env` and throws if false, preventing production-bundle
 inclusion. Make this the first line in new modules. Enforced by
 `src/test/testing/assert_dev_env_coverage.test.ts`, which fails if any module
@@ -770,7 +770,8 @@ One-shot transport:
 
 - `RpcTestTransport = (url, init) => Promise<Response>` — duck type `Hono.request` already satisfies.
 - `http_transport(app)` — adapter for anything with a `request()` method.
-- `RpcCallResult` — discriminated `{ok: true, status, result}` / `{ok: false, status, error: {code, message, data?}}`.
+- `RpcCallResult` — discriminated `{ok: true, status, headers, result}` / `{ok: false, status, headers, error: {code, message, data?}}`. `headers` is the lowercased-key response-header snapshot so callers can assert header-level properties (e.g. the conformance runner's no-fingerprint invariant).
+- `headers_to_record(headers)` — snapshot a `Headers` into a lowercased-key `Record<string, string>` (multi-value collapses to the comma-joined form; `Set-Cookie` excluded). Used by `rpc_call` and the conformance table's REST branch to thread response headers through for assertions.
 - `RpcCallArgs` — `{app, path, method, params?, headers?, id?, verb?}`. `verb` defaults to `'POST'`; use `'GET'` for `side_effects: false` methods.
 - `rpc_call(args)` — merges `RPC_CALL_DEFAULT_HEADERS` (`host: 'localhost'`, `origin: 'http://localhost:5173'`, `Content-Type: 'application/json'`) under caller headers. Envelope-shape violations throw; JSON-RPC errors return `{ok: false, error}` so callers assert on `error.code` / `error.data.reason`.
 - `rpc_call_typed<T>(args, output_schema)` — parses the success `result` through the schema; throws on envelope failure, error response, or schema mismatch. Use `rpc_call` when the test needs to assert on error shapes.
@@ -822,7 +823,7 @@ points:
 
 - **`await_pending_effects: true`** is set by `create_test_app`. Fire-and-forget effects (audit logs, session touches, WS fan-out via `emit_after_commit`) resolve before the response returns, so tests can assert on side effects inline without manual flushing.
 - **Deep-path imports only.** Import from the canonical module (`testing/db.js`, `testing/rpc_helpers.js`, etc.); fuz_app's `dist/` ships no barrel.
-- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.js`.
+- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.ts`.
 - **Keep the shared echo routes in sync with public surface.** When middleware or public API gains a new context variable, header, or field, update the echo in `middleware.ts` (`create_bearer_auth_test_app`, `create_test_middleware_stack_app`) alongside the assertions in `src/test/auth/*.test.ts`. Drift surfaces as a missed assertion, not a test failure.
 
 ## Cross-backend integration layer
@@ -966,7 +967,7 @@ wire-shape check passes green on even when behavior is wrong.
 
 - `conformance_case.ts` — `ConformanceCase` Zod schema:
   `{name, request: {method, params?, as, verb?}, expect: {status,
-error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
+error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case is **data** — `method`
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
   closed `ConformancePrincipal` enum (`keeper` / `daemon` / `token` /
@@ -978,7 +979,24 @@ error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
   `error_reason` is the imported
   `ERROR_*` constant (asserted against the RPC `error.data.reason` or the
   REST flat-body `error`; the bare `unauthenticated()` 401 carries no
-  reason, so `status` pins that denial class).
+  reason, so `status` pins that denial class). `equivalence_group` is the
+  **negative-space** axis: every case tagged with the same group string must
+  produce a **byte-identical** normalized response (`{status, body}`),
+  asserted per impl after the case loop. It promotes a masked pair
+  (wrong-password ≡ account-not-found, found-but-unauthorized ≡ not-found)
+  from "same status + reason" to "wire-indistinguishable", so a prober
+  hitting either spine can't tell the members apart — the twin of the
+  positive `output`-schema parity the runner already enforces. The
+  per-case status/reason assertions stay the non-vacuous positive control
+  (a both-paths-identically-broken group still fails the per-case checks).
+  `headers` is the **header** negative-space axis: a string value pins a
+  header present-and-equal (case-insensitive name), `null` pins it absent.
+  Independent of it, the runner enforces an always-on **no-fingerprint**
+  invariant on _every_ response (`conformance_table.ts` `FINGERPRINT_HEADERS`
+  — `Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both
+  spines, so a framework upgrade adding one can't become a silent
+  backend-fingerprinting oracle). Headers are deliberately kept out of the
+  `equivalence_group` `{status, body}` comparison (`Set-Cookie` / `Date` vary).
 - `conformance_table.ts` — `describe_conformance_table_tests({cases,
 setup_test, surface_source, capabilities, rpc_endpoints, session_options,
 principals?, suite_name?})`. Same `{setup_test, surface_source,

package/dist/testing/adversarial_input.js

@@ -14,7 +14,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
-import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.js';
+import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.ts';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS, } from '../http/error_schemas.js';

package/dist/testing/app_server.d.ts

@@ -13,7 +13,7 @@ import './assert_dev_env.js';
  * @module
  */
 import type { Hono } from 'hono';
-import type { Uuid } from '@fuzdev/fuz_util/id.js';
+import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type Keyring } from '../auth/keyring.js';
 import type { Db, DbType } from '../db/db.js';
 import type { PasswordHashDeps } from '../auth/password.js';

package/dist/testing/app_server.js

@@ -1,6 +1,6 @@
 import './assert_dev_env.js';
 import { z } from 'zod';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { create_validated_keyring } from '../auth/keyring.js';

package/dist/testing/auth_apps.js

@@ -8,7 +8,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { Hono } from 'hono';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_route_specs } from '../http/route_spec.js';
 import { is_public_auth } from '../http/auth_shape.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';

package/dist/testing/cross_backend/bench/bench_report.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.ts';
 import type { CrossImplBenchResult } from './run_cross_impl_bench.js';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's

package/dist/testing/cross_backend/bench/bench_report.js

@@ -1,6 +1,6 @@
 import '../../assert_dev_env.js';
-import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.js';
-import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.ts';
+import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.ts';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's
  * formatters + Welch comparison. Markdown for human eyeballs, a per-scenario

package/dist/testing/cross_backend/bench/run_cross_impl_bench.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.js';
+import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.ts';
 import type { BootstrappedBackendHandle } from '../setup.js';
 import type { BenchScenario } from './scenario.js';
 /**

package/dist/testing/cross_backend/bench/run_cross_impl_bench.js

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { Benchmark } from '@fuzdev/fuz_util/benchmark.js';
+import { Benchmark } from '@fuzdev/fuz_util/benchmark.ts';
 /**
  * Network-tuned defaults — fuz_util's micro-benchmark defaults (warmup 10,
  * min 30, duration 1000ms) are sized for sub-microsecond functions. RPC round

package/dist/testing/cross_backend/bootstrap_backend.d.ts

@@ -6,7 +6,7 @@ import '../assert_dev_env.js';
  * consumer's vitest `globalSetup` reduces to a single await:
  *
  * ```ts
- * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.js';
+ * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.ts';
  *
  * export default async function ({provide}) {
  *   const bootstrapped = await bootstrap_backend(deno_backend_config());

package/dist/testing/cross_backend/cell_relations.js

@@ -52,7 +52,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.js';
+import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput, } from '../../auth/cell_grant_action_specs.js';

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -85,6 +85,8 @@ export declare const ConformanceCaseExpectation: z.ZodObject<{
     status: z.ZodNumber;
     error_reason: z.ZodOptional<z.ZodString>;
     fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+    equivalence_group: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ConformanceCaseExpectation = z.infer<typeof ConformanceCaseExpectation>;
 /**
@@ -133,6 +135,8 @@ export declare const ConformanceCase: z.ZodObject<{
         status: z.ZodNumber;
         error_reason: z.ZodOptional<z.ZodString>;
         fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        equivalence_group: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     note: z.ZodOptional<z.ZodString>;
     xfail: z.ZodOptional<z.ZodObject<{

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;kBAqBrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -96,6 +96,32 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Specific field-value assertions on the success `result` (2xx) or the error ' +
             '`error.data` (non-2xx). Each key must deep-equal the corresponding response field.',
     }),
+    headers: z
+        .record(z.string(), z.string().nullable())
+        .optional()
+        .meta({
+        description: 'Per-header expectations on the response. Each key is a header name ' +
+            '(case-insensitive); a string value asserts the header is present and equals ' +
+            'it exactly, `null` asserts the header is ABSENT. Independent of this, the ' +
+            'runner enforces an unconditional no-fingerprint invariant on EVERY response ' +
+            '(`Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both ' +
+            'spines), so a case only needs `headers` to pin a header beyond that ' +
+            'always-on floor.',
+    }),
+    equivalence_group: z
+        .string()
+        .optional()
+        .meta({
+        description: 'Tags this case as a member of an indistinguishability group. After all cases ' +
+            'run, the runner asserts every member of a group produced a BYTE-IDENTICAL ' +
+            'normalized response (`{status, body}`) — checked per impl. This promotes a ' +
+            'masked pair (found-but-unauthorized ≡ not-found, wrong-password ≡ ' +
+            'account-not-found) from "same status + reason" to "wire-indistinguishable", ' +
+            'and holds BOTH impls to it: a prober hitting either spine cannot tell the ' +
+            'members apart. A group needs >= 2 members; a member may still set `fields`. ' +
+            'The negative-space twin of the positive `output`-schema parity the runner ' +
+            'already asserts.',
+    }),
 });
 /**
  * Marks a case as a deferred-by-design gap. The runner routes it through

package/dist/testing/cross_backend/conformance_table.d.ts

@@ -36,6 +36,27 @@ export interface ConformanceTableOptions {
     /** `describe` block label. Defaults to `'conformance table'`. */
     readonly suite_name?: string;
 }
+/**
+ * Response headers that fingerprint the backend implementation or framework.
+ * Neither spine emits these; the runner asserts they stay absent on EVERY
+ * conformance response so a framework upgrade or consumer middleware that adds
+ * (say) `Server:` to one spine can't silently become a backend-identifying
+ * oracle. Lowercased — matched against the lowercased-key snapshot
+ * `headers_to_record` produces.
+ */
+export declare const FINGERPRINT_HEADERS: ReadonlyArray<string>;
+/**
+ * Assert a response carries none of the `FINGERPRINT_HEADERS`. Run on every
+ * case unconditionally — the always-on no-fingerprint floor.
+ */
+export declare const assert_no_fingerprint_headers: (headers: Record<string, string>, label: string) => void;
+/**
+ * Assert each declared header expectation: a string value must be present and
+ * equal (header name matched case-insensitively), `null` must be absent. The
+ * negative-space twin for headers — `expect.headers` pins a header beyond the
+ * always-on no-fingerprint floor.
+ */
+export declare const assert_expected_headers: (headers: Record<string, string>, expected: Record<string, string | null>, label: string) => void;
 /**
  * Register a `describe` block running every `ConformanceCase` as a
  * vitest `test` (or `xfail_until` for deferred-by-design rows). Drives

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwB9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkOD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAgBnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -16,11 +16,17 @@ import '../assert_dev_env.js';
  * row runs `as` resolves to a `TestFixture` accessor via
  * `resolve_principal` — no inline credential minting.
  *
+ * Every response also passes an always-on **no-fingerprint** invariant
+ * (`assert_no_fingerprint_headers` over `FINGERPRINT_HEADERS` — `Server` /
+ * `X-Powered-By` / `WWW-Authenticate` must stay absent on both spines), and
+ * a row may pin further header expectations via `expect.headers`. Headers are
+ * deliberately kept out of the equivalence-group `{status, body}` comparison.
+ *
  * @module
  */
 import { assert, describe, test } from 'vitest';
 import { find_auth_route, rest_auth_route_suffixes, } from '../integration_helpers.js';
-import { find_rpc_action, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
+import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
 import {} from './conformance_case.js';
 import { xfail_until } from './xfail.js';
 /**
@@ -91,19 +97,70 @@ const assert_fields = (actual, fields, label) => {
         assert.deepEqual(record[key], expected, `${label}: field '${key}'`);
     }
 };
+/**
+ * Response headers that fingerprint the backend implementation or framework.
+ * Neither spine emits these; the runner asserts they stay absent on EVERY
+ * conformance response so a framework upgrade or consumer middleware that adds
+ * (say) `Server:` to one spine can't silently become a backend-identifying
+ * oracle. Lowercased — matched against the lowercased-key snapshot
+ * `headers_to_record` produces.
+ */
+export const FINGERPRINT_HEADERS = [
+    'server',
+    'x-powered-by',
+    'www-authenticate',
+];
+/**
+ * Assert a response carries none of the `FINGERPRINT_HEADERS`. Run on every
+ * case unconditionally — the always-on no-fingerprint floor.
+ */
+export const assert_no_fingerprint_headers = (headers, label) => {
+    for (const name of FINGERPRINT_HEADERS) {
+        assert.ok(!(name in headers), `${label}: response leaked backend-fingerprinting header '${name}: ${headers[name]}' — ` +
+            `Server / X-Powered-By / WWW-Authenticate must stay absent on both spines.`);
+    }
+};
+/**
+ * Assert each declared header expectation: a string value must be present and
+ * equal (header name matched case-insensitively), `null` must be absent. The
+ * negative-space twin for headers — `expect.headers` pins a header beyond the
+ * always-on no-fingerprint floor.
+ */
+export const assert_expected_headers = (headers, expected, label) => {
+    for (const [name, value] of Object.entries(expected)) {
+        const key = name.toLowerCase();
+        if (value === null) {
+            assert.ok(!(key in headers), `${label}: header '${name}' expected absent but present as '${headers[key]}'`);
+        }
+        else {
+            assert.strictEqual(headers[key], value, `${label}: header '${name}'`);
+        }
+    }
+};
+/**
+ * Run a case's header invariants: the always-on no-fingerprint floor on every
+ * response plus any declared `expect.headers`. Header assertions are kept off
+ * the equivalence-group `{status, body}` normalized response — `Set-Cookie` /
+ * `Date` legitimately vary, so headers are never compared for byte-identity.
+ */
+const assert_response_headers = (headers, c) => {
+    assert_no_fingerprint_headers(headers, c.name);
+    if (c.expect.headers)
+        assert_expected_headers(headers, c.expect.headers, c.name);
+};
 const is_success_status = (status) => status >= 200 && status < 300;
 /**
  * Run one conformance case end-to-end: resolve the principal, dispatch the
- * request, and assert the expected status / reason / fields.
+ * request, and assert the expected status / reason / fields. Returns the
+ * normalized response so the caller can feed an equivalence group.
  */
 const run_case = async (c, options, resolved_rpc_endpoints) => {
     const fixture = await options.setup_test();
     const { transport, headers, suppress_default_origin } = await resolve_principal(fixture, c.request.as, options.principals);
     if (c.request.method.startsWith('/')) {
-        await run_rest_case(c, options, transport, headers);
-        return;
+        return run_rest_case(c, options, transport, headers);
     }
-    await run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    return run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
 };
 /** Dispatch + assert a case targeting an RPC method. */
 const run_rpc_case = async (c, transport, headers, suppress_default_origin, resolved_rpc_endpoints) => {
@@ -121,6 +178,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
         ...(c.request.verb && { verb: c.request.verb }),
         ...(suppress_default_origin && { suppress_default_origin: true }),
     });
+    assert_response_headers(res.headers, c);
     if (is_success_status(c.expect.status)) {
         assert.ok(res.ok, `${c.name}: expected success (${c.expect.status}) but got error ${JSON.stringify(res.ok ? undefined : res.error)}`);
         assert.strictEqual(res.status, c.expect.status, `${c.name}: status`);
@@ -128,7 +186,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
         assert.ok(parsed.success, `${c.name}: result does not match spec.output: ${JSON.stringify(parsed.success ? undefined : parsed.error.issues)}`);
         if (c.expect.fields)
             assert_fields(res.result, c.expect.fields, c.name);
-        return;
+        return { status: res.status, body: res.result };
     }
     assert.ok(!res.ok, `${c.name}: expected error status ${c.expect.status} but got success`);
     assert.strictEqual(res.status, c.expect.status, `${c.name}: error status`);
@@ -145,6 +203,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
     }
     if (c.expect.fields)
         assert_fields(res.error.data, c.expect.fields, c.name);
+    return { status: res.status, body: res.error };
 };
 /** Dispatch + assert a case targeting one of the 6 REST auth routes. */
 const run_rest_case = async (c, options, transport, headers) => {
@@ -165,6 +224,7 @@ const run_rest_case = async (c, options, transport, headers) => {
             c.request.params !== undefined && { body: JSON.stringify(c.request.params) }),
     };
     const response = await transport(route.path, init);
+    assert_response_headers(headers_to_record(response.headers), c);
     assert.strictEqual(response.status, c.expect.status, `${c.name}: status`);
     const body = await response.json().catch(() => undefined);
     if (is_success_status(c.expect.status)) {
@@ -177,6 +237,7 @@ const run_rest_case = async (c, options, transport, headers) => {
     }
     if (c.expect.fields)
         assert_fields(body, c.expect.fields, c.name);
+    return { status: response.status, body };
 };
 /**
  * Register a `describe` block running every `ConformanceCase` as a
@@ -186,10 +247,28 @@ const run_rest_case = async (c, options, transport, headers) => {
  */
 export const describe_conformance_table_tests = (options) => {
     const resolved_rpc_endpoints = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
+    // Per-group normalized responses, populated as the member case tests run
+    // and consulted by the per-group byte-identity assertions registered after
+    // the case loop — vitest runs a describe's tests in registration order, so
+    // the group assertions execute last, after every member has recorded.
+    const equivalence_groups = new Map();
+    const group_names = new Set();
+    for (const c of options.cases) {
+        if (c.expect.equivalence_group)
+            group_names.add(c.expect.equivalence_group);
+    }
     describe(options.suite_name ?? 'conformance table', () => {
         for (const c of options.cases) {
             const label = c.note ? `${c.name} — ${c.note}` : c.name;
-            const body = () => run_case(c, options, resolved_rpc_endpoints);
+            const group = c.expect.equivalence_group;
+            const body = async () => {
+                const normalized = await run_case(c, options, resolved_rpc_endpoints);
+                if (group) {
+                    const members = equivalence_groups.get(group) ?? [];
+                    members.push({ name: c.name, normalized });
+                    equivalence_groups.set(group, members);
+                }
+            };
             if (c.xfail) {
                 xfail_until(c.xfail.tracking_id, c.xfail.reason, label, body);
             }
@@ -197,5 +276,28 @@ export const describe_conformance_table_tests = (options) => {
                 test(label, body);
             }
         }
+        // Negative-space gate: every member of an equivalence group must have
+        // produced a byte-identical `{status, body}`. This holds the impl under
+        // test to "a prober cannot distinguish these masked paths" — the
+        // promotion of a masked pair (wrong-password ≡ account-not-found,
+        // found-but-unauthorized ≡ not-found) from "same status + reason" to
+        // "wire-indistinguishable". Runs per impl, so each spine is held to it.
+        for (const group of group_names) {
+            test(`equivalence group '${group}' — members are wire-indistinguishable`, () => {
+                const members = equivalence_groups.get(group) ?? [];
+                assert.ok(members.length >= 2, `equivalence group '${group}': expected >= 2 members to have recorded, got ` +
+                    `${members.length} — a group pins indistinguishability between paths, so it ` +
+                    `needs at least a pair (check the member cases ran and weren't all xfail).`);
+                const [first, ...rest] = members;
+                // `members.length >= 2` guarantees `first` is defined; the explicit
+                // assert narrows it for the typechecker (noUncheckedIndexedAccess).
+                assert.ok(first);
+                for (const member of rest) {
+                    assert.deepStrictEqual(member.normalized, first.normalized, `equivalence group '${group}': '${member.name}' is distinguishable from ` +
+                        `'${first.name}' — a prober could tell these masked paths apart. The ` +
+                        `normalized {status, body} must be byte-identical across all members.`);
+                }
+            });
+        }
     });
 };