@fuzdev/fuz_app 0.93.0 → 0.95.0

package/dist/http/db_routes.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db, DbType } from '../db/db.js';
 import { type RouteSpec } from './route_spec.js';
 /**

package/dist/http/origin.js

@@ -9,7 +9,7 @@
  *
  * @module
  */
-import { escape_regexp } from '@fuzdev/fuz_util/regexp.js';
+import { escape_regexp } from '@fuzdev/fuz_util/regexp.ts';
 import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
 /**
  * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.

package/dist/http/pending_effects.d.ts

@@ -39,7 +39,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Minimal structural context required by `emit_after_commit`. Both
  * `RouteContext` and `ActionContext` satisfy this — they each carry

package/dist/http/proxy.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from 'hono';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { MiddlewareSpec } from './middleware_spec.js';
 /**
  * Normalize an IP address for consistent matching and storage.

package/dist/http/route_spec.d.ts

@@ -14,7 +14,7 @@
  */
 import type { Context, Hono, MiddlewareHandler } from 'hono';
 import type { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { Db } from '../db/db.js';
 import { type RouteErrorSchemas, type RateLimitKey } from './error_schemas.js';
 import type { MiddlewareSpec } from './middleware_spec.js';

package/dist/rate_limiter.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { LruMap } from '@fuzdev/fuz_util/lru_map.js';
+import { LruMap } from '@fuzdev/fuz_util/lru_map.ts';
 import { ERROR_RATE_LIMIT_EXCEEDED } from './http/error_schemas.js';
 /**
  * Default tracked-key cap: bounds worst-case memory under key-enumeration

package/dist/realtime/sse.d.ts

@@ -8,7 +8,7 @@
  */
 import type { Context } from 'hono';
 import { z } from 'zod';
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Generic SSE stream controller interface.
  *

package/dist/realtime/sse_auth_guard.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type AuditLogEvent } from '../auth/audit_log_schema.js';
 import { SubscriberRegistry, type SubscribeOptions } from './subscriber_registry.js';
 import type { SseStream, SseNotification, EventSpec } from './sse.js';

package/dist/runtime/deno.js

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 /**
  * Create a runtime backed by Deno APIs.
  *

package/dist/server/app_backend.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppDeps } from '../auth/deps.js';
 import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { DbType, Db } from '../db/db.js';

package/dist/server/app_backend.js

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_audit_emitter } from '../auth/audit_emitter.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns, reserved_migration_namespaces } from '../auth/migrations.js';

package/dist/server/env.js

@@ -9,7 +9,7 @@
  * @module
  */
 import { z } from 'zod';
-import { to_error_message } from '@fuzdev/fuz_util/error.js';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_validated_keyring } from '../auth/keyring.js';
 import { parse_allowed_origins } from '../http/origin.js';
 /**

package/dist/server/fact_write.d.ts

@@ -10,8 +10,8 @@
  *
  * @module
  */
-import { type FactHash } from '@fuzdev/fuz_util/fact_hash.js';
-import type { FactStore } from '@fuzdev/fuz_util/fact_store.js';
+import { type FactHash } from '@fuzdev/fuz_util/fact_hash.ts';
+import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
 export interface WriteFactOptions {
     content_type: string;
 }

package/dist/server/fact_write.js

@@ -13,7 +13,7 @@
 import { randomBytes } from 'node:crypto';
 import { writeFile, rename, mkdir, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
-import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.js';
+import { FACT_HASH_PREFIX, fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
 import { mint_file_fact_url } from '../db/file_fact_url.js';
 /**
  * Write `bytes` as a fact, choosing embedded (PG) vs external (disk +

package/dist/server/serve_fact_route.d.ts

@@ -72,7 +72,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RouteSpec } from '../http/route_spec.js';
 import type { AppDeps } from '../auth/deps.js';
 export interface CreateServeFactRouteSpecOptions {

package/dist/server/serve_fact_route.js

@@ -75,8 +75,8 @@
 import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
 import { join } from 'node:path';
-import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.js';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
+import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { z } from 'zod';
 import { build_request_context, get_request_context, has_role, } from '../auth/request_context.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';

package/dist/server/startup.d.ts

@@ -5,7 +5,7 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppSurface } from '../http/surface.js';
 /**
  * Log a startup summary from an `AppSurface`.

package/dist/testing/CLAUDE.md

@@ -13,7 +13,7 @@ testing-patterns. This file is a reference index for the helpers themselves.
 
 ## Production guard — always the first import
 
-Every runtime-reachable module here starts with `import './assert_dev_env.js';`
+Every runtime-reachable module here starts with `import './assert_dev_env.ts';`
 — reads `DEV` from `esm-env` and throws if false, preventing production-bundle
 inclusion. Make this the first line in new modules. Enforced by
 `src/test/testing/assert_dev_env_coverage.test.ts`, which fails if any module
@@ -770,7 +770,8 @@ One-shot transport:
 
 - `RpcTestTransport = (url, init) => Promise<Response>` — duck type `Hono.request` already satisfies.
 - `http_transport(app)` — adapter for anything with a `request()` method.
-- `RpcCallResult` — discriminated `{ok: true, status, result}` / `{ok: false, status, error: {code, message, data?}}`.
+- `RpcCallResult` — discriminated `{ok: true, status, headers, result}` / `{ok: false, status, headers, error: {code, message, data?}}`. `headers` is the lowercased-key response-header snapshot so callers can assert header-level properties (e.g. the conformance runner's no-fingerprint invariant).
+- `headers_to_record(headers)` — snapshot a `Headers` into a lowercased-key `Record<string, string>` (multi-value collapses to the comma-joined form; `Set-Cookie` excluded). Used by `rpc_call` and the conformance table's REST branch to thread response headers through for assertions.
 - `RpcCallArgs` — `{app, path, method, params?, headers?, id?, verb?}`. `verb` defaults to `'POST'`; use `'GET'` for `side_effects: false` methods.
 - `rpc_call(args)` — merges `RPC_CALL_DEFAULT_HEADERS` (`host: 'localhost'`, `origin: 'http://localhost:5173'`, `Content-Type: 'application/json'`) under caller headers. Envelope-shape violations throw; JSON-RPC errors return `{ok: false, error}` so callers assert on `error.code` / `error.data.reason`.
 - `rpc_call_typed<T>(args, output_schema)` — parses the success `result` through the schema; throws on envelope failure, error response, or schema mismatch. Use `rpc_call` when the test needs to assert on error shapes.
@@ -822,7 +823,7 @@ points:
 
 - **`await_pending_effects: true`** is set by `create_test_app`. Fire-and-forget effects (audit logs, session touches, WS fan-out via `emit_after_commit`) resolve before the response returns, so tests can assert on side effects inline without manual flushing.
 - **Deep-path imports only.** Import from the canonical module (`testing/db.js`, `testing/rpc_helpers.js`, etc.); fuz_app's `dist/` ships no barrel.
-- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.js`.
+- **DI via small `*Deps` interfaces.** Stub factories accept the same narrow `*Deps` contracts production code uses — never `Pick<GodType, ...>`. New helpers needing env/fs/logger take `EnvDeps` / `FsReadDeps` / `Logger` from `runtime/deps.ts` or `@fuzdev/fuz_util/log.ts`.
 - **Keep the shared echo routes in sync with public surface.** When middleware or public API gains a new context variable, header, or field, update the echo in `middleware.ts` (`create_bearer_auth_test_app`, `create_test_middleware_stack_app`) alongside the assertions in `src/test/auth/*.test.ts`. Drift surfaces as a missed assertion, not a test failure.
 
 ## Cross-backend integration layer
@@ -893,7 +894,10 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
-  `oversized_reject_closes_connection` — each has a `test_if` reader),
+  `oversized_reject_closes_connection` / `peer_request` — each has a `test_if`
+  reader; `peer_request` (server-initiated requests — the `ActionPeer`
+  `peer/ping` round-trip) is `true` only for the Rust spine and `false` for the
+  TS family, whose server request transport is deferred),
   `test_if(cond, name, fn)`
   for capability-gated cases, and `in_process_capabilities` preset. The
   non-gating wiring facts (`bearer_auth` / `trusted_proxy` / `login_rate_limit`,
@@ -966,7 +970,7 @@ wire-shape check passes green on even when behavior is wrong.
 
 - `conformance_case.ts` — `ConformanceCase` Zod schema:
   `{name, request: {method, params?, as, verb?}, expect: {status,
-error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
+error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case is **data** — `method`
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
   closed `ConformancePrincipal` enum (`keeper` / `daemon` / `token` /
@@ -978,7 +982,24 @@ error_reason?, fields?}, note?, xfail?}`. A case is **data** — `method`
   `error_reason` is the imported
   `ERROR_*` constant (asserted against the RPC `error.data.reason` or the
   REST flat-body `error`; the bare `unauthenticated()` 401 carries no
-  reason, so `status` pins that denial class).
+  reason, so `status` pins that denial class). `equivalence_group` is the
+  **negative-space** axis: every case tagged with the same group string must
+  produce a **byte-identical** normalized response (`{status, body}`),
+  asserted per impl after the case loop. It promotes a masked pair
+  (wrong-password ≡ account-not-found, found-but-unauthorized ≡ not-found)
+  from "same status + reason" to "wire-indistinguishable", so a prober
+  hitting either spine can't tell the members apart — the twin of the
+  positive `output`-schema parity the runner already enforces. The
+  per-case status/reason assertions stay the non-vacuous positive control
+  (a both-paths-identically-broken group still fails the per-case checks).
+  `headers` is the **header** negative-space axis: a string value pins a
+  header present-and-equal (case-insensitive name), `null` pins it absent.
+  Independent of it, the runner enforces an always-on **no-fingerprint**
+  invariant on _every_ response (`conformance_table.ts` `FINGERPRINT_HEADERS`
+  — `Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both
+  spines, so a framework upgrade adding one can't become a silent
+  backend-fingerprinting oracle). Headers are deliberately kept out of the
+  `equivalence_group` `{status, body}` comparison (`Set-Cookie` / `Date` vary).
 - `conformance_table.ts` — `describe_conformance_table_tests({cases,
 setup_test, surface_source, capabilities, rpc_endpoints, session_options,
 principals?, suite_name?})`. Same `{setup_test, surface_source,
@@ -1058,6 +1079,30 @@ where one exists (forge) and be offered the role; harmless on the auth-only
 spine. Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
 `src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`.
 
+### `cross_backend/peer_ping_ws.ts` — `describe_peer_ping_ws_tests`
+
+The server→client **request/response** sibling of the notification suite above —
+the machinery proof for `ActionPeer`. `peer/ping` is `initiator: both`; the
+client→server direction already exists as `heartbeat`, this exercises the new
+server→client one. The observable trigger is a client invoking the `peer/ping`
+**action** over its own socket: the handler initiates a `peer/ping` request back
+to that socket (`ctx.request_client`), awaits the client's echo, validates it
+against `PingResponse`, and returns the validated shape — so one client RPC
+drives the whole round-trip and every outcome (success / `Timeout` / wrong-shape
+/ client-error) surfaces as that RPC's wire response. The client attaches an
+`on_request` responder **at construction** (the `create_ws_transport` seam) so
+the inbound server-initiated request is answered as soon as it arrives; the
+security negatives use the raw `WsClient.send` to inject unsolicited /
+cross-connection frames. Seven cases: the positive round-trip plus
+unsolicited-response rejection, per-connection id isolation, never-reply
+`Timeout`, wrong-shape rejection, client-error forwarding, and the HTTP
+no-transport path. Gated on `capabilities.peer_request` — `true` only on the
+Rust spine (server-initiated requests are Rust-first canonical), so it `.skip`s
+on the TS spines whose server request transport is the deferred convergence
+item; `peer/ping` is a protocol action (manifest-excluded), so parity is
+behavioral here, not via the manifest gate. Cross-process only; fuz_app's own
+wiring is `src/test/cross_backend/peer_ping_ws.cross.test.ts`.
+
 ### `cross_backend/sse_round_trip.ts` — `describe_cross_process_sse_tests`
 
 Cross-process counterpart to the in-process `sse_round_trip.ts` harness —
@@ -1159,12 +1204,19 @@ in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.t
   wire-frame types, and
   predicates (`is_notification`, `is_response_for`, ...). Both in-process
   (`ws_round_trip.ts`) and cross-process (`ws_transport.ts`) impls satisfy
-  this interface.
-- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?})`
+  this interface. Also owns `deliver_inbound` — the shared
+  parse→(respond|push)→resolve receive core both impls call (so the responder
+  branch is written once) — plus the `WsRequestResponder` / `WsResponderOutcome`
+  types for the **`on_request`** seam: a responder answers a server-initiated
+  request (`{result}` / `{error}` / `undefined` to swallow), the path
+  `describe_peer_ping_ws_tests` drives. With no `on_request` the seam is inert
+  (a server-initiated request flows to `messages` as before).
+- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?})`
   builds a real-upgrade WS client using the `ws` npm package (optional
   peerDep; consumers wiring cross-process tests `npm install --save-dev ws`).
   Threads the keeper cookie onto the upgrade so per-action auth succeeds on
-  the first message.
+  the first message. `on_request` (attached at construction, before the upgrade
+  completes) answers server-initiated requests via the shared `deliver_inbound`.
 - `testing/transports/sse_frame_reader.ts` — `create_sse_frame_reader(reader, default_timeout_ms?)`,
   the transport-agnostic SSE framing core over a
   `ReadableStreamDefaultReader<Uint8Array>`: `\n\n` framing, per-read timeout,

package/dist/testing/adversarial_input.js

@@ -14,7 +14,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
-import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.js';
+import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.ts';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS, } from '../http/error_schemas.js';

package/dist/testing/app_server.d.ts

@@ -13,7 +13,7 @@ import './assert_dev_env.js';
  * @module
  */
 import type { Hono } from 'hono';
-import type { Uuid } from '@fuzdev/fuz_util/id.js';
+import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type Keyring } from '../auth/keyring.js';
 import type { Db, DbType } from '../db/db.js';
 import type { PasswordHashDeps } from '../auth/password.js';

package/dist/testing/app_server.js

@@ -1,6 +1,6 @@
 import './assert_dev_env.js';
 import { z } from 'zod';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { create_validated_keyring } from '../auth/keyring.js';

package/dist/testing/auth_apps.js

@@ -8,7 +8,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { Hono } from 'hono';
-import { Logger } from '@fuzdev/fuz_util/log.js';
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_route_specs } from '../http/route_spec.js';
 import { is_public_auth } from '../http/auth_shape.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';

package/dist/testing/cross_backend/bench/bench_report.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { type BenchmarkComparison } from '@fuzdev/fuz_util/benchmark_stats.ts';
 import type { CrossImplBenchResult } from './run_cross_impl_bench.js';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's

package/dist/testing/cross_backend/bench/bench_report.js

@@ -1,6 +1,6 @@
 import '../../assert_dev_env.js';
-import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.js';
-import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.js';
+import { benchmark_format_markdown } from '@fuzdev/fuz_util/benchmark_format.ts';
+import { benchmark_stats_compare, } from '@fuzdev/fuz_util/benchmark_stats.ts';
 /**
  * Reporting adapters over a `CrossImplBenchResult` — all built on fuz_util's
  * formatters + Welch comparison. Markdown for human eyeballs, a per-scenario

package/dist/testing/cross_backend/bench/run_cross_impl_bench.d.ts

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.js';
+import type { BenchmarkConfig, BenchmarkResult } from '@fuzdev/fuz_util/benchmark_types.ts';
 import type { BootstrappedBackendHandle } from '../setup.js';
 import type { BenchScenario } from './scenario.js';
 /**

package/dist/testing/cross_backend/bench/run_cross_impl_bench.js

@@ -1,5 +1,5 @@
 import '../../assert_dev_env.js';
-import { Benchmark } from '@fuzdev/fuz_util/benchmark.js';
+import { Benchmark } from '@fuzdev/fuz_util/benchmark.ts';
 /**
  * Network-tuned defaults — fuz_util's micro-benchmark defaults (warmup 10,
  * min 30, duration 1000ms) are sized for sub-microsecond functions. RPC round

package/dist/testing/cross_backend/bootstrap_backend.d.ts

@@ -6,7 +6,7 @@ import '../assert_dev_env.js';
  * consumer's vitest `globalSetup` reduces to a single await:
  *
  * ```ts
- * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.js';
+ * import {bootstrap_backend} from '@fuzdev/fuz_app/testing/cross_backend/bootstrap_backend.ts';
  *
  * export default async function ({provide}) {
  *   const bootstrapped = await bootstrap_backend(deno_backend_config());

package/dist/testing/cross_backend/capabilities.d.ts

@@ -139,12 +139,33 @@ export interface BackendCapabilities {
      * smuggle detector. See `docs/security.md` §"Body Size Limiting".
      */
     readonly oversized_reject_closes_connection: boolean;
+    /**
+     * The backend can **initiate** a JSON-RPC request to a connected client
+     * and await its typed reply (the server→client request/response direction
+     * `ActionPeer` adds). Gates `describe_peer_ping_ws_tests` — the on-demand
+     * `peer/ping` round-trip plus its security negatives (unsolicited-response
+     * rejection, per-connection id isolation, never-replying `Timeout`,
+     * wrong-shape reply rejection).
+     *
+     * `true` for the Rust spine (server-initiated requests landed Rust-first
+     * canonical); `false` for the TS family — the TS server
+     * `BackendWebsocketTransport.send()` request path is the deferred
+     * twin-impl convergence item, so a TS backend can't yet drive the
+     * round-trip. Like ws/sse/cells, `peer/ping` stays off the standard
+     * declared surface (it's a protocol action, manifest-excluded), so this
+     * flag is the only opt-in into the peer parity coverage.
+     */
+    readonly peer_request: boolean;
 }
 /**
- * Capability declarations for the in-process Hono transport. Every flag
- * is `true` because in-process testing exercises the full backend with
- * no missing optional behaviors. Cross-process consumers
- * declare each flag explicitly per backend.
+ * Capability declarations for the in-process Hono transport. Nearly every
+ * flag is `true` because in-process testing exercises the full backend
+ * with no missing optional behaviors. The one exception is `peer_request`:
+ * the in-process driver runs the **TS** server (`register_action_ws`),
+ * whose server-initiated request transport is deferred, so it can't drive
+ * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
+ * cross-process-only regardless. Cross-process consumers declare each flag
+ * explicitly per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
 /**

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAUpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -36,10 +36,14 @@ import '../assert_dev_env.js';
  */
 import { test } from 'vitest';
 /**
- * Capability declarations for the in-process Hono transport. Every flag
- * is `true` because in-process testing exercises the full backend with
- * no missing optional behaviors. Cross-process consumers
- * declare each flag explicitly per backend.
+ * Capability declarations for the in-process Hono transport. Nearly every
+ * flag is `true` because in-process testing exercises the full backend
+ * with no missing optional behaviors. The one exception is `peer_request`:
+ * the in-process driver runs the **TS** server (`register_action_ws`),
+ * whose server-initiated request transport is deferred, so it can't drive
+ * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
+ * cross-process-only regardless. Cross-process consumers declare each flag
+ * explicitly per backend.
  */
 export const in_process_capabilities = Object.freeze({
     ws: true,
@@ -51,6 +55,7 @@ export const in_process_capabilities = Object.freeze({
     ready: true,
     account_status: true,
     oversized_reject_closes_connection: true,
+    peer_request: false,
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_relations.js

@@ -52,7 +52,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.js';
+import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput, } from '../../auth/cell_grant_action_specs.js';

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -85,6 +85,8 @@ export declare const ConformanceCaseExpectation: z.ZodObject<{
     status: z.ZodNumber;
     error_reason: z.ZodOptional<z.ZodString>;
     fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+    equivalence_group: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ConformanceCaseExpectation = z.infer<typeof ConformanceCaseExpectation>;
 /**
@@ -133,6 +135,8 @@ export declare const ConformanceCase: z.ZodObject<{
         status: z.ZodNumber;
         error_reason: z.ZodOptional<z.ZodString>;
         fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        equivalence_group: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     note: z.ZodOptional<z.ZodString>;
     xfail: z.ZodOptional<z.ZodObject<{

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;kBAqBrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -96,6 +96,32 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Specific field-value assertions on the success `result` (2xx) or the error ' +
             '`error.data` (non-2xx). Each key must deep-equal the corresponding response field.',
     }),
+    headers: z
+        .record(z.string(), z.string().nullable())
+        .optional()
+        .meta({
+        description: 'Per-header expectations on the response. Each key is a header name ' +
+            '(case-insensitive); a string value asserts the header is present and equals ' +
+            'it exactly, `null` asserts the header is ABSENT. Independent of this, the ' +
+            'runner enforces an unconditional no-fingerprint invariant on EVERY response ' +
+            '(`Server` / `X-Powered-By` / `WWW-Authenticate` must stay absent on both ' +
+            'spines), so a case only needs `headers` to pin a header beyond that ' +
+            'always-on floor.',
+    }),
+    equivalence_group: z
+        .string()
+        .optional()
+        .meta({
+        description: 'Tags this case as a member of an indistinguishability group. After all cases ' +
+            'run, the runner asserts every member of a group produced a BYTE-IDENTICAL ' +
+            'normalized response (`{status, body}`) — checked per impl. This promotes a ' +
+            'masked pair (found-but-unauthorized ≡ not-found, wrong-password ≡ ' +
+            'account-not-found) from "same status + reason" to "wire-indistinguishable", ' +
+            'and holds BOTH impls to it: a prober hitting either spine cannot tell the ' +
+            'members apart. A group needs >= 2 members; a member may still set `fields`. ' +
+            'The negative-space twin of the positive `output`-schema parity the runner ' +
+            'already asserts.',
+    }),
 });
 /**
  * Marks a case as a deferred-by-design gap. The runner routes it through

package/dist/testing/cross_backend/conformance_table.d.ts

@@ -36,6 +36,27 @@ export interface ConformanceTableOptions {
     /** `describe` block label. Defaults to `'conformance table'`. */
     readonly suite_name?: string;
 }
+/**
+ * Response headers that fingerprint the backend implementation or framework.
+ * Neither spine emits these; the runner asserts they stay absent on EVERY
+ * conformance response so a framework upgrade or consumer middleware that adds
+ * (say) `Server:` to one spine can't silently become a backend-identifying
+ * oracle. Lowercased — matched against the lowercased-key snapshot
+ * `headers_to_record` produces.
+ */
+export declare const FINGERPRINT_HEADERS: ReadonlyArray<string>;
+/**
+ * Assert a response carries none of the `FINGERPRINT_HEADERS`. Run on every
+ * case unconditionally — the always-on no-fingerprint floor.
+ */
+export declare const assert_no_fingerprint_headers: (headers: Record<string, string>, label: string) => void;
+/**
+ * Assert each declared header expectation: a string value must be present and
+ * equal (header name matched case-insensitively), `null` must be absent. The
+ * negative-space twin for headers — `expect.headers` pins a header beyond the
+ * always-on no-fingerprint floor.
+ */
+export declare const assert_expected_headers: (headers: Record<string, string>, expected: Record<string, string | null>, label: string) => void;
 /**
  * Register a `describe` block running every `ConformanceCase` as a
  * vitest `test` (or `xfail_until` for deferred-by-design rows). Drives

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwB9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkOD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAgBnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}