@fuzdev/fuz_app 0.96.0 → 0.98.0

package/dist/testing/cross_backend/conformance_case.js

@@ -33,8 +33,39 @@ import { z } from 'zod';
  * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
  *   `ROLE_ADMIN`), session credential.
  * - `daemon` — the keeper authenticated via the daemon-token header.
+ * - `invalid_daemon` — a *malformed/invalid* `X-Daemon-Token` carried
+ *   alongside the keeper's session cookie, over a non-browser (no-Origin)
+ *   transport. The middleware soft-fail-discards the invalid daemon token
+ *   (matching the Rust spine's `None`), so auth falls through to the session
+ *   leg: the request authenticates as the keeper-via-session and a
+ *   daemon-gated action then refuses the session credential with
+ *   `credential_type_required` — not a hard `invalid_daemon_token` 401. The
+ *   no-Origin transport keeps the daemon token on the invalid-token path
+ *   rather than the browser-context discard; the session base credential is
+ *   what makes the credential-type gate (not the auth gate) the refusing
+ *   layer (without it the discard would 401 anonymous).
+ * - `daemon_browser` — a *valid* `X-Daemon-Token` carried in a browser
+ *   context (default `Origin` present) alongside the keeper's session cookie.
+ *   Browsers attach `Origin` automatically; the daemon-token middleware
+ *   discards a header-bearing daemon token as browser context (mirroring the
+ *   bearer guard and the Rust spine's `is_browser_context`), so the *valid*
+ *   token is dropped and auth falls through to the session leg → a daemon-gated
+ *   action then refuses the session credential with `credential_type_required`.
+ *   Distinct from `invalid_daemon`: here the token is well-formed and current,
+ *   so a 403 (not a 400 confirm-guard hit like `daemon`) proves the
+ *   browser-context discard fired — a valid daemon token does NOT authenticate
+ *   when an `Origin` is present. `Origin` is deliberately NOT suppressed; its
+ *   presence is the signal under test.
  * - `token` — the keeper authenticated via a bearer api-token (non-browser
  *   context; the runner suppresses `Origin` so the token isn't discarded).
+ * - `bearer_browser` — a *valid* bearer api-token carried in a browser context
+ *   (default `Origin` present), fresh jar so NO session rides alongside. The
+ *   bearer middleware discards the token as browser context (mirroring the
+ *   daemon guard + the Rust spine's `is_browser_context`), so the request
+ *   arrives anonymous and an authed action 401s. Proves a stolen bearer cannot
+ *   be replayed from a browser — wire-indistinguishable from sending no
+ *   credential (the `token` principal is the honored counterpart: it suppresses
+ *   `Origin`, so the same token authenticates).
  * - `anonymous` — no credential, fresh cookie jar.
  * - `fresh_non_admin` — a freshly minted account with no roles, session
  *   credential (via the production invite → signup → login flow).
@@ -52,7 +83,10 @@ import { z } from 'zod';
 export const ConformancePrincipal = z.enum([
     'keeper',
     'daemon',
+    'invalid_daemon',
+    'daemon_browser',
     'token',
+    'bearer_browser',
     'anonymous',
     'fresh_non_admin',
     'role_holder',
@@ -96,6 +130,19 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Specific field-value assertions on the success `result` (2xx) or the error ' +
             '`error.data` (non-2xx). Each key must deep-equal the corresponding response field.',
     }),
+    absent_fields: z
+        .array(z.string())
+        .optional()
+        .meta({
+        description: 'Sensitive field names that must NOT appear ANYWHERE (at any depth) in the ' +
+            'normalized response body — the negative-space twin of `fields`. Each name is ' +
+            'searched recursively through the success `result` / error envelope, so a ' +
+            'secret column (`password_hash`, `token_hash`) that leaks at any nesting level ' +
+            '(top-level, inside a list element) fails the case. Pins "this secret never ' +
+            'serializes" on BOTH spines — a serialization regression would otherwise leak ' +
+            'identically and silently on each. Non-vacuous only when the body is known ' +
+            'non-empty (e.g. a list that always contains the caller); note that in the case.',
+    }),
     headers: z
         .record(z.string(), z.string().nullable())
         .optional()

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAOjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAuLD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAuKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -25,10 +25,21 @@ import '../assert_dev_env.js';
  * @module
  */
 import { assert, describe, test } from 'vitest';
+import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { find_auth_route, rest_auth_route_suffixes, } from '../integration_helpers.js';
 import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
 import {} from './conformance_case.js';
 import { xfail_until } from './xfail.js';
+/**
+ * A deliberately malformed `X-Daemon-Token` value for the `invalid_daemon`
+ * principal. Fails the `DaemonToken` Zod schema (not 43 base64url chars), so
+ * the daemon-token middleware soft-fail-discards it rather than authenticating
+ * — the request falls through with no identity, surfacing
+ * `credential_type_required` on a daemon-gated action (matching the Rust
+ * spine's `None`). Sent over a no-Origin transport so it lands on the
+ * invalid-token path, not the browser-context discard.
+ */
+const INVALID_DAEMON_TOKEN_VALUE = 'not-a-valid-daemon-token';
 /**
  * Map a `ConformancePrincipal` onto the transport + headers it
  * authenticates with, reading exclusively from the per-test `TestFixture`.
@@ -51,6 +62,39 @@ const resolve_principal = async (fixture, as, principals) => {
                 headers: fixture.create_daemon_token_headers(),
                 suppress_default_origin: true,
             };
+        case 'invalid_daemon':
+            // A malformed `X-Daemon-Token` carried ALONGSIDE the keeper's session
+            // cookie, over a non-browser (no-Origin) transport. The invalid daemon
+            // token is soft-fail-discarded (matching the Rust spine's `None`), so
+            // auth falls through to the session leg: the request authenticates as
+            // the keeper-via-session (clearing `require_auth`), then the daemon-gated
+            // action's credential-type gate refuses the session credential →
+            // `403 credential_type_required`. No-Origin keeps the daemon token on
+            // the invalid-token path, NOT the browser-context discard. Without the
+            // base credential this would 401 (anonymous) — the session is what makes
+            // the *credential-type* gate, not the auth gate, the refusing layer.
+            return {
+                transport: fixture.fresh_transport({ origin: null }),
+                headers: fixture.create_session_headers({
+                    [DAEMON_TOKEN_HEADER]: INVALID_DAEMON_TOKEN_VALUE,
+                }),
+                suppress_default_origin: true,
+            };
+        case 'daemon_browser':
+            // A VALID `X-Daemon-Token` carried in a browser context (default Origin
+            // present) ALONGSIDE the keeper's session cookie. The daemon-token
+            // middleware discards a header-bearing daemon token as browser context
+            // (mirroring the bearer guard + the Rust spine's `is_browser_context`),
+            // so the valid token is dropped and auth falls through to the session
+            // leg → keeper-via-session → a daemon-gated action refuses the session
+            // credential with `credential_type_required`. Origin is NOT suppressed —
+            // its presence is the browser-context signal under test. Unlike the
+            // `daemon` principal (no Origin → token honored → reaches the 400 confirm
+            // guard), the 403 here proves the valid token was discarded, not honored.
+            return {
+                transport: fixture.transport,
+                headers: fixture.create_session_headers(fixture.create_daemon_token_headers()),
+            };
         case 'token':
             // Bearer is discarded in a browser context — empty jar + no Origin.
             return {
@@ -58,6 +102,20 @@ const resolve_principal = async (fixture, as, principals) => {
                 headers: fixture.create_bearer_headers(),
                 suppress_default_origin: true,
             };
+        case 'bearer_browser':
+            // A VALID bearer api-token in a browser context (default Origin
+            // present), fresh jar so no session rides alongside. The bearer
+            // middleware discards a header-bearing token as browser context
+            // (mirroring the daemon guard + the Rust spine's `is_browser_context`),
+            // so the request arrives anonymous → an authed action 401s. Origin is
+            // NOT suppressed (its presence is the browser-context signal) — the
+            // inverse of the `token` principal, which suppresses it so the same
+            // token is honored. The 401 proves the valid token was discarded, not
+            // honored (a non-discarding leg would authenticate → 200).
+            return {
+                transport: fixture.fresh_transport(),
+                headers: fixture.create_bearer_headers(),
+            };
         case 'anonymous':
             // Fresh jar so the keeper cookie (cross-process) can't leak in.
             return { transport: fixture.fresh_transport(), headers: {} };
@@ -97,6 +155,29 @@ const assert_fields = (actual, fields, label) => {
         assert.deepEqual(record[key], expected, `${label}: field '${key}'`);
     }
 };
+/**
+ * Whether `key` is present as an own property of `value` or any object nested
+ * within it (arrays and objects walked recursively). The shape-agnostic test
+ * behind `expect.absent_fields` — a secret column leaking at any depth (inside
+ * a list element, a nested record) is caught, not just a top-level field.
+ */
+const has_key_anywhere = (value, key) => {
+    if (Array.isArray(value))
+        return value.some((v) => has_key_anywhere(v, key));
+    if (value !== null && typeof value === 'object') {
+        if (Object.hasOwn(value, key))
+            return true;
+        return Object.values(value).some((v) => has_key_anywhere(v, key));
+    }
+    return false;
+};
+/** Assert none of the sensitive field names appear anywhere in the response body. */
+const assert_absent_fields = (body, absent, label) => {
+    for (const key of absent) {
+        assert.ok(!has_key_anywhere(body, key), `${label}: response must not serialize the sensitive field '${key}' anywhere in its ` +
+            `body — a secret column leaked into the wire shape.`);
+    }
+};
 /**
  * Response headers that fingerprint the backend implementation or framework.
  * Neither spine emits these; the runner asserts they stay absent on EVERY
@@ -157,10 +238,16 @@ const is_success_status = (status) => status >= 200 && status < 300;
 const run_case = async (c, options, resolved_rpc_endpoints) => {
     const fixture = await options.setup_test();
     const { transport, headers, suppress_default_origin } = await resolve_principal(fixture, c.request.as, options.principals);
-    if (c.request.method.startsWith('/')) {
-        return run_rest_case(c, options, transport, headers);
+    const normalized = c.request.method.startsWith('/')
+        ? await run_rest_case(c, options, transport, headers)
+        : await run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    // Negative-space field check, uniform across REST + RPC and success + error
+    // bodies: a sensitive column (`password_hash`, `token_hash`) must not appear
+    // anywhere in what the prober sees.
+    if (c.expect.absent_fields) {
+        assert_absent_fields(normalized.body, c.expect.absent_fields, c.name);
     }
-    return run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    return normalized;
 };
 /** Dispatch + assert a case targeting an RPC method. */
 const run_rpc_case = async (c, transport, headers, suppress_default_origin, resolved_rpc_endpoints) => {

package/dist/testing/cross_backend/cookie_attributes.d.ts

@@ -0,0 +1,20 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session-cookie-attribute parity suite. */
+export interface CookieAttributesCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /**
+     * The spine's session cookie name (`handle.config.cookie_name`, e.g.
+     * `fuz_session`). The `Set-Cookie` under test is matched by this name so a
+     * future cookie-name change surfaces here as "no session cookie set" rather
+     * than a silent miss.
+     */
+    readonly cookie_name: string;
+    /** REST login route path. Default `/api/account/login`. */
+    readonly login_path?: string;
+    /** REST logout route path. Default `/api/account/logout`. */
+    readonly logout_path?: string;
+}
+export declare const describe_cookie_attributes_cross_tests: (options: CookieAttributesCrossTestOptions) => void;
+//# sourceMappingURL=cookie_attributes.d.ts.map

package/dist/testing/cross_backend/cookie_attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie_attributes.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cookie_attributes.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+C9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,WAAW,gCAAgC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoED,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAmFF,CAAC"}

package/dist/testing/cross_backend/cookie_attributes.js

@@ -0,0 +1,158 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **session cookie attributes** over real HTTP.
+ *
+ * The session cookie's `Set-Cookie` attributes are the load-bearing browser
+ * security boundary: `HttpOnly` keeps the token out of JS (XSS can't read it),
+ * `Secure` keeps it off plaintext HTTP, `SameSite=Strict` is the primary CSRF
+ * defense (the Origin allowlist is only defense-in-depth), and `Path=/` scopes
+ * it to the whole app. A regression dropping any one of these is a real
+ * downgrade — and it's wire-observable, so both spines must emit the same
+ * hardened set. The cross-backend conformance table deliberately keeps
+ * `Set-Cookie` *out* of its byte-identity comparison (the signed value
+ * legitimately differs per request and per impl), so the attribute contract
+ * had no cross-backend pin: the TS spine's attributes were covered by
+ * `session_cookie.ts`'s own tests, but the Rust spine's `sign_session_cookie`
+ * / `clear_session_cookie` strings were asserted nowhere. This suite closes
+ * that gap on both impls by parsing the raw `Set-Cookie` and asserting the
+ * attributes directly. Three properties:
+ *
+ * - **successful login sets a hardened cookie** — `HttpOnly; Secure;
+ *   SameSite=Strict; Path=/` plus a positive integer `Max-Age` (the session
+ *   lifetime). The signed value is opaque here; only the attributes are pinned.
+ * - **a failed login sets no session cookie** — a denial mints no credential,
+ *   so there is no `Set-Cookie` for the session name at all. A spine that
+ *   leaked a (signed-but-unauthenticated) cookie on the 401 would fail here.
+ * - **logout clears the cookie with `Max-Age=0` and the same hardened flags** —
+ *   the clear must not silently drop `Secure` / `HttpOnly` / `SameSite=Strict`
+ *   (a cleared-but-unhardened `Set-Cookie` is a downgrade window).
+ *
+ * Both surfaces are flat REST (`POST /api/account/{login,logout}`) on every
+ * spine, so this is an imperative suite (not a `conformance_table` row) — the
+ * sibling of `origin.ts` / `login_security.ts`. Cross-process only: reading the
+ * raw `Set-Cookie` attributes needs the wire response (the in-process
+ * `parse_session` / `session_cookie.rs` unit tests cover each impl's cookie
+ * codec directly). Cited property: `docs/security.md` §"Session Security"
+ * (the "Cookie attributes" bullet — `HttpOnly; Secure; SameSite=Strict; Path=/`).
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+/**
+ * Parse a single `Set-Cookie` header value into `{name, value, attributes}`.
+ * Returns `null` for a malformed head (no `=`, empty name). Unlike the
+ * transport jar's `parse_set_cookie` (which drops everything after the first
+ * `;`), this retains the attributes — they are exactly what the suite asserts.
+ */
+const parse_set_cookie = (raw) => {
+    const parts = raw.split(';');
+    const head = (parts[0] ?? '').trim();
+    const eq = head.indexOf('=');
+    if (eq <= 0)
+        return null;
+    const name = head.slice(0, eq).trim();
+    if (!name)
+        return null;
+    const value = head.slice(eq + 1);
+    const attributes = new Map();
+    for (let i = 1; i < parts.length; i++) {
+        const attr = parts[i].trim();
+        if (!attr)
+            continue;
+        const attr_eq = attr.indexOf('=');
+        if (attr_eq === -1) {
+            attributes.set(attr.toLowerCase(), '');
+        }
+        else {
+            attributes.set(attr.slice(0, attr_eq).trim().toLowerCase(), attr.slice(attr_eq + 1).trim());
+        }
+    }
+    return { name, value, attributes };
+};
+/**
+ * Find the `Set-Cookie` for the session cookie among a response's headers.
+ * `getSetCookie()` returns each `Set-Cookie` as its own string (the only way
+ * to read attributes — `Headers.get()` collapses multiple cookies to one
+ * comma-joined string). Returns `undefined` when no session cookie was set.
+ */
+const find_session_cookie = (res, cookie_name) => {
+    for (const raw of res.headers.getSetCookie()) {
+        const parsed = parse_set_cookie(raw);
+        if (parsed && parsed.name === cookie_name)
+            return parsed;
+    }
+    return undefined;
+};
+/** Assert the hardened attribute set shared by the set + cleared cookies. */
+const assert_hardened_flags = (cookie, label) => {
+    assert.ok(cookie.attributes.has('httponly'), `${label}: cookie must be HttpOnly (no JS read)`);
+    assert.ok(cookie.attributes.has('secure'), `${label}: cookie must be Secure (HTTPS-only)`);
+    assert.strictEqual(cookie.attributes.get('samesite')?.toLowerCase(), 'strict', `${label}: cookie must be SameSite=Strict (CSRF backstop)`);
+    assert.strictEqual(cookie.attributes.get('path'), '/', `${label}: cookie Path must be '/'`);
+};
+export const describe_cookie_attributes_cross_tests = (options) => {
+    const { setup_test, cookie_name } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    const logout_path = options.logout_path ?? '/api/account/logout';
+    // Fresh-keeper-per-test wipes the DB between tests, so a literal username
+    // never collides (see `setup.ts`). Each test mints it fresh.
+    const username = 'cookie_attr_user';
+    describe('session cookie attribute parity', () => {
+        test('successful login sets a hardened session cookie (HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age>0)', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // Fresh transport so no pre-existing cookie rides along; the default
+            // Origin (= base_url) is allowlisted, so the login clears the Origin gate.
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD }),
+            });
+            assert.strictEqual(res.status, 200, 'valid credentials must log in');
+            const cookie = find_session_cookie(res, cookie_name);
+            assert.ok(cookie, `login must Set-Cookie the '${cookie_name}' session cookie`);
+            assert.ok(cookie.value.length > 0, 'the session cookie must carry a signed value');
+            assert_hardened_flags(cookie, 'login Set-Cookie');
+            const max_age = Number(cookie.attributes.get('max-age'));
+            assert.ok(Number.isInteger(max_age) && max_age > 0, `login cookie must carry a positive integer Max-Age (got ${cookie.attributes.get('max-age')})`);
+        });
+        test('failed login (wrong password) sets no session cookie', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: `wrong-${DEFAULT_TEST_PASSWORD}` }),
+            });
+            assert.strictEqual(res.status, 401, 'wrong password must be rejected');
+            assert.strictEqual(find_session_cookie(res, cookie_name), undefined, 'a failed login must not Set-Cookie a session — no credential is minted on denial');
+        });
+        test('logout clears the session cookie with Max-Age=0 and hardened flags', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // Log in on a fresh transport so its jar carries the session cookie into
+            // the logout request (logout is session-authenticated).
+            const transport = fixture.fresh_transport();
+            const login_res = await transport(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD }),
+            });
+            assert.strictEqual(login_res.status, 200, 'precondition: login must succeed');
+            const res = await transport(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({}),
+            });
+            assert.strictEqual(res.status, 200, 'logout must succeed for an authenticated session');
+            const cookie = find_session_cookie(res, cookie_name);
+            assert.ok(cookie, `logout must Set-Cookie a cleared '${cookie_name}'`);
+            assert.strictEqual(cookie.attributes.get('max-age'), '0', 'logout must clear the cookie with Max-Age=0');
+            assert_hardened_flags(cookie, 'logout Set-Cookie');
+        });
+    });
+};

package/dist/testing/cross_backend/credential_header_robustness.d.ts

@@ -0,0 +1,12 @@
+import '../assert_dev_env.js';
+/** Options for the credential-header robustness probe — needs the raw URL + a valid daemon token. */
+export interface CredentialHeaderRobustnessCrossTestOptions {
+    /** Base URL the spawned backend is reachable at (e.g. `http://localhost:1178`). */
+    readonly base_url: string;
+    /** RPC endpoint path to target. Default `/api/rpc`. */
+    readonly rpc_path?: string;
+    /** A valid daemon token (keeper) — `handle.daemon_token`. */
+    readonly daemon_token: string;
+}
+export declare const describe_credential_header_robustness_cross_tests: (options: CredentialHeaderRobustnessCrossTestOptions) => void;
+//# sourceMappingURL=credential_header_robustness.d.ts.map

package/dist/testing/cross_backend/credential_header_robustness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAwFD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -0,0 +1,179 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend **credential-header robustness** probe — the auth sibling of
+ * `body_size_smuggling.ts`.
+ *
+ * The auth middleware reads a single credential per header (`Authorization`,
+ * `X-Daemon-Token`). What a *duplicated*, *oversized*, or *control-char-injected*
+ * credential header does is framework-territory — Hono reads its headers via the
+ * Web `Headers` API, axum via `http::HeaderMap` — and the two could resolve a
+ * duplicate differently (first-vs-last), cap header size differently, or parse a
+ * malformed value differently. None of that is exercised over `fetch` (the
+ * `FetchTransport` can't emit a duplicate or malformed header), so it had no
+ * cross-impl pin. This raw-socket suite sends hand-framed requests and asserts
+ * the **security invariants that must hold regardless of how each framework
+ * resolves the ambiguity** — so it pins a real property without blessing one
+ * resolution over the other:
+ *
+ * - **a duplicated credential header never escalates** — a request carrying a
+ *   valid keeper `X-Daemon-Token` *and* a second, conflicting one must not
+ *   perform a keeper operation. The target omits `confirm`, so the documented
+ *   confirm guard (`purge_not_confirmed`) makes the honored-token branch a
+ *   guaranteed non-2xx with **zero side effect**, and the discarded-token
+ *   branch is a non-2xx auth/credential refusal — so whichever copy the
+ *   framework picks, the outcome is non-2xx. The same shape with two garbage
+ *   `Authorization` headers pins the bearer path can't be escalated either.
+ * - **a control-char-injected credential header can't smuggle or authenticate**
+ *   — embedded `CRLF` / bare `CR` in the value never frames a second request
+ *   (no smuggle) and never authenticates (the truncated / rejected value is no
+ *   token).
+ * - **no response desync** — each crafted request yields exactly one HTTP
+ *   response (a duplicate header that reframed the request would surface as a
+ *   second status line, like the body-size smuggling probe).
+ * - **an oversized credential header can't wedge the server** — after a request
+ *   with a 64 KiB `X-Daemon-Token` (well past both frameworks' header caps), a
+ *   subsequent normal request on a fresh connection still gets a response. The
+ *   oversized request's own outcome (4xx / 431 / connection close) is
+ *   don't-care; surviving it is the property.
+ *
+ * Raw-socket by necessity (`fetch` can't emit duplicate or malformed headers),
+ * so — like `body_size_smuggling.ts` — this is **cross-process only** and
+ * fixture-free: it needs only the base URL, the RPC path, and a valid daemon
+ * token (`handle.daemon_token`, kept current for the run by the same rotation
+ * the `_testing_reset` channel relies on). Cited property: `docs/security.md`
+ * §"Credential Type Hierarchy" (a leaked / conflicting credential header can't
+ * escalate the credential ceiling) + §"API Token Security" (bearer handling).
+ *
+ * `$lib`-free by contract (relative + `node:` specifiers only).
+ *
+ * @module
+ */
+import { connect } from 'node:net';
+import { describe, test, assert } from 'vitest';
+import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
+import { SPINE_RPC_PATH } from './default_spine_surface.js';
+/** A well-formed UUID that never names a real row. */
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+/** A value that is never a real credential — used for the conflicting / garbage copies. */
+const GARBAGE_TOKEN = 'not-a-real-credential-value';
+/**
+ * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
+ * everything the server sends back until it closes or `read_timeout_ms`
+ * elapses. Write errors are swallowed (a server closing mid-write on a rejected
+ * request is expected behavior); what matters is what we read back. Mirrors
+ * `body_size_smuggling.ts`'s `send_raw`.
+ */
+const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
+    const url = new URL(base_url);
+    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
+    const socket = connect({ host: url.hostname, port });
+    let received = '';
+    let settled = false;
+    const finish = () => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        resolve(received);
+    };
+    const timer = setTimeout(finish, read_timeout_ms);
+    socket.setEncoding('latin1');
+    socket.on('connect', () => socket.write(request_bytes));
+    socket.on('data', (chunk) => {
+        received += chunk;
+    });
+    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
+    socket.on('close', finish);
+});
+/**
+ * Count HTTP response status lines in a raw byte stream. Unanchored so a
+ * second (smuggled) response concatenated after the first body — which carries
+ * no trailing newline — is still counted; see `body_size_smuggling.ts`.
+ */
+const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
+/** The status code of the first HTTP response in a raw stream, or `null` if none. */
+const first_status = (raw) => {
+    const match = /HTTP\/1\.[01] (\d{3})/.exec(raw);
+    return match ? Number(match[1]) : null;
+};
+const is_success_status = (status) => status >= 200 && status < 300;
+/**
+ * Frame a raw HTTP/1.1 POST with the given extra header lines + JSON body.
+ * `Connection: close` so the server closes after one response (the response
+ * count is then unambiguous). The body is ASCII JSON, so `body.length` is the
+ * byte length — no `Buffer` needed.
+ */
+const rpc_post = (host, path, header_lines, body) => `POST ${path} HTTP/1.1\r\n` +
+    `Host: ${host}\r\n` +
+    `Content-Type: application/json\r\n` +
+    header_lines.map((h) => `${h}\r\n`).join('') +
+    `Content-Length: ${body.length}\r\n` +
+    `Connection: close\r\n` +
+    `\r\n` +
+    body;
+/**
+ * A keeper-gated `account_purge` body with `confirm` OMITTED — the confirm
+ * guard (`purge_not_confirmed`, before any deletion) guarantees the
+ * valid-credential branch is a non-2xx with zero side effect, so the
+ * no-escalation assertion holds regardless of which duplicate header wins.
+ */
+const purge_body = (id) => JSON.stringify({ jsonrpc: '2.0', method: 'account_purge', id, params: { account_id: NIL_UUID } });
+export const describe_credential_header_robustness_cross_tests = (options) => {
+    const { base_url, daemon_token } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const host = new URL(base_url).host;
+    describe('credential-header robustness', () => {
+        test('duplicate X-Daemon-Token (valid + conflicting) never escalates → one non-2xx response', async () => {
+            const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${daemon_token}`, `${DAEMON_TOKEN_HEADER}: ${GARBAGE_TOKEN}`], purge_body('dup-daemon'));
+            const raw = await send_raw(base_url, req, 2000);
+            assert.strictEqual(count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = first_status(raw);
+            assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
+            assert.ok(!is_success_status(status), `a duplicated daemon token must not perform a keeper operation; whichever copy wins, ` +
+                `the result must be non-2xx (got ${status})`);
+        });
+        test('duplicate Authorization bearer headers (both garbage) do not authenticate → one non-2xx response', async () => {
+            const req = rpc_post(host, rpc_path, [`Authorization: Bearer ${GARBAGE_TOKEN}`, `Authorization: Bearer ${GARBAGE_TOKEN}-2`], purge_body('dup-bearer'));
+            const raw = await send_raw(base_url, req, 2000);
+            assert.strictEqual(count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = first_status(raw);
+            assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
+            assert.ok(!is_success_status(status), `garbage bearer tokens (even duplicated) must not authenticate (got ${status})`);
+        });
+        test('control-char-injected credential header (CR/LF) cannot smuggle or authenticate', async () => {
+            // Embedded CRLF and a bare CR (header-splitting attempts) in a garbage
+            // `X-Daemon-Token` value. A strict HTTP parser rejects the request
+            // (400 / connection close); a lenient one truncates the value to a
+            // non-token or treats the injected line as an extra (harmless) header.
+            // Either way the framework-agnostic invariants hold: the injected bytes
+            // never frame a SECOND request (no smuggle), and the garbage credential
+            // never authenticates (no 2xx). `<= 1` (not `=== 1`) because a strict
+            // parser may close without a readable response — that's also "no smuggle".
+            const malformed = [
+                { label: 'CRLF header-split', value: `${GARBAGE_TOKEN}\r\nX-Injected: 1` },
+                { label: 'bare CR', value: `${GARBAGE_TOKEN}\rX-Injected: 1` },
+            ];
+            for (const { label, value } of malformed) {
+                const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${value}`], purge_body('ctrl-char'));
+                const raw = await send_raw(base_url, req, 2000);
+                assert.ok(count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
+                    `request (no smuggle). Raw head: ${raw.slice(0, 120)}`);
+                const status = first_status(raw);
+                assert.ok(status === null || !is_success_status(status), `${label}: a malformed credential header must never authenticate (got ${status})`);
+            }
+        });
+        test('oversized credential header does not crash or wedge the server', async () => {
+            // 64 KiB — well past both frameworks' header-size caps, so the request is
+            // rejected (4xx / 431 / connection close). Its own outcome is don't-care.
+            const oversized = 'a'.repeat(64 * 1024);
+            const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${oversized}`], purge_body('oversized'));
+            await send_raw(base_url, req, 2000);
+            // The property: the server survives it. A normal request on a fresh
+            // connection must still get a response (no crash, no wedged accept loop).
+            const probe = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
+            const raw = await send_raw(base_url, probe, 2000);
+            assert.ok(first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
+        });
+    });
+};

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAuBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -35,9 +35,11 @@ export const ts_default_capabilities = Object.freeze({
     // posture). A Bun-served consumer overrides to `false` (see the bun spine
     // config) — fail-loud rather than silently skipping the smuggle detector.
     oversized_reject_closes_connection: true,
-    // The TS server can't yet initiate server→client requests (the
-    // `BackendWebsocketTransport.send()` request path is the deferred
-    // twin-impl convergence), so the TS family skips the peer/ping suite.
+    // Off by default like `sse`/`ready`: the WS backend transport *can* initiate
+    // server→client requests (`BackendWebsocketTransport.request_connection`),
+    // but driving the full `peer/ping` suite also needs `peer/ping` mounted on
+    // the HTTP RPC endpoint (the no-transport case). The TS spine config opts in;
+    // a generic consumer enables it once it wires that mount.
     peer_request: false,
 });
 /**

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8NxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAiOxF,CAAC"}