@fuzdev/fuz_app 0.97.0 → 0.98.0

package/dist/testing/cross_backend/capabilities.d.ts

@@ -142,18 +142,21 @@ export interface BackendCapabilities {
     /**
      * The backend can **initiate** a JSON-RPC request to a connected client
      * and await its typed reply (the server→client request/response direction
-     * `ActionPeer` adds). Gates `describe_peer_ping_ws_tests` — the on-demand
+     * ActionPeer adds). Gates `describe_peer_ping_ws_tests` — the on-demand
      * `peer/ping` round-trip plus its security negatives (unsolicited-response
      * rejection, per-connection id isolation, never-replying `Timeout`,
      * wrong-shape reply rejection).
      *
-     * `true` for the Rust spine (server-initiated requests landed Rust-first
-     * canonical); `false` for the TS family — the TS server
-     * `BackendWebsocketTransport.send()` request path is the deferred
-     * twin-impl convergence item, so a TS backend can't yet drive the
-     * round-trip. Like ws/sse/cells, `peer/ping` stays off the standard
-     * declared surface (it's a protocol action, manifest-excluded), so this
-     * flag is the only opt-in into the peer parity coverage.
+     * `true` for both the Rust spine (server-initiated requests landed
+     * Rust-first canonical) and the TS spine
+     * (`BackendWebsocketTransport.request_connection` drives the round-trip,
+     * correlated by `register_action_ws`). The conservative
+     * `ts_default_capabilities` keeps it `false` like sse/ready — a TS backend
+     * opts in once it mounts `peer/ping` on a WS endpoint **and** the HTTP RPC
+     * endpoint (the no-transport refusal). Like ws/sse/cells, `peer/ping` stays
+     * off the standard declared surface (it's a protocol action,
+     * manifest-excluded), so this flag is the only opt-in into the peer parity
+     * coverage.
      */
     readonly peer_request: boolean;
 }
@@ -161,10 +164,10 @@ export interface BackendCapabilities {
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
  * with no missing optional behaviors. The one exception is `peer_request`:
- * the in-process driver runs the **TS** server (`register_action_ws`),
- * whose server-initiated request transport is deferred, so it can't drive
- * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
- * cross-process-only regardless. Cross-process consumers declare each flag
+ * `describe_peer_ping_ws_tests` is cross-process-only (it needs a real bound
+ * socket with an `on_request` responder via `create_ws_transport`), so the
+ * in-process driver never runs it — the transport itself supports
+ * server-initiated requests. Cross-process consumers declare each flag
  * explicitly per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -39,10 +39,10 @@ import { test } from 'vitest';
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend
  * with no missing optional behaviors. The one exception is `peer_request`:
- * the in-process driver runs the **TS** server (`register_action_ws`),
- * whose server-initiated request transport is deferred, so it can't drive
- * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
- * cross-process-only regardless. Cross-process consumers declare each flag
+ * `describe_peer_ping_ws_tests` is cross-process-only (it needs a real bound
+ * socket with an `on_request` responder via `create_ws_transport`), so the
+ * in-process driver never runs it — the transport itself supports
+ * server-initiated requests. Cross-process consumers declare each flag
  * explicitly per backend.
  */
 export const in_process_capabilities = Object.freeze({

package/dist/testing/cross_backend/cell_cross_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmB9B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAG3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAErE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CAC5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAMnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAQrE,CAAC"}
+{"version":3,"file":"cell_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmB9B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAG3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAErE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CAC5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAMnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -122,6 +122,7 @@ export declare const ConformanceCaseExpectation: z.ZodObject<{
     status: z.ZodNumber;
     error_reason: z.ZodOptional<z.ZodString>;
     fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    absent_fields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
     equivalence_group: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -175,6 +176,7 @@ export declare const ConformanceCase: z.ZodObject<{
         status: z.ZodNumber;
         error_reason: z.ZodOptional<z.ZodString>;
         fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        absent_fields: z.ZodOptional<z.ZodArray<z.ZodString>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
         equivalence_group: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAY/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAY/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -130,6 +130,19 @@ export const ConformanceCaseExpectation = z.strictObject({
         description: 'Specific field-value assertions on the success `result` (2xx) or the error ' +
             '`error.data` (non-2xx). Each key must deep-equal the corresponding response field.',
     }),
+    absent_fields: z
+        .array(z.string())
+        .optional()
+        .meta({
+        description: 'Sensitive field names that must NOT appear ANYWHERE (at any depth) in the ' +
+            'normalized response body — the negative-space twin of `fields`. Each name is ' +
+            'searched recursively through the success `result` / error envelope, so a ' +
+            'secret column (`password_hash`, `token_hash`) that leaks at any nesting level ' +
+            '(top-level, inside a list element) fails the case. Pins "this secret never ' +
+            'serializes" on BOTH spines — a serialization regression would otherwise leak ' +
+            'identically and silently on each. Non-vacuous only when the body is known ' +
+            'non-empty (e.g. a list that always contains the caller); note that in the case.',
+    }),
     headers: z
         .record(z.string(), z.string().nullable())
         .optional()

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAOjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyJD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAOjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAuLD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAuKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -155,6 +155,29 @@ const assert_fields = (actual, fields, label) => {
         assert.deepEqual(record[key], expected, `${label}: field '${key}'`);
     }
 };
+/**
+ * Whether `key` is present as an own property of `value` or any object nested
+ * within it (arrays and objects walked recursively). The shape-agnostic test
+ * behind `expect.absent_fields` — a secret column leaking at any depth (inside
+ * a list element, a nested record) is caught, not just a top-level field.
+ */
+const has_key_anywhere = (value, key) => {
+    if (Array.isArray(value))
+        return value.some((v) => has_key_anywhere(v, key));
+    if (value !== null && typeof value === 'object') {
+        if (Object.hasOwn(value, key))
+            return true;
+        return Object.values(value).some((v) => has_key_anywhere(v, key));
+    }
+    return false;
+};
+/** Assert none of the sensitive field names appear anywhere in the response body. */
+const assert_absent_fields = (body, absent, label) => {
+    for (const key of absent) {
+        assert.ok(!has_key_anywhere(body, key), `${label}: response must not serialize the sensitive field '${key}' anywhere in its ` +
+            `body — a secret column leaked into the wire shape.`);
+    }
+};
 /**
  * Response headers that fingerprint the backend implementation or framework.
  * Neither spine emits these; the runner asserts they stay absent on EVERY
@@ -215,10 +238,16 @@ const is_success_status = (status) => status >= 200 && status < 300;
 const run_case = async (c, options, resolved_rpc_endpoints) => {
     const fixture = await options.setup_test();
     const { transport, headers, suppress_default_origin } = await resolve_principal(fixture, c.request.as, options.principals);
-    if (c.request.method.startsWith('/')) {
-        return run_rest_case(c, options, transport, headers);
+    const normalized = c.request.method.startsWith('/')
+        ? await run_rest_case(c, options, transport, headers)
+        : await run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    // Negative-space field check, uniform across REST + RPC and success + error
+    // bodies: a sensitive column (`password_hash`, `token_hash`) must not appear
+    // anywhere in what the prober sees.
+    if (c.expect.absent_fields) {
+        assert_absent_fields(normalized.body, c.expect.absent_fields, c.name);
     }
-    return run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    return normalized;
 };
 /** Dispatch + assert a case targeting an RPC method. */
 const run_rpc_case = async (c, transport, headers, suppress_default_origin, resolved_rpc_endpoints) => {

package/dist/testing/cross_backend/cookie_attributes.d.ts

@@ -0,0 +1,20 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session-cookie-attribute parity suite. */
+export interface CookieAttributesCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /**
+     * The spine's session cookie name (`handle.config.cookie_name`, e.g.
+     * `fuz_session`). The `Set-Cookie` under test is matched by this name so a
+     * future cookie-name change surfaces here as "no session cookie set" rather
+     * than a silent miss.
+     */
+    readonly cookie_name: string;
+    /** REST login route path. Default `/api/account/login`. */
+    readonly login_path?: string;
+    /** REST logout route path. Default `/api/account/logout`. */
+    readonly logout_path?: string;
+}
+export declare const describe_cookie_attributes_cross_tests: (options: CookieAttributesCrossTestOptions) => void;
+//# sourceMappingURL=cookie_attributes.d.ts.map

package/dist/testing/cross_backend/cookie_attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie_attributes.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cookie_attributes.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+C9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,WAAW,gCAAgC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoED,eAAO,MAAM,sCAAsC,GAClD,SAAS,gCAAgC,KACvC,IAmFF,CAAC"}

package/dist/testing/cross_backend/cookie_attributes.js

@@ -0,0 +1,158 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **session cookie attributes** over real HTTP.
+ *
+ * The session cookie's `Set-Cookie` attributes are the load-bearing browser
+ * security boundary: `HttpOnly` keeps the token out of JS (XSS can't read it),
+ * `Secure` keeps it off plaintext HTTP, `SameSite=Strict` is the primary CSRF
+ * defense (the Origin allowlist is only defense-in-depth), and `Path=/` scopes
+ * it to the whole app. A regression dropping any one of these is a real
+ * downgrade — and it's wire-observable, so both spines must emit the same
+ * hardened set. The cross-backend conformance table deliberately keeps
+ * `Set-Cookie` *out* of its byte-identity comparison (the signed value
+ * legitimately differs per request and per impl), so the attribute contract
+ * had no cross-backend pin: the TS spine's attributes were covered by
+ * `session_cookie.ts`'s own tests, but the Rust spine's `sign_session_cookie`
+ * / `clear_session_cookie` strings were asserted nowhere. This suite closes
+ * that gap on both impls by parsing the raw `Set-Cookie` and asserting the
+ * attributes directly. Three properties:
+ *
+ * - **successful login sets a hardened cookie** — `HttpOnly; Secure;
+ *   SameSite=Strict; Path=/` plus a positive integer `Max-Age` (the session
+ *   lifetime). The signed value is opaque here; only the attributes are pinned.
+ * - **a failed login sets no session cookie** — a denial mints no credential,
+ *   so there is no `Set-Cookie` for the session name at all. A spine that
+ *   leaked a (signed-but-unauthenticated) cookie on the 401 would fail here.
+ * - **logout clears the cookie with `Max-Age=0` and the same hardened flags** —
+ *   the clear must not silently drop `Secure` / `HttpOnly` / `SameSite=Strict`
+ *   (a cleared-but-unhardened `Set-Cookie` is a downgrade window).
+ *
+ * Both surfaces are flat REST (`POST /api/account/{login,logout}`) on every
+ * spine, so this is an imperative suite (not a `conformance_table` row) — the
+ * sibling of `origin.ts` / `login_security.ts`. Cross-process only: reading the
+ * raw `Set-Cookie` attributes needs the wire response (the in-process
+ * `parse_session` / `session_cookie.rs` unit tests cover each impl's cookie
+ * codec directly). Cited property: `docs/security.md` §"Session Security"
+ * (the "Cookie attributes" bullet — `HttpOnly; Secure; SameSite=Strict; Path=/`).
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+/**
+ * Parse a single `Set-Cookie` header value into `{name, value, attributes}`.
+ * Returns `null` for a malformed head (no `=`, empty name). Unlike the
+ * transport jar's `parse_set_cookie` (which drops everything after the first
+ * `;`), this retains the attributes — they are exactly what the suite asserts.
+ */
+const parse_set_cookie = (raw) => {
+    const parts = raw.split(';');
+    const head = (parts[0] ?? '').trim();
+    const eq = head.indexOf('=');
+    if (eq <= 0)
+        return null;
+    const name = head.slice(0, eq).trim();
+    if (!name)
+        return null;
+    const value = head.slice(eq + 1);
+    const attributes = new Map();
+    for (let i = 1; i < parts.length; i++) {
+        const attr = parts[i].trim();
+        if (!attr)
+            continue;
+        const attr_eq = attr.indexOf('=');
+        if (attr_eq === -1) {
+            attributes.set(attr.toLowerCase(), '');
+        }
+        else {
+            attributes.set(attr.slice(0, attr_eq).trim().toLowerCase(), attr.slice(attr_eq + 1).trim());
+        }
+    }
+    return { name, value, attributes };
+};
+/**
+ * Find the `Set-Cookie` for the session cookie among a response's headers.
+ * `getSetCookie()` returns each `Set-Cookie` as its own string (the only way
+ * to read attributes — `Headers.get()` collapses multiple cookies to one
+ * comma-joined string). Returns `undefined` when no session cookie was set.
+ */
+const find_session_cookie = (res, cookie_name) => {
+    for (const raw of res.headers.getSetCookie()) {
+        const parsed = parse_set_cookie(raw);
+        if (parsed && parsed.name === cookie_name)
+            return parsed;
+    }
+    return undefined;
+};
+/** Assert the hardened attribute set shared by the set + cleared cookies. */
+const assert_hardened_flags = (cookie, label) => {
+    assert.ok(cookie.attributes.has('httponly'), `${label}: cookie must be HttpOnly (no JS read)`);
+    assert.ok(cookie.attributes.has('secure'), `${label}: cookie must be Secure (HTTPS-only)`);
+    assert.strictEqual(cookie.attributes.get('samesite')?.toLowerCase(), 'strict', `${label}: cookie must be SameSite=Strict (CSRF backstop)`);
+    assert.strictEqual(cookie.attributes.get('path'), '/', `${label}: cookie Path must be '/'`);
+};
+export const describe_cookie_attributes_cross_tests = (options) => {
+    const { setup_test, cookie_name } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    const logout_path = options.logout_path ?? '/api/account/logout';
+    // Fresh-keeper-per-test wipes the DB between tests, so a literal username
+    // never collides (see `setup.ts`). Each test mints it fresh.
+    const username = 'cookie_attr_user';
+    describe('session cookie attribute parity', () => {
+        test('successful login sets a hardened session cookie (HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age>0)', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // Fresh transport so no pre-existing cookie rides along; the default
+            // Origin (= base_url) is allowlisted, so the login clears the Origin gate.
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD }),
+            });
+            assert.strictEqual(res.status, 200, 'valid credentials must log in');
+            const cookie = find_session_cookie(res, cookie_name);
+            assert.ok(cookie, `login must Set-Cookie the '${cookie_name}' session cookie`);
+            assert.ok(cookie.value.length > 0, 'the session cookie must carry a signed value');
+            assert_hardened_flags(cookie, 'login Set-Cookie');
+            const max_age = Number(cookie.attributes.get('max-age'));
+            assert.ok(Number.isInteger(max_age) && max_age > 0, `login cookie must carry a positive integer Max-Age (got ${cookie.attributes.get('max-age')})`);
+        });
+        test('failed login (wrong password) sets no session cookie', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: `wrong-${DEFAULT_TEST_PASSWORD}` }),
+            });
+            assert.strictEqual(res.status, 401, 'wrong password must be rejected');
+            assert.strictEqual(find_session_cookie(res, cookie_name), undefined, 'a failed login must not Set-Cookie a session — no credential is minted on denial');
+        });
+        test('logout clears the session cookie with Max-Age=0 and hardened flags', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // Log in on a fresh transport so its jar carries the session cookie into
+            // the logout request (logout is session-authenticated).
+            const transport = fixture.fresh_transport();
+            const login_res = await transport(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD }),
+            });
+            assert.strictEqual(login_res.status, 200, 'precondition: login must succeed');
+            const res = await transport(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({}),
+            });
+            assert.strictEqual(res.status, 200, 'logout must succeed for an authenticated session');
+            const cookie = find_session_cookie(res, cookie_name);
+            assert.ok(cookie, `logout must Set-Cookie a cleared '${cookie_name}'`);
+            assert.strictEqual(cookie.attributes.get('max-age'), '0', 'logout must clear the cookie with Max-Age=0');
+            assert_hardened_flags(cookie, 'logout Set-Cookie');
+        });
+    });
+};

package/dist/testing/cross_backend/credential_header_robustness.d.ts

@@ -0,0 +1,12 @@
+import '../assert_dev_env.js';
+/** Options for the credential-header robustness probe — needs the raw URL + a valid daemon token. */
+export interface CredentialHeaderRobustnessCrossTestOptions {
+    /** Base URL the spawned backend is reachable at (e.g. `http://localhost:1178`). */
+    readonly base_url: string;
+    /** RPC endpoint path to target. Default `/api/rpc`. */
+    readonly rpc_path?: string;
+    /** A valid daemon token (keeper) — `handle.daemon_token`. */
+    readonly daemon_token: string;
+}
+export declare const describe_credential_header_robustness_cross_tests: (options: CredentialHeaderRobustnessCrossTestOptions) => void;
+//# sourceMappingURL=credential_header_robustness.d.ts.map

package/dist/testing/cross_backend/credential_header_robustness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAwFD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -0,0 +1,179 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend **credential-header robustness** probe — the auth sibling of
+ * `body_size_smuggling.ts`.
+ *
+ * The auth middleware reads a single credential per header (`Authorization`,
+ * `X-Daemon-Token`). What a *duplicated*, *oversized*, or *control-char-injected*
+ * credential header does is framework-territory — Hono reads its headers via the
+ * Web `Headers` API, axum via `http::HeaderMap` — and the two could resolve a
+ * duplicate differently (first-vs-last), cap header size differently, or parse a
+ * malformed value differently. None of that is exercised over `fetch` (the
+ * `FetchTransport` can't emit a duplicate or malformed header), so it had no
+ * cross-impl pin. This raw-socket suite sends hand-framed requests and asserts
+ * the **security invariants that must hold regardless of how each framework
+ * resolves the ambiguity** — so it pins a real property without blessing one
+ * resolution over the other:
+ *
+ * - **a duplicated credential header never escalates** — a request carrying a
+ *   valid keeper `X-Daemon-Token` *and* a second, conflicting one must not
+ *   perform a keeper operation. The target omits `confirm`, so the documented
+ *   confirm guard (`purge_not_confirmed`) makes the honored-token branch a
+ *   guaranteed non-2xx with **zero side effect**, and the discarded-token
+ *   branch is a non-2xx auth/credential refusal — so whichever copy the
+ *   framework picks, the outcome is non-2xx. The same shape with two garbage
+ *   `Authorization` headers pins the bearer path can't be escalated either.
+ * - **a control-char-injected credential header can't smuggle or authenticate**
+ *   — embedded `CRLF` / bare `CR` in the value never frames a second request
+ *   (no smuggle) and never authenticates (the truncated / rejected value is no
+ *   token).
+ * - **no response desync** — each crafted request yields exactly one HTTP
+ *   response (a duplicate header that reframed the request would surface as a
+ *   second status line, like the body-size smuggling probe).
+ * - **an oversized credential header can't wedge the server** — after a request
+ *   with a 64 KiB `X-Daemon-Token` (well past both frameworks' header caps), a
+ *   subsequent normal request on a fresh connection still gets a response. The
+ *   oversized request's own outcome (4xx / 431 / connection close) is
+ *   don't-care; surviving it is the property.
+ *
+ * Raw-socket by necessity (`fetch` can't emit duplicate or malformed headers),
+ * so — like `body_size_smuggling.ts` — this is **cross-process only** and
+ * fixture-free: it needs only the base URL, the RPC path, and a valid daemon
+ * token (`handle.daemon_token`, kept current for the run by the same rotation
+ * the `_testing_reset` channel relies on). Cited property: `docs/security.md`
+ * §"Credential Type Hierarchy" (a leaked / conflicting credential header can't
+ * escalate the credential ceiling) + §"API Token Security" (bearer handling).
+ *
+ * `$lib`-free by contract (relative + `node:` specifiers only).
+ *
+ * @module
+ */
+import { connect } from 'node:net';
+import { describe, test, assert } from 'vitest';
+import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
+import { SPINE_RPC_PATH } from './default_spine_surface.js';
+/** A well-formed UUID that never names a real row. */
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+/** A value that is never a real credential — used for the conflicting / garbage copies. */
+const GARBAGE_TOKEN = 'not-a-real-credential-value';
+/**
+ * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
+ * everything the server sends back until it closes or `read_timeout_ms`
+ * elapses. Write errors are swallowed (a server closing mid-write on a rejected
+ * request is expected behavior); what matters is what we read back. Mirrors
+ * `body_size_smuggling.ts`'s `send_raw`.
+ */
+const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
+    const url = new URL(base_url);
+    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
+    const socket = connect({ host: url.hostname, port });
+    let received = '';
+    let settled = false;
+    const finish = () => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        resolve(received);
+    };
+    const timer = setTimeout(finish, read_timeout_ms);
+    socket.setEncoding('latin1');
+    socket.on('connect', () => socket.write(request_bytes));
+    socket.on('data', (chunk) => {
+        received += chunk;
+    });
+    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
+    socket.on('close', finish);
+});
+/**
+ * Count HTTP response status lines in a raw byte stream. Unanchored so a
+ * second (smuggled) response concatenated after the first body — which carries
+ * no trailing newline — is still counted; see `body_size_smuggling.ts`.
+ */
+const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
+/** The status code of the first HTTP response in a raw stream, or `null` if none. */
+const first_status = (raw) => {
+    const match = /HTTP\/1\.[01] (\d{3})/.exec(raw);
+    return match ? Number(match[1]) : null;
+};
+const is_success_status = (status) => status >= 200 && status < 300;
+/**
+ * Frame a raw HTTP/1.1 POST with the given extra header lines + JSON body.
+ * `Connection: close` so the server closes after one response (the response
+ * count is then unambiguous). The body is ASCII JSON, so `body.length` is the
+ * byte length — no `Buffer` needed.
+ */
+const rpc_post = (host, path, header_lines, body) => `POST ${path} HTTP/1.1\r\n` +
+    `Host: ${host}\r\n` +
+    `Content-Type: application/json\r\n` +
+    header_lines.map((h) => `${h}\r\n`).join('') +
+    `Content-Length: ${body.length}\r\n` +
+    `Connection: close\r\n` +
+    `\r\n` +
+    body;
+/**
+ * A keeper-gated `account_purge` body with `confirm` OMITTED — the confirm
+ * guard (`purge_not_confirmed`, before any deletion) guarantees the
+ * valid-credential branch is a non-2xx with zero side effect, so the
+ * no-escalation assertion holds regardless of which duplicate header wins.
+ */
+const purge_body = (id) => JSON.stringify({ jsonrpc: '2.0', method: 'account_purge', id, params: { account_id: NIL_UUID } });
+export const describe_credential_header_robustness_cross_tests = (options) => {
+    const { base_url, daemon_token } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const host = new URL(base_url).host;
+    describe('credential-header robustness', () => {
+        test('duplicate X-Daemon-Token (valid + conflicting) never escalates → one non-2xx response', async () => {
+            const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${daemon_token}`, `${DAEMON_TOKEN_HEADER}: ${GARBAGE_TOKEN}`], purge_body('dup-daemon'));
+            const raw = await send_raw(base_url, req, 2000);
+            assert.strictEqual(count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = first_status(raw);
+            assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
+            assert.ok(!is_success_status(status), `a duplicated daemon token must not perform a keeper operation; whichever copy wins, ` +
+                `the result must be non-2xx (got ${status})`);
+        });
+        test('duplicate Authorization bearer headers (both garbage) do not authenticate → one non-2xx response', async () => {
+            const req = rpc_post(host, rpc_path, [`Authorization: Bearer ${GARBAGE_TOKEN}`, `Authorization: Bearer ${GARBAGE_TOKEN}-2`], purge_body('dup-bearer'));
+            const raw = await send_raw(base_url, req, 2000);
+            assert.strictEqual(count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = first_status(raw);
+            assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
+            assert.ok(!is_success_status(status), `garbage bearer tokens (even duplicated) must not authenticate (got ${status})`);
+        });
+        test('control-char-injected credential header (CR/LF) cannot smuggle or authenticate', async () => {
+            // Embedded CRLF and a bare CR (header-splitting attempts) in a garbage
+            // `X-Daemon-Token` value. A strict HTTP parser rejects the request
+            // (400 / connection close); a lenient one truncates the value to a
+            // non-token or treats the injected line as an extra (harmless) header.
+            // Either way the framework-agnostic invariants hold: the injected bytes
+            // never frame a SECOND request (no smuggle), and the garbage credential
+            // never authenticates (no 2xx). `<= 1` (not `=== 1`) because a strict
+            // parser may close without a readable response — that's also "no smuggle".
+            const malformed = [
+                { label: 'CRLF header-split', value: `${GARBAGE_TOKEN}\r\nX-Injected: 1` },
+                { label: 'bare CR', value: `${GARBAGE_TOKEN}\rX-Injected: 1` },
+            ];
+            for (const { label, value } of malformed) {
+                const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${value}`], purge_body('ctrl-char'));
+                const raw = await send_raw(base_url, req, 2000);
+                assert.ok(count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
+                    `request (no smuggle). Raw head: ${raw.slice(0, 120)}`);
+                const status = first_status(raw);
+                assert.ok(status === null || !is_success_status(status), `${label}: a malformed credential header must never authenticate (got ${status})`);
+            }
+        });
+        test('oversized credential header does not crash or wedge the server', async () => {
+            // 64 KiB — well past both frameworks' header-size caps, so the request is
+            // rejected (4xx / 431 / connection close). Its own outcome is don't-care.
+            const oversized = 'a'.repeat(64 * 1024);
+            const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${oversized}`], purge_body('oversized'));
+            await send_raw(base_url, req, 2000);
+            // The property: the server survives it. A normal request on a fresh
+            // connection must still get a response (no crash, no wedged accept loop).
+            const probe = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
+            const raw = await send_raw(base_url, probe, 2000);
+            assert.ok(first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
+        });
+    });
+};

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAuBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -35,9 +35,11 @@ export const ts_default_capabilities = Object.freeze({
     // posture). A Bun-served consumer overrides to `false` (see the bun spine
     // config) — fail-loud rather than silently skipping the smuggle detector.
     oversized_reject_closes_connection: true,
-    // The TS server can't yet initiate server→client requests (the
-    // `BackendWebsocketTransport.send()` request path is the deferred
-    // twin-impl convergence), so the TS family skips the peer/ping suite.
+    // Off by default like `sse`/`ready`: the WS backend transport *can* initiate
+    // server→client requests (`BackendWebsocketTransport.request_connection`),
+    // but driving the full `peer/ping` suite also needs `peer/ping` mounted on
+    // the HTTP RPC endpoint (the no-transport case). The TS spine config opts in;
+    // a generic consumer enables it once it wires that mount.
     peer_request: false,
 });
 /**

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAOzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoBjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAOzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0BjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -1,4 +1,5 @@
 import '../assert_dev_env.js';
+import { peer_ping_action } from '../../actions/peer_ping.js';
 import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js';
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
@@ -29,6 +30,12 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         ...create_all_cell_actions(deps, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),
+        // `peer/ping` is mounted on the HTTP RPC endpoint too (not just WS) so an
+        // HTTP invocation reaches the handler and refuses with `peer_no_transport`
+        // rather than `method_not_found`. It's a protocol action, so it's filtered
+        // out of the action manifest (`create_testing_action_manifest_action`) —
+        // the WS endpoint registers it via the `protocol_actions` spread.
+        peer_ping_action,
     ];
     // Append the `_testing_action_manifest` backdoor last — it closes over the
     // complete `actions` list (plus its own spec) to dump the live method set