testing/cross_backend/credential_deadline.ts

Cross-process credential deadline suite — a long-lived connection closes when the credential it was opened with expires.

A WebSocket or an audit stream is authorized once, at open, and closed on revocation by identity — but expiry writes nothing a revocation listener could hear. So each spine carries the credential's deadline onto the connection (ResolvedAuth.credential_deadline: the earlier of a session's cookie and row expiry, an API token's row expiry) and closes it there: a socket with WS_CLOSE_SESSION_REVOKED and WS_CLOSE_CREDENTIAL_EXPIRED_REASON, a stream by ending it as a revoked one ends.

Each case pulls a fresh account's credential expiries in to expiry_seconds from now with the daemon-token _testing_shorten_credential_expiry seam, before opening the connection (the deadline is read when the credential resolves), then checks the connection is open short of the deadline and closed at it:

1. WebSocket × session — 4001, "Credential expired".
2. WebSocket × API token — the same.
3. Audit stream × session — the stream ends.
4. The seam only shortens: a second call asking for a later expiry moves nothing, and the socket still closes at the first deadline.

The fourth reachable combination, API token × audit stream, is not here: the stock audit stream admits sessions only on both spines. Each spine covers it below the wire — the Rust stream route on a widened credential gate, the TS deadline wait shared by both transports.

The cases run concurrently, each on its own account under one reset for the suite: the seam shortens only the account it names, so each case waits out its own deadline and the suite takes about one. Every case keeps the full expiry_seconds margin — the "open short of the deadline" check needs it.

Gated on capabilities.ws (cases 1, 2, 4) and capabilities.sse (case 3); cross-process only — the seam is mounted on the spine test binaries.