@fuzdev/fuz_app 0.111.0 → 0.112.0

package/dist/db/sql_columns.js

@@ -10,7 +10,16 @@
  * client-safe subset — rather than spelling a second column list, so the
  * drift guard on the base const (`assert_columns_match_live` in
  * `testing/db.ts`) covers every derived projection too. Twin of the Rust
- * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns`.
+ * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns` / `omit_columns`.
+ *
+ * A read that needs a column rendered as something other than the bare
+ * reference passes a `ColumnExpr` — the `expr` override, twin of the third
+ * argument to `fuz_db::qualify_columns`. Every timestamp that reaches the
+ * wire projects through `iso8601_timestamp_column` so both spines serialize
+ * the same instant to the same bytes; each query module builds its override
+ * with `iso8601_timestamp_expr` over its table const. An override costs one
+ * rule — a projected `ORDER BY` must qualify its column — stated on
+ * `qualify_columns`.
  *
  * Placement rule: a const lives in its table's query module. When two query
  * modules project the same table (the revoke cascades in
@@ -27,13 +36,78 @@
  * @module
  */
 import { assert_valid_sql_identifier } from './sql_identifier.js';
+/**
+ * Build a `to_char({alias}.{column} AT TIME ZONE 'UTC',
+ * 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` fragment for embedding in a SELECT
+ * projection, via a `ColumnExpr` override.
+ *
+ * The format literal is the spine's canonical timestamp wire shape —
+ * second-precision UTC ISO-8601, exactly 20 characters — byte-identical to
+ * `fuz_db::iso8601_timestamp_column`, so the two backends serialize the same
+ * instant to the same bytes. `to_iso8601_seconds` (`timestamp.ts`) is the
+ * same shape for stamps minted in TS rather than read from Postgres.
+ *
+ * @param alias - the table alias or name to qualify the column with, or the
+ *   empty string for an unqualified reference
+ * @param column - the timestamp column name
+ * @returns the `to_char(…)` fragment
+ */
+export const iso8601_timestamp_column = (alias, column) => alias === ''
+    ? `to_char(${column} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')`
+    : `to_char(${alias}.${column} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')`;
+/**
+ * Build a table's timestamp override: a `ColumnExpr` factory that projects
+ * each of `timestamp_columns` through `iso8601_timestamp_column` and declines
+ * every other column. The result takes the row qualifier — the empty string
+ * for a bare-table read, the alias for a JOIN — so one definition per query
+ * module serves every read in it.
+ *
+ * `timestamp_columns` is typed against `columns` (and checked at build time),
+ * so a misspelled name is a compile error and a stale one throws at module
+ * load rather than silently leaving a column projected as a `Date`.
+ *
+ * @param columns - the table's `*_COLUMNS` const
+ * @param timestamp_columns - the members of `columns` that carry timestamps
+ * @returns `(alias) => ColumnExpr`
+ * @throws Error when a name in `timestamp_columns` is not in `columns`
+ */
+export const iso8601_timestamp_expr = (columns, timestamp_columns) => {
+    for (const t of timestamp_columns) {
+        if (!columns.includes(t)) {
+            throw new Error(`iso8601_timestamp_expr: "${t}" is not in the column list "${columns.join(', ')}"`);
+        }
+    }
+    return (alias) => (column) => timestamp_columns.includes(column)
+        ? iso8601_timestamp_column(alias, column)
+        : undefined;
+};
+/**
+ * Render one projection entry — the `expr` override aliased back to its
+ * column name, or `fallback` when the override declines the column
+ * (`undefined`, and only `undefined` — see `ColumnExpr`).
+ *
+ * The alias this adds is what makes the `ORDER BY` rule on `qualify_columns`
+ * necessary.
+ *
+ * @param column - the column name, and the output name an override is aliased to
+ * @param fallback - what to project when the override declines — the bare
+ *   column, or the alias-qualified reference
+ * @param expr - the per-column expression override, if the read has one
+ * @returns the projection entry, `<expr> AS <column>` or `fallback`
+ */
+const render_column = (column, fallback, expr) => {
+    const override = expr?.(column);
+    return override === undefined ? fallback : `${override} AS ${column}`;
+};
 /**
  * Render a `*_COLUMNS` const as a SQL select list, in projection order.
  *
  * @param columns - the column names
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `a, b, c`
  */
-export const columns_sql = (columns) => columns.join(', ');
+export const columns_sql = (columns, expr) => columns.map((c) => render_column(c, c, expr)).join(', ');
 /**
  * Render a `*_COLUMNS` const as a SQL select list with every column qualified
  * by a table alias, for reads that alias the table (JOINs, the `c`-aliased
@@ -44,14 +118,27 @@ export const columns_sql = (columns) => columns.join(', ');
  * alias through gets a thrown error instead of a malformed (or injectable)
  * projection.
  *
+ * **An `expr` override costs one rule: an `ORDER BY` in a projected SELECT
+ * must qualify its column.** An override is aliased back to its own name
+ * (`… AS created_at`), and Postgres resolves a bare `ORDER BY created_at`
+ * against the *output* names first, so it would sort on the `to_char(…)`
+ * text — collapsing sub-second order into ties and losing the btree index (a
+ * `Sort` node over the expression instead of an `Index Scan`). Writing
+ * `ORDER BY <alias>.created_at` (or `<table>.created_at`) names the input
+ * column and both go away. The Rust twin needs no such rule: it decodes
+ * positionally, so `fuz_db::qualify_columns` emits no alias and its bare
+ * `ORDER BY created_at` already means the column.
+ *
  * @param columns - the column names
  * @param alias - the table alias or name to prefix each column with
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `alias.a, alias.b, alias.c`
  * @throws Error when `alias` is not a valid SQL identifier
  */
-export const qualify_columns = (columns, alias) => {
+export const qualify_columns = (columns, alias, expr) => {
     assert_valid_sql_identifier(alias);
-    return columns_sql(columns.map((c) => `${alias}.${c}`));
+    return columns.map((c) => render_column(c, `${alias}.${c}`, expr)).join(', ');
 };
 /**
  * Drop named columns from a `*_COLUMNS` const, preserving projection order —

package/dist/http/CLAUDE.md

@@ -107,7 +107,9 @@ wrapper). See `auth/signup_routes.ts`.
 
 **Ordering: 401 → authz → 403 → 400 → handler.** Mirrors the RPC dispatcher
 (`actions/action_rpc.ts`) so HTTP RPC and REST fail with the same priority, and
-matches the Rust spine, which validates handler-side. Body validation runs last
+matches the Rust spine, which validates handler-side — with the one difference
+that the dispatcher carries a per-action rate-limit phase (429) between 403 and
+400 that REST has no equivalent of. Body validation runs last
 so a caller the authority gates refuse learns nothing about the route's input
 shape — a 400 would confirm the route exists and describe how to call it.
 Params and query still validate first: they are part of addressing the route,

package/dist/http/jsonrpc_helpers.d.ts

@@ -43,6 +43,19 @@ export declare const is_jsonrpc_error_response: (message: unknown) => message is
  * Returns `null` if no valid id can be extracted.
  */
 export declare const to_jsonrpc_message_id: (message_or_id: unknown) => JsonrpcRequestId | null;
+/**
+ * The id an error response to a rejected envelope can echo: the frame's
+ * `id` when the frame is an object carrying a valid one, else `null`.
+ *
+ * Unlike `to_jsonrpc_message_id`, a scalar frame (`5`, `"x"`) is never read
+ * as its own id — a non-object body has no id to echo, which is the Rust
+ * twin's `classify` answer too. Both transports use this for the
+ * `invalid_request` reply.
+ *
+ * @param frame - the parsed body, of any shape
+ * @returns the echoable id, or `null`
+ */
+export declare const to_jsonrpc_envelope_id: (frame: unknown) => JsonrpcRequestId | null;
 /**
  * Normalizes input to JSON-RPC params format.
  * Returns `undefined` for null/undefined, wraps primitives in `{value}`.

package/dist/http/jsonrpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,eAAe,EACf,MAAM,cAAc,CAAC;AAKtB,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,GAClC,QAAQ,aAAa,EACrB,QAAQ,oBAAoB,GAAG,SAAS,EACxC,IAAI,gBAAgB,KAClB,cAUF,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,GACnC,IAAI,gBAAgB,EACpB,QAAQ,aAAa,KACnB,eAID,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,GACvC,QAAQ,aAAa,EACrB,QAAQ,yBAAyB,GAAG,SAAS,KAC3C,mBASF,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,6BAA6B,GACzC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAC9B,OAAO,oBAAoB,CAAC,OAAO,CAAC,KAClC,oBAID,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,IAAI,gBAAgB,GAAG,IAAI,EAC3B,OAAO,OAAO,KACZ,oBAyBF,CAAC;AAIF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,IAAI,OAAO,KAAG,EAAE,IAAI,gBAGzD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,GAC7B,SAAS,OAAO,KACd,OAAO,IAAI;IAAE,OAAO,EAAE,OAAO,eAAe,CAAA;CAIF,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAC9B,SAAS,OAAO,KACd,OAAO,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAGrB,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,cACI,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,mBACE,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,eACG,CAAC;AAEtE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,oBACJ,CAAC;AAIrE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,eAAe,OAAO,KAAG,gBAAgB,GAAG,IAOjF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAQxE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAQrE,CAAC"}
+{"version":3,"file":"jsonrpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,eAAe,EACf,MAAM,cAAc,CAAC;AAKtB,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,GAClC,QAAQ,aAAa,EACrB,QAAQ,oBAAoB,GAAG,SAAS,EACxC,IAAI,gBAAgB,KAClB,cAUF,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,GACnC,IAAI,gBAAgB,EACpB,QAAQ,aAAa,KACnB,eAID,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,GACvC,QAAQ,aAAa,EACrB,QAAQ,yBAAyB,GAAG,SAAS,KAC3C,mBASF,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,6BAA6B,GACzC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAC9B,OAAO,oBAAoB,CAAC,OAAO,CAAC,KAClC,oBAID,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,IAAI,gBAAgB,GAAG,IAAI,EAC3B,OAAO,OAAO,KACZ,oBAyBF,CAAC;AAIF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,IAAI,OAAO,KAAG,EAAE,IAAI,gBAGzD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,GAC7B,SAAS,OAAO,KACd,OAAO,IAAI;IAAE,OAAO,EAAE,OAAO,eAAe,CAAA;CAIF,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAC9B,SAAS,OAAO,KACd,OAAO,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAGrB,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,cACI,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,mBACE,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,eACG,CAAC;AAEtE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,oBACJ,CAAC;AAIrE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,eAAe,OAAO,KAAG,gBAAgB,GAAG,IAOjF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,gBAAgB,GAAG,IACX,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAQxE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAQrE,CAAC"}

package/dist/http/jsonrpc_helpers.js

@@ -110,6 +110,19 @@ export const to_jsonrpc_message_id = (message_or_id) => {
     const maybe_id = typeof message_or_id === 'object' ? message_or_id.id : message_or_id;
     return is_jsonrpc_request_id(maybe_id) ? maybe_id : null;
 };
+/**
+ * The id an error response to a rejected envelope can echo: the frame's
+ * `id` when the frame is an object carrying a valid one, else `null`.
+ *
+ * Unlike `to_jsonrpc_message_id`, a scalar frame (`5`, `"x"`) is never read
+ * as its own id — a non-object body has no id to echo, which is the Rust
+ * twin's `classify` answer too. Both transports use this for the
+ * `invalid_request` reply.
+ *
+ * @param frame - the parsed body, of any shape
+ * @returns the echoable id, or `null`
+ */
+export const to_jsonrpc_envelope_id = (frame) => typeof frame === 'object' ? to_jsonrpc_message_id(frame) : null;
 /**
  * Normalizes input to JSON-RPC params format.
  * Returns `undefined` for null/undefined, wraps primitives in `{value}`.

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6DjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA0CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA0CF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -150,11 +150,16 @@ const cell_fact_params_schema = z.strictObject({
     cell_id: Uuid,
     hash: FactHashSchema
 });
-/** Shared error-schema entry: tighten the auto-derived 400 to the literal emitted by params validation. */
+/**
+ * Shared error-schema entry: tighten the auto-derived 400 to the literal
+ * emitted by params validation. `issues` is optional because the framework
+ * emits it through `dev_only` — a production body carries the `error`
+ * literal alone.
+ */
 const params_400_error = {
     400: z.looseObject({
         error: z.literal(ERROR_INVALID_ROUTE_PARAMS),
-        issues: z.array(z.unknown())
+        issues: z.array(z.unknown()).optional()
     })
 };
 /**

package/dist/testing/CLAUDE.md

@@ -121,7 +121,8 @@ factories accept any migration namespace set.
 - `IS_CI` — `process.env.CI === 'true'`.
 - `DbFactory` — `{name, create, close, skip, skip_reason?}`.
 - `reset_pglite(db)` — `DROP SCHEMA public CASCADE` + recreate. Reuses a live PGlite instance.
-- `create_pglite_factory(init_schema)` — in-memory; no external deps; `skip: false`. See WASM caching below.
+- `create_pglite_factory(init_schema, options?)` — in-memory; no external deps; `skip: false`. `options.substitutable: false` pins the call site to PGlite when a substitute is installed. See WASM caching below.
+- `set_substitute_db_factory(create_factory | null)` — install a `DbFactoryBuilder` that stands in for `create_pglite_factory`, so a suite written against PGlite runs on another driver without being edited. Injected rather than selected here: the drivers a substitute wraps live in test-side code this shipped module can't import. fuz_app's own switch is `src/test/db_substitute.ts`.
 - `create_pg_factory(init_schema, test_url?)` — PostgreSQL; `skip: true` when `test_url` missing. Drops `schema_version` before `init_schema` so migrations re-evaluate against actual tables (prevents stale tracker rows from skipping migrations when DDL changes between sessions). Pool reused + cleaned up across `create()` calls.
 - `auth_truncate_tables` — `['invite', 'api_token', 'auth_session', 'role_grant', 'role_grant_offer', 'actor', 'account']` in FK-safe order. Excludes `audit_log` — unit DB tests don't need to truncate it.
 - `auth_integration_truncate_tables` — `auth_truncate_tables + ['audit_log']` for integration suites that exercise the audit path.
@@ -131,14 +132,13 @@ factories accept any migration namespace set.
 - `assert_columns_match_live(db, table, columns)` — the named-projection drift guard: asserts a `*_COLUMNS` const (`ACCOUNT_COLUMNS`, `CELL_COLUMNS`, a consumer's own) names exactly the live `public`-schema columns of `table`, via `query_public_columns(db, {table})`. Per module, or iterated from a table → const registry (fuz_app's own: `src/test/db/column_projections.db.test.ts`).
 
 **PGlite WASM caching.** `create_pglite_factory` shares a single PGlite
-instance in a module-level ref (`module_db`) across all factories in the
-same vitest worker thread. Subsequent `create()` calls
-`DROP SCHEMA public CASCADE` instead of paying the ~500–700ms WASM cold-start
-cost again. Each vitest file runs in its own worker, so no cross-file
-contamination — but inside a file, suites share state until the schema is
+instance in a module-level ref (`module_db`) across the PGlite factories it builds.
+Subsequent `create()` calls `DROP SCHEMA public CASCADE` instead of paying the
+~500–700ms WASM cold-start cost again, so suites share state until the next
 reset. The `db` vitest project (opted into by the `.db.test.ts` suffix) runs
 with `isolate: false` + `fileParallelism: false` to amortize WASM boot across
-every DB test file.
+every DB test file — which also makes that one instance the whole run's; a
+project that isolates its files gets one per worker instead.
 
 ## Test app assembly
 
@@ -207,7 +207,7 @@ test-only by construction.
 - `AuthTestApps` — `{public, authed, keeper, by_role: Map<string, Hono>}`.
 - `create_auth_test_apps(specs, roles)` — builds one app per auth level. Keeper app uses `credential_type: 'daemon_token'` so `require_credential_types(['daemon_token'])` passes.
 - `select_auth_app(apps, auth)` — map `RouteAuth` → matching Hono app. Throws for missing `role:*` entries.
-- `resolve_test_path(path)` — `:foo` → `test_foo`; adequate for routes without format-constrained params.
+- `create_route_skip_filter(skip_routes)` — the `'METHOD /path'` skip predicate the three adversarial sub-suites apply from their `skip_routes` option.
 
 ## Cross-impl schema parity
 
@@ -237,8 +237,10 @@ per-method auth shape.
 - `cross_backend/action_manifest.ts` — `ActionManifest` / `ActionManifestEntry`
   Zod schema (the `_testing_action_manifest` wire validator) + `build_action_manifest(specs)`,
   which normalizes each spec to `{method, side_effects, account, actor, roles,
-credential_types}` (auth axes pass through; `roles` / `credential_types` flatten
-  to sorted arrays). Twin of `schema_introspect.ts`. Excludes the protocol actions
+credential_types, rate_limit}` (auth axes pass through; `roles` /
+  `credential_types` flatten to sorted arrays; `rate_limit` is the declared
+  class or an explicit `null`, so a missing key reads as drift rather than a
+  default). Twin of `schema_introspect.ts`. Excludes the protocol actions
   (`heartbeat` / `cancel` / `peer/ping`) — `create_testing_action_manifest_action`
   filters them via the `protocol_action_specs` method set (Rust drops
   `PROTOCOL_ACTION_SPECS`); the two impls organize them differently (`peer/ping`
@@ -247,6 +249,8 @@ credential_types}` (auth axes pass through; `roles` / `credential_types` flatten
 - `cross_backend/action_manifest_parity.ts` — `diff_action_manifests` /
   `format_action_manifest_diffs` / `assert_action_manifests_equal` (twin of
   `schema_parity.ts`) — asserts exact method-set + per-method auth-shape parity.
+  `ActionManifestDiff` kinds: `method_only_in`, `side_effects_differ`,
+  `rate_limit_differs`, `auth_field_differs`, `auth_list_differs`.
 - `cross_backend/setup.ts` `capture_action_manifest(handle)` — dumps a backend's
   manifest over the daemon-token `_testing_action_manifest` channel (twin of
   `capture_schema_snapshot`).
@@ -255,9 +259,9 @@ It runs under the same dual-spawn `cross_backend_parity` project (one TS-spine +
 Rust-stub spawn serves both gates). It complements the in-repo
 `spine_method_coverage` reconciliation gate (which proves _mounted ⟹ covered_);
 this proves _TS-mount-set ≡ Rust-mount-set_. The gate asserts **exact** parity —
-every mounted method and its full auth shape (side-effects + the four auth axes)
-must match across the two impls, with no allowlisted divergences (see
-`action_manifest_parity.cross.test.ts`).
+every mounted method and its full auth shape (side-effects, the four auth axes,
+the rate-limit class) must match across the two impls, with no allowlisted
+divergences (see `action_manifest_parity.cross.test.ts`).
 
 **Cross-impl gate pattern** — a dual-impl consumer running two backends
 (a TS Hono server and a Rust spine server) against a shared schema, plus
@@ -367,7 +371,7 @@ Walks Zod schemas to generate valid values for adversarial/round-trip tests.
 
 - `detect_format(field_schema)` — reads `format` / `pattern` from the JSON Schema representation.
 - `generate_valid_value(field, field_schema)` — base-type switch producing a valid sample (UUIDs → nil UUID, strings → `'xxxxxxxxxx'`, numbers → `1`, objects → recurse, enums → first entry, etc.). For branded-string refinements, walks a fallback chain synthesized from the `pattern` string the JSON Schema representation exposes: fixed-length hex (`^[0-9a-f]{N}$` — blake3 / sha256 / md5 digests; `0`.repeat(N)), prefix-lengthed slug (`^<prefix>_[A-Za-z0-9_-]{N}$` — `ApiTokenId`-style ids; `<prefix>_` + `x`.repeat(N)), absolute path prefix, URL prefix. First candidate that `safeParse` accepts is used.
-- `resolve_valid_path(path, params_schema?)` — swaps `:param` for valid-format values (nil UUID for UUID params, `test_param` otherwise).
+- `resolve_valid_path(path, params_schema?)` — swaps `:param` for a value the params schema accepts. Prefers `test_<name>` wherever the field schema admits it (the param name keeps failure messages readable); otherwise a UUID param takes the nil UUID and anything else is synthesized from the schema, percent-encoded. A synthesized value containing `/` is refused (it would route elsewhere) and falls back to `test_<name>`.
 - `generate_valid_body(input_schema) => Record<string, unknown> | undefined` — builds a body satisfying the input schema. Throws with Zod `issues` if the generated body fails validation — surfaces broken generation logic with a descriptive error rather than a confusing 400 downstream.
 
 ### `integration_helpers.ts` — route lookup + body checks
@@ -398,7 +402,16 @@ case per route):
 4. **adversarial input validation** — delegated to `describe_adversarial_input`.
 5. **adversarial 404 response validation** — delegated to `describe_adversarial_404`.
 
-Options: `{build: () => AppSurfaceSpec, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix?, security_policy?, error_schema_tightness?}`.
+Options: `{build: () => AppSurfaceSpec, snapshot_path, expected_public_routes, expected_api_middleware, roles, api_path_prefix?, security_policy?, error_schema_tightness?, skip_routes?}`.
+
+`skip_routes` is a list of `'METHOD /path'` surface keys the three
+adversarial sub-suites drop, forwarded to each of them (it also sits on
+`AdversarialTestOptions` for the standalone `describe_adversarial_auth` /
+`describe_adversarial_input` / `describe_adversarial_404` calls). It is the
+escape hatch for a route that cannot be driven generically at all — a
+handler needing real seeded state, a path segment no schema describes. A
+route whose params merely carry a format needs no entry: `resolve_valid_path`
+synthesizes a segment the route accepts.
 
 Also exported: `describe_adversarial_auth(options)` (group 3 on its own) and
 `build_error_schema_lookup(specs, middleware_specs?)` (pre-built
@@ -480,7 +493,7 @@ For every route spec, fires a valid request with matching auth and validates
 the response against declared schemas. DB-backed via `create_test_app`.
 Per-route test (`test.each`) — one line per route in the vitest output.
 
-Options: `{setup_test, surface_source, capabilities, skip_routes?, input_overrides?}`.
+Options: `{setup_test, surface_source, skip_routes?, input_overrides?, success_fixtures?}`.
 `input_overrides` is a `Map<"METHOD /path", body>` — override generated
 bodies for routes whose input schema can't round-trip cleanly (e.g. fields
 that must reference DB state).
@@ -493,7 +506,7 @@ picks them up separately.
 DB-backed round-trip for RPC: one POST test for all methods, one GET test
 for `side_effects: false` methods. Successful responses validate against
 `action.spec.output`; error responses validate as well-formed JSON-RPC error
-envelopes. Options: `{setup_test, surface_source, capabilities, session_options, rpc_endpoints, skip_methods?, input_overrides?}`.
+envelopes. Options: `{setup_test, surface_source, session_options, rpc_endpoints, skip_methods?, input_overrides?, success_fixtures?}`.
 The admin RPC auth test picks a session-based identity (`authed` / `admin` /
 bootstrapped keeper) based on `method.auth`; keeper uses the daemon token.
 
@@ -568,7 +581,7 @@ Support functions: `collect_json_schema_property_names(schema)` (walks
 `assert_output_schemas_no_sensitive_fields(surface, fields?)`,
 `assert_non_admin_schemas_no_admin_fields(surface, fields?)`.
 
-Options: `{setup_test, surface_source, capabilities, sensitive_fields?, admin_only_fields?, skip_routes?}`.
+Options: `{setup_test, surface_source, sensitive_fields?, admin_only_fields?, skip_routes?}`.
 
 ### `rate_limiting.ts` — `describe_rate_limiting_tests`
 
@@ -626,7 +639,7 @@ Override with
 minimal route sets whose declared error codes outpace the suite's
 denial-path drivers).
 
-Options: `{setup_test, surface_source, capabilities, session_options, rpc_endpoints, error_coverage_min?}`.
+Options: `{setup_test, surface_source, session_options, rpc_endpoints, error_coverage_min?}`.
 
 ### `admin_integration.ts` — `describe_standard_admin_integration_tests`
 
@@ -646,7 +659,7 @@ header/account mismatch. Direct-grant fixtures (test focuses on revoke or
 isolation, not the consent path) go through `create_test_role_grant_direct`
 from `db_entities.ts`.
 
-Required options: `{setup_test, surface_source, capabilities, session_options, rpc_endpoints: RpcEndpointsSuiteOption, roles: RoleSchemaResult, admin_prefix?}`.
+Required options: `{setup_test, surface_source, session_options, rpc_endpoints: RpcEndpointsSuiteOption, roles: RoleSchemaResult, admin_prefix?}`.
 
 `rpc_endpoints` is `Array<RpcEndpointSpec> | ((ctx: AppServerContext) => Array<RpcEndpointSpec>)` —
 the same `RpcEndpointsSuiteOption` union every DB-backed suite accepts
@@ -1179,10 +1192,23 @@ never sees them). Both parse every success response against the verb's Zod
 **output** schema, so a TS↔Rust envelope drift fails the suite — not just a
 payload-field drift. Call-site primitives (`cross_rpc_call` / `error_reason` /
 `expect_output`) live in `cross_backend/cell_cross_helpers.ts`; the shared
-options shape is `RpcPathCrossSuiteOptions` from `cross_backend/setup.ts` (the
-neutral base every RPC-dispatched imperative cross suite aliases — origin,
-body-size, actor lookup/search, account lifecycle, app settings, testing
-backdoor, cell).
+options shape is `RpcPathCapabilityGatedCrossSuiteOptions` from
+`cross_backend/setup.ts`. `cross_backend/wire_shapes.ts` carries
+`assert_iso8601_seconds` / `assert_iso8601_seconds_nullable` — the byte-level
+gate on the canonical second-precision UTC timestamp shape, which a
+`z.string()` output schema can't catch (a millisecond stamp parses fine).
+The shared suites pin it on the account-status account + role grants, a
+session, a minted + listed API token, a cell's `created_at` / `updated_at`,
+an audit row, an admin account listing, and an offer's `created_at` /
+`expires_at`. `cross_backend/setup.ts` carries the four bases every
+imperative cross suite aliases: `CrossSuiteOptions` (`setup_test` alone),
+`CapabilityGatedCrossSuiteOptions` (+ `capabilities` — `ready`),
+`RpcPathCrossSuiteOptions` (+ `rpc_path?` — origin, body-size, actor
+lookup/search, app settings, testing backdoor), and the intersection
+`RpcPathCapabilityGatedCrossSuiteOptions` (every `cell_*` suite, query-shape,
+token-scope surface, fact-serving, account lifecycle). A suite takes the
+capability-carrying variant only when it actually gates cases on a flag, so
+the option type states whether the bundle is read.
 
 - **`describe_cell_crud_cross_tests`** (gates on `capabilities.cell_crud`) —
   the create → get → update → delete → list lifecycle threading the id, plus
@@ -1387,7 +1413,7 @@ censuses). Cross-process only; fuz_app's own wiring is
 
 ### Origin verification parity — `cross_backend/origin.ts`
 
-`describe_origin_cross_tests({setup_test, capabilities, rpc_path?})` — the
+`describe_origin_cross_tests({setup_test, rpc_path?})` — the
 imperative Origin-verification suite: disallowed `Origin` → 403 `forbidden_origin` (refused
 before dispatch), absent `Origin` → request passes (non-browser direct access).
 Imperative (not a conformance-table row) because origin rejection is
@@ -1461,7 +1487,7 @@ drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 
 ### Testing-backdoor credential gate — `cross_backend/testing_backdoor.ts`
 
-`describe_testing_backdoor_cross_tests({setup_test, capabilities, rpc_path?})` —
+`describe_testing_backdoor_cross_tests({setup_test, rpc_path?})` —
 the negative-credential parity suite for the `_testing_*` backdoor actions.
 For each of `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
 `_testing_schema_snapshot` (the three privileged writes plus the schema-dump
@@ -1471,7 +1497,7 @@ proving the daemon-token gate that fences each backdoor action holds end-to-end
 on the real dispatcher (the spec-derived `describe_rpc_attack_surface_tests`
 never enumerates them because they're off the declared surface). Each method is
 sent with **valid** params so each case varies only the credential (validation
-runs after the gates — order is 401 → authz → 403 → 400); the handler never
+runs after the gates — order is 401 → authz → 403 → 429 → 400); the handler never
 runs. Cited property: `docs/security.md`
 §Test Backdoor Actions. Cross-process only (the `_testing_*` actions are
 mounted on the spawned binary, not the in-process app — like the ws/sse

package/dist/testing/admin_integration.d.ts

@@ -3,7 +3,6 @@ import type { SessionOptions } from '../auth/session_cookie.js';
 import { type RoleSchemaResult } from '../auth/role_schema.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
 import type { AppSurfaceSpec } from '../http/surface.js';
-import type { BackendCapabilities } from './cross_backend/capabilities.js';
 import type { SetupTest } from './cross_backend/setup.js';
 /**
  * Configuration for `describe_standard_admin_integration_tests`.
@@ -21,8 +20,6 @@ export interface StandardAdminIntegrationTestOptions {
      * shape for in-process and cross-process tests).
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
-    capabilities: BackendCapabilities;
     /** Session config — needed for cookie_name + factory-form rpc_endpoints resolution. */
     session_options: SessionOptions<string>;
     /** Role schema result from `create_role_schema()` — used to determine valid/invalid/web-grantable roles. */

package/dist/testing/admin_integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAYvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm5BF,CAAC"}
+{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAYvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAk5BF,CAAC"}

package/dist/testing/admin_integration.js

@@ -77,7 +77,6 @@ export const describe_standard_admin_integration_tests = (options) => {
     // confusing test failure when `rpc_endpoints` is missing.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
-    void options.capabilities;
     describe('standard_admin_integration', () => {
         const { cookie_name } = options.session_options;
         const { role_specs } = options.roles;

package/dist/testing/adversarial_404.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAyBlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA2E1E,CAAC"}
+{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAyBlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA6E1E,CAAC"}

package/dist/testing/adversarial_404.js

@@ -13,7 +13,7 @@ import './assert_dev_env.js';
 import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
 import { is_null_schema } from '../http/schema_helpers.js';
-import { create_auth_test_apps, select_auth_app } from './auth_apps.js';
+import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
 import { resolve_valid_path, generate_valid_body } from './schema_generators.js';
 /**
  * Extract the error code from a 404 Zod schema for use in the stub handler.
@@ -51,6 +51,7 @@ const extract_404_error_code = (schema) => {
 export const describe_adversarial_404 = (options) => {
     const { build, roles } = options;
     const { surface, route_specs } = build();
+    const is_skipped = create_route_skip_filter(options.skip_routes);
     // Build spec lookup for Zod schema access
     const spec_lookup = new Map();
     for (const spec of route_specs) {
@@ -63,6 +64,8 @@ export const describe_adversarial_404 = (options) => {
             continue;
         if (!route.error_schemas || !('404' in route.error_schemas))
             continue;
+        if (is_skipped(route))
+            continue;
         const key = `${route.method} ${route.path}`;
         const spec = spec_lookup.get(key);
         if (!spec?.params || !spec.errors?.[404])

package/dist/testing/adversarial_input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8ClE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAkN5E,CAAC"}
+{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8ClE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAmN5E,CAAC"}

package/dist/testing/adversarial_input.js

@@ -18,7 +18,7 @@ import { zod_unwrap_to_object, zod_extract_fields } from '@fuzdev/fuz_util/zod.t
 import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS } from '../http/error_schemas.js';
-import { create_auth_test_apps, select_auth_app } from './auth_apps.js';
+import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
 import { detect_format, generate_valid_value, resolve_valid_path } from './schema_generators.js';
 // --- Payload generation ---
 /** One wrong-type value per base type — one representative is sufficient. */
@@ -374,9 +374,10 @@ const build_query_url = (path, query) => {
 export const describe_adversarial_input = (options) => {
     const { build, roles } = options;
     const { surface, route_specs } = build();
-    const routes_with_input = filter_routes_with_input(surface);
-    const routes_with_params = filter_routes_with_params(surface);
-    const routes_with_query = filter_routes_with_query(surface);
+    const is_skipped = create_route_skip_filter(options.skip_routes);
+    const routes_with_input = filter_routes_with_input(surface).filter((r) => !is_skipped(r));
+    const routes_with_params = filter_routes_with_params(surface).filter((r) => !is_skipped(r));
+    const routes_with_query = filter_routes_with_query(surface).filter((r) => !is_skipped(r));
     if (routes_with_input.length === 0 &&
         routes_with_params.length === 0 &&
         routes_with_query.length === 0)

package/dist/testing/app_server.d.ts

@@ -3,8 +3,9 @@ import './assert_dev_env.js';
  * Bootstrapped app server factory for integration tests.
  *
  * Creates a keeper account, API token, and signed session cookie on a
- * database. By default uses a cached in-memory PGlite (shared WASM instance
- * per vitest worker thread via `test_db.ts` module cache); pass `db` to use
+ * database. By default uses a cached in-memory PGlite (one shared WASM instance
+ * per loaded copy of `testing/db.ts` — once per run under the `db` project's
+ * `isolate: false` + `fileParallelism: false`); pass `db` to use
  * an existing database (any driver) instead.
  *
  * Also provides `create_test_app` — a combined helper that creates both
@@ -312,7 +313,7 @@ export interface TestApp {
  *
  * A fresh Hono app is created each call — middleware closures bind to the
  * server's deps (db, keyring), so reuse across servers is unsafe.
- * The expensive resource (PGlite WASM) is cached separately in `test_db.ts`.
+ * The expensive resource (PGlite WASM) is cached separately in `testing/db.ts`.
  *
  * @param options - test app configuration
  * @returns a `TestApp` ready for HTTP testing

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AA0ID,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CA0E7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAgJD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CA0E7B,CAAC"}

package/dist/testing/app_server.js

@@ -31,8 +31,8 @@ export const stub_password_deps = {
 /** 64-hex-char test cookie secret — deterministic, never used in production. */
 export const TEST_COOKIE_SECRET = 'a'.repeat(64);
 // Module-level PGlite factory for create_test_app_server when no db is provided.
-// Shares the WASM instance cache from test_db.ts, avoiding redundant cold starts
-// within the same vitest worker thread. Schema is reset on each create() call.
+// Shares the WASM instance cache from `testing/db.ts`, avoiding redundant cold starts
+// within one loaded copy of that module. Schema is reset on each create() call.
 const fallback_pglite_factory = create_pglite_factory(async (db) => {
     await run_migrations(db, [auth_migration_ns]);
 });
@@ -205,10 +205,16 @@ const _build_test_backend = async (options) => {
         };
     }
     else {
-        // In-memory PGlite via cached factory — reuses the WASM instance from test_db.ts
+        // In-memory PGlite via cached factory — reuses the WASM instance from `testing/db.ts`
         // instead of creating a new PGlite each time. Schema is reset and migrations re-run
-        // on each call, but the expensive WASM cold start only happens once per worker thread.
+        // on each call, but the expensive WASM cold start only happens once per loaded
+        // copy of `testing/db.ts` — under the `db` project's `isolate: false` +
+        // `fileParallelism: false` that is once for the whole run.
         // `migration_namespaces` selects an auth+extras factory; auth-only is the default.
+        // `db_type` below names PGlite unconditionally: a run that installs a substitute
+        // factory (`set_substitute_db_factory`) before this module loads gets that driver
+        // here, and no caller reads this field to pick behavior — it is reported, not
+        // dispatched on.
         const db = await resolve_fallback_factory(migration_namespaces).create();
         const audit = audit_factory({ db, log: test_log });
         backend = {
@@ -255,7 +261,7 @@ export const create_test_app_server = async (options) => {
  *
  * A fresh Hono app is created each call — middleware closures bind to the
  * server's deps (db, keyring), so reuse across servers is unsafe.
- * The expensive resource (PGlite WASM) is cached separately in `test_db.ts`.
+ * The expensive resource (PGlite WASM) is cached separately in `testing/db.ts`.
  *
  * @param options - test app configuration
  * @returns a `TestApp` ready for HTTP testing