@fuzdev/fuz_app 0.124.0 → 0.126.0

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -51,6 +51,21 @@ export interface SpineStubBackendConfigOptions {
      * TS spine binary wires the equivalent set unconditionally.
      */
     readonly trusted_proxies?: string;
+    /**
+     * Enable the action rate limiters (`FUZ_ACTION_RATE_LIMIT_ENABLED=true`) —
+     * one per-IP and one per-account limiter shared by the RPC and WS
+     * endpoints. Off by default, like `enable_login_rate_limit`; set only for
+     * the dedicated security cross project, which drives them through
+     * `ws_action_rate_limit.ts`. Mirrors `TsSpineBackendConfigOptions.enable_action_rate_limit`.
+     */
+    readonly enable_action_rate_limit?: boolean;
+    /**
+     * Replace both action limiters' `max_attempts`
+     * (`FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS`) so a suite reaches the cap in a few
+     * calls. Requires `enable_action_rate_limit` — the binary refuses to boot
+     * otherwise. Mirrors `TsSpineBackendConfigOptions.action_rate_limit_max_attempts`.
+     */
+    readonly action_rate_limit_max_attempts?: number;
 }
 /**
  * Build the `BackendConfig` for `testing_spine_stub`. Resolves the binary

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -39,7 +39,7 @@ import '../assert_dev_env.js';
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, action_rate_limit_env, make_default_rust_backend_config, rust_default_capabilities } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -127,7 +127,8 @@ export const rust_spine_stub_backend_config = (options = {}) => {
             // limiters + trust the loopback proxy so the limiter keys on the
             // resolved `X-Forwarded-For` IP. The stub reads both directly.
             ...(enable_login_rate_limit ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {}),
-            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {})
+            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {}),
+            ...action_rate_limit_env(options)
         }
     });
 };

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAqExE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -12,7 +12,8 @@ import '../assert_dev_env.js';
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
- * endpoint but keeps them off the declared surface — so the spec-derived
+ * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
+ * endpoint) but keeps them off the declared surface — so the spec-derived
  * `describe_rpc_attack_surface_tests` never enumerates them, and nothing
  * else fires them with a non-daemon credential to prove the gate holds
  * end-to-end. This suite does, against each impl's real auth resolution.

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -163,9 +163,12 @@ export declare const testing_reset_action_spec: {
  * asserting on audit rows.
  *
  * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every mutation's fire-and-
- * forget audit emits are awaited before its response returns — by the time
- * a later drain call runs, prior emits are already durable. The action still
+ * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
+ * fire-and-forget audit emits are awaited before its response returns — by
+ * the time a later drain call runs, prior emits are already durable. A
+ * WS-dispatched mutation replies before its effects flush, so on TS this
+ * action is not a barrier for WS-originated emits; issue audit-asserting
+ * mutations over HTTP. The action still
  * exists so the cross-backend test body calls the same method on every
  * backend; the Rust spine (whose audit writes are detached tokio tasks)
  * does the real await in `AuditEmitter::drain_inflight`.

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -169,9 +169,12 @@ export const testing_reset_action_spec = {
  * asserting on audit rows.
  *
  * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every mutation's fire-and-
- * forget audit emits are awaited before its response returns — by the time
- * a later drain call runs, prior emits are already durable. The action still
+ * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
+ * fire-and-forget audit emits are awaited before its response returns — by
+ * the time a later drain call runs, prior emits are already durable. A
+ * WS-dispatched mutation replies before its effects flush, so on TS this
+ * action is not a barrier for WS-originated emits; issue audit-asserting
+ * mutations over HTTP. The action still
  * exists so the cross-backend test body calls the same method on every
  * backend; the Rust spine (whose audit writes are detached tokio tasks)
  * does the real await in `AuditEmitter::drain_inflight`.

package/dist/testing/cross_backend/testing_server_bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_bun.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_bun.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,QAAO,oBA0D5C,CAAC"}
+{"version":3,"file":"testing_server_bun.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_bun.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,QAAO,oBA8D5C,CAAC"}

package/dist/testing/cross_backend/testing_server_bun.js

@@ -2,16 +2,16 @@ import '../assert_dev_env.js';
 /**
  * Bun runtime adapter for spawnable cross-process test server binaries.
  *
- * Binds `Bun.serve` and `hono/bun`'s module-level `upgradeWebSocket` +
+ * Binds `Bun.serve` and `@hono/bun`'s module-level `upgradeWebSocket` +
  * `websocket` handler. The shared `testing/cross_backend/testing_server_core.ts` owns the rest.
  * Third sibling to `testing/cross_backend/testing_server_node.ts` / `testing/cross_backend/testing_server_deno.ts` —
  * together the three isolate the JS-runtime axis (Node V8 / Deno V8 / Bun
  * JSC) on identical TS surfaces, and the Rust spine binary covers the
  * cross-language axis.
  *
- * Needs **no extra deps**: `hono/bun` ships with the `hono` peer dep and
- * `Bun.serve` is built in (unlike Node, which pulls `@hono/node-server` +
- * `@hono/node-ws`). `RuntimeDeps` reuse `create_node_runtime` — Bun
+ * Needs the optional `@hono/bun` peer dep (the Bun counterpart to Node's
+ * `@hono/node-server` + `@hono/node-ws`); `Bun.serve` is built in.
+ * `RuntimeDeps` reuse `create_node_runtime` — Bun
  * implements the `node:fs` / `node:process` surface `RuntimeDeps` +
  * `cli/daemon` touch.
  *
@@ -22,7 +22,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import process from 'node:process';
-import { getConnInfo, upgradeWebSocket, websocket } from 'hono/bun';
+import { getConnInfo, upgradeWebSocket, websocket } from '@hono/bun';
 import { create_node_runtime } from '../../runtime/node.js';
 /** Build the Bun {@link TestingServerAdapter}. */
 export const create_bun_testing_adapter = () => ({
@@ -32,7 +32,11 @@ export const create_bun_testing_adapter = () => ({
     // Bun's WS upgrade is module-level and stateless (like Deno) — no
     // post-serve attach. The `websocket` handler is threaded into `serve`
     // below, where `Bun.serve` wants it.
-    prepare_websocket: () => ({ upgrade_websocket: upgradeWebSocket }),
+    // TODO: `Bun.serve({websocket: {maxPayloadLength}})` (default 16 MiB) could
+    // carry the endpoint's `max_message_bytes` as a frame cap, like Node's
+    // `maxPayload`; until then the per-message check in `register_ws_endpoint`
+    // closes an oversized message with `WS_CLOSE_MESSAGE_TOO_BIG` (1009).
+    prepare_websocket: () => ({ create_upgrade_websocket: () => upgradeWebSocket }),
     serve: ({ fetch, port, hostname }) => {
         const server = Bun.serve({
             fetch: fetch,
@@ -44,7 +48,7 @@ export const create_bun_testing_adapter = () => ({
         });
         const handle = {
             // Bun bug (1.3.14): after a *server-initiated* WebSocket close
-            // (`ServerWebSocket.close()` / `hono/bun`'s `WSContext.close()`),
+            // (`ServerWebSocket.close()` / `@hono/bun`'s `WSContext.close()`),
             // `server.stop()` never resolves — Bun doesn't decrement its
             // active-connection count for a server-closed socket, so the stop
             // waits forever for a connection it already closed. The trigger is

package/dist/testing/cross_backend/testing_server_core.d.ts

@@ -7,15 +7,20 @@ import '../assert_dev_env.js';
  * the `cross_backend/*` suites (and the cross-impl bench) can drive it the
  * same way they drive the Rust spine. This module owns the runtime-neutral
  * orchestration — stale-daemon check, daemon-info write, serve, post-serve
- * WS attach, graceful drain shutdown — and delegates the runtime-boundary
+ * WS attach, graceful shutdown — and delegates the runtime-boundary
  * primitives (HTTP serve, WS upgrade construction, signals, pid, exit) to a
- * {@link TestingServerAdapter}. The two shipped adapters are
- * `testing/cross_backend/testing_server_node.ts` (`@hono/node-server` + `@hono/node-ws`) and
- * `testing/cross_backend/testing_server_deno.ts` (`Deno.serve` + `hono/deno`).
+ * {@link TestingServerAdapter}. The shipped adapters are
+ * `testing/cross_backend/testing_server_node.ts` (`@hono/node-server` + `@hono/node-ws`),
+ * `testing/cross_backend/testing_server_deno.ts` (`Deno.serve` + `@hono/deno`), and
+ * `testing/cross_backend/testing_server_bun.ts` (`Bun.serve` + `@hono/bun`).
  *
- * The app itself — routes, RPC, DB, `_testing_reset`, optional WS mount —
- * is the caller's {@link StartTestingServerOptions.build_app} seam, so this
- * core stays domain-free. fuz_app's own `testing_spine_server` passes a
+ * The app itself — routes, RPC, DB, `_testing_reset`, WS endpoints — is the
+ * caller's {@link StartTestingServerOptions.build_app} seam, so this core
+ * stays domain-free. WebSocket endpoints mount through `create_app_server`'s
+ * `ws_endpoints`: `build_app` asks its context to prepare the runtime's
+ * upgrade helper and passes the resulting factory as
+ * `create_upgrade_websocket`; the core attaches it to the server once
+ * `serve` returns (Node's `injectWebSocket`). fuz_app's own `testing_spine_server` passes a
  * no-domain build; consumers (zzz, fuz_forge) pass their domain build.
  *
  * **NEVER ships in a release.** This module lives under `cross_backend/` and
@@ -33,32 +38,52 @@ import type { RuntimeDeps } from '../../runtime/deps.js';
 /**
  * Adapter-built handle to a bound HTTP server.
  *
- * `shutdown` stops accepting new connections and drains in-flight ones.
- * `native` is an adapter-specific server reference — used by Node's
- * `@hono/node-ws` `injectWebSocket(server)` post-serve hook; Deno leaves it
- * unset.
+ * `shutdown` stops accepting new connections at once and settles when the
+ * in-flight ones have drained — the core starts it, closes the app (which
+ * ends live WebSockets), then awaits it. `native` is an adapter-specific
+ * server reference — used by Node's `@hono/node-ws` `injectWebSocket(server)`
+ * post-serve hook.
  */
 export interface ServeHandle {
     shutdown: () => Promise<void>;
     /** Adapter-specific server ref for post-serve hooks. Type-erased at the seam. */
     native?: unknown;
 }
+/** Options for {@link TestingServerAdapter.prepare_websocket}. */
+export interface PrepareWebsocketOptions {
+    /**
+     * Largest inbound WebSocket message, in bytes — pass the largest
+     * `WsEndpointSpec.max_message_bytes` of the mounted endpoints; a smaller
+     * value refuses messages the endpoint would accept. Node's `ws` server takes
+     * it as its frame cap (`maxPayload`), so an oversized message is refused
+     * before it is buffered whole; Deno and Bun ignore it, leaving the
+     * per-message check `register_ws_endpoint` makes (both close with
+     * `WS_CLOSE_MESSAGE_TOO_BIG`). The default sits far below `ws`'s own
+     * 100 MiB, so a build raising an endpoint's cap must pass it here too.
+     *
+     * @default DEFAULT_WS_MAX_MESSAGE_BYTES
+     */
+    max_message_bytes?: number;
+}
 /**
  * Result of an adapter's WS preparation step.
  *
- * `upgrade_websocket` is the Hono `UpgradeWebSocket` closure the caller's
- * WS mount uses to register the endpoint. `attach_to_server` runs after
- * `serve()` returns a {@link ServeHandle} — Node uses it for
- * `injectWebSocket(server)`; Deno leaves it undefined.
+ * `create_upgrade_websocket` is the factory a build passes to
+ * `create_app_server` as `AppServerOptions.create_upgrade_websocket`.
+ * `attach_to_server` runs after `serve()` returns a {@link ServeHandle} —
+ * Node uses it for `injectWebSocket(server)`, and it does nothing when the
+ * factory was never called (no `ws_endpoints`); Deno and Bun leave it
+ * undefined.
  */
 export interface PreparedWebsocket {
-    upgrade_websocket: UpgradeWebSocket;
+    create_upgrade_websocket: (app: Hono) => UpgradeWebSocket;
     attach_to_server?: (handle: ServeHandle) => void;
 }
 /**
  * Runtime adapter contract for the test-binary entry. Each adapter
- * (`testing/cross_backend/testing_server_node.ts`, `testing/cross_backend/testing_server_deno.ts`) implements this and
- * hands the shape to {@link start_testing_server}.
+ * (`testing/cross_backend/testing_server_node.ts`, `testing/cross_backend/testing_server_deno.ts`,
+ * `testing/cross_backend/testing_server_bun.ts`) implements this and hands the shape to
+ * {@link start_testing_server}.
  */
 export interface TestingServerAdapter {
     /** Human-readable runtime label for log output (e.g. `"Node"`, `"Deno"`). */
@@ -67,8 +92,8 @@ export interface TestingServerAdapter {
     runtime: RuntimeDeps;
     /** Extract the raw TCP connection IP from a Hono context. */
     get_connection_ip: (c: Context) => string | undefined;
-    /** Build the WS upgrade closure after the caller's `build_app` returns the app. */
-    prepare_websocket: (app: Hono) => PreparedWebsocket;
+    /** Prepare the runtime's WS upgrade helper and its post-serve attach step. */
+    prepare_websocket: (options?: PrepareWebsocketOptions) => PreparedWebsocket;
     /** Bind `app.fetch` to `port` on `hostname`; return a {@link ServeHandle}. */
     serve: (options: {
         fetch: Hono['fetch'];
@@ -82,22 +107,29 @@ export interface TestingServerAdapter {
     /** Forceful exit on graceful-shutdown completion or fatal error. */
     exit: (code: number) => never;
 }
-/**
- * The assembled app a {@link StartTestingServerOptions.build_app} seam
- * returns.
- *
- * `mount_websocket` is invoked by the core after the app exists and the
- * adapter prepared the WS upgrade closure — the closure mounts the WS
- * endpoint(s) (e.g. via `register_ws_endpoint`) and wires any
- * audit-revocation guards. Omit it for an HTTP-only binary.
- */
+/** What the core hands a {@link StartTestingServerOptions.build_app} seam. */
+export interface BuildTestingAppContext {
+    /**
+     * Prepare the runtime adapter's WS upgrade helper and return the factory
+     * to pass to `create_app_server` as `create_upgrade_websocket`. The core
+     * runs the adapter's attach step once the server is bound, so a build
+     * that mounts `ws_endpoints` needs nothing else. An HTTP-only build
+     * doesn't call it. Call it at most once per build: the Node adapter
+     * attaches one upgrade listener per preparation, and two would race on
+     * the shared socket.
+     */
+    prepare_websocket: (options?: PrepareWebsocketOptions) => (app: Hono) => UpgradeWebSocket;
+}
+/** The assembled app a {@link StartTestingServerOptions.build_app} seam returns. */
 export interface BuiltTestingApp {
-    /** The assembled Hono app (HTTP routes + RPC already mounted). */
+    /** The assembled Hono app (HTTP routes, RPC, and WS endpoints already mounted). */
     app: Hono;
-    /** Tear down backend(s) + DB + any rotation on graceful shutdown. */
+    /**
+     * Tear down backend(s) + DB + any rotation on graceful shutdown. Called
+     * after the listener stops accepting connections and before its drain is
+     * awaited, so it must end live WebSockets (`AppServer.close` does).
+     */
     close: () => Promise<void>;
-    /** Mount WS endpoint(s) given the runtime-prepared upgrade closure. */
-    mount_websocket?: (upgrade_websocket: UpgradeWebSocket) => void;
 }
 /** Options for {@link start_testing_server}. */
 export interface StartTestingServerOptions {
@@ -120,10 +152,9 @@ export interface StartTestingServerOptions {
     /**
      * Build the app. Closes over the entry's runtime + connection-IP getter
      * + password deps + resolved config — so this core never touches the
-     * domain. Returns the assembled app, a `close` teardown, and an optional
-     * `mount_websocket` hook.
+     * domain. Returns the assembled app and a `close` teardown.
      */
-    build_app: () => Promise<BuiltTestingApp>;
+    build_app: (context: BuildTestingAppContext) => Promise<BuiltTestingApp>;
     /** Optional logger; defaults to a `[daemon_name]`-namespaced `Logger`. */
     log?: LoggerType;
 }
@@ -141,7 +172,7 @@ export declare const is_loopback_host: (host: string) => boolean;
  * Boot a test-mode server using the supplied runtime adapter.
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
- * check, daemon-info write, bind, graceful drain — but the app is the
+ * check, daemon-info write, bind, graceful shutdown — but the app is the
  * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
  * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see

package/dist/testing/cross_backend/testing_server_core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,iBAAiB,CAAC;IACpD,8EAA8E;IAC9E,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC/B,kEAAkE;IAClE,GAAG,EAAE,IAAI,CAAC;IACV,qEAAqE;IACrE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,uEAAuE;IACvE,eAAe,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;CAChE;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CA4D3F,CAAC"}
+{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,uBAAuB;IACvC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,wBAAwB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAC1D,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IAC5E,8EAA8E;IAC9E,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACtC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;CAC1F;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC/B,mFAAmF;IACnF,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CAkE3F,CAAC"}

package/dist/testing/cross_backend/testing_server_core.js

@@ -18,7 +18,7 @@ export const is_loopback_host = (host) => {
  * Boot a test-mode server using the supplied runtime adapter.
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
- * check, daemon-info write, bind, graceful drain — but the app is the
+ * check, daemon-info write, bind, graceful shutdown — but the app is the
  * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
  * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see
@@ -42,12 +42,14 @@ export const start_testing_server = async (options) => {
             log.warn(`stale daemon.json (pid ${stale.pid} not running), replacing`);
         }
     }
-    const built = await build_app();
-    let ws;
-    if (built.mount_websocket) {
-        ws = adapter.prepare_websocket(built.app);
-        built.mount_websocket(ws.upgrade_websocket);
-    }
+    const prepared_websockets = [];
+    const built = await build_app({
+        prepare_websocket: (ws_options) => {
+            const prepared = adapter.prepare_websocket(ws_options);
+            prepared_websockets.push(prepared);
+            return prepared.create_upgrade_websocket;
+        }
+    });
     await write_daemon_info(runtime, daemon_name, {
         version: 1,
         pid: adapter.pid,
@@ -57,7 +59,8 @@ export const start_testing_server = async (options) => {
     });
     log.info(`Listening on http://${host}:${port} (${adapter.runtime_label}, test mode)`);
     const server = adapter.serve({ fetch: built.app.fetch, port, hostname: host });
-    ws?.attach_to_server?.(server);
+    for (const prepared of prepared_websockets)
+        prepared.attach_to_server?.(server);
     let shutting_down = false;
     const shutdown = async () => {
         if (shutting_down)
@@ -65,11 +68,16 @@ export const start_testing_server = async (options) => {
         shutting_down = true;
         log.info('shutting down...');
         try {
-            // Drain HTTP first (stop accepting + let in-flight requests finish)
-            // before tearing down the backend, so a request still draining
-            // never hits a closed DB.
-            await server.shutdown();
+            // Stop accepting first so no new request reaches a closed DB, but
+            // don't await the drain yet: live WebSockets hold it open until
+            // `built.close()` ends them (`AppServer.close`), so awaiting it
+            // first would wait on sockets nothing is closing. A request already
+            // in flight when the signal lands may still see the backend close
+            // under it — acceptable for a test binary, where shutdown follows
+            // the suite.
+            const drained = server.shutdown();
             await built.close();
+            await drained;
         }
         catch (error) {
             log.error('shutdown error:', error);

package/dist/testing/cross_backend/testing_server_deno.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_deno.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_deno.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBAkB7C,CAAC"}
+{"version":3,"file":"testing_server_deno.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_deno.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAelF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBAkB7C,CAAC"}

package/dist/testing/cross_backend/testing_server_deno.js

@@ -2,8 +2,9 @@ import '../assert_dev_env.js';
 /**
  * Deno runtime adapter for spawnable cross-process test server binaries.
  *
- * Binds `Deno.serve` and `hono/deno`'s module-level `upgradeWebSocket`. The
- * shared `testing/cross_backend/testing_server_core.ts` owns the rest. Counterpart to
+ * Binds `Deno.serve` and `@hono/deno`'s module-level `upgradeWebSocket` (the
+ * optional `@hono/deno` peer dep). The shared
+ * `testing/cross_backend/testing_server_core.ts` owns the rest. Counterpart to
  * `testing/cross_backend/testing_server_node.ts` — together they isolate the JS-runtime axis (Deno
  * vs Node V8) on identical TS surfaces, and the Rust spine binary covers the
  * cross-language axis.
@@ -14,7 +15,7 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import { upgradeWebSocket } from 'hono/deno';
+import { upgradeWebSocket } from '@hono/deno';
 import { create_deno_runtime } from '../../runtime/deno.js';
 /** Build the Deno {@link TestingServerAdapter}. */
 export const create_deno_testing_adapter = () => ({
@@ -22,7 +23,7 @@ export const create_deno_testing_adapter = () => ({
     runtime: create_deno_runtime([]),
     get_connection_ip: (c) => c.env?.remoteAddr?.hostname,
     // Deno's WS upgrade is module-level and stateless — no post-serve attach.
-    prepare_websocket: () => ({ upgrade_websocket: upgradeWebSocket }),
+    prepare_websocket: () => ({ create_upgrade_websocket: () => upgradeWebSocket }),
     serve: ({ fetch, port, hostname }) => {
         const server = Deno.serve({ port, hostname }, fetch);
         const handle = { shutdown: () => server.shutdown(), native: server };

package/dist/testing/cross_backend/testing_server_node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_node.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_node.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUlF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBAsB7C,CAAC"}
+{"version":3,"file":"testing_server_node.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_node.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUlF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBA+B7C,CAAC"}

package/dist/testing/cross_backend/testing_server_node.js

@@ -3,9 +3,12 @@ import '../assert_dev_env.js';
  * Node runtime adapter for spawnable cross-process test server binaries.
  *
  * Binds `@hono/node-server`'s `serve()` and `@hono/node-ws`'s two-phase
- * `createNodeWebSocket(app)` / `injectWebSocket(server)`. The shared
- * `testing/cross_backend/testing_server_core.ts` owns the rest. A test binary builds this adapter
- * and hands it to `start_testing_server` alongside its `build_app` seam.
+ * `createNodeWebSocket({app})` / `injectWebSocket(server)`: the factory
+ * `prepare_websocket` returns builds the first half from the app
+ * `create_app_server` assembles, and the core runs the second once `serve()`
+ * returns. The shared `testing/cross_backend/testing_server_core.ts` owns
+ * the rest. A test binary builds this adapter and hands it to
+ * `start_testing_server` alongside its `build_app` seam.
  *
  * `@hono/node-server` + `@hono/node-ws` are **optional** peer deps (same
  * posture as `ws`) — only test binaries import them; production bundles
@@ -17,6 +20,7 @@ import process from 'node:process';
 import { serve } from '@hono/node-server';
 import { getConnInfo } from '@hono/node-server/conninfo';
 import { createNodeWebSocket } from '@hono/node-ws';
+import { DEFAULT_WS_MAX_MESSAGE_BYTES } from '../../actions/transports.js';
 import { create_node_runtime } from '../../runtime/node.js';
 const node_serve_handle = (server) => ({
     shutdown: () => new Promise((resolve, reject) => {
@@ -29,14 +33,23 @@ export const create_node_testing_adapter = () => ({
     runtime_label: 'Node',
     runtime: create_node_runtime(),
     get_connection_ip: (c) => getConnInfo(c).remote.address,
-    prepare_websocket: (app) => {
-        const { upgradeWebSocket, injectWebSocket } = createNodeWebSocket({ app });
+    prepare_websocket: (options) => {
+        const max_payload = options?.max_message_bytes ?? DEFAULT_WS_MAX_MESSAGE_BYTES;
+        let node_ws;
         return {
-            upgrade_websocket: upgradeWebSocket,
+            create_upgrade_websocket: (app) => {
+                node_ws = createNodeWebSocket({ app });
+                // `@hono/node-ws` builds its `ws` server with no options and takes
+                // none, so its frame cap would stay `ws`'s 100 MiB default. `ws` reads
+                // `options.maxPayload` per upgrade, so setting it here — before any
+                // connection — caps every socket at the endpoint's message limit.
+                node_ws.wss.options.maxPayload = max_payload;
+                return node_ws.upgradeWebSocket;
+            },
             attach_to_server: (handle) => {
                 // `handle.native` is the `ServerType` from `serve()` —
                 // type-erased at the {@link ServeHandle} seam, so it downcasts here.
-                injectWebSocket(handle.native);
+                node_ws?.injectWebSocket(handle.native);
             }
         };
     },

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -47,6 +47,21 @@ export interface TsSpineBackendConfigOptions {
      * client IP. Mirrors `SpineStubBackendConfigOptions.enable_login_rate_limit`.
      */
     readonly enable_login_rate_limit?: boolean;
+    /**
+     * Enable the action rate limiters (`FUZ_ACTION_RATE_LIMIT_ENABLED=true`) —
+     * one per-IP and one per-account limiter shared by the RPC and WS
+     * endpoints. Off by default, like `enable_login_rate_limit`; set only for
+     * the dedicated security cross project, which drives them through
+     * `ws_action_rate_limit.ts`. Mirrors `SpineStubBackendConfigOptions.enable_action_rate_limit`.
+     */
+    readonly enable_action_rate_limit?: boolean;
+    /**
+     * Replace both action limiters' `max_attempts`
+     * (`FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS`) so a suite reaches the cap in a few
+     * calls. Requires `enable_action_rate_limit` — the binary refuses to boot
+     * otherwise. Mirrors `SpineStubBackendConfigOptions.action_rate_limit_max_attempts`.
+     */
+    readonly action_rate_limit_max_attempts?: number;
 }
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`
@@ -57,7 +72,8 @@ export declare const ts_spine_node_backend_config: (options?: TsSpineBackendConf
  * `BackendConfig` for the Bun TS spine binary — spawned via `bun run`. Bun
  * resolves the entry's relative `.js`→`.ts` source specifiers natively (no
  * flag needed — unlike Deno's `--sloppy-imports`, and like Gro's loader on
- * the Node path), and `Bun.serve` + `hono/bun` need no extra deps.
+ * the Node path). `Bun.serve` is built in; the WS upgrade comes from the
+ * optional `@hono/bun` peer dep.
  */
 export declare const ts_spine_bun_backend_config: (options?: TsSpineBackendConfigOptions) => BackendConfig;
 /**

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA0C3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA2C3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,6 +1,6 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, action_rate_limit_env, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
 import { SPINE_SSE_PATH } from './spine_surface_constants.js';
 /** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
 export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
@@ -9,7 +9,8 @@ export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the
  * `/ready` deploy gate in `build_spine_app`), `peer_request` (the backend
  * WS transport's `request_connection` path drives server→client `peer/ping`),
- * `ws_account_actions` (the binary mounts the account actions on `/api/ws`),
+ * `ws_account_actions` (the binary mounts its full action set on `/api/ws`,
+ * the account actions among them),
  * and `cell_gated_create` (the binary's `full_spine_mount` mounts the
  * `test_cell_gated_create_authorize` policy).
  */
@@ -78,7 +79,8 @@ export const ts_spine_node_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_capabilities
         }),
@@ -89,7 +91,8 @@ export const ts_spine_node_backend_config = (options = {}) => {
  * `BackendConfig` for the Bun TS spine binary — spawned via `bun run`. Bun
  * resolves the entry's relative `.js`→`.ts` source specifiers natively (no
  * flag needed — unlike Deno's `--sloppy-imports`, and like Gro's loader on
- * the Node path), and `Bun.serve` + `hono/bun` need no extra deps.
+ * the Node path). `Bun.serve` is built in; the WS upgrade comes from the
+ * optional `@hono/bun` peer dep.
  */
 export const ts_spine_bun_backend_config = (options = {}) => {
     const { port = TS_SPINE_BUN_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
@@ -104,7 +107,8 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_bun_capabilities
         }),
@@ -148,7 +152,8 @@ export const ts_spine_deno_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_capabilities
         }),