@fuzdev/fuz_app 0.125.0 → 0.127.0

package/dist/testing/cross_backend/testing_server_core.d.ts

@@ -7,15 +7,20 @@ import '../assert_dev_env.js';
  * the `cross_backend/*` suites (and the cross-impl bench) can drive it the
  * same way they drive the Rust spine. This module owns the runtime-neutral
  * orchestration — stale-daemon check, daemon-info write, serve, post-serve
- * WS attach, graceful drain shutdown — and delegates the runtime-boundary
+ * WS attach, graceful shutdown — and delegates the runtime-boundary
  * primitives (HTTP serve, WS upgrade construction, signals, pid, exit) to a
- * {@link TestingServerAdapter}. The two shipped adapters are
- * `testing/cross_backend/testing_server_node.ts` (`@hono/node-server` + `@hono/node-ws`) and
- * `testing/cross_backend/testing_server_deno.ts` (`Deno.serve` + `@hono/deno`).
+ * `TestingServerAdapter`. The shipped adapters are
+ * `testing/cross_backend/testing_server_node.ts` (`@hono/node-server` + `@hono/node-ws`),
+ * `testing/cross_backend/testing_server_deno.ts` (`Deno.serve` + `@hono/deno`), and
+ * `testing/cross_backend/testing_server_bun.ts` (`Bun.serve` + `@hono/bun`).
  *
- * The app itself — routes, RPC, DB, `_testing_reset`, optional WS mount —
- * is the caller's {@link StartTestingServerOptions.build_app} seam, so this
- * core stays domain-free. fuz_app's own `testing_spine_server` passes a
+ * The app itself — routes, RPC, DB, `_testing_reset`, WS endpoints — is the
+ * caller's `StartTestingServerOptions.build_app` seam, so this core
+ * stays domain-free. WebSocket endpoints mount through `create_app_server`'s
+ * `ws_endpoints`: `build_app` asks its context to prepare the runtime's
+ * upgrade helper and passes the resulting factory as
+ * `create_upgrade_websocket`; the core attaches it to the server once
+ * `serve` returns (Node's `injectWebSocket`). fuz_app's own `testing_spine_server` passes a
  * no-domain build; consumers (zzz, fuz_forge) pass their domain build.
  *
  * **NEVER ships in a release.** This module lives under `cross_backend/` and
@@ -33,32 +38,52 @@ import type { RuntimeDeps } from '../../runtime/deps.js';
 /**
  * Adapter-built handle to a bound HTTP server.
  *
- * `shutdown` stops accepting new connections and drains in-flight ones.
- * `native` is an adapter-specific server reference — used by Node's
- * `@hono/node-ws` `injectWebSocket(server)` post-serve hook; Deno leaves it
- * unset.
+ * `shutdown` stops accepting new connections at once and settles when the
+ * in-flight ones have drained — the core starts it, closes the app (which
+ * ends live WebSockets), then awaits it. `native` is an adapter-specific
+ * server reference — used by Node's `@hono/node-ws` `injectWebSocket(server)`
+ * post-serve hook.
  */
 export interface ServeHandle {
     shutdown: () => Promise<void>;
     /** Adapter-specific server ref for post-serve hooks. Type-erased at the seam. */
     native?: unknown;
 }
+/** Options for `TestingServerAdapter.prepare_websocket`. */
+export interface PrepareWebsocketOptions {
+    /**
+     * Largest inbound WebSocket message, in bytes — pass the largest
+     * `WsEndpointSpec.max_message_bytes` of the mounted endpoints; a smaller
+     * value refuses messages the endpoint would accept. Node's `ws` server takes
+     * it as its frame cap (`maxPayload`), so an oversized message is refused
+     * before it is buffered whole; Deno and Bun ignore it, leaving the
+     * per-message check `register_ws_endpoint` makes (both close with
+     * `WS_CLOSE_MESSAGE_TOO_BIG`). The default sits far below `ws`'s own
+     * 100 MiB, so a build raising an endpoint's cap must pass it here too.
+     *
+     * @default DEFAULT_WS_MAX_MESSAGE_BYTES
+     */
+    max_message_bytes?: number;
+}
 /**
  * Result of an adapter's WS preparation step.
  *
- * `upgrade_websocket` is the Hono `UpgradeWebSocket` closure the caller's
- * WS mount uses to register the endpoint. `attach_to_server` runs after
- * `serve()` returns a {@link ServeHandle} — Node uses it for
- * `injectWebSocket(server)`; Deno leaves it undefined.
+ * `create_upgrade_websocket` is the factory a build passes to
+ * `create_app_server` as `AppServerOptions.create_upgrade_websocket`.
+ * `attach_to_server` runs after `serve()` returns a `ServeHandle` —
+ * Node uses it for `injectWebSocket(server)`, and it does nothing when the
+ * factory was never called (no `ws_endpoints`); Deno and Bun leave it
+ * undefined.
  */
 export interface PreparedWebsocket {
-    upgrade_websocket: UpgradeWebSocket;
+    create_upgrade_websocket: (app: Hono) => UpgradeWebSocket;
     attach_to_server?: (handle: ServeHandle) => void;
 }
 /**
  * Runtime adapter contract for the test-binary entry. Each adapter
- * (`testing/cross_backend/testing_server_node.ts`, `testing/cross_backend/testing_server_deno.ts`) implements this and
- * hands the shape to {@link start_testing_server}.
+ * (`testing/cross_backend/testing_server_node.ts`, `testing/cross_backend/testing_server_deno.ts`,
+ * `testing/cross_backend/testing_server_bun.ts`) implements this and hands the shape to
+ * `start_testing_server`.
  */
 export interface TestingServerAdapter {
     /** Human-readable runtime label for log output (e.g. `"Node"`, `"Deno"`). */
@@ -67,9 +92,9 @@ export interface TestingServerAdapter {
     runtime: RuntimeDeps;
     /** Extract the raw TCP connection IP from a Hono context. */
     get_connection_ip: (c: Context) => string | undefined;
-    /** Build the WS upgrade closure after the caller's `build_app` returns the app. */
-    prepare_websocket: (app: Hono) => PreparedWebsocket;
-    /** Bind `app.fetch` to `port` on `hostname`; return a {@link ServeHandle}. */
+    /** Prepare the runtime's WS upgrade helper and its post-serve attach step. */
+    prepare_websocket: (options?: PrepareWebsocketOptions) => PreparedWebsocket;
+    /** Bind `app.fetch` to `port` on `hostname`; return a `ServeHandle`. */
     serve: (options: {
         fetch: Hono['fetch'];
         port: number;
@@ -82,24 +107,31 @@ export interface TestingServerAdapter {
     /** Forceful exit on graceful-shutdown completion or fatal error. */
     exit: (code: number) => never;
 }
-/**
- * The assembled app a {@link StartTestingServerOptions.build_app} seam
- * returns.
- *
- * `mount_websocket` is invoked by the core after the app exists and the
- * adapter prepared the WS upgrade closure — the closure mounts the WS
- * endpoint(s) (e.g. via `register_ws_endpoint`) and wires any
- * audit-revocation guards. Omit it for an HTTP-only binary.
- */
+/** What the core hands a `StartTestingServerOptions.build_app` seam. */
+export interface BuildTestingAppContext {
+    /**
+     * Prepare the runtime adapter's WS upgrade helper and return the factory
+     * to pass to `create_app_server` as `create_upgrade_websocket`. The core
+     * runs the adapter's attach step once the server is bound, so a build
+     * that mounts `ws_endpoints` needs nothing else. An HTTP-only build
+     * doesn't call it. Call it at most once per build: the Node adapter
+     * attaches one upgrade listener per preparation, and two would race on
+     * the shared socket.
+     */
+    prepare_websocket: (options?: PrepareWebsocketOptions) => (app: Hono) => UpgradeWebSocket;
+}
+/** The assembled app a `StartTestingServerOptions.build_app` seam returns. */
 export interface BuiltTestingApp {
-    /** The assembled Hono app (HTTP routes + RPC already mounted). */
+    /** The assembled Hono app (HTTP routes, RPC, and WS endpoints already mounted). */
     app: Hono;
-    /** Tear down backend(s) + DB + any rotation on graceful shutdown. */
+    /**
+     * Tear down backend(s) + DB + any rotation on graceful shutdown. Called
+     * after the listener stops accepting connections and before its drain is
+     * awaited, so it must end live WebSockets (`AppServer.close` does).
+     */
     close: () => Promise<void>;
-    /** Mount WS endpoint(s) given the runtime-prepared upgrade closure. */
-    mount_websocket?: (upgrade_websocket: UpgradeWebSocket) => void;
 }
-/** Options for {@link start_testing_server}. */
+/** Options for `start_testing_server`. */
 export interface StartTestingServerOptions {
     /** Runtime-boundary adapter (Node or Deno). */
     adapter: TestingServerAdapter;
@@ -120,10 +152,9 @@ export interface StartTestingServerOptions {
     /**
      * Build the app. Closes over the entry's runtime + connection-IP getter
      * + password deps + resolved config — so this core never touches the
-     * domain. Returns the assembled app, a `close` teardown, and an optional
-     * `mount_websocket` hook.
+     * domain. Returns the assembled app and a `close` teardown.
      */
-    build_app: () => Promise<BuiltTestingApp>;
+    build_app: (context: BuildTestingAppContext) => Promise<BuiltTestingApp>;
     /** Optional logger; defaults to a `[daemon_name]`-namespaced `Logger`. */
     log?: LoggerType;
 }
@@ -141,9 +172,9 @@ export declare const is_loopback_host: (host: string) => boolean;
  * Boot a test-mode server using the supplied runtime adapter.
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
- * check, daemon-info write, bind, graceful drain — but the app is the
- * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
- * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
+ * check, daemon-info write, bind, graceful shutdown — but the app is the
+ * caller's no-domain (or domain) `StartTestingServerOptions.build_app`
+ * and the runtime boundary is the `TestingServerAdapter`. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see
  * `is_loopback_host`).
  */

package/dist/testing/cross_backend/testing_server_core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,iBAAiB,CAAC;IACpD,8EAA8E;IAC9E,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC/B,kEAAkE;IAClE,GAAG,EAAE,IAAI,CAAC;IACV,qEAAqE;IACrE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,uEAAuE;IACvE,eAAe,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;CAChE;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CA4D3F,CAAC"}
+{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACvC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,wBAAwB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAC1D,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IAC5E,wEAAwE;IACxE,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACtC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;CAC1F;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC/B,mFAAmF;IACnF,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CAkE3F,CAAC"}

package/dist/testing/cross_backend/testing_server_core.js

@@ -18,9 +18,9 @@ export const is_loopback_host = (host) => {
  * Boot a test-mode server using the supplied runtime adapter.
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
- * check, daemon-info write, bind, graceful drain — but the app is the
- * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
- * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
+ * check, daemon-info write, bind, graceful shutdown — but the app is the
+ * caller's no-domain (or domain) `StartTestingServerOptions.build_app`
+ * and the runtime boundary is the `TestingServerAdapter`. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see
  * `is_loopback_host`).
  */
@@ -42,12 +42,14 @@ export const start_testing_server = async (options) => {
             log.warn(`stale daemon.json (pid ${stale.pid} not running), replacing`);
         }
     }
-    const built = await build_app();
-    let ws;
-    if (built.mount_websocket) {
-        ws = adapter.prepare_websocket(built.app);
-        built.mount_websocket(ws.upgrade_websocket);
-    }
+    const prepared_websockets = [];
+    const built = await build_app({
+        prepare_websocket: (ws_options) => {
+            const prepared = adapter.prepare_websocket(ws_options);
+            prepared_websockets.push(prepared);
+            return prepared.create_upgrade_websocket;
+        }
+    });
     await write_daemon_info(runtime, daemon_name, {
         version: 1,
         pid: adapter.pid,
@@ -57,7 +59,8 @@ export const start_testing_server = async (options) => {
     });
     log.info(`Listening on http://${host}:${port} (${adapter.runtime_label}, test mode)`);
     const server = adapter.serve({ fetch: built.app.fetch, port, hostname: host });
-    ws?.attach_to_server?.(server);
+    for (const prepared of prepared_websockets)
+        prepared.attach_to_server?.(server);
     let shutting_down = false;
     const shutdown = async () => {
         if (shutting_down)
@@ -65,11 +68,16 @@ export const start_testing_server = async (options) => {
         shutting_down = true;
         log.info('shutting down...');
         try {
-            // Drain HTTP first (stop accepting + let in-flight requests finish)
-            // before tearing down the backend, so a request still draining
-            // never hits a closed DB.
-            await server.shutdown();
+            // Stop accepting first so no new request reaches a closed DB, but
+            // don't await the drain yet: live WebSockets hold it open until
+            // `built.close()` ends them (`AppServer.close`), so awaiting it
+            // first would wait on sockets nothing is closing. A request already
+            // in flight when the signal lands may still see the backend close
+            // under it — acceptable for a test binary, where shutdown follows
+            // the suite.
+            const drained = server.shutdown();
             await built.close();
+            await drained;
         }
         catch (error) {
             log.error('shutdown error:', error);

package/dist/testing/cross_backend/testing_server_deno.js

@@ -23,7 +23,7 @@ export const create_deno_testing_adapter = () => ({
     runtime: create_deno_runtime([]),
     get_connection_ip: (c) => c.env?.remoteAddr?.hostname,
     // Deno's WS upgrade is module-level and stateless — no post-serve attach.
-    prepare_websocket: () => ({ upgrade_websocket: upgradeWebSocket }),
+    prepare_websocket: () => ({ create_upgrade_websocket: () => upgradeWebSocket }),
     serve: ({ fetch, port, hostname }) => {
         const server = Deno.serve({ port, hostname }, fetch);
         const handle = { shutdown: () => server.shutdown(), native: server };

package/dist/testing/cross_backend/testing_server_node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_node.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_node.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUlF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBAsB7C,CAAC"}
+{"version":3,"file":"testing_server_node.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_node.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2B9B,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUlF,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,QAAO,oBA+B7C,CAAC"}

package/dist/testing/cross_backend/testing_server_node.js

@@ -3,9 +3,12 @@ import '../assert_dev_env.js';
  * Node runtime adapter for spawnable cross-process test server binaries.
  *
  * Binds `@hono/node-server`'s `serve()` and `@hono/node-ws`'s two-phase
- * `createNodeWebSocket({app})` / `injectWebSocket(server)`. The shared
- * `testing/cross_backend/testing_server_core.ts` owns the rest. A test binary builds this adapter
- * and hands it to `start_testing_server` alongside its `build_app` seam.
+ * `createNodeWebSocket({app})` / `injectWebSocket(server)`: the factory
+ * `prepare_websocket` returns builds the first half from the app
+ * `create_app_server` assembles, and the core runs the second once `serve()`
+ * returns. The shared `testing/cross_backend/testing_server_core.ts` owns
+ * the rest. A test binary builds this adapter and hands it to
+ * `start_testing_server` alongside its `build_app` seam.
  *
  * `@hono/node-server` + `@hono/node-ws` are **optional** peer deps (same
  * posture as `ws`) — only test binaries import them; production bundles
@@ -17,6 +20,7 @@ import process from 'node:process';
 import { serve } from '@hono/node-server';
 import { getConnInfo } from '@hono/node-server/conninfo';
 import { createNodeWebSocket } from '@hono/node-ws';
+import { DEFAULT_WS_MAX_MESSAGE_BYTES } from '../../actions/transports.js';
 import { create_node_runtime } from '../../runtime/node.js';
 const node_serve_handle = (server) => ({
     shutdown: () => new Promise((resolve, reject) => {
@@ -29,14 +33,23 @@ export const create_node_testing_adapter = () => ({
     runtime_label: 'Node',
     runtime: create_node_runtime(),
     get_connection_ip: (c) => getConnInfo(c).remote.address,
-    prepare_websocket: (app) => {
-        const { upgradeWebSocket, injectWebSocket } = createNodeWebSocket({ app });
+    prepare_websocket: (options) => {
+        const max_payload = options?.max_message_bytes ?? DEFAULT_WS_MAX_MESSAGE_BYTES;
+        let node_ws;
         return {
-            upgrade_websocket: upgradeWebSocket,
+            create_upgrade_websocket: (app) => {
+                node_ws = createNodeWebSocket({ app });
+                // `@hono/node-ws` builds its `ws` server with no options and takes
+                // none, so its frame cap would stay `ws`'s 100 MiB default. `ws` reads
+                // `options.maxPayload` per upgrade, so setting it here — before any
+                // connection — caps every socket at the endpoint's message limit.
+                node_ws.wss.options.maxPayload = max_payload;
+                return node_ws.upgradeWebSocket;
+            },
             attach_to_server: (handle) => {
                 // `handle.native` is the `ServerType` from `serve()` —
                 // type-erased at the {@link ServeHandle} seam, so it downcasts here.
-                injectWebSocket(handle.native);
+                node_ws?.injectWebSocket(handle.native);
             }
         };
     },

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -17,8 +17,6 @@ import '../assert_dev_env.js';
  * @module
  */
 import type { BackendConfig } from './backend_config.js';
-/** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
-export declare const TS_SPINE_DIR_ENV = "FUZ_TESTING_TS_SPINE_DIR";
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */
 export declare const TS_SPINE_NODE_DEFAULT_PORT = 1178;
 /** Default port for the Deno TS spine binary. */
@@ -47,6 +45,21 @@ export interface TsSpineBackendConfigOptions {
      * client IP. Mirrors `SpineStubBackendConfigOptions.enable_login_rate_limit`.
      */
     readonly enable_login_rate_limit?: boolean;
+    /**
+     * Enable the action rate limiters (`FUZ_ACTION_RATE_LIMIT_ENABLED=true`) —
+     * one per-IP and one per-account limiter shared by the RPC and WS
+     * endpoints. Off by default, like `enable_login_rate_limit`; set only for
+     * the dedicated security cross project, which drives them through
+     * `ws_action_rate_limit.ts`. Mirrors `SpineStubBackendConfigOptions.enable_action_rate_limit`.
+     */
+    readonly enable_action_rate_limit?: boolean;
+    /**
+     * Replace both action limiters' `max_attempts`
+     * (`FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS`) so a suite reaches the cap in a few
+     * calls. Requires `enable_action_rate_limit` — the binary refuses to boot
+     * otherwise. Mirrors `SpineStubBackendConfigOptions.action_rate_limit_max_attempts`.
+     */
+    readonly action_rate_limit_max_attempts?: number;
 }
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA0C3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,15 +1,14 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
-import { SPINE_SSE_PATH } from './spine_surface_constants.js';
-/** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
-export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
+import { action_rate_limit_env, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_SSE_PATH, TS_SPINE_DIR_ENV } from './spine_surface_constants.js';
 /**
  * Capabilities for the TS spine binary — `ts_default_capabilities` plus `sse`
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the
  * `/ready` deploy gate in `build_spine_app`), `peer_request` (the backend
  * WS transport's `request_connection` path drives server→client `peer/ping`),
- * `ws_account_actions` (the binary mounts the account actions on `/api/ws`),
+ * `ws_account_actions` (the binary mounts its full action set on `/api/ws`,
+ * the account actions among them),
  * and `cell_gated_create` (the binary's `full_spine_mount` mounts the
  * `test_cell_gated_create_authorize` policy).
  */
@@ -78,7 +77,8 @@ export const ts_spine_node_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_capabilities
         }),
@@ -105,7 +105,8 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_bun_capabilities
         }),
@@ -149,7 +150,8 @@ export const ts_spine_deno_backend_config = (options = {}) => {
             paths,
             extra_env: {
                 [TS_SPINE_DIR_ENV]: paths.root,
-                ...login_rate_limit_env(enable_login_rate_limit)
+                ...login_rate_limit_env(enable_login_rate_limit),
+                ...action_rate_limit_env(options)
             },
             capabilities: ts_spine_capabilities
         }),

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts

@@ -0,0 +1,26 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for `describe_ws_action_rate_limit_cross_tests`. */
+export interface WsActionRateLimitCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /** Base URL the backend is reachable at (e.g. `http://localhost:1177`). */
+    readonly base_url: string;
+    /** WebSocket endpoint path (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** JSON-RPC endpoint path. Default `/api/rpc` (the spine convention). */
+    readonly rpc_path?: string;
+    /**
+     * The `max_attempts` both action limiters were started with
+     * (`action_rate_limit_max_attempts` on the backend config). At least 2 —
+     * the shared-bucket case splits the budget across the two transports.
+     */
+    readonly max_attempts: number;
+}
+/**
+ * Register the action rate-limit suite: the account axis over WS, one account
+ * bucket across HTTP RPC and WS, the per-IP axis keyed by `X-Forwarded-For`
+ * across both transports, and the account axis at the RPC and WS dispatchers.
+ */
+export declare const describe_ws_action_rate_limit_cross_tests: (options: WsActionRateLimitCrossTestOptions) => void;
+//# sourceMappingURL=ws_action_rate_limit.d.ts.map

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}