@fuzdev/fuz_app 0.133.0 → 0.135.0

package/dist/auth/cell_actions.js

@@ -165,7 +165,7 @@ export const create_cell_actions = (deps) => {
         // **in-tx** (only when an authorizer is mounted), reusing the parent row
         // when the parent *is* the root, else one read by `root_id` — so the
         // authorizer stays pure + the read rides the handler's connection (no
-        // separate-handle deadlock on the single-connection PGlite).
+        // separate-handle deadlock on the single-connection in-memory drivers).
         const parent_id = input.parent_id ?? null;
         let root_id = null;
         let root_data = null;

package/dist/auth/role_schema.d.ts

@@ -24,7 +24,17 @@ import { z } from 'zod';
 import { type CredentialTypeSchemaResult } from './credential_type_schema.js';
 import { type GrantPathSchemaResult } from './grant_path_schema.js';
 import type { ScopeKindSchemaResult } from './scope_kind_schema.js';
-/** Valid role name: lowercase letters and underscores, no leading/trailing underscore. */
+/**
+ * The longest role name `RoleName` admits, in characters. A role string is
+ * caller-chosen text until it passes the grammar, and the grant verbs record
+ * the role they refuse in a failure audit row, so the grammar bounds its
+ * length too. Same value as the Rust spine's `ROLE_NAME_LENGTH_MAX`.
+ */
+export declare const ROLE_NAME_LENGTH_MAX = 64;
+/**
+ * Valid role name: lowercase letters and underscores, no leading/trailing
+ * underscore, at most `ROLE_NAME_LENGTH_MAX` characters.
+ */
 export declare const RoleName: z.ZodString;
 export type RoleName = z.infer<typeof RoleName>;
 /** System-level role. Requires daemon token (filesystem proof). Controls the keep. */
@@ -78,7 +88,7 @@ export declare const is_builtin_role: (name: string) => name is BuiltinRole;
  * `builtin_role_specs_by_name`.
  */
 export interface RoleSpec {
-    /** Unique role name. Must match `RoleName` regex; collisions with builtins throw. */
+    /** Unique role name. Must match `RoleName` — its regex and length cap; collisions with builtins throw. */
     name: string;
     /** Admin-UI-facing copy describing the role's intent. */
     description?: string;
@@ -146,7 +156,8 @@ export interface RoleSchemaResult {
  *
  * Construction-time guards (all fire on misconfiguration):
  *
- * 1. Every `consumer_roles[i].name` matches `RoleName` regex.
+ * 1. Every `consumer_roles[i].name` matches `RoleName` — its regex and its
+ *    `ROLE_NAME_LENGTH_MAX` length cap.
  * 2. No two consumer roles share a name.
  * 3. No consumer role collides with a builtin (`keeper` / `admin`).
  * 4. When `options.credential_types` is supplied, every entry in

package/dist/auth/role_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,qBAAqB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,0FAA0F;AAC1F,eAAO,MAAM,QAAQ,aAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD,sFAAsF;AACtF,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,iEAAiE;AACjE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,+CAA+C;AAC/C,eAAO,MAAM,aAAa,8BAAqC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,WAAW;;;EAAwB,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,WACX,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,QAAQ;IACxB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAuBnE,CAAC;AAEH,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACvC,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,+FAA+F;IAC/F,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,oFAAoF;IACpF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAChC,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,yEAAyE;IACzE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,eAAO,MAAM,kBAAkB,GAC9B,gBAAgB,aAAa,CAAC,QAAQ,CAAC,EACvC,UAAS,uBAA4B,KACnC,gBA2CF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,MAAM,MAAM,EACZ,YAAY,MAAM,KAChB,OAGF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,GACtC,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,YAAY,MAAM,KAChB,KAAK,CAAC,MAAM,CAMd,CAAC"}
+{"version":3,"file":"role_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,qBAAqB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,QAAQ,aAMnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD,sFAAsF;AACtF,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,iEAAiE;AACjE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,+CAA+C;AAC/C,eAAO,MAAM,aAAa,8BAAqC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,WAAW;;;EAAwB,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,WACX,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,QAAQ;IACxB,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAuBnE,CAAC;AAEH,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACvC,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,+FAA+F;IAC/F,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,oFAAoF;IACpF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAChC,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,yEAAyE;IACzE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,kBAAkB,GAC9B,gBAAgB,aAAa,CAAC,QAAQ,CAAC,EACvC,UAAS,uBAA4B,KACnC,gBA2CF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,MAAM,MAAM,EACZ,YAAY,MAAM,KAChB,OAGF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,GACtC,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,YAAY,MAAM,KAChB,KAAK,CAAC,MAAM,CAMd,CAAC"}

package/dist/auth/role_schema.js

@@ -23,9 +23,20 @@
 import { z } from 'zod';
 import { CREDENTIAL_TYPE_DAEMON_TOKEN } from './credential_type_schema.js';
 import { GRANT_PATH_ADMIN, GRANT_PATH_BOOTSTRAP } from './grant_path_schema.js';
-/** Valid role name: lowercase letters and underscores, no leading/trailing underscore. */
+/**
+ * The longest role name `RoleName` admits, in characters. A role string is
+ * caller-chosen text until it passes the grammar, and the grant verbs record
+ * the role they refuse in a failure audit row, so the grammar bounds its
+ * length too. Same value as the Rust spine's `ROLE_NAME_LENGTH_MAX`.
+ */
+export const ROLE_NAME_LENGTH_MAX = 64;
+/**
+ * Valid role name: lowercase letters and underscores, no leading/trailing
+ * underscore, at most `ROLE_NAME_LENGTH_MAX` characters.
+ */
 export const RoleName = z
     .string()
+    .max(ROLE_NAME_LENGTH_MAX, `Role names must be at most ${ROLE_NAME_LENGTH_MAX} characters`)
     .regex(/^[a-z][a-z_]*[a-z]$|^[a-z]$/, 'Role names must be lowercase letters and underscores (a-z_), no leading/trailing underscore');
 // Builtin roles — provided by fuz_app, always available.
 /** System-level role. Requires daemon token (filesystem proof). Controls the keep. */
@@ -99,7 +110,8 @@ const validate_registry_membership = (role_name, field, values, registry) => {
  *
  * Construction-time guards (all fire on misconfiguration):
  *
- * 1. Every `consumer_roles[i].name` matches `RoleName` regex.
+ * 1. Every `consumer_roles[i].name` matches `RoleName` — its regex and its
+ *    `ROLE_NAME_LENGTH_MAX` length cap.
  * 2. No two consumer roles share a name.
  * 3. No consumer role collides with a builtin (`keeper` / `admin`).
  * 4. When `options.credential_types` is supplied, every entry in

package/dist/db/CLAUDE.md

@@ -1,6 +1,6 @@
 # db/
 
-> Database layer: the `Db` abstraction over pg + PGlite, the migration
+> Database layer: the `Db` abstraction over pg, PGlite and pglet, the migration
 > runner, and the cell content-primitive schema + queries.
 
 For server assembly, `QueryDeps`, and migration-runner contract see the
@@ -12,20 +12,23 @@ the code.
 
 ## Generic db infrastructure
 
-- `db.ts` — `Db` abstraction over pg + PGlite, `query` / `query_one` /
+- `db.ts` — `Db` abstraction over pg, PGlite and pglet, `query` / `query_one` /
   `transaction`, `no_nested_transaction` guard.
 - `create_db.ts` — URL-based driver auto-detection (`postgres` /
-  `pglite-file` / `pglite-memory`).
-- `db_pg.ts` / `db_pglite.ts` — driver adapters. `db_pg.ts` also exports
-  `register_pg_type_parsers`, the shared int8→number coercion (so
+  `pglite-file` for `file://` / `pglet-memory` for `memory://`, over
+  `@fuzdev/pglet-wasm`). An in-memory PGlite is `create_pglite_db(new PGlite())`.
+- `db_pg.ts` / `db_pglite.ts` / `db_pglet.ts` — driver adapters. `db_pg.ts` also
+  exports `register_pg_type_parsers`, the shared int8→number coercion (so
   `BIGSERIAL` columns read as JS numbers, matching PGlite) — called by both
   `create_db` and the test pg factory (`testing/db.ts`) so prod and tests
-  read the same wire shape from one registration site.
+  read the same wire shape from one registration site. `db_pglet.ts`'s
+  `PGLET_COERCION` is pglet's half of the same convention, which every pglet
+  instance fuz_app creates is given.
 - `migrate.ts` — advisory-lock migration runner (`run_migrations`,
   `baseline`), `Migration` / `MigrationNamespace` / `MigrationError`.
 - `query_deps.ts` — `QueryDeps = {db}`, the first param to every `query_*`.
 - `assert_row.ts` — `assert_row(row, context)` for INSERT … RETURNING.
-- `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite errors), `is_pg_unique_violation` (Postgres `23505`).
+- `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite/pglet errors), `is_pg_unique_violation` (Postgres `23505`).
 - `sql_identifier.ts` — `assert_valid_sql_identifier`.
 - `sql_columns.ts` — `columns_sql` / `qualify_columns` / `omit_columns`,
   the derivation helpers every `*_COLUMNS` projection const's variants

package/dist/db/create_db.d.ts

@@ -4,11 +4,12 @@
  * Selects the appropriate database driver based on `database_url`:
  * - `postgres://` or `postgresql://` — uses `pg` (PostgreSQL)
  * - `file://` — uses `@electric-sql/pglite` (file-based)
- * - `memory://` — uses `@electric-sql/pglite` (in-memory)
+ * - `memory://` — uses `@fuzdev/pglet-wasm` (in-memory)
  *
- * Both `pg` and `@electric-sql/pglite` are optional peer dependencies,
- * dynamically imported only when needed. For direct driver construction
- * without auto-detection, use `db/db_pg.ts` or `db/db_pglite.ts`.
+ * `pg`, `@electric-sql/pglite` and `@fuzdev/pglet-wasm` are optional peer
+ * dependencies, dynamically imported only when needed. For direct driver
+ * construction without auto-detection, use `db/db_pg.ts`, `db/db_pglite.ts`
+ * or `db/db_pglet.ts` — an in-memory PGlite is `create_pglite_db(new PGlite())`.
  *
  * @module
  */
@@ -28,12 +29,13 @@ export interface CreateDbResult {
  * know which driver is in use.
  *
  * For direct driver construction without URL routing, import
- * `create_pg_db` from `db/db_pg.ts` or `create_pglite_db` from `db/db_pglite.ts`.
+ * `create_pg_db` from `db/db_pg.ts`, `create_pglite_db` from `db/db_pglite.ts`
+ * or `create_pglet_db_driver` from `db/db_pglet.ts`.
  *
  * @param database_url - connection URL (`postgres://`, `postgresql://`, `file://`, or `memory://`)
  * @returns database instance, close callback, type, and display name
  * @throws Error if `database_url` uses an unsupported scheme. Driver
- *   construction (`pg.Pool` or `PGlite`) may also throw on bad connection
+ *   construction (`pg.Pool`, `PGlite` or pglet) may also throw on bad connection
  *   parameters or missing peer-dependency packages.
  */
 export declare const create_db: (database_url: string) => Promise<CreateDbResult>;

package/dist/db/create_db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAI1C,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CAmC5E,CAAC"}
+{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAK1C,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CAiC5E,CAAC"}

package/dist/db/create_db.js

@@ -4,16 +4,18 @@
  * Selects the appropriate database driver based on `database_url`:
  * - `postgres://` or `postgresql://` — uses `pg` (PostgreSQL)
  * - `file://` — uses `@electric-sql/pglite` (file-based)
- * - `memory://` — uses `@electric-sql/pglite` (in-memory)
+ * - `memory://` — uses `@fuzdev/pglet-wasm` (in-memory)
  *
- * Both `pg` and `@electric-sql/pglite` are optional peer dependencies,
- * dynamically imported only when needed. For direct driver construction
- * without auto-detection, use `db/db_pg.ts` or `db/db_pglite.ts`.
+ * `pg`, `@electric-sql/pglite` and `@fuzdev/pglet-wasm` are optional peer
+ * dependencies, dynamically imported only when needed. For direct driver
+ * construction without auto-detection, use `db/db_pg.ts`, `db/db_pglite.ts`
+ * or `db/db_pglet.ts` — an in-memory PGlite is `create_pglite_db(new PGlite())`.
  *
  * @module
  */
 import { create_pg_db, register_pg_type_parsers } from './db_pg.js';
 import { create_pglite_db } from './db_pglite.js';
+import { create_pglet_db_driver, create_pglet_instance } from './db_pglet.js';
 /**
  * Create a database connection based on a URL.
  *
@@ -21,12 +23,13 @@ import { create_pglite_db } from './db_pglite.js';
  * know which driver is in use.
  *
  * For direct driver construction without URL routing, import
- * `create_pg_db` from `db/db_pg.ts` or `create_pglite_db` from `db/db_pglite.ts`.
+ * `create_pg_db` from `db/db_pg.ts`, `create_pglite_db` from `db/db_pglite.ts`
+ * or `create_pglet_db_driver` from `db/db_pglet.ts`.
  *
  * @param database_url - connection URL (`postgres://`, `postgresql://`, `file://`, or `memory://`)
  * @returns database instance, close callback, type, and display name
  * @throws Error if `database_url` uses an unsupported scheme. Driver
- *   construction (`pg.Pool` or `PGlite`) may also throw on bad connection
+ *   construction (`pg.Pool`, `PGlite` or pglet) may also throw on bad connection
  *   parameters or missing peer-dependency packages.
  */
 export const create_db = async (database_url) => {
@@ -43,10 +46,8 @@ export const create_db = async (database_url) => {
         };
     }
     if (database_url.startsWith('memory://')) {
-        const { PGlite } = await import('@electric-sql/pglite');
-        const pglite = new PGlite(database_url);
-        const { db, close } = create_pglite_db(pglite);
-        return { db, close, db_type: 'pglite-memory', db_name: '(memory)' };
+        const { db, close } = create_pglet_db_driver(await create_pglet_instance());
+        return { db, close, db_type: 'pglet-memory', db_name: '(memory)' };
     }
     if (database_url.startsWith('file://')) {
         const path = new URL(database_url).pathname;

package/dist/db/db.d.ts

@@ -2,17 +2,17 @@
  * Database wrapper with duck-typed interface.
  *
  * Accepts any client with a query(text, values) method.
- * Both `pg.Pool` and `@electric-sql/pglite` satisfy this interface.
+ * `pg.Pool`, `@electric-sql/pglite` and `@fuzdev/pglet-wasm` all satisfy this interface.
  *
  * Transaction safety is provided by an injected `transaction` callback —
- * the driver adapters (`db/db_pg.ts`, `db/db_pglite.ts`) supply the driver-appropriate
+ * the driver adapters (`db/db_pg.ts`, `db/db_pglite.ts`, `db/db_pglet.ts`) supply the driver-appropriate
  * implementation. Close is handled externally (returned alongside the `Db`
  * as `DbDriverResult`), not as a method on this class.
  *
  * @module
  */
 /**
- * Minimal interface that both pg and pglite satisfy.
+ * Minimal interface that pg, pglite and pglet satisfy.
  */
 export interface DbClient {
     query: <T = unknown>(text: string, values?: Array<unknown>) => Promise<{
@@ -25,6 +25,7 @@ export interface DbClient {
  * `transaction` is injected by `create_db` which knows the driver.
  * For `pg`: acquires a dedicated pool client per transaction.
  * For PGlite: delegates to `pglite.transaction()`.
+ * For pglet: delegates to the adapter's `transaction()`.
  */
 export interface DbDeps {
     client: DbClient;
@@ -33,7 +34,7 @@ export interface DbDeps {
 /**
  * Result of constructing a driver-specific `Db`.
  *
- * Returned by `create_pg_db()` and `create_pglite_db()`.
+ * Returned by `create_pg_db()`, `create_pglite_db()` and `create_pglet_db_driver()`.
  * The `close` callback is bound to the actual driver — callers
  * never need to know which driver is in use.
  */
@@ -43,7 +44,7 @@ export interface DbDriverResult {
     close: () => Promise<void>;
 }
 /** Database driver type. */
-export type DbType = 'postgres' | 'pglite-file' | 'pglite-memory';
+export type DbType = 'postgres' | 'pglite-file' | 'pglet-memory';
 /**
  * Sentinel transaction function for transaction-scoped `Db` instances.
  *
@@ -56,8 +57,9 @@ export declare const no_nested_transaction: DbDeps['transaction'];
 /**
  * Database wrapper providing a consistent query and transaction interface.
  *
- * Construct via `create_pg_db()` from `db/db_pg.ts` or `create_pglite_db()` from
- * `db/db_pglite.ts` for proper transaction support, or via `create_db()` for
+ * Construct via `create_pg_db()` from `db/db_pg.ts`, `create_pglite_db()` from
+ * `db/db_pglite.ts` or `create_pglet_db_driver()` from `db/db_pglet.ts` for proper
+ * transaction support, or via `create_db()` for
  * URL-based auto-detection.
  *
  * @example

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACtB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,4BAA4B;AAC5B,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,aAAa,CAEvD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,EAAE;;IACd,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAId,OAAO,EAAE,MAAM;IAK3B;;;;;;OAMG;IACG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAKxE;;;;;;OAMG;IACG,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKjF;;;;;;;;;;;OAWG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAG/D"}
+{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,MAAM;IACtB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,4BAA4B;AAC5B,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,aAAa,CAEvD,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,EAAE;;IACd,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAId,OAAO,EAAE,MAAM;IAK3B;;;;;;OAMG;IACG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAKxE;;;;;;OAMG;IACG,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKjF;;;;;;;;;;;OAWG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAG/D"}

package/dist/db/db.js

@@ -2,10 +2,10 @@
  * Database wrapper with duck-typed interface.
  *
  * Accepts any client with a query(text, values) method.
- * Both `pg.Pool` and `@electric-sql/pglite` satisfy this interface.
+ * `pg.Pool`, `@electric-sql/pglite` and `@fuzdev/pglet-wasm` all satisfy this interface.
  *
  * Transaction safety is provided by an injected `transaction` callback —
- * the driver adapters (`db/db_pg.ts`, `db/db_pglite.ts`) supply the driver-appropriate
+ * the driver adapters (`db/db_pg.ts`, `db/db_pglite.ts`, `db/db_pglet.ts`) supply the driver-appropriate
  * implementation. Close is handled externally (returned alongside the `Db`
  * as `DbDriverResult`), not as a method on this class.
  *
@@ -25,8 +25,9 @@ export const no_nested_transaction = () => {
 /**
  * Database wrapper providing a consistent query and transaction interface.
  *
- * Construct via `create_pg_db()` from `db/db_pg.ts` or `create_pglite_db()` from
- * `db/db_pglite.ts` for proper transaction support, or via `create_db()` for
+ * Construct via `create_pg_db()` from `db/db_pg.ts`, `create_pglite_db()` from
+ * `db/db_pglite.ts` or `create_pglet_db_driver()` from `db/db_pglet.ts` for proper
+ * transaction support, or via `create_db()` for
  * URL-based auto-detection.
  *
  * @example

package/dist/db/db_pglet.d.ts

@@ -0,0 +1,43 @@
+/**
+ * pglet driver adapter for `Db`.
+ *
+ * Provides `create_pglet_instance()`, which loads `@fuzdev/pglet-wasm` on
+ * demand and creates an in-memory instance with `PGLET_COERCION`, the value
+ * coercion every fuz_app pglet instance is created with, and
+ * `create_pglet_db_driver()` to construct a `Db` backed by one. The package is
+ * imported dynamically, so it stays an optional peer.
+ *
+ * @module
+ */
+import type { CoercionOptions, PgletDb } from '@fuzdev/pglet-wasm';
+import { type DbDriverResult } from './db.js';
+/**
+ * The value coercion fuz_app creates every pglet instance with.
+ *
+ * The adapter defaults int8 to `bigint`; fuz_app reads int8 as a JS number on
+ * every driver (`register_pg_type_parsers` for `pg`, PGlite's own default), so
+ * `AuditLogEvent.seq` and friends validate identically across drivers.
+ */
+export declare const PGLET_COERCION: CoercionOptions;
+/**
+ * Create an in-memory pglet instance with `PGLET_COERCION`.
+ *
+ * Loads `@fuzdev/pglet-wasm` on demand and awaits its `init()` — a no-op on the
+ * package's Node entry, where the wasm loads at import; the browser entry loads
+ * it here.
+ *
+ * @returns a fresh, empty instance; wrap it with `create_pglet_db_driver`
+ */
+export declare const create_pglet_instance: () => Promise<PgletDb>;
+/**
+ * Create a `Db` backed by a pglet instance.
+ *
+ Named `_driver` to stay clear of `@fuzdev/pglet-wasm`'s own `create_pglet_db`,
+ * which creates the instance this wraps. Create it with `create_pglet_instance`
+ * (or with `PGLET_COERCION`) so it reads values as the other drivers do.
+ *
+ * @param pglet - a `@fuzdev/pglet-wasm` instance
+ * @returns the `Db` instance and a `close` callback bound to `pglet.close()`
+ */
+export declare const create_pglet_db_driver: (pglet: PgletDb) => DbDriverResult;
+//# sourceMappingURL=db_pglet.d.ts.map

package/dist/db/db_pglet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db_pglet.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db_pglet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,eAAoC,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAI7D,CAAC;AAaF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,cAGtD,CAAC"}

package/dist/db/db_pglet.js

@@ -0,0 +1,55 @@
+/**
+ * pglet driver adapter for `Db`.
+ *
+ * Provides `create_pglet_instance()`, which loads `@fuzdev/pglet-wasm` on
+ * demand and creates an in-memory instance with `PGLET_COERCION`, the value
+ * coercion every fuz_app pglet instance is created with, and
+ * `create_pglet_db_driver()` to construct a `Db` backed by one. The package is
+ * imported dynamically, so it stays an optional peer.
+ *
+ * @module
+ */
+import { Db, no_nested_transaction } from './db.js';
+/**
+ * The value coercion fuz_app creates every pglet instance with.
+ *
+ * The adapter defaults int8 to `bigint`; fuz_app reads int8 as a JS number on
+ * every driver (`register_pg_type_parsers` for `pg`, PGlite's own default), so
+ * `AuditLogEvent.seq` and friends validate identically across drivers.
+ */
+export const PGLET_COERCION = { int8: 'number' };
+/**
+ * Create an in-memory pglet instance with `PGLET_COERCION`.
+ *
+ * Loads `@fuzdev/pglet-wasm` on demand and awaits its `init()` — a no-op on the
+ * package's Node entry, where the wasm loads at import; the browser entry loads
+ * it here.
+ *
+ * @returns a fresh, empty instance; wrap it with `create_pglet_db_driver`
+ */
+export const create_pglet_instance = async () => {
+    const pglet_wasm = await import('@fuzdev/pglet-wasm');
+    await pglet_wasm.init();
+    return pglet_wasm.create_pglet_db({ coercion: PGLET_COERCION });
+};
+/**
+ * Create a transaction implementation for pglet.
+ *
+ * Delegates to the adapter's single-flight `transaction()` (`BEGIN` / `COMMIT`,
+ * `ROLLBACK` on throw).
+ */
+const create_pglet_transaction = (pglet) => async (fn) => pglet.transaction(async (tx) => fn(new Db({ client: tx, transaction: no_nested_transaction })));
+/**
+ * Create a `Db` backed by a pglet instance.
+ *
+ Named `_driver` to stay clear of `@fuzdev/pglet-wasm`'s own `create_pglet_db`,
+ * which creates the instance this wraps. Create it with `create_pglet_instance`
+ * (or with `PGLET_COERCION`) so it reads values as the other drivers do.
+ *
+ * @param pglet - a `@fuzdev/pglet-wasm` instance
+ * @returns the `Db` instance and a `close` callback bound to `pglet.close()`
+ */
+export const create_pglet_db_driver = (pglet) => ({
+    db: new Db({ client: pglet, transaction: create_pglet_transaction(pglet) }),
+    close: () => pglet.close()
+});

package/dist/db/migrate.d.ts

@@ -50,7 +50,7 @@
  * tx atomicity + the `(namespace, name)` PK on `schema_version`: the
  * loser's INSERT hits a PK violation, the chain-tx rolls back, and the
  * next boot reads the committed state and proceeds cleanly. Environments
- * without `pg_advisory_lock` (some PGlite versions) silently fall through.
+ * without `pg_advisory_lock` (pglet) silently fall through.
  *
  * @module
  */

package/dist/db/migrate.js

@@ -50,7 +50,7 @@
  * tx atomicity + the `(namespace, name)` PK on `schema_version`: the
  * loser's INSERT hits a PK violation, the chain-tx rolls back, and the
  * next boot reads the committed state and proceeds cleanly. Environments
- * without `pg_advisory_lock` (some PGlite versions) silently fall through.
+ * without `pg_advisory_lock` (pglet) silently fall through.
  *
  * @module
  */
@@ -99,7 +99,7 @@ const namespace_lock_key = (namespace) => {
  * Run `fn` with the namespace's advisory lock held.
  *
  * Acquire / release are best-effort and silently fall through in
- * environments without `pg_advisory_lock` (some PGlite versions). The
+ * environments without `pg_advisory_lock` (pglet). The
  * `finally` ensures release on any throw from `fn`.
  */
 const with_namespace_lock = async (db, namespace, fn) => {

package/dist/http/CLAUDE.md

@@ -19,6 +19,7 @@ effects, see ../../../docs/architecture.md.
 - `http/error_schemas.ts` — `ERROR_*` constants, standard error shapes, `derive_error_schemas`.
 - `http/schema_helpers.ts` — shared Zod introspection (null/void/strict/surface/merge/middleware-applies) + `to_void_params` / `to_input_params` / `safe_parse_dropping_unknown_keys`.
 - `http/middleware_spec.ts` — `MiddlewareSpec` interface.
+- `http/body_limit.ts` — `create_body_limit_middleware(max_size)`: the `413` body cap `create_app_server` mounts. Refuses on `Content-Length` without reading `c.req.raw.body` and answers `Connection: close` — `413` past the cap, `400` `ERROR_INVALID_CONTENT_LENGTH` when the value is not a plain run of ASCII digits (a length the cap cannot read, which Hono's `bodyLimit` would pass uncounted) — else falls through to Hono's streaming `bodyLimit` (no `Content-Length`, or one beside `Transfer-Encoding`; that `413` carries no `Connection: close`). Mounted with `app.use`, not as a `MiddlewareSpec`, so neither status appears in a route's merged error schemas. After the header `413` Node closes at once (the header is what makes `@hono/node-server` do so), Deno closes once the declared body has arrived, and Bun keeps the connection and serves the next request (../../../docs/security.md §Body Size Limiting).
 - `http/surface.ts` — `AppSurface`, `AppSurfaceSpec`, `generate_app_surface`, diagnostics.
 - `http/surface_query.ts` — pure filters/groupings over `AppSurface`.
 - `http/proxy.ts` — trusted-proxy middleware, CIDR parsing, rightmost-first XFF resolution. Pulls `hono/utils/ipaddr` for CIDR matching.
@@ -207,7 +208,7 @@ confirmation.
 ### `ERROR_*` constants by category
 
 - **Validation**: `ERROR_INVALID_REQUEST_BODY`, `ERROR_INVALID_JSON_BODY`, `ERROR_INVALID_ROUTE_PARAMS`, `ERROR_INVALID_QUERY_PARAMS`
-- **Auth**: `ERROR_AUTHENTICATION_REQUIRED`, `ERROR_INSUFFICIENT_PERMISSIONS`, `ERROR_CREDENTIAL_TYPE_REQUIRED`, `ERROR_RATE_LIMIT_EXCEEDED`, `ERROR_INVALID_CREDENTIALS`, `ERROR_PAYLOAD_TOO_LARGE`
+- **Auth**: `ERROR_AUTHENTICATION_REQUIRED`, `ERROR_INSUFFICIENT_PERMISSIONS`, `ERROR_CREDENTIAL_TYPE_REQUIRED`, `ERROR_RATE_LIMIT_EXCEEDED`, `ERROR_INVALID_CREDENTIALS`, `ERROR_PAYLOAD_TOO_LARGE`, `ERROR_INVALID_CONTENT_LENGTH`
 - **Origin + bearer**: `ERROR_FORBIDDEN_ORIGIN`, `ERROR_INVALID_TOKEN`, `ERROR_ACCOUNT_NOT_FOUND`
 - **Keeper/daemon**: `ERROR_KEEPER_ACCOUNT_NOT_FOUND`
 - **Bootstrap**: `ERROR_ALREADY_BOOTSTRAPPED`, `ERROR_TOKEN_FILE_MISSING`

package/dist/http/body_limit.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Request body size limit — rejects an oversized body with `413`, and a
+ * `Content-Length` it cannot read with `400`, before auth and validation.
+ *
+ * Wraps Hono's `bodyLimit` with a header-first check:
+ *
+ * - A `Content-Length` that is not a plain run of ASCII digits (`abc`, `-1`,
+ *   `+5`, `1e9`, `0x1F4`, empty, or a combined `5, 500`) is refused with `400`
+ *   `{error: 'invalid_content_length'}`. A cap cannot be applied to a length
+ *   that does not parse, and `bodyLimit` passes such a request on uncounted.
+ *   The runtimes' HTTP parsers answer their own bodiless `400` to most of
+ *   these before the application sees them, so this branch is defense in
+ *   depth where they do and the refusal where they do not: Node's refuses
+ *   them all; Deno hands over a repeated equal header as one combined value
+ *   (`50, 50`); Bun hands over an empty value and a repeated header, equal or
+ *   differing (`5, 50`), framing the body on the first (observed on Node
+ *   24.14.1, Deno 2.8.3, Bun 1.3.11). The Rust spine's parser (hyper) refuses
+ *   a malformed value and differing repeats, and accepts an equal repeat as
+ *   the one value.
+ * - A request whose `Content-Length` exceeds the cap is refused with `413`
+ *   `{error: 'payload_too_large'}`, whatever its method. A digit run of any
+ *   length compares as a number, so one too long to represent exactly is over
+ *   the cap, never unreadable.
+ * - Both refusals answer on the header alone — without touching
+ *   `c.req.raw.body` — and carry `Connection: close`.
+ * - A request with a well-formed `Content-Length` beside `Transfer-Encoding`,
+ *   or with no `Content-Length`, falls through to `bodyLimit`'s streaming
+ *   count: with `Transfer-Encoding` the declared length does not frame the
+ *   body, so the bytes that arrive are what is measured. That `413` is sent
+ *   once more than the cap has been read and carries no `Connection: close`.
+ *   The Node, Deno and Bun parsers refuse a request carrying both headers
+ *   with their own `400`; hyper accepts one and frames its body as chunked.
+ * - A well-formed `Content-Length` within the cap is trusted to frame the
+ *   body, as the runtime's HTTP parser enforces.
+ *
+ * What the connection does after the header `413` is the runtime's
+ * (`docs/security.md` §"Body Size Limiting"):
+ *
+ * - **Node** (`@hono/node-server`) closes at once, the body unread. The
+ *   `Connection: close` header is what does it: without one the adapter
+ *   holds the connection for a drain window and then closes or, the body
+ *   untouched and arriving within the window, reads it off and serves the
+ *   next request.
+ * - **Deno** closes once the whole declared body has arrived and holds the
+ *   connection open while a client withholds it; a request pipelined behind
+ *   the body is not served. Neither the header nor what the handler does with
+ *   the body changes that (observed on Deno 2.8.3).
+ * - **Bun** keeps the connection, skips the declared body, and serves the
+ *   next request on it (observed on Bun 1.3.11).
+ *
+ * @module
+ */
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Create the body size limit middleware.
+ *
+ * @param max_size - the largest accepted body, in bytes
+ * @returns middleware answering `413` `{error: 'payload_too_large'}` past the cap and `400` `{error: 'invalid_content_length'}` to a `Content-Length` that is not a run of digits
+ */
+export declare const create_body_limit_middleware: (max_size: number) => MiddlewareHandler;
+//# sourceMappingURL=body_limit.d.ts.map

package/dist/http/body_limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/body_limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAQ9C;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,MAAM,KAAG,iBAwB/D,CAAC"}

package/dist/http/body_limit.js

@@ -0,0 +1,87 @@
+/**
+ * Request body size limit — rejects an oversized body with `413`, and a
+ * `Content-Length` it cannot read with `400`, before auth and validation.
+ *
+ * Wraps Hono's `bodyLimit` with a header-first check:
+ *
+ * - A `Content-Length` that is not a plain run of ASCII digits (`abc`, `-1`,
+ *   `+5`, `1e9`, `0x1F4`, empty, or a combined `5, 500`) is refused with `400`
+ *   `{error: 'invalid_content_length'}`. A cap cannot be applied to a length
+ *   that does not parse, and `bodyLimit` passes such a request on uncounted.
+ *   The runtimes' HTTP parsers answer their own bodiless `400` to most of
+ *   these before the application sees them, so this branch is defense in
+ *   depth where they do and the refusal where they do not: Node's refuses
+ *   them all; Deno hands over a repeated equal header as one combined value
+ *   (`50, 50`); Bun hands over an empty value and a repeated header, equal or
+ *   differing (`5, 50`), framing the body on the first (observed on Node
+ *   24.14.1, Deno 2.8.3, Bun 1.3.11). The Rust spine's parser (hyper) refuses
+ *   a malformed value and differing repeats, and accepts an equal repeat as
+ *   the one value.
+ * - A request whose `Content-Length` exceeds the cap is refused with `413`
+ *   `{error: 'payload_too_large'}`, whatever its method. A digit run of any
+ *   length compares as a number, so one too long to represent exactly is over
+ *   the cap, never unreadable.
+ * - Both refusals answer on the header alone — without touching
+ *   `c.req.raw.body` — and carry `Connection: close`.
+ * - A request with a well-formed `Content-Length` beside `Transfer-Encoding`,
+ *   or with no `Content-Length`, falls through to `bodyLimit`'s streaming
+ *   count: with `Transfer-Encoding` the declared length does not frame the
+ *   body, so the bytes that arrive are what is measured. That `413` is sent
+ *   once more than the cap has been read and carries no `Connection: close`.
+ *   The Node, Deno and Bun parsers refuse a request carrying both headers
+ *   with their own `400`; hyper accepts one and frames its body as chunked.
+ * - A well-formed `Content-Length` within the cap is trusted to frame the
+ *   body, as the runtime's HTTP parser enforces.
+ *
+ * What the connection does after the header `413` is the runtime's
+ * (`docs/security.md` §"Body Size Limiting"):
+ *
+ * - **Node** (`@hono/node-server`) closes at once, the body unread. The
+ *   `Connection: close` header is what does it: without one the adapter
+ *   holds the connection for a drain window and then closes or, the body
+ *   untouched and arriving within the window, reads it off and serves the
+ *   next request.
+ * - **Deno** closes once the whole declared body has arrived and holds the
+ *   connection open while a client withholds it; a request pipelined behind
+ *   the body is not served. Neither the header nor what the handler does with
+ *   the body changes that (observed on Deno 2.8.3).
+ * - **Bun** keeps the connection, skips the declared body, and serves the
+ *   next request on it (observed on Bun 1.3.11).
+ *
+ * @module
+ */
+import { bodyLimit } from 'hono/body-limit';
+import { ERROR_INVALID_CONTENT_LENGTH, ERROR_PAYLOAD_TOO_LARGE } from './error_schemas.js';
+/** A well-formed `Content-Length` value: one or more ASCII digits and nothing else. */
+const CONTENT_LENGTH_DIGITS = /^[0-9]+$/;
+/**
+ * Create the body size limit middleware.
+ *
+ * @param max_size - the largest accepted body, in bytes
+ * @returns middleware answering `413` `{error: 'payload_too_large'}` past the cap and `400` `{error: 'invalid_content_length'}` to a `Content-Length` that is not a run of digits
+ */
+export const create_body_limit_middleware = (max_size) => {
+    const streaming_limit = bodyLimit({
+        maxSize: max_size,
+        onError: (c) => c.json({ error: ERROR_PAYLOAD_TOO_LARGE }, 413)
+    });
+    return async (c, next) => {
+        const content_length = c.req.header('content-length');
+        if (content_length !== undefined) {
+            if (!CONTENT_LENGTH_DIGITS.test(content_length)) {
+                // a length that does not parse cannot be capped, and `bodyLimit`
+                // would pass the request on without counting it
+                return c.json({ error: ERROR_INVALID_CONTENT_LENGTH }, 400, { connection: 'close' });
+            }
+            // `Number` of a digit run is never `NaN`; past exact precision it is
+            // still a huge number (or `Infinity`), so it compares as over the cap
+            if (!c.req.header('transfer-encoding') && Number(content_length) > max_size) {
+                // refused on the header alone, the body untouched; `Connection: close`
+                // makes `@hono/node-server` close at once instead of holding the
+                // connection or serving the request behind the body
+                return c.json({ error: ERROR_PAYLOAD_TOO_LARGE }, 413, { connection: 'close' });
+            }
+        }
+        return streaming_limit(c, next);
+    };
+};

package/dist/http/db_routes.js

@@ -425,8 +425,8 @@ export const create_db_route_specs = (deps, options) => {
                     }
                     // 23503 foreign_key_violation / 23001 restrict_violation — the
                     // same referencing-row refusal: PG 18+ raises 23001 for `ON
-                    // DELETE RESTRICT` constraints where PG ≤17 (PGlite today)
-                    // raises 23503 for both.
+                    // DELETE RESTRICT` constraints where PG ≤17 raises 23503 for
+                    // both.
                     if (code === '23503' || code === '23001') {
                         const pg_err = err;
                         log?.warn('Foreign key violation:', pg_err.detail, pg_err.constraint);