@fuzdev/fuz_app 0.134.0 → 0.135.0

package/dist/realtime/sse.js

@@ -4,12 +4,30 @@
  * Provides generic helpers for creating SSE response streams
  * and a notification type aligned with JSON-RPC 2.0.
  *
+ * ## Outbound bound
+ *
+ * `SseStream.send` never waits on its client: each frame is written to the
+ * response stream, which holds it until the client reads. What a stream holds
+ * unread is kept within `SSE_OUTBOUND_QUEUE_BYTES` — each frame charged its
+ * bytes as written (`data: ` prefix and terminator included) plus
+ * `OUTBOUND_FRAME_OVERHEAD_BYTES`, and a frame always accepted when nothing is
+ * unread, so a single frame larger than the budget is still deliverable. A
+ * frame that does not fit **ends the stream**: it is not written, what was
+ * unread is dropped, the body ends with no final frame, and the stream's
+ * `on_close` listeners run. One `warn` line names the stream's account (when
+ * the caller passed it) and what was unread; no audit row is written, since each would itself be fanned to every
+ * stream. A client that is reading reconnects and misses the frames in
+ * between. The twin of the Rust spine's `fuz_realtime` SSE bound — the same
+ * budget and charge.
+ *
  * @module
  */
 import { streamSSE } from 'hono/streaming';
 import { z } from 'zod';
 import { DEV } from 'esm-env';
-import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
+import { utf8_length } from '../actions/transports.js';
+import { OutboundBudget } from './outbound_budget.js';
+import { SSE_CONNECTED_COMMENT, SSE_OUTBOUND_QUEUE_BYTES } from './sse_constants.js';
 const is_node_connection_stream = (value) => {
     if (typeof value !== 'object' || value === null)
         return false;
@@ -85,10 +103,15 @@ const watch_client_disconnect = (c, on_gone) => {
  * Uses `hono_stream.write()` directly (not `writeSSE`) to avoid
  * Hono's HTML callback resolution — keeps the same `data: JSON\n\n` format.
  *
- * @param log - logger for serialization and `on_close` listener errors
+ * What the stream holds unread is bounded by `SSE_OUTBOUND_QUEUE_BYTES`; a
+ * frame past it ends the stream (module doc, "Outbound bound").
+ *
+ * @param log - logger for serialization and `on_close` listener errors, and
+ *   for the warning when the stream ends on its outbound budget
+ * @param options - what the overflow warning names
  * @returns object with the streaming `Response` and an `SseStream` controller
  */
-export const create_sse_response = (c, log) => {
+export const create_sse_response = (c, log, options) => {
     const { promise, resolve } = Promise.withResolvers();
     const close_listeners = [];
     let resolved = false;
@@ -107,24 +130,53 @@ export const create_sse_response = (c, log) => {
         }
     };
     let sse_stream;
+    // charges the frames written to the stream and not yet read from it
+    const budget = new OutboundBudget(SSE_OUTBOUND_QUEUE_BYTES);
     const response = streamSSE(c, async (hono_stream) => {
+        // Write one frame within the budget, or end the stream. The write
+        // settles once the response body has taken the frame, which frees its
+        // charge.
+        const write = (frame) => {
+            const bytes = utf8_length(frame);
+            if (!budget.admit(bytes)) {
+                // same line as the Rust spine's registry, so one grep finds either
+                log.warn('sse: outbound queue overflow, ending the stream', {
+                    account_id: options?.account_id ?? null,
+                    ...budget.to_overflow(bytes)
+                });
+                budget.clear();
+                // drops what the stream still holds and ends the body; `do_close`
+                // runs as its abort listener
+                hono_stream.abort();
+                do_close();
+                return;
+            }
+            void hono_stream.write(frame).then(() => {
+                // a stream that ended has had its charges cleared
+                if (!resolved && !hono_stream.aborted)
+                    budget.release(bytes);
+            });
+        };
         sse_stream = {
             send(data) {
                 if (resolved || hono_stream.aborted)
                     return;
+                let frame;
                 try {
                     // JSON.stringify (no space arg) never produces literal newlines,
                     // so single-line `data:` framing is safe per the SSE spec.
-                    void hono_stream.write(`data: ${JSON.stringify(data)}\n\n`);
+                    frame = `data: ${JSON.stringify(data)}\n\n`;
                 }
                 catch (e) {
                     log.error('send failed to serialize data:', e);
+                    return;
                 }
+                write(frame);
             },
             comment(text) {
                 if (resolved || hono_stream.aborted)
                     return;
-                void hono_stream.write(`: ${text}\n`);
+                write(`: ${text}\n`);
             },
             close: do_close,
             on_close(fn) {
@@ -143,7 +195,7 @@ export const create_sse_response = (c, log) => {
         hono_stream.onAbort(do_close);
         // flush an SSE comment to push headers through proxies (Vite, nginx),
         // ensuring EventSource fires onopen without waiting for the first data event
-        void hono_stream.write(SSE_CONNECTED_COMMENT);
+        write(SSE_CONNECTED_COMMENT);
         await promise;
     });
     // after the callback above has built `sse_stream`, which runs synchronously

package/dist/realtime/sse_constants.d.ts

@@ -14,4 +14,16 @@
  * SSE tests assert the stream emits this on connect.
  */
 export declare const SSE_CONNECTED_COMMENT = ": connected\n\n";
+/**
+ * The byte budget of what one SSE stream holds for its client to read
+ * (`realtime/sse.ts` module doc, "Outbound bound").
+ *
+ * 1 MiB — equal to the default cap on one request body
+ * (`DEFAULT_MAX_BODY_SIZE`). An audit row is bounded by the request that
+ * produced it, so on a server that keeps that default the budget holds a burst
+ * of ordinary rows or one at the largest. The value is fixed and does not
+ * follow the server's body limit. Same value as the Rust spine's
+ * `SSE_OUTBOUND_QUEUE_BYTES`.
+ */
+export declare const SSE_OUTBOUND_QUEUE_BYTES: number;
 //# sourceMappingURL=sse_constants.d.ts.map

package/dist/realtime/sse_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oBAAoB,CAAC"}
+{"version":3,"file":"sse_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,QAAc,CAAC"}

package/dist/realtime/sse_constants.js

@@ -14,3 +14,15 @@
  * SSE tests assert the stream emits this on connect.
  */
 export const SSE_CONNECTED_COMMENT = `: connected\n\n`;
+/**
+ * The byte budget of what one SSE stream holds for its client to read
+ * (`realtime/sse.ts` module doc, "Outbound bound").
+ *
+ * 1 MiB — equal to the default cap on one request body
+ * (`DEFAULT_MAX_BODY_SIZE`). An audit row is bounded by the request that
+ * produced it, so on a server that keeps that default the budget holds a burst
+ * of ordinary rows or one at the largest. The value is fixed and does not
+ * follow the server's body limit. Same value as the Rust spine's
+ * `SSE_OUTBOUND_QUEUE_BYTES`.
+ */
+export const SSE_OUTBOUND_QUEUE_BYTES = 1024 * 1024;

package/dist/server/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CAiD5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CAiD5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}

package/dist/server/app_server.js

@@ -9,7 +9,6 @@
  */
 import { Hono } from 'hono';
 import { logger } from 'hono/logger';
-import { bodyLimit } from 'hono/body-limit';
 import { z } from 'zod';
 import { session_cookie_options } from '../auth/session_cookie.js';
 import { create_audit_log_sse, create_sse_connection_closer, audit_log_event_specs } from '../realtime/sse_auth_guard.js';
@@ -29,7 +28,7 @@ import { flush_pending_effects, flush_post_commit_effects } from '../http/pendin
 import { assert_endpoint_in_auth_scope, assert_middleware_stack_mounted, create_auth_middleware_specs } from '../auth/middleware.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';
 import { create_fuz_authorization_handler } from '../auth/request_context.js';
-import { ERROR_PAYLOAD_TOO_LARGE } from '../http/error_schemas.js';
+import { create_body_limit_middleware } from '../http/body_limit.js';
 import { create_rpc_endpoint } from '../actions/action_rpc.js';
 import { register_ws_endpoint } from '../actions/register_ws_endpoint.js';
 import { resolve_ws_endpoints } from '../actions/ws_endpoint_spec.js';
@@ -483,10 +482,7 @@ const assemble_app_server = async (options, releases) => {
     // Default 1 MiB; pass null to disable.
     if (options.max_body_size !== null) {
         const max_size = options.max_body_size ?? DEFAULT_MAX_BODY_SIZE;
-        app.use(bodyLimit({
-            maxSize: max_size,
-            onError: (c) => c.json({ error: ERROR_PAYLOAD_TOO_LARGE }, 413)
-        }));
+        app.use(create_body_limit_middleware(max_size));
     }
     apply_middleware_specs(app, middleware_specs);
     const authorize = create_fuz_authorization_handler({ db: deps.db });
@@ -524,6 +520,7 @@ const assemble_app_server = async (options, releases) => {
                 // added below instead, so the remover is the server's
                 connection_closer: null,
                 max_connections_per_account: endpoint.max_connections_per_account,
+                outbound_queue_bytes: endpoint.outbound_queue_bytes,
                 heartbeat: endpoint.heartbeat,
                 artificial_delay: endpoint.artificial_delay,
                 max_message_bytes: endpoint.max_message_bytes,

package/dist/testing/CLAUDE.md

@@ -223,7 +223,7 @@ test-only by construction.
 
 ### `schema_introspect.ts` — `query_schema_snapshot`
 
-- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema, and impls organize migration namespaces differently. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
+- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema; twin impls keep it identical (same namespaces, names and partitioning), which `query_migration_tracker` + `assert_migration_trackers_equal` gate separately. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
 - `SchemaSnapshot` — the Zod schema is canonical (co-located in `schema_introspect.ts`; the cross-impl `_testing_schema_snapshot` RPC action reuses it as its wire validator, and the type is `z.infer`'d from it). Fully JSON-serializable; every collection deterministically sorted on capture so structural equality is stable across runs.
 - `query_migration_tracker(db)` / `MigrationTracker` — the migration-_identity_ twin of the snapshot: reads the `schema_version` tracker rows (`[{namespace, name, sequence}]`) the snapshot deliberately _excludes_. `MigrationTracker` is the `_testing_migration_tracker` RPC's wire validator; pairs with `assert_migration_trackers_equal` to gate that the two spines record byte-identical migration identity (the swap-freely invariant), catching a migration-name or namespace-partitioning drift the provenance-agnostic schema snapshot can't see.
 
@@ -235,7 +235,7 @@ test-only by construction.
 - `SchemaDiff` — tagged-union per drift kind: `table_only_in`, `column_only_in`, `column_field_differs`, `index_only_in`, `index_definition_differs`, `constraint_only_in`, `constraint_differs`, `sequence_only_in`, `sequence_data_type_differs`, `enum_only_in`, `enum_labels_differ` (enum labels compared positionally — declared order is significant).
 - `diff_migration_trackers(a, b)` / `format_migration_tracker_diffs(diffs, labels?)` / `assert_migration_trackers_equal(a, b, labels?)` — the migration-identity twins of the snapshot diff/format/assert, over two `MigrationTracker`s. `MigrationTrackerDiff` is keyed on `(namespace, name)` (the `schema_version` PK): `tracker_row_only_in` (a migration rename or namespace re-partition) and `tracker_sequence_differs` (a re-order).
 
-fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. The forge has its own deno↔rust parity gate.
+fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. Both legs run on PostgreSQL there: index definitions are compared as the engine renders them, and pglet (what `memory://` gives a TS backend) leaves sort direction, `NULLS` placement, operator classes and `NULLS NOT DISTINCT` out of `indexdef`, so a snapshot taken on it differs from a PostgreSQL one with identical DDL. The forge has its own deno↔rust parity gate.
 
 ## Cross-impl RPC-manifest parity
 
@@ -552,7 +552,7 @@ cover real sockets.
 
 Three layers:
 
-1. **Primitives** — `create_fake_ws()`, `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same. `create_stub_upgrade()` stands in for a runtime adapter's `upgradeWebSocket`: it passes a request without `Upgrade: websocket` to `next()`, and records an upgrade request — its real `Context` and the endpoint's events factory — in `upgrades`, answering `200`. So a test can send `app.request('/api/ws', {headers: {upgrade: 'websocket', cookie | authorization, origin, 'x-forwarded-for'}})` through an assembled app's whole middleware chain and build the socket's events from the `Context` that chain produced (`src/test/server/create_app_server_ws_endpoints.dispatch.db.test.ts`); `get_create_events()` still returns the last mounted factory, for a hand-built context.
+1. **Primitives** — `create_fake_ws(options?)` (a real `WSContext` over capture arrays `sends` / `closes`, plus `socket` — the fake runtime socket behind `ws.raw`, shaped like Node's `ws`: a `bufferedAmount` the transport's outbound writer reads for backpressure, `stalled` (start it with `{stalled: true}`) to model a client that stopped reading, and `terminate` / `terminated` for the frameless cut; `readyState` reads open until closed or terminated), `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same. `create_stub_upgrade()` stands in for a runtime adapter's `upgradeWebSocket`: it passes a request without `Upgrade: websocket` to `next()`, and records an upgrade request — its real `Context` and the endpoint's events factory — in `upgrades`, answering `200`. So a test can send `app.request('/api/ws', {headers: {upgrade: 'websocket', cookie | authorization, origin, 'x-forwarded-for'}})` through an assembled app's whole middleware chain and build the socket's events from the `Context` that chain produced (`src/test/server/create_app_server_ws_endpoints.dispatch.db.test.ts`); `get_create_events()` still returns the last mounted factory, for a hand-built context.
 2. **Harness** — `create_ws_test_harness({actions, transport?, heartbeat?, log?, on_socket_open?, on_socket_close?})` → `WsTestHarness`. `connect(identity?)` is async and resolves after the connection is admitted and `on_socket_open` completes, so broadcasts sent immediately after `await harness.connect()` reach the client. The harness pre-bakes its `RequestContext` (`TEST_CONTEXT_PRESET_KEY`), which also skips the admission credential re-read — there are no session or token rows behind a harness identity — so tests of the re-read itself drive `register_action_ws` with a real database and no preset (`src/test/actions/register_action_ws.admission.db.test.ts`). The harness threads its own `create_stub_db()` into the dispatcher's `db` slot so handlers declaring `side_effects: true` execute under the same transaction wrap they would in production (the stub's `transaction(fn)` synchronously calls `fn(stub_db)`); domain deps reach handlers via factory closures, the same way HTTP RPC factories already wire them. Audit fan-out runs through whatever `audit` emitter the consumer supplied to its action factory closure (typically `create_test_audit_emitter()` for unit harnesses).
 3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts).
 
@@ -971,10 +971,13 @@ source of truth for wire-shape conformance.
   case — `GET /api/account/status` is bundled into `create_account_route_specs`,
   so every spine serves it (`true`); the gate fails loud if a declaring backend
   doesn't mount it (replacing the old runtime 404-sniff-skip).
-  `oversized_reject_closes_connection` gates the strong half of the body-size
-  smuggling probe (`true` Node/Deno/Rust — they close on an oversized reject;
-  `false` Bun — `Bun.serve` drains + keepalives but frames correctly, so the
-  suite's no-desync half still runs).
+  `oversized_reject_closes_connection` picks the arm of the body-size
+  smuggling probe (`true` Node/Deno/Rust — the connection closes after an
+  oversized-body 413, at once on Node and once the declared body has arrived
+  on Deno, so the pipelined request goes unanswered; `false` Bun —
+  `Bun.serve` keeps the connection and serves the next request, correctly
+  framed, so the suite requires no desync there instead: exactly the 413 and
+  the reply to the pipelined request, which a backend that closes fails).
   `ws_handshake_pipelining` gates the WS round-trip suite's
   frames-with-the-handshake case (`true` Node/Deno/Rust — frames written in the
   same TCP write as the upgrade request reach the socket; `false` Bun, whose
@@ -1218,6 +1221,36 @@ ws_path})`. The wire literals are independent copies of the producers'
 constants, so a value changed on one spine fails here. Cross-process only;
 fuz_app's own wiring is `src/test/cross_backend/ws_inbound_dispatch.cross.test.ts`.
 
+### `cross_backend/ws_outbound_overflow.ts` — `describe_ws_outbound_overflow_cross_tests`
+
+Real-upgrade parity for the **per-connection outbound bound** — the byte
+budget both spines hold a WebSocket's waiting frames to
+(`BackendWebsocketTransport`'s `outbound_queue_bytes`, the Rust `fuz_realtime`
+outbound queue; same default, same per-frame charge). The close code and its
+reason are wire contract — a client reads `WS_CLOSE_OUTBOUND_OVERFLOW` as "you
+fell behind, reconnect" — so this is the pin that runs on both.
+`describe_ws_outbound_overflow_cross_tests({setup_test, capabilities, base_url,
+ws_path, origin?, rpc_path?})` drives `_testing_flood_notifications`, which
+queues a burst onto the caller's own connection in one synchronous run, so the
+burst waits at once whether or not the client reads and the overflow is
+deterministic. Cases: a burst within the budget arrives whole and in order
+ahead of its response, the socket left open — a small one, and one of a few
+mebibytes in megabyte frames, most of the default budget, which waits on the backend's write pump where megabyte frames outrun the socket's buffer (Deno; Node and Bun write the burst through); a burst far past it closes the
+socket with the code and the exact reason, no response for the flooding request
+arrives, and any flood frames that did arrive are a contiguous prefix of the
+burst — while a second connection on the same account keeps dispatching; a
+burst past the action's own size limit is refused `invalid_params` with the
+socket left open; and, with `rpc_path`, the action over HTTP refuses
+`invalid_params` with reason `no_connection`. Not asserted, because each
+implementation decides them: how many frames accepted before the overflow
+reach the client, and the boundary a burst of tiny frames overflows at. The
+flood action is daemon-token-gated, so the flooding socket upgrades with the
+daemon token and no `Origin` (`create_ws_transport`'s `origin: null`). The wire
+literals are independent copies of the producers' constants. Gated on
+`capabilities.ws`; cross-process only, and only for a backend that mounts the
+flood action on its WS endpoint. fuz_app's own wiring is
+`src/test/cross_backend/ws_outbound_overflow.cross.test.ts`.
+
 ### `cross_backend/ws_connection_cap.ts` — `describe_ws_connection_cap_cross_tests`
 
 Real-upgrade parity for the **per-account WebSocket connection cap** — the
@@ -1408,7 +1441,7 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   request (`{result}` / `{error}` / `undefined` to swallow), the path
   `describe_peer_ping_ws_tests` drives. With no `on_request` the seam is inert
   (a server-initiated request flows to `messages` as before).
-- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?, headers?})`
+- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?, headers?})` (`origin: null` sends no `Origin`, which a daemon-token upgrade needs)
   builds a real-upgrade WS client using the `ws` npm package (optional
   peerDep; consumers wiring cross-process tests `npm install --save-dev ws`).
   Threads the keeper cookie onto the upgrade so per-action auth succeeds on
@@ -1496,6 +1529,17 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   emitter, so the shared suite body can call the barrier on every backend
   uniformly.
 
+  Also bundled: `_testing_flood_notifications`
+  (`create_testing_flood_notifications_action()`) — queues `count`
+  notifications of `size` payload bytes each (method `_testing_flood`, params
+  `{index, payload}`) onto the caller's own WebSocket connection in one
+  synchronous run and answers `{queued: count}`, so a suite can push a
+  connection's outbound queue past its byte budget from outside. Refused with
+  `invalid_params` past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+  `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`), and over HTTP (reason
+  `no_connection` — there is no connection to queue onto). The Rust mirror is
+  `fuz_testing::create_testing_flood_notifications_action_spec`.
+
   Also bundled: `_testing_mint_session` — mints a backdated-expiry
   `auth_session` row for an account (via `mint_test_session` in `app_server.ts`)
   and returns its signed cookie value (future-dated payload). Backs the
@@ -1601,6 +1645,22 @@ module's own tests (`account_status.test.ts`, `action_rpc.test.ts`,
 `serve_fact_route.db.test.ts`); fuz_app's own wiring is
 `cross_backend/query_shape.cross.test.ts`.
 
+### Grant-verb role grammar parity — `cross_backend/role_grant_role_grammar.ts`
+
+`describe_role_grant_role_grammar_cross_tests({setup_test, rpc_path?})` — an
+off-grammar `role` (uppercase, hyphen, digit, leading or trailing underscore,
+space, empty, or all lowercase and one character past the length cap) on `role_grant_assign` and `role_grant_offer_create` answers
+`invalid_params` with no `data.reason`, and after the refusals no
+`role_grant_create` / `role_grant_offer_create` audit row carries one of those
+strings. The control — an on-grammar role no registry holds, refused past
+validation with `role_not_web_grantable` — keeps the audit read from being
+vacuous, and the same refusal for a role exactly at the length cap pins that
+boundary. Exists because the action-manifest parity gate captures no param
+schemas while the Rust spine parses params by hand, and the grant verbs write
+the role they refuse into their failure rows. Ungated; cross-process only (it
+reads the audit log behind `_testing_drain_effects`). fuz_app's own wiring is
+`src/test/cross_backend/role_grant_role_grammar.cross.test.ts`.
+
 ### API-token lifetime parity — `cross_backend/token_lifetime.ts`
 
 `describe_token_lifetime_cross_tests({setup_test, rpc_path?})` — the
@@ -1645,8 +1705,8 @@ drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 
 `describe_testing_backdoor_cross_tests({setup_test, rpc_path?, ws?})` —
 the negative-credential parity suite for the `_testing_*` backdoor actions.
-For each `_testing_*` action except `_testing_drain_effects` (the three
-privileged writes plus the three introspection reads) it fires three principals over real HTTP: **anonymous** →
+For each `_testing_*` action except `_testing_drain_effects` (the privileged
+writes, the connection flood, and the introspection reads) it fires three principals over real HTTP: **anonymous** →
 401 `unauthenticated`, **session** → 403 `forbidden` `credential_type_required`,
 **bearer** → 403 `forbidden` `credential_type_required` — and, when `ws`
 (`{base_url, ws_path, origin?}`) is passed, sends each on a socket opened with

package/dist/testing/admin_integration.js

@@ -5,7 +5,7 @@ import './assert_dev_env.js';
  * `describe_standard_admin_integration_tests` creates a composable test suite
  * that exercises admin account listing, role_grant grant/revoke (via the RPC
  * surface — see `role_grant_offer_create` / `role_grant_revoke`), session/token
- * management, and audit log routes against a real PGlite database.
+ * management, and audit log routes against a real database.
  *
  * Consumers call it with their route factory, session config, role schema,
  * and RPC endpoint specs — all admin route tests come for free.

package/dist/testing/audit_completeness.d.ts

@@ -34,7 +34,7 @@ export interface AuditCompletenessTestOptions {
  * Composable audit log completeness test suite.
  *
  * Verifies that every auth mutation route produces the correct audit log
- * event type. Exercises routes via HTTP requests against a real PGlite
+ * event type. Exercises routes via HTTP requests against a real
  * database, then reads events back through the `audit_log_list` RPC
  * (the production observation path the admin UI consumes).
  *

package/dist/testing/audit_completeness.js

@@ -96,7 +96,7 @@ const json_session_headers = (fixture, extra) => fixture.create_session_headers(
  * Composable audit log completeness test suite.
  *
  * Verifies that every auth mutation route produces the correct audit log
- * event type. Exercises routes via HTTP requests against a real PGlite
+ * event type. Exercises routes via HTTP requests against a real
  * database, then reads events back through the `audit_log_list` RPC
  * (the production observation path the admin UI consumes).
  *

package/dist/testing/audit_drift_guard.d.ts

@@ -36,7 +36,7 @@ export interface RecordingAuditEmitter {
  * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
  * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
  * capture audit metadata shapes in unit tests (e.g. password change failure
- * outcome, role-grant create denial) without standing up the full PGlite +
+ * outcome, role-grant create denial) without standing up a database and the
  * `query_audit_log` pipeline.
  *
  * **Capture scope — all four production fan-out shapes.**

package/dist/testing/audit_drift_guard.js

@@ -34,7 +34,7 @@ export const install_audit_drift_guard = () => {
  * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
  * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
  * capture audit metadata shapes in unit tests (e.g. password change failure
- * outcome, role-grant create denial) without standing up the full PGlite +
+ * outcome, role-grant create denial) without standing up a database and the
  * `query_audit_log` pipeline.
  *
  * **Capture scope — all four production fan-out shapes.**

package/dist/testing/cross_backend/body_size_smuggling.d.ts

@@ -6,15 +6,15 @@ export interface BodySizeSmugglingCrossTestOptions {
     /** RPC endpoint path to target. Default `/api/rpc`. */
     readonly rpc_path?: string;
     /**
-     * Whether the backend closes the connection on an oversized-body reject
-     * without reading the body (`capabilities.oversized_reject_closes_connection`).
-     * `true` (default) demands the strong posture — the pipelined GET is never
-     * reached, so **at most one** response comes back. `false` (Bun) relaxes to
-     * the no-desync property: the body is drained on `Content-Length` and the
-     * pipelined GET is framed correctly, so **at most two** responses come back
-     * and the body bytes are never reparsed as a request. Default `true` so a
-     * consumer that forgets to declare the flag fails loud rather than silently
-     * accepting a drain.
+     * Whether the backend closes the connection after an oversized-body `413`
+     * (`capabilities.oversized_reject_closes_connection`). `true` (default)
+     * requires that the pipelined GET goes unanswered — at most one response.
+     * `false` (Bun) requires no desync instead: exactly two well-formed
+     * responses, the 413 and one matching what the backend answers that GET
+     * sent alone — so `rpc_path` must answer a bare `GET` with a stable status
+     * and body, and a backend that closes after the 413 fails. Default `true`
+     * so a consumer that leaves the flag out fails loud on a backend that
+     * keeps the connection.
      */
     readonly closes_connection?: boolean;
 }

package/dist/testing/cross_backend/body_size_smuggling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAqDD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAiFF,CAAC"}
+{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAkGD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA0GF,CAAC"}