@fuzdev/fuz_app 0.134.0 → 0.136.0

package/dist/server/app_server.js

@@ -9,7 +9,6 @@
  */
 import { Hono } from 'hono';
 import { logger } from 'hono/logger';
-import { bodyLimit } from 'hono/body-limit';
 import { z } from 'zod';
 import { session_cookie_options } from '../auth/session_cookie.js';
 import { create_audit_log_sse, create_sse_connection_closer, audit_log_event_specs } from '../realtime/sse_auth_guard.js';
@@ -29,7 +28,7 @@ import { flush_pending_effects, flush_post_commit_effects } from '../http/pendin
 import { assert_endpoint_in_auth_scope, assert_middleware_stack_mounted, create_auth_middleware_specs } from '../auth/middleware.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';
 import { create_fuz_authorization_handler } from '../auth/request_context.js';
-import { ERROR_PAYLOAD_TOO_LARGE } from '../http/error_schemas.js';
+import { create_body_limit_middleware } from '../http/body_limit.js';
 import { create_rpc_endpoint } from '../actions/action_rpc.js';
 import { register_ws_endpoint } from '../actions/register_ws_endpoint.js';
 import { resolve_ws_endpoints } from '../actions/ws_endpoint_spec.js';
@@ -483,10 +482,7 @@ const assemble_app_server = async (options, releases) => {
     // Default 1 MiB; pass null to disable.
     if (options.max_body_size !== null) {
         const max_size = options.max_body_size ?? DEFAULT_MAX_BODY_SIZE;
-        app.use(bodyLimit({
-            maxSize: max_size,
-            onError: (c) => c.json({ error: ERROR_PAYLOAD_TOO_LARGE }, 413)
-        }));
+        app.use(create_body_limit_middleware(max_size));
     }
     apply_middleware_specs(app, middleware_specs);
     const authorize = create_fuz_authorization_handler({ db: deps.db });
@@ -524,6 +520,7 @@ const assemble_app_server = async (options, releases) => {
                 // added below instead, so the remover is the server's
                 connection_closer: null,
                 max_connections_per_account: endpoint.max_connections_per_account,
+                outbound_queue_bytes: endpoint.outbound_queue_bytes,
                 heartbeat: endpoint.heartbeat,
                 artificial_delay: endpoint.artificial_delay,
                 max_message_bytes: endpoint.max_message_bytes,

package/dist/testing/CLAUDE.md

@@ -99,7 +99,8 @@ mismatch.
 
 ### `audit_drift_guard.ts` — audit-emission validation
 
-- `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts`. Call once at the top of any `describe_db` block firing audit emits — production validation is fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field is silent. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
+- `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks the `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts` and the emitter's write-failure counter (`get_audit_write_failures` in `auth/audit_emitter.ts`). Call once at the top of any `describe_db` block firing audit emits — production validation and the emitter's write are fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field, or losing a row the database refused, is silent. A test that fails a write on purpose resets the counter (`reset_audit_write_failures`) once it has asserted it.
+- `assert_no_audit_drift()` — the zero-check itself, for a test that manages the counters. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
 - `create_recording_audit_emitter(calls_ref?)` — no-op `AuditEmitter` pushing every `emit` and `emit_pool` call into `calls`. Pass `calls_ref` to write into a caller-owned array; omit to let the helper allocate. Returns `{emitter, calls}` — destructure `emitter` as the `audit` dep and read `calls` to assert. `add_listener` records (never fires) and returns a remover with the production semantics, so `listener_count` tracks what a server registered and released. Replaces per-file capturing emitters previously duplicated across `password_change.test.ts`, `audit_log.test.ts`, etc.
 - `RecordingAuditEmitter` — `{emitter: AuditEmitter; calls: Array<AuditLogInput>}`.
 
@@ -223,7 +224,7 @@ test-only by construction.
 
 ### `schema_introspect.ts` — `query_schema_snapshot`
 
-- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema, and impls organize migration namespaces differently. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
+- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Throws on pglet when the snapshot holds an index, unless `accept_pglet_index_definitions` is passed: pglet's `indexdef` omits index modifiers, so its index definitions read as false differences against PostgreSQL and false agreement between two pglet schemas. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema; twin impls keep it identical (same namespaces, names and partitioning), which `query_migration_tracker` + `assert_migration_trackers_equal` gate separately. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
 - `SchemaSnapshot` — the Zod schema is canonical (co-located in `schema_introspect.ts`; the cross-impl `_testing_schema_snapshot` RPC action reuses it as its wire validator, and the type is `z.infer`'d from it). Fully JSON-serializable; every collection deterministically sorted on capture so structural equality is stable across runs.
 - `query_migration_tracker(db)` / `MigrationTracker` — the migration-_identity_ twin of the snapshot: reads the `schema_version` tracker rows (`[{namespace, name, sequence}]`) the snapshot deliberately _excludes_. `MigrationTracker` is the `_testing_migration_tracker` RPC's wire validator; pairs with `assert_migration_trackers_equal` to gate that the two spines record byte-identical migration identity (the swap-freely invariant), catching a migration-name or namespace-partitioning drift the provenance-agnostic schema snapshot can't see.
 
@@ -235,7 +236,7 @@ test-only by construction.
 - `SchemaDiff` — tagged-union per drift kind: `table_only_in`, `column_only_in`, `column_field_differs`, `index_only_in`, `index_definition_differs`, `constraint_only_in`, `constraint_differs`, `sequence_only_in`, `sequence_data_type_differs`, `enum_only_in`, `enum_labels_differ` (enum labels compared positionally — declared order is significant).
 - `diff_migration_trackers(a, b)` / `format_migration_tracker_diffs(diffs, labels?)` / `assert_migration_trackers_equal(a, b, labels?)` — the migration-identity twins of the snapshot diff/format/assert, over two `MigrationTracker`s. `MigrationTrackerDiff` is keyed on `(namespace, name)` (the `schema_version` PK): `tracker_row_only_in` (a migration rename or namespace re-partition) and `tracker_sequence_differs` (a re-order).
 
-fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. The forge has its own deno↔rust parity gate.
+fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. Both legs run on PostgreSQL there: index definitions are compared as the engine renders them, and pglet (what `memory://` gives a TS backend) leaves sort direction, `NULLS` placement, operator classes and `NULLS NOT DISTINCT` out of `indexdef`, so a snapshot taken on it differs from a PostgreSQL one with identical DDL. The forge has its own deno↔rust parity gate.
 
 ## Cross-impl RPC-manifest parity
 
@@ -552,7 +553,7 @@ cover real sockets.
 
 Three layers:
 
-1. **Primitives** — `create_fake_ws()`, `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same. `create_stub_upgrade()` stands in for a runtime adapter's `upgradeWebSocket`: it passes a request without `Upgrade: websocket` to `next()`, and records an upgrade request — its real `Context` and the endpoint's events factory — in `upgrades`, answering `200`. So a test can send `app.request('/api/ws', {headers: {upgrade: 'websocket', cookie | authorization, origin, 'x-forwarded-for'}})` through an assembled app's whole middleware chain and build the socket's events from the `Context` that chain produced (`src/test/server/create_app_server_ws_endpoints.dispatch.db.test.ts`); `get_create_events()` still returns the last mounted factory, for a hand-built context.
+1. **Primitives** — `create_fake_ws(options?)` (a real `WSContext` over capture arrays `sends` / `closes`, plus `socket` — the fake runtime socket behind `ws.raw`, shaped like Node's `ws`: a `bufferedAmount` the transport's outbound writer reads for backpressure, `stalled` (start it with `{stalled: true}`) to model a client that stopped reading, and `terminate` / `terminated` for the frameless cut; `readyState` reads open until closed or terminated), `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same. `create_stub_upgrade()` stands in for a runtime adapter's `upgradeWebSocket`: it passes a request without `Upgrade: websocket` to `next()`, and records an upgrade request — its real `Context` and the endpoint's events factory — in `upgrades`, answering `200`. So a test can send `app.request('/api/ws', {headers: {upgrade: 'websocket', cookie | authorization, origin, 'x-forwarded-for'}})` through an assembled app's whole middleware chain and build the socket's events from the `Context` that chain produced (`src/test/server/create_app_server_ws_endpoints.dispatch.db.test.ts`); `get_create_events()` still returns the last mounted factory, for a hand-built context.
 2. **Harness** — `create_ws_test_harness({actions, transport?, heartbeat?, log?, on_socket_open?, on_socket_close?})` → `WsTestHarness`. `connect(identity?)` is async and resolves after the connection is admitted and `on_socket_open` completes, so broadcasts sent immediately after `await harness.connect()` reach the client. The harness pre-bakes its `RequestContext` (`TEST_CONTEXT_PRESET_KEY`), which also skips the admission credential re-read — there are no session or token rows behind a harness identity — so tests of the re-read itself drive `register_action_ws` with a real database and no preset (`src/test/actions/register_action_ws.admission.db.test.ts`). The harness threads its own `create_stub_db()` into the dispatcher's `db` slot so handlers declaring `side_effects: true` execute under the same transaction wrap they would in production (the stub's `transaction(fn)` synchronously calls `fn(stub_db)`); domain deps reach handlers via factory closures, the same way HTTP RPC factories already wire them. Audit fan-out runs through whatever `audit` emitter the consumer supplied to its action factory closure (typically `create_test_audit_emitter()` for unit harnesses).
 3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts).
 
@@ -927,7 +928,7 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
-  `account_status` / `oversized_reject_closes_connection` / `peer_request` /
+  `account_status` / `peer_request` /
   `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` —
   each has a `test_if`
   reader (`ws_self_revocation_reply` forks one case's assertion instead); `peer_request` (server-initiated requests — the ActionPeer
@@ -971,15 +972,17 @@ source of truth for wire-shape conformance.
   case — `GET /api/account/status` is bundled into `create_account_route_specs`,
   so every spine serves it (`true`); the gate fails loud if a declaring backend
   doesn't mount it (replacing the old runtime 404-sniff-skip).
-  `oversized_reject_closes_connection` gates the strong half of the body-size
-  smuggling probe (`true` Node/Deno/Rust — they close on an oversized reject;
-  `false` Bun — `Bun.serve` drains + keepalives but frames correctly, so the
-  suite's no-desync half still runs).
+  No flag covers the body-size smuggling probe: every backend closes the
+  connection after an oversized-body 413 (at once on Node, Bun and the Rust
+  spine, once the declared body has arrived on Deno), so the pipelined request
+  goes unanswered. Bun 1.4.3 is the tested floor — an older Bun kept the
+  connection and served the next request, correctly framed, and fails the probe.
   `ws_handshake_pipelining` gates the WS round-trip suite's
   frames-with-the-handshake case (`true` Node/Deno/Rust — frames written in the
-  same TCP write as the upgrade request reach the socket; `false` Bun, whose
-  HTTP parser answers such a request `400`, and `false` in-process, where there
-  is no socket to write raw bytes to).
+  same TCP write as the upgrade request reach the socket; `false` Bun, which
+  answers such a request `400` when the upgrade follows an asynchronous check,
+  as it does behind auth, and `false` in-process, where there is no socket to
+  write raw bytes to).
   `ws_account_actions` (the WS endpoint mounts the account actions — `true` on
   fuz_app's own spine presets, `false` in the family defaults) gates the WS
   round-trip suite's self-revocation case and, with `rpc_path`, its
@@ -1218,6 +1221,36 @@ ws_path})`. The wire literals are independent copies of the producers'
 constants, so a value changed on one spine fails here. Cross-process only;
 fuz_app's own wiring is `src/test/cross_backend/ws_inbound_dispatch.cross.test.ts`.
 
+### `cross_backend/ws_outbound_overflow.ts` — `describe_ws_outbound_overflow_cross_tests`
+
+Real-upgrade parity for the **per-connection outbound bound** — the byte
+budget both spines hold a WebSocket's waiting frames to
+(`BackendWebsocketTransport`'s `outbound_queue_bytes`, the Rust `fuz_realtime`
+outbound queue; same default, same per-frame charge). The close code and its
+reason are wire contract — a client reads `WS_CLOSE_OUTBOUND_OVERFLOW` as "you
+fell behind, reconnect" — so this is the pin that runs on both.
+`describe_ws_outbound_overflow_cross_tests({setup_test, capabilities, base_url,
+ws_path, origin?, rpc_path?})` drives `_testing_flood_notifications`, which
+queues a burst onto the caller's own connection in one synchronous run, so the
+burst waits at once whether or not the client reads and the overflow is
+deterministic. Cases: a burst within the budget arrives whole and in order
+ahead of its response, the socket left open — a small one, and one of a few
+mebibytes in megabyte frames, most of the default budget, which waits on the backend's write pump where megabyte frames outrun the socket's buffer (Deno; Node and Bun write the burst through); a burst far past it closes the
+socket with the code and the exact reason, no response for the flooding request
+arrives, and any flood frames that did arrive are a contiguous prefix of the
+burst — while a second connection on the same account keeps dispatching; a
+burst past the action's own size limit is refused `invalid_params` with the
+socket left open; and, with `rpc_path`, the action over HTTP refuses
+`invalid_params` with reason `no_connection`. Not asserted, because each
+implementation decides them: how many frames accepted before the overflow
+reach the client, and the boundary a burst of tiny frames overflows at. The
+flood action is daemon-token-gated, so the flooding socket upgrades with the
+daemon token and no `Origin` (`create_ws_transport`'s `origin: null`). The wire
+literals are independent copies of the producers' constants. Gated on
+`capabilities.ws`; cross-process only, and only for a backend that mounts the
+flood action on its WS endpoint. fuz_app's own wiring is
+`src/test/cross_backend/ws_outbound_overflow.cross.test.ts`.
+
 ### `cross_backend/ws_connection_cap.ts` — `describe_ws_connection_cap_cross_tests`
 
 Real-upgrade parity for the **per-account WebSocket connection cap** — the
@@ -1312,7 +1345,7 @@ an audit row, an admin account listing, and an offer's `created_at` /
 `expires_at`. `cross_backend/setup.ts` carries the four bases every
 imperative cross suite aliases: `CrossSuiteOptions` (`setup_test` alone),
 `CapabilityGatedCrossSuiteOptions` (+ `capabilities` — `ready`),
-`RpcPathCrossSuiteOptions` (+ `rpc_path?` — origin, body-size, actor
+`RpcPathCrossSuiteOptions` (+ `rpc_path?` — origin, body-size (which adds `base_url`), actor
 lookup/search, app settings, testing backdoor), and the intersection
 `RpcPathCapabilityGatedCrossSuiteOptions` (every `cell_*` suite, query-shape,
 token-scope surface, fact-serving, account lifecycle). A suite takes the
@@ -1325,7 +1358,8 @@ the option type states whether the bundle is read.
   edit/read/delete → 404 IDOR mask; admin reaches any; dup active `path` → 409;
   `path` write by non-admin → 403 on create + update; `cell_get` with no
   id/path → `invalid_params`; null-auth `cell_list` `created_by` →
-  `invalid_params`).
+  `invalid_params`; a `kind` at `CELL_KIND_LENGTH_MAX` stored whole, one
+  UTF-16 code unit past it → `invalid_params` on create and as a list filter).
 - **`describe_cell_relations_cross_tests`** (gates on
   `capabilities.cell_relations`) — the verbs beyond CRUD: grant lifecycle
   (actor-shaped editor grant enables edit, manage-tier `cell_grant_list`,
@@ -1408,7 +1442,7 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   request (`{result}` / `{error}` / `undefined` to swallow), the path
   `describe_peer_ping_ws_tests` drives. With no `on_request` the seam is inert
   (a server-initiated request flows to `messages` as before).
-- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?, headers?})`
+- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?, headers?})` (`origin: null` sends no `Origin`, which a daemon-token upgrade needs)
   builds a real-upgrade WS client using the `ws` npm package (optional
   peerDep; consumers wiring cross-process tests `npm install --save-dev ws`).
   Threads the keeper cookie onto the upgrade so per-action auth succeeds on
@@ -1430,6 +1464,21 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   write as the upgrade request, so before the connection can have been
   admitted). Small unfragmented text frames only. Helpers `is_raw_ws_close`,
   `raw_ws_close_code`, `RAW_WS_OPCODE_TEXT` / `_CLOSE`.
+- `testing/transports/raw_http.ts` — `raw_http_exchange(base_url, request_bytes, {read_timeout_ms, until?})`
+  → `RawHttpExchange` (`{received, closed_by_server}`): writes caller-built
+  HTTP/1.1 bytes to a raw `node:net` socket once and reads what the server
+  sends until it closes (`until: 'close'`, the default), until one whole
+  response has arrived (`until: 'response'` — for a server that answers and
+  keeps the connection), or until the read timeout. For what `fetch` can't
+  send: two requests in one write, duplicate or malformed headers, a request
+  head whose body never follows, an unterminated chunked body. Write errors are
+  swallowed, and a write error ends the socket — so a caller that must read a
+  refusal reliably sends nothing the server will leave unread. Helpers
+  `raw_http_parse_response` (the first response, `null` until its head and
+  framed body are whole), `raw_http_count_responses` (unanchored status-line
+  count, so a response concatenated after a body is seen),
+  `raw_http_first_status`. Shared by the body-size, body-size smuggling, and
+  credential-header suites.
 - `testing/transports/sse_frame_reader.ts` — `create_sse_frame_reader(reader, default_timeout_ms?)`,
   the transport-agnostic SSE framing core over a
   `ReadableStreamDefaultReader<Uint8Array>`: `\n\n` framing, per-read timeout,
@@ -1496,6 +1545,17 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   emitter, so the shared suite body can call the barrier on every backend
   uniformly.
 
+  Also bundled: `_testing_flood_notifications`
+  (`create_testing_flood_notifications_action()`) — queues `count`
+  notifications of `size` payload bytes each (method `_testing_flood`, params
+  `{index, payload}`) onto the caller's own WebSocket connection in one
+  synchronous run and answers `{queued: count}`, so a suite can push a
+  connection's outbound queue past its byte budget from outside. Refused with
+  `invalid_params` past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+  `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`), and over HTTP (reason
+  `no_connection` — there is no connection to queue onto). The Rust mirror is
+  `fuz_testing::create_testing_flood_notifications_action_spec`.
+
   Also bundled: `_testing_mint_session` — mints a backdated-expiry
   `auth_session` row for an account (via `mint_test_session` in `app_server.ts`)
   and returns its signed cookie value (future-dated payload). Backs the
@@ -1601,14 +1661,31 @@ module's own tests (`account_status.test.ts`, `action_rpc.test.ts`,
 `serve_fact_route.db.test.ts`); fuz_app's own wiring is
 `cross_backend/query_shape.cross.test.ts`.
 
+### Grant-verb role grammar parity — `cross_backend/role_grant_role_grammar.ts`
+
+`describe_role_grant_role_grammar_cross_tests({setup_test, rpc_path?})` — an
+off-grammar `role` (uppercase, hyphen, digit, leading or trailing underscore,
+space, empty, or all lowercase and one character past the length cap) on `role_grant_assign` and `role_grant_offer_create` answers
+`invalid_params` with no `data.reason`, and after the refusals no
+`role_grant_create` / `role_grant_offer_create` audit row carries one of those
+strings. The control — an on-grammar role no registry holds, refused past
+validation with `role_not_web_grantable` — keeps the audit read from being
+vacuous, and the same refusal for a role exactly at the length cap pins that
+boundary. Exists because the action-manifest parity gate captures no param
+schemas while the Rust spine parses params by hand, and the grant verbs write
+the role they refuse into their failure rows. Ungated; cross-process only (it
+reads the audit log behind `_testing_drain_effects`). fuz_app's own wiring is
+`src/test/cross_backend/role_grant_role_grammar.cross.test.ts`.
+
 ### API-token lifetime parity — `cross_backend/token_lifetime.ts`
 
 `describe_token_lifetime_cross_tests({setup_test, rpc_path?})` — the
 imperative round-trip on `account_token_create`'s required `lifetime` union:
 a `{kind:'ttl', days}` mint returns and stores a bounded `expires_at`
 (create output + `account_token_list` read-back), `{kind:'eternal'}` stores
-NULL, and an omitted or out-of-range lifetime 400s identically on both
-spines. Exists because the action-manifest parity gate captures no param
+NULL, an omitted or out-of-range lifetime 400s identically on both
+spines, and a `name` at `API_TOKEN_NAME_LENGTH_MAX` mints and reads back whole
+while one UTF-16 code unit past it is `invalid_params`. Exists because the action-manifest parity gate captures no param
 schemas while the Rust spine hand-parses params — a spine that silently
 dropped the field would answer the same mint with a 200 and an eternal
 token; only the stored-state read-back catches it. Ungated (mint + list are
@@ -1645,8 +1722,8 @@ drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 
 `describe_testing_backdoor_cross_tests({setup_test, rpc_path?, ws?})` —
 the negative-credential parity suite for the `_testing_*` backdoor actions.
-For each `_testing_*` action except `_testing_drain_effects` (the three
-privileged writes plus the three introspection reads) it fires three principals over real HTTP: **anonymous** →
+For each `_testing_*` action (the privileged writes, the audit barrier, the
+connection flood, and the introspection reads) it fires three principals over real HTTP: **anonymous** →
 401 `unauthenticated`, **session** → 403 `forbidden` `credential_type_required`,
 **bearer** → 403 `forbidden` `credential_type_required` — and, when `ws`
 (`{base_url, ws_path, origin?}`) is passed, sends each on a socket opened with

package/dist/testing/admin_integration.js

@@ -5,7 +5,7 @@ import './assert_dev_env.js';
  * `describe_standard_admin_integration_tests` creates a composable test suite
  * that exercises admin account listing, role_grant grant/revoke (via the RPC
  * surface — see `role_grant_offer_create` / `role_grant_revoke`), session/token
- * management, and audit log routes against a real PGlite database.
+ * management, and audit log routes against a real database.
  *
  * Consumers call it with their route factory, session config, role schema,
  * and RPC endpoint specs — all admin route tests come for free.

package/dist/testing/audit_completeness.d.ts

@@ -34,7 +34,7 @@ export interface AuditCompletenessTestOptions {
  * Composable audit log completeness test suite.
  *
  * Verifies that every auth mutation route produces the correct audit log
- * event type. Exercises routes via HTTP requests against a real PGlite
+ * event type. Exercises routes via HTTP requests against a real
  * database, then reads events back through the `audit_log_list` RPC
  * (the production observation path the admin UI consumes).
  *

package/dist/testing/audit_completeness.js

@@ -96,7 +96,7 @@ const json_session_headers = (fixture, extra) => fixture.create_session_headers(
  * Composable audit log completeness test suite.
  *
  * Verifies that every auth mutation route produces the correct audit log
- * event type. Exercises routes via HTTP requests against a real PGlite
+ * event type. Exercises routes via HTTP requests against a real
  * database, then reads events back through the `audit_log_list` RPC
  * (the production observation path the admin UI consumes).
  *

package/dist/testing/audit_drift_guard.d.ts

@@ -1,26 +1,39 @@
 import './assert_dev_env.js';
-import type { AuditEmitter } from '../auth/audit_emitter.js';
+import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { AuditLogInput } from '../auth/audit_log_schema.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
- * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ * entry, an `event_type` not present in the active `AuditLogConfig`, or a
+ * row the emitter failed to write.
  *
  * The production validation in `query_audit_log` is fail-open — it bumps
  * process-wide counters and proceeds, so a regression that emits an
  * undeclared metadata field or a typo'd event-type lands a row that
- * passes downstream queries but breaks forensics. Tests that exercise
- * audit emits should fail loudly when this happens.
+ * passes downstream queries but breaks forensics. The emitter's pool write
+ * is fail-open too: a refused `INSERT` is logged and counted, the request
+ * succeeds, and the row is gone. Tests that exercise audit emits should fail
+ * loudly when either happens.
  *
  * Call at the top of every `describe` / `describe_db` block that fires
  * audit writes through `deps.audit.emit`. Resets counters before each
- * test and asserts zero on completion.
+ * test and asserts zero on completion. A test that makes a write fail on
+ * purpose calls `reset_audit_write_failures` (`auth/audit_emitter.ts`) once
+ * it has asserted the count.
  *
  * Pair with `await_pending_effects: true` (the default for
  * `create_test_app`) so fire-and-forget audit writes have completed by
  * the time the after-each check observes counter state.
  */
 export declare const install_audit_drift_guard: () => void;
+/**
+ * Assert the process-wide audit counters are zero — the check
+ * `install_audit_drift_guard` runs after each test. Exported for a test that
+ * manages the counters itself.
+ *
+ * @throws AssertionError naming the first counter that is not zero
+ */
+export declare const assert_no_audit_drift: () => void;
 /**
  * Pair returned by `create_recording_audit_emitter` — the
  * `AuditEmitter` to inject as `deps.audit`, plus the shared `calls`
@@ -36,7 +49,7 @@ export interface RecordingAuditEmitter {
  * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
  * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
  * capture audit metadata shapes in unit tests (e.g. password change failure
- * outcome, role-grant create denial) without standing up the full PGlite +
+ * outcome, role-grant create denial) without standing up a database and the
  * `query_audit_log` pipeline.
  *
  * **Capture scope — all four production fan-out shapes.**

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAGN,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAO5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAO,IAgBxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -1,20 +1,26 @@
 import './assert_dev_env.js';
 import { assert, beforeEach, afterEach } from 'vitest';
 import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures } from '../auth/audit_log_queries.js';
+import { get_audit_write_failures, reset_audit_write_failures } from '../auth/audit_emitter.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
- * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ * entry, an `event_type` not present in the active `AuditLogConfig`, or a
+ * row the emitter failed to write.
  *
  * The production validation in `query_audit_log` is fail-open — it bumps
  * process-wide counters and proceeds, so a regression that emits an
  * undeclared metadata field or a typo'd event-type lands a row that
- * passes downstream queries but breaks forensics. Tests that exercise
- * audit emits should fail loudly when this happens.
+ * passes downstream queries but breaks forensics. The emitter's pool write
+ * is fail-open too: a refused `INSERT` is logged and counted, the request
+ * succeeds, and the row is gone. Tests that exercise audit emits should fail
+ * loudly when either happens.
  *
  * Call at the top of every `describe` / `describe_db` block that fires
  * audit writes through `deps.audit.emit`. Resets counters before each
- * test and asserts zero on completion.
+ * test and asserts zero on completion. A test that makes a write fail on
+ * purpose calls `reset_audit_write_failures` (`auth/audit_emitter.ts`) once
+ * it has asserted the count.
  *
  * Pair with `await_pending_effects: true` (the default for
  * `create_test_app`) so fire-and-forget audit writes have completed by
@@ -24,17 +30,27 @@ export const install_audit_drift_guard = () => {
     beforeEach(() => {
         reset_audit_metadata_validation_failures();
         reset_audit_unknown_event_type_failures();
+        reset_audit_write_failures();
     });
-    afterEach(() => {
-        assert.strictEqual(get_audit_metadata_validation_failures(), 0, 'audit metadata failed schema validation — see audit_log_schema.audit_metadata_schemas');
-        assert.strictEqual(get_audit_unknown_event_type_failures(), 0, 'audit emitted an unknown event_type — see AUDIT_EVENT_TYPES');
-    });
+    afterEach(assert_no_audit_drift);
+};
+/**
+ * Assert the process-wide audit counters are zero — the check
+ * `install_audit_drift_guard` runs after each test. Exported for a test that
+ * manages the counters itself.
+ *
+ * @throws AssertionError naming the first counter that is not zero
+ */
+export const assert_no_audit_drift = () => {
+    assert.strictEqual(get_audit_metadata_validation_failures(), 0, 'audit metadata failed schema validation — see audit_log_schema.audit_metadata_schemas');
+    assert.strictEqual(get_audit_unknown_event_type_failures(), 0, 'audit emitted an unknown event_type — see AUDIT_EVENT_TYPES');
+    assert.strictEqual(get_audit_write_failures(), 0, 'an audit row failed to write and was lost — the emitter logged the database error');
 };
 /**
  * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
  * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
  * capture audit metadata shapes in unit tests (e.g. password change failure
- * outcome, role-grant create denial) without standing up the full PGlite +
+ * outcome, role-grant create denial) without standing up a database and the
  * `query_audit_log` pipeline.
  *
  * **Capture scope — all four production fan-out shapes.**

package/dist/testing/cross_backend/body_size.d.ts

@@ -2,11 +2,24 @@ import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /**
  * Options for the body-size parity suite — the standard RPC-dispatched
- * cross-suite shape (`setup_test` / `rpc_path`); aliases the shared
- * `RpcPathCrossSuiteOptions` rather than minting a duplicate. The limit is
- * on every spine, so no case is capability-gated and the flag bundle is not
- * on the shape.
+ * cross-suite shape (`setup_test` / `rpc_path`) plus where the backend's
+ * socket is. The limit is on every spine, so no case is capability-gated and
+ * the flag bundle is not on the shape.
  */
-export type BodySizeCrossTestOptions = RpcPathCrossSuiteOptions;
+export interface BodySizeCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /**
+     * Base URL the spawned backend is reachable at (e.g. `http://localhost:1178`),
+     * or `null` for an in-process run, which has no socket. Given a URL, the
+     * over-cap cases write to the socket directly and send only the bytes the
+     * refusal needs; with `null` they send whole bodies through the fixture's
+     * transport.
+     *
+     * Pass the URL whenever the fixture's transport reaches a real socket.
+     * `null` there uploads each whole over-cap body through `fetch`, where the
+     * write races the close that follows the 413 and the case fails some of the
+     * time.
+     */
+    readonly base_url: string | null;
+}
 export declare const describe_body_size_cross_tests: (options: BodySizeCrossTestOptions) => void;
 //# sourceMappingURL=body_size.d.ts.map

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0D9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAmDhE,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA0ClF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA2HD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAyLlF,CAAC"}