@fuzdev/fuz_app 0.134.0 → 0.136.0

package/dist/testing/cross_backend/capabilities.d.ts

@@ -122,25 +122,6 @@ export interface BackendCapabilities {
      * explicitly (a backend that deliberately omits the route).
      */
     readonly account_status: boolean;
-    /**
-     * On an oversized-body `413` reject the backend **closes the connection
-     * without reading the body** (the defense-in-depth posture), rather than
-     * draining the declared `Content-Length` and keeping the socket alive.
-     * Gates the strong half of `describe_body_size_smuggling_cross_tests`: when
-     * `true`, the pipelined GET is never reached (at most one response); when
-     * `false`, the suite instead asserts the weaker but still-load-bearing
-     * no-desync property (the body is framed on `Content-Length`, not reparsed
-     * as request bytes).
-     *
-     * `true` for the Node / Deno (`@hono/node-server` graceful close) and Rust
-     * (hyper RST) backends; `false` for Bun — `Bun.serve` reads the full body
-     * and processes the correctly-framed pipelined request even when the `413`
-     * carries `Connection: close`. Bun is not insecure (no desync — it answers
-     * the cleanly-delimited GET with a proper `400`); the flag records the
-     * connection-handling divergence so the suite stays green without losing the
-     * smuggle detector. See `docs/security.md` §"Body Size Limiting".
-     */
-    readonly oversized_reject_closes_connection: boolean;
     /**
      * The backend can **initiate** a JSON-RPC request to a connected client
      * and await its typed reply (the server→client request/response direction
@@ -171,8 +152,9 @@ export interface BackendCapabilities {
      * anything.
      *
      * `true` for Node (`ws`), Deno, and the Rust spine (hyper hands the
-     * leftover bytes to the upgraded stream); `false` for Bun, whose HTTP
-     * parser answers such a request `400` before any handler runs. A backend
+     * leftover bytes to the upgraded stream); `false` for a Bun backend that
+     * upgrades after an asynchronous check, as one behind auth does — `Bun.serve`
+     * answers such a request `400` (observed on Bun 1.4.3). A backend
      * without it still runs the suite's client-library case (requests sent the
      * moment the socket opens), which pins the same contract without forcing
      * the ordering.

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -22,8 +22,7 @@ import '../assert_dev_env.js';
  *   a capability is a compile error until each family declares it).
  * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
  *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
- *   default; Bun flips `oversized_reject_closes_connection` and
- *   `ws_handshake_pipelining`).
+ *   default; Bun flips `ws_handshake_pipelining`).
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
  *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
  *
@@ -61,7 +60,6 @@ export const in_process_capabilities = Object.freeze({
     fact_serving: true,
     ready: true,
     account_status: true,
-    oversized_reject_closes_connection: true,
     peer_request: false,
     // Cross-process-only, like `peer_request`: the case needs a real bound socket
     // to write raw bytes to.

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA+cF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6fF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -32,7 +32,10 @@ import '../assert_dev_env.js';
  *   `kind` inside `data` still gets the authz error (404 / 403), never the
  *   kind error — authz runs before the input-shape checks, on both spines;
  * - an empty-string `kind` is rejected on create (`cell_kind_empty`) and is
- *   accepted as a list filter that matches nothing.
+ *   accepted as a list filter that matches nothing;
+ * - a `kind` of exactly `CELL_KIND_LENGTH_MAX` UTF-16 code units is stored
+ *   whole, and one unit past it is `invalid_params` on create and as a list
+ *   filter.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -42,7 +45,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
@@ -239,5 +242,31 @@ export const describe_cell_crud_cross_tests = (options) => {
             const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind: '' }, owner_headers), CellListOutput);
             assert.ok(!listed.cells.some((c) => c.id === note.id), 'empty-kind filter matched a non-empty-kind cell');
         });
+        test_if(capabilities.cell_crud, 'kind length cap: stored whole at the cap; one unit past it is invalid_params on create and list', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_kind_cap' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            // an astral character costs two UTF-16 code units on both spines
+            const astral_at_cap = '\u{1F600}'.repeat(CELL_KIND_LENGTH_MAX / 2);
+            for (const kind of ['k'.repeat(CELL_KIND_LENGTH_MAX), astral_at_cap]) {
+                assert.strictEqual(kind.length, CELL_KIND_LENGTH_MAX);
+                const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind, data: {} }, owner_headers), CellCreateOutput).cell;
+                assert.strictEqual(created.kind, kind, 'a kind at the cap must be stored whole');
+                const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind }, owner_headers), CellListOutput);
+                assert.ok(listed.cells.some((c) => c.id === created.id), 'a kind filter at the cap must match the cell that carries it');
+            }
+            for (const kind of ['k'.repeat(CELL_KIND_LENGTH_MAX + 1), astral_at_cap + 'k']) {
+                for (const [method, params] of [
+                    ['cell_create', { kind, data: {} }],
+                    ['cell_list', { kind }]
+                ]) {
+                    const refused = await cross_rpc_call(t, rpc_path, method, params, owner_headers);
+                    assert.ok(!refused.ok, `${method} admitted a ${kind.length}-unit kind`);
+                    assert.strictEqual(refused.error?.code, -32602);
+                    assert.strictEqual(error_reason(refused), undefined, 'a schema refusal carries no reason');
+                }
+            }
+        });
     });
 };

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -92,12 +92,12 @@ import { z } from 'zod';
 export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
+    anonymous: "anonymous";
     daemon: "daemon";
     invalid_daemon: "invalid_daemon";
     daemon_browser: "daemon_browser";
     bearer_browser: "bearer_browser";
     scoped_token: "scoped_token";
-    anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
     wrong_role: "wrong_role";
@@ -122,12 +122,12 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
     as: z.ZodEnum<{
         keeper: "keeper";
         token: "token";
+        anonymous: "anonymous";
         daemon: "daemon";
         invalid_daemon: "invalid_daemon";
         daemon_browser: "daemon_browser";
         bearer_browser: "bearer_browser";
         scoped_token: "scoped_token";
-        anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
         wrong_role: "wrong_role";
@@ -179,12 +179,12 @@ export declare const ConformanceCase: z.ZodObject<{
         as: z.ZodEnum<{
             keeper: "keeper";
             token: "token";
+            anonymous: "anonymous";
             daemon: "daemon";
             invalid_daemon: "invalid_daemon";
             daemon_browser: "daemon_browser";
             bearer_browser: "bearer_browser";
             scoped_token: "scoped_token";
-            anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";
             wrong_role: "wrong_role";

package/dist/testing/cross_backend/credential_header_robustness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyD9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAwFD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}
+{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAgDD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -46,55 +46,19 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
+import { raw_http_count_responses, raw_http_exchange, raw_http_first_status } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /** A value that is never a real credential — used for the conflicting / garbage copies. */
 const GARBAGE_TOKEN = 'not-a-real-credential-value';
-/**
- * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
- * everything the server sends back until it closes or `read_timeout_ms`
- * elapses. Write errors are swallowed (a server closing mid-write on a rejected
- * request is expected behavior); what matters is what we read back. Mirrors
- * `body_size_smuggling.ts`'s `send_raw`.
- */
-const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
-    const url = new URL(base_url);
-    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
-    const socket = connect({ host: url.hostname, port });
-    let received = '';
-    let settled = false;
-    const finish = () => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        resolve(received);
-    };
-    const timer = setTimeout(finish, read_timeout_ms);
-    socket.setEncoding('latin1');
-    socket.on('connect', () => socket.write(request_bytes));
-    socket.on('data', (chunk) => {
-        received += chunk;
-    });
-    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
-    socket.on('close', finish);
-});
-/**
- * Count HTTP response status lines in a raw byte stream. Unanchored so a
- * second (smuggled) response concatenated after the first body — which carries
- * no trailing newline — is still counted; see `body_size_smuggling.ts`.
- */
-const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
-/** The status code of the first HTTP response in a raw stream, or `null` if none. */
-const first_status = (raw) => {
-    const match = /HTTP\/1\.[01] (\d{3})/.exec(raw);
-    return match ? Number(match[1]) : null;
-};
+/** How long each raw exchange waits for the server to finish answering. */
+const RAW_READ_TIMEOUT_MS = 2000;
+/** Write `request_bytes` to a fresh raw socket and read until the server closes. */
+const send_raw = async (base_url, request_bytes) => (await raw_http_exchange(base_url, request_bytes, { read_timeout_ms: RAW_READ_TIMEOUT_MS }))
+    .received;
 const is_success_status = (status) => status >= 200 && status < 300;
 /**
  * Frame a raw HTTP/1.1 POST with the given extra header lines + JSON body.
@@ -124,18 +88,18 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
     describe('credential-header robustness', () => {
         test('duplicate X-Daemon-Token (valid + conflicting) never escalates → one non-2xx response', async () => {
             const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${daemon_token}`, `${DAEMON_TOKEN_HEADER}: ${GARBAGE_TOKEN}`], purge_body('dup-daemon'));
-            const raw = await send_raw(base_url, req, 2000);
-            assert.strictEqual(count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
-            const status = first_status(raw);
+            const raw = await send_raw(base_url, req);
+            assert.strictEqual(raw_http_count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = raw_http_first_status(raw);
             assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
             assert.ok(!is_success_status(status), `a duplicated daemon token must not perform a keeper operation; whichever copy wins, ` +
                 `the result must be non-2xx (got ${status})`);
         });
         test('duplicate Authorization bearer headers (both garbage) do not authenticate → one non-2xx response', async () => {
             const req = rpc_post(host, rpc_path, [`Authorization: Bearer ${GARBAGE_TOKEN}`, `Authorization: Bearer ${GARBAGE_TOKEN}-2`], purge_body('dup-bearer'));
-            const raw = await send_raw(base_url, req, 2000);
-            assert.strictEqual(count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
-            const status = first_status(raw);
+            const raw = await send_raw(base_url, req);
+            assert.strictEqual(raw_http_count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = raw_http_first_status(raw);
             assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
             assert.ok(!is_success_status(status), `garbage bearer tokens (even duplicated) must not authenticate (got ${status})`);
         });
@@ -154,10 +118,10 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
             ];
             for (const { label, value } of malformed) {
                 const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${value}`], purge_body('ctrl-char'));
-                const raw = await send_raw(base_url, req, 2000);
-                assert.ok(count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
+                const raw = await send_raw(base_url, req);
+                assert.ok(raw_http_count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
                     `request (no smuggle). Raw head: ${raw.slice(0, 120)}`);
-                const status = first_status(raw);
+                const status = raw_http_first_status(raw);
                 assert.ok(status === null || !is_success_status(status), `${label}: a malformed credential header must never authenticate (got ${status})`);
             }
         });
@@ -166,12 +130,12 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
             // rejected (4xx / 431 / connection close). Its own outcome is don't-care.
             const oversized = 'a'.repeat(64 * 1024);
             const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${oversized}`], purge_body('oversized'));
-            await send_raw(base_url, req, 2000);
+            await send_raw(base_url, req);
             // The property: the server survives it. A normal request on a fresh
             // connection must still get a response (no crash, no wedged accept loop).
             const probe = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
-            const raw = await send_raw(base_url, probe, 2000);
-            assert.ok(first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
+            const raw = await send_raw(base_url, probe);
+            assert.ok(raw_http_first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
         });
     });
 };

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAmCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA6BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -32,10 +32,6 @@ export const ts_default_capabilities = Object.freeze({
     // `GET /api/account/status` is bundled into `create_account_route_specs`, so
     // every TS backend mounting account routes serves it.
     account_status: true,
-    // Node/Deno close the socket on an oversized-body reject (the default
-    // posture). A Bun-served consumer overrides to `false` (see the bun spine
-    // config) — fail-loud rather than silently skipping the smuggle detector.
-    oversized_reject_closes_connection: true,
     // Off by default like `sse`/`ready`: the WS backend transport *can* initiate
     // server→client requests (`BackendWebsocketTransport.request_connection`),
     // but driving the full `peer/ping` suite also needs `peer/ping` mounted on
@@ -44,7 +40,8 @@ export const ts_default_capabilities = Object.freeze({
     peer_request: false,
     // Node (`ws`) and Deno hand frames pipelined with the upgrade request to the
     // socket. A Bun-served consumer overrides to `false` (see the bun spine
-    // config) — `Bun.serve` answers such a request `400`.
+    // config) — `Bun.serve` answers such a request `400` when the upgrade
+    // follows an asynchronous check.
     ws_handshake_pipelining: true,
     // Off by default: a consumer's WS endpoint mounts its own domain's actions.
     // fuz_app's spine configs opt in (the spine binary mounts the account
@@ -76,9 +73,6 @@ export const rust_default_capabilities = Object.freeze({
     // The Rust `account_router` bundles `/status` into the account routes, so
     // every Rust spine serving the account surface serves it.
     account_status: true,
-    // hyper sends an RST on the oversized-body reject — the connection closes
-    // and the pipelined request is never reached.
-    oversized_reject_closes_connection: true,
     // Server-initiated requests landed Rust-first canonical — the Rust spine
     // drives the `peer/ping` round-trip, so the family opts into the suite.
     peer_request: true,

package/dist/testing/cross_backend/role_grant_role_grammar.d.ts

@@ -0,0 +1,6 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/** Options for the role-grammar suite (the standard RPC-dispatched shape). */
+export type RoleGrantRoleGrammarCrossTestOptions = RpcPathCrossSuiteOptions;
+export declare const describe_role_grant_role_grammar_cross_tests: (options: RoleGrantRoleGrammarCrossTestOptions) => void;
+//# sourceMappingURL=role_grant_role_grammar.d.ts.map

package/dist/testing/cross_backend/role_grant_role_grammar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_grant_role_grammar.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_role_grammar.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,8EAA8E;AAC9E,MAAM,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AAoC5E,eAAO,MAAM,4CAA4C,GACxD,SAAS,oCAAoC,KAC3C,IAoGF,CAAC"}

package/dist/testing/cross_backend/role_grant_role_grammar.js

@@ -0,0 +1,117 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for an **off-grammar `role`** on the grant verbs.
+ *
+ * `role_grant_assign` and `role_grant_offer_create` declare `role` as
+ * `RoleName` (lowercase letters and underscores, no leading or trailing
+ * underscore, at most 64 characters). A role string outside that grammar is refused at input
+ * validation — JSON-RPC `invalid_params`, with no `data.reason` — and writes
+ * no audit row: a role is caller-chosen text until it passes the grammar, and
+ * the grant verbs record the role they refuse in their failure rows.
+ *
+ * - **refused at validation** — each off-grammar role, on each verb, answers
+ *   `invalid_params` with no reason, so the refusal is the input schema's and
+ *   not a grant-path or authorizer one. One of them is all lowercase letters
+ *   and one character past the length cap: the cap is part of the grammar, so
+ *   a failure row never carries an arbitrarily long caller-chosen string.
+ * - **no audit row** — after the refusals, no grant audit row carries an
+ *   off-grammar role. The control keeps that read from being vacuous: an
+ *   on-grammar role no registry holds is refused past validation with
+ *   `role_not_web_grantable`, the refusal a failure row records — as is one
+ *   exactly at the length cap, which pins the boundary.
+ *
+ * Exists because the action-manifest parity gate captures no param schemas
+ * while the Rust spine parses params by hand — a spine that let an off-grammar
+ * role reach its grant path would answer with a different error and write the
+ * caller's text into the audit log. Both verbs are on every spine's standard
+ * surface, so the suite is ungated. Cross-process only: it reads the audit log
+ * through `_testing_drain_effects`, which the spine binaries mount.
+ *
+ * @module
+ */
+import { assert, describe, test } from 'vitest';
+import { ERROR_ROLE_NOT_WEB_GRANTABLE } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { cross_rpc_call, error_reason } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+/**
+ * The longest role name the grammar admits — an independent copy of the
+ * producers' `ROLE_NAME_LENGTH_MAX`, so a cap moved on one spine fails here.
+ */
+const ROLE_NAME_LENGTH_MAX = 64;
+/** All lowercase letters, so only its length is off the grammar. */
+const OVER_LENGTH_ROLE = 'a'.repeat(ROLE_NAME_LENGTH_MAX + 1);
+/** On the grammar at exactly the length cap, held by no registry. */
+const AT_LENGTH_ROLE = 'a'.repeat(ROLE_NAME_LENGTH_MAX);
+/** Each breaks one rule of the `RoleName` grammar. */
+const OFF_GRAMMAR_ROLES = [
+    'Admin', // uppercase
+    'role-name', // hyphen
+    'role1', // digit
+    '_role', // leading underscore
+    'role_', // trailing underscore
+    'role name', // space
+    '', // empty
+    OVER_LENGTH_ROLE // on the alphabet, one past the length cap
+];
+/** On the grammar, held by no registry. */
+const UNREGISTERED_ROLE = 'not_a_registered_role';
+const GRANT_METHODS = ['role_grant_assign', 'role_grant_offer_create'];
+/** The audit event types the grant verbs write. */
+const GRANT_EVENT_TYPES = ['role_grant_create', 'role_grant_offer_create'];
+export const describe_role_grant_role_grammar_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('grant verbs refuse an off-grammar role at validation', { timeout: 30_000 }, () => {
+        for (const method of GRANT_METHODS) {
+            test(`${method}: an off-grammar role is invalid_params with no reason`, async () => {
+                const fixture = await setup_test();
+                const t = fixture.fresh_transport();
+                for (const role of OFF_GRAMMAR_ROLES) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { to_account_id: NIL_UUID, role }, fixture.create_session_headers());
+                    const label = `${method} role=${JSON.stringify(role)}`;
+                    assert.strictEqual(res.ok, false, `${label}: expected a refusal`);
+                    assert.strictEqual(res.error?.code, JSONRPC_ERROR_CODES.invalid_params, label);
+                    // a validation refusal, not a grant-path or authorizer one
+                    assert.strictEqual(error_reason(res), undefined, `${label}: no data.reason`);
+                }
+            });
+        }
+        test('an off-grammar role writes no audit row; an unregistered on-grammar one is refused past validation', async () => {
+            const fixture = await setup_test();
+            const t = fixture.fresh_transport();
+            const session = fixture.create_session_headers();
+            for (const method of GRANT_METHODS) {
+                for (const role of OFF_GRAMMAR_ROLES) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { to_account_id: NIL_UUID, role }, session);
+                    assert.strictEqual(res.error?.code, JSONRPC_ERROR_CODES.invalid_params, `${method} ${JSON.stringify(role)}`);
+                }
+            }
+            // control: the same call with an on-grammar role reaches the grant-path gate
+            const control = await cross_rpc_call(t, rpc_path, 'role_grant_assign', { to_account_id: NIL_UUID, role: UNREGISTERED_ROLE }, session);
+            assert.strictEqual(error_reason(control), ERROR_ROLE_NOT_WEB_GRANTABLE);
+            // and the length cap is inclusive: a role exactly at it is on the grammar
+            const at_length = await cross_rpc_call(t, rpc_path, 'role_grant_assign', { to_account_id: NIL_UUID, role: AT_LENGTH_ROLE }, session);
+            assert.strictEqual(error_reason(at_length), ERROR_ROLE_NOT_WEB_GRANTABLE, 'a role at the length cap passes validation');
+            // a barrier before reading the log: both spines write audit rows off
+            // the request path
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            for (const event_type of GRANT_EVENT_TYPES) {
+                const listed = await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type }, session);
+                assert.ok(listed.ok, `audit_log_list failed: ${JSON.stringify(listed.error)}`);
+                const events = listed.result.events;
+                const roles = events.map((event) => event.metadata?.role);
+                for (const role of roles) {
+                    assert.ok(typeof role !== 'string' || !OFF_GRAMMAR_ROLES.includes(role), `${event_type}: an audit row records the off-grammar role ${JSON.stringify(role)}`);
+                }
+                if (event_type === 'role_grant_create') {
+                    // the controls' failure rows are in the same read, so it is not vacuous
+                    assert.ok(roles.includes(UNREGISTERED_ROLE), 'the control refusal wrote its failure row');
+                    assert.ok(roles.includes(AT_LENGTH_ROLE), 'the at-cap refusal wrote its failure row');
+                }
+            }
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -5,9 +5,8 @@ export declare const RUST_SPINE_STUB_BIN_ENV = "FUZ_TESTING_RUST_SPINE_STUB_BIN"
 /**
  * Env var overriding the stub's Postgres URL when `database_url` is omitted —
  * e.g. a scratch cluster on a spare port, keeping the run off the machine's
- * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
- * idempotent `createdb` reads, so the database it ensures is the one the URL
- * names.
+ * default server. A runner that creates the stub's database before the spawn
+ * must create the one this URL names, on the server it names.
  */
 export declare const RUST_SPINE_STUB_DATABASE_URL_ENV = "FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL";
 /**

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -45,9 +45,8 @@ export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
  * Env var overriding the stub's Postgres URL when `database_url` is omitted —
  * e.g. a scratch cluster on a spare port, keeping the run off the machine's
- * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
- * idempotent `createdb` reads, so the database it ensures is the one the URL
- * names.
+ * default server. A runner that creates the stub's database before the spawn
+ * must create the one this URL names, on the server it names.
  */
 export const RUST_SPINE_STUB_DATABASE_URL_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL';
 /**

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA+ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -4,10 +4,11 @@ import '../assert_dev_env.js';
  * actions.
  *
  * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_schema_snapshot` / `_testing_migration_tracker` /
- * `_testing_action_manifest` are privileged test-binary actions the production
- * wire never exposes — three direct DB writes (full auth wipe, forged session
- * row, raw fact insert) plus three introspection reads (the live schema, the
+ * `_testing_flood_notifications` / `_testing_schema_snapshot` /
+ * `_testing_migration_tracker` / `_testing_action_manifest` are privileged
+ * test-binary actions the production wire never exposes — direct DB writes
+ * (full auth wipe, forged session row, raw fact insert), a flood of the
+ * caller's own connection, and introspection reads (the live schema, the
  * `schema_version` migration tracker, and the live RPC registry — the highest
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
@@ -76,8 +77,13 @@ const NIL_UUID = '00000000-0000-0000-0000-000000000000';
  */
 const backdoor_methods = [
     { method: '_testing_reset', params: {} },
+    // The audit barrier — its input is void, so the call carries no params.
+    { method: '_testing_drain_effects', params: undefined },
     { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
     { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    // An empty burst — valid input, so it clears the 400 phase; a refused
+    // caller never reaches the handler that would queue it.
+    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
     { method: '_testing_schema_snapshot', params: {} },