@fuzdev/fuz_app 0.134.0 → 0.136.0

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -8,10 +8,12 @@ import '../assert_dev_env.js';
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
  * suite), **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot),
  * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
  * cross-impl migration-identity parity — the provenance half the snapshot gate
- * excludes by design).
+ * excludes by design), and **`_testing_flood_notifications`** (queue a burst
+ * of notifications onto the caller's own WebSocket connection, to push its
+ * outbound queue past its byte budget).
  *
  * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
@@ -291,6 +293,84 @@ export declare const testing_put_fact_action_spec: {
     readonly async: true;
     readonly description: string;
 };
+/** The wire method of each notification `_testing_flood_notifications` queues. */
+export declare const TESTING_FLOOD_NOTIFICATION_METHOD = "_testing_flood";
+/**
+ * The most notifications one `_testing_flood_notifications` call queues.
+ * Empty ones at this count are charged more than
+ * `DEFAULT_WS_OUTBOUND_QUEUE_BYTES` between them — each frame's envelope and
+ * its overhead — so a burst of tiny frames can overflow a connection on a
+ * default transport too. Same value as the Rust spine's.
+ */
+export declare const TESTING_FLOOD_MAX_COUNT = 65536;
+/** The largest `payload` one `_testing_flood_notifications` call builds, in bytes. */
+export declare const TESTING_FLOOD_MAX_SIZE: number;
+/**
+ * The most payload bytes one `_testing_flood_notifications` call builds across
+ * all its notifications — the bound on `count` × `size`. The handler
+ * serializes each notification without yielding, so the product is how long
+ * one call holds the event loop.
+ */
+export declare const TESTING_FLOOD_MAX_TOTAL_BYTES: number;
+/** The `data.reason` of the refusal `_testing_flood_notifications` gives a call over HTTP. */
+export declare const ERROR_TESTING_FLOOD_NO_CONNECTION = "no_connection";
+/**
+ * `_testing_flood_notifications` — queue a burst of notifications onto the
+ * **caller's own WebSocket connection**, all in one synchronous run, so a suite
+ * driving the server from outside can push a connection's outbound queue past
+ * its byte budget deterministically — without a second producer, and whether
+ * or not its client is reading: the connection's write pump gets no turn while
+ * the handler runs, so the burst waits at once. Past the budget the server
+ * closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ *
+ * Each notification is
+ * `{"jsonrpc":"2.0","method":"_testing_flood","params":{"index":<i>,"payload":"<size × 'x'>"}}`
+ * with `index` counting from 0, so every frame is a little longer than `size`
+ * bytes and a client can tell which frames reached it.
+ *
+ * The result is `{queued: count}` — the number asked for, not the number that
+ * fit: when the burst overflows the queue the connection is closed and this
+ * response is never written. A burst that fits arrives in order, ahead of the
+ * response.
+ *
+ * A call past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+ * `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`) is refused with
+ * `invalid_params` and queues nothing. Over HTTP there is no connection to
+ * queue onto, so the call is refused with `invalid_params`, reason
+ * `ERROR_TESTING_FLOOD_NO_CONNECTION`, rather than answering as though it had
+ * flooded something.
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_flood_notifications_action_spec`.
+ */
+export declare const testing_flood_notifications_action_spec: {
+    readonly method: "_testing_flood_notifications";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        count: z.ZodNumber;
+        size: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly output: z.ZodObject<{
+        queued: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly async: true;
+    readonly error_reasons: readonly ["no_connection"];
+    readonly description: string;
+};
+/**
+ * Build the standalone `_testing_flood_notifications` action (see the spec
+ * doc). The spine binary bundles it via `create_testing_actions`; mount it
+ * directly on an in-process WS endpoint whose suite drives an outbound
+ * overflow.
+ */
+export declare const create_testing_flood_notifications_action: () => RpcAction;
 /**
  * `_testing_schema_snapshot` — introspect the live database into a normalized
  * `SchemaSnapshot` for cross-impl parity diffing. The cross-backend harness
@@ -299,6 +379,11 @@ export declare const testing_put_fact_action_spec: {
  * shapes match by design). Optional `exclude_tables` drops documented
  * divergences from both sides before comparison.
  *
+ * A backend running on pglet (a TS backend config's `memory://` default)
+ * answers with an error when its schema holds an index: the snapshot exists
+ * to be compared, and pglet's index definitions omit the modifiers a
+ * comparison needs (`query_schema_snapshot`). Run the backend on PostgreSQL.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export declare const testing_schema_snapshot_action_spec: {

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAMzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA4IjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -8,10 +8,12 @@ import '../assert_dev_env.js';
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
  * suite), **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot),
  * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
  * cross-impl migration-identity parity — the provenance half the snapshot gate
- * excludes by design).
+ * excludes by design), and **`_testing_flood_notifications`** (queue a burst
+ * of notifications onto the caller's own WebSocket connection, to push its
+ * outbound queue past its byte budget).
  *
  * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
@@ -72,6 +74,7 @@ import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
 import { FactHashSchema } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { rpc_action } from '../../actions/action_rpc.js';
+import { jsonrpc_errors } from '../../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../../http/pending_effects.js';
 import { protocol_action_specs } from '../../actions/protocol.js';
 import { query_put_fact } from '../../db/fact_queries.js';
@@ -291,6 +294,101 @@ export const testing_put_fact_action_spec = {
     description: 'Test-binary only — seed an embedded fact (blake3 of the UTF-8 content) and return its hash, ' +
         'so the cross-process fact-serving suite can store bytes without a DB handle.'
 };
+/** The wire method of each notification `_testing_flood_notifications` queues. */
+export const TESTING_FLOOD_NOTIFICATION_METHOD = '_testing_flood';
+/**
+ * The most notifications one `_testing_flood_notifications` call queues.
+ * Empty ones at this count are charged more than
+ * `DEFAULT_WS_OUTBOUND_QUEUE_BYTES` between them — each frame's envelope and
+ * its overhead — so a burst of tiny frames can overflow a connection on a
+ * default transport too. Same value as the Rust spine's.
+ */
+export const TESTING_FLOOD_MAX_COUNT = 65_536;
+/** The largest `payload` one `_testing_flood_notifications` call builds, in bytes. */
+export const TESTING_FLOOD_MAX_SIZE = 16 * 1024 * 1024;
+/**
+ * The most payload bytes one `_testing_flood_notifications` call builds across
+ * all its notifications — the bound on `count` × `size`. The handler
+ * serializes each notification without yielding, so the product is how long
+ * one call holds the event loop.
+ */
+export const TESTING_FLOOD_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+/** The `data.reason` of the refusal `_testing_flood_notifications` gives a call over HTTP. */
+export const ERROR_TESTING_FLOOD_NO_CONNECTION = 'no_connection';
+/**
+ * `_testing_flood_notifications` — queue a burst of notifications onto the
+ * **caller's own WebSocket connection**, all in one synchronous run, so a suite
+ * driving the server from outside can push a connection's outbound queue past
+ * its byte budget deterministically — without a second producer, and whether
+ * or not its client is reading: the connection's write pump gets no turn while
+ * the handler runs, so the burst waits at once. Past the budget the server
+ * closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ *
+ * Each notification is
+ * `{"jsonrpc":"2.0","method":"_testing_flood","params":{"index":<i>,"payload":"<size × 'x'>"}}`
+ * with `index` counting from 0, so every frame is a little longer than `size`
+ * bytes and a client can tell which frames reached it.
+ *
+ * The result is `{queued: count}` — the number asked for, not the number that
+ * fit: when the burst overflows the queue the connection is closed and this
+ * response is never written. A burst that fits arrives in order, ahead of the
+ * response.
+ *
+ * A call past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+ * `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`) is refused with
+ * `invalid_params` and queues nothing. Over HTTP there is no connection to
+ * queue onto, so the call is refused with `invalid_params`, reason
+ * `ERROR_TESTING_FLOOD_NO_CONNECTION`, rather than answering as though it had
+ * flooded something.
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_flood_notifications_action_spec`.
+ */
+export const testing_flood_notifications_action_spec = {
+    method: '_testing_flood_notifications',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: z.strictObject({
+        count: z.number().int().min(0).max(TESTING_FLOOD_MAX_COUNT).meta({
+            description: 'How many notifications to queue.'
+        }),
+        size: z.number().int().min(0).max(TESTING_FLOOD_MAX_SIZE).meta({
+            description: "The byte length of each notification's `payload` string."
+        })
+    }),
+    output: z.strictObject({
+        queued: z.number().int().meta({
+            description: 'The number of notifications asked for — not the number that fit.'
+        })
+    }),
+    async: true,
+    error_reasons: [ERROR_TESTING_FLOOD_NO_CONNECTION],
+    description: "Test-binary only — queue a burst of notifications onto the caller's own WebSocket " +
+        'connection in one synchronous run, to push its outbound queue past its byte budget.'
+};
+/**
+ * Build the standalone `_testing_flood_notifications` action (see the spec
+ * doc). The spine binary bundles it via `create_testing_actions`; mount it
+ * directly on an in-process WS endpoint whose suite drives an outbound
+ * overflow.
+ */
+export const create_testing_flood_notifications_action = () => 
+// not `async`: the burst must be queued in one synchronous run
+rpc_action(testing_flood_notifications_action_spec, ({ count, size }, ctx) => {
+    if (count * size > TESTING_FLOOD_MAX_TOTAL_BYTES) {
+        throw jsonrpc_errors.invalid_params(`count * size must be at most ${TESTING_FLOOD_MAX_TOTAL_BYTES}`);
+    }
+    if (ctx.connection_id === undefined) {
+        throw jsonrpc_errors.invalid_params('_testing_flood_notifications needs a WebSocket connection', { reason: ERROR_TESTING_FLOOD_NO_CONNECTION });
+    }
+    const payload = 'x'.repeat(size);
+    for (let index = 0; index < count; index++) {
+        ctx.notify(TESTING_FLOOD_NOTIFICATION_METHOD, { index, payload });
+    }
+    return { queued: count };
+});
 /**
  * `_testing_schema_snapshot` — introspect the live database into a normalized
  * `SchemaSnapshot` for cross-impl parity diffing. The cross-backend harness
@@ -299,6 +397,11 @@ export const testing_put_fact_action_spec = {
  * shapes match by design). Optional `exclude_tables` drops documented
  * divergences from both sides before comparison.
  *
+ * A backend running on pglet (a TS backend config's `memory://` default)
+ * answers with an error when its schema holds an index: the snapshot exists
+ * to be compared, and pglet's index definitions omit the modifiers a
+ * comparison needs (`query_schema_snapshot`). Run the backend on PostgreSQL.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export const testing_schema_snapshot_action_spec = {
@@ -555,6 +658,7 @@ export const create_testing_actions = (deps, options) => {
             return { hash };
         }),
         create_testing_drain_effects_action(deps.audit),
+        create_testing_flood_notifications_action(),
         create_testing_schema_snapshot_action(),
         create_testing_migration_tracker_action()
     ];

package/dist/testing/cross_backend/token_lifetime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAsHF,CAAC"}
+{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA6KF,CAAC"}

package/dist/testing/cross_backend/token_lifetime.js

@@ -27,11 +27,16 @@ import '../assert_dev_env.js';
  *   pin on the silently-ignoring-unknown-shapes hazard.
  * - **Out-of-range days are refused** — `days: 0` 400s identically, so the
  *   two hand-rolled bounds checks can't drift.
+ * - **The `name` cap** — the same blind spot on another field of the same
+ *   mint: a name of exactly `API_TOKEN_NAME_LENGTH_MAX` UTF-16 code units
+ *   mints and reads back whole, and one unit past it is `invalid_params`,
+ *   with an astral-plane name at each side of the boundary so the two spines
+ *   count the same unit.
  *
  * @module
  */
 import { describe, test, assert } from 'vitest';
-import { account_token_create_action_spec, account_token_list_action_spec, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
+import { account_token_create_action_spec, account_token_list_action_spec, API_TOKEN_NAME_LENGTH_MAX, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -97,5 +102,33 @@ export const describe_token_lifetime_cross_tests = (options) => {
             assert.ok(!res.ok, 'days: 0 must be refused');
             assert.strictEqual(res.error?.code, -32602, `expected invalid_params: ${JSON.stringify(res.error)}`);
         });
+        test('a name at the length cap mints and reads back; one past it is invalid_params', async () => {
+            const fixture = await setup_test();
+            const astral = '\u{1F600}';
+            // the cap is odd: whole astral characters, plus one unit to land on it
+            const astral_at_cap = astral.repeat((API_TOKEN_NAME_LENGTH_MAX - 1) / 2) + 'a';
+            const mint = (name) => cross_rpc_call(fixture.transport, rpc_path, account_token_create_action_spec.method, { name, scope: { kind: 'full' }, lifetime: { kind: 'eternal' } }, fixture.create_session_headers());
+            const admitted = ['a'.repeat(API_TOKEN_NAME_LENGTH_MAX), astral_at_cap];
+            const minted_ids = [];
+            for (const name of admitted) {
+                assert.strictEqual(name.length, API_TOKEN_NAME_LENGTH_MAX);
+                minted_ids.push(expect_output(await mint(name), TokenCreateOutput).id);
+            }
+            const listed = expect_output(await cross_rpc_call(fixture.transport, rpc_path, account_token_list_action_spec.method, undefined, fixture.create_session_headers()), TokenListOutput);
+            for (const [index, id] of minted_ids.entries()) {
+                assert.strictEqual(listed.tokens.find((t) => t.id === id)?.name, admitted[index], 'a name at the cap must be stored whole');
+            }
+            for (const name of [
+                'a'.repeat(API_TOKEN_NAME_LENGTH_MAX + 1),
+                // one astral character past the cap: two units over an even count
+                astral.repeat((API_TOKEN_NAME_LENGTH_MAX + 1) / 2),
+                astral_at_cap + 'a'
+            ]) {
+                const res = await mint(name);
+                assert.ok(!res.ok, `a ${name.length}-unit name must be refused`);
+                assert.strictEqual(res.error?.code, -32602, `expected invalid_params for a ${name.length}-unit name, got ${JSON.stringify(res.error)}`);
+                assert.strictEqual(error_reason(res), undefined, 'a schema refusal carries no reason');
+            }
+        });
     });
 };

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAiDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -22,23 +22,18 @@ const ts_spine_capabilities = Object.freeze({
 });
 /**
  * Capabilities for the **Bun** spine binary — `ts_spine_capabilities` with
- * `oversized_reject_closes_connection: false` and
- * `ws_handshake_pipelining: false`. `Bun.serve` drains the declared
- * `Content-Length` of an oversized-body `413` reject and keeps the socket
- * alive (processing the correctly-framed pipelined request) even when the
- * response carries `Connection: close`, unlike `@hono/node-server` / Deno /
- * hyper, which close. Bun is not insecure — it frames on `Content-Length`, so
- * there is no desync — but the smuggling suite's strong "connection closes"
- * assertion doesn't hold; this flag routes Bun onto the suite's no-desync arm.
- * See `docs/security.md` §"Body Size Limiting".
+ * `ws_handshake_pipelining: false`.
  *
- * `Bun.serve` also answers `400` to an upgrade request that carries WebSocket
- * frames in the same TCP write, before any handler runs, so the WS suite's
- * frames-with-the-handshake case has nothing to drive there.
+ * `Bun.serve` answers `400` to an upgrade request that carries WebSocket
+ * frames in the same TCP write when the handler upgrades after an await that
+ * yields to the event loop — a timer, I/O; the spine's does, behind the auth
+ * middleware's database reads — so the WS suite's frames-with-the-handshake
+ * case has nothing to drive there (observed on Bun 1.4.3; an upgrade made
+ * synchronously in `fetch`, or after an await that settles in the same
+ * microtask run, takes the frames).
  */
 const ts_spine_bun_capabilities = Object.freeze({
     ...ts_spine_capabilities,
-    oversized_reject_closes_connection: false,
     ws_handshake_pipelining: false
 });
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */

package/dist/testing/cross_backend/ws_outbound_overflow.d.ts

@@ -0,0 +1,29 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { SetupTest } from './setup.js';
+/** Options for the outbound-overflow parity suite. */
+export interface WsOutboundOverflowCrossTestOptions {
+    /** Per-test fixture producer (`default_cross_process_setup(handle)`). */
+    readonly setup_test: SetupTest;
+    /** Backend capability flags; every WebSocket case gates on `capabilities.ws`. */
+    readonly capabilities: BackendCapabilities;
+    /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+    readonly base_url: string;
+    /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** Origin for the session socket's upgrade. Defaults to `base_url`. */
+    readonly origin?: string;
+    /**
+     * The backend's RPC endpoint path, for the over-HTTP refusal. Omitted, that
+     * case is skipped.
+     */
+    readonly rpc_path?: string;
+}
+/**
+ * Register the outbound-overflow parity suite over a real upgrade: a burst
+ * within the budget arrives whole, one past it closes the socket with
+ * `WS_CLOSE_OUTBOUND_OVERFLOW` and no response, and the account's other
+ * connection is unaffected.
+ */
+export declare const describe_ws_outbound_overflow_cross_tests: (options: WsOutboundOverflowCrossTestOptions) => void;
+//# sourceMappingURL=ws_outbound_overflow.d.ts.map

package/dist/testing/cross_backend/ws_outbound_overflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws_outbound_overflow.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_outbound_overflow.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAoFzD,sDAAsD;AACtD,MAAM,WAAW,kCAAkC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,kCAAkC,KACzC,IA0NF,CAAC"}