@fuzdev/fuz_app 0.135.0 → 0.136.0

package/dist/testing/CLAUDE.md

@@ -99,7 +99,8 @@ mismatch.
 
 ### `audit_drift_guard.ts` — audit-emission validation
 
-- `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts`. Call once at the top of any `describe_db` block firing audit emits — production validation is fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field is silent. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
+- `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks the `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts` and the emitter's write-failure counter (`get_audit_write_failures` in `auth/audit_emitter.ts`). Call once at the top of any `describe_db` block firing audit emits — production validation and the emitter's write are fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field, or losing a row the database refused, is silent. A test that fails a write on purpose resets the counter (`reset_audit_write_failures`) once it has asserted it.
+- `assert_no_audit_drift()` — the zero-check itself, for a test that manages the counters. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
 - `create_recording_audit_emitter(calls_ref?)` — no-op `AuditEmitter` pushing every `emit` and `emit_pool` call into `calls`. Pass `calls_ref` to write into a caller-owned array; omit to let the helper allocate. Returns `{emitter, calls}` — destructure `emitter` as the `audit` dep and read `calls` to assert. `add_listener` records (never fires) and returns a remover with the production semantics, so `listener_count` tracks what a server registered and released. Replaces per-file capturing emitters previously duplicated across `password_change.test.ts`, `audit_log.test.ts`, etc.
 - `RecordingAuditEmitter` — `{emitter: AuditEmitter; calls: Array<AuditLogInput>}`.
 
@@ -223,7 +224,7 @@ test-only by construction.
 
 ### `schema_introspect.ts` — `query_schema_snapshot`
 
-- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema; twin impls keep it identical (same namespaces, names and partitioning), which `query_migration_tracker` + `assert_migration_trackers_equal` gate separately. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
+- `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Throws on pglet when the snapshot holds an index, unless `accept_pglet_index_definitions` is passed: pglet's `indexdef` omits index modifiers, so its index definitions read as false differences against PostgreSQL and false agreement between two pglet schemas. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema; twin impls keep it identical (same namespaces, names and partitioning), which `query_migration_tracker` + `assert_migration_trackers_equal` gate separately. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
 - `SchemaSnapshot` — the Zod schema is canonical (co-located in `schema_introspect.ts`; the cross-impl `_testing_schema_snapshot` RPC action reuses it as its wire validator, and the type is `z.infer`'d from it). Fully JSON-serializable; every collection deterministically sorted on capture so structural equality is stable across runs.
 - `query_migration_tracker(db)` / `MigrationTracker` — the migration-_identity_ twin of the snapshot: reads the `schema_version` tracker rows (`[{namespace, name, sequence}]`) the snapshot deliberately _excludes_. `MigrationTracker` is the `_testing_migration_tracker` RPC's wire validator; pairs with `assert_migration_trackers_equal` to gate that the two spines record byte-identical migration identity (the swap-freely invariant), catching a migration-name or namespace-partitioning drift the provenance-agnostic schema snapshot can't see.
 
@@ -927,7 +928,7 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
-  `account_status` / `oversized_reject_closes_connection` / `peer_request` /
+  `account_status` / `peer_request` /
   `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` —
   each has a `test_if`
   reader (`ws_self_revocation_reply` forks one case's assertion instead); `peer_request` (server-initiated requests — the ActionPeer
@@ -971,18 +972,17 @@ source of truth for wire-shape conformance.
   case — `GET /api/account/status` is bundled into `create_account_route_specs`,
   so every spine serves it (`true`); the gate fails loud if a declaring backend
   doesn't mount it (replacing the old runtime 404-sniff-skip).
-  `oversized_reject_closes_connection` picks the arm of the body-size
-  smuggling probe (`true` Node/Deno/Rust — the connection closes after an
-  oversized-body 413, at once on Node and once the declared body has arrived
-  on Deno, so the pipelined request goes unanswered; `false` Bun —
-  `Bun.serve` keeps the connection and serves the next request, correctly
-  framed, so the suite requires no desync there instead: exactly the 413 and
-  the reply to the pipelined request, which a backend that closes fails).
+  No flag covers the body-size smuggling probe: every backend closes the
+  connection after an oversized-body 413 (at once on Node, Bun and the Rust
+  spine, once the declared body has arrived on Deno), so the pipelined request
+  goes unanswered. Bun 1.4.3 is the tested floor — an older Bun kept the
+  connection and served the next request, correctly framed, and fails the probe.
   `ws_handshake_pipelining` gates the WS round-trip suite's
   frames-with-the-handshake case (`true` Node/Deno/Rust — frames written in the
-  same TCP write as the upgrade request reach the socket; `false` Bun, whose
-  HTTP parser answers such a request `400`, and `false` in-process, where there
-  is no socket to write raw bytes to).
+  same TCP write as the upgrade request reach the socket; `false` Bun, which
+  answers such a request `400` when the upgrade follows an asynchronous check,
+  as it does behind auth, and `false` in-process, where there is no socket to
+  write raw bytes to).
   `ws_account_actions` (the WS endpoint mounts the account actions — `true` on
   fuz_app's own spine presets, `false` in the family defaults) gates the WS
   round-trip suite's self-revocation case and, with `rpc_path`, its
@@ -1345,7 +1345,7 @@ an audit row, an admin account listing, and an offer's `created_at` /
 `expires_at`. `cross_backend/setup.ts` carries the four bases every
 imperative cross suite aliases: `CrossSuiteOptions` (`setup_test` alone),
 `CapabilityGatedCrossSuiteOptions` (+ `capabilities` — `ready`),
-`RpcPathCrossSuiteOptions` (+ `rpc_path?` — origin, body-size, actor
+`RpcPathCrossSuiteOptions` (+ `rpc_path?` — origin, body-size (which adds `base_url`), actor
 lookup/search, app settings, testing backdoor), and the intersection
 `RpcPathCapabilityGatedCrossSuiteOptions` (every `cell_*` suite, query-shape,
 token-scope surface, fact-serving, account lifecycle). A suite takes the
@@ -1358,7 +1358,8 @@ the option type states whether the bundle is read.
   edit/read/delete → 404 IDOR mask; admin reaches any; dup active `path` → 409;
   `path` write by non-admin → 403 on create + update; `cell_get` with no
   id/path → `invalid_params`; null-auth `cell_list` `created_by` →
-  `invalid_params`).
+  `invalid_params`; a `kind` at `CELL_KIND_LENGTH_MAX` stored whole, one
+  UTF-16 code unit past it → `invalid_params` on create and as a list filter).
 - **`describe_cell_relations_cross_tests`** (gates on
   `capabilities.cell_relations`) — the verbs beyond CRUD: grant lifecycle
   (actor-shaped editor grant enables edit, manage-tier `cell_grant_list`,
@@ -1463,6 +1464,21 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   write as the upgrade request, so before the connection can have been
   admitted). Small unfragmented text frames only. Helpers `is_raw_ws_close`,
   `raw_ws_close_code`, `RAW_WS_OPCODE_TEXT` / `_CLOSE`.
+- `testing/transports/raw_http.ts` — `raw_http_exchange(base_url, request_bytes, {read_timeout_ms, until?})`
+  → `RawHttpExchange` (`{received, closed_by_server}`): writes caller-built
+  HTTP/1.1 bytes to a raw `node:net` socket once and reads what the server
+  sends until it closes (`until: 'close'`, the default), until one whole
+  response has arrived (`until: 'response'` — for a server that answers and
+  keeps the connection), or until the read timeout. For what `fetch` can't
+  send: two requests in one write, duplicate or malformed headers, a request
+  head whose body never follows, an unterminated chunked body. Write errors are
+  swallowed, and a write error ends the socket — so a caller that must read a
+  refusal reliably sends nothing the server will leave unread. Helpers
+  `raw_http_parse_response` (the first response, `null` until its head and
+  framed body are whole), `raw_http_count_responses` (unanchored status-line
+  count, so a response concatenated after a body is seen),
+  `raw_http_first_status`. Shared by the body-size, body-size smuggling, and
+  credential-header suites.
 - `testing/transports/sse_frame_reader.ts` — `create_sse_frame_reader(reader, default_timeout_ms?)`,
   the transport-agnostic SSE framing core over a
   `ReadableStreamDefaultReader<Uint8Array>`: `\n\n` framing, per-read timeout,
@@ -1667,8 +1683,9 @@ reads the audit log behind `_testing_drain_effects`). fuz_app's own wiring is
 imperative round-trip on `account_token_create`'s required `lifetime` union:
 a `{kind:'ttl', days}` mint returns and stores a bounded `expires_at`
 (create output + `account_token_list` read-back), `{kind:'eternal'}` stores
-NULL, and an omitted or out-of-range lifetime 400s identically on both
-spines. Exists because the action-manifest parity gate captures no param
+NULL, an omitted or out-of-range lifetime 400s identically on both
+spines, and a `name` at `API_TOKEN_NAME_LENGTH_MAX` mints and reads back whole
+while one UTF-16 code unit past it is `invalid_params`. Exists because the action-manifest parity gate captures no param
 schemas while the Rust spine hand-parses params — a spine that silently
 dropped the field would answer the same mint with a 200 and an eternal
 token; only the stored-state read-back catches it. Ungated (mint + list are
@@ -1705,8 +1722,8 @@ drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 
 `describe_testing_backdoor_cross_tests({setup_test, rpc_path?, ws?})` —
 the negative-credential parity suite for the `_testing_*` backdoor actions.
-For each `_testing_*` action except `_testing_drain_effects` (the privileged
-writes, the connection flood, and the introspection reads) it fires three principals over real HTTP: **anonymous** →
+For each `_testing_*` action (the privileged writes, the audit barrier, the
+connection flood, and the introspection reads) it fires three principals over real HTTP: **anonymous** →
 401 `unauthenticated`, **session** → 403 `forbidden` `credential_type_required`,
 **bearer** → 403 `forbidden` `credential_type_required` — and, when `ws`
 (`{base_url, ws_path, origin?}`) is passed, sends each on a socket opened with

package/dist/testing/audit_drift_guard.d.ts

@@ -1,26 +1,39 @@
 import './assert_dev_env.js';
-import type { AuditEmitter } from '../auth/audit_emitter.js';
+import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { AuditLogInput } from '../auth/audit_log_schema.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
- * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ * entry, an `event_type` not present in the active `AuditLogConfig`, or a
+ * row the emitter failed to write.
  *
  * The production validation in `query_audit_log` is fail-open — it bumps
  * process-wide counters and proceeds, so a regression that emits an
  * undeclared metadata field or a typo'd event-type lands a row that
- * passes downstream queries but breaks forensics. Tests that exercise
- * audit emits should fail loudly when this happens.
+ * passes downstream queries but breaks forensics. The emitter's pool write
+ * is fail-open too: a refused `INSERT` is logged and counted, the request
+ * succeeds, and the row is gone. Tests that exercise audit emits should fail
+ * loudly when either happens.
  *
  * Call at the top of every `describe` / `describe_db` block that fires
  * audit writes through `deps.audit.emit`. Resets counters before each
- * test and asserts zero on completion.
+ * test and asserts zero on completion. A test that makes a write fail on
+ * purpose calls `reset_audit_write_failures` (`auth/audit_emitter.ts`) once
+ * it has asserted the count.
  *
  * Pair with `await_pending_effects: true` (the default for
  * `create_test_app`) so fire-and-forget audit writes have completed by
  * the time the after-each check observes counter state.
  */
 export declare const install_audit_drift_guard: () => void;
+/**
+ * Assert the process-wide audit counters are zero — the check
+ * `install_audit_drift_guard` runs after each test. Exported for a test that
+ * manages the counters itself.
+ *
+ * @throws AssertionError naming the first counter that is not zero
+ */
+export declare const assert_no_audit_drift: () => void;
 /**
  * Pair returned by `create_recording_audit_emitter` — the
  * `AuditEmitter` to inject as `deps.audit`, plus the shared `calls`

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAGN,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAO5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAO,IAgBxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -1,20 +1,26 @@
 import './assert_dev_env.js';
 import { assert, beforeEach, afterEach } from 'vitest';
 import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures } from '../auth/audit_log_queries.js';
+import { get_audit_write_failures, reset_audit_write_failures } from '../auth/audit_emitter.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
- * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ * entry, an `event_type` not present in the active `AuditLogConfig`, or a
+ * row the emitter failed to write.
  *
  * The production validation in `query_audit_log` is fail-open — it bumps
  * process-wide counters and proceeds, so a regression that emits an
  * undeclared metadata field or a typo'd event-type lands a row that
- * passes downstream queries but breaks forensics. Tests that exercise
- * audit emits should fail loudly when this happens.
+ * passes downstream queries but breaks forensics. The emitter's pool write
+ * is fail-open too: a refused `INSERT` is logged and counted, the request
+ * succeeds, and the row is gone. Tests that exercise audit emits should fail
+ * loudly when either happens.
  *
  * Call at the top of every `describe` / `describe_db` block that fires
  * audit writes through `deps.audit.emit`. Resets counters before each
- * test and asserts zero on completion.
+ * test and asserts zero on completion. A test that makes a write fail on
+ * purpose calls `reset_audit_write_failures` (`auth/audit_emitter.ts`) once
+ * it has asserted the count.
  *
  * Pair with `await_pending_effects: true` (the default for
  * `create_test_app`) so fire-and-forget audit writes have completed by
@@ -24,11 +30,21 @@ export const install_audit_drift_guard = () => {
     beforeEach(() => {
         reset_audit_metadata_validation_failures();
         reset_audit_unknown_event_type_failures();
+        reset_audit_write_failures();
     });
-    afterEach(() => {
-        assert.strictEqual(get_audit_metadata_validation_failures(), 0, 'audit metadata failed schema validation — see audit_log_schema.audit_metadata_schemas');
-        assert.strictEqual(get_audit_unknown_event_type_failures(), 0, 'audit emitted an unknown event_type — see AUDIT_EVENT_TYPES');
-    });
+    afterEach(assert_no_audit_drift);
+};
+/**
+ * Assert the process-wide audit counters are zero — the check
+ * `install_audit_drift_guard` runs after each test. Exported for a test that
+ * manages the counters itself.
+ *
+ * @throws AssertionError naming the first counter that is not zero
+ */
+export const assert_no_audit_drift = () => {
+    assert.strictEqual(get_audit_metadata_validation_failures(), 0, 'audit metadata failed schema validation — see audit_log_schema.audit_metadata_schemas');
+    assert.strictEqual(get_audit_unknown_event_type_failures(), 0, 'audit emitted an unknown event_type — see AUDIT_EVENT_TYPES');
+    assert.strictEqual(get_audit_write_failures(), 0, 'an audit row failed to write and was lost — the emitter logged the database error');
 };
 /**
  * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and

package/dist/testing/cross_backend/body_size.d.ts

@@ -2,11 +2,24 @@ import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 /**
  * Options for the body-size parity suite — the standard RPC-dispatched
- * cross-suite shape (`setup_test` / `rpc_path`); aliases the shared
- * `RpcPathCrossSuiteOptions` rather than minting a duplicate. The limit is
- * on every spine, so no case is capability-gated and the flag bundle is not
- * on the shape.
+ * cross-suite shape (`setup_test` / `rpc_path`) plus where the backend's
+ * socket is. The limit is on every spine, so no case is capability-gated and
+ * the flag bundle is not on the shape.
  */
-export type BodySizeCrossTestOptions = RpcPathCrossSuiteOptions;
+export interface BodySizeCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /**
+     * Base URL the spawned backend is reachable at (e.g. `http://localhost:1178`),
+     * or `null` for an in-process run, which has no socket. Given a URL, the
+     * over-cap cases write to the socket directly and send only the bytes the
+     * refusal needs; with `null` they send whole bodies through the fixture's
+     * transport.
+     *
+     * Pass the URL whenever the fixture's transport reaches a real socket.
+     * `null` there uploads each whole over-cap body through `fetch`, where the
+     * write races the close that follows the 413 and the case fails some of the
+     * time.
+     */
+    readonly base_url: string | null;
+}
 export declare const describe_body_size_cross_tests: (options: BodySizeCrossTestOptions) => void;
 //# sourceMappingURL=body_size.d.ts.map

package/dist/testing/cross_backend/body_size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0D9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAmDhE,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA0ClF,CAAC"}
+{"version":3,"file":"body_size.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8F9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACzE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA2HD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAyLlF,CAAC"}

package/dist/testing/cross_backend/body_size.js

@@ -5,11 +5,12 @@ import '../assert_dev_env.js';
  * `create_app_server` (TS) and the Rust spine both cap the request body at a
  * 1 MiB default (`DEFAULT_MAX_BODY_SIZE` / `fuz_http`'s
  * `DEFAULT_BODY_LIMIT_BYTES`) and reject oversized payloads with `413` and the
- * canonical flat REST body `{error: 'payload_too_large'}` — *before* auth,
+ * canonical flat REST body `{error: 'payload_too_large'}`. A declared
+ * `Content-Length` over the cap is refused on the header, *before* auth,
  * origin, or dispatch run (middleware step 4). Each impl unit-tests this in
- * isolation, but nothing fires an oversized POST over the wire, so the
- * cross-impl agreement on the status + body shape (and on the exact `>` cap
- * boundary, not an off-by-one divergence) was unpinned. Three cases:
+ * isolation; this suite pins the cross-impl agreement on the status + body
+ * shape, on the exact `>` cap boundary (not an off-by-one divergence), and on
+ * the cap answering ahead of the origin check and of auth. The cases:
  *
  * - **over-limit POST (cap + 1 byte) → 413** `payload_too_large`, refused
  *   before any handler runs (the limit fires ahead of origin verification + the
@@ -24,17 +25,48 @@ import '../assert_dev_env.js';
  * - **under-limit POST (small) → 200** — a small, well-formed authenticated
  *   `account_verify` envelope sails through to a successful handler response,
  *   the positive control that the route works for normal traffic.
+ * - **over-limit POST with a disallowed `Origin` → 413**, not the origin
+ *   check's 403, and **over-limit POST with no credentials → 413**, not 401:
+ *   the cap answers a declared length ahead of both. The control — the same
+ *   disallowed `Origin` on an under-limit body → 403 `forbidden_origin` —
+ *   shows the origin check still runs.
+ * - **over-limit chunked POST (no `Content-Length`), authenticated → 413** —
+ *   a body with no declared length is refused by the bytes that arrive.
  *
- * **Real-socket connection hazard (cross-process only).** When the server caps
- * the body it answers 413 and closes the connection *before* the client
- * finishes uploading — correct HTTP, since an unread request body can't share a
- * keep-alive socket. The client's pool can then hand that now-dead socket to
- * the very next request (observed as `other side closed`). So every request
- * here goes through `fetch_retrying_once`: a request that inherits the poisoned
- * socket retries onto a fresh connection, which both keeps the suite
- * deterministic *and* evicts the dead socket so it can't strand a later cross
- * suite in the same process. In-process (`app.request`) has no socket, so the
- * hazard is cross-process-only and the retry never fires there.
+ * **Implementation-defined, not pinned here.** Without a declared length the
+ * two spines measure at different points: the TS spine reads the body up to
+ * the cap before any later middleware runs, so its 413 comes ahead of the
+ * origin check and auth; the Rust spine counts as the handler reads, so a
+ * refusal made on the headers (a disallowed `Origin`) answers first and a
+ * handler that never reads the body answers its own status. Only the
+ * authenticated, allowed-origin chunked case — where nothing else refuses —
+ * has one answer on every backend. A repeated `Content-Length` with equal
+ * values is also the implementation's: the TS spine answers 400
+ * `invalid_content_length` where its runtime's parser hands the repeat over,
+ * and hyper folds it into one value and accepts.
+ *
+ * **Over a real socket the over-cap cases send no byte the server won't
+ * read.** A server that caps the body answers 413 and may close the
+ * connection with the rest of the upload unread — correct HTTP, since an
+ * unread request body can't share a keep-alive socket. A client still
+ * uploading then has its write fail (`EPIPE`) and can lose the 413 the server
+ * did send, so a whole over-cap body sent through `fetch` reads its answer
+ * only some of the time. Given a `base_url`, the suite speaks to the socket
+ * directly (`raw_http_exchange`) and holds back what the refusal doesn't need:
+ *
+ * - a **declared** over-cap length is sent as the request head alone —
+ *   `Content-Length` one over the cap and not one body byte. The 413 must
+ *   arrive within `RAW_READ_TIMEOUT_MS`, which also pins that the refusal is
+ *   made on the header: a backend that reads the body before refusing, or has
+ *   no cap, waits for bytes that never come and fails the case.
+ * - the **chunked** body is sent up to one byte past the cap and never
+ *   terminated. The server has read every byte sent by the time it has counted
+ *   past the cap, so nothing is left unread, and the 413 must arrive without
+ *   the body's end.
+ *
+ * With `base_url: null` there is no socket and no such race (the in-process
+ * `app.request`), so the same cases send whole bodies through the fixture's
+ * transport. The under-cap cases go through the transport either way.
  *
  * Like origin/payload rejection, this is middleware-level flat REST — not the
  * JSON-RPC envelope the conformance-table runner expects — so it's an
@@ -51,7 +83,8 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * The shared 1 MiB default both impls ship (`DEFAULT_MAX_BODY_SIZE` in TS,
@@ -78,41 +111,159 @@ const sized_envelope = (id, target_bytes) => {
 };
 /** A small, well-formed nullary `account_verify` body — well under the cap. */
 const small_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
+/** An `Origin` no backend's allowlist admits. */
+const DISALLOWED_ORIGIN = 'http://evil.com';
+/** Chunk size of the streamed over-cap body. */
+const STREAM_CHUNK_BYTES = 64 * 1024;
+/**
+ * A request body of `total_bytes` delivered as a stream, so the request
+ * carries no `Content-Length` (`Transfer-Encoding: chunked` over a socket).
+ * Single-use.
+ */
+const streamed_body = (total_bytes) => {
+    let sent = 0;
+    return new ReadableStream({
+        pull: (controller) => {
+            if (sent >= total_bytes) {
+                controller.close();
+                return;
+            }
+            const size = Math.min(STREAM_CHUNK_BYTES, total_bytes - sent);
+            sent += size;
+            controller.enqueue(new Uint8Array(size).fill(0x78));
+        }
+    });
+};
 /**
- * Issue a request, retrying once if the call *throws* (vs. returning a
- * response). A request handed the keep-alive socket the server closed on an
- * oversized-body rejection fails at the transport layer before any response;
- * one retry opens a fresh connection (and drops the dead socket from the
- * pool). Keyed on "threw at all" rather than a specific error code so it holds
- * across the node / deno / bun cross runtimes, which surface different errors.
+ * How long a raw over-cap exchange waits for the refusal. The server has every
+ * byte it will get when the wait starts, so a backend that refuses on what it
+ * has answers at once and one that waits for more runs the whole window.
  */
-const fetch_retrying_once = async (transport, path, init) => {
+const RAW_READ_TIMEOUT_MS = 2000;
+const to_sized_response = async (res) => ({
+    status: res.status,
+    body: await res.json().catch(() => undefined)
+});
+const parse_json = (text) => {
     try {
-        return await transport(path, init);
+        return JSON.parse(text);
     }
     catch {
-        return await transport(path, init);
+        return undefined;
     }
 };
+/** Render request headers as raw header lines. */
+const to_header_lines = (headers) => Object.entries(headers)
+    .map(([name, value]) => `${name}: ${value}\r\n`)
+    .join('');
+/**
+ * Write `request_bytes` to the backend's socket and read the one response it
+ * must answer with — without being sent anything more.
+ *
+ * @param withheld - what the request leaves unsent, for the failure message
+ */
+const exchange_withholding = async (base_url, request_bytes, withheld) => {
+    const { received, closed_by_server } = await raw_http_exchange(base_url, request_bytes, {
+        read_timeout_ms: RAW_READ_TIMEOUT_MS,
+        until: 'response'
+    });
+    const response = raw_http_parse_response(received);
+    assert.ok(response, `expected a whole response with ${withheld} withheld; ` +
+        (closed_by_server
+            ? `the server closed the connection first`
+            : `none arrived within ${RAW_READ_TIMEOUT_MS}ms — the backend is waiting for bytes ` +
+                `it should refuse without`) +
+        `. Received: ${received ? received.slice(0, 120) : 'nothing'}`);
+    return { status: response.status, body: parse_json(response.body) };
+};
+/** Assert a response is the canonical over-cap refusal. */
+const assert_payload_too_large = (res, message) => {
+    assert.strictEqual(res.status, 413, message);
+    assert.strictEqual(res.body?.error, ERROR_PAYLOAD_TOO_LARGE);
+};
 export const describe_body_size_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    /** POST `body` to the RPC path as the keeper, retry-once on a dead socket. */
-    const post = (fixture, body) => fetch_retrying_once(fixture.transport, rpc_path, {
+    /** POST `body` to the RPC path as the keeper. */
+    const post = (fixture, body) => fixture.transport(rpc_path, {
         method: 'POST',
         headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
         body
     });
+    /**
+     * POST with a declared `Content-Length` one byte over the cap. Over a
+     * socket only the head is sent; in-process, the whole body.
+     *
+     * `headers` carries the credential and any `Origin`, which defaults to the
+     * backend's own. `anonymous` picks the cookie-jar-free transport in-process;
+     * a raw head carries only what `headers` names either way.
+     */
+    const post_over_limit_declared = async (fixture, request) => {
+        const { id, headers, anonymous } = request;
+        const content_length = BODY_LIMIT_DEFAULT_BYTES + 1;
+        if (base_url === null) {
+            const transport = anonymous ? fixture.fresh_transport() : fixture.transport;
+            return to_sized_response(await transport(rpc_path, {
+                method: 'POST',
+                headers: { ...headers, 'content-type': 'application/json' },
+                body: sized_envelope(id, content_length)
+            }));
+        }
+        const url = new URL(base_url);
+        return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
+            to_header_lines({
+                host: url.host,
+                origin: url.origin,
+                ...headers,
+                'content-type': 'application/json',
+                'content-length': String(content_length)
+            }) +
+            `\r\n`, 'the declared body');
+    };
+    /**
+     * POST a chunked body past the cap as the keeper. Over a socket the body
+     * stops one byte past the cap, unterminated; in-process, a whole streamed
+     * body runs past it.
+     */
+    const post_over_limit_chunked = async (fixture) => {
+        if (base_url === null) {
+            return to_sized_response(await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+                body: streamed_body(BODY_LIMIT_DEFAULT_BYTES + 1024),
+                // a streamed request body needs half-duplex `fetch`
+                duplex: 'half'
+            }));
+        }
+        const url = new URL(base_url);
+        // whole chunks up to exactly the cap, then a one-byte chunk's size line
+        // and its byte — and neither that chunk's closing CRLF nor the
+        // terminating chunk, so the last byte sent is the first one past the cap
+        const whole_chunk = `${STREAM_CHUNK_BYTES.toString(16)}\r\n${'x'.repeat(STREAM_CHUNK_BYTES)}\r\n`;
+        return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
+            to_header_lines({
+                host: url.host,
+                origin: url.origin,
+                ...fixture.create_session_headers(),
+                'content-type': 'application/json',
+                'transfer-encoding': 'chunked'
+            }) +
+            `\r\n` +
+            whole_chunk.repeat(BODY_LIMIT_DEFAULT_BYTES / STREAM_CHUNK_BYTES) +
+            `1\r\nx`, `the chunked body's end`);
+    };
     describe('body-size limit parity', () => {
         test('over-limit POST (cap + 1) → 413 payload_too_large (refused before dispatch)', async () => {
             const fixture = await setup_test();
-            // Keeper session cookie + the transport's default allowed Origin, so
-            // neither auth nor origin is the cause — only the body size. One byte
-            // over the cap: both impls reject on a strict `>`.
-            const res = await post(fixture, sized_envelope('over-limit', BODY_LIMIT_DEFAULT_BYTES + 1));
-            assert.strictEqual(res.status, 413, 'a body one byte over the cap must be rejected with 413');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_PAYLOAD_TOO_LARGE);
+            // Keeper session cookie + the default allowed Origin, so neither auth
+            // nor origin is the cause — only the size. One byte over the cap: both
+            // impls reject on a strict `>`.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit',
+                headers: fixture.create_session_headers(),
+                anonymous: false
+            });
+            assert_payload_too_large(res, 'a body one byte over the cap must be rejected with 413');
         });
         test('at-limit POST (exactly the cap) → not size-rejected', async () => {
             const fixture = await setup_test();
@@ -130,5 +281,53 @@ export const describe_body_size_cross_tests = (options) => {
             const res = await post(fixture, small_envelope('under-limit'));
             assert.strictEqual(res.status, 200, 'an under-limit authenticated request must pass');
         });
+        test('over-limit POST with a disallowed Origin → 413, not 403', async () => {
+            const fixture = await setup_test();
+            // Keeper session + a rogue Origin: the origin check would answer 403,
+            // and the cap, which reads only the declared length, answers first.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit-evil-origin',
+                headers: { ...fixture.create_session_headers(), origin: DISALLOWED_ORIGIN },
+                anonymous: false
+            });
+            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of the origin check');
+        });
+        test('under-limit POST with a disallowed Origin → 403 forbidden_origin', async () => {
+            const fixture = await setup_test();
+            // The control for the case above: the same request minus the size is
+            // refused by the origin check, so the 413 there is the cap answering
+            // first, not the origin check being absent.
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: {
+                    ...fixture.create_session_headers(),
+                    origin: DISALLOWED_ORIGIN,
+                    'content-type': 'application/json'
+                },
+                body: small_envelope('under-limit-evil-origin')
+            });
+            assert.strictEqual(res.status, 403, 'a disallowed Origin on an under-limit body is refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test('over-limit POST with no credentials → 413, not 401', async () => {
+            const fixture = await setup_test();
+            // No cookie, no token: the dispatcher would answer 401, and the cap
+            // answers first.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit-anonymous',
+                headers: {},
+                anonymous: true
+            });
+            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of auth');
+        });
+        test('over-limit chunked POST (no Content-Length), authenticated → 413', async () => {
+            const fixture = await setup_test();
+            // Keeper session + the default allowed Origin, so nothing but the size
+            // refuses. No declared length for the header check to read, so the
+            // refusal is by the bytes that arrive.
+            const res = await post_over_limit_chunked(fixture);
+            assert_payload_too_large(res, 'a chunked body past the cap must be rejected with 413 when nothing else refuses');
+        });
     });
 };

package/dist/testing/cross_backend/body_size_smuggling.d.ts

@@ -5,18 +5,6 @@ export interface BodySizeSmugglingCrossTestOptions {
     readonly base_url: string;
     /** RPC endpoint path to target. Default `/api/rpc`. */
     readonly rpc_path?: string;
-    /**
-     * Whether the backend closes the connection after an oversized-body `413`
-     * (`capabilities.oversized_reject_closes_connection`). `true` (default)
-     * requires that the pipelined GET goes unanswered — at most one response.
-     * `false` (Bun) requires no desync instead: exactly two well-formed
-     * responses, the 413 and one matching what the backend answers that GET
-     * sent alone — so `rpc_path` must answer a bare `GET` with a stable status
-     * and body, and a backend that closes after the 413 fails. Default `true`
-     * so a consumer that leaves the flag out fails loud on a backend that
-     * keeps the connection.
-     */
-    readonly closes_connection?: boolean;
 }
 export declare const describe_body_size_smuggling_cross_tests: (options: BodySizeSmugglingCrossTestOptions) => void;
 //# sourceMappingURL=body_size_smuggling.d.ts.map

package/dist/testing/cross_backend/body_size_smuggling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAkGD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA0GF,CAAC"}
+{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAWD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4GF,CAAC"}