@fuzdev/fuz_app 0.135.0 → 0.136.0

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -10,38 +10,42 @@ import '../assert_dev_env.js';
  * body bytes would be parsed as the start of the next request — a classic
  * request-smuggling vector. This suite probes the boundary by **pipelining**:
  * it opens a raw TCP socket and sends, in one write, an oversized `POST`
- * immediately followed by a second `GET`. What it requires forks on the
- * backend's declared `oversized_reject_closes_connection` capability:
+ * immediately followed by a second `GET`. Every backend must close after the
+ * reject, so the pipelined GET goes unanswered and **at most one** response
+ * comes back. `<= 1` rather than "exactly the 413" because the impls close
+ * differently at the TCP level (a graceful close delivers the 413 first;
+ * hyper's RST can drop the in-flight 413 before the client reads it), so
+ * demanding a cleanly-read 413 would be flaky.
  *
- * - **Closes (Node / Deno / hyper)** — the pipelined GET goes unanswered, so
- *   **at most one** response comes back. `<= 1` rather than "exactly the 413"
- *   because the impls close differently at the TCP level (a graceful close
- *   delivers the 413 first; hyper's RST can drop the in-flight 413 before the
- *   client reads it), so demanding a cleanly-read 413 would be flaky. Node
- *   closes at once with the body unread — `create_app_server`'s body limit
- *   (`http/body_limit.ts`) refuses on the header and answers
- *   `Connection: close`, which is what makes `@hono/node-server` close. Deno
- *   closes once the whole declared body has arrived, which this probe's
- *   single write delivers; a client that withholds the body holds a Deno
- *   connection open, and no request behind the body is served either way.
- * - **Keeps the connection (Bun)** — `Bun.serve` sends that same 413, header
- *   included, then keeps the socket open, skips the declared body, and serves
- *   the GET. This is not a smuggle — the GET is delimited by the POST's
- *   `Content-Length`, not carved out of the body — so the property held here
- *   is **no desync**: the bytes read back are **exactly two** well-formed
- *   responses, the first the 413 and the second the same status and body the
- *   backend gives that GET on a connection of its own. Body bytes parsed as a
- *   request would show up as a different second response or as extra ones.
- *   Fewer than two fails too, with a message naming the capability: a backend
- *   on this arm that closes after the 413 belongs on the other one.
+ * - **Node** closes at once with the body unread — `create_app_server`'s body
+ *   limit (`http/body_limit.ts`) refuses on the header and answers
+ *   `Connection: close`, which is what makes `@hono/node-server` close.
+ * - **Bun** closes at once too, honouring that header. Bun 1.4.3 is the tested
+ *   floor: an older Bun kept the connection after the 413 and served the next
+ *   request (correctly framed), which fails this suite.
+ * - **Deno** closes once the whole declared body has arrived, which this
+ *   probe's single write delivers; a client that withholds the body holds a
+ *   Deno connection open, and no request behind the body is served either way.
+ * - **hyper** (the Rust spine) closes at once.
  *
  * The oversized body is rejected *with* a 413 on every backend — pinned
- * reliably over `fetch` by `describe_body_size_cross_tests`; this test owns
+ * reliably by `describe_body_size_cross_tests`, which sends the over-cap
+ * request's head and no body, so no upload races the close; this test owns
  * only the connection-handling half. A **positive control** (two pipelined
  * requests → `>= 2` responses) proves a second response *would* be seen if a
- * trailing request were processed — without it the close-posture `<= 1` would
- * be vacuous on a server that never reuses connections — and that the counter
- * isn't undercounting.
+ * trailing request were processed — without it `<= 1` would be vacuous on a
+ * server that never reuses connections — and that the counter isn't
+ * undercounting.
+ *
+ * **`Content-Length` beside `Transfer-Encoding`.** The second probe sends a
+ * request carrying both headers — the shape a request-smuggling attack hands a
+ * server and a proxy that disagree on which one frames the body — with a
+ * `GET` pipelined behind it. What the backends share is the outcome, not the
+ * status: the request is refused with `400` (the Node, Deno and Bun parsers)
+ * or answered as its chunked body reads (hyper, which drops the
+ * `Content-Length`), and either way the server **closes the connection** and
+ * the pipelined request is **never served**. The status of the one response
+ * is implementation-defined and not asserted.
  *
  * Raw-socket by necessity (the `FetchTransport` can't pipeline two requests on
  * one connection), so — unlike `body_size.ts` — this is **cross-process only**
@@ -54,107 +58,32 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
+import { raw_http_count_responses, raw_http_exchange } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
 const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
 /**
- * How long each raw exchange waits for the server to finish answering. A
- * backend that keeps the connection never closes it, so its exchange runs the
- * whole window.
+ * How long each raw exchange waits for the server to finish answering. An
+ * exchange the backend does not end by closing runs the whole window.
  */
 const RAW_READ_TIMEOUT_MS = 2000;
-/**
- * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
- * everything the server sends back until it closes the connection or
- * `read_timeout_ms` elapses. Write errors are swallowed: the server closing
- * mid-upload (the correct response to an oversized body) surfaces as
- * `EPIPE`/`ECONNRESET` on our unfinished write, which is exactly the behavior
- * under test — what matters is what we *read back*.
- */
-const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
-    const url = new URL(base_url);
-    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
-    const socket = connect({ host: url.hostname, port });
-    let received = '';
-    let settled = false;
-    const finish = () => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        resolve(received);
-    };
-    const timer = setTimeout(finish, read_timeout_ms);
-    socket.setEncoding('latin1');
-    socket.on('connect', () => socket.write(request_bytes));
-    socket.on('data', (chunk) => {
-        received += chunk;
-    });
-    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
-    socket.on('close', finish);
-});
-/**
- * Count HTTP response status lines in a raw byte stream. Deliberately
- * **unanchored** (no `^`/`m`): a second pipelined response is concatenated
- * straight after the first response's body, which carries no trailing newline,
- * so a line-anchored match would miss it — and missing a smuggled second
- * response is a silent false negative. No response header or JSON error body
- * contains the literal `HTTP/1.x NNN`, so an unanchored match counts exactly
- * the status lines. The positive control below proves this counts 2 when the
- * server genuinely returns 2.
- */
-const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
-/**
- * Split a raw byte stream into the HTTP responses it holds, each framed on
- * its own `Content-Length` (a response without one runs to the end of the
- * stream). The stream is `latin1`-decoded, so a character is a byte.
- *
- * @returns the responses in order, or `null` when the bytes are not a
- * sequence of whole responses — text where a status line belongs, a head
- * with no end, a body shorter than its declared length
- */
-const parse_responses = (raw) => {
-    const responses = [];
-    let offset = 0;
-    while (offset < raw.length) {
-        const head_end = raw.indexOf('\r\n\r\n', offset);
-        if (head_end === -1)
-            return null;
-        const [status_line, ...header_lines] = raw.slice(offset, head_end).split('\r\n');
-        const status_match = /^HTTP\/1\.[01] (\d{3})(?: |$)/.exec(status_line);
-        if (!status_match)
-            return null;
-        const body_start = head_end + 4;
-        const length_line = header_lines.find((line) => /^content-length:/i.test(line));
-        const body_end = length_line === undefined
-            ? raw.length
-            : body_start + Number.parseInt(length_line.slice(length_line.indexOf(':') + 1), 10);
-        // also false for a `NaN` length
-        if (!(body_end >= body_start && body_end <= raw.length))
-            return null;
-        responses.push({ status: Number(status_match[1]), body: raw.slice(body_start, body_end) });
-        offset = body_end;
-    }
-    return responses;
-};
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    const closes_connection = options.closes_connection ?? true;
     const host = new URL(base_url).host;
     describe('body-size limit — request-smuggling resistance', () => {
         // Positive control: prove the server returns >1 response on a single
         // connection. Without this the smuggling assertion below would be
         // vacuously green on a server that simply never reuses connections — and
-        // it also validates `count_responses` actually counts a second response.
+        // it also validates `raw_http_count_responses` actually counts a second response.
         test('control: two pipelined requests → ≥2 responses (connection reuse is real)', async () => {
             const two_requests = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n` +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
-            const response = await send_raw(base_url, two_requests, RAW_READ_TIMEOUT_MS);
-            const n = count_responses(response);
+            const { received: response } = await raw_http_exchange(base_url, two_requests, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS
+            });
+            const n = raw_http_count_responses(response);
             assert.ok(n >= 2, `expected ≥2 responses on one keep-alive connection (got ${n}); without ` +
                 `connection reuse — or with an undercounting matcher — the smuggling ` +
                 `assertion below is not a real signal. Raw head: ${response.slice(0, 120)}`);
@@ -171,43 +100,59 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
                 `\r\n` +
                 'x'.repeat(oversized_len) +
                 pipelined_get;
-            const response = await send_raw(base_url, payload, RAW_READ_TIMEOUT_MS);
-            const n = count_responses(response);
-            if (closes_connection) {
-                // The reject closes the connection, so the pipelined GET is never
-                // reached — **at most one** response comes back (the 413, or none if
-                // the close raced the read). A *second* response means the connection
-                // was kept and the GET served. The control above proves a second
-                // response *would* be seen, so `<= 1` is a real signal.
-                assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
-                    `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
-                return;
-            }
-            // The backend keeps the connection (Bun): the 413, then its answer to
-            // the GET, and nothing else. Hold it to **no desync** — the body bytes
-            // were skipped as a body, never parsed as a request.
-            assert.ok(n >= 2, `expected two responses (the 413 + the reply to the pipelined GET) from a ` +
-                `backend declared to keep the connection after an oversized-body 413. Saw ` +
-                `${n} within ${RAW_READ_TIMEOUT_MS}ms. If this backend closes the connection ` +
-                `after the 413, declare \`oversized_reject_closes_connection: true\` for it ` +
-                `(this suite's \`closes_connection\`). Raw head: ${response.slice(0, 120)}`);
-            assert.ok(n <= 2, `expected exactly two responses (the 413 + one reply to the pipelined GET); ` +
-                `more means the oversized body was parsed as requests (a desync). ` +
-                `Saw ${n}. Raw head: ${response.slice(0, 120)}`);
-            const responses = parse_responses(response);
-            assert.ok(responses !== null, `expected the bytes read back to be whole HTTP responses, each framed on its ` +
-                `Content-Length. Raw head: ${response.slice(0, 240)}`);
-            assert.strictEqual(responses.length, n, `expected one status line per framed response; a difference means a status ` +
-                `line sits inside another response's body. Raw head: ${response.slice(0, 240)}`);
-            const [first, second] = responses;
-            assert.strictEqual(first.status, 413, 'the first response is the oversized reject');
-            // A request carved out of the body would not be this GET, so the reply
-            // must be the one the same GET gets on its own connection.
-            const alone = parse_responses(await send_raw(base_url, `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`, RAW_READ_TIMEOUT_MS));
-            assert.ok(alone?.length === 1, 'expected one response to the GET sent alone');
-            assert.deepStrictEqual(second, alone[0], `expected the second response to be the backend's reply to the pipelined ` +
-                `GET (same status and body as that GET sent alone); anything else means ` +
-                `the bytes after the 413 were not framed as that request`);
+            const { received: response } = await raw_http_exchange(base_url, payload, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS
+            });
+            const n = raw_http_count_responses(response);
+            // The reject closes the connection, so the pipelined GET is never
+            // reached — **at most one** response comes back (the 413, or none if
+            // the close raced the read). A *second* response means the connection
+            // was kept and the GET served. The control above proves a second
+            // response *would* be seen, so `<= 1` is a real signal.
+            assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
+                `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
         });
+        // A request carrying both `Content-Length` and `Transfer-Encoding`, with
+        // a GET pipelined behind it. The body is a small JSON-RPC envelope,
+        // chunked and terminated, so a backend that frames on
+        // `Transfer-Encoding` reads a whole request. `Content-Length` disagrees
+        // with the chunked length in both cases: framing on it instead would
+        // leave body bytes to be parsed as the next request.
+        const envelope = JSON.stringify({ jsonrpc: '2.0', id: 'cl-te', method: 'heartbeat' });
+        const chunked_envelope = `${envelope.length.toString(16)}\r\n${envelope}\r\n0\r\n\r\n`;
+        const framing_cases = [
+            [
+                'Content-Length ahead of Transfer-Encoding',
+                `Content-Length: 5\r\nTransfer-Encoding: chunked\r\n`
+            ],
+            [
+                'Transfer-Encoding ahead of Content-Length',
+                `Transfer-Encoding: chunked\r\nContent-Length: 5\r\n`
+            ]
+        ];
+        for (const [name, framing_headers] of framing_cases) {
+            test(`${name} + pipelined GET → connection closed, GET never served`, async () => {
+                const payload = `POST ${rpc_path} HTTP/1.1\r\n` +
+                    `Host: ${host}\r\n` +
+                    `Content-Type: application/json\r\n` +
+                    framing_headers +
+                    `\r\n` +
+                    chunked_envelope +
+                    `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
+                const { received, closed_by_server } = await raw_http_exchange(base_url, payload, {
+                    read_timeout_ms: RAW_READ_TIMEOUT_MS
+                });
+                const n = raw_http_count_responses(received);
+                // Refused with 400 or answered — the status is the implementation's.
+                // A second response is the pipelined GET served on a connection the
+                // ambiguous request should have ended.
+                assert.ok(n <= 1, `expected at most one response to a request carrying both Content-Length ` +
+                    `and Transfer-Encoding (the pipelined GET must not be served). Saw ${n}. ` +
+                    `Raw head: ${received.slice(0, 120)}`);
+                assert.ok(closed_by_server, `expected the server to close the connection after a request carrying both ` +
+                    `Content-Length and Transfer-Encoding; it was still open after ` +
+                    `${RAW_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
+            });
+        }
     });
 };

package/dist/testing/cross_backend/capabilities.d.ts

@@ -122,28 +122,6 @@ export interface BackendCapabilities {
      * explicitly (a backend that deliberately omits the route).
      */
     readonly account_status: boolean;
-    /**
-     * After an oversized-body `413` the backend **closes the connection**, so a
-     * request that follows on the same connection is never served. Read by
-     * `describe_body_size_smuggling_cross_tests`, which pipelines a `GET` behind
-     * an oversized `POST`: with it `true` the `GET` must go unanswered (at most
-     * one response); with it `false` the suite requires **exactly two**
-     * responses — the 413, then the backend's own answer to that `GET`, which
-     * shows the next request was framed on `Content-Length` and the body bytes
-     * were not parsed as a request. Fewer than two fails as well: a backend
-     * declared `false` that closes after the 413 fails the suite until the flag
-     * is flipped to `true`.
-     *
-     * `true` for Node (closes at once, the body unread), Deno (closes once the
-     * declared body has arrived — observed on Deno 2.8.3) and the Rust spine
-     * (hyper closes at once); `false` for Bun. `Bun.serve` sends the 413
-     * with its `Connection: close` header and then keeps the connection open,
-     * skips the declared body, and serves the request after it — observed on
-     * Bun 1.3.11, whatever the handler does with the request body. Requests
-     * stay correctly framed there; what is missing is the close. See
-     * `docs/security.md` §"Body Size Limiting".
-     */
-    readonly oversized_reject_closes_connection: boolean;
     /**
      * The backend can **initiate** a JSON-RPC request to a connected client
      * and await its typed reply (the server→client request/response direction
@@ -174,8 +152,9 @@ export interface BackendCapabilities {
      * anything.
      *
      * `true` for Node (`ws`), Deno, and the Rust spine (hyper hands the
-     * leftover bytes to the upgraded stream); `false` for Bun, whose HTTP
-     * parser answers such a request `400` before any handler runs. A backend
+     * leftover bytes to the upgraded stream); `false` for a Bun backend that
+     * upgrades after an asynchronous check, as one behind auth does — `Bun.serve`
+     * answers such a request `400` (observed on Bun 1.4.3). A backend
      * without it still runs the suite's client-library case (requests sent the
      * moment the socket opens), which pins the same contract without forcing
      * the ordering.

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAuBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -22,8 +22,7 @@ import '../assert_dev_env.js';
  *   a capability is a compile error until each family declares it).
  * - `ts_spine_capabilities` / `ts_spine_bun_capabilities` — fuz_app's own TS
  *   spine presets, in `ts_spine_backend_config.ts` (deltas off the family
- *   default; Bun flips `oversized_reject_closes_connection` and
- *   `ws_handshake_pipelining`).
+ *   default; Bun flips `ws_handshake_pipelining`).
  * - `rust_spine_stub_capabilities` — fuz_app's Rust spine-stub preset, in
  *   `rust_spine_stub_backend_config.ts` (delta off the rust family default).
  *
@@ -61,8 +60,6 @@ export const in_process_capabilities = Object.freeze({
     fact_serving: true,
     ready: true,
     account_status: true,
-    // Nothing reads it in-process: the smuggling probe needs a real socket.
-    oversized_reject_closes_connection: true,
     peer_request: false,
     // Cross-process-only, like `peer_request`: the case needs a real bound socket
     // to write raw bytes to.

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA+cF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6fF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -32,7 +32,10 @@ import '../assert_dev_env.js';
  *   `kind` inside `data` still gets the authz error (404 / 403), never the
  *   kind error — authz runs before the input-shape checks, on both spines;
  * - an empty-string `kind` is rejected on create (`cell_kind_empty`) and is
- *   accepted as a list filter that matches nothing.
+ *   accepted as a list filter that matches nothing;
+ * - a `kind` of exactly `CELL_KIND_LENGTH_MAX` UTF-16 code units is stored
+ *   whole, and one unit past it is `invalid_params` on create and as a list
+ *   filter.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -42,7 +45,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
@@ -239,5 +242,31 @@ export const describe_cell_crud_cross_tests = (options) => {
             const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind: '' }, owner_headers), CellListOutput);
             assert.ok(!listed.cells.some((c) => c.id === note.id), 'empty-kind filter matched a non-empty-kind cell');
         });
+        test_if(capabilities.cell_crud, 'kind length cap: stored whole at the cap; one unit past it is invalid_params on create and list', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_kind_cap' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            // an astral character costs two UTF-16 code units on both spines
+            const astral_at_cap = '\u{1F600}'.repeat(CELL_KIND_LENGTH_MAX / 2);
+            for (const kind of ['k'.repeat(CELL_KIND_LENGTH_MAX), astral_at_cap]) {
+                assert.strictEqual(kind.length, CELL_KIND_LENGTH_MAX);
+                const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind, data: {} }, owner_headers), CellCreateOutput).cell;
+                assert.strictEqual(created.kind, kind, 'a kind at the cap must be stored whole');
+                const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { kind }, owner_headers), CellListOutput);
+                assert.ok(listed.cells.some((c) => c.id === created.id), 'a kind filter at the cap must match the cell that carries it');
+            }
+            for (const kind of ['k'.repeat(CELL_KIND_LENGTH_MAX + 1), astral_at_cap + 'k']) {
+                for (const [method, params] of [
+                    ['cell_create', { kind, data: {} }],
+                    ['cell_list', { kind }]
+                ]) {
+                    const refused = await cross_rpc_call(t, rpc_path, method, params, owner_headers);
+                    assert.ok(!refused.ok, `${method} admitted a ${kind.length}-unit kind`);
+                    assert.strictEqual(refused.error?.code, -32602);
+                    assert.strictEqual(error_reason(refused), undefined, 'a schema refusal carries no reason');
+                }
+            }
+        });
     });
 };

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -92,12 +92,12 @@ import { z } from 'zod';
 export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
+    anonymous: "anonymous";
     daemon: "daemon";
     invalid_daemon: "invalid_daemon";
     daemon_browser: "daemon_browser";
     bearer_browser: "bearer_browser";
     scoped_token: "scoped_token";
-    anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
     wrong_role: "wrong_role";
@@ -122,12 +122,12 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
     as: z.ZodEnum<{
         keeper: "keeper";
         token: "token";
+        anonymous: "anonymous";
         daemon: "daemon";
         invalid_daemon: "invalid_daemon";
         daemon_browser: "daemon_browser";
         bearer_browser: "bearer_browser";
         scoped_token: "scoped_token";
-        anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
         wrong_role: "wrong_role";
@@ -179,12 +179,12 @@ export declare const ConformanceCase: z.ZodObject<{
         as: z.ZodEnum<{
             keeper: "keeper";
             token: "token";
+            anonymous: "anonymous";
             daemon: "daemon";
             invalid_daemon: "invalid_daemon";
             daemon_browser: "daemon_browser";
             bearer_browser: "bearer_browser";
             scoped_token: "scoped_token";
-            anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";
             wrong_role: "wrong_role";

package/dist/testing/cross_backend/credential_header_robustness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyD9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAwFD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}
+{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAgDD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -46,55 +46,19 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
+import { raw_http_count_responses, raw_http_exchange, raw_http_first_status } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /** A value that is never a real credential — used for the conflicting / garbage copies. */
 const GARBAGE_TOKEN = 'not-a-real-credential-value';
-/**
- * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
- * everything the server sends back until it closes or `read_timeout_ms`
- * elapses. Write errors are swallowed (a server closing mid-write on a rejected
- * request is expected behavior); what matters is what we read back. Mirrors
- * `body_size_smuggling.ts`'s `send_raw`.
- */
-const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
-    const url = new URL(base_url);
-    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
-    const socket = connect({ host: url.hostname, port });
-    let received = '';
-    let settled = false;
-    const finish = () => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        resolve(received);
-    };
-    const timer = setTimeout(finish, read_timeout_ms);
-    socket.setEncoding('latin1');
-    socket.on('connect', () => socket.write(request_bytes));
-    socket.on('data', (chunk) => {
-        received += chunk;
-    });
-    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
-    socket.on('close', finish);
-});
-/**
- * Count HTTP response status lines in a raw byte stream. Unanchored so a
- * second (smuggled) response concatenated after the first body — which carries
- * no trailing newline — is still counted; see `body_size_smuggling.ts`.
- */
-const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
-/** The status code of the first HTTP response in a raw stream, or `null` if none. */
-const first_status = (raw) => {
-    const match = /HTTP\/1\.[01] (\d{3})/.exec(raw);
-    return match ? Number(match[1]) : null;
-};
+/** How long each raw exchange waits for the server to finish answering. */
+const RAW_READ_TIMEOUT_MS = 2000;
+/** Write `request_bytes` to a fresh raw socket and read until the server closes. */
+const send_raw = async (base_url, request_bytes) => (await raw_http_exchange(base_url, request_bytes, { read_timeout_ms: RAW_READ_TIMEOUT_MS }))
+    .received;
 const is_success_status = (status) => status >= 200 && status < 300;
 /**
  * Frame a raw HTTP/1.1 POST with the given extra header lines + JSON body.
@@ -124,18 +88,18 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
     describe('credential-header robustness', () => {
         test('duplicate X-Daemon-Token (valid + conflicting) never escalates → one non-2xx response', async () => {
             const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${daemon_token}`, `${DAEMON_TOKEN_HEADER}: ${GARBAGE_TOKEN}`], purge_body('dup-daemon'));
-            const raw = await send_raw(base_url, req, 2000);
-            assert.strictEqual(count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
-            const status = first_status(raw);
+            const raw = await send_raw(base_url, req);
+            assert.strictEqual(raw_http_count_responses(raw), 1, `a duplicated X-Daemon-Token must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = raw_http_first_status(raw);
             assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
             assert.ok(!is_success_status(status), `a duplicated daemon token must not perform a keeper operation; whichever copy wins, ` +
                 `the result must be non-2xx (got ${status})`);
         });
         test('duplicate Authorization bearer headers (both garbage) do not authenticate → one non-2xx response', async () => {
             const req = rpc_post(host, rpc_path, [`Authorization: Bearer ${GARBAGE_TOKEN}`, `Authorization: Bearer ${GARBAGE_TOKEN}-2`], purge_body('dup-bearer'));
-            const raw = await send_raw(base_url, req, 2000);
-            assert.strictEqual(count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
-            const status = first_status(raw);
+            const raw = await send_raw(base_url, req);
+            assert.strictEqual(raw_http_count_responses(raw), 1, `duplicate Authorization headers must yield exactly one response (no desync). Raw head: ${raw.slice(0, 120)}`);
+            const status = raw_http_first_status(raw);
             assert.ok(status !== null, `expected an HTTP response. Raw head: ${raw.slice(0, 120)}`);
             assert.ok(!is_success_status(status), `garbage bearer tokens (even duplicated) must not authenticate (got ${status})`);
         });
@@ -154,10 +118,10 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
             ];
             for (const { label, value } of malformed) {
                 const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${value}`], purge_body('ctrl-char'));
-                const raw = await send_raw(base_url, req, 2000);
-                assert.ok(count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
+                const raw = await send_raw(base_url, req);
+                assert.ok(raw_http_count_responses(raw) <= 1, `${label}: a control-char-injected credential header must not frame a second ` +
                     `request (no smuggle). Raw head: ${raw.slice(0, 120)}`);
-                const status = first_status(raw);
+                const status = raw_http_first_status(raw);
                 assert.ok(status === null || !is_success_status(status), `${label}: a malformed credential header must never authenticate (got ${status})`);
             }
         });
@@ -166,12 +130,12 @@ export const describe_credential_header_robustness_cross_tests = (options) => {
             // rejected (4xx / 431 / connection close). Its own outcome is don't-care.
             const oversized = 'a'.repeat(64 * 1024);
             const req = rpc_post(host, rpc_path, [`${DAEMON_TOKEN_HEADER}: ${oversized}`], purge_body('oversized'));
-            await send_raw(base_url, req, 2000);
+            await send_raw(base_url, req);
             // The property: the server survives it. A normal request on a fresh
             // connection must still get a response (no crash, no wedged accept loop).
             const probe = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
-            const raw = await send_raw(base_url, probe, 2000);
-            assert.ok(first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
+            const raw = await send_raw(base_url, probe);
+            assert.ok(raw_http_first_status(raw) !== null, `server must still respond after an oversized-header request (no crash / wedge). Raw head: ${raw.slice(0, 120)}`);
         });
     });
 };

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAmCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA6BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -32,10 +32,6 @@ export const ts_default_capabilities = Object.freeze({
     // `GET /api/account/status` is bundled into `create_account_route_specs`, so
     // every TS backend mounting account routes serves it.
     account_status: true,
-    // Node and Deno close the connection after an oversized-body `413`. A
-    // Bun-served consumer overrides to `false` (see the bun spine config) —
-    // `Bun.serve` keeps the connection and serves the next request.
-    oversized_reject_closes_connection: true,
     // Off by default like `sse`/`ready`: the WS backend transport *can* initiate
     // server→client requests (`BackendWebsocketTransport.request_connection`),
     // but driving the full `peer/ping` suite also needs `peer/ping` mounted on
@@ -44,7 +40,8 @@ export const ts_default_capabilities = Object.freeze({
     peer_request: false,
     // Node (`ws`) and Deno hand frames pipelined with the upgrade request to the
     // socket. A Bun-served consumer overrides to `false` (see the bun spine
-    // config) — `Bun.serve` answers such a request `400`.
+    // config) — `Bun.serve` answers such a request `400` when the upgrade
+    // follows an asynchronous check.
     ws_handshake_pipelining: true,
     // Off by default: a consumer's WS endpoint mounts its own domain's actions.
     // fuz_app's spine configs opt in (the spine binary mounts the account
@@ -76,9 +73,6 @@ export const rust_default_capabilities = Object.freeze({
     // The Rust `account_router` bundles `/status` into the account routes, so
     // every Rust spine serving the account surface serves it.
     account_status: true,
-    // hyper closes the connection on the oversized-body reject, so a pipelined
-    // request is never reached.
-    oversized_reject_closes_connection: true,
     // Server-initiated requests landed Rust-first canonical — the Rust spine
     // drives the `peer/ping` round-trip, so the family opts into the suite.
     peer_request: true,