pgserve 2.1.3 → 2.2.0

package/examples/multi-tenant-demo.js

@@ -1,104 +0,0 @@
-/**
- * Multi-Tenant Router Demo
- *
- * Shows how to use the new multi-tenant architecture
- */
-
-import { startMultiTenantServer } from '../src/index.js';
-import pg from 'pg';
-
-const { Client } = pg;
-
-async function demo() {
-  console.log('🚀 Starting multi-tenant router demo...\n');
-
-  // Start multi-tenant router
-  const router = await startMultiTenantServer({
-    port: 15432,
-    baseDir: './demo-data',
-    logLevel: 'info'
-  });
-
-  console.log('\n📊 Initial stats:');
-  console.log(JSON.stringify(router.getStats(), null, 2));
-
-  // Connect to database "user123" (auto-created)
-  console.log('\n📥 Connecting to database: user123');
-  const client1 = new Client({
-    host: '127.0.0.1',
-    port: 15432,
-    database: 'user123'
-  });
-
-  await client1.connect();
-  console.log('✅ Connected to user123');
-
-  // Create table and insert data
-  await client1.query('CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT)');
-  await client1.query("INSERT INTO users (name) VALUES ('Alice'), ('Bob')");
-
-  const result1 = await client1.query('SELECT * FROM users');
-  console.log('📋 user123 data:', result1.rows);
-
-  await client1.end();
-  console.log('🔌 Disconnected from user123');
-
-  // Connect to database "app456" (auto-created)
-  console.log('\n📥 Connecting to database: app456');
-  const client2 = new Client({
-    host: '127.0.0.1',
-    port: 15432,
-    database: 'app456'
-  });
-
-  await client2.connect();
-  console.log('✅ Connected to app456');
-
-  // Different schema in different database
-  await client2.query('CREATE TABLE posts (id SERIAL PRIMARY KEY, title TEXT)');
-  await client2.query("INSERT INTO posts (title) VALUES ('Hello World'), ('Multi-tenant magic')");
-
-  const result2 = await client2.query('SELECT * FROM posts');
-  console.log('📋 app456 data:', result2.rows);
-
-  await client2.end();
-  console.log('🔌 Disconnected from app456');
-
-  // Show final stats
-  console.log('\n📊 Final stats:');
-  console.log(JSON.stringify(router.getStats(), null, 2));
-
-  console.log('\n📋 All databases:');
-  console.log(JSON.stringify(router.listDatabases(), null, 2));
-
-  // Reconnect to user123 to verify data persists
-  console.log('\n🔄 Reconnecting to user123 to verify data persists...');
-  const client1Again = new Client({
-    host: '127.0.0.1',
-    port: 15432,
-    database: 'user123'
-  });
-
-  await client1Again.connect();
-  const persistedData = await client1Again.query('SELECT * FROM users');
-  console.log('✅ Persisted data in user123:', persistedData.rows);
-
-  await client1Again.end();
-
-  // Stop router
-  console.log('\n🛑 Stopping router...');
-  await router.stop();
-
-  console.log('\n✅ Demo complete!');
-  console.log('\n🎯 Key achievements:');
-  console.log('  • Single port (15432) handled multiple databases');
-  console.log('  • Auto-provisioned user123 and app456');
-  console.log('  • Data isolated between databases');
-  console.log('  • Data persisted across reconnections');
-  console.log('  • Zero configuration required!');
-}
-
-demo().catch((error) => {
-  console.error('❌ Demo failed:', error);
-  process.exit(1);
-});

package/install.sh

@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-# ============================================================================
-# pgserve — Canonical PostgreSQL backbone installer
-#
-# Bootstraps a single shared pgserve instance under pm2 supervision. Used as
-# a prerequisite by `omni/install.sh` and `genie/install.sh` so every
-# automagik service on a host points at the same Postgres.
-#
-# Usage:
-#   curl -fsSL https://raw.githubusercontent.com/namastexlabs/pgserve/main/install.sh | bash
-#
-# With pinned version:
-#   PGSERVE_VERSION=^2.1.1 curl -fsSL .../install.sh | bash
-#
-# Local checkout:
-#   bash install.sh
-#
-# Idempotent — re-running is a no-op success when pgserve is already
-# registered under pm2 with a healthy entry.
-# ============================================================================
-set -euo pipefail
-
-PGSERVE_VERSION="${PGSERVE_VERSION:-^2.1.0}"
-
-# Colors (no-op when stdout isn't a tty)
-if [[ -t 1 ]]; then
-  RED='\033[0;31m'
-  GREEN='\033[0;32m'
-  YELLOW='\033[1;33m'
-  BLUE='\033[0;34m'
-  CYAN='\033[0;36m'
-  BOLD='\033[1m'
-  NC='\033[0m'
-else
-  RED='' GREEN='' YELLOW='' BLUE='' CYAN='' BOLD='' NC=''
-fi
-
-info() { printf "${BLUE}ℹ${NC}  %s\n" "$*"; }
-ok()   { printf "${GREEN}✓${NC}  %s\n" "$*"; }
-warn() { printf "${YELLOW}⚠${NC}  %s\n" "$*"; }
-fail() { printf "${RED}✗${NC}  %s\n" "$*" >&2; exit 1; }
-step() { printf "\n${BOLD}${CYAN}▸ %s${NC}\n" "$*"; }
-
-has_cmd() { command -v "$1" >/dev/null 2>&1; }
-
-# ============================================================================
-# Prerequisites: bun + pm2
-# ============================================================================
-
-ensure_bun() {
-  if has_cmd bun; then
-    ok "bun $(bun --version 2>/dev/null || echo '?')"
-    return 0
-  fi
-  info "Installing bun (https://bun.sh)..."
-  curl -fsSL https://bun.sh/install | bash >/dev/null 2>&1 || fail "bun install failed — see https://bun.sh"
-  # Make bun available to the rest of this script without requiring a re-login.
-  export PATH="$HOME/.bun/bin:$PATH"
-  has_cmd bun || fail "bun installed but not on PATH — restart your shell and re-run."
-  ok "bun $(bun --version)"
-}
-
-ensure_pm2() {
-  if has_cmd pm2; then
-    ok "pm2 $(pm2 --version 2>/dev/null || echo '?')"
-    return 0
-  fi
-  info "Installing pm2 (process supervisor)..."
-  bun add -g pm2 >/dev/null 2>&1 || fail "pm2 install failed — try: bun add -g pm2"
-  has_cmd pm2 || fail "pm2 installed but not on PATH — restart your shell and re-run."
-  ok "pm2 installed"
-}
-
-# ============================================================================
-# pgserve binary + pm2 registration
-# ============================================================================
-
-ensure_pgserve_binary() {
-  # Probe via `pgserve port` (real subcommand). `pgserve --version` doesn't
-  # exist in 2.1.x — using it would false-negative and trigger a redundant
-  # reinstall every time install.sh runs.
-  if has_cmd pgserve && pgserve port >/dev/null 2>&1; then
-    ok "pgserve binary present (port $(pgserve port 2>/dev/null))"
-    return 0
-  fi
-  info "Installing pgserve@${PGSERVE_VERSION} globally..."
-  bun add -g "pgserve@${PGSERVE_VERSION}" >/dev/null 2>&1 \
-    || fail "pgserve install failed — try: bun add -g pgserve@${PGSERVE_VERSION}"
-  has_cmd pgserve || fail "pgserve installed but not on PATH — restart your shell and re-run."
-  ok "pgserve $(pgserve port 2>/dev/null || echo '?')"
-}
-
-register_pgserve_pm2() {
-  info "Registering pgserve under pm2 (idempotent)..."
-  # `pgserve install` prints its own success/already-installed line and exits
-  # 0 in both cases. We pipe stderr through so any pm2 errors surface to the
-  # operator (the pm2-6.x --min-uptime breakage we hit on 2026-04-30 was
-  # invisible because stderr was being captured).
-  pgserve install || fail "pgserve install failed — see ~/.pgserve/logs/pgserve-error.log"
-}
-
-# ============================================================================
-# Main
-# ============================================================================
-
-main() {
-  step "Installing canonical pgserve"
-  ensure_bun
-  ensure_pm2
-  ensure_pgserve_binary
-  register_pgserve_pm2
-
-  echo ""
-  ok "Canonical pgserve ready"
-  info "URL:  $(pgserve url 2>/dev/null || echo '<run: pgserve url>')"
-  info "Port: $(pgserve port 2>/dev/null || echo '?')"
-  info "Logs: ~/.pgserve/logs/"
-  echo ""
-  info "Other automagik services on this host (omni, genie, ...) will share this pgserve."
-  echo ""
-}
-
-main "$@"

package/knip.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "https://unpkg.com/knip@5/schema.json",
-  "entry": ["src/index.js", "bin/postgres-server.js", "bin/pgserve-wrapper.cjs"],
-  "project": ["src/**/*.js", "bin/**/*.js", "bin/**/*.cjs"],
-  "ignore": ["tests/**", "helpers/**", "scripts/**"],
-  "ignoreBinaries": ["scripts/test-npx.sh", "scripts/test-bun-self-heal.sh", "make"],
-  "ignoreDependencies": ["bun"],
-  "ignoreExportsUsedInFile": true
-}

package/scripts/test-bun-self-heal.sh

@@ -1,163 +0,0 @@
-#!/bin/bash
-# Regression test for https://github.com/namastexlabs/pgserve/issues/22
-#
-# When pgserve is installed via `bun install`, the nested `bun` npm package's
-# postinstall can be skipped, leaving @oven/bun-<platform>/bin/bun empty.
-# The bun stub then refuses to run with "Bun's postinstall script was not run".
-# pgserve-wrapper.cjs must detect this and self-heal via `node install.js`.
-#
-# This test stages a synthetic broken install tree, runs the wrapper, and
-# asserts that it recovers and spawns postgres-server.
-
-set -e
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-WRAPPER="$REPO_ROOT/bin/pgserve-wrapper.cjs"
-
-if [ ! -f "$WRAPPER" ]; then
-  echo "✗ wrapper not found: $WRAPPER"
-  exit 1
-fi
-
-# Use a real bun binary as the "recovered" payload so the healthy-path
-# assertion is meaningful. Falls back to any bun on PATH.
-REAL_BUN="${BUN_BIN:-$(command -v bun || true)}"
-if [ -z "$REAL_BUN" ] || [ ! -x "$REAL_BUN" ]; then
-  echo "✗ bun runtime not found on PATH (set BUN_BIN to override)"
-  exit 1
-fi
-
-FIXTURE=$(mktemp -d)
-trap "rm -rf $FIXTURE" EXIT
-
-mkdir -p "$FIXTURE/node_modules/bun/bin"
-mkdir -p "$FIXTURE/node_modules/@oven/bun-linux-x64/bin"   # empty, simulating the bug
-mkdir -p "$FIXTURE/node_modules/.bin"
-mkdir -p "$FIXTURE/node_modules/pgserve/bin"
-
-cp "$WRAPPER" "$FIXTURE/node_modules/pgserve/bin/pgserve-wrapper.cjs"
-
-# Stub postgres-server so we can detect a successful spawn without needing
-# postgres binaries in the fixture.
-cat > "$FIXTURE/node_modules/pgserve/bin/postgres-server.js" <<'EOF'
-console.log("postgres-server-spawned");
-process.exit(0);
-EOF
-
-# Fake bun install.js: copies the real bun into the expected @oven location,
-# mirroring what the real postinstall does.
-cat > "$FIXTURE/node_modules/bun/install.js" <<EOF
-const fs = require('fs');
-const path = require('path');
-const dst = path.resolve(__dirname, '..', '@oven', 'bun-linux-x64', 'bin', 'bun');
-fs.mkdirSync(path.dirname(dst), { recursive: true });
-fs.copyFileSync('$REAL_BUN', dst);
-fs.chmodSync(dst, 0o755);
-console.log('[test] install.js populated', dst);
-EOF
-echo '{"name":"bun","version":"1.3.12"}' > "$FIXTURE/node_modules/bun/package.json"
-
-# Broken bun stub: prints the postinstall error unless the @oven binary exists.
-cat > "$FIXTURE/node_modules/bun/bin/bun" <<'EOF'
-#!/bin/sh
-SELF=$(readlink -f "$0")
-TARGET="$(dirname "$SELF")/../../@oven/bun-linux-x64/bin/bun"
-if [ ! -x "$TARGET" ]; then
-  echo "Error: Bun's postinstall script was not run." >&2
-  echo "" >&2
-  echo "To fix this, run the postinstall script manually:" >&2
-  echo "  cd node_modules/bun && node install.js" >&2
-  exit 1
-fi
-exec "$TARGET" "$@"
-EOF
-chmod +x "$FIXTURE/node_modules/bun/bin/bun"
-
-ln -s ../bun/bin/bun "$FIXTURE/node_modules/.bin/bun"
-
-echo "=== Testing self-heal on broken install ==="
-OUTPUT=$(node "$FIXTURE/node_modules/pgserve/bin/pgserve-wrapper.cjs" 2>&1)
-EXIT=$?
-
-if [ $EXIT -ne 0 ]; then
-  echo "✗ wrapper exited non-zero: $EXIT"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if ! echo "$OUTPUT" | grep -q "attempting self-heal"; then
-  echo "✗ wrapper did not attempt self-heal"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if ! echo "$OUTPUT" | grep -q "bun runtime recovered"; then
-  echo "✗ wrapper did not report recovery"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if ! echo "$OUTPUT" | grep -q "postgres-server-spawned"; then
-  echo "✗ postgres-server was not spawned after self-heal"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-echo "✓ self-heal path: wrapper detected, repaired, and spawned postgres-server"
-
-echo ""
-echo "=== Testing healthy path is unaffected ==="
-OUTPUT=$(node "$FIXTURE/node_modules/pgserve/bin/pgserve-wrapper.cjs" 2>&1)
-EXIT=$?
-
-if [ $EXIT -ne 0 ]; then
-  echo "✗ wrapper exited non-zero on healthy path: $EXIT"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if echo "$OUTPUT" | grep -q "self-heal\|recovered"; then
-  echo "✗ wrapper logged self-heal messages on a healthy install"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if ! echo "$OUTPUT" | grep -q "postgres-server-spawned"; then
-  echo "✗ postgres-server was not spawned on healthy path"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-echo "✓ healthy path: wrapper was silent and spawned postgres-server directly"
-
-echo ""
-echo "=== Testing non-postinstall errors surface raw ==="
-# Replace stub with one that emits an unrelated error.
-cat > "$FIXTURE/node_modules/bun/bin/bun" <<'EOF'
-#!/bin/sh
-echo "Error: GLIBC_2.99 not found (libc mismatch)" >&2
-exit 127
-EOF
-chmod +x "$FIXTURE/node_modules/bun/bin/bun"
-
-# Clear the @oven healed binary so the stub is what runs.
-rm -f "$FIXTURE/node_modules/@oven/bun-linux-x64/bin/bun"
-
-OUTPUT=$(node "$FIXTURE/node_modules/pgserve/bin/pgserve-wrapper.cjs" 2>&1 || true)
-
-if echo "$OUTPUT" | grep -q "self-heal"; then
-  echo "✗ wrapper tried self-heal for a non-postinstall error"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-if ! echo "$OUTPUT" | grep -q "GLIBC_2.99"; then
-  echo "✗ wrapper did not surface the real error message"
-  echo "$OUTPUT"
-  exit 1
-fi
-
-echo "✓ unrelated-error path: wrapper surfaced the raw error without self-heal"
-
-echo ""
-echo "=== bun self-heal test PASSED ==="

package/scripts/test-npx.sh

@@ -1,60 +0,0 @@
-#!/bin/bash
-# Test that the package works with npx (simulates fresh user install)
-# This catches path resolution issues that static analysis can't detect
-
-set -e
-
-echo "=== Testing npx compatibility ==="
-
-# Create temp directory
-TEST_DIR=$(mktemp -d)
-trap "rm -rf $TEST_DIR" EXIT
-
-# Pack the current package
-echo "Packing package..."
-PACK_OUTPUT=$(npm pack --pack-destination "$TEST_DIR" 2>&1)
-PACK_FILE=$(echo "$PACK_OUTPUT" | grep -E '\.tgz$' | tail -1)
-
-# If npm pack fails, exit with an error
-if [ -z "$PACK_FILE" ] || [ ! -f "$TEST_DIR/$PACK_FILE" ]; then
-  echo "✗ Failed to pack package with npm"
-  echo "Pack output: $PACK_OUTPUT"
-  exit 1
-fi
-echo "Packed: $PACK_FILE"
-
-# Install in isolated environment using npm
-echo "Installing in isolated environment..."
-cd "$TEST_DIR"
-echo '{"name":"test-npx-install","private":true}' > package.json
-npm install "./$PACK_FILE" > /dev/null 2>&1
-
-# Test that it starts (with timeout)
-echo "Testing server startup via npx..."
-timeout 30 npx pgserve --no-cluster --port 15432 > output.log 2>&1 &
-PID=$!
-
-# Wait for ready signal (Server started successfully!)
-for i in {1..60}; do
-  if grep -q "Server started successfully" output.log 2>/dev/null; then
-    echo "✓ Server started successfully via npx"
-    kill $PID 2>/dev/null || true
-    wait $PID 2>/dev/null || true
-    echo "=== npx test PASSED ==="
-    exit 0
-  fi
-  if ! kill -0 $PID 2>/dev/null; then
-    echo "✗ Server exited unexpectedly"
-    cat output.log
-    echo "=== npx test FAILED ==="
-    exit 1
-  fi
-  sleep 0.5
-done
-
-# Timeout
-kill $PID 2>/dev/null || true
-echo "✗ Server did not start within timeout"
-cat output.log
-echo "=== npx test FAILED ==="
-exit 1

package/tests/audit.test.js

@@ -1,189 +0,0 @@
-/**
- * Tests for src/audit.js — JSONL writer with rotation + syslog target.
- *
- * Tests use temp dirs under /tmp; nothing touches the user's real
- * `~/.pgserve/audit.log`. The syslog test stubs `logger` via PATH so we
- * don't depend on (or pollute) the host's syslog daemon.
- */
-
-import { test, expect, beforeEach, afterEach } from 'bun:test';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import {
-  audit,
-  configureAudit,
-  readAuditTarget,
-  AUDIT_EVENTS,
-  _internals,
-} from '../src/audit.js';
-
-let scratchDir;
-
-beforeEach(() => {
-  scratchDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-audit-test-'));
-  configureAudit({
-    logFile: path.join(scratchDir, 'audit.log'),
-    target: 'file',
-  });
-});
-
-afterEach(() => {
-  try {
-    fs.rmSync(scratchDir, { recursive: true, force: true });
-  } catch { /* noop */ }
-});
-
-test('audit() appends a JSON line per event', () => {
-  audit(AUDIT_EVENTS.DB_CREATED, { fingerprint: 'abc123def456', db: 'app_demo_abc123def456' });
-  audit(AUDIT_EVENTS.CONNECTION_ROUTED, { fingerprint: 'abc123def456', peer_pid: 1234 });
-
-  const logFile = path.join(scratchDir, 'audit.log');
-  const lines = fs.readFileSync(logFile, 'utf8').trim().split('\n');
-  expect(lines.length).toBe(2);
-  const r1 = JSON.parse(lines[0]);
-  expect(r1.event).toBe('db_created');
-  expect(r1.fingerprint).toBe('abc123def456');
-  expect(typeof r1.ts).toBe('string');
-  expect(new Date(r1.ts).toString()).not.toBe('Invalid Date');
-
-  const r2 = JSON.parse(lines[1]);
-  expect(r2.event).toBe('connection_routed');
-  expect(r2.peer_pid).toBe(1234);
-});
-
-test('audit() refuses unknown events', () => {
-  expect(() => audit('definitely_not_a_real_event', {})).toThrow(/unknown event/);
-});
-
-test('audit() creates the parent directory if missing', () => {
-  const nested = path.join(scratchDir, 'nested', 'sub', 'audit.log');
-  audit(AUDIT_EVENTS.DB_CREATED, { fingerprint: 'a'.repeat(12) }, { logFile: nested });
-  expect(fs.existsSync(nested)).toBe(true);
-});
-
-test('all v2.0 event names are exported (incl. Group 6 tcp_*)', () => {
-  expect(Object.values(AUDIT_EVENTS).sort()).toEqual([
-    'connection_denied_fingerprint_mismatch',
-    'connection_routed',
-    'db_created',
-    'db_persist_honored',
-    'db_reaped_liveness',
-    'db_reaped_ttl',
-    'enforcement_kill_switch_used',
-    'tcp_token_denied',
-    'tcp_token_issued',
-    'tcp_token_used',
-  ]);
-});
-
-test('rotation kicks in once existing file crosses 50 MB', () => {
-  const logFile = path.join(scratchDir, 'audit.log');
-  // Use a sparse file to simulate a 50 MB log without writing 50 MB.
-  const fd = fs.openSync(logFile, 'w');
-  fs.ftruncateSync(fd, _internals.ROTATE_THRESHOLD_BYTES);
-  fs.closeSync(fd);
-
-  audit(AUDIT_EVENTS.DB_CREATED, { fingerprint: 'r'.repeat(12) });
-
-  // Original file rotated to .1, fresh file holds the new line.
-  expect(fs.existsSync(`${logFile}.1`)).toBe(true);
-  const fresh = fs.readFileSync(logFile, 'utf8');
-  expect(fresh.trim().split('\n').length).toBe(1);
-  expect(JSON.parse(fresh.trim()).event).toBe('db_created');
-
-  // The rotated file is the original 50 MB sparse file.
-  expect(fs.statSync(`${logFile}.1`).size).toBe(_internals.ROTATE_THRESHOLD_BYTES);
-});
-
-test('rotation cascades up to KEEP files and drops the eldest', () => {
-  const logFile = path.join(scratchDir, 'audit.log');
-  // Pre-populate audit.log.1 ... audit.log.5 with distinct markers.
-  for (let i = 1; i <= _internals.ROTATE_KEEP; i++) {
-    fs.writeFileSync(`${logFile}.${i}`, `slot-${i}\n`);
-  }
-  // And the live audit.log just under threshold.
-  const fd = fs.openSync(logFile, 'w');
-  fs.ftruncateSync(fd, _internals.ROTATE_THRESHOLD_BYTES);
-  fs.closeSync(fd);
-
-  audit(AUDIT_EVENTS.DB_CREATED, { fingerprint: 'q'.repeat(12) });
-
-  // .5 (was "slot-5") dropped; .4 → .5; .3 → .4; .2 → .3; .1 → .2; live → .1.
-  expect(fs.readFileSync(`${logFile}.5`, 'utf8').trim()).toBe('slot-4');
-  expect(fs.readFileSync(`${logFile}.4`, 'utf8').trim()).toBe('slot-3');
-  expect(fs.readFileSync(`${logFile}.3`, 'utf8').trim()).toBe('slot-2');
-  expect(fs.readFileSync(`${logFile}.2`, 'utf8').trim()).toBe('slot-1');
-  expect(fs.statSync(`${logFile}.1`).size).toBe(_internals.ROTATE_THRESHOLD_BYTES);
-});
-
-test('audit({target:"syslog"}) spawns logger -t pgserve-audit', async () => {
-  // Stub `logger` by prepending a temp shim to PATH.
-  const shimDir = path.join(scratchDir, 'shim');
-  fs.mkdirSync(shimDir, { recursive: true });
-  const marker = path.join(scratchDir, 'logger-calls.txt');
-  const shimPath = path.join(shimDir, 'logger');
-  fs.writeFileSync(
-    shimPath,
-    `#!/usr/bin/env bash
-# Capture argv to a marker file so the test can verify the spawn.
-printf '%s\\n' "$*" >> "${marker}"
-`,
-    { mode: 0o755 },
-  );
-
-  const oldPath = process.env.PATH;
-  process.env.PATH = `${shimDir}:${oldPath}`;
-  try {
-    audit(
-      AUDIT_EVENTS.CONNECTION_ROUTED,
-      { fingerprint: 's'.repeat(12) },
-      { target: 'syslog' },
-    );
-    // logger is spawned async; poll briefly for the marker.
-    const deadline = Date.now() + 2000;
-    while (!fs.existsSync(marker) && Date.now() < deadline) {
-      await new Promise(r => setTimeout(r, 25));
-    }
-    expect(fs.existsSync(marker)).toBe(true);
-    const contents = fs.readFileSync(marker, 'utf8');
-    expect(contents).toContain('-t pgserve-audit');
-    expect(contents).toContain('"event":"connection_routed"');
-  } finally {
-    process.env.PATH = oldPath;
-  }
-});
-
-test('audit({target:"syslog"}) swallows missing logger binary', () => {
-  // Point PATH at an empty dir → `logger` cannot be found → no throw.
-  const empty = path.join(scratchDir, 'empty');
-  fs.mkdirSync(empty);
-  const oldPath = process.env.PATH;
-  process.env.PATH = empty;
-  try {
-    expect(() =>
-      audit(
-        AUDIT_EVENTS.CONNECTION_ROUTED,
-        { fingerprint: 'z'.repeat(12) },
-        { target: 'syslog' },
-      ),
-    ).not.toThrow();
-  } finally {
-    process.env.PATH = oldPath;
-  }
-});
-
-test('readAuditTarget reads pgserve.audit.target from package.json', () => {
-  const pkgFile = path.join(scratchDir, 'package.json');
-  fs.writeFileSync(
-    pkgFile,
-    JSON.stringify({ name: 'demo', pgserve: { audit: { target: 'syslog' } } }),
-  );
-  expect(readAuditTarget(pkgFile)).toBe('syslog');
-
-  fs.writeFileSync(pkgFile, JSON.stringify({ name: 'demo' }));
-  expect(readAuditTarget(pkgFile)).toBe('file');
-
-  // Missing file → file (default).
-  expect(readAuditTarget(path.join(scratchDir, 'missing.json'))).toBe('file');
-});