Pre 1.0 audit

.cargo/audit.toml

@@ -6,7 +6,7 @@
 [advisories]
 ignore = [
     # `rsa` Marvin Attack — no constant-time fix yet. Used only for outbound
-    # JWT signing in `hyperapi-salesforce`, where timing sidechannels are not
+    # JWT signing in `hyperdb-api-salesforce`, where timing sidechannels are not
     # observable to a remote attacker. Threat model does not apply.
     "RUSTSEC-2023-0071",
     # `ttf-parser` unmaintained (RUSTSEC-2026-0192, informational). Transitive via

.cargo/config.toml

@@ -7,7 +7,7 @@ download-hyperd = "run --release --package hyperdb-bootstrap --bin hyperdb-boots
 # Use mold on Linux to avoid lld OOM-crashing on large debug link jobs
 # (CI ubuntu-latest runners have ~7 GB RAM; linking the full workspace in
 # debug mode with lld exhausts it and triggers a Bus error / signal 7).
-# mold is pre-installed on ubuntu-latest since actions/runner-images 20240310.
+# CI installs mold via apt in every Linux job that builds code.
 # No effect on macOS or Windows (target cfg guards the override).
 [target.x86_64-unknown-linux-gnu]
 linker = "clang"

.claude/workflows/plan-to-release.js

@@ -545,7 +545,7 @@ CRITICAL — verify against the REAL published artifact, NOT this session's conn
    \`npx -y ${npmPackage}@${expected} --ephemeral-only --no-daemon\`
    These two flags avoid two real collisions with the session's live MCP, observed on the v0.7.0 run:
    - \`--ephemeral-only\`: the shared persistent \`workspace.hyper\` is held open by the session's server; opening it from a second process throws SQLSTATE 55006 ("database file is locked by another process"). The KV smoke checks only need the ephemeral DB, so skip persistent entirely.
-   - \`--no-daemon\`: a newer client performs a daemon version-takeover on the shared port 7485 (a shipped feature) — killing the session's daemon. \`--no-daemon\` spawns a private hyperd and leaves the session's daemon alone.
+   - \`--no-daemon\`: a newer client performs a daemon version-takeover on the shared per-user health socket (a shipped feature) — killing the session's daemon. \`--no-daemon\` spawns a private hyperd and leaves the session's daemon alone.
    Do the MCP JSON-RPC handshake (initialize -> notifications/initialized -> tools/call). GATE FIRST: call \`status\` and assert its reported version starts with "${expected}". If it does not, STOP — you are not testing the new artifact; report version_match=false. Only if the version matches, run these checks and record each as a test:
    - kv_set returns a \`created\` field (true on first write, false on overwrite of the same key) and \`value_bytes\`.
    - kv_set with overwrite:false on an existing key returns \`{stored:false, existed:true}\` / does not clobber.

.github/workflows/ci.yml

@@ -252,9 +252,9 @@ jobs:
           cargo test --workspace \
             --exclude hyperdb-api-node \
             --exclude hyperdb-bootstrap
-        # hyperdb-api-node needs napi-rs + a Node.js toolchain; it gets
-        # its own workflow when wired up. hyperdb-bootstrap has its own
-        # coverage (next step) and doesn't need hyperd running.
+        # hyperdb-api-node needs napi-rs + a Node.js toolchain; the
+        # node-bindings job builds and smoke-tests it. hyperdb-bootstrap has
+        # its own coverage (next step) and doesn't need hyperd running.
 
       - name: hyperdb-compile-check tests
         # Declares its own [workspace], so the run above cannot see it. Nothing
@@ -385,6 +385,29 @@ jobs:
       - run: cargo install cargo-audit --locked
       - run: cargo audit --deny warnings
 
+  third-party-licenses:
+    # Generates the THIRD-PARTY-LICENSES.txt that npm-build-publish.yml ships
+    # in the npm platform packages, so a dependency under an unaccepted
+    # license (about.toml) fails here rather than in the middle of a release.
+    name: third-party licenses
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache-key: about
+          rustflags: ""
+      - run: cargo install cargo-about --locked --features cli --version 0.9.2
+      - name: Generate the notices for both shipped binaries
+        run: |
+          set -euo pipefail
+          for crate in hyperdb-mcp hyperdb-api-node; do
+            cargo about generate --manifest-path "$crate/Cargo.toml" about.hbs \
+              -o "$RUNNER_TEMP/THIRD-PARTY-LICENSES-$crate.txt"
+          done
+
   version-consistency:
     # Ensures version.txt (release-please source of truth) stays in sync
     # with Cargo.toml workspace version. Catches release-please PRs that
@@ -423,9 +446,7 @@ jobs:
             hyperdb-api-node/package.json
             hyperdb-api-node/npm/darwin-arm64/package.json
             hyperdb-api-node/npm/darwin-x64/package.json
-            hyperdb-api-node/npm/linux-arm64-gnu/package.json
             hyperdb-api-node/npm/linux-x64-gnu/package.json
-            hyperdb-api-node/npm/linux-x64-musl/package.json
             hyperdb-api-node/npm/win32-x64-msvc/package.json
           )
           OFFENDERS=()

.github/workflows/npm-build-publish.yml

@@ -1,8 +1,9 @@
 name: npm-build-publish
 
 # Builds hyperdb-mcp and hyperdb-api-node npm packages with bundled
-# hyperd binaries. Triggered after a successful release workflow creates
-# a GitHub release, or manually via workflow_dispatch.
+# hyperd binaries. Triggered by the hand-created GitHub Release
+# (`release: published`, in parallel with release.yml), or manually via
+# workflow_dispatch.
 
 on:
   workflow_dispatch:
@@ -58,17 +59,23 @@ jobs:
           # them through bash → jq → Oniguruma was fragile and broke
           # silently on the v0.2.2 release. Exact-string match avoids
           # the whole class of regex-escaping bugs.
+          # These names must match the `name:` of the ci.yml jobs; the
+          # msrv entry embeds the MSRV, so it changes whenever ci.yml does.
+          # Every name must be present: a renamed or missing job makes the
+          # gate time out instead of silently lowering the count.
           REQUIRED_JSON='[
             "rustfmt","clippy (ubuntu-24.04)","clippy (windows-2025)",
-            "cargo-audit","cargo-deny",
+            "msrv (1.88)","doc","cargo-audit","cargo-deny",
             "version consistency","publish dry-run",
             "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)",
             "hyperdb-api-node (build + smoke)"
           ]'
+          EXPECTED=$(echo "$REQUIRED_JSON" | jq 'length')
           for i in $(seq 1 "$MAX_ATTEMPTS"); do
             RUNS=$(gh api "repos/$REPO/commits/$SHA/check-runs?per_page=100" \
               --jq "[.check_runs[] | select(.name as \$n | $REQUIRED_JSON | index(\$n))]")
             TOTAL=$(echo "$RUNS" | jq 'length')
+            PRESENT=$(echo "$RUNS" | jq '[.[].name] | unique | length')
             COMPLETED=$(echo "$RUNS" | jq '[.[] | select(.status=="completed")] | length')
             FAILED=$(echo "$RUNS" | jq '[.[] | select(.status=="completed" and (.conclusion!="success" and .conclusion!="skipped" and .conclusion!="neutral"))] | length')
             echo "Attempt $i/$MAX_ATTEMPTS: total=$TOTAL completed=$COMPLETED failed=$FAILED"
@@ -77,7 +84,7 @@ jobs:
               echo "$RUNS" | jq -r '.[] | select(.status=="completed" and (.conclusion!="success" and .conclusion!="skipped" and .conclusion!="neutral")) | "  - \(.name): \(.conclusion)"'
               exit 1
             fi
-            if [[ "$TOTAL" -gt 0 && "$COMPLETED" == "$TOTAL" ]]; then
+            if [[ "$PRESENT" == "$EXPECTED" && "$COMPLETED" == "$TOTAL" ]]; then
               echo "CI passed ($TOTAL required check-runs completed successfully)."
               exit 0
             fi
@@ -169,6 +176,9 @@ jobs:
           MACOSX_DEPLOYMENT_TARGET: "13.0"
         run: cargo build --release --target "$TARGET" -p hyperdb-api-node
 
+      - name: Install cargo-about
+        run: cargo install cargo-about --locked --features cli --version 0.9.2
+
       - name: Download and verify hyperd
         env:
           SLUG: ${{ matrix.hyperd-slug }}
@@ -255,6 +265,8 @@ jobs:
             cp "$f" "$DEST/"
           done
           cp LICENSE-HYPERD "$DEST/"
+          cargo about generate --manifest-path hyperdb-mcp/Cargo.toml about.hbs \
+            -o "$DEST/THIRD-PARTY-LICENSES.txt"
           chmod +x "$DEST/hyperdb-mcp${EXE}" "$DEST/${HYPERD_BIN}" 2>/dev/null || true
           echo "Contents of $DEST:"
           ls -la "$DEST/"
@@ -280,6 +292,8 @@ jobs:
             cp "$f" "$DEST/"
           done
           cp LICENSE-HYPERD "$DEST/"
+          cargo about generate --manifest-path hyperdb-api-node/Cargo.toml about.hbs \
+            -o "$DEST/THIRD-PARTY-LICENSES.txt"
           chmod +x "$DEST/${HYPERD_BIN}" 2>/dev/null || true
           echo "Contents of $DEST:"
           ls -la "$DEST/"
@@ -331,6 +345,19 @@ jobs:
       - name: Copy README into hyperdb-mcp npm publish directory
         run: cp hyperdb-mcp/README.md hyperdb-mcp/npm/README.md
 
+      - name: Copy license files into every published npm package directory
+        # npm auto-includes only files named LICENSE / LICENCE, so the
+        # hyphenated names are listed in each package.json `files` array and
+        # copied in here, the same way as the README above. The platform
+        # list must match PLATFORMS in the version-injection step below.
+        run: |
+          set -euo pipefail
+          for d in hyperdb-mcp/npm hyperdb-api-node \
+              hyperdb-mcp/npm/{darwin-arm64,linux-x64-gnu,win32-x64-msvc} \
+              hyperdb-api-node/npm/{darwin-arm64,linux-x64-gnu,win32-x64-msvc}; do
+            cp LICENSE-MIT.txt LICENSE-APACHE.txt NOTICE "$d/"
+          done
+
       - name: Resolve version and dist-tag from event
         id: version
         # Source-of-truth: the git tag that triggered the workflow.

.github/workflows/release-please.yml

@@ -11,9 +11,9 @@ name: release-please
 # anchor on the freshly created tag and correct the next release PR (see #308).
 #
 # Uses a fine-grained PAT (RELEASE_PLEASE_TOKEN) instead of the default
-# GITHUB_TOKEN so that PRs and tags created by this workflow trigger
-# downstream CI and publish workflows. With GITHUB_TOKEN, GitHub
-# suppresses workflow triggers on events it creates (anti-recursion).
+# GITHUB_TOKEN so that PRs created by this workflow trigger downstream
+# CI. With GITHUB_TOKEN, GitHub suppresses workflow triggers on events
+# it creates (anti-recursion).
 #
 # After release-please opens or updates the release PR, a follow-up
 # step reconciles Cargo.lock against the bumped Cargo.toml and pushes

.github/workflows/release.yml

@@ -10,11 +10,9 @@ name: release
 #   - a manual workflow_dispatch with an explicit existing tag (for
 #     re-runs or emergency releases).
 #
-# Note: the `push: tags:` trigger was removed because release-please
-# now uses a PAT (RELEASE_PLEASE_TOKEN) that fires both `release:
-# published` AND `push: tags:` events. Keeping both caused duplicate
-# runs. For emergency releases that bypass release-please, use
-# workflow_dispatch.
+# There is no `push: tags:` trigger: pushing a tag alone publishes
+# nothing. Use workflow_dispatch for re-runs or for emergency releases
+# that bypass release-please.
 #
 # Stable tags (v0.1.0) mark the GitHub release as latest; pre-release
 # tags (v0.1.0-rc.1) mark it as prerelease so it doesn't show as
@@ -60,16 +58,18 @@ jobs:
           ref: ${{ github.event.inputs.tag || github.event.release.tag_name || github.ref }}
 
       - name: Wait for CI to pass
-        # The full test matrix already ran on the merge commit before
-        # release-please tagged it. Re-running it here was ~20 minutes
-        # of redundant CI per release. Instead, poll the check-runs
+        # The full test matrix already ran on the release-PR merge
+        # commit, and re-running it here would cost ~20 minutes of
+        # redundant CI per release. Instead, poll the check-runs
         # API for the tag's SHA and verify all required checks are
         # green. Mirrors the verify-ci pattern in npm-build-publish.yml.
         #
         # Risk: a maintainer who runs workflow_dispatch with a tag on
         # a SHA that never had CI would skip all test coverage. Guard
-        # against that by requiring TOTAL > 0 — if no required check
-        # ever ran on this SHA, abort.
+        # against that by requiring every name in REQUIRED_JSON to be
+        # present and completed — if a required check never ran on
+        # this SHA (or was renamed), the gate times out instead of
+        # passing.
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
@@ -85,16 +85,21 @@ jobs:
           # them through bash → jq → Oniguruma was fragile and broke
           # silently on the v0.2.2 release. Exact-string match avoids
           # the whole class of regex-escaping bugs.
+          # These names must match the `name:` of the ci.yml jobs; the
+          # msrv entry embeds the MSRV, so it changes whenever ci.yml does.
           REQUIRED_JSON='[
-            "rustfmt","clippy","cargo-audit","cargo-deny",
+            "rustfmt","clippy (ubuntu-24.04)","clippy (windows-2025)",
+            "msrv (1.88)","doc","cargo-audit","cargo-deny",
             "version consistency","publish dry-run",
             "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)",
             "hyperdb-api-node (build + smoke)"
           ]'
+          EXPECTED=$(echo "$REQUIRED_JSON" | jq 'length')
           for i in $(seq 1 "$MAX_ATTEMPTS"); do
             RUNS=$(gh api "repos/$REPO/commits/$SHA/check-runs?per_page=100" \
               --jq "[.check_runs[] | select(.name as \$n | $REQUIRED_JSON | index(\$n))]")
             TOTAL=$(echo "$RUNS" | jq 'length')
+            PRESENT=$(echo "$RUNS" | jq '[.[].name] | unique | length')
             COMPLETED=$(echo "$RUNS" | jq '[.[] | select(.status=="completed")] | length')
             FAILED=$(echo "$RUNS" | jq '[.[] | select(.status=="completed" and (.conclusion!="success" and .conclusion!="skipped" and .conclusion!="neutral"))] | length')
             echo "Attempt $i/$MAX_ATTEMPTS: total=$TOTAL completed=$COMPLETED failed=$FAILED"
@@ -103,7 +108,7 @@ jobs:
               echo "$RUNS" | jq -r '.[] | select(.status=="completed" and (.conclusion!="success" and .conclusion!="skipped" and .conclusion!="neutral")) | "  - \(.name): \(.conclusion)"'
               exit 1
             fi
-            if [[ "$TOTAL" -gt 0 && "$COMPLETED" == "$TOTAL" ]]; then
+            if [[ "$PRESENT" == "$EXPECTED" && "$COMPLETED" == "$TOTAL" ]]; then
               echo "CI passed ($TOTAL required check-runs completed successfully)."
               exit 0
             fi

AGENTS.md

@@ -261,8 +261,8 @@ cargo test -p hyperdb-api
 # Run a specific test
 cargo test -p hyperdb-api test_name
 
-# Run tests in a specific file (use module path)
-cargo test -p hyperdb-api --test integration_test
+# Run tests in a specific file (use the file stem)
+cargo test -p hyperdb-api --test connection_tests
 ```
 
 ### Running Examples
@@ -311,7 +311,7 @@ hyperdb-api-core/src/types/     # Unit tests (inline with code)
 **Test utilities:**
 
 - `hyperdb-api/tests/common/mod.rs` - Shared test helpers
-- `hyperdb-api-core/src/client/test_util.rs` - Client test utilities
+- `hyperdb-api-core/tests/common/mod.rs` - Client test utilities
 - Both use `HyperProcess::new()` to start temporary `hyperd` servers
 
 **Pattern:** Tests create temporary `.hyper` files and clean them up automatically. The `make clean-test-files` command removes any leftover test artifacts.
@@ -346,7 +346,7 @@ Query results are **always streaming** to maintain constant memory usage:
 ```rust
 let mut result = conn.execute_query("SELECT * FROM large_table")?;
 
-// Process in chunks (default: 16384 rows per chunk)
+// Process in chunks (TCP: up to 65,536 rows per chunk)
 while let Some(chunk) = result.next_chunk()? {
     for row in &chunk {
         // Process row

CODE_OF_CONDUCT.md

@@ -99,7 +99,7 @@ It includes adaptions and additions from [Go Community Code of Conduct][golang-c
 This Code of Conduct is licensed under the [Creative Commons Attribution 3.0 License][cc-by-3-us].
 
 [contributor-covenant-home]: https://www.contributor-covenant.org (https://www.contributor-covenant.org/)
-[golang-coc]: https://golang.org/conduct
+[golang-coc]: https://go.dev/conduct
 [cncf-coc]: https://github.com/cncf/foundation/blob/master/code-of-conduct.md
 [microsoft-coc]: https://opensource.microsoft.com/codeofconduct/
 [cc-by-3-us]: https://creativecommons.org/licenses/by/3.0/us/

CONTRIBUTING.md

@@ -15,7 +15,7 @@ Use GitHub Issues page to submit issues, enhancement requests and discuss ideas.
 ### Bug Reports and Fixes
 
 - If you find a bug, please search for it in the [Issues](https://github.com/tableau/hyper-api-rust/issues), and if it isn't already tracked,
-   [create a new issue](https://github.com/tableau/hyper-api-rust/issues/new). Fill out the "Bug Report" section of the issue template. Even if an Issue is closed, feel free to comment and add details, it will still
+   [create a new issue](https://github.com/tableau/hyper-api-rust/issues/new). Include the crate and version, your OS, the `hyperd --version` output, a minimal reproduction, and the expected vs. actual behavior. Even if an Issue is closed, feel free to comment and add details, it will still
    be reviewed.
 - Issues that have already been identified as a bug (note: able to reproduce) will be labelled `bug`.
 - If you'd like to submit a fix for a bug, [send a Pull Request](#creating-a-pull-request) and mention the Issue number.
@@ -140,7 +140,7 @@ GPG signing is also supported — see [GitHub's signing-commits guide](https://d
 7. **Submit** a Pull Request against the `main` branch and refer to the issue(s) you are fixing. Try not to pollute your pull request with unintended changes. Keep it simple and small.
 8. **Sign** the Salesforce CLA (you will be prompted to do so when submitting the Pull Request)
 
-> **NOTE**: Be sure to [sync your fork](https://help.github.com/articles/syncing-a-fork/) before making a pull request.
+> **NOTE**: Be sure to [sync your fork](https://docs.github.com/en/pull-requests/how-tos/work-with-forks/syncing-a-fork) before making a pull request.
 
 ## Contributor License Agreement ("CLA")
 
@@ -274,4 +274,4 @@ Please follow our [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## License
 
-By contributing your code, you agree to license your contribution under the terms of our project [MIT](LICENSE-MIT) and [Apache-2.0](LICENSE-APACHE) dual license, and to sign the [Salesforce CLA](https://cla.salesforce.com/sign-cla).
+By contributing your code, you agree to license your contribution under the terms of our project [MIT](LICENSE-MIT.txt) and [Apache-2.0](LICENSE-APACHE.txt) dual license, and to sign the [Salesforce CLA](https://cla.salesforce.com/sign-cla).