Changelog

api_client_extended_tests.rs (61 tests):

• Token management: get/refresh/logout flows
• 429 rate limiting: Retry-After parsing, gate blocking, proactive throttling
• 401 auto-refresh retry on POST and DELETE
• Workspace 409 conflict resolution
• All endpoint error paths (500s)
• Data edge cases: invalid base64, string-encoded percents, empty lists
• Concurrent refresh deduplication

recovery_extended_tests.rs (32 tests):

• setup_recovery_with_mnemonic: roundtrip, overwrite, vault_manager wrapper
• reset_password: re-encryption roundtrip, mnemonic stays valid
• sanitize_for_sql: edge cases (quotes, unicode, empty, long strings)
• checkpoint and content hash verification

• TrackingLimiter: memory_growing allowed/denied, table_growing, instances/tables/memories
• get_resource_metrics: metadata-only, third-party limits, with entities, zero memory edge case
• PluginResourceMetrics: Debug, Clone, Serialize coverage
• from_wasm_cached: nonexistent file error path
• track_fuel_consumption: no-op for metadata-only
• call_link_type/call_navigate_to_item: error paths
• Manager: navigate_to_item, get_entity_view_data (capability not supported)
• Manager: get_plugin_metrics, get_all_plugin_metrics
• Manager: get_plugin/get_plugin_mut not found
• Manager: load_plugin_from_wasm error, navigation items with icons
• Manager: fetch_url_for_plugin network error, with_policy constructor

Add Community license configuration in static constructor, matching

the existing pattern in EmergencyKitPdfService. Without this, QuestPDF

throws on PDF generation since it requires explicit license selection.

New test areas covering previously untested functionality:

• Sync ledger: list_all_entity_ids, entities_needing_sync (with

unsynced, modified-after-sync, local-only exclusion), mark_entity_synced,

mark_entities_synced batch, clear_sync_ledger_for_peer,

invalidate_sync_ledger_for_entity

• Storage estimation: estimate_storage_bytes, estimate_storage_by_types
• Cloud sync cursors: save/load/upsert/clear
• Plugin fuel history: record, metrics (avg/peak/count), clear, isolation
• RAG vector index: upsert, update, delete, delete_all, cosine similarity

search, type-filtered search, get_hashes with filter, fetch_all

• Orphan management: find_orphan_entities, delete with cascade, empty

valid_types early return

• Maintenance: checkpoint, run_maintenance orphan cleanup
• DB diagnostics: returns table metadata
• Query filter edge cases: path without slash prefix, missing field,

limit break, include_trashed, bool filter, string-to-number coercion,

string-to-bool coercion

• Compact: write/delete/compact/verify data integrity

New test files and expanded existing ones for privstack-cloud:

• cred_manager_integration_tests.rs: 8 tests covering CredentialManager

lifecycle (caching, refresh, clear, expiry-driven refresh, error propagation)

• envelope_manager_tests.rs: 12 tests covering EnvelopeManager (keypair

state, open_dek roundtrip, seal_dek_for_user via wiremock, create_and_store,

retrieve_and_open)

• sharing_tests.rs: 8 tests covering ShareManager (create, accept, revoke,

get shares, error cases) via wiremock

• error_behavior_tests.rs: expanded from 24 to 37 tests, adding Display

coverage for all CloudError variants and Http variant testing via real

reqwest errors (connect failure, timeout)

• types_tests.rs: added RateLimitConfig, SyncProgress, StsCredentials

optional fields, BatchMeta int deserialization, QuotaInfo string parsing

• compaction_tests.rs: added recovery_key_s3_key format test

Coverage improvements: credential_manager 0%→98%, sharing 0%→72%,

envelope 0%→61%, error 78%→91%. Overall cloud coverage 45%→53%.