The PDS endpoint URL is /xrpc/com.atproto.server.getSession —
those are dots before getSession, not slashes, so the previous
includes("/getSession") filter never matched and the Authorization
header assertion silently short-circuited via optional chaining.
Uses @std/testing/time FakeTime to deterministically advance the
500ms debounce. Covers accumulation, timer restart on each push,
the bulk-create verb + payload shape, and per-did buffer
isolation with cleared state after flush.
The webhook CRUD test combined an explicit did:plc:user webhook
with seedWebhook calls that defaulted to did:plc:test, so
listWebhooksByDid("did:plc:user") only returned the one
explicit row instead of three.
withTestDb sets up an in-memory SQLite handle with migrations
applied, swaps the production singleton via _setDbForTest, and
restores in a finally block. installFetchStub captures every
outbound request and throws if restored twice. requestApp wraps
Oak's app.handle so route tests can run without listen().
stubAuthenticate flips the server's authenticator indirection.
