@durable-streams/server-conformance-tests 0.1.5 → 0.1.7

package/dist/{src-BtF2jQ-Q.js → src-GWuAOela.js}

@@ -59,7 +59,7 @@ async function fetchSSE(url, opts = {}) {
 */
 function parseSSEEvents(sseText) {
 	const events = [];
-	const normalized = sseText.replace(/\r\n/g, `\n`);
+	const normalized = sseText.replace(/\r\n/g, `\n`).replace(/\r/g, `\n`);
 	const eventBlocks = normalized.split(`\n\n`).filter((block) => block.trim());
 	for (const block of eventBlocks) {
 		const lines = block.split(`\n`);
@@ -301,7 +301,7 @@ function runConformanceTests(options) {
 				method: `PUT`,
 				headers: { "Content-Type": `text/plain` }
 			});
-			expect([200, 204]).toContain(secondResponse.status);
+			expect(secondResponse.status).toBe(200);
 		});
 		test(`should return 409 on PUT with different config`, async () => {
 			const streamPath = `/v1/stream/config-conflict-test-${Date.now()}`;
@@ -326,7 +326,7 @@ function runConformanceTests(options) {
 				headers: { "Content-Type": `text/plain` },
 				body: `hello world`
 			});
-			expect([200, 204]).toContain(response.status);
+			expect(response.status).toBe(204);
 			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined();
 		});
 		test(`should return 404 on POST to non-existent stream`, async () => {
@@ -509,7 +509,7 @@ function runConformanceTests(options) {
 				},
 				body: `second`
 			});
-			expect([200, 204]).toContain(response.status);
+			expect(response.status).toBe(204);
 		});
 		test(`should reject duplicate seq values`, async () => {
 			const streamPath = `/v1/stream/seq-duplicate-test-${Date.now()}`;
@@ -536,6 +536,140 @@ function runConformanceTests(options) {
 			expect(response.status).toBe(409);
 		});
 	});
+	describe(`Browser Security Headers`, () => {
+		test(`should include X-Content-Type-Options: nosniff on GET responses`, async () => {
+			const streamPath = `/v1/stream/security-get-nosniff-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `test data`
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, { method: `GET` });
+			expect(response.status).toBe(200);
+			expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+		});
+		test(`should include X-Content-Type-Options: nosniff on PUT responses`, async () => {
+			const streamPath = `/v1/stream/security-put-nosniff-${Date.now()}`;
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			expect(response.status).toBe(201);
+			expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+		});
+		test(`should include X-Content-Type-Options: nosniff on POST responses`, async () => {
+			const streamPath = `/v1/stream/security-post-nosniff-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: { "Content-Type": `text/plain` },
+				body: `data`
+			});
+			expect([200, 204]).toContain(response.status);
+			expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+		});
+		test(`should include X-Content-Type-Options: nosniff on HEAD responses`, async () => {
+			const streamPath = `/v1/stream/security-head-nosniff-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, { method: `HEAD` });
+			expect(response.status).toBe(200);
+			expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+		});
+		test(`should include Cross-Origin-Resource-Policy header on GET responses`, async () => {
+			const streamPath = `/v1/stream/security-corp-get-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/octet-stream` },
+				body: new Uint8Array([
+					1,
+					2,
+					3,
+					4
+				])
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, { method: `GET` });
+			expect(response.status).toBe(200);
+			const corp = response.headers.get(`cross-origin-resource-policy`);
+			expect(corp).toBeDefined();
+			expect([
+				`cross-origin`,
+				`same-origin`,
+				`same-site`
+			]).toContain(corp);
+		});
+		test(`should include Cache-Control: no-store on HEAD responses`, async () => {
+			const streamPath = `/v1/stream/security-head-cache-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, { method: `HEAD` });
+			expect(response.status).toBe(200);
+			const cacheControl = response.headers.get(`cache-control`);
+			expect(cacheControl).toBeDefined();
+			expect(cacheControl).toContain(`no-store`);
+		});
+		test(`should include X-Content-Type-Options: nosniff on SSE responses`, async () => {
+			const streamPath = `/v1/stream/security-sse-nosniff-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` },
+				body: JSON.stringify({ test: `data` })
+			});
+			const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, { method: `HEAD` });
+			const offset = headResponse.headers.get(STREAM_OFFSET_HEADER) ?? `-1`;
+			const controller = new AbortController();
+			const timeoutId = setTimeout(() => controller.abort(), 500);
+			try {
+				const response = await fetch(`${getBaseUrl()}${streamPath}?offset=${offset}&live=sse`, {
+					method: `GET`,
+					signal: controller.signal
+				});
+				expect(response.status).toBe(200);
+				expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+			} catch (e) {
+				if (!(e instanceof Error && e.name === `AbortError`)) throw e;
+			} finally {
+				clearTimeout(timeoutId);
+			}
+		});
+		test(`should include X-Content-Type-Options: nosniff on long-poll responses`, async () => {
+			const streamPath = `/v1/stream/security-longpoll-nosniff-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `initial data`
+			});
+			const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, { method: `HEAD` });
+			const offset = headResponse.headers.get(STREAM_OFFSET_HEADER) ?? `-1`;
+			const controller = new AbortController();
+			const timeoutId = setTimeout(() => controller.abort(), 500);
+			try {
+				const response = await fetch(`${getBaseUrl()}${streamPath}?offset=${offset}&live=long-poll`, {
+					method: `GET`,
+					signal: controller.signal
+				});
+				expect([200, 204]).toContain(response.status);
+				expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+			} catch (e) {
+				if (!(e instanceof Error && e.name === `AbortError`)) throw e;
+			} finally {
+				clearTimeout(timeoutId);
+			}
+		});
+		test(`should include security headers on error responses`, async () => {
+			const streamPath = `/v1/stream/security-error-headers-${Date.now()}`;
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, { method: `GET` });
+			expect(response.status).toBe(404);
+			expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`);
+		});
+	});
 	describe(`TTL and Expiry Validation`, () => {
 		test(`should reject both TTL and Expires-At (400)`, async () => {
 			const streamPath = `/v1/stream/ttl-expires-conflict-test-${Date.now()}`;
@@ -606,7 +740,7 @@ function runConformanceTests(options) {
 				headers: { "Content-Type": `TEXT/PLAIN` },
 				body: `test`
 			});
-			expect([200, 204]).toContain(response.status);
+			expect(response.status).toBe(204);
 		});
 		test(`should allow idempotent create with different case content-type`, async () => {
 			const streamPath = `/v1/stream/case-idempotent-test-${Date.now()}`;
@@ -619,7 +753,7 @@ function runConformanceTests(options) {
 				method: `PUT`,
 				headers: { "Content-Type": `APPLICATION/JSON` }
 			});
-			expect([200, 204]).toContain(response2.status);
+			expect(response2.status).toBe(200);
 		});
 		test(`should accept headers with different casing`, async () => {
 			const streamPath = `/v1/stream/case-header-test-${Date.now()}`;
@@ -635,7 +769,7 @@ function runConformanceTests(options) {
 				},
 				body: `test`
 			});
-			expect([200, 204]).toContain(response.status);
+			expect(response.status).toBe(204);
 		});
 	});
 	describe(`Content-Type Validation`, () => {
@@ -663,7 +797,7 @@ function runConformanceTests(options) {
 				headers: { "Content-Type": `application/json` },
 				body: `{"test": true}`
 			});
-			expect([200, 204]).toContain(response.status);
+			expect(response.status).toBe(204);
 		});
 		test(`should return stream content-type on GET`, async () => {
 			const streamPath = `/v1/stream/content-type-get-test-${Date.now()}`;
@@ -745,6 +879,199 @@ function runConformanceTests(options) {
 			expect(text1).toBe(text2);
 			expect(text1).toBe(`hello world`);
 		});
+		test(`should accept offset=now as sentinel for current tail position`, async () => {
+			const streamPath = `/v1/stream/offset-now-sentinel-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `historical data`
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(response.status).toBe(200);
+			const text = await response.text();
+			expect(text).toBe(``);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined();
+		});
+		test(`should return correct tail offset for offset=now`, async () => {
+			const streamPath = `/v1/stream/offset-now-tail-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `initial data`
+			});
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`, { method: `GET` });
+			const tailOffset = readResponse.headers.get(STREAM_OFFSET_HEADER);
+			expect(tailOffset).toBeDefined();
+			const nowResponse = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(nowResponse.headers.get(STREAM_OFFSET_HEADER)).toBe(tailOffset);
+		});
+		test(`should be able to resume from offset=now result`, async () => {
+			const streamPath = `/v1/stream/offset-now-resume-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `old data`
+			});
+			const nowResponse = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			const nowOffset = nowResponse.headers.get(STREAM_OFFSET_HEADER);
+			expect(nowOffset).toBeDefined();
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: { "Content-Type": `text/plain` },
+				body: `new data`
+			});
+			const resumeResponse = await fetch(`${getBaseUrl()}${streamPath}?offset=${nowOffset}`, { method: `GET` });
+			const resumeText = await resumeResponse.text();
+			expect(resumeText).toBe(`new data`);
+		});
+		test(`should work with offset=now on empty stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-empty-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(response.status).toBe(200);
+			const text = await response.text();
+			expect(text).toBe(``);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined();
+		});
+		test(`should return empty JSON array for offset=now on JSON streams`, async () => {
+			const streamPath = `/v1/stream/offset-now-json-body-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` },
+				body: `[{"event": "historical"}]`
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(response.status).toBe(200);
+			expect(response.headers.get(`content-type`)).toBe(`application/json`);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined();
+			const body = await response.text();
+			expect(body).toBe(`[]`);
+		});
+		test(`should return empty body for offset=now on non-JSON streams`, async () => {
+			const streamPath = `/v1/stream/offset-now-text-body-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `historical data`
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(response.status).toBe(200);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined();
+			const body = await response.text();
+			expect(body).toBe(``);
+		});
+		test(`should support offset=now with long-poll mode (waits for data)`, async () => {
+			const streamPath = `/v1/stream/offset-now-longpoll-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `existing data`
+			});
+			const readRes = await fetch(`${getBaseUrl()}${streamPath}`);
+			const tailOffset = readRes.headers.get(STREAM_OFFSET_HEADER);
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now&live=long-poll`, { method: `GET` });
+			expect(response.status).toBe(204);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBe(tailOffset);
+		});
+		test(`should receive data with offset=now long-poll when appended`, async () => {
+			const streamPath = `/v1/stream/offset-now-longpoll-data-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `historical`
+			});
+			const longPollPromise = fetch(`${getBaseUrl()}${streamPath}?offset=now&live=long-poll`, { method: `GET` });
+			await new Promise((r) => setTimeout(r, 100));
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: { "Content-Type": `text/plain` },
+				body: `new data`
+			});
+			const response = await longPollPromise;
+			expect(response.status).toBe(200);
+			const text = await response.text();
+			expect(text).toBe(`new data`);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+		});
+		test(`should support offset=now with SSE mode`, async () => {
+			const streamPath = `/v1/stream/offset-now-sse-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: `existing data`
+			});
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`, { method: `GET` });
+			const tailOffset = readResponse.headers.get(STREAM_OFFSET_HEADER);
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=now&live=sse`, { untilContent: `"upToDate"` });
+			expect(response.status).toBe(200);
+			const controlMatch = received.match(/event: control\s*\n\s*data: ({[^}]+})/);
+			expect(controlMatch).toBeDefined();
+			if (controlMatch && controlMatch[1]) {
+				const controlData = JSON.parse(controlMatch[1]);
+				expect(controlData[`upToDate`]).toBe(true);
+				expect(controlData[`streamNextOffset`]).toBe(tailOffset);
+			}
+		});
+		test(`should return 404 for offset=now on non-existent stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-404-test-${Date.now()}`;
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, { method: `GET` });
+			expect(response.status).toBe(404);
+		});
+		test(`should return 404 for offset=now with long-poll on non-existent stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-longpoll-404-test-${Date.now()}`;
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now&live=long-poll`, { method: `GET` });
+			expect(response.status).toBe(404);
+		});
+		test(`should return 404 for offset=now with SSE on non-existent stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-sse-404-test-${Date.now()}`;
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now&live=sse`, { method: `GET` });
+			expect(response.status).toBe(404);
+		});
+		test(`should support offset=now with long-poll on empty stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-empty-longpoll-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now&live=long-poll`, { method: `GET` });
+			expect(response.status).toBe(204);
+			expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`);
+			const offset = response.headers.get(STREAM_OFFSET_HEADER);
+			expect(offset).toBeDefined();
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: { "Content-Type": `text/plain` },
+				body: `first data`
+			});
+			const resumeResponse = await fetch(`${getBaseUrl()}${streamPath}?offset=${offset}`, { method: `GET` });
+			expect(resumeResponse.status).toBe(200);
+			const resumeText = await resumeResponse.text();
+			expect(resumeText).toBe(`first data`);
+		});
+		test(`should support offset=now with SSE on empty stream`, async () => {
+			const streamPath = `/v1/stream/offset-now-empty-sse-test-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=now&live=sse`, { untilContent: `"upToDate"` });
+			expect(response.status).toBe(200);
+			const controlMatch = received.match(/event: control\s*\n\s*data: ({[^}]+})/);
+			expect(controlMatch).toBeDefined();
+			if (controlMatch && controlMatch[1]) {
+				const controlData = JSON.parse(controlMatch[1]);
+				expect(controlData[`upToDate`]).toBe(true);
+				expect(controlData[`streamNextOffset`]).toBeDefined();
+			}
+		});
 		test(`should reject malformed offset (contains comma)`, async () => {
 			const streamPath = `/v1/stream/offset-comma-test-${Date.now()}`;
 			await fetch(`${getBaseUrl()}${streamPath}`, {
@@ -955,7 +1282,8 @@ function runConformanceTests(options) {
 			expect(response.status).toBe(201);
 			const location = response.headers.get(`location`);
 			expect(location).toBeDefined();
-			expect(location).toBe(`${getBaseUrl()}${streamPath}`);
+			expect(location.endsWith(streamPath)).toBe(true);
+			expect(() => new URL(location)).not.toThrow();
 		});
 		test(`should reject missing Content-Type on POST`, async () => {
 			const streamPath = `/v1/stream/missing-ct-post-test-${Date.now()}`;
@@ -1159,7 +1487,7 @@ function runConformanceTests(options) {
 					"Stream-TTL": `3600`
 				}
 			});
-			expect([200, 204]).toContain(response2.status);
+			expect(response2.status).toBe(200);
 		});
 		test(`should reject idempotent PUT with different TTL`, async () => {
 			const streamPath = `/v1/stream/ttl-conflict-test-${Date.now()}`;
@@ -1263,7 +1591,7 @@ function runConformanceTests(options) {
 				headers: { "Content-Type": `text/plain` },
 				body: `appended data`
 			});
-			expect([200, 204]).toContain(postBefore.status);
+			expect(postBefore.status).toBe(204);
 			await sleep(1500);
 			const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
 				method: `POST`,
@@ -1323,7 +1651,7 @@ function runConformanceTests(options) {
 				headers: { "Content-Type": `text/plain` },
 				body: `appended data`
 			});
-			expect([200, 204]).toContain(postBefore.status);
+			expect(postBefore.status).toBe(204);
 			await sleep(1500);
 			const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
 				method: `POST`,
@@ -1746,6 +2074,88 @@ function runConformanceTests(options) {
 			expect(received).toContain(`data: line2`);
 			expect(received).toContain(`data: line3`);
 		});
+		test(`should prevent CRLF injection in payloads - embedded event boundaries become literal data`, async () => {
+			const streamPath = `/v1/stream/sse-crlf-injection-test-${Date.now()}`;
+			const maliciousPayload = `safe content\r\n\r\nevent: control\r\ndata: {"injected":true}\r\n\r\nmore safe content`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: maliciousPayload
+			});
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=-1&live=sse`, { untilContent: `event: control` });
+			expect(response.status).toBe(200);
+			const events = parseSSEEvents(received);
+			const dataEvents = events.filter((e) => e.type === `data`);
+			const controlEvents = events.filter((e) => e.type === `control`);
+			expect(dataEvents.length).toBe(1);
+			expect(controlEvents.length).toBe(1);
+			const dataContent = dataEvents[0].data;
+			expect(dataContent).toContain(`event: control`);
+			expect(dataContent).toContain(`data: {"injected":true}`);
+			const controlContent = JSON.parse(controlEvents[0].data);
+			expect(controlContent.injected).toBeUndefined();
+			expect(controlContent.streamNextOffset).toBeDefined();
+		});
+		test(`should prevent CRLF injection - LF-only attack vectors`, async () => {
+			const streamPath = `/v1/stream/sse-lf-injection-test-${Date.now()}`;
+			const maliciousPayload = `start\n\nevent: data\ndata: fake-event\n\nend`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: maliciousPayload
+			});
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=-1&live=sse`, { untilContent: `event: control` });
+			expect(response.status).toBe(200);
+			const events = parseSSEEvents(received);
+			const dataEvents = events.filter((e) => e.type === `data`);
+			expect(dataEvents.length).toBe(1);
+			const dataContent = dataEvents[0].data;
+			expect(dataContent).toContain(`event: data`);
+			expect(dataContent).toContain(`data: fake-event`);
+		});
+		test(`should prevent CRLF injection - carriage return only attack vectors`, async () => {
+			const streamPath = `/v1/stream/sse-cr-injection-test-${Date.now()}`;
+			const maliciousPayload = `start\r\revent: control\rdata: {"cr_injected":true}\r\rend`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` },
+				body: maliciousPayload
+			});
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=-1&live=sse`, { untilContent: `event: control` });
+			expect(response.status).toBe(200);
+			const events = parseSSEEvents(received);
+			const controlEvents = events.filter((e) => e.type === `control`);
+			expect(controlEvents.length).toBe(1);
+			const controlContent = JSON.parse(controlEvents[0].data);
+			expect(controlContent.cr_injected).toBeUndefined();
+			expect(controlContent.streamNextOffset).toBeDefined();
+		});
+		test(`should handle JSON payloads with embedded newlines safely`, async () => {
+			const streamPath = `/v1/stream/sse-json-newline-test-${Date.now()}`;
+			const jsonPayload = JSON.stringify({
+				message: `line1\nline2\nline3`,
+				attack: `try\r\n\r\nevent: control\r\ndata: {"bad":true}`
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` },
+				body: jsonPayload
+			});
+			const { response, received } = await fetchSSE(`${getBaseUrl()}${streamPath}?offset=-1&live=sse`, { untilContent: `event: control` });
+			expect(response.status).toBe(200);
+			const events = parseSSEEvents(received);
+			const dataEvents = events.filter((e) => e.type === `data`);
+			const controlEvents = events.filter((e) => e.type === `control`);
+			expect(dataEvents.length).toBe(1);
+			expect(controlEvents.length).toBe(1);
+			const parsedData = JSON.parse(dataEvents[0].data);
+			expect(Array.isArray(parsedData)).toBe(true);
+			expect(parsedData[0].message).toBe(`line1\nline2\nline3`);
+			expect(parsedData[0].attack).toContain(`event: control`);
+			const controlContent = JSON.parse(controlEvents[0].data);
+			expect(controlContent.bad).toBeUndefined();
+			expect(controlContent.streamNextOffset).toBeDefined();
+		});
 		test(`should generate unique, monotonically increasing offsets in SSE mode`, async () => {
 			const streamPath = `/v1/stream/sse-monotonic-offset-test-${Date.now()}`;
 			await fetch(`${getBaseUrl()}${streamPath}`, {
@@ -2131,7 +2541,7 @@ function runConformanceTests(options) {
 								headers: { "Content-Type": `application/octet-stream` },
 								body: chunk
 							});
-							expect([200, 204]).toContain(response.status);
+							expect(response.status).toBe(204);
 						}
 						const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
 						const expected = new Uint8Array(totalLength);
@@ -2234,7 +2644,7 @@ function runConformanceTests(options) {
 								headers: { "Content-Type": `application/octet-stream` },
 								body: op.data
 							});
-							expect([200, 204]).toContain(response.status);
+							expect(response.status).toBe(204);
 							appendedData.push(...Array.from(op.data));
 							const offset = response.headers.get(STREAM_OFFSET_HEADER);
 							if (offset) savedOffsets.push(offset);
@@ -2301,7 +2711,7 @@ function runConformanceTests(options) {
 						return true;
 					}
 ), { numRuns: 25 });
-			});
+			}, 15e3);
 			test(`read-your-writes: data is immediately visible after append`, async () => {
 				await fc.assert(fc.asyncProperty(fc.uint8Array({
 					minLength: 1,
@@ -2317,7 +2727,7 @@ function runConformanceTests(options) {
 						headers: { "Content-Type": `application/octet-stream` },
 						body: data
 					});
-					expect([200, 204]).toContain(appendResponse.status);
+					expect(appendResponse.status).toBe(204);
 					const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
 					expect(readResponse.status).toBe(200);
 					const buffer = await readResponse.arrayBuffer();
@@ -2429,7 +2839,7 @@ function runConformanceTests(options) {
 								},
 								body: `data-${seq}`
 							});
-							expect([200, 204]).toContain(response.status);
+							expect(response.status).toBe(204);
 						}
 						return true;
 					}
@@ -2453,7 +2863,7 @@ function runConformanceTests(options) {
 							},
 							body: `first`
 						});
-						expect([200, 204]).toContain(response1.status);
+						expect(response1.status).toBe(204);
 						const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
 							method: `POST`,
 							headers: {
@@ -2468,6 +2878,1171 @@ function runConformanceTests(options) {
 ), { numRuns: 25 });
 			});
 		});
+		describe(`Concurrent Writer Stress Tests`, () => {
+			test(`concurrent writers with sequence numbers - server handles gracefully`, async () => {
+				const streamPath = `/v1/stream/concurrent-seq-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `text/plain` }
+				});
+				const numWriters = 5;
+				const seqValue = `seq-001`;
+				const writePromises = Array.from({ length: numWriters }, (_, i) => fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: {
+						"Content-Type": `text/plain`,
+						[STREAM_SEQ_HEADER]: seqValue
+					},
+					body: `writer-${i}`
+				}));
+				const responses = await Promise.all(writePromises);
+				const statuses = responses.map((r) => r.status);
+				for (const status of statuses) expect([
+					200,
+					204,
+					409
+				]).toContain(status);
+				const successes = statuses.filter((s) => s === 200 || s === 204);
+				expect(successes.length).toBeGreaterThanOrEqual(1);
+				const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+				const content = await readResponse.text();
+				const matchingWriters = Array.from({ length: numWriters }, (_, i) => content.includes(`writer-${i}`)).filter(Boolean);
+				expect(matchingWriters.length).toBeGreaterThanOrEqual(1);
+			});
+			test(`concurrent writers racing with incrementing seq values`, async () => {
+				await fc.assert(fc.asyncProperty(fc.integer({
+					min: 3,
+					max: 8
+				}), async (numWriters) => {
+					const streamPath = `/v1/stream/concurrent-race-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+					await fetch(`${getBaseUrl()}${streamPath}`, {
+						method: `PUT`,
+						headers: { "Content-Type": `text/plain` }
+					});
+					const writePromises = Array.from({ length: numWriters }, (_, i) => fetch(`${getBaseUrl()}${streamPath}`, {
+						method: `POST`,
+						headers: {
+							"Content-Type": `text/plain`,
+							[STREAM_SEQ_HEADER]: String(i).padStart(4, `0`)
+						},
+						body: `data-${i}`
+					}));
+					const responses = await Promise.all(writePromises);
+					const successIndices = [];
+					for (let i = 0; i < responses.length; i++) {
+						expect([
+							200,
+							204,
+							409
+						]).toContain(responses[i].status);
+						if (responses[i].status === 200 || responses[i].status === 204) successIndices.push(i);
+					}
+					expect(successIndices.length).toBeGreaterThanOrEqual(1);
+					const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+					const content = await readResponse.text();
+					for (const i of successIndices) expect(content).toContain(`data-${i}`);
+					return true;
+				}), { numRuns: 10 });
+			});
+			test(`concurrent appends without seq - all data is persisted`, async () => {
+				const streamPath = `/v1/stream/concurrent-no-seq-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `text/plain` }
+				});
+				const numWriters = 10;
+				const writePromises = Array.from({ length: numWriters }, (_, i) => fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: { "Content-Type": `text/plain` },
+					body: `concurrent-${i}`
+				}));
+				const responses = await Promise.all(writePromises);
+				for (const response of responses) expect([200, 204]).toContain(response.status);
+				const offsets = responses.map((r) => r.headers.get(STREAM_OFFSET_HEADER));
+				for (const offset of offsets) expect(offset).not.toBeNull();
+				const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+				const content = await readResponse.text();
+				for (let i = 0; i < numWriters; i++) expect(content).toContain(`concurrent-${i}`);
+			});
+			test(`mixed readers and writers - readers see consistent state`, async () => {
+				const streamPath = `/v1/stream/concurrent-rw-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `text/plain` }
+				});
+				await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: { "Content-Type": `text/plain` },
+					body: `initial`
+				});
+				const numOps = 20;
+				const operations = Array.from({ length: numOps }, (_, i) => {
+					if (i % 2 === 0) return fetch(`${getBaseUrl()}${streamPath}`, {
+						method: `POST`,
+						headers: { "Content-Type": `text/plain` },
+						body: `write-${i}`
+					});
+					else return fetch(`${getBaseUrl()}${streamPath}`);
+				});
+				const responses = await Promise.all(operations);
+				responses.forEach((response, i) => {
+					if (i % 2 === 0) expect([200, 204]).toContain(response.status);
+					else expect(response.status).toBe(200);
+				});
+				const finalRead = await fetch(`${getBaseUrl()}${streamPath}`);
+				const content = await finalRead.text();
+				expect(content).toContain(`initial`);
+				for (let i = 0; i < numOps; i += 2) expect(content).toContain(`write-${i}`);
+			});
+		});
+		describe(`State Hash Verification`, () => {
+			/**
+			* Simple hash function for content verification.
+			* Uses FNV-1a algorithm for deterministic hashing.
+			*/
+			function hashContent(data) {
+				let hash = 2166136261;
+				for (const byte of data) {
+					hash ^= byte;
+					hash = Math.imul(hash, 16777619);
+					hash = hash >>> 0;
+				}
+				return hash.toString(16).padStart(8, `0`);
+			}
+			test(`replay produces identical content hash`, async () => {
+				await fc.assert(fc.asyncProperty(
+					// Generate a sequence of appends
+					fc.array(fc.uint8Array({
+						minLength: 1,
+						maxLength: 100
+					}), {
+						minLength: 1,
+						maxLength: 10
+					}),
+					async (chunks) => {
+						const streamPath1 = `/v1/stream/hash-verify-1-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+						await fetch(`${getBaseUrl()}${streamPath1}`, {
+							method: `PUT`,
+							headers: { "Content-Type": `application/octet-stream` }
+						});
+						for (const chunk of chunks) await fetch(`${getBaseUrl()}${streamPath1}`, {
+							method: `POST`,
+							headers: { "Content-Type": `application/octet-stream` },
+							body: chunk
+						});
+						const response1 = await fetch(`${getBaseUrl()}${streamPath1}`);
+						const data1 = new Uint8Array(await response1.arrayBuffer());
+						const hash1 = hashContent(data1);
+						const streamPath2 = `/v1/stream/hash-verify-2-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+						await fetch(`${getBaseUrl()}${streamPath2}`, {
+							method: `PUT`,
+							headers: { "Content-Type": `application/octet-stream` }
+						});
+						for (const chunk of chunks) await fetch(`${getBaseUrl()}${streamPath2}`, {
+							method: `POST`,
+							headers: { "Content-Type": `application/octet-stream` },
+							body: chunk
+						});
+						const response2 = await fetch(`${getBaseUrl()}${streamPath2}`);
+						const data2 = new Uint8Array(await response2.arrayBuffer());
+						const hash2 = hashContent(data2);
+						expect(hash1).toBe(hash2);
+						expect(data1.length).toBe(data2.length);
+						return true;
+					}
+), { numRuns: 15 });
+			}, 15e3);
+			test(`content hash changes with each append`, async () => {
+				const streamPath = `/v1/stream/hash-changes-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `application/octet-stream` }
+				});
+				const hashes = [];
+				for (let i = 0; i < 5; i++) {
+					await fetch(`${getBaseUrl()}${streamPath}`, {
+						method: `POST`,
+						headers: { "Content-Type": `application/octet-stream` },
+						body: new Uint8Array([
+							i,
+							i + 1,
+							i + 2
+						])
+					});
+					const response = await fetch(`${getBaseUrl()}${streamPath}`);
+					const data = new Uint8Array(await response.arrayBuffer());
+					hashes.push(hashContent(data));
+				}
+				const uniqueHashes = new Set(hashes);
+				expect(uniqueHashes.size).toBe(5);
+			});
+			test(`empty stream has consistent hash`, async () => {
+				const streamPath1 = `/v1/stream/empty-hash-1-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				const streamPath2 = `/v1/stream/empty-hash-2-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+				await fetch(`${getBaseUrl()}${streamPath1}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `application/octet-stream` }
+				});
+				await fetch(`${getBaseUrl()}${streamPath2}`, {
+					method: `PUT`,
+					headers: { "Content-Type": `application/octet-stream` }
+				});
+				const response1 = await fetch(`${getBaseUrl()}${streamPath1}`);
+				const response2 = await fetch(`${getBaseUrl()}${streamPath2}`);
+				const data1 = new Uint8Array(await response1.arrayBuffer());
+				const data2 = new Uint8Array(await response2.arrayBuffer());
+				expect(data1.length).toBe(0);
+				expect(data2.length).toBe(0);
+				expect(hashContent(data1)).toBe(hashContent(data2));
+			});
+			test(`deterministic ordering - same data in same order produces same hash`, async () => {
+				await fc.assert(fc.asyncProperty(fc.array(fc.uint8Array({
+					minLength: 1,
+					maxLength: 50
+				}), {
+					minLength: 2,
+					maxLength: 5
+				}), async (chunks) => {
+					const hashes = [];
+					for (let run = 0; run < 2; run++) {
+						const streamPath = `/v1/stream/order-hash-${run}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+						await fetch(`${getBaseUrl()}${streamPath}`, {
+							method: `PUT`,
+							headers: { "Content-Type": `application/octet-stream` }
+						});
+						for (const chunk of chunks) await fetch(`${getBaseUrl()}${streamPath}`, {
+							method: `POST`,
+							headers: { "Content-Type": `application/octet-stream` },
+							body: chunk
+						});
+						const response = await fetch(`${getBaseUrl()}${streamPath}`);
+						const data = new Uint8Array(await response.arrayBuffer());
+						hashes.push(hashContent(data));
+					}
+					expect(hashes[0]).toBe(hashes[1]);
+					return true;
+				}), { numRuns: 10 });
+			});
+		});
+	});
+	describe(`Idempotent Producer Operations`, () => {
+		const PRODUCER_ID_HEADER = `Producer-Id`;
+		const PRODUCER_EPOCH_HEADER = `Producer-Epoch`;
+		const PRODUCER_SEQ_HEADER = `Producer-Seq`;
+		const PRODUCER_EXPECTED_SEQ_HEADER = `Producer-Expected-Seq`;
+		const PRODUCER_RECEIVED_SEQ_HEADER = `Producer-Received-Seq`;
+		test(`should accept first append with producer headers (epoch=0, seq=0)`, async () => {
+			const streamPath = `/v1/stream/producer-basic-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `hello`
+			});
+			expect(response.status).toBe(200);
+			expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeTruthy();
+			expect(response.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`0`);
+		});
+		test(`should accept sequential producer sequences`, async () => {
+			const streamPath = `/v1/stream/producer-seq-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg0`
+			});
+			expect(r0.status).toBe(200);
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `msg1`
+			});
+			expect(r1.status).toBe(200);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `2`
+				},
+				body: `msg2`
+			});
+			expect(r2.status).toBe(200);
+		});
+		test(`should return 204 for duplicate sequence (idempotent success)`, async () => {
+			const streamPath = `/v1/stream/producer-dup-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `hello`
+			});
+			expect(r1.status).toBe(200);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `hello`
+			});
+			expect(r2.status).toBe(204);
+		});
+		test(`should accept epoch upgrade (new epoch starts at seq=0)`, async () => {
+			const streamPath = `/v1/stream/producer-epoch-upgrade-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `epoch0-msg0`
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `epoch0-msg1`
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `epoch1-msg0`
+			});
+			expect(r.status).toBe(200);
+			expect(r.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`);
+		});
+		test(`should reject stale epoch with 403 (zombie fencing)`, async () => {
+			const streamPath = `/v1/stream/producer-stale-epoch-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `zombie`
+			});
+			expect(r.status).toBe(403);
+			expect(r.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`);
+		});
+		test(`should reject sequence gap with 409`, async () => {
+			const streamPath = `/v1/stream/producer-seq-gap-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg0`
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `2`
+				},
+				body: `msg2`
+			});
+			expect(r.status).toBe(409);
+			expect(r.headers.get(PRODUCER_EXPECTED_SEQ_HEADER)).toBe(`1`);
+			expect(r.headers.get(PRODUCER_RECEIVED_SEQ_HEADER)).toBe(`2`);
+		});
+		test(`should reject epoch increase with seq != 0`, async () => {
+			const streamPath = `/v1/stream/producer-epoch-bad-seq-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1`,
+					[PRODUCER_SEQ_HEADER]: `5`
+				},
+				body: `bad`
+			});
+			expect(r.status).toBe(400);
+		});
+		test(`should require all producer headers together`, async () => {
+			const streamPath = `/v1/stream/producer-partial-headers-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`
+				},
+				body: `msg`
+			});
+			expect(r1.status).toBe(400);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_EPOCH_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r2.status).toBe(400);
+			const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r3.status).toBe(400);
+		});
+		test(`should reject invalid integer formats in producer headers`, async () => {
+			const streamPath = `/v1/stream/producer-invalid-format-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1abc`
+				},
+				body: `msg`
+			});
+			expect(r1.status).toBe(400);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0xyz`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r2.status).toBe(400);
+			const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1e3`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r3.status).toBe(400);
+			const r4 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `-1`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r4.status).toBe(400);
+			const r5 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			expect(r5.status).toBe(200);
+		});
+		test(`multiple producers should have independent state`, async () => {
+			const streamPath = `/v1/stream/producer-multi-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const rA0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-A`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `A0`
+			});
+			expect(rA0.status).toBe(200);
+			const rB0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-B`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `B0`
+			});
+			expect(rB0.status).toBe(200);
+			const rA1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-A`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `A1`
+			});
+			expect(rA1.status).toBe(200);
+			const rB1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-B`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `B1`
+			});
+			expect(rB1.status).toBe(200);
+		});
+		test(`duplicate of seq=0 should not corrupt state`, async () => {
+			const streamPath = `/v1/stream/producer-dup-seq0-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `first`
+			});
+			expect(r1.status).toBe(200);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `first`
+			});
+			expect(r2.status).toBe(204);
+			const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `second`
+			});
+			expect(r3.status).toBe(200);
+		});
+		test(`duplicate response should return highest accepted seq, not request seq`, async () => {
+			const streamPath = `/v1/stream/producer-dup-highest-seq-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			for (let i = 0; i < 3; i++) {
+				const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: {
+						"Content-Type": `text/plain`,
+						[PRODUCER_ID_HEADER]: `test-producer`,
+						[PRODUCER_EPOCH_HEADER]: `0`,
+						[PRODUCER_SEQ_HEADER]: `${i}`
+					},
+					body: `msg-${i}`
+				});
+				expect(r.status).toBe(200);
+				expect(r.headers.get(PRODUCER_SEQ_HEADER)).toBe(`${i}`);
+			}
+			const dupResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `msg-1`
+			});
+			expect(dupResponse.status).toBe(204);
+			expect(dupResponse.headers.get(PRODUCER_SEQ_HEADER)).toBe(`2`);
+		});
+		test(`split-brain fencing scenario`, async () => {
+			const streamPath = `/v1/stream/producer-split-brain-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const rA0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `shared-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `A0`
+			});
+			expect(rA0.status).toBe(200);
+			const rB0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `shared-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `B0`
+			});
+			expect(rB0.status).toBe(200);
+			const rA1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `shared-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `A1`
+			});
+			expect(rA1.status).toBe(403);
+			expect(rA1.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`);
+		});
+		test(`epoch rollback should be rejected`, async () => {
+			const streamPath = `/v1/stream/producer-epoch-rollback-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `2`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `msg`
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `1`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `rollback`
+			});
+			expect(r.status).toBe(403);
+		});
+		test(`producer headers work with Stream-Seq header`, async () => {
+			const streamPath = `/v1/stream/producer-with-stream-seq-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`,
+					[STREAM_SEQ_HEADER]: `app-seq-001`
+				},
+				body: `msg`
+			});
+			expect(r.status).toBe(200);
+		});
+		test(`producer duplicate should return 204 even with Stream-Seq header`, async () => {
+			const streamPath = `/v1/stream/producer-dedupe-before-stream-seq-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`,
+					[STREAM_SEQ_HEADER]: `app-seq-001`
+				},
+				body: `msg`
+			});
+			expect(r1.status).toBe(200);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`,
+					[STREAM_SEQ_HEADER]: `app-seq-001`
+				},
+				body: `msg`
+			});
+			expect(r2.status).toBe(204);
+		});
+		test(`should store and read back data correctly`, async () => {
+			const streamPath = `/v1/stream/producer-readback-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `hello world`
+			});
+			expect(r.status).toBe(200);
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			expect(readResponse.status).toBe(200);
+			const content = await readResponse.text();
+			expect(content).toBe(`hello world`);
+		});
+		test(`should preserve order of sequential producer writes`, async () => {
+			const streamPath = `/v1/stream/producer-order-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			for (let i = 0; i < 5; i++) {
+				const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: {
+						"Content-Type": `text/plain`,
+						[PRODUCER_ID_HEADER]: `test-producer`,
+						[PRODUCER_EPOCH_HEADER]: `0`,
+						[PRODUCER_SEQ_HEADER]: `${i}`
+					},
+					body: `msg-${i}`
+				});
+				expect(r.status).toBe(200);
+			}
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const content = await readResponse.text();
+			expect(content).toBe(`msg-0msg-1msg-2msg-3msg-4`);
+		});
+		test(`duplicate should not corrupt or duplicate data`, async () => {
+			const streamPath = `/v1/stream/producer-dup-integrity-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `first`
+			});
+			expect(r1.status).toBe(200);
+			const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `first`
+			});
+			expect(r2.status).toBe(204);
+			const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `second`
+			});
+			expect(r3.status).toBe(200);
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const content = await readResponse.text();
+			expect(content).toBe(`firstsecond`);
+		});
+		test(`multiple producers should interleave correctly`, async () => {
+			const streamPath = `/v1/stream/producer-interleave-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-A`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `A0`
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-B`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `B0`
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-A`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `A1`
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `producer-B`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: `B1`
+			});
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const content = await readResponse.text();
+			expect(content).toBe(`A0B0A1B1`);
+		});
+		test(`should store and read back JSON object correctly`, async () => {
+			const streamPath = `/v1/stream/producer-json-obj-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: JSON.stringify({
+					event: `test`,
+					value: 42
+				})
+			});
+			expect(r.status).toBe(200);
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const data = await readResponse.json();
+			expect(data).toEqual([{
+				event: `test`,
+				value: 42
+			}]);
+		});
+		test(`should preserve order of JSON appends with producer`, async () => {
+			const streamPath = `/v1/stream/producer-json-order-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` }
+			});
+			for (let i = 0; i < 5; i++) {
+				const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+					method: `POST`,
+					headers: {
+						"Content-Type": `application/json`,
+						[PRODUCER_ID_HEADER]: `test-producer`,
+						[PRODUCER_EPOCH_HEADER]: `0`,
+						[PRODUCER_SEQ_HEADER]: `${i}`
+					},
+					body: JSON.stringify({
+						seq: i,
+						data: `msg-${i}`
+					})
+				});
+				expect(r.status).toBe(200);
+			}
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const data = await readResponse.json();
+			expect(data).toEqual([
+				{
+					seq: 0,
+					data: `msg-0`
+				},
+				{
+					seq: 1,
+					data: `msg-1`
+				},
+				{
+					seq: 2,
+					data: `msg-2`
+				},
+				{
+					seq: 3,
+					data: `msg-3`
+				},
+				{
+					seq: 4,
+					data: `msg-4`
+				}
+			]);
+		});
+		test(`JSON duplicate should not corrupt data`, async () => {
+			const streamPath = `/v1/stream/producer-json-dup-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` }
+			});
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: JSON.stringify({ id: 1 })
+			});
+			const dup = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: JSON.stringify({ id: 1 })
+			});
+			expect(dup.status).toBe(204);
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `1`
+				},
+				body: JSON.stringify({ id: 2 })
+			});
+			const readResponse = await fetch(`${getBaseUrl()}${streamPath}`);
+			const data = await readResponse.json();
+			expect(data).toEqual([{ id: 1 }, { id: 2 }]);
+		});
+		test(`should reject invalid JSON with producer headers`, async () => {
+			const streamPath = `/v1/stream/producer-json-invalid-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `{ invalid json }`
+			});
+			expect(r.status).toBe(400);
+		});
+		test(`should reject empty JSON array with producer headers`, async () => {
+			const streamPath = `/v1/stream/producer-json-empty-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `application/json` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `[]`
+			});
+			expect(r.status).toBe(400);
+		});
+		test(`should return 404 for non-existent stream`, async () => {
+			const streamPath = `/v1/stream/producer-404-${Date.now()}`;
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `data`
+			});
+			expect(r.status).toBe(404);
+		});
+		test(`should return 409 for content-type mismatch`, async () => {
+			const streamPath = `/v1/stream/producer-ct-mismatch-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `application/json`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: JSON.stringify({ data: `test` })
+			});
+			expect(r.status).toBe(409);
+		});
+		test(`should return 400 for empty body`, async () => {
+			const streamPath = `/v1/stream/producer-empty-body-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: `test-producer`,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: ``
+			});
+			expect(r.status).toBe(400);
+		});
+		test(`should reject empty Producer-Id`, async () => {
+			const streamPath = `/v1/stream/producer-empty-id-${Date.now()}`;
+			await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `PUT`,
+				headers: { "Content-Type": `text/plain` }
+			});
+			const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+				method: `POST`,
+				headers: {
+					"Content-Type": `text/plain`,
+					[PRODUCER_ID_HEADER]: ``,
+					[PRODUCER_EPOCH_HEADER]: `0`,
+					[PRODUCER_SEQ_HEADER]: `0`
+				},
+				body: `data`
+			});
+			expect(r.status).toBe(400);
+		});
 	});
 }