@fuzdev/fuz_app 0.126.0 → 0.128.0

package/dist/server/app_server.js

@@ -12,9 +12,9 @@ import { logger } from 'hono/logger';
 import { bodyLimit } from 'hono/body-limit';
 import { z } from 'zod';
 import { session_cookie_options } from '../auth/session_cookie.js';
-import { create_audit_log_sse, audit_log_event_specs } from '../realtime/sse_auth_guard.js';
+import { create_audit_log_sse, create_sse_connection_closer, audit_log_event_specs } from '../realtime/sse_auth_guard.js';
 import { BaseServerEnv } from './env.js';
-import { RateLimiter, default_login_ip_rate_limit, default_login_account_rate_limit, default_action_account_rate_limit, default_action_ip_rate_limit } from '../rate_limiter.js';
+import { RateLimiter, announce_rate_limiters_disabled, default_login_ip_rate_limit, default_login_account_rate_limit, default_action_account_rate_limit, default_action_ip_rate_limit } from '../rate_limiter.js';
 // Side-effect import: augments Hono's ContextVariableMap so consumers
 // that import app_server get type-safe c.get('auth_session_id') etc.
 import '../hono_context.js';
@@ -26,7 +26,7 @@ import { apply_middleware_specs, apply_route_specs, prefix_route_specs } from '.
 import { check_bootstrap_status, create_bootstrap_route_specs } from '../auth/bootstrap_routes.js';
 import { create_surface_route_spec } from '../http/common_routes.js';
 import { flush_pending_effects, flush_post_commit_effects } from '../http/pending_effects.js';
-import { assert_endpoint_in_auth_scope, create_auth_middleware_specs } from '../auth/middleware.js';
+import { assert_endpoint_in_auth_scope, assert_middleware_stack_mounted, create_auth_middleware_specs } from '../auth/middleware.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';
 import { create_fuz_authorization_handler } from '../auth/request_context.js';
 import { ERROR_PAYLOAD_TOO_LARGE } from '../http/error_schemas.js';
@@ -80,16 +80,53 @@ export const DEFAULT_MAX_BODY_SIZE = 1024 * 1024;
  * case; consumers can call `require_audit_sse(ctx)` / `require_audit_sse(server)`
  * to assert the invariant.
  *
- * When `auth_cleanup` is set, the auth cleanup schedule starts as the last
- * step of assembly — so an assembly that throws leaves no schedule running.
+ * Assembly acquires a few things that outlive it — the rate limiters it
+ * builds, the listeners it registers on `deps.audit`, the members it adds to
+ * `deps.connection_closer` — and records a release for each as it goes. When
+ * assembly throws, every release recorded so far runs, last acquired first
+ * (one that throws is logged and the rest still run), and the original error
+ * is rethrown: a failed assembly leaves the backend's emitter and closer as
+ * it found them and no limiter timer running. When `auth_cleanup` is set, the
+ * auth cleanup schedule starts as the last step of assembly — nothing after
+ * it can throw, so an assembly that throws leaves no schedule running.
  *
  * The returned `close` owns shutdown: it stops that schedule, closes every
- * live connection on the backend's closer, disposes the rate limiters built
- * here, and closes the database (`AppServer.close`).
+ * live connection on the backend's closer, runs the same releases, and
+ * closes the database (`AppServer.close`).
  *
  * @returns assembled Hono app, backend, surface build, and bootstrap status
+ * @throws Error from any assembly step, after releasing what assembly acquired
  */
 export const create_app_server = async (options) => {
+    const releases = [];
+    try {
+        return await assemble_app_server(options, releases);
+    }
+    catch (error) {
+        run_releases(releases, options.backend.deps.log, 'a failed assembly');
+        throw error;
+    }
+};
+/**
+ * Run `releases` last-first and empty it. Each runs in its own `try`, so one
+ * that throws is logged and the rest still run.
+ */
+const run_releases = (releases, log, during) => {
+    for (const release of releases.splice(0).reverse()) {
+        try {
+            release();
+        }
+        catch (error) {
+            log.error(`create_app_server: a release during ${during} failed:`, error);
+        }
+    }
+};
+/**
+ * The body of `create_app_server`. Every acquisition that outlives assembly
+ * pushes its release onto `releases` as it happens, so a throw at any later
+ * step unwinds exactly what was acquired.
+ */
+const assemble_app_server = async (options, releases) => {
     const { backend } = options;
     const { deps } = backend;
     const { log } = deps;
@@ -97,16 +134,18 @@ export const create_app_server = async (options) => {
     // one is a default instance under 'enforced', `null` under
     // 'disabled_for_testing'. One instance per surface — see
     // `AppServerOptions.login_ip_rate_limiter` for why these are not a single
-    // shared bucket. The ones built here are the server's to dispose on close.
+    // shared bucket. The ones built here are the server's to dispose — on
+    // close, or when assembly fails.
     const rate_limiter_mode = options.rate_limiters ?? 'enforced';
-    const built_rate_limiters = [];
     const resolve_rate_limiter = (option, defaults) => {
         if (option !== undefined)
             return option;
-        if (rate_limiter_mode === 'disabled_for_testing')
+        if (rate_limiter_mode === 'disabled_for_testing') {
+            announce_rate_limiters_disabled();
             return null;
+        }
         const limiter = new RateLimiter({ ...defaults });
-        built_rate_limiters.push(limiter);
+        releases.push(() => limiter.dispose());
         return limiter;
     };
     const login_ip_rate_limiter = resolve_rate_limiter(options.login_ip_rate_limiter, default_login_ip_rate_limit);
@@ -119,16 +158,19 @@ export const create_app_server = async (options) => {
     // Factory-managed audit SSE — registers a listener on the bound emitter
     // so SSE fan-out runs alongside the consumer's `on_audit_event`
     // without rebuilding `AppDeps`, and adds the registry to the backend's
-    // closer so revocations close its streams.
+    // closer so revocations close its streams. The closer membership is added
+    // here rather than through `create_audit_log_sse`'s option, so its remover
+    // is the server's.
     const audit_sse = options.audit_log_sse
         ? create_audit_log_sse({
             log,
             role: typeof options.audit_log_sse === 'object' ? options.audit_log_sse.role : undefined,
-            connection_closer: deps.connection_closer
+            connection_closer: null
         })
         : null;
     if (audit_sse) {
-        deps.audit.add_listener(audit_sse.on_audit_event);
+        releases.push(deps.connection_closer.add(create_sse_connection_closer(audit_sse.registry)));
+        releases.push(deps.audit.add_listener(audit_sse.on_audit_event));
     }
     // Proxy middleware
     const proxy_spec = create_proxy_middleware_spec({ ...options.proxy, log });
@@ -138,9 +180,13 @@ export const create_app_server = async (options) => {
         session_options: options.session_options,
         daemon_token_state: options.daemon_token_state
     });
-    let middleware_specs = [proxy_spec, ...auth_middleware];
+    const stack_specs = [proxy_spec, ...auth_middleware];
+    let middleware_specs = stack_specs;
     if (options.transform_middleware) {
-        middleware_specs = options.transform_middleware(middleware_specs);
+        // the transform gets copies in a fresh array, so mutating what it was
+        // handed can't rewrite the originals the check matches against
+        middleware_specs = options.transform_middleware(stack_specs.map((spec) => ({ ...spec })));
+        assert_middleware_stack_mounted(stack_specs, middleware_specs);
     }
     // Bootstrap status
     // - undefined / 'disabled': no route mounted; placeholder status.
@@ -221,8 +267,10 @@ export const create_app_server = async (options) => {
     const resolved_ws_endpoints = resolve_ws_endpoints(typeof options.ws_endpoints === 'function'
         ? options.ws_endpoints(context)
         : options.ws_endpoints, options.allowed_origins);
-    const create_upgrade_websocket = options.create_upgrade_websocket;
+    // the endpoints to mount and the adapter factory they need — null when none resolve
+    let ws_mount = null;
     if (resolved_ws_endpoints?.length) {
+        const create_upgrade_websocket = options.create_upgrade_websocket;
         if (create_upgrade_websocket === undefined) {
             throw new Error('create_app_server: ws_endpoints resolved non-empty but create_upgrade_websocket is missing. ' +
                 "Pass a factory returning the Hono adapter's upgradeWebSocket helper.");
@@ -230,12 +278,34 @@ export const create_app_server = async (options) => {
         for (const endpoint of resolved_ws_endpoints) {
             assert_endpoint_in_auth_scope('ws_endpoints', endpoint.path);
         }
+        ws_mount = { endpoints: resolved_ws_endpoints, create_upgrade_websocket };
     }
     // Surface route (default: enabled)
     if (options.surface_route !== false) {
         factory_routes.push(create_surface_route_spec(surface_ref));
     }
     const route_specs = [...consumer_routes, ...factory_routes];
+    // WS path checks — pure data, so they run before anything mounts.
+    // `register_ws_endpoint` mounts a `GET path` upgrade route: a duplicate
+    // path, or one a `RouteSpec` already registered as `GET path`, would be
+    // silently shadowed by Hono's last-wins semantics — fail fast instead.
+    if (ws_mount) {
+        const route_spec_get_paths = new Set();
+        for (const r of route_specs) {
+            if (r.method === 'GET')
+                route_spec_get_paths.add(r.path);
+        }
+        const seen_paths = new Set();
+        for (const endpoint of ws_mount.endpoints) {
+            if (seen_paths.has(endpoint.path)) {
+                throw new Error(`create_app_server: duplicate ws_endpoints path: ${endpoint.path}`);
+            }
+            if (route_spec_get_paths.has(endpoint.path)) {
+                throw new Error(`create_app_server: ws_endpoints path collides with a GET RouteSpec: ${endpoint.path}`);
+            }
+            seen_paths.add(endpoint.path);
+        }
+    }
     // Surface + logging
     const surface_middleware = options.post_route_middleware
         ? [...middleware_specs, ...options.post_route_middleware]
@@ -317,12 +387,6 @@ export const create_app_server = async (options) => {
     log_startup_summary(surface_spec.surface, log, options.env_values);
     // Hono app assembly
     const app = new Hono();
-    // The adapter helper for the WS mount below — built from this app, which
-    // Node's `createNodeWebSocket({app})` needs, and only when there is
-    // something to mount.
-    const upgrade_websocket = resolved_ws_endpoints?.length && create_upgrade_websocket
-        ? create_upgrade_websocket(app)
-        : null;
     // Two-queue side-effect flush. `pending_effects` collects eager
     // fire-and-forget promises (audit emits, api-token usage). `post_commit_effects` collects deferred thunks pushed via
     // `emit_after_commit` (WS notifications, anything that must observe a
@@ -386,17 +450,10 @@ export const create_app_server = async (options) => {
     // adjacent to the consumer routes and ahead of the static fallback —
     // matches the "WS mount is route registration" mental model.
     const mounted_ws_endpoints = {};
-    if (resolved_ws_endpoints?.length && upgrade_websocket) {
-        // Cross-surface collision: `register_ws_endpoint` mounts a `GET path`
-        // upgrade route. If a `RouteSpec` already registered `GET path`,
-        // Hono's last-wins semantics would silently shadow the consumer's
-        // GET route — fail fast instead.
-        const route_spec_get_paths = new Set();
-        for (const r of route_specs) {
-            if (r.method === 'GET')
-                route_spec_get_paths.add(r.path);
-        }
-        const seen_paths = new Set();
+    if (ws_mount) {
+        // the adapter helper — built from this app, which Node's
+        // `createNodeWebSocket({app})` needs, and only when there is something to mount
+        const upgrade_websocket = ws_mount.create_upgrade_websocket(app);
         // Dedupe `auth_guard` wiring by transport reference — two specs
         // sharing one transport instance get a single listener,
         // otherwise revocation events would fire `close_sockets_for_*`
@@ -406,14 +463,7 @@ export const create_app_server = async (options) => {
         // (even with explicit `auth_guard: false`) cannot opt out. To
         // disable, every spec sharing the transport must pass `auth_guard: false`.
         const guarded_transports = new WeakSet();
-        for (const endpoint of resolved_ws_endpoints) {
-            if (seen_paths.has(endpoint.path)) {
-                throw new Error(`create_app_server: duplicate ws_endpoints path: ${endpoint.path}`);
-            }
-            if (route_spec_get_paths.has(endpoint.path)) {
-                throw new Error(`create_app_server: ws_endpoints path collides with a GET RouteSpec: ${endpoint.path}`);
-            }
-            seen_paths.add(endpoint.path);
+        for (const endpoint of ws_mount.endpoints) {
             const { transport: endpoint_transport } = register_ws_endpoint({
                 app,
                 path: endpoint.path,
@@ -422,8 +472,8 @@ export const create_app_server = async (options) => {
                 db: deps.db,
                 actions: endpoint.actions,
                 transport: endpoint.transport,
-                // every revocation handler's close reaches this transport
-                connection_closer: deps.connection_closer,
+                // added below instead, so the remover is the server's
+                connection_closer: null,
                 max_connections_per_account: endpoint.max_connections_per_account,
                 heartbeat: endpoint.heartbeat,
                 artificial_delay: endpoint.artificial_delay,
@@ -436,13 +486,15 @@ export const create_app_server = async (options) => {
                 action_account_rate_limiter
             });
             mounted_ws_endpoints[endpoint.path] = endpoint_transport;
+            // every revocation handler's close reaches this transport
+            releases.push(deps.connection_closer.add(endpoint_transport));
             if (endpoint.auth_guard !== false && !guarded_transports.has(endpoint_transport)) {
                 guarded_transports.add(endpoint_transport);
-                deps.audit.add_listener(create_ws_auth_guard(endpoint_transport, log));
+                releases.push(deps.audit.add_listener(create_ws_auth_guard(endpoint_transport, log)));
             }
             if (endpoint.extra_audit_handlers?.length) {
                 for (const handler of endpoint.extra_audit_handlers) {
-                    deps.audit.add_listener(handler);
+                    releases.push(deps.audit.add_listener(handler));
                 }
             }
         }
@@ -459,8 +511,10 @@ export const create_app_server = async (options) => {
         }
     }
     // Auth cleanup — opt-in, and last: nothing after it can throw, so a failed
-    // assembly never leaves a schedule running. Its closes go through
-    // `deps.connection_closer`, which the mounts above have filled.
+    // assembly never leaves a schedule running. Its own throw (an invalid
+    // `interval_ms`) comes before any pass starts, and unwinds `releases` like
+    // any other. Its closes go through `deps.connection_closer`, which the
+    // mounts above have filled.
     const auth_cleanup = options.auth_cleanup
         ? start_auth_cleanup(deps, options.auth_cleanup === true ? undefined : options.auth_cleanup)
         : null;
@@ -478,8 +532,9 @@ export const create_app_server = async (options) => {
         catch (error) {
             log.error('create_app_server: closing live connections on shutdown failed:', error);
         }
-        for (const limiter of built_rate_limiters)
-            limiter.dispose();
+        // then what assembly acquired — the audit listeners and closer members
+        // this server added, and the limiters it built
+        run_releases(releases, log, 'shutdown');
         await backend.close();
     };
     return {

package/dist/testing/CLAUDE.md

@@ -33,11 +33,11 @@ time (never runtime), where a throwing guard would break `vite build`.
 - `stub_mw` — pass-through middleware (`async (_c, next) => next()`).
 - `stub_app_deps` — frozen `AppDeps`, every capability throwing, `audit` a no-op `AuditEmitter` from `create_test_audit_emitter`, `connection_closer` an empty `RealtimeCloser`.
 - `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`, an empty `connection_closer`.
-- `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0.
+- `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0, `drain_inflight` resolves immediately.
 - `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
-- `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth. See `auth/CLAUDE.md` §Middleware for the real stack.
+- `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth. Each spec gets its own pass-through handler (not the shared `stub_mw`), so `assert_middleware_stack_mounted` tells the layers apart. See `auth/CLAUDE.md` §Middleware for the real stack.
 - `create_stub_app_server_context(session_options)` — stub `AppServerContext`; rate limiters null, `bootstrap_status.available: false`.
-- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly (consumer routes + stub middleware + surface generation). `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `transform_middleware?`, `bootstrap?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
+- `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly (consumer routes + stub middleware + surface generation). Its middleware list mirrors the real one — a stub `trusted_proxy` spec at `'*'`, then the stub auth stack — so every route's `applicable_middleware` starts with `trusted_proxy` (a route outside `/api/*` now lists just `['trusted_proxy']`), as on the live server. `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `allowed_origins?`, `transform_middleware?`, `bootstrap?`. Throws, like `create_app_server`, on an endpoint path outside `AUTH_MIDDLEWARE_PATH` (`assert_endpoint_in_auth_scope`) and on a `transform_middleware` that moves, drops, duplicates, reorders, wraps, or replaces the stub proxy spec or a stub auth spec (`assert_middleware_stack_mounted`); the transform receives shallow copies in a fresh array, so an in-place mutation can't slip past the check. Throws on a `ws_endpoints` spec with no `allowed_origins` of its own when no `allowed_origins` option is given (there is no server list to default from). Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
 
 Throwing stubs surface mock escape: a test that accidentally reaches into
 stub territory breaks immediately with a label-scoped error rather than
@@ -100,7 +100,7 @@ mismatch.
 ### `audit_drift_guard.ts` — audit-emission validation
 
 - `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts`. Call once at the top of any `describe_db` block firing audit emits — production validation is fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field is silent. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
-- `create_recording_audit_emitter(calls_ref?)` — no-op `AuditEmitter` pushing every `emit` and `emit_pool` call into `calls`. Pass `calls_ref` to write into a caller-owned array; omit to let the helper allocate. Returns `{emitter, calls}` — destructure `emitter` as the `audit` dep and read `calls` to assert. Replaces per-file capturing emitters previously duplicated across `password_change.test.ts`, `audit_log.test.ts`, etc.
+- `create_recording_audit_emitter(calls_ref?)` — no-op `AuditEmitter` pushing every `emit` and `emit_pool` call into `calls`. Pass `calls_ref` to write into a caller-owned array; omit to let the helper allocate. Returns `{emitter, calls}` — destructure `emitter` as the `audit` dep and read `calls` to assert. `add_listener` records (never fires) and returns a remover with the production semantics, so `listener_count` tracks what a server registered and released. Replaces per-file capturing emitters previously duplicated across `password_change.test.ts`, `audit_log.test.ts`, etc.
 - `RecordingAuditEmitter` — `{emitter: AuditEmitter; calls: Array<AuditLogInput>}`.
 
 ### `connection_closer_helpers.ts` — `ConnectionCloser` test doubles
@@ -179,15 +179,17 @@ Types:
 `create_test_app` hard-codes the test-friendly `AppServerOptions`:
 `allowed_origins: [/^http:\/\/localhost/]`, stub proxy pinned to `127.0.0.1`,
 `env_schema: z.object({})`, `rate_limiters: 'disabled_for_testing'` (every
-rate limiter `null`, the action limiters included — a limiter passed through
-`app_options` wins over the mode, so a rate-limit test enables just the one it
-pins), static daemon token state (no rotation, keeper already set),
+rate limiter `null` — a limiter passed through `app_options` wins over the
+mode, so a rate-limit test enables just the one it pins; the mode's stderr
+banner prints once per module instance — once per test file in an isolated
+vitest project, once per run under `isolate: false`, ../../../docs/usage.md §Rate limiters), static daemon token state (no rotation, keeper already set),
 **`await_pending_effects: true`** (fire-and-forget effects complete before
 the response returns so tests can assert on side effects inline), and silent
 logger. Override via `app_options`. `create_test_app_for_bootstrap` disables
 the limiters the same way. `cleanup()` is the assembled server's idempotent
-`close` — it also closes the server's live connections and disposes the
-limiters it built.
+`close` — it also closes the server's live connections, disposes the
+limiters it built, and removes the audit listeners and closer members it
+added.
 
 `auth_cleanup` is left at its default, **off**, here and in
 `create_test_app_for_bootstrap`: a background pass would delete rows and
@@ -551,7 +553,7 @@ Three layers:
 
 1. **Primitives** — `create_fake_ws()`, `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same. `create_stub_upgrade()` stands in for a runtime adapter's `upgradeWebSocket`: it passes a request without `Upgrade: websocket` to `next()`, and records an upgrade request — its real `Context` and the endpoint's events factory — in `upgrades`, answering `200`. So a test can send `app.request('/api/ws', {headers: {upgrade: 'websocket', cookie | authorization, origin, 'x-forwarded-for'}})` through an assembled app's whole middleware chain and build the socket's events from the `Context` that chain produced (`src/test/server/create_app_server_ws_endpoints.dispatch.db.test.ts`); `get_create_events()` still returns the last mounted factory, for a hand-built context.
 2. **Harness** — `create_ws_test_harness({actions, transport?, heartbeat?, log?, on_socket_open?, on_socket_close?})` → `WsTestHarness`. `connect(identity?)` is async and resolves after the connection is admitted and `on_socket_open` completes, so broadcasts sent immediately after `await harness.connect()` reach the client. The harness pre-bakes its `RequestContext` (`TEST_CONTEXT_PRESET_KEY`), which also skips the admission credential re-read — there are no session or token rows behind a harness identity — so tests of the re-read itself drive `register_action_ws` with a real database and no preset (`src/test/actions/register_action_ws.admission.db.test.ts`). The harness threads its own `create_stub_db()` into the dispatcher's `db` slot so handlers declaring `side_effects: true` execute under the same transaction wrap they would in production (the stub's `transaction(fn)` synchronously calls `fn(stub_db)`); domain deps reach handlers via factory closures, the same way HTTP RPC factories already wire them. Audit fan-out runs through whatever `audit` emitter the consumer supplied to its action factory closure (typically `create_test_audit_emitter()` for unit harnesses).
-3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts). `build_broadcast_api<TApi>({harness, specs})` (in `ws_round_trip.ts`) wires a typed broadcast API against the harness transport.
+3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts).
 
 `WsClient` (in `transports/ws_client.ts`):
 `{send, request<R>, close, messages, wait_for, wait_for_close, close_code, close_reason}`.
@@ -572,8 +574,6 @@ of undefined`). `wait_for(predicate, timeout_ms?)` checks already-received
 messages first, then waits for new arrivals (default 1000ms); drops the
 waiter on timeout so the `waiters` array doesn't grow.
 
-`keeper_identity()` — convenience for `{credential_type: 'daemon_token', roles: [ROLE_KEEPER]}`.
-
 ## Data exposure + rate limiting
 
 ### `data_exposure.ts` — `describe_data_exposure_tests`
@@ -979,10 +979,11 @@ source of truth for wire-shape conformance.
   same TCP write as the upgrade request reach the socket; `false` Bun, whose
   HTTP parser answers such a request `400`, and `false` in-process, where there
   is no socket to write raw bytes to).
-  `ws_account_actions` gates the WS round-trip suite's self-revocation case
-  (the WS endpoint mounts the account actions — `true` on fuz_app's own spine
-  presets, `false` in the family defaults), and `ws_self_revocation_reply`
-  says what that case requires: the reply ahead of the close (`true`, the TS
+  `ws_account_actions` (the WS endpoint mounts the account actions — `true` on
+  fuz_app's own spine presets, `false` in the family defaults) gates the WS
+  round-trip suite's self-revocation case and, with `rpc_path`, its
+  WS-mutation audit case (which calls `_testing_drain_effects`);
+  `ws_self_revocation_reply` says what the self-revocation case requires: the reply ahead of the close (`true`, the TS
   family) or the close alone (`false`, the Rust family, whose socket loop
   drops the response once the connection is closed — a recorded divergence).
 
@@ -1127,11 +1128,15 @@ time**, so the negative upgrade cases assert the upgrade itself rejects, not
 a per-message error; the close cases prove a revocation closes an
 already-open socket, since per-message dispatch never re-checks credential
 validity. Omit `rpc_path` to skip the close cases (consumers without the
-standard account and admin actions on their RPC endpoint). One case is gated
+standard account and admin actions on their RPC endpoint). Two cases are gated
 on `capabilities.ws_account_actions` (the WS endpoint mounts the account
 actions): a socket that revokes its own sessions over that socket is closed
 with `WS_CLOSE_SESSION_REVOKED`, and — where the backend declares
-`capabilities.ws_self_revocation_reply` — reads the reply first.
+`capabilities.ws_self_revocation_reply` — reads the reply first; and (with
+`rpc_path`) a socket mints an API token over WS, and its `token_create` audit
+row is read back after `_testing_drain_effects` — a WS reply can precede its
+audit write, so the drain is the barrier (the binary mounts it via
+`create_testing_actions`).
 Otherwise **consumer-agnostic** — it drives only the `heartbeat` protocol action
 (guaranteed on every WS endpoint by `assert_ws_endpoints_include_protocol_actions`),
 so it validates the transport without touching domain WS methods. Gated on
@@ -1450,18 +1455,25 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   `testing_reset_actions.ts` TSDoc for the audit + WS fan-out rationale
   that rejected a `_testing_seed_role_grant` shape.
 
-  Same module also exports `create_testing_drain_effects_action()` — the
+  Same module also exports `create_testing_drain_effects_action(audit)` — the
   `_testing_drain_effects` RPC action (daemon-token-gated, like
-  `_testing_reset`). It awaits in-flight fire-and-forget audit writes so a
-  following `audit_log_list` is authoritative — the deterministic barrier a
-  cross-process audit assertion fires before reading (no poll/sleep). On the
-  TS spine it is **satisfied by construction** (the binary runs
-  `await_pending_effects: true`, so each mutation's emits land before its
-  response); the Rust spine does the real await in
-  `AuditEmitter::drain_inflight`. `create_testing_actions` bundles it
-  alongside `_testing_reset`; suites that mount their own endpoint (e.g. the
-  in-process `account_lifecycle_parity.db.test.ts`) add it directly so the
-  shared suite body can call the barrier on every backend uniformly.
+  `_testing_reset`). It awaits `audit.drain_inflight()` so a following
+  `audit_log_list` is authoritative — the deterministic barrier a
+  cross-process audit assertion fires before reading (no poll/sleep). The
+  emitter must be built with `create_audit_emitter({track_inflight: true})`
+  (the spine binary's `audit_factory` does), or the drain resolves at once.
+  The barrier is needed whatever the transport: HTTP on a binary running
+  `await_pending_effects: true` settles a mutation's writes before
+  responding, but WS replies before its effects flush, so a WS mutation's
+  audit write can still be in flight when its reply arrives. The drain waits
+  until no tracked `emit` write is outstanding — writes started while it
+  waits included — the same wait-for-zero as the Rust spine's
+  `AuditEmitter::drain_inflight` over `new_with_inflight_tracking`.
+  `create_testing_actions` bundles it over `deps.audit`; suites that mount
+  their own endpoint (e.g. the in-process
+  `account_lifecycle_parity.db.test.ts`) add it directly, over a tracked
+  emitter, so the shared suite body can call the barrier on every backend
+  uniformly.
 
   Also bundled: `_testing_mint_session` — mints a backdated-expiry
   `auth_session` row for an account (via `mint_test_session` in `app_server.ts`)
@@ -1594,12 +1606,15 @@ drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`
 
 ### Testing-backdoor credential gate — `cross_backend/testing_backdoor.ts`
 
-`describe_testing_backdoor_cross_tests({setup_test, rpc_path?})` —
+`describe_testing_backdoor_cross_tests({setup_test, rpc_path?, ws?})` —
 the negative-credential parity suite for the `_testing_*` backdoor actions.
-For each of `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
-`_testing_schema_snapshot` (the three privileged writes plus the schema-dump
-read) it fires three principals over real HTTP: **anonymous** → 401, **session** →
-403 `credential_type_required`, **bearer** → 403 `credential_type_required` —
+For each `_testing_*` action except `_testing_drain_effects` (the three
+privileged writes plus the three introspection reads) it fires three principals over real HTTP: **anonymous** →
+401 `unauthenticated`, **session** → 403 `forbidden` `credential_type_required`,
+**bearer** → 403 `forbidden` `credential_type_required` — and, when `ws`
+(`{base_url, ws_path, origin?}`) is passed, sends each on a socket opened with
+the keeper's session cookie, which answers the same `forbidden`
+`credential_type_required` (a socket is no way around the daemon-token channel) —
 proving the daemon-token gate that fences each backdoor action holds end-to-end
 on the real dispatcher (the spec-derived `describe_rpc_attack_surface_tests`
 never enumerates them because they're off the declared surface). Each method is
@@ -1731,12 +1746,10 @@ TEST-NET-2 addresses nothing else sends. The backends are started by the
 backend configs (`ts_spine_*_backend_config`, `rust_spine_stub_backend_config`),
 which set `ACTION_RATE_LIMIT_ENABLED_ENV` (`FUZ_ACTION_RATE_LIMIT_ENABLED`) and
 `ACTION_RATE_LIMIT_MAX_ATTEMPTS_ENV` (`FUZ_ACTION_RATE_LIMIT_MAX_ATTEMPTS`) from
-`default_backend_configs.ts` — both spine binaries build one IP + one account
+`spine_surface_constants.ts` — both spine binaries build one IP + one account
 limiter (the action defaults' windows, the cap replacing both
 `max_attempts`) shared by RPC and WS, and refuse to boot on a cap without the
-flag. Off, the TS spine builds no action limiter, and the Rust stub keeps its
-default posture: its auth families charge an always-on per-account limiter at
-the production cap, its dispatchers none. Runs under the
+flag. Off, neither spine builds an action limiter. Runs under the
 `cross_backend_security` dual-spawn beside the login-security suite. The TS
 spine charges every classed action in its dispatcher; the Rust stub charges
 `account_token_create` and the other auth-family specs inside their handlers

package/dist/testing/app_server.d.ts

@@ -302,7 +302,7 @@ export interface TestApp {
     create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
     create_account: (options?: CreateTestAppAccountArgs) => Promise<TestAccount>;
-    /** Cleanup resources — `AppServer.close`: stops an opted-in auth cleanup schedule, closes live connections, disposes the limiters the server built, then the backend's `close`. Idempotent. */
+    /** Cleanup resources — `AppServer.close`: stops an opted-in auth cleanup schedule, closes live connections, disposes the limiters the server built and removes the audit listeners and closer members it added, then the backend's `close`. Idempotent. */
     cleanup: () => Promise<void>;
 }
 /**

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAkJD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,+LAA+L;IAC/L,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAuGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAyE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAkJD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,2PAA2P;IAC3P,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAmBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAiGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAmE7B,CAAC"}

package/dist/testing/app_server.js

@@ -256,6 +256,19 @@ export const create_test_app_server = async (options) => {
         cleanup: () => backend.close()
     };
 };
+/**
+ * The `create_app_server` options both test-app builders share — a fresh
+ * object per call, spread ahead of the per-builder options and `app_options`.
+ */
+const test_app_server_base_options = () => ({
+    allowed_origins: [/^http:\/\/localhost/],
+    proxy: { trusted_proxies: ['127.0.0.1'], get_connection_ip: () => '127.0.0.1' },
+    env_schema: z.object({}),
+    // every limiter off unless `app_options` passes one — a rate-limit test
+    // enables just the limiter it pins
+    rate_limiters: 'disabled_for_testing',
+    await_pending_effects: true
+});
 /**
  * Create a fully assembled test app with a Hono server, middleware, and routes.
  *
@@ -283,15 +296,9 @@ export const create_test_app = async (options) => {
         keeper_account_id: test_server.account.id
     };
     const result = await create_app_server({
+        ...test_app_server_base_options(),
         backend: test_server,
         session_options: options.session_options,
-        allowed_origins: [/^http:\/\/localhost/],
-        proxy: { trusted_proxies: ['127.0.0.1'], get_connection_ip: () => '127.0.0.1' },
-        env_schema: z.object({}),
-        // every limiter off unless `app_options` passes one — a rate-limit test
-        // enables just the limiter it pins
-        rate_limiters: 'disabled_for_testing',
-        await_pending_effects: true,
         daemon_token_state,
         rpc_endpoints: options.rpc_endpoints,
         bootstrap: options.bootstrap,
@@ -418,15 +425,9 @@ export const create_test_app_for_bootstrap = async (options) => {
         keeper_account_id: null
     };
     const result = await create_app_server({
+        ...test_app_server_base_options(),
         backend,
         session_options,
-        allowed_origins: [/^http:\/\/localhost/],
-        proxy: { trusted_proxies: ['127.0.0.1'], get_connection_ip: () => '127.0.0.1' },
-        env_schema: z.object({}),
-        // every limiter off unless `app_options` passes one — a rate-limit test
-        // enables just the limiter it pins
-        rate_limiters: 'disabled_for_testing',
-        await_pending_effects: true,
         daemon_token_state,
         rpc_endpoints: options.rpc_endpoints,
         bootstrap,

package/dist/testing/attack_surface.d.ts

@@ -53,7 +53,7 @@ export interface StandardAttackSurfaceOptions {
     snapshot_path: string;
     /** Expected public routes, e.g. `['GET /health', 'POST /api/account/login']`. */
     expected_public_routes: Array<string>;
-    /** Expected middleware names for API routes, e.g. `['origin', 'session', 'request_context', 'bearer_auth']`. */
+    /** Expected middleware names for API routes, e.g. `['trusted_proxy', 'origin', 'session', 'request_context', 'bearer_auth']`. */
     expected_api_middleware: Array<string>;
     /** All roles in the app (e.g. `['admin', 'keeper']`). */
     roles: Array<string>;

package/dist/testing/attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAejC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsDpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IA2J3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,gHAAgH;IAChH,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA4EF,CAAC"}
+{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAejC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsDpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IA2J3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,iIAAiI;IACjI,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA4EF,CAAC"}

package/dist/testing/audit_drift_guard.d.ts

@@ -46,8 +46,10 @@ export interface RecordingAuditEmitter {
  * forward from the input envelope. Tests asserting on role-grant-shape
  * emissions read out of the same homogeneous `calls` array.
  * `notify` is a no-op; `add_listener` records into a local array that
- * `listener_count` reports (registered listeners never fire — this emitter
- * captures `emit` shapes, not fan-out).
+ * `listener_count` reports, and returns a remover with the production
+ * semantics (per registration, idempotent) — registered listeners never fire,
+ * since this emitter captures `emit` shapes, not fan-out. `drain_inflight` resolves at once:
+ * a recorded call writes nothing, so nothing is ever in flight.
  *
  * `emit` AND `emit_pool` both append to `calls`, so a test reads either
  * entry point's writes off the same array.

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA8BF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBAqCF,CAAC"}