@fuzdev/fuz_app 0.126.0 → 0.128.0

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -168,16 +168,21 @@ export const testing_reset_action_spec = {
  * the cross-backend conformance suite uses in place of a poll/sleep before
  * asserting on audit rows.
  *
- * On the TS spine the barrier is **satisfied by construction**: the test
- * binary runs `await_pending_effects: true`, so every **HTTP** mutation's
- * fire-and-forget audit emits are awaited before its response returns — by
- * the time a later drain call runs, prior emits are already durable. A
- * WS-dispatched mutation replies before its effects flush, so on TS this
- * action is not a barrier for WS-originated emits; issue audit-asserting
- * mutations over HTTP. The action still
- * exists so the cross-backend test body calls the same method on every
- * backend; the Rust spine (whose audit writes are detached tokio tasks)
- * does the real await in `AuditEmitter::drain_inflight`.
+ * The handler awaits `AuditEmitter.drain_inflight`, which waits until no
+ * tracked `emit` write is outstanding — so the binary's emitter must be built
+ * with `track_inflight: true`, or the drain resolves at once and is no barrier.
+ * Tracking is what makes it a barrier whatever the transport: an **HTTP**
+ * mutation on a binary running `await_pending_effects: true` has its writes
+ * settled by the time it responds, but a **WS** mutation is answered before
+ * its effects flush (reply-then-close for a self-revocation), so its audit
+ * write can still be in flight when the caller reads the reply. The Rust
+ * spine does the same await in `AuditEmitter::drain_inflight`, over an
+ * emitter built with `new_with_inflight_tracking`.
+ *
+ * Covered: every `emit` that ran before the drain was dispatched, and any
+ * started while it waits. A write that starts after the drain resolves is
+ * not — nor are eager writes outside `emit` (session touch, token usage),
+ * which only the dispatching transport's own flush awaits.
  *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
@@ -246,13 +251,18 @@ export const testing_mint_session_action_spec = {
         'signed cookie value (exercises the authoritative server-side DB-row expiry gate).'
 };
 /**
- * Build the standalone `_testing_drain_effects` action. No deps — on TS the
- * barrier is satisfied by `await_pending_effects` (see the spec doc), so the
- * handler just returns `{ok: true}`. Mount it on any test endpoint whose
- * suite asserts on audit rows (the spine binary bundles it via
+ * Build the standalone `_testing_drain_effects` action over `audit` — the
+ * emitter the backend's handlers emit through (`deps.audit`), built with
+ * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
+ * whose suite asserts on audit rows (the spine binary bundles it via
  * `create_testing_actions`; in-process suites mount it directly).
+ *
+ * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
-export const create_testing_drain_effects_action = () => rpc_action(testing_drain_effects_action_spec, async () => ({ ok: true }));
+export const create_testing_drain_effects_action = (audit) => rpc_action(testing_drain_effects_action_spec, async () => {
+    await audit.drain_inflight();
+    return { ok: true };
+});
 /**
  * `_testing_put_fact` — seed an **embedded** fact (`fact.bytes`) for the
  * cross-process fact-serving suite, which drives over real HTTP and has no
@@ -405,9 +415,10 @@ export const create_testing_action_manifest_action = (mounted) => {
 /**
  * Build the testing RPC actions for a test binary's registry.
  *
- * Returns `_testing_reset` — the single privileged action test binaries
- * register. The test binary calls this at server-assembly time and
- * registers the result on its dispatcher.
+ * Returns the bundled `_testing_*` actions (module doc). The test binary
+ * calls this at server-assembly time and registers the result on its
+ * dispatcher. `_testing_drain_effects` drains `deps.audit`, so the binary's
+ * `audit_factory` builds the emitter with `track_inflight: true`.
  *
  * The reset action's table-wipe list mirrors
  * `auth_integration_truncate_tables` from `testing/db.ts` — the
@@ -533,7 +544,7 @@ export const create_testing_actions = (deps, options) => {
             });
             return { hash };
         }),
-        create_testing_drain_effects_action(),
+        create_testing_drain_effects_action(deps.audit),
         create_testing_schema_snapshot_action(),
         create_testing_migration_tracker_action()
     ];

package/dist/testing/cross_backend/testing_server_core.d.ts

@@ -9,13 +9,13 @@ import '../assert_dev_env.js';
  * orchestration — stale-daemon check, daemon-info write, serve, post-serve
  * WS attach, graceful shutdown — and delegates the runtime-boundary
  * primitives (HTTP serve, WS upgrade construction, signals, pid, exit) to a
- * {@link TestingServerAdapter}. The shipped adapters are
+ * `TestingServerAdapter`. The shipped adapters are
  * `testing/cross_backend/testing_server_node.ts` (`@hono/node-server` + `@hono/node-ws`),
  * `testing/cross_backend/testing_server_deno.ts` (`Deno.serve` + `@hono/deno`), and
  * `testing/cross_backend/testing_server_bun.ts` (`Bun.serve` + `@hono/bun`).
  *
  * The app itself — routes, RPC, DB, `_testing_reset`, WS endpoints — is the
- * caller's {@link StartTestingServerOptions.build_app} seam, so this core
+ * caller's `StartTestingServerOptions.build_app` seam, so this core
  * stays domain-free. WebSocket endpoints mount through `create_app_server`'s
  * `ws_endpoints`: `build_app` asks its context to prepare the runtime's
  * upgrade helper and passes the resulting factory as
@@ -49,7 +49,7 @@ export interface ServeHandle {
     /** Adapter-specific server ref for post-serve hooks. Type-erased at the seam. */
     native?: unknown;
 }
-/** Options for {@link TestingServerAdapter.prepare_websocket}. */
+/** Options for `TestingServerAdapter.prepare_websocket`. */
 export interface PrepareWebsocketOptions {
     /**
      * Largest inbound WebSocket message, in bytes — pass the largest
@@ -70,7 +70,7 @@ export interface PrepareWebsocketOptions {
  *
  * `create_upgrade_websocket` is the factory a build passes to
  * `create_app_server` as `AppServerOptions.create_upgrade_websocket`.
- * `attach_to_server` runs after `serve()` returns a {@link ServeHandle} —
+ * `attach_to_server` runs after `serve()` returns a `ServeHandle` —
  * Node uses it for `injectWebSocket(server)`, and it does nothing when the
  * factory was never called (no `ws_endpoints`); Deno and Bun leave it
  * undefined.
@@ -83,7 +83,7 @@ export interface PreparedWebsocket {
  * Runtime adapter contract for the test-binary entry. Each adapter
  * (`testing/cross_backend/testing_server_node.ts`, `testing/cross_backend/testing_server_deno.ts`,
  * `testing/cross_backend/testing_server_bun.ts`) implements this and hands the shape to
- * {@link start_testing_server}.
+ * `start_testing_server`.
  */
 export interface TestingServerAdapter {
     /** Human-readable runtime label for log output (e.g. `"Node"`, `"Deno"`). */
@@ -94,7 +94,7 @@ export interface TestingServerAdapter {
     get_connection_ip: (c: Context) => string | undefined;
     /** Prepare the runtime's WS upgrade helper and its post-serve attach step. */
     prepare_websocket: (options?: PrepareWebsocketOptions) => PreparedWebsocket;
-    /** Bind `app.fetch` to `port` on `hostname`; return a {@link ServeHandle}. */
+    /** Bind `app.fetch` to `port` on `hostname`; return a `ServeHandle`. */
     serve: (options: {
         fetch: Hono['fetch'];
         port: number;
@@ -107,7 +107,7 @@ export interface TestingServerAdapter {
     /** Forceful exit on graceful-shutdown completion or fatal error. */
     exit: (code: number) => never;
 }
-/** What the core hands a {@link StartTestingServerOptions.build_app} seam. */
+/** What the core hands a `StartTestingServerOptions.build_app` seam. */
 export interface BuildTestingAppContext {
     /**
      * Prepare the runtime adapter's WS upgrade helper and return the factory
@@ -120,7 +120,7 @@ export interface BuildTestingAppContext {
      */
     prepare_websocket: (options?: PrepareWebsocketOptions) => (app: Hono) => UpgradeWebSocket;
 }
-/** The assembled app a {@link StartTestingServerOptions.build_app} seam returns. */
+/** The assembled app a `StartTestingServerOptions.build_app` seam returns. */
 export interface BuiltTestingApp {
     /** The assembled Hono app (HTTP routes, RPC, and WS endpoints already mounted). */
     app: Hono;
@@ -131,7 +131,7 @@ export interface BuiltTestingApp {
      */
     close: () => Promise<void>;
 }
-/** Options for {@link start_testing_server}. */
+/** Options for `start_testing_server`. */
 export interface StartTestingServerOptions {
     /** Runtime-boundary adapter (Node or Deno). */
     adapter: TestingServerAdapter;
@@ -173,8 +173,8 @@ export declare const is_loopback_host: (host: string) => boolean;
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
  * check, daemon-info write, bind, graceful shutdown — but the app is the
- * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
- * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
+ * caller's no-domain (or domain) `StartTestingServerOptions.build_app`
+ * and the runtime boundary is the `TestingServerAdapter`. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see
  * `is_loopback_host`).
  */

package/dist/testing/cross_backend/testing_server_core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,uBAAuB;IACvC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,wBAAwB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAC1D,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IAC5E,8EAA8E;IAC9E,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACtC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;CAC1F;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC/B,mFAAmF;IACnF,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CAkE3F,CAAC"}
+{"version":3,"file":"testing_server_core.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_server_core.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACvC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,wBAAwB,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAC1D,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IAC5E,wEAAwE;IACxE,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;IAC1F,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACtC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;CAC1F;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC/B,mFAAmF;IACnF,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,+CAA+C;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,0EAA0E;IAC1E,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,OAG/C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAU,SAAS,yBAAyB,KAAG,OAAO,CAAC,IAAI,CAkE3F,CAAC"}

package/dist/testing/cross_backend/testing_server_core.js

@@ -19,8 +19,8 @@ export const is_loopback_host = (host) => {
  *
  * Mirrors a production `start_server` at the surface level — stale-daemon
  * check, daemon-info write, bind, graceful shutdown — but the app is the
- * caller's no-domain (or domain) {@link StartTestingServerOptions.build_app}
- * and the runtime boundary is the {@link TestingServerAdapter}. Refuses any
+ * caller's no-domain (or domain) `StartTestingServerOptions.build_app`
+ * and the runtime boundary is the `TestingServerAdapter`. Refuses any
  * non-loopback bind host (the test binary must stay on loopback — see
  * `is_loopback_host`).
  */

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -17,8 +17,6 @@ import '../assert_dev_env.js';
  * @module
  */
 import type { BackendConfig } from './backend_config.js';
-/** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
-export declare const TS_SPINE_DIR_ENV = "FUZ_TESTING_TS_SPINE_DIR";
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */
 export declare const TS_SPINE_NODE_DEFAULT_PORT = 1178;
 /** Default port for the Deno TS spine binary. */

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA2C3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,9 +1,7 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { LOGIN_RATE_LIMIT_ENABLED_ENV, action_rate_limit_env, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
-import { SPINE_SSE_PATH } from './spine_surface_constants.js';
-/** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
-export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
+import { action_rate_limit_env, make_default_ts_backend_config, ts_default_capabilities } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, SPINE_SSE_PATH, TS_SPINE_DIR_ENV } from './spine_surface_constants.js';
 /**
  * Capabilities for the TS spine binary — `ts_default_capabilities` plus `sse`
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts

@@ -1,6 +1,6 @@
 import '../assert_dev_env.js';
 import type { SetupTest } from './setup.js';
-/** Options for {@link describe_ws_action_rate_limit_cross_tests}. */
+/** Options for `describe_ws_action_rate_limit_cross_tests`. */
 export interface WsActionRateLimitCrossTestOptions {
     /** Per-test fixture producer (cross-process only — see the module doc). */
     readonly setup_test: SetupTest;

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,qEAAqE;AACrE,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}
+{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}

package/dist/testing/cross_backend/ws_round_trip.d.ts

@@ -38,7 +38,8 @@ export interface CrossProcessWsTestOptions {
  * oversized message closing with `WS_CLOSE_MESSAGE_TOO_BIG`, anonymous-upgrade
  * refusal, disallowed-origin refusal, and — when `rpc_path` is supplied —
  * session revocation and account deletion closing the live socket, plus a
- * self-revoking socket reading its reply before its close.
+ * self-revoking socket reading its reply before its close, and a WS mutation's
+ * audit row read back after `_testing_drain_effects`.
  */
 export declare const describe_cross_process_ws_tests: (options: CrossProcessWsTestOptions) => void;
 //# sourceMappingURL=ws_round_trip.d.ts.map

package/dist/testing/cross_backend/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6F9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,yBAAyB,KAAG,IA+RpF,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwG9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,yBAAyB,KAAG,IAkVpF,CAAC"}

package/dist/testing/cross_backend/ws_round_trip.js

@@ -55,7 +55,11 @@ import '../assert_dev_env.js';
  * `capabilities.ws_self_revocation_reply` — reads the reply to its request
  * first. The TS spine queues the close behind the commit and sends the reply
  * ahead of it, so the caller is never left without an answer; the Rust spine
- * does not answer yet, which that flag records.
+ * does not answer yet, which that flag records. Under the same gate (and
+ * `rpc_path`), a socket mints an API token over WS and the token's
+ * `token_create` audit row is read back after `_testing_drain_effects` — the
+ * barrier a WS mutation needs, since a WS reply can precede its audit write.
+ * The binary's `create_testing_actions` mount provides the drain.
  *
  * Gated on `capabilities.ws` — backends without an end-to-end WS transport
  * skip (the cases still surface as `.skip` in the report). Cross-process
@@ -68,14 +72,15 @@ import { assert, describe } from 'vitest';
 import { assert_rejects } from '@fuzdev/fuz_util/testing.ts';
 import { heartbeat_action_spec } from '../../actions/heartbeat.js';
 import { DEFAULT_WS_MAX_MESSAGE_BYTES, WS_CLOSE_MESSAGE_TOO_BIG, WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
-import { account_session_revoke_all_action_spec } from '../../auth/account_action_specs.js';
-import { account_delete_action_spec } from '../../auth/admin_action_specs.js';
+import { account_session_revoke_all_action_spec, account_token_create_action_spec } from '../../auth/account_action_specs.js';
+import { account_delete_action_spec, audit_log_list_action_spec, AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { is_response_for } from '../transports/ws_client.js';
 import { create_ws_transport } from '../transports/ws_transport.js';
 import { connect_raw_ws, is_raw_ws_close, RAW_WS_OPCODE_TEXT } from '../transports/ws_raw_client.js';
 import { create_rpc_post_init } from '../rpc_helpers.js';
 import { test_if } from './capabilities.js';
+import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
 /** Origin guaranteed to fail the `http://localhost:*` allowlist the test backends run with. */
 const DISALLOWED_ORIGIN = 'http://disallowed.example';
 /**
@@ -84,7 +89,8 @@ const DISALLOWED_ORIGIN = 'http://disallowed.example';
  * oversized message closing with `WS_CLOSE_MESSAGE_TOO_BIG`, anonymous-upgrade
  * refusal, disallowed-origin refusal, and — when `rpc_path` is supplied —
  * session revocation and account deletion closing the live socket, plus a
- * self-revoking socket reading its reply before its close.
+ * self-revoking socket reading its reply before its close, and a WS mutation's
+ * audit row read back after `_testing_drain_effects`.
  */
 export const describe_cross_process_ws_tests = (options) => {
     const { setup_test, capabilities, base_url, ws_path, origin, rpc_path, max_message_bytes = DEFAULT_WS_MAX_MESSAGE_BYTES } = options;
@@ -308,5 +314,35 @@ export const describe_cross_process_ws_tests = (options) => {
                 await client.close();
             }
         });
+        // A WS mutation is answered before its effects flush, so its audit row
+        // can land after the reply. `_testing_drain_effects` is the barrier: once
+        // it returns, the row is visible on either spine.
+        test_if(capabilities.ws && capabilities.ws_account_actions && rpc_path !== undefined, "a WS mutation's audit row is visible after _testing_drain_effects", async () => {
+            const fixture = await setup_test();
+            const client = await create_ws_transport({
+                base_url,
+                ws_path,
+                cookies: fixture.transport.cookies(),
+                origin
+            });
+            try {
+                await client.request(1, account_token_create_action_spec.method, {
+                    name: 'ws drain probe',
+                    scope: { kind: 'full' },
+                    lifetime: { kind: 'eternal' }
+                });
+            }
+            finally {
+                await client.close();
+            }
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            // `_testing_reset` wiped audit_log at setup, so the mint is the only
+            // token_create event
+            const listed = expect_output(await cross_rpc_call(fixture.transport, rpc_path, audit_log_list_action_spec.method, { event_type: 'token_create' }, fixture.create_session_headers()), AuditLogListOutput);
+            assert.strictEqual(listed.events.length, 1, JSON.stringify(listed.events));
+            assert.strictEqual(listed.events[0].outcome, 'success');
+            assert.strictEqual(listed.events[0].account_id, fixture.account.id);
+        });
     });
 };

package/dist/testing/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,KACvB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAwDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAC9B,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAwDF,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgB7B,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,KACvB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAwDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAC9B,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAwDF,CAAC"}

package/dist/testing/middleware.js

@@ -12,6 +12,7 @@ import { vi, test, assert, describe } from 'vitest';
 import { Hono } from 'hono';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_bearer_auth_middleware } from '../auth/bearer_auth.js';
+import { AUTH_MIDDLEWARE_PATH } from '../auth/middleware.js';
 import { query_validate_api_token } from '../auth/api_token_queries.js';
 import { query_account_by_id, query_actor_by_id, query_active_actors_by_account } from '../auth/account_queries.js';
 import { query_role_grant_find_active_for_actor } from '../auth/role_grant_queries.js';
@@ -117,7 +118,7 @@ export const create_bearer_auth_test_app = (tc) => {
         c.set('client_ip', TEST_CLIENT_IP);
         await next();
     });
-    app.use('/api/*', bearer_middleware);
+    app.use(AUTH_MIDDLEWARE_PATH, bearer_middleware);
     // route handler echoes the account-grain identity the middleware writes
     // (bearer auth sets `ACCOUNT_ID_KEY` + `CREDENTIAL_TYPE_KEY` +
     // `AUTH_API_TOKEN_ID_KEY`; it never builds the full request context —
@@ -230,8 +231,8 @@ export const create_test_middleware_stack_app = (options) => {
     const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     app.use('*', proxy_mw);
-    app.use('/api/*', origin_mw);
-    app.use('/api/*', bearer_mw);
+    app.use(AUTH_MIDDLEWARE_PATH, origin_mw);
+    app.use(AUTH_MIDDLEWARE_PATH, bearer_mw);
     // echo route for assertions — exposes the account-grain identity bearer
     // auth writes (`ACCOUNT_ID_KEY`); the full request context is the
     // dispatcher's authorization phase concern, not middleware.

package/dist/testing/stubs.d.ts

@@ -62,7 +62,8 @@ export declare const stub_mw: (_c: any, next: any) => Promise<void>;
  * immediately; `notify` is a no-op; `add_listener` throws, so a test that
  * wires a listener fails loudly instead of silently never firing
  * (`create_recording_audit_emitter` accepts listeners); `listener_count`
- * returns 0. Tests asserting on real audit-row persistence (or on listener
+ * returns 0; `drain_inflight` resolves immediately, since nothing is ever
+ * written. Tests asserting on real audit-row persistence (or on listener
  * fan-out) build a real emitter via `create_audit_emitter` against a stub or
  * real DB — `create_test_app` already does this on the test backend.
  */
@@ -84,7 +85,11 @@ export declare const stub_app_deps: AppDeps;
  * Create no-op `AppDeps` for auth surface testing.
  */
 export declare const create_stub_app_deps: () => AppDeps;
-/** Create the API middleware stub array matching `create_auth_middleware_specs` output. */
+/**
+ * Create the API middleware stub array matching `create_auth_middleware_specs`
+ * output. Like the real factory's, each spec gets its own pass-through handler,
+ * so `assert_middleware_stack_mounted` can tell the layers apart by identity.
+ */
 export declare const create_stub_api_middleware: (options?: {
     /** Include the daemon_token middleware layer. */
     include_daemon_token?: boolean;
@@ -132,10 +137,19 @@ export interface CreateTestAppSurfaceSpecOptions {
      * The server's origin allowlist — `AppServerOptions.allowed_origins`.
      * Read only as the default for a `ws_endpoints` spec that declares no
      * `allowed_origins`, as `create_app_server` does; required when any spec
-     * omits its own, since surface generation throws on an unresolved one.
+     * omits its own — without it, such a spec throws, since the surface records
+     * the exact patterns the upgrade gate matches.
      */
     allowed_origins?: ReadonlyArray<RegExp>;
-    /** Transform middleware array (e.g., zap's `extend_middleware_for_zap_binary`). */
+    /**
+     * Transform middleware array — `AppServerOptions.transform_middleware`.
+     * Receives shallow copies of a stub `trusted_proxy` spec (at `'*'`)
+     * followed by the stub auth stack, in a fresh array, as
+     * `create_app_server` passes the real ones. Throws, like
+     * `create_app_server`, if the result doesn't keep each of those specs
+     * mounted once at its original path in its original order
+     * (`assert_middleware_stack_mounted`).
+     */
     transform_middleware?: (specs: Array<MiddlewareSpec>) => Array<MiddlewareSpec>;
     /**
      * Bootstrap config — symmetric with `AppServerOptions.bootstrap`. Discriminated
@@ -161,13 +175,19 @@ export interface CreateTestAppSurfaceSpecOptions {
  * Mirrors `create_app_server`'s route assembly: consumer routes +
  * factory-managed bootstrap routes + surface generation — including its
  * refusal of an `rpc_endpoints` or `ws_endpoints` path outside the auth
- * middleware's scope (`assert_endpoint_in_auth_scope`). If
+ * middleware's scope (`assert_endpoint_in_auth_scope`) and of a
+ * `transform_middleware` that doesn't keep the proxy and auth stack mounted
+ * (`assert_middleware_stack_mounted`). The middleware list mirrors the real
+ * one: a stub `trusted_proxy` spec at `'*'`, then the stub auth stack. If
  * `create_app_server` changes how it wires routes, update this helper
  * to stay in sync (single source of truth for all consumers).
  *
  * @param options - surface spec options
  * @returns the surface spec for the standard suites
- * @throws Error when an endpoint path is outside `AUTH_MIDDLEWARE_PATH`
+ * @throws Error when an endpoint path is outside `AUTH_MIDDLEWARE_PATH`, a
+ *   `ws_endpoints` spec declares no `allowed_origins` and no `allowed_origins`
+ *   option is given, or `transform_middleware` moves, drops, duplicates,
+ *   reorders, wraps, or replaces the stub proxy spec or a stub auth spec
  */
 export declare const create_test_app_surface_spec: (options: CreateTestAppSurfaceSpecOptions) => AppSurfaceSpec;
 //# sourceMappingURL=stubs.d.ts.map

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAK9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WASxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAWtC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA8DF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAS9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAY3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WASxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAWtC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CA0BvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAoEF,CAAC"}

package/dist/testing/stubs.js

@@ -19,7 +19,7 @@ import { resolve_ws_endpoints } from '../actions/ws_endpoint_spec.js';
 import { AUDIT_LOG_SSE_MAX_PER_SCOPE } from '../realtime/sse_auth_guard.js';
 import { SubscriberRegistry } from '../realtime/subscriber_registry.js';
 import { BaseServerEnv } from '../server/env.js';
-import { AUTH_MIDDLEWARE_PATH, assert_endpoint_in_auth_scope } from '../auth/middleware.js';
+import { AUTH_MIDDLEWARE_PATH, assert_endpoint_in_auth_scope, assert_middleware_stack_mounted } from '../auth/middleware.js';
 /**
  * Create a Proxy that throws descriptive errors on any property access or method call.
  *
@@ -99,7 +99,8 @@ const stub_db = create_noop_stub('stub_db');
  * immediately; `notify` is a no-op; `add_listener` throws, so a test that
  * wires a listener fails loudly instead of silently never firing
  * (`create_recording_audit_emitter` accepts listeners); `listener_count`
- * returns 0. Tests asserting on real audit-row persistence (or on listener
+ * returns 0; `drain_inflight` resolves immediately, since nothing is ever
+ * written. Tests asserting on real audit-row persistence (or on listener
  * fan-out) build a real emitter via `create_audit_emitter` against a stub or
  * real DB — `create_test_app` already does this on the test backend.
  */
@@ -111,7 +112,8 @@ export const create_test_audit_emitter = () => ({
     add_listener: () => {
         throw new Error('create_test_audit_emitter accepts no listeners — use create_recording_audit_emitter');
     },
-    listener_count: () => 0
+    listener_count: () => 0,
+    drain_inflight: async () => { }
 });
 /**
  * Build a no-op `AuditLogSse` for tests that wire `audit_sse` into the
@@ -159,16 +161,27 @@ export const create_stub_app_deps = () => ({
     audit: create_test_audit_emitter(),
     connection_closer: create_realtime_closer()
 });
-/** Create the API middleware stub array matching `create_auth_middleware_specs` output. */
+/** A fresh pass-through middleware — a distinct handler per call, unlike the shared `stub_mw`. */
+const create_stub_mw = () => async (_c, next) => next();
+/**
+ * Create the API middleware stub array matching `create_auth_middleware_specs`
+ * output. Like the real factory's, each spec gets its own pass-through handler,
+ * so `assert_middleware_stack_mounted` can tell the layers apart by identity.
+ */
 export const create_stub_api_middleware = (options) => {
     const specs = [
-        { name: 'origin', path: AUTH_MIDDLEWARE_PATH, handler: stub_mw, errors: { 403: ApiError } },
-        { name: 'session', path: AUTH_MIDDLEWARE_PATH, handler: stub_mw },
-        { name: 'request_context', path: AUTH_MIDDLEWARE_PATH, handler: stub_mw },
+        {
+            name: 'origin',
+            path: AUTH_MIDDLEWARE_PATH,
+            handler: create_stub_mw(),
+            errors: { 403: ApiError }
+        },
+        { name: 'session', path: AUTH_MIDDLEWARE_PATH, handler: create_stub_mw() },
+        { name: 'request_context', path: AUTH_MIDDLEWARE_PATH, handler: create_stub_mw() },
         {
             name: 'bearer_auth',
             path: AUTH_MIDDLEWARE_PATH,
-            handler: stub_mw,
+            handler: create_stub_mw(),
             errors: { 401: ApiError, 403: ApiError, 429: RateLimitError }
         }
     ];
@@ -176,7 +189,7 @@ export const create_stub_api_middleware = (options) => {
         specs.push({
             name: 'daemon_token',
             path: AUTH_MIDDLEWARE_PATH,
-            handler: stub_mw,
+            handler: create_stub_mw(),
             errors: { 401: ApiError, 500: ApiError, 503: ApiError }
         });
     }
@@ -213,6 +226,21 @@ export const create_stub_app_server_context = (session_options) => {
         audit_sse: null
     };
 };
+/**
+ * Narrow a WS endpoint spec that carries its own `allowed_origins` — the only
+ * way it resolves when no server list is given to default from.
+ *
+ * @throws Error when the spec declares no `allowed_origins`
+ */
+const to_self_resolved_ws_endpoint = (endpoint) => {
+    const { allowed_origins } = endpoint;
+    if (!allowed_origins) {
+        throw new Error(`create_test_app_surface_spec: ws endpoint ${endpoint.path} has no allowed_origins — ` +
+            "pass the server's list as create_test_app_surface_spec's allowed_origins option, " +
+            'or set allowed_origins on the spec');
+    }
+    return { ...endpoint, allowed_origins };
+};
 /**
  * Create an `AppSurfaceSpec` for the standard testing suites.
  *
@@ -226,13 +254,19 @@ export const create_stub_app_server_context = (session_options) => {
  * Mirrors `create_app_server`'s route assembly: consumer routes +
  * factory-managed bootstrap routes + surface generation — including its
  * refusal of an `rpc_endpoints` or `ws_endpoints` path outside the auth
- * middleware's scope (`assert_endpoint_in_auth_scope`). If
+ * middleware's scope (`assert_endpoint_in_auth_scope`) and of a
+ * `transform_middleware` that doesn't keep the proxy and auth stack mounted
+ * (`assert_middleware_stack_mounted`). The middleware list mirrors the real
+ * one: a stub `trusted_proxy` spec at `'*'`, then the stub auth stack. If
  * `create_app_server` changes how it wires routes, update this helper
  * to stay in sync (single source of truth for all consumers).
  *
  * @param options - surface spec options
  * @returns the surface spec for the standard suites
- * @throws Error when an endpoint path is outside `AUTH_MIDDLEWARE_PATH`
+ * @throws Error when an endpoint path is outside `AUTH_MIDDLEWARE_PATH`, a
+ *   `ws_endpoints` spec declares no `allowed_origins` and no `allowed_origins`
+ *   option is given, or `transform_middleware` moves, drops, duplicates,
+ *   reorders, wraps, or replaces the stub proxy spec or a stub auth spec
  */
 export const create_test_app_surface_spec = (options) => {
     const ctx = create_stub_app_server_context(options.session_options);
@@ -255,11 +289,9 @@ export const create_test_app_surface_spec = (options) => {
     // Resolve ws endpoints (mirrors create_app_server). Surface-only —
     // no `register_ws_endpoint` call here, so no `create_upgrade_websocket` needed.
     const declared_ws_endpoints = typeof options.ws_endpoints === 'function' ? options.ws_endpoints(ctx) : options.ws_endpoints;
-    // without the server's list, an origin-less spec reaches surface
-    // generation unresolved and throws there
     const resolved_ws_endpoints = options.allowed_origins
         ? resolve_ws_endpoints(declared_ws_endpoints, options.allowed_origins)
-        : declared_ws_endpoints;
+        : declared_ws_endpoints?.map(to_self_resolved_ws_endpoint);
     for (const endpoint of resolved_ws_endpoints ?? []) {
         assert_endpoint_in_auth_scope('ws_endpoints', endpoint.path);
     }
@@ -277,9 +309,17 @@ export const create_test_app_surface_spec = (options) => {
         ])
         : [];
     const route_specs = [...consumer_routes, ...rpc_route_specs, ...bootstrap_route_specs];
-    let middleware_specs = create_stub_api_middleware();
+    // mirrors `create_app_server`'s `[proxy_spec, ...auth_middleware]`
+    const stack_specs = [
+        { name: 'trusted_proxy', path: '*', handler: create_stub_mw() },
+        ...create_stub_api_middleware()
+    ];
+    let middleware_specs = stack_specs;
     if (options.transform_middleware) {
-        middleware_specs = options.transform_middleware(middleware_specs);
+        // the transform gets copies in a fresh array, so mutating what it was
+        // handed can't rewrite the originals the check matches against
+        middleware_specs = options.transform_middleware(stack_specs.map((spec) => ({ ...spec })));
+        assert_middleware_stack_mounted(stack_specs, middleware_specs);
     }
     return create_app_surface_spec({
         middleware_specs,