@fuzdev/fuz_app 0.127.0 → 0.128.0

package/dist/actions/CLAUDE.md

@@ -565,11 +565,17 @@ fail-open. Failure outcomes (`revoked: false`, a 404) queue no close — they
 carry caller-supplied ids.
 
 **One closer for every transport.** `create_realtime_closer()` returns a
-`RealtimeCloser` — a `ConnectionCloser` plus `add(closer)` (idempotent by
-reference) — whose every close fans out to each member and returns the sum.
+`RealtimeCloser` — a `ConnectionCloser` plus `add(closer)` and `member_count()`
+— whose every close fans out to each member and returns the sum. Membership is
+by reference: a closer added twice is one member, reached once. `add` returns a
+remover for that addition (idempotent); additions are counted, so the closer
+stays a member until every addition is removed — one owner releasing a shared
+transport leaves it reachable for the others.
 `create_app_backend` puts one on `AppDeps.connection_closer`; `create_app_server`
-adds each mounted WS transport and the audit stream registry, and its
-`AppServer.close` runs `close_all_sockets` across them all. Twin of
+adds each mounted WS transport and the audit stream registry itself (passing
+`connection_closer: null` to the mount functions so it holds the removers), and
+removes them when its assembly fails or `AppServer.close` runs — after
+`close_all_sockets` across them all. Twin of
 `RealtimeRevoker`. A member that throws does not stop the fan-out — every
 member is called, then the first error is thrown for the caller to log;
 `BackendWebsocketTransport` and `SubscriberRegistry.close_by_identity` treat a
@@ -586,7 +592,8 @@ the connections of each expired session it deletes — `auth/CLAUDE.md`
 §Cleanup), and the
 `connection_closer: RealtimeCloser | null` option of `register_action_ws` /
 `register_ws_endpoint` / `create_audit_log_sse`, which add their transport to it
-(`null` is the explicit opt-out).
+(`null` is the explicit opt-out, or for a caller that adds the transport itself
+to hold the remover, as `create_app_server` does).
 
 ## WS auth guard (`actions/transports_ws_auth_guard.ts`)
 
@@ -676,10 +683,10 @@ enforced.
 
 Mounted transport reachable at `app_server.ws_endpoints[path]`
 (`Readonly<Record<string, BackendWebsocketTransport>>`). Duplicate paths
-across `WsEndpointSpec`s throw at mount time. Cross-surface collisions
-(same `GET <path>` on both `RouteSpec` and `WsEndpointSpec`) throw with
-exact-string match. Pattern overlap (e.g. `GET /api/:resource` vs
-`/api/ws`) is not detected — Hono's specific-before-wildcard routing keeps
+across `WsEndpointSpec`s throw at assembly, before any endpoint mounts.
+Cross-surface collisions (same `GET <path>` on both `RouteSpec` and
+`WsEndpointSpec`) throw with exact-string match. Pattern overlap (e.g.
+`GET /api/:resource` vs `/api/ws`) is not detected — Hono's specific-before-wildcard routing keeps
 those working but avoid the overlap.
 
 `auth_guard: true` does NOT close sockets on `role_grant_revoke`
@@ -746,8 +753,13 @@ revocation closes only after its commit — see
 
 `connection_closer: RealtimeCloser | null` is a required option: the endpoint's
 transport is added to it, so the revocation handlers' post-commit closes reach
-the sockets opened here. `null` is for a transport no revocation has to reach
-(a harness driving the dispatcher directly).
+the sockets opened here. The add is the mount's last step, so a mount that
+throws (a registry that fails to compile) adds nothing; the addition is
+permanent, its remover not returned. `null` is for a transport no revocation
+has to reach (a harness driving the dispatcher directly), or one the caller
+adds itself to hold the remover — `create_app_server` passes `null` and adds
+the transport after the mount returns, releasing it when assembly fails or
+the server closes.
 
 Because `onOpen` awaits, an adapter can deliver `onMessage` before admission
 (`@hono/node-ws` doesn't await `onOpen` at all). Those frames are **queued, not
@@ -800,13 +812,18 @@ Per-message side-effect queues: `pending_effects` (eager) drains via
 `flush_pending_effects`; `post_commit_effects` (deferred — pushed by
 handlers via `emit_after_commit`) drains via `flush_post_commit_effects`.
 Both flush in the same `try/finally` that releases the request controller,
-so fire-and-forget audit / notification effects pushed by the handler
-complete (or reject visibly) before the next message dispatches. The
-deferred thunks are invoked first and the eager writes awaited after, so a
-revocation's close never waits on a slow audit INSERT — held behind one, the
-socket would stay open on a credential already committed gone and dispatch its
-next frame. The
-deferred queue is **discarded on rollback** before it reaches that flush (a
+after the reply is sent, and every rejection is logged. Nothing orders that
+flush against other frames: frames on an admitted socket are not serialized
+(`handle_frame` calls aren't chained, and an adapter need not await
+`onMessage` — `@hono/node-ws` doesn't), so a message's effects can still be
+in flight when the caller reads its reply and when the next message
+dispatches. A test that reads the audit log after a WS reply awaits
+`_testing_drain_effects` first, over an emitter built with
+`track_inflight: true` (`src/lib/testing/CLAUDE.md`). The deferred thunks are
+invoked first and the eager writes awaited after, so a revocation's close never
+waits on a slow audit INSERT — held behind one, the socket would stay open on a
+credential already committed gone and dispatch its next frame. The deferred
+queue is **discarded on rollback** before it reaches that flush (a
 rolled-back message fires no post-commit effect). See `http/CLAUDE.md`
 §Pending Effects.
 

package/dist/actions/connection_closer.d.ts

@@ -139,20 +139,32 @@ export declare const noop_connection_closer: ConnectionCloser;
  */
 export interface RealtimeCloser extends ConnectionCloser {
     /**
-     * Add a transport's closer. Idempotent by reference, so two endpoints
-     * sharing one transport add it once.
+     * Add a transport's closer, returning a remover for this addition.
+     *
+     * Membership is by reference: a closer added twice — two endpoints
+     * sharing one transport — is one member, and every close reaches it
+     * once. Each `add` is counted, and its remover releases only that count:
+     * the closer stays a member until every addition is removed, so one
+     * owner releasing a shared transport leaves it reachable for the others.
+     * Calling a remover again is a no-op.
      *
      * Members must be the same instances connections are registered on — a
      * closer over a fresh registry closes nothing.
+     *
+     * @param closer - the transport's closer
+     * @returns a remover for this addition, idempotent
      */
-    add: (closer: ConnectionCloser) => void;
+    add: (closer: ConnectionCloser) => () => void;
+    /** Count of distinct members — introspection for tests and diagnostics. */
+    member_count: () => number;
 }
 /**
  * Create an empty `RealtimeCloser`.
  *
  * `create_app_backend` creates the one on `AppDeps.connection_closer`, and
  * `create_app_server` adds each WebSocket transport it mounts and its audit
- * stream registry. A consumer that mounts a transport by hand adds it through
+ * stream registry, removing them when its assembly fails or the server
+ * closes. A consumer that mounts a transport by hand adds it through
  * the `connection_closer` option of `register_ws_endpoint` /
  * `create_audit_log_sse`, or with `add`.
  */

package/dist/actions/connection_closer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;OAMG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAO,cAiCzC,CAAC"}
+{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA4CzC,CAAC"}

package/dist/actions/connection_closer.js

@@ -100,17 +100,19 @@ export const noop_connection_closer = Object.freeze({
  *
  * `create_app_backend` creates the one on `AppDeps.connection_closer`, and
  * `create_app_server` adds each WebSocket transport it mounts and its audit
- * stream registry. A consumer that mounts a transport by hand adds it through
+ * stream registry, removing them when its assembly fails or the server
+ * closes. A consumer that mounts a transport by hand adds it through
  * the `connection_closer` option of `register_ws_endpoint` /
  * `create_audit_log_sse`, or with `add`.
  */
 export const create_realtime_closer = () => {
-    const members = new Set();
+    // member → how many additions hold it; iteration order is first addition
+    const members = new Map();
     const fan_out = (close) => {
         let count = 0;
         let failed = false;
         let first_error;
-        for (const member of members) {
+        for (const member of members.keys()) {
             try {
                 count += close(member);
             }
@@ -129,8 +131,22 @@ export const create_realtime_closer = () => {
     };
     return Object.freeze({
         add: (closer) => {
-            members.add(closer);
+            members.set(closer, (members.get(closer) ?? 0) + 1);
+            let removed = false;
+            return () => {
+                if (removed)
+                    return;
+                removed = true;
+                const count = members.get(closer);
+                if (count === undefined)
+                    return;
+                if (count <= 1)
+                    members.delete(closer);
+                else
+                    members.set(closer, count - 1);
+            };
         },
+        member_count: () => members.size,
         close_sockets_for_session: (session_token_hash) => fan_out((member) => member.close_sockets_for_session(session_token_hash)),
         close_sockets_for_token: (api_token_id) => fan_out((member) => member.close_sockets_for_token(api_token_id)),
         close_sockets_for_account: (account_id) => fan_out((member) => member.close_sockets_for_account(account_id)),

package/dist/actions/register_action_ws.d.ts

@@ -244,6 +244,12 @@ export interface RegisterActionWsOptions {
      * reaches. Pass `null` only when no revocation has to reach this transport
      * (a harness driving the dispatcher directly), or when the transport was
      * added by hand.
+     *
+     * The transport is added once the mount succeeds, so a mount that throws
+     * adds nothing. The addition is permanent — its remover is not returned.
+     * A caller that must release the membership (as `create_app_server` does
+     * on close) passes `null` and adds the transport itself, holding the
+     * remover `RealtimeCloser.add` returns.
      */
     connection_closer: RealtimeCloser | null;
     /**
@@ -355,9 +361,11 @@ export interface RegisterActionWsResult {
  * @mutates options.app - registers a `GET path` route via `upgradeWebSocket`
  * @mutates options.transport - per socket, registers, admits, and removes a
  *   connection via `register_pending` / `admit` / `remove_connection`
- * @mutates options.connection_closer - adds the endpoint's transport
+ * @mutates options.connection_closer - adds the endpoint's transport, once the
+ *   mount has succeeded
  * @throws Error when `max_connections_per_account` is passed alongside
- *   `transport`, or is neither `null` nor a positive integer
+ *   `transport`, or is neither `null` nor a positive integer, or when
+ *   `actions` fails to compile (`compile_action_registry`)
  */
 export declare const register_action_ws: (options: RegisterActionWsOptions) => RegisterActionWsResult;
 //# sourceMappingURL=register_action_ws.d.ts.map

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAsC/F;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;OASG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAksBrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAsC/F;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAmsBrE,CAAC"}

package/dist/actions/register_action_ws.js

@@ -208,9 +208,11 @@ const is_peer_response = (json) => {
  * @mutates options.app - registers a `GET path` route via `upgradeWebSocket`
  * @mutates options.transport - per socket, registers, admits, and removes a
  *   connection via `register_pending` / `admit` / `remove_connection`
- * @mutates options.connection_closer - adds the endpoint's transport
+ * @mutates options.connection_closer - adds the endpoint's transport, once the
+ *   mount has succeeded
  * @throws Error when `max_connections_per_account` is passed alongside
- *   `transport`, or is neither `null` nor a positive integer
+ *   `transport`, or is neither `null` nor a positive integer, or when
+ *   `actions` fails to compile (`compile_action_registry`)
  */
 export const register_action_ws = (options) => {
     if (options.transport && options.max_connections_per_account !== undefined) {
@@ -224,7 +226,6 @@ export const register_action_ws = (options) => {
             max_connections_per_account: options.max_connections_per_account,
             log
         });
-    options.connection_closer?.add(transport);
     // Build the dispatcher's per-method lookup. Only request_response
     // specs with a handler reach `action_map` — perform_action is the
     // only site that calls handlers, and it requires an `RpcAction`.
@@ -800,6 +801,8 @@ export const register_action_ws = (options) => {
             }
         };
     }));
+    // last, after everything that can throw, so a failed mount leaves no member
+    options.connection_closer?.add(transport);
     return { transport };
 };
 /**

package/dist/actions/register_ws_endpoint.d.ts

@@ -62,7 +62,9 @@ export interface RegisterWsEndpointOptions extends RegisterActionWsOptions {
  * @mutates options.app - applies origin/auth/scope/authorization/role middleware
  *   via `app.use`, then registers the `GET path` route via the inner
  *   `register_action_ws`
- * @mutates options.connection_closer - adds the endpoint's transport
+ * @mutates options.connection_closer - adds the endpoint's transport, once the
+ *   mount has succeeded, for good — pass `null` and add it yourself to hold the
+ *   remover
  */
 export declare const register_ws_endpoint: (options: RegisterWsEndpointOptions) => RegisterActionWsResult;
 //# sourceMappingURL=register_ws_endpoint.d.ts.map

package/dist/actions/register_ws_endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAaH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAoBF,CAAC"}
+{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAaH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAoBF,CAAC"}

package/dist/actions/register_ws_endpoint.js

@@ -86,7 +86,9 @@ const create_ws_authorization_middleware = (db) => {
  * @mutates options.app - applies origin/auth/scope/authorization/role middleware
  *   via `app.use`, then registers the `GET path` route via the inner
  *   `register_action_ws`
- * @mutates options.connection_closer - adds the endpoint's transport
+ * @mutates options.connection_closer - adds the endpoint's transport, once the
+ *   mount has succeeded, for good — pass `null` and add it yourself to hold the
+ *   remover
  */
 export const register_ws_endpoint = (options) => {
     const { app, path, allowed_origins, db, required_roles, log = new Logger('[ws]'), ...rest } = options;

package/dist/auth/CLAUDE.md

@@ -121,20 +121,24 @@ upstream in `auth/signup_routes.ts` via `query_invite_find_unclaimed_match_for_u
 `auth/audit_emitter.ts` defines the `AuditEmitter` capability that lives on
 `AppDeps.audit`. Built once at backend assembly via the consumer's
 `audit_factory` callback over `create_audit_emitter`; closes over the pool +
-its registered listeners + optional `AuditLogConfig`. Six methods:
+its registered listeners + optional `AuditLogConfig`. Its methods:
 
 - `emit(ctx, input)` — fire-and-forget pool write, pushes to `ctx.pending_effects`; a success row's listener fan-out goes on `ctx.post_commit_effects`
 - `emit_role_grant_target(ctx, auth, input)` — lifts `actor_id` / `account_id` / `ip` boilerplate for role-grant-shape events
 - `emit_pool(input)` — awaitable pool write for code paths without a request context (ad-hoc maintenance scripts; not for success audits paired with a mutation — those write in-tx and `notify` post-commit). Writes, then notifies, whatever the outcome
 - `notify(event)` — fan out an already-written row to listeners (used by in-tx audit batches like `query_accept_offer.audit_events`)
-- `add_listener(listener)` — append-only listener registration (twin of Rust `fuz_auth` `AuditEmitter::add_listener`)
+- `add_listener(listener)` — listener registration, returning a remover for that registration (idempotent; the same function registered twice is two registrations, each with its own remover). Twin of Rust `fuz_auth` `AuditEmitter::add_listener` in firing order and snapshot-at-notify
 - `listener_count()` — registered-listener count, for tests / diagnostics
-
-Listeners are closure-private and append-only. `create_app_server` registers
-the audit-log SSE listener and per-endpoint WS auth guards via
-`add_listener` so SSE + WS fan-out compose on top of the consumer's
-`on_audit_event` callback without shallow-copying `AppDeps`. `notify` iterates a
-snapshot so a listener registered mid-fan-out fires only on the next event
+- `drain_inflight()` — test-binary barrier: waits until no `emit` write is in flight, writes started while waiting included. Only an emitter built with `track_inflight: true` tracks; otherwise it resolves at once (production never tracks). Backs `_testing_drain_effects` (twin of Rust `AuditEmitter::drain_inflight` / `new_with_inflight_tracking`)
+
+Listeners are closure-private; they change only through `add_listener` and
+its removers. `create_app_server` registers the audit-log SSE listener,
+per-endpoint WS auth guards, and any `extra_audit_handlers` via `add_listener`
+so SSE + WS fan-out compose on top of the consumer's `on_audit_event` callback
+without shallow-copying `AppDeps`, and removes them when its assembly fails or
+`AppServer.close` runs — the emitter outlives any one server on its backend.
+`notify` iterates a snapshot so a listener registered mid-fan-out fires only on
+the next event, and one removed mid-fan-out still hears the in-flight event
 (converges with the Rust twin's cloned vec).
 
 **When listeners hear about a row.** `emit` always writes at once, on the pool
@@ -211,7 +215,7 @@ Everything else listed under §RPC action surfaces.
 
 ### Middleware
 
-- `auth/middleware.ts` — `create_auth_middleware_specs(deps, options)` assembles `[origin, session, request_context, bearer_auth]` + optional `daemon_token`.
+- `auth/middleware.ts` — `create_auth_middleware_specs(deps, options)` assembles `[origin, session, request_context, bearer_auth]` + optional `daemon_token`. `AUTH_MIDDLEWARE_PATH` (`'/api/*'`) is where `create_app_server` mounts the stack; two assembly asserts lean on it: `assert_endpoint_in_auth_scope` (an `rpc_endpoints` / `ws_endpoints` path must sit inside it) and `assert_middleware_stack_mounted(stack_specs, middleware_specs)`, run on a `transform_middleware` result against the pre-transform stack (`[proxy, ...auth]`) — each stack spec, matched by its `handler` closure (not its spoofable `name`), mounted exactly once at its original path (`'*'` for the trusted proxy, `AUTH_MIDDLEWARE_PATH` for auth), in its original order; other specs may sit anywhere, including before the proxy and between the auth layers. The proxy is in the stack because dropping it turns every `get_client_ip` into `'unknown'`, one shared bucket for every IP-keyed limiter. The transform receives shallow copies in a fresh array, so an in-place mutation can't rewrite the originals the check reads. The check pins where those layers sit, not what added layers do — a layer you add runs with full context access. Both run in `create_test_app_surface_spec` too.
 - `auth/request_context.ts` — `RequestContext`, `resolve_acting_actor`, `build_request_context`, predicates (`has_role`, `has_scoped_role`, `has_any_scoped_role` — the dispatcher's role gate and every builtin-role check read the **global** grant via `has_scoped_role(_, role, null)` / `has_any_scoped_role(_, roles, null)`; scope-blind `has_role` is never the gate for a builtin role), guards (`require_auth`, `require_role`, `require_credential_types`, `require_token_scope`), `token_scope_surface_denial` (the direct-call form, for surfaces that aren't route specs), `refresh_role_grants`.
 - `auth/session_middleware.ts` — `process_session_cookie` integration, `create_session_and_set_cookie` (shared by login / signup / bootstrap; returns the token hashes of the sessions the cap evicted, which the caller closes after its commit — only login passes a cap).
 - `auth/resolved_auth.ts` — `ResolvedAuth` (the resolved credential as one value: `account_id`, `credential_type`, `token_hash`, `api_token_id`), `get_resolved_auth(c)` (gathers it from the context keys the auth middleware set), and `revalidate_resolved_auth(deps, resolved)`, the no-touch re-read a long-lived connection runs once it is registered: session row / token row (by id) still live and still on the account, account not soft-deleted; a daemon token re-reads its account only. Reuses the middleware's own queries and predicates. Called by the WS upgrade (`actions/register_action_ws.ts`) and the audit SSE route between registering a connection pending and admitting it. Twin of the Rust `revalidate_resolved_auth`.

package/dist/auth/audit_emitter.d.ts

@@ -29,6 +29,8 @@
  *   the query layer, or the offer-expiry rows `auth/cleanup.ts` writes in
  *   its sweep transaction). Runs every registered listener; per-listener
  *   throws are isolated.
+ * - `drain_inflight()` — test-binary barrier: await every in-flight `emit`
+ *   write, on an emitter built with `track_inflight: true`.
  *
  * ## When listeners hear about a row
  *
@@ -56,9 +58,10 @@
  * registers additional listeners via `add_listener` after the backend is
  * built (the factory-managed audit-log SSE, per-endpoint WS auth guards, any
  * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also register listeners directly on the emitter they
- * return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * runs, and removes each through the remover `add_listener` returns when its
+ * assembly fails or the server closes. Consumers can also register
+ * listeners directly on the emitter they return from `audit_factory` for
+ * setups that don't pass through `create_app_server`.
  *
  * @module
  */
@@ -168,22 +171,55 @@ export interface AuditEmitter {
      */
     notify(event: AuditLogEvent): void;
     /**
-     * Register an audit-event listener. Append-only — listeners fire in
-     * registration order for every row `emit` / `emit_pool` wrote and on
-     * every `notify`.
+     * Register an audit-event listener. Listeners fire in registration order
+     * for every row `emit` / `emit_pool` wrote and on every `notify`.
+     *
+     * Returns a remover that unregisters this registration. Each call is its
+     * own registration: the same function registered twice fires twice, and
+     * each remover takes out only the registration it was returned for,
+     * leaving the others in place and in order. Calling a remover again is a
+     * no-op. A `notify` already in progress still runs a listener removed
+     * during its fan-out — it iterates a snapshot — and the next one does not.
      *
      * `create_app_server` registers the factory-managed audit-log SSE
      * listener and per-endpoint WS auth guards here so
      * SSE + WS fan-out compose on top of the consumer's `on_audit_event`
-     * callback without shallow-copying `AppDeps`. Consumers can also
-     * register listeners directly for setups that don't run through
-     * `create_app_server`.
+     * callback without shallow-copying `AppDeps`, and removes them when its
+     * assembly fails or the server closes. Consumers can also register
+     * listeners directly for setups that don't run through
+     * `create_app_server`. The `on_audit_event` passed at construction has
+     * no remover — it lives as long as the emitter.
+     *
+     * Twin of the Rust `fuz_auth` `AuditEmitter::add_listener` in what
+     * registration means — firing order, snapshot-at-notify.
      *
-     * Twin of the Rust `fuz_auth` `AuditEmitter::add_listener`.
+     * @param listener - called with each announced audit row
+     * @returns a remover for this registration, idempotent
+     */
+    add_listener(listener: (event: AuditLogEvent) => void): () => void;
+    /**
+     * Count of registered listeners, the construction-time `on_audit_event`
+     * included — introspection for tests and diagnostics.
      */
-    add_listener(listener: (event: AuditLogEvent) => void): void;
-    /** Count of registered listeners — introspection for tests and diagnostics. */
     listener_count(): number;
+    /**
+     * Await every fire-and-forget `emit` write in flight — the deterministic
+     * barrier behind the `_testing_drain_effects` test action.
+     *
+     * Waits until no tracked write is outstanding, so a write that starts
+     * while the drain is waiting (an emit from a post-commit thunk) is awaited
+     * too. Once it resolves, a following `audit_log_list` read sees every row
+     * whose `emit` ran before the drain was called. A write that starts after
+     * the drain resolves is not covered. A success row's listener fan-out runs
+     * as a post-commit effect and is not tracked, so an SSE broadcast or an
+     * auth-guard close driven by one isn't guaranteed done when the drain
+     * resolves — the row itself is.
+     *
+     * Resolves at once unless the emitter was built with
+     * `track_inflight: true` — production never tracks, so there is nothing
+     * to wait for. Twin of the Rust `fuz_auth` `AuditEmitter::drain_inflight`.
+     */
+    drain_inflight(): Promise<void>;
 }
 /**
  * Signature of `AuditEmitter.emit` — captured by the inner closure so
@@ -230,6 +266,17 @@ export interface CreateAuditEmitterOptions {
      * Leave unset in production — it is a test instrumentation seam.
      */
     emit_decorator?: EmitDecorator;
+    /**
+     * Track every in-flight `emit` write so `drain_inflight` can await it.
+     * Defaults to `false`, which makes `drain_inflight` resolve at once.
+     *
+     * Test binaries only. A transport can reply before a request's writes
+     * settle — a WebSocket message is answered before its effects flush — so
+     * a test reading the audit log after a reply needs this barrier. In
+     * production the tracking is pure overhead and nothing drains it. Twin of
+     * the Rust `fuz_auth` `AuditEmitter::new_with_inflight_tracking`.
+     */
+    track_inflight?: boolean;
 }
 /**
  * Build a bound `AuditEmitter`. Typical caller is the consumer's

package/dist/auth/audit_emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_emitter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IAClE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACrE,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACtC,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;QACN,UAAU,EAAE,CAAC,CAAC;QACd,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;QAC7B,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GACC,IAAI,CAAC;IACR;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,IAAI,CAAC;IAC7D,+EAA+E;IAC/E,cAAc,IAAI,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,MAAM,EAC1C,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,IAAI,CAAC;AAEV;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW,CAAC;AAEhE,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,oDAAoD;IACpD,EAAE,EAAE,EAAE,CAAC;IACP,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,YA4GzE,CAAC"}
+{"version":3,"file":"audit_emitter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IAClE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACrE,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACtC,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;QACN,UAAU,EAAE,CAAC,CAAC;QACd,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;QAC7B,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GACC,IAAI,CAAC;IACR;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACnE;;;OAGG;IACH,cAAc,IAAI,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,MAAM,EAC1C,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,IAAI,CAAC;AAEV;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW,CAAC;AAEhE,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,oDAAoD;IACpD,EAAE,EAAE,EAAE,CAAC;IACP,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,YAqJzE,CAAC"}

package/dist/auth/audit_emitter.js

@@ -29,6 +29,8 @@
  *   the query layer, or the offer-expiry rows `auth/cleanup.ts` writes in
  *   its sweep transaction). Runs every registered listener; per-listener
  *   throws are isolated.
+ * - `drain_inflight()` — test-binary barrier: await every in-flight `emit`
+ *   write, on an emitter built with `track_inflight: true`.
  *
  * ## When listeners hear about a row
  *
@@ -56,9 +58,10 @@
  * registers additional listeners via `add_listener` after the backend is
  * built (the factory-managed audit-log SSE, per-endpoint WS auth guards, any
  * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also register listeners directly on the emitter they
- * return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * runs, and removes each through the remover `add_listener` returns when its
+ * assembly fails or the server closes. Consumers can also register
+ * listeners directly on the emitter they return from `audit_factory` for
+ * setups that don't pass through `create_app_server`.
  *
  * @module
  */
@@ -75,18 +78,21 @@ import { builtin_audit_log_config } from './audit_log_schema.js';
  * @returns the bound emitter; closes over the pool + config + listener chain
  */
 export const create_audit_emitter = (options) => {
-    const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator } = options;
+    const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator, track_inflight = false } = options;
     // Closure-private listener list — no mutable array is exposed on the
     // returned (frozen) emitter; registration goes through `add_listener`.
+    // One entry object per registration, so a remover takes out its own
+    // registration even when the same function is registered twice.
     const listeners = [];
     if (options.on_audit_event)
-        listeners.push(options.on_audit_event);
+        listeners.push({ listener: options.on_audit_event });
     const notify = (event) => {
         // Snapshot-at-notify: iterate a copy so a listener that registers
         // another listener mid-fan-out doesn't have the newcomer fire for the
-        // in-flight event (it fires on the next `notify`). Converges with the
-        // Rust twin, which clones the listener vec before iterating.
-        for (const listener of [...listeners]) {
+        // in-flight event (it fires on the next `notify`), and one removed
+        // mid-fan-out still hears the in-flight event. Converges with the Rust
+        // twin, which clones the listener vec before iterating.
+        for (const { listener } of [...listeners]) {
             try {
                 listener(event);
             }
@@ -111,16 +117,41 @@ export const create_audit_emitter = (options) => {
         if (event)
             notify(event);
     };
+    // In-flight `emit` writes, when tracked — each removed as it settles, so
+    // the set is empty exactly when nothing is outstanding. Neither tracked
+    // promise rejects (`write` and `notify` log their failures).
+    const inflight = track_inflight ? new Set() : null;
+    const track = (promise) => {
+        if (inflight) {
+            inflight.add(promise);
+            const remove = () => {
+                inflight.delete(promise);
+            };
+            void promise.then(remove, remove);
+        }
+        return promise;
+    };
+    const drain_inflight = async () => {
+        if (!inflight)
+            return;
+        // Wait for zero, not for a snapshot: a write started while waiting —
+        // an emit from a post-commit thunk — joins the set and is awaited on
+        // the next pass. The removal reactions were registered before these,
+        // so a settled write is gone from the set by the time a pass resumes.
+        while (inflight.size > 0) {
+            await Promise.allSettled(inflight);
+        }
+    };
     const base_emit = (ctx, input) => {
         if (input.outcome === 'failure') {
             // an attempt happened whether or not the transaction commits
-            ctx.pending_effects.push(emit_pool(input));
+            ctx.pending_effects.push(track(emit_pool(input)));
             return;
         }
         // A success row is written now and announced after the commit — and
         // not at all on rollback, when the queue is discarded. See the module
         // doc, "When listeners hear about a row".
-        const written = write(input);
+        const written = track(write(input));
         ctx.pending_effects.push(written.then(() => undefined));
         emit_after_commit(ctx, async () => {
             const event = await written;
@@ -146,7 +177,13 @@ export const create_audit_emitter = (options) => {
         });
     };
     const add_listener = (listener) => {
-        listeners.push(listener);
+        const entry = { listener };
+        listeners.push(entry);
+        return () => {
+            const index = listeners.indexOf(entry);
+            if (index !== -1)
+                listeners.splice(index, 1);
+        };
     };
     const listener_count = () => listeners.length;
     // Freeze the slot layout so consumers cannot hot-patch `emit` /
@@ -157,15 +194,16 @@ export const create_audit_emitter = (options) => {
     // `this.emit`, so the patch silently bypassed role-grant-shape emits.
     // Tests that need instrumentation pass `emit_decorator` so the wrap
     // is captured by the closure before the freeze. The listener list stays
-    // closure-private; registration is append-only via `add_listener`
-    // (`create_app_server` registers its SSE + WS listeners post-assembly,
-    // by design).
+    // closure-private; it changes only through `add_listener` and the remover
+    // it returns (`create_app_server` registers its SSE + WS listeners
+    // post-assembly, by design, and removes them on close).
     return Object.freeze({
         emit,
         emit_role_grant_target,
         emit_pool,
         notify,
         add_listener,
-        listener_count
+        listener_count,
+        drain_inflight
     });
 };

package/dist/auth/middleware.d.ts

@@ -38,6 +38,36 @@ export declare const AUTH_MIDDLEWARE_PATH = "/api/*";
  * @throws Error when `path` is outside `AUTH_MIDDLEWARE_PATH`
  */
 export declare const assert_endpoint_in_auth_scope: (option: "rpc_endpoints" | "ws_endpoints", path: string) => void;
+/**
+ * Throw unless a middleware list still mounts every spec of the stack it was
+ * built from — the trusted-proxy spec and the auth middleware — exactly once,
+ * at its original path, in its original order.
+ *
+ * `create_app_server` and `create_test_app_surface_spec` run it on the list
+ * a `transform_middleware` option returns, against the stack they handed it
+ * (`[proxy, ...auth]`). The endpoint auth-scope check
+ * (`assert_endpoint_in_auth_scope`) assumes the auth stack is mounted at
+ * `AUTH_MIDDLEWARE_PATH`, and every IP-keyed rate limiter assumes the proxy
+ * spec ran first — without it `get_client_ip` answers `'unknown'` for every
+ * caller, collapsing each limiter into one shared bucket. So a transform that
+ * moves, drops, duplicates, reorders, wraps, or replaces a stack layer is
+ * refused. Other specs may sit anywhere, including before the proxy spec and
+ * between the auth layers. The check pins where the stack's layers sit, not
+ * what added layers do — a layer you add runs with full context access.
+ *
+ * Each stack spec is matched by its `handler` — the closure its factory built
+ * — not by `name`, which any spec can carry, so a same-named replacement or a
+ * wrapped handler counts as missing. A spread copy (`{...spec}`) keeps the
+ * handler and still matches. Its path is compared with the original's, so
+ * pass specs the transform could not reach: the assemblies hand the transform
+ * shallow copies in a fresh array and keep the originals here.
+ *
+ * @param stack_specs - the stack the transform was built from, in mount order
+ * @param middleware_specs - the middleware list the transform returned
+ * @throws Error when a stack spec is missing, mounted more than once, mounted
+ *   at another path, or out of order
+ */
+export declare const assert_middleware_stack_mounted: (stack_specs: ReadonlyArray<MiddlewareSpec>, middleware_specs: ReadonlyArray<MiddlewareSpec>) => void;
 /**
  * Per-factory configuration for the standard auth middleware stack.
  */