@fuzdev/fuz_app 0.128.0 → 0.129.0

package/dist/testing/stubs.js

@@ -8,12 +8,13 @@ import './assert_dev_env.js';
  * @module
  */
 import { Logger } from '@fuzdev/fuz_util/log.ts';
-import { ApiError, RateLimitError } from '../http/error_schemas.js';
+import { ApiError } from '../http/error_schemas.js';
 import { create_realtime_closer } from '../actions/connection_closer.js';
 import { Db } from '../db/db.js';
 import { prefix_route_specs } from '../http/route_spec.js';
 import { bootstrap_route_shape } from '../auth/bootstrap_route_schema.js';
 import { create_rpc_endpoint } from '../actions/action_rpc.js';
+import { create_surface_route_spec } from '../server/surface_route.js';
 import { create_app_surface_spec } from '../http/surface.js';
 import { resolve_ws_endpoints } from '../actions/ws_endpoint_spec.js';
 import { AUDIT_LOG_SSE_MAX_PER_SCOPE } from '../realtime/sse_auth_guard.js';
@@ -135,17 +136,6 @@ export const create_stub_audit_sse = () => {
         registry
     };
 };
-/** Stub `AppDeps` for auth surface tests — throws on any method access. */
-export const stub_app_deps = {
-    read_secure_file: create_throwing_stub('read_secure_file'),
-    delete_file: create_throwing_stub('delete_file'),
-    keyring: create_throwing_stub('keyring'),
-    password: create_throwing_stub('password'),
-    db: create_throwing_stub('db'),
-    log: create_throwing_stub('log'),
-    audit: create_test_audit_emitter(),
-    connection_closer: create_realtime_closer()
-};
 /**
  * Create no-op `AppDeps` for auth surface testing.
  */
@@ -161,12 +151,30 @@ export const create_stub_app_deps = () => ({
     audit: create_test_audit_emitter(),
     connection_closer: create_realtime_closer()
 });
+/**
+ * Create a stub `AppBackend` with no database behind it — no migration
+ * results, and a `close` that does nothing unless one is passed. For
+ * assembling a server (`create_app_server`) in tests that never reach the
+ * database; one whose `close` does nothing can host server after server.
+ *
+ * @param options - the deps and `close` to use in place of the defaults
+ */
+export const create_stub_app_backend = (options) => ({
+    db_type: 'pglite-memory',
+    db_name: 'test',
+    migration_results: [],
+    close: options?.close ?? (async () => { }),
+    deps: options?.deps ?? create_stub_app_deps()
+});
 /** A fresh pass-through middleware — a distinct handler per call, unlike the shared `stub_mw`. */
 const create_stub_mw = () => async (_c, next) => next();
 /**
  * Create the API middleware stub array matching `create_auth_middleware_specs`
- * output. Like the real factory's, each spec gets its own pass-through handler,
- * so `assert_middleware_stack_mounted` can tell the layers apart by identity.
+ * output — the same names, paths, order, and declared `errors` (the surface
+ * merges middleware errors into every route under the path, so a stub that
+ * declared more than the real stack would widen the test surface). Like the
+ * real factory's, each spec gets its own pass-through handler, so
+ * `assert_middleware_stack_mounted` can tell the layers apart by identity.
  */
 export const create_stub_api_middleware = (options) => {
     const specs = [
@@ -182,7 +190,7 @@ export const create_stub_api_middleware = (options) => {
             name: 'bearer_auth',
             path: AUTH_MIDDLEWARE_PATH,
             handler: create_stub_mw(),
-            errors: { 401: ApiError, 403: ApiError, 429: RateLimitError }
+            errors: {}
         }
     ];
     if (options?.include_daemon_token) {
@@ -190,7 +198,7 @@ export const create_stub_api_middleware = (options) => {
             name: 'daemon_token',
             path: AUTH_MIDDLEWARE_PATH,
             handler: create_stub_mw(),
-            errors: { 401: ApiError, 500: ApiError, 503: ApiError }
+            errors: {}
         });
     }
     return specs;
@@ -204,16 +212,10 @@ export const create_stub_api_middleware = (options) => {
  * @param session_options - consumer's session config (required — varies per app)
  */
 export const create_stub_app_server_context = (session_options) => {
-    const deps = create_stub_app_deps();
+    const backend = create_stub_app_backend();
     return {
-        deps,
-        backend: {
-            deps,
-            db_type: 'pglite-memory',
-            db_name: 'test',
-            migration_results: [],
-            close: async () => { }
-        },
+        deps: backend.deps,
+        backend,
         bootstrap_status: { available: false, token_path: null },
         session_options,
         login_ip_rate_limiter: null,
@@ -251,13 +253,16 @@ const to_self_resolved_ws_endpoint = (endpoint) => {
  * suites consume the spec object this function returns, not the JSON
  * file.
  *
- * Mirrors `create_app_server`'s route assembly: consumer routes +
- * factory-managed bootstrap routes + surface generation — including its
+ * Mirrors `create_app_server`'s route assembly, in its order: consumer
+ * routes, then the factory-managed bootstrap routes, RPC endpoint routes, and
+ * `GET /api/surface` (with `surface_route: true`), then surface
+ * generation — including its
  * refusal of an `rpc_endpoints` or `ws_endpoints` path outside the auth
  * middleware's scope (`assert_endpoint_in_auth_scope`) and of a
  * `transform_middleware` that doesn't keep the proxy and auth stack mounted
  * (`assert_middleware_stack_mounted`). The middleware list mirrors the real
- * one: a stub `trusted_proxy` spec at `'*'`, then the stub auth stack. If
+ * one: a stub `trusted_proxy` spec at `'*'`, then the stub auth stack (with
+ * `daemon_token` when `options.daemon_token` is set). If
  * `create_app_server` changes how it wires routes, update this helper
  * to stay in sync (single source of truth for all consumers).
  *
@@ -308,11 +313,33 @@ export const create_test_app_surface_spec = (options) => {
             { ...bootstrap_route_shape, handler: stub_handler }
         ])
         : [];
-    const route_specs = [...consumer_routes, ...rpc_route_specs, ...bootstrap_route_specs];
+    // the surface route mirrors `create_app_server`'s opt-in mount — its handler
+    // serves the surface generated below, backfilled into the same ref
+    const surface_ref = {
+        surface: {
+            middleware: [],
+            routes: [],
+            rpc_endpoints: [],
+            ws_endpoints: [],
+            env: [],
+            events: [],
+            diagnostics: []
+        }
+    };
+    const surface_route_specs = options.surface_route
+        ? [create_surface_route_spec(surface_ref)]
+        : [];
+    // `create_app_server`'s order: consumer routes, then the factory routes
+    const route_specs = [
+        ...consumer_routes,
+        ...bootstrap_route_specs,
+        ...rpc_route_specs,
+        ...surface_route_specs
+    ];
     // mirrors `create_app_server`'s `[proxy_spec, ...auth_middleware]`
     const stack_specs = [
         { name: 'trusted_proxy', path: '*', handler: create_stub_mw() },
-        ...create_stub_api_middleware()
+        ...create_stub_api_middleware({ include_daemon_token: options.daemon_token })
     ];
     let middleware_specs = stack_specs;
     if (options.transform_middleware) {
@@ -321,7 +348,7 @@ export const create_test_app_surface_spec = (options) => {
         middleware_specs = options.transform_middleware(stack_specs.map((spec) => ({ ...spec })));
         assert_middleware_stack_mounted(stack_specs, middleware_specs);
     }
-    return create_app_surface_spec({
+    const surface_spec = create_app_surface_spec({
         middleware_specs,
         route_specs,
         env_schema: options.env_schema ?? BaseServerEnv,
@@ -329,4 +356,6 @@ export const create_test_app_surface_spec = (options) => {
         rpc_endpoints: resolved_rpc_endpoints,
         ws_endpoints: resolved_ws_endpoints
     });
+    surface_ref.surface = surface_spec.surface;
+    return surface_spec;
 };

package/dist/testing/ws_round_trip.d.ts

@@ -202,9 +202,7 @@ export interface WsTestHarness {
     /**
      * Open a mock connection. Resolves after `on_socket_open` (and the
      * transport's `register_ws`) completes, so broadcasts issued
-     * immediately after the `await` reach the connection. Earlier
-     * revisions returned synchronously and required a `settle_open()`
-     * microtask drain — no longer necessary.
+     * immediately after the `await` reach the connection.
      *
      * Returns the shared `WsClient` interface — same surface the
      * cross-process driver in `transports/ws_transport.ts` implements,

package/dist/testing/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAmBvE,CAAC;AAEF,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,CAAC,EAAE,OAAO,CAAC;IACX,8DAA8D;IAC9D,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5D;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAsBtC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aA+N5E,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAmBvE,CAAC;AAEF,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,CAAC,EAAE,OAAO,CAAC;IACX,8DAA8D;IAC9D,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5D;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAsBtC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aA+N5E,CAAC"}

package/dist/ui/AdminSurface.svelte

@@ -3,7 +3,9 @@
 	 * Attack-surface viewer. Fetches `GET /api/surface` (REST — not RPC, since
 	 * the surface dump exists outside the action surface) and delegates
 	 * rendering to `SurfaceExplorer`. Surfaces a retry button on fetch
-	 * failures.
+	 * failures. The server must opt in to the route
+	 * (`create_app_server({surface_route: true})`), which is admin-only and
+	 * refused to a narrowed API token.
 	 *
 	 * @module
 	 */

package/dist/ui/AdminSurface.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminSurface.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSurface.svelte"],"names":[],"mappings":"AAkEA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"AdminSurface.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSurface.svelte"],"names":[],"mappings":"AAoEA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/ui/CLAUDE.md

@@ -326,7 +326,9 @@ destructive actions.
 - `AdminSettings.svelte` — shell for `OpenSignupToggle` + the logged-in
   account line + logout `ConfirmButton`. No direct RPC calls.
 - `AdminSurface.svelte` — attack-surface viewer. Fetches
-  `/api/surface` (REST) and delegates to `SurfaceExplorer`.
+  `/api/surface` (REST) and delegates to `SurfaceExplorer`. The server must
+  opt in with `create_app_server({surface_route: true})`; the route is
+  admin-only and refused to a narrowed API token.
 - `OpenSignupToggle.svelte` — single checkbox bound to
   `AppSettingsState.settings.open_signup`. Consumes
   `app_settings_rpc_context`.

package/dist/ui/async_slot.svelte.d.ts

@@ -28,7 +28,7 @@
  *   would otherwise need to compensate for.
  * - **`AbortSignal` threaded to the callback** — RPC clients that accept
  *   a signal (or `fetch`) get cancellation for free; callers can also
- *   pass an external `signal` via {@link RunOptions} to bind the slot's
+ *   pass an external `signal` via `RunOptions` to bind the slot's
  *   lifetime to a component / page.
  * - **`preserve_error_on_retry`** — opt-in to keeping the previous error
  *   visible while a retry is pending (default clears at the start of
@@ -68,7 +68,7 @@ export interface AsyncSlotOptions<T, E = string> {
     initial?: T;
     /**
      * Convert a caught throw into the error value stored in
-     * {@link AsyncSlot.error}. Default extracts `Error.message` (falling
+     * `AsyncSlot.error`. Default extracts `Error.message` (falling
      * back to `'Request failed'` for non-Error throws). Pass
      * `to_rpc_error_message` to unwrap JSON-RPC `data.reason` codes.
      */
@@ -87,7 +87,7 @@ export interface RunOptions {
     /**
      * External signal chained into the slot's internal controller. Aborts
      * the in-flight run when fired (alongside automatic supersession by
-     * the next `run()` and manual {@link AsyncSlot.abort} calls).
+     * the next `run()` and manual `AsyncSlot.abort` calls).
      */
     signal?: AbortSignal;
 }
@@ -96,7 +96,7 @@ export interface RunOptions {
  *
  * @typeParam T - The success payload type. Use `void` for write-only
  *   actions whose response isn't worth retaining.
- * @typeParam E - The shape of {@link AsyncSlot.error}. Defaults to
+ * @typeParam E - The shape of `AsyncSlot.error`. Defaults to
  *   `string` (set by the default `map_error`). Narrow to a structured
  *   type by providing a `map_error` that returns it.
  */

package/dist/ui/async_slot.svelte.js

@@ -28,7 +28,7 @@
  *   would otherwise need to compensate for.
  * - **`AbortSignal` threaded to the callback** — RPC clients that accept
  *   a signal (or `fetch`) get cancellation for free; callers can also
- *   pass an external `signal` via {@link RunOptions} to bind the slot's
+ *   pass an external `signal` via `RunOptions` to bind the slot's
  *   lifetime to a component / page.
  * - **`preserve_error_on_retry`** — opt-in to keeping the previous error
  *   visible while a retry is pending (default clears at the start of
@@ -64,7 +64,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
  *
  * @typeParam T - The success payload type. Use `void` for write-only
  *   actions whose response isn't worth retaining.
- * @typeParam E - The shape of {@link AsyncSlot.error}. Defaults to
+ * @typeParam E - The shape of `AsyncSlot.error`. Defaults to
  *   `string` (set by the default `map_error`). Narrow to a structured
  *   type by providing a `map_error` that returns it.
  */
@@ -85,7 +85,7 @@ export class AsyncSlot {
     #controller = null;
     /**
      * Tracks whether any `run()` or `set()` has ever produced a success
-     * result. Used by {@link abort} to revert to `'success'` (vs `'initial'`)
+     * result. Used by `abort` to revert to `'success'` (vs `'initial'`)
      * — explicit flag instead of inspecting `data` so the discriminator
      * stays correct for `T = void` (where success-`data` is `undefined`)
      * and for nullable `T`s where `null` is a legitimate success value.
@@ -183,7 +183,7 @@ export class AsyncSlot {
     }
     /**
      * Abort the in-flight run (if any) and null out the controller field.
-     * Shared by {@link abort}, {@link set}, and {@link reset}.
+     * Shared by `abort`, `set`, and `reset`.
      */
     #clear_controller(reason) {
         this.#controller?.abort(reason);

package/dist/ui/keyed_async_slot.svelte.d.ts

@@ -46,7 +46,7 @@ import { AsyncSlot, type AsyncSlotOptions, type RunOptions } from './async_slot.
  * Constructor options for `KeyedAsyncSlot`. Propagated to every child
  * `AsyncSlot` at lazy creation time.
  *
- * `initial` from {@link AsyncSlotOptions} is deliberately omitted —
+ * `initial` from `AsyncSlotOptions` is deliberately omitted —
  * keyed slots have no per-key seed concept (the entries don't exist
  * until `run()` creates them).
  */
@@ -74,7 +74,7 @@ export declare class KeyedAsyncSlot<K, T = void, E = string> {
      * `undefined` if no `run()` has been issued for it yet. Reactive on
      * map population and on the slot's `$state.raw` fields.
      *
-     * Prefer the sugar getters ({@link loading}, {@link error}) for
+     * Prefer the sugar getters (`loading`, `error`) for
      * templates; reach for `get(key)` when you need `error_data`, `data`,
      * or to call `abort()` / `set()` / `reset()` on the underlying slot.
      */
@@ -109,12 +109,12 @@ export declare class KeyedAsyncSlot<K, T = void, E = string> {
     /**
      * Abort the in-flight run for `key`, if any. No-op when the key has
      * no entry. The slot stays in the map at its prior resolved status —
-     * call {@link delete} to remove the entry entirely.
+     * call `delete` to remove the entry entirely.
      */
     abort(key: K, reason?: unknown): void;
     /**
      * Abort every in-flight run. Resolved entries stay in the map —
-     * call {@link reset} to clear them too.
+     * call `reset` to clear them too.
      */
     abort_all(reason?: unknown): void;
     /**

package/dist/ui/keyed_async_slot.svelte.js

@@ -73,7 +73,7 @@ export class KeyedAsyncSlot {
      * `undefined` if no `run()` has been issued for it yet. Reactive on
      * map population and on the slot's `$state.raw` fields.
      *
-     * Prefer the sugar getters ({@link loading}, {@link error}) for
+     * Prefer the sugar getters (`loading`, `error`) for
      * templates; reach for `get(key)` when you need `error_data`, `data`,
      * or to call `abort()` / `set()` / `reset()` on the underlying slot.
      */
@@ -131,14 +131,14 @@ export class KeyedAsyncSlot {
     /**
      * Abort the in-flight run for `key`, if any. No-op when the key has
      * no entry. The slot stays in the map at its prior resolved status —
-     * call {@link delete} to remove the entry entirely.
+     * call `delete` to remove the entry entirely.
      */
     abort(key, reason) {
         this.#slots.get(key)?.abort(reason);
     }
     /**
      * Abort every in-flight run. Resolved entries stay in the map —
-     * call {@link reset} to clear them too.
+     * call `reset` to clear them too.
      */
     abort_all(reason) {
         for (const slot of this.#slots.values()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.128.0",
+  "version": "0.129.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",