@fuzdev/fuz_app 0.63.0 → 0.64.0

package/dist/testing/audit_drift_guard.d.ts

@@ -0,0 +1,116 @@
+import './assert_dev_env.js';
+import { type AuditEmitter, type CreateAuditEmitterOptions } from '../auth/audit_emitter.js';
+import type { AuditLogInput } from '../auth/audit_log_schema.js';
+import type { AuditFactory } from '../server/app_backend.js';
+/**
+ * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
+ * emission with a metadata shape that fails its `audit_metadata_schemas`
+ * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ *
+ * The production validation in `query_audit_log` is fail-open — it bumps
+ * process-wide counters and proceeds, so a regression that emits an
+ * undeclared metadata field or a typo'd event-type lands a row that
+ * passes downstream queries but breaks forensics. Tests that exercise
+ * audit emits should fail loudly when this happens.
+ *
+ * Call at the top of every `describe` / `describe_db` block that fires
+ * audit writes through `deps.audit.emit`. Resets counters before each
+ * test and asserts zero on completion.
+ *
+ * Pair with `await_pending_effects: true` (the default for
+ * `create_test_app`) so fire-and-forget audit writes have completed by
+ * the time the after-each check observes counter state.
+ */
+export declare const install_audit_drift_guard: () => void;
+/**
+ * Marker pushed into a shared sequence array by an emit-recording
+ * `audit_factory`. Pair with `RecordedClose` from
+ * `connection_closer_helpers.ts` to test close-vs-emit ordering at
+ * handler call sites — see `create_emit_ordering_audit_factory` below.
+ */
+export interface AuditEmitMarker {
+    kind: 'emit';
+    at: number;
+}
+/**
+ * Pair returned by {@link create_recording_audit_emitter} — the
+ * `AuditEmitter` to inject as `deps.audit`, plus the shared `calls`
+ * array that records every captured emission. Both fields are live —
+ * callers read `calls` after exercising the handler to assert on the
+ * audit metadata shape.
+ */
+export interface RecordingAuditEmitter {
+    emitter: AuditEmitter;
+    calls: Array<AuditLogInput>;
+}
+/**
+ * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
+ * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
+ * capture audit metadata shapes in unit tests (e.g. password change failure
+ * outcome, role-grant create denial) without standing up the full PGlite +
+ * `query_audit_log` pipeline.
+ *
+ * **Capture scope — all four production fan-out shapes.**
+ * `emit_role_grant_target` mirrors `create_audit_emitter`'s lift logic in
+ * place — `actor_id` / `account_id` / `ip` are populated from `auth` + `ctx`
+ * and the `event_type` / `outcome` / `target_*_id` / `metadata` fields
+ * forward from the input envelope. Tests asserting on role-grant-shape
+ * emissions read out of the same homogeneous `calls` array.
+ * `notify` is a no-op; `on_event_chain` is an empty array.
+ *
+ * `emit` AND `emit_pool` both append to `calls` so cleanup-sweep tests
+ * (which use `emit_pool` exclusively — see `auth/cleanup.ts`) can also
+ * read assertions off the same array.
+ *
+ * Pass `calls_ref` to write into a caller-owned array (callers that
+ * declared `const events: Array<AuditLogInput> = []` and want to keep
+ * the reference). Omit to let the helper allocate a fresh array and
+ * return it on the `calls` field of the result.
+ *
+ * The returned emitter is deliberately NOT frozen — slots stay mutable
+ * so a test can override one when it needs bespoke shape (e.g. an
+ * `emit_pool` that throws on the first call). The production
+ * `create_audit_emitter` freeze invariant exists to catch the
+ * `patch_audit_emit_capture` hot-patch footgun against the
+ * closure-captured `emit`; the recording emitter has no inner closure,
+ * so the freeze isn't load-bearing here.
+ */
+export declare const create_recording_audit_emitter: (calls_ref?: Array<AuditLogInput>) => RecordingAuditEmitter;
+/**
+ * Build an `audit_factory` that produces a real `create_audit_emitter`
+ * with its `emit` decorated to push a `{kind: 'emit', at: seq.value++}`
+ * marker into a shared sequence + events array. Used by the close-vs-emit
+ * ordering test to compose against a shared sequence counter (typically
+ * `create_recording_closer(seq_ref)` capturing eager-close calls).
+ *
+ * Pass the returned factory through `create_test_app({audit_factory: …})`
+ * — the test backend invokes it with its constructed `{db, log}` and
+ * lands the decorated emitter on `backend.deps.audit`. Production
+ * handlers dereference `deps.audit.emit` at call time, so the decorator
+ * sees every subsequent handler invocation. The underlying `emit` still
+ * runs — the decorator records the call, it does not suppress side
+ * effects.
+ *
+ * **Scope — both `emit` and `emit_role_grant_target`.** The decorator
+ * is captured by `emit_role_grant_target`'s closure inside
+ * `create_audit_emitter` (and re-exposed as the outer `emit` slot), so
+ * role-grant-shape emissions land in `events_ref` alongside bare `emit`
+ * calls. `emit_pool` and `notify` are not decorated — they take
+ * `AuditLogInput` / `AuditLogEvent` directly without going through
+ * `emit`, so handler-side `emit_pool` writes (today only
+ * `auth/cleanup.ts`) skip capture. Close-firing handlers all reach for
+ * `emit` or `emit_role_grant_target`, so the ordering test sees them
+ * regardless of which entry point a future refactor picks.
+ *
+ * Optionally accept `extra_options` to thread `on_audit_event` /
+ * `audit_log_config` into the inner emitter — useful when a test wants
+ * both ordering capture and a real SSE/WS guard wired into the same
+ * emitter chain.
+ */
+export declare const create_emit_ordering_audit_factory: <E extends {
+    kind: string;
+    at: number;
+}>(seq_ref: {
+    value: number;
+}, events_ref: Array<AuditEmitMarker | E>, extra_options?: Omit<CreateAuditEmitterOptions, "db" | "log" | "emit_decorator">) => AuditFactory;
+//# sourceMappingURL=audit_drift_guard.d.ts.map

package/dist/testing/audit_drift_guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA0BF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,kCAAkC,GAAI,CAAC,SAAS;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAC,EACtF,SAAS;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EACxB,YAAY,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EACtC,gBAAgB,IAAI,CAAC,yBAAyB,EAAE,IAAI,GAAG,KAAK,GAAG,gBAAgB,CAAC,KAC9E,YAWF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -0,0 +1,134 @@
+import './assert_dev_env.js';
+import { assert, beforeEach, afterEach } from 'vitest';
+import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures, } from '../auth/audit_log_queries.js';
+import { create_audit_emitter, } from '../auth/audit_emitter.js';
+/**
+ * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
+ * emission with a metadata shape that fails its `audit_metadata_schemas`
+ * entry, or an `event_type` not present in the active `AuditLogConfig`.
+ *
+ * The production validation in `query_audit_log` is fail-open — it bumps
+ * process-wide counters and proceeds, so a regression that emits an
+ * undeclared metadata field or a typo'd event-type lands a row that
+ * passes downstream queries but breaks forensics. Tests that exercise
+ * audit emits should fail loudly when this happens.
+ *
+ * Call at the top of every `describe` / `describe_db` block that fires
+ * audit writes through `deps.audit.emit`. Resets counters before each
+ * test and asserts zero on completion.
+ *
+ * Pair with `await_pending_effects: true` (the default for
+ * `create_test_app`) so fire-and-forget audit writes have completed by
+ * the time the after-each check observes counter state.
+ */
+export const install_audit_drift_guard = () => {
+    beforeEach(() => {
+        reset_audit_metadata_validation_failures();
+        reset_audit_unknown_event_type_failures();
+    });
+    afterEach(() => {
+        assert.strictEqual(get_audit_metadata_validation_failures(), 0, 'audit metadata failed schema validation — see audit_log_schema.audit_metadata_schemas');
+        assert.strictEqual(get_audit_unknown_event_type_failures(), 0, 'audit emitted an unknown event_type — see AUDIT_EVENT_TYPES');
+    });
+};
+/**
+ * Build a no-op `AuditEmitter` that records every `emit`, `emit_pool`, and
+ * `emit_role_grant_target` call into `calls` as an `AuditLogInput`. Use to
+ * capture audit metadata shapes in unit tests (e.g. password change failure
+ * outcome, role-grant create denial) without standing up the full PGlite +
+ * `query_audit_log` pipeline.
+ *
+ * **Capture scope — all four production fan-out shapes.**
+ * `emit_role_grant_target` mirrors `create_audit_emitter`'s lift logic in
+ * place — `actor_id` / `account_id` / `ip` are populated from `auth` + `ctx`
+ * and the `event_type` / `outcome` / `target_*_id` / `metadata` fields
+ * forward from the input envelope. Tests asserting on role-grant-shape
+ * emissions read out of the same homogeneous `calls` array.
+ * `notify` is a no-op; `on_event_chain` is an empty array.
+ *
+ * `emit` AND `emit_pool` both append to `calls` so cleanup-sweep tests
+ * (which use `emit_pool` exclusively — see `auth/cleanup.ts`) can also
+ * read assertions off the same array.
+ *
+ * Pass `calls_ref` to write into a caller-owned array (callers that
+ * declared `const events: Array<AuditLogInput> = []` and want to keep
+ * the reference). Omit to let the helper allocate a fresh array and
+ * return it on the `calls` field of the result.
+ *
+ * The returned emitter is deliberately NOT frozen — slots stay mutable
+ * so a test can override one when it needs bespoke shape (e.g. an
+ * `emit_pool` that throws on the first call). The production
+ * `create_audit_emitter` freeze invariant exists to catch the
+ * `patch_audit_emit_capture` hot-patch footgun against the
+ * closure-captured `emit`; the recording emitter has no inner closure,
+ * so the freeze isn't load-bearing here.
+ */
+export const create_recording_audit_emitter = (calls_ref) => {
+    const calls = calls_ref ?? [];
+    const emitter = {
+        emit: (_ctx, input) => {
+            calls.push(input);
+        },
+        emit_role_grant_target: (ctx, auth, input) => {
+            calls.push({
+                event_type: input.event_type,
+                actor_id: auth.actor.id,
+                account_id: auth.account.id,
+                outcome: input.outcome,
+                target_account_id: input.target_account_id,
+                target_actor_id: input.target_actor_id,
+                ip: ctx.client_ip,
+                metadata: input.metadata,
+            });
+        },
+        emit_pool: (input) => {
+            calls.push(input);
+            return Promise.resolve();
+        },
+        notify: () => undefined,
+        on_event_chain: [],
+    };
+    return { emitter, calls };
+};
+/**
+ * Build an `audit_factory` that produces a real `create_audit_emitter`
+ * with its `emit` decorated to push a `{kind: 'emit', at: seq.value++}`
+ * marker into a shared sequence + events array. Used by the close-vs-emit
+ * ordering test to compose against a shared sequence counter (typically
+ * `create_recording_closer(seq_ref)` capturing eager-close calls).
+ *
+ * Pass the returned factory through `create_test_app({audit_factory: …})`
+ * — the test backend invokes it with its constructed `{db, log}` and
+ * lands the decorated emitter on `backend.deps.audit`. Production
+ * handlers dereference `deps.audit.emit` at call time, so the decorator
+ * sees every subsequent handler invocation. The underlying `emit` still
+ * runs — the decorator records the call, it does not suppress side
+ * effects.
+ *
+ * **Scope — both `emit` and `emit_role_grant_target`.** The decorator
+ * is captured by `emit_role_grant_target`'s closure inside
+ * `create_audit_emitter` (and re-exposed as the outer `emit` slot), so
+ * role-grant-shape emissions land in `events_ref` alongside bare `emit`
+ * calls. `emit_pool` and `notify` are not decorated — they take
+ * `AuditLogInput` / `AuditLogEvent` directly without going through
+ * `emit`, so handler-side `emit_pool` writes (today only
+ * `auth/cleanup.ts`) skip capture. Close-firing handlers all reach for
+ * `emit` or `emit_role_grant_target`, so the ordering test sees them
+ * regardless of which entry point a future refactor picks.
+ *
+ * Optionally accept `extra_options` to thread `on_audit_event` /
+ * `audit_log_config` into the inner emitter — useful when a test wants
+ * both ordering capture and a real SSE/WS guard wired into the same
+ * emitter chain.
+ */
+export const create_emit_ordering_audit_factory = (seq_ref, events_ref, extra_options) => {
+    return ({ db, log }) => create_audit_emitter({
+        ...extra_options,
+        db,
+        log,
+        emit_decorator: (inner) => (ctx, input) => {
+            events_ref.push({ kind: 'emit', at: seq_ref.value++ });
+            inner(ctx, input);
+        },
+    });
+};

package/dist/testing/connection_closer_helpers.d.ts

@@ -0,0 +1,44 @@
+import './assert_dev_env.js';
+import type { ConnectionCloser } from '../actions/connection_closer.js';
+/**
+ * Record of a single `ConnectionCloser` method invocation. `at` is the
+ * value of a monotonically-increasing sequence counter at the time of
+ * the call — pair with `create_emit_ordering_audit_factory` to record both
+ * close + audit emit calls into the same sequence for ordering tests.
+ */
+export interface RecordedClose {
+    method: 'session' | 'token' | 'account';
+    id: string;
+    at: number;
+}
+export interface RecordingCloser {
+    closer: ConnectionCloser;
+    calls: Array<RecordedClose>;
+}
+/**
+ * Build a `ConnectionCloser` that records every call into `calls` rather
+ * than touching real transports. Each method returns 1 ("one socket
+ * closed") regardless of whether a real socket exists — handlers
+ * typically ignore the return value.
+ *
+ * Pass `seq_ref` to share the sequence counter with a sibling
+ * `create_emit_ordering_audit_factory` so tests can pin close-vs-emit
+ * ordering at the handler call site. Without `seq_ref`, the closer
+ * uses a fresh internal counter — `at: N` values within a single test
+ * are meaningful, but cannot be compared against audit emit ordering.
+ */
+export declare const create_recording_closer: (seq_ref?: {
+    value: number;
+}) => RecordingCloser;
+/**
+ * Pin `{method, id}` on a single recorded close call without baking in
+ * the `at: N` sequence number. Use at every "did the closer fire?"
+ * assertion site; the sequence number is only meaningful for dedicated
+ * ordering tests (paired with `create_emit_ordering_audit_factory`).
+ *
+ * Throws via `assert.ok` if `call` is `undefined` — index a recorded
+ * `calls` array directly (`calls[0]`) and let this helper handle the
+ * missing-element case.
+ */
+export declare const assert_close_call: (call: RecordedClose | undefined, method: "session" | "token" | "account", id: string) => void;
+//# sourceMappingURL=connection_closer_helpers.d.ts.map

package/dist/testing/connection_closer_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection_closer_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/connection_closer_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,KAAG,eAkBnE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,aAAa,GAAG,SAAS,EAC/B,QAAQ,SAAS,GAAG,OAAO,GAAG,SAAS,EACvC,IAAI,MAAM,KACR,IAIF,CAAC"}

package/dist/testing/connection_closer_helpers.js

@@ -0,0 +1,48 @@
+import './assert_dev_env.js';
+import { assert } from 'vitest';
+/**
+ * Build a `ConnectionCloser` that records every call into `calls` rather
+ * than touching real transports. Each method returns 1 ("one socket
+ * closed") regardless of whether a real socket exists — handlers
+ * typically ignore the return value.
+ *
+ * Pass `seq_ref` to share the sequence counter with a sibling
+ * `create_emit_ordering_audit_factory` so tests can pin close-vs-emit
+ * ordering at the handler call site. Without `seq_ref`, the closer
+ * uses a fresh internal counter — `at: N` values within a single test
+ * are meaningful, but cannot be compared against audit emit ordering.
+ */
+export const create_recording_closer = (seq_ref) => {
+    const calls = [];
+    const seq = seq_ref ?? { value: 0 };
+    const closer = {
+        close_sockets_for_session: (id) => {
+            calls.push({ method: 'session', id, at: seq.value++ });
+            return 1;
+        },
+        close_sockets_for_token: (id) => {
+            calls.push({ method: 'token', id, at: seq.value++ });
+            return 1;
+        },
+        close_sockets_for_account: (id) => {
+            calls.push({ method: 'account', id, at: seq.value++ });
+            return 1;
+        },
+    };
+    return { closer, calls };
+};
+/**
+ * Pin `{method, id}` on a single recorded close call without baking in
+ * the `at: N` sequence number. Use at every "did the closer fire?"
+ * assertion site; the sequence number is only meaningful for dedicated
+ * ordering tests (paired with `create_emit_ordering_audit_factory`).
+ *
+ * Throws via `assert.ok` if `call` is `undefined` — index a recorded
+ * `calls` array directly (`calls[0]`) and let this helper handle the
+ * missing-element case.
+ */
+export const assert_close_call = (call, method, id) => {
+    assert.ok(call, 'expected a recorded close call');
+    assert.strictEqual(call.method, method);
+    assert.strictEqual(call.id, id);
+};

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAA6C,KAAK,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAOjB,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAsB1B;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA87CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAA6C,KAAK,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAOjB,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAsB1B;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA87CF,CAAC"}

package/dist/testing/integration.js

@@ -31,19 +31,17 @@ import { account_verify_action_spec, account_session_list_action_spec, account_s
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 /**
  * Build `CreateTestAppOptions` from standard options plus a database.
- * Forwards `options.rpc_endpoints` to `app_options.rpc_endpoints` so
- * `create_app_server` auto-mounts it per-test with the real ctx.
- * `SuiteAppOptions` excludes `rpc_endpoints` so there's no way for
- * `options.app_options` to collide with the suite-level field.
+ * Forwards `options.rpc_endpoints` to the top-level `rpc_endpoints` slot on
+ * `CreateTestAppOptions` so `create_app_server` auto-mounts it per-test with
+ * the real ctx. `SuiteAppOptions` excludes `rpc_endpoints` so there's no way
+ * for `options.app_options` to collide with the suite-level field.
  */
 const build_test_app_options = (options, db) => ({
     session_options: options.session_options,
     create_route_specs: options.create_route_specs,
     db,
-    app_options: {
-        ...options.app_options,
-        rpc_endpoints: options.rpc_endpoints,
-    },
+    rpc_endpoints: options.rpc_endpoints,
+    app_options: options.app_options,
 });
 /**
  * Standard integration test suite for fuz_app auth routes.
@@ -66,7 +64,7 @@ export const describe_standard_integration_tests = (options) => {
     // Hard-fail early so consumers see a clear setup error instead of a
     // confusing test failure when `rpc_endpoints` is missing. Factory-form
     // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via `app_options.rpc_endpoints`.
+    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {

package/dist/testing/rate_limiting.js

@@ -44,7 +44,7 @@ export const describe_rate_limiting_tests = (options) => {
     // Hard-fail early so consumers see a clear setup error instead of a
     // confusing test failure when `rpc_endpoints` is missing. Factory-form
     // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via `app_options.rpc_endpoints`.
+    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
@@ -64,9 +64,9 @@ export const describe_rate_limiting_tests = (options) => {
                         session_options: options.session_options,
                         create_route_specs: options.create_route_specs,
                         db: get_db(),
+                        rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            rpc_endpoints: options.rpc_endpoints,
                             ip_rate_limiter,
                             login_account_rate_limiter: null,
                             bearer_ip_rate_limiter: null,
@@ -117,9 +117,9 @@ export const describe_rate_limiting_tests = (options) => {
                         session_options: options.session_options,
                         create_route_specs: options.create_route_specs,
                         db: get_db(),
+                        rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            rpc_endpoints: options.rpc_endpoints,
                             ip_rate_limiter: null,
                             login_account_rate_limiter,
                             bearer_ip_rate_limiter: null,
@@ -182,9 +182,9 @@ export const describe_rate_limiting_tests = (options) => {
                         session_options: options.session_options,
                         create_route_specs: options.create_route_specs,
                         db: get_db(),
+                        rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            rpc_endpoints: options.rpc_endpoints,
                             ip_rate_limiter: null,
                             login_account_rate_limiter: null,
                             bearer_ip_rate_limiter,

package/dist/testing/rpc_helpers.d.ts

@@ -13,7 +13,8 @@ import type { SessionOptions } from '../auth/session_cookie.js';
  * per-test `ctx.app_settings` / `ctx.deps` (e.g. the canonical
  * `create_standard_rpc_actions(ctx.deps, {app_settings: ctx.app_settings})`
  * pattern). `create_app_server` resolves either shape natively; test helpers
- * forward the raw value to `app_options.rpc_endpoints` for live dispatch.
+ * forward the raw value to the top-level `rpc_endpoints` slot on
+ * `CreateTestAppOptions` for live dispatch.
  */
 export type RpcEndpointsSuiteOption = Array<RpcEndpointSpec> | ((ctx: AppServerContext) => Array<RpcEndpointSpec>);
 /**

package/dist/testing/rpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAC,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG9D;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAChC,KAAK,CAAC,eAAe,CAAC,GACtB,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAW1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB,yEAAyE;AACzE,MAAM,MAAM,aAAa,GACtB;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAC3C;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CACtD,CAAC;AAEL,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,mEAAmE;IACnE,GAAG,EAAE;QAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;KAAC,CAAC;IACnF,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAuD,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAC,GAC5D;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAA;CAAC,CAAC;AAEvF,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAarC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAcX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAC,GAAG,SAOtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAC,GAAG,SAOrD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAYF,CAAC"}
+{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAC,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG9D;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAChC,KAAK,CAAC,eAAe,CAAC,GACtB,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAW1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB,yEAAyE;AACzE,MAAM,MAAM,aAAa,GACtB;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAC3C;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CACtD,CAAC;AAEL,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,mEAAmE;IACnE,GAAG,EAAE;QAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;KAAC,CAAC;IACnF,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAuD,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAC,GAC5D;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAA;CAAC,CAAC;AAEvF,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAarC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAcX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAC,GAAG,SAOtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAC,GAAG,SAOrD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAYF,CAAC"}

package/dist/testing/rpc_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAEN,KAAK,eAAe,EAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAO9D,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AA2BD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA8IhF,CAAC"}
+{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAEN,KAAK,eAAe,EAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAO9D,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AA2BD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA4IhF,CAAC"}

package/dist/testing/rpc_round_trip.js

@@ -54,10 +54,10 @@ const pick_rpc_auth_headers = (method, test_app, authed_account, admin_account)
 export const describe_rpc_round_trip_tests = (options) => {
     const skip_set = new Set(options.skip_methods);
     // Resolve factory-form endpoints once for setup-time iteration (method
-    // enumeration, surface lookup). Real handlers run per-test via
-    // `app_options.rpc_endpoints` — `action.spec.method` / `.input` /
-    // `.output` are ctx-independent, so the stub-resolved specs match
-    // what the live dispatcher serves.
+    // enumeration, surface lookup). Real handlers run per-test via the
+    // top-level `rpc_endpoints` slot on `CreateTestAppOptions` —
+    // `action.spec.method` / `.input` / `.output` are ctx-independent, so
+    // the stub-resolved specs match what the live dispatcher serves.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const init_schema = async (db) => {
         await run_migrations(db, [auth_migration_ns]);
@@ -76,10 +76,8 @@ export const describe_rpc_round_trip_tests = (options) => {
                     session_options: options.session_options,
                     create_route_specs: options.create_route_specs,
                     db,
-                    app_options: {
-                        ...options.app_options,
-                        rpc_endpoints: options.rpc_endpoints,
-                    },
+                    rpc_endpoints: options.rpc_endpoints,
+                    app_options: options.app_options,
                 });
                 authed_account = await test_app.create_account({
                     username: 'rpc_round_trip_authed',

package/dist/testing/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAmB7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,SAAS,EAAuB,MAAM,oBAAoB,CAAC;AAE/F,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAE9D,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAM1B,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAChC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,8BAA8B;IAC9B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAyHD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,mBAAmB,KAAG,IA2HvE,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAmB7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,SAAS,EAAuB,MAAM,oBAAoB,CAAC;AAE/F,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAG/D,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAE9D,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAM1B,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAChC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,8BAA8B;IAC9B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAyHD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,mBAAmB,KAAG,IAgIvE,CAAC"}

package/dist/testing/sse_round_trip.js

@@ -16,6 +16,7 @@ import './assert_dev_env.js';
 import { describe, test, beforeAll, afterAll, assert } from 'vitest';
 import { SSE_CONNECTED_COMMENT } from '../realtime/sse.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
+import { create_audit_emitter } from '../auth/audit_emitter.js';
 import { create_test_app, } from './app_server.js';
 import { create_pglite_factory } from './db.js';
 import { find_route_spec, pick_auth_headers } from './integration_helpers.js';
@@ -134,7 +135,7 @@ export const describe_sse_route_tests = (options) => {
     // Hard-fail early so consumers see a clear setup error instead of a
     // confusing test failure when `rpc_endpoints` is missing. Factory-form
     // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via `app_options.rpc_endpoints`.
+    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
@@ -153,15 +154,20 @@ export const describe_sse_route_tests = (options) => {
                     let db;
                     beforeAll(async () => {
                         db = await factory.create();
+                        // Forward the consumer's listener through an `audit_factory`
+                        // body — the sugar was removed from `TestAppServerOptions`
+                        // to match the production `CreateAppBackendOptions` shape.
+                        const { on_audit_event } = options;
+                        const audit_factory = on_audit_event
+                            ? (params) => create_audit_emitter({ ...params, on_audit_event })
+                            : undefined;
                         test_app = await create_test_app({
                             session_options: options.session_options,
                             create_route_specs: options.create_route_specs,
                             db,
-                            app_options: {
-                                ...options.app_options,
-                                rpc_endpoints: options.rpc_endpoints,
-                            },
-                            on_audit_event: options.on_audit_event,
+                            rpc_endpoints: options.rpc_endpoints,
+                            app_options: options.app_options,
+                            audit_factory,
                         });
                         authed_account = await test_app.create_account({
                             username: 'sse_authed',

package/dist/testing/stubs.d.ts

@@ -8,6 +8,7 @@ import type { AppServerContext } from '../server/app_server.js';
 import { Db } from '../db/db.js';
 import { type RouteSpec } from '../http/route_spec.js';
 import { type AppSurfaceSpec, type RpcEndpointSpec } from '../http/surface.js';
+import type { WsEndpointSpec } from '../actions/ws_endpoint_spec.js';
 import type { EventSpec } from '../realtime/sse.js';
 import { type AuditLogSse } from '../realtime/sse_auth_guard.js';
 /**
@@ -116,6 +117,16 @@ export interface CreateTestAppSurfaceSpecOptions {
      * the stub `AppServerContext` this helper already builds.
      */
     rpc_endpoints?: Array<RpcEndpointSpec> | ((ctx: AppServerContext) => Array<RpcEndpointSpec>);
+    /**
+     * WebSocket endpoint specs for surface generation. Symmetric with
+     * `create_app_server`'s `ws_endpoints` option — pass the same value
+     * to both entry points so the attack surface tests see the same WS
+     * endpoints production auto-mounts. The factory runs once against
+     * the stub `AppServerContext` this helper already builds. No
+     * `upgradeWebSocket` needed — this helper produces an `AppSurfaceSpec`
+     * only, never mounts.
+     */
+    ws_endpoints?: ReadonlyArray<WsEndpointSpec> | ((ctx: AppServerContext) => ReadonlyArray<WsEndpointSpec>);
     /** Transform middleware array (e.g., tx's `extend_middleware_for_tx_binary`). */
     transform_middleware?: (specs: Array<MiddlewareSpec>) => Array<MiddlewareSpec>;
     /** Bootstrap route prefix (default: `'/api/account'`). */

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAE3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAE3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAkB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAA8B,KAAK,WAAW,EAAC,MAAM,+BAA+B,CAAC;AAM5F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAM3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAqBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA2CF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAE3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAE3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAkB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAA8B,KAAK,WAAW,EAAC,MAAM,+BAA+B,CAAC;AAM5F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAM3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAqBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACV,aAAa,CAAC,cAAc,CAAC,GAC7B,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAgDF,CAAC"}

package/dist/testing/stubs.js

@@ -237,6 +237,9 @@ export const create_test_app_surface_spec = (options) => {
         actions: endpoint.actions,
         log: ctx.deps.log,
     })) ?? [];
+    // Resolve ws endpoints (mirrors create_app_server). Surface-only —
+    // no `register_ws_endpoint` call here, so no `upgradeWebSocket` needed.
+    const resolved_ws_endpoints = typeof options.ws_endpoints === 'function' ? options.ws_endpoints(ctx) : options.ws_endpoints;
     const route_specs = [
         ...consumer_routes,
         ...rpc_route_specs,
@@ -252,5 +255,6 @@ export const create_test_app_surface_spec = (options) => {
         env_schema: options.env_schema ?? BaseServerEnv,
         event_specs: options.event_specs,
         rpc_endpoints: resolved_rpc_endpoints,
+        ws_endpoints: resolved_ws_endpoints,
     });
 };