@openparachute/hub 0.6.3-rc.1 → 0.6.3-rc.3

package/src/__tests__/api-modules-ops.test.ts

@@ -70,6 +70,36 @@ async function mintBearer(h: Harness, scopes: string[]): Promise<string> {
   return signed.token;
 }
 
+/**
+ * Mint a host-admin bearer at a chosen `iss` (hub#516). The CLI presents the
+ * operator token on loopback; after `expose` its `iss` is the public origin
+ * while the loopback request resolves the loopback issuer.
+ */
+async function mintBearerAtIssuer(h: Harness, scopes: string[], iss: string): Promise<string> {
+  const signed = await signAccessToken(h.db, {
+    sub: h.userId,
+    scopes,
+    audience: "operator",
+    clientId: "parachute-hub",
+    issuer: iss,
+    ttlSeconds: 3600,
+  });
+  recordTokenMint(h.db, {
+    jti: signed.jti,
+    createdVia: "operator_mint",
+    subject: "operator",
+    clientId: "parachute-hub",
+    scopes,
+    expiresAt: signed.expiresAt,
+  });
+  return signed.token;
+}
+
+/** The hub's public origin after `expose` — what the operator token's `iss` becomes. */
+const PUBLIC_ORIGIN = "https://parachute.taildf9ce2.ts.net";
+/** A foreign origin the hub never answers on. */
+const FOREIGN_ORIGIN = "https://evil.example.com";
+
 function postReq(path: string, headers: Record<string, string>): Request {
   return new Request(`http://localhost${path}`, { method: "POST", headers });
 }
@@ -967,6 +997,97 @@ describe("POST /api/modules/:short/stop", () => {
   });
 });
 
+/**
+ * hub#516 — the module-ops `authorize` accepts the operator token's `iss`
+ * against the SET of origins the hub answers on (knownIssuers), not just the
+ * single per-request issuer. Exercised through `handleStop` (the simplest sync
+ * op that goes through `authorize`). The per-request `issuer` here is loopback
+ * (mirroring a loopback CLI request); `knownIssuers` carries loopback + the
+ * public expose-state origin.
+ */
+describe("operator-token iss validation against knownIssuers (hub#516)", () => {
+  let h: Harness;
+  beforeEach(async () => {
+    h = await makeHarness();
+    _resetOperationsRegistryForTests();
+  });
+  afterEach(() => h.cleanup());
+
+  // The live repro: operator token's iss = PUBLIC origin, loopback request
+  // (per-request issuer = loopback), knownIssuers includes the public origin
+  // → ACCEPTED. Was rejected (`unexpected "iss" claim value`) pre-fix.
+  test("live repro: public-iss operator token on a loopback request → ACCEPTED", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_OPS_REQUIRED_SCOPE], PUBLIC_ORIGIN);
+    const res = await handleStop(
+      postReq("/api/modules/vault/stop", { authorization: `Bearer ${bearer}` }),
+      "vault",
+      {
+        db: h.db,
+        issuer: ISSUER, // loopback per-request issuer
+        knownIssuers: [ISSUER, "http://localhost:1939", PUBLIC_ORIGIN],
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        supervisor,
+      },
+    );
+    // Not a 401 — authorize passed. (stopped:false because nothing's running.)
+    expect(res.status).toBe(200);
+  });
+
+  test("loopback-iss operator token, loopback knownIssuers → accepted (unchanged)", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_OPS_REQUIRED_SCOPE], ISSUER);
+    const res = await handleStop(
+      postReq("/api/modules/vault/stop", { authorization: `Bearer ${bearer}` }),
+      "vault",
+      {
+        db: h.db,
+        issuer: ISSUER,
+        knownIssuers: [ISSUER, "http://localhost:1939"],
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        supervisor,
+      },
+    );
+    expect(res.status).toBe(200);
+  });
+
+  test("FOREIGN-iss operator token → 401 (no widening to arbitrary issuers)", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_OPS_REQUIRED_SCOPE], FOREIGN_ORIGIN);
+    const res = await handleStop(
+      postReq("/api/modules/vault/stop", { authorization: `Bearer ${bearer}` }),
+      "vault",
+      {
+        db: h.db,
+        issuer: ISSUER,
+        knownIssuers: [ISSUER, "http://localhost:1939", PUBLIC_ORIGIN],
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        supervisor,
+      },
+    );
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error_description: string };
+    expect(body.error_description).toMatch(/unexpected "iss" claim value/);
+  });
+
+  test("knownIssuers absent → falls back to strict per-request issuer (back-compat)", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    // Public-iss token, loopback per-request issuer, NO knownIssuers wired →
+    // the strict single-issuer fallback rejects (the pre-fix behavior the
+    // non-HTTP install path relies on).
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_OPS_REQUIRED_SCOPE], PUBLIC_ORIGIN);
+    const res = await handleStop(
+      postReq("/api/modules/vault/stop", { authorization: `Bearer ${bearer}` }),
+      "vault",
+      { db: h.db, issuer: ISSUER, manifestPath: h.manifestPath, configDir: h.dir, supervisor },
+    );
+    expect(res.status).toBe(401);
+  });
+});
+
 describe("POST /api/modules/:short/restart", () => {
   let h: Harness;
   beforeEach(async () => {

package/src/__tests__/api-modules.test.ts

@@ -63,6 +63,32 @@ async function mintBearer(h: Harness, scopes: string[]): Promise<string> {
   return signed.token;
 }
 
+/** The hub's public origin after `expose` — what the operator token's `iss` becomes (hub#516). */
+const PUBLIC_ORIGIN = "https://parachute.taildf9ce2.ts.net";
+/** A foreign origin the hub never answers on (hub#516). */
+const FOREIGN_ORIGIN = "https://evil.example.com";
+
+/** Mint a host-admin (operator-shaped) bearer at a chosen `iss` (hub#516). */
+async function mintBearerAtIssuer(h: Harness, scopes: string[], iss: string): Promise<string> {
+  const signed = await signAccessToken(h.db, {
+    sub: h.userId,
+    scopes,
+    audience: "operator",
+    clientId: "parachute-hub",
+    issuer: iss,
+    ttlSeconds: 3600,
+  });
+  recordTokenMint(h.db, {
+    jti: signed.jti,
+    createdVia: "operator_mint",
+    subject: "operator",
+    clientId: "parachute-hub",
+    scopes,
+    expiresAt: signed.expiresAt,
+  });
+  return signed.token;
+}
+
 function writeManifest(path: string, services: unknown[]): void {
   writeFileSync(path, JSON.stringify({ services }));
 }
@@ -147,6 +173,47 @@ describe("GET /api/modules", () => {
     expect(body.error).toBe("insufficient_scope");
   });
 
+  // hub#516: `parachute status` reads /api/modules on loopback presenting the
+  // operator token, whose `iss` is the PUBLIC origin after `expose`. The
+  // host-admin bearer's iss is validated against `knownIssuers` (loopback ∪
+  // expose-state public ∪ env), not the single per-request loopback issuer.
+  test("live repro: public-iss operator token on a loopback request → 200 (hub#516)", async () => {
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_REQUIRED_SCOPE], PUBLIC_ORIGIN);
+    const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
+      db: h.db,
+      issuer: ISSUER, // loopback per-request issuer
+      knownIssuers: [ISSUER, "http://localhost:1939", PUBLIC_ORIGIN],
+      manifestPath: h.manifestPath,
+      fetchLatestVersion: async () => null,
+    });
+    expect(res.status).toBe(200);
+  });
+
+  test("FOREIGN-iss operator token → 401 (no widening) (hub#516)", async () => {
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_REQUIRED_SCOPE], FOREIGN_ORIGIN);
+    const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
+      db: h.db,
+      issuer: ISSUER,
+      knownIssuers: [ISSUER, "http://localhost:1939", PUBLIC_ORIGIN],
+      manifestPath: h.manifestPath,
+      fetchLatestVersion: async () => null,
+    });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error_description: string };
+    expect(body.error_description).toMatch(/unexpected "iss" claim value/);
+  });
+
+  test("knownIssuers absent → strict per-request issuer fallback rejects public-iss (hub#516)", async () => {
+    const bearer = await mintBearerAtIssuer(h, [API_MODULES_REQUIRED_SCOPE], PUBLIC_ORIGIN);
+    const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
+      db: h.db,
+      issuer: ISSUER, // no knownIssuers → falls back to [issuer]
+      manifestPath: h.manifestPath,
+      fetchLatestVersion: async () => null,
+    });
+    expect(res.status).toBe(401);
+  });
+
   test("200 + curated list on fresh container (empty services.json)", async () => {
     // The v0.6 hot path: brand-new Render container, no services.json
     // yet. UI must render "install vault / scribe" cards even though

package/src/__tests__/expose-cloudflare.test.ts

@@ -15,9 +15,12 @@ import {
   exposeCloudflareOff,
   exposeCloudflareUp,
 } from "../commands/expose-cloudflare.ts";
+import type { ExposeSupervisorOpts } from "../commands/expose-supervisor.ts";
 import { readEnvFileValues } from "../env-file.ts";
 import { readExposeState } from "../expose-state.ts";
 import { writeHubPort } from "../hub-control.ts";
+import type { EnsureHubUnitOpts } from "../hub-unit.ts";
+import { type ModuleOp, ModuleOpHttpError } from "../module-ops-client.ts";
 import type { CommandResult, Runner } from "../tailscale/run.ts";
 
 // Default seeded hub port used by tests with `skipHub: true`. The cloudflared
@@ -283,23 +286,22 @@ describe("exposeCloudflareUp", () => {
     }
   });
 
-  test("persists the public hub origin to vault/.env + restarts vault (Cloudflare 401 fix)", async () => {
+  test("persists the public hub origin to vault/.env + restarts vault via the supervisor (Cloudflare 401 fix)", async () => {
     // The Cloudflare 401 P0: the cloudflare path wrote expose-state.json but —
     // unlike the Tailscale path, which auto-restarts vault and so flows the
-    // public origin into vault/.env via lifecycle's persistVaultHubOrigin —
-    // never touched vault's .env or restarted it. The launchd/systemd daemon
-    // kept booting vault with NO PARACHUTE_HUB_ORIGIN → vault fell back to
-    // loopback as its expected issuer → every hub-minted token (iss=public)
-    // failed the iss check → 401. This asserts the durable .env write + the
-    // running-vault restart that mirrors the Tailscale path.
+    // public origin into vault/.env — never touched vault's .env or restarted
+    // it. The launchd/systemd daemon kept booting vault with NO
+    // PARACHUTE_HUB_ORIGIN → vault fell back to loopback as its expected issuer →
+    // every hub-minted token (iss=public) failed the iss check → 401.
+    //
+    // Phase 5b: the restart goes through the running Supervisor
+    // (`driveModuleOp("vault", "restart")`) — the helper also persists the
+    // durable .env. This asserts the durable .env write + the supervised restart
+    // (no longer a pidfile-gated detached restart; the supervisor decides
+    // liveness, and a not-supervised vault surfaces as a tolerated 404 — see the
+    // Phase 4 dual-dispatch suite).
     const env = makeEnv();
     try {
-      // Seed vault as "running" so the restart branch fires. PID lives at
-      // <configDir>/vault/run/vault.pid (see process-state.ts:pidPath).
-      const vaultRun = join(env.configDir, "vault", "run");
-      require("node:fs").mkdirSync(vaultRun, { recursive: true });
-      writeFileSync(join(vaultRun, "vault.pid"), "99001");
-
       const uuid = "ffffffff-0000-0000-0000-000000000006";
       const { runner } = queueRunner([
         { code: 0, stdout: "cloudflared 2024.1.0\n", stderr: "" },
@@ -312,14 +314,12 @@ describe("exposeCloudflareUp", () => {
         { code: 0, stdout: "", stderr: "" },
       ]);
       const { spawner } = fakeSpawner(42300);
-      const restarted: string[] = [];
+      const sup = makeCfSupervisorStub();
 
       const code = await exposeCloudflareUp("gitcoin-parachute.unforced.dev", {
         runner,
         spawner,
-        // `alive` reports the seeded vault pid as running so processState() ===
-        // "running" and the restart branch executes.
-        alive: (pid) => pid === 99001,
+        alive: () => false,
         kill: () => {},
         log: () => {},
         manifestPath: env.manifestPath,
@@ -330,10 +330,7 @@ describe("exposeCloudflareUp", () => {
         cloudflaredHome: env.cloudflaredHome,
         configDir: env.configDir,
         skipHub: true,
-        restartService: async (short) => {
-          restarted.push(short);
-          return 0;
-        },
+        supervisor: sup.opts,
       });
 
       expect(code).toBe(0);
@@ -342,57 +339,8 @@ describe("exposeCloudflareUp", () => {
       expect(readEnvFileValues(join(env.configDir, "vault", ".env")).PARACHUTE_HUB_ORIGIN).toBe(
         "https://gitcoin-parachute.unforced.dev",
       );
-      // Live half: the running vault is restarted to re-read the new origin.
-      expect(restarted).toEqual(["vault"]);
-    } finally {
-      env.cleanup();
-    }
-  });
-
-  test("persists vault/.env but does NOT restart when vault isn't running", async () => {
-    // No vault pidfile → processState() !== "running" → no restart, but the
-    // durable .env write still happens so the next daemon boot is correct.
-    const env = makeEnv();
-    try {
-      const uuid = "ffffffff-0000-0000-0000-000000000007";
-      const { runner } = queueRunner([
-        { code: 0, stdout: "cloudflared 2024.1.0\n", stderr: "" },
-        { code: 0, stdout: "[]", stderr: "" },
-        {
-          code: 0,
-          stdout: `Tunnel credentials written to ${env.cloudflaredHome}/${uuid}.json.\nCreated tunnel parachute with id ${uuid}\n`,
-          stderr: "",
-        },
-        { code: 0, stdout: "", stderr: "" },
-      ]);
-      const { spawner } = fakeSpawner(42301);
-      const restarted: string[] = [];
-
-      const code = await exposeCloudflareUp("gitcoin-parachute.unforced.dev", {
-        runner,
-        spawner,
-        alive: () => false,
-        kill: () => {},
-        log: () => {},
-        manifestPath: env.manifestPath,
-        statePath: env.statePath,
-        exposeStatePath: env.exposeStatePath,
-        configPath: env.configPath,
-        logPath: env.logPath,
-        cloudflaredHome: env.cloudflaredHome,
-        configDir: env.configDir,
-        skipHub: true,
-        restartService: async (short) => {
-          restarted.push(short);
-          return 0;
-        },
-      });
-
-      expect(code).toBe(0);
-      expect(readEnvFileValues(join(env.configDir, "vault", ".env")).PARACHUTE_HUB_ORIGIN).toBe(
-        "https://gitcoin-parachute.unforced.dev",
-      );
-      expect(restarted).toEqual([]);
+      // Live half: vault is restarted via the supervisor to re-read the new origin.
+      expect(sup.driveCalls).toEqual([{ short: "vault", op: "restart" }]);
     } finally {
       env.cleanup();
     }
@@ -2017,3 +1965,146 @@ describe("reboot-persistent connector service wiring", () => {
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// Phase 4 dual-dispatch (design §4.3): unit-managed → "ensure the hub" ensures
+// the UNIT (not a detached spawn) and the post-route vault restart drives the
+// running Supervisor over the loopback module-ops API (firing the operator-
+// token self-heal). The cloudflared CONNECTOR unit is unchanged. The no-unit
+// arm keeps today's `persistVaultHubOrigin` + `restartService` behavior.
+// ---------------------------------------------------------------------------
+
+interface CfExposeSupervisorStub {
+  opts: ExposeSupervisorOpts;
+  ensureCalls: number;
+  driveCalls: Array<{ short: string; op: ModuleOp }>;
+  selfHealCalls: Array<{ issuer: string }>;
+}
+
+function makeCfSupervisorStub(opts?: {
+  ensureOutcome?: "already-up" | "started" | "no-manager";
+  driveThrows?: () => unknown;
+}): CfExposeSupervisorStub {
+  const stub: CfExposeSupervisorStub = {
+    ensureCalls: 0,
+    driveCalls: [],
+    selfHealCalls: [],
+    opts: {
+      openDb: () => ({ close() {} }) as unknown as import("bun:sqlite").Database,
+      ensureHubUnit: async (o: EnsureHubUnitOpts) => {
+        stub.ensureCalls++;
+        return { outcome: opts?.ensureOutcome ?? "already-up", port: o.port ?? 1939, messages: [] };
+      },
+      driveModuleOp: async (short, op) => {
+        stub.driveCalls.push({ short, op });
+        if (opts?.driveThrows) throw opts.driveThrows();
+        return { status: 200, body: { short, state: { status: "running" } } };
+      },
+      selfHealOperatorTokenIssuer: async (_db, o) => {
+        stub.selfHealCalls.push({ issuer: o.issuer });
+        return { kind: "fresh" };
+      },
+    },
+  };
+  return stub;
+}
+
+describe("Phase 4 cloudflare expose dual-dispatch — unit-managed", () => {
+  test("unit-managed → ensureHubUnit (not detached) + supervised vault restart + operator-token self-heal", async () => {
+    const env = makeEnv();
+    try {
+      const uuid = "ffffffff-0000-0000-0000-0000000000a4";
+      const { runner } = queueRunner([
+        { code: 0, stdout: "cloudflared 2024.1.0\n", stderr: "" }, // --version
+        { code: 0, stdout: "[]", stderr: "" }, // tunnel list
+        {
+          code: 0,
+          stdout: `Tunnel credentials written to ${env.cloudflaredHome}/${uuid}.json.\nCreated tunnel parachute with id ${uuid}\n`,
+          stderr: "",
+        }, // tunnel create
+        { code: 0, stdout: "", stderr: "" }, // route dns
+      ]);
+      const { spawner } = fakeSpawner(42400);
+      const sup = makeCfSupervisorStub();
+      const logs: string[] = [];
+
+      const code = await exposeCloudflareUp("gitcoin-parachute.unforced.dev", {
+        runner,
+        spawner,
+        alive: () => false,
+        kill: () => {},
+        log: (l) => logs.push(l),
+        manifestPath: env.manifestPath,
+        statePath: env.statePath,
+        exposeStatePath: env.exposeStatePath,
+        configPath: env.configPath,
+        logPath: env.logPath,
+        cloudflaredHome: env.cloudflaredHome,
+        configDir: env.configDir,
+        // No skipHub → the hub-unit ensure runs (via the stub, no real hub).
+        // Inert connector install so the cloudflared connector path is unchanged.
+        installService: () => ({ outcome: "fallback", messages: [] }),
+        supervisor: sup.opts,
+      });
+
+      expect(code).toBe(0);
+      // Ensured the hub UNIT (the stub), never a detached spawn.
+      expect(sup.ensureCalls).toBe(1);
+      // Vault restart drove the running Supervisor.
+      expect(sup.driveCalls).toEqual([{ short: "vault", op: "restart" }]);
+      // Operator-token issuer self-heal fired toward the public origin.
+      expect(sup.selfHealCalls).toHaveLength(1);
+      expect(sup.selfHealCalls[0]?.issuer).toBe("https://gitcoin-parachute.unforced.dev");
+      // Durable .env still written (the helper persists it for vault).
+      expect(readEnvFileValues(join(env.configDir, "vault", ".env")).PARACHUTE_HUB_ORIGIN).toBe(
+        "https://gitcoin-parachute.unforced.dev",
+      );
+      expect(logs.join("\n")).toMatch(/hub unit up/);
+    } finally {
+      env.cleanup();
+    }
+  });
+
+  test("unit-managed: a not_supervised vault (404) is not a failure", async () => {
+    const env = makeEnv();
+    try {
+      const uuid = "ffffffff-0000-0000-0000-0000000000a5";
+      const { runner } = queueRunner([
+        { code: 0, stdout: "cloudflared 2024.1.0\n", stderr: "" },
+        { code: 0, stdout: "[]", stderr: "" },
+        {
+          code: 0,
+          stdout: `Tunnel credentials written to ${env.cloudflaredHome}/${uuid}.json.\nCreated tunnel parachute with id ${uuid}\n`,
+          stderr: "",
+        },
+        { code: 0, stdout: "", stderr: "" },
+      ]);
+      const { spawner } = fakeSpawner(42401);
+      const sup = makeCfSupervisorStub({
+        driveThrows: () => new ModuleOpHttpError(404, "not_supervised", "vault is not supervised"),
+      });
+
+      const code = await exposeCloudflareUp("gitcoin-parachute.unforced.dev", {
+        runner,
+        spawner,
+        alive: () => false,
+        kill: () => {},
+        log: () => {},
+        manifestPath: env.manifestPath,
+        statePath: env.statePath,
+        exposeStatePath: env.exposeStatePath,
+        configPath: env.configPath,
+        logPath: env.logPath,
+        cloudflaredHome: env.cloudflaredHome,
+        configDir: env.configDir,
+        installService: () => ({ outcome: "fallback", messages: [] }),
+        supervisor: sup.opts,
+      });
+
+      expect(code).toBe(0);
+      expect(sup.driveCalls).toEqual([{ short: "vault", op: "restart" }]);
+    } finally {
+      env.cleanup();
+    }
+  });
+});

package/src/__tests__/expose-off-auto.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import type { CloudflaredState } from "../cloudflare/state.ts";
+import type { ExposeCloudflareOpts } from "../commands/expose-cloudflare.ts";
 import {
   type ExposePublicOffAutoOpts,
   runExposePublicOffAutoDetect,
@@ -50,6 +51,7 @@ interface Harness {
   prompts: string[];
   tailscaleCalls: number;
   cloudflareCalls: number;
+  cloudflareOpts: ExposeCloudflareOpts[];
 }
 
 function makeHarness(
@@ -70,6 +72,7 @@ function makeHarness(
     prompts: [],
     tailscaleCalls: 0,
     cloudflareCalls: 0,
+    cloudflareOpts: [],
   };
   const answers = [...(input.promptAnswers ?? [])];
   let i = 0;
@@ -88,8 +91,9 @@ function makeHarness(
       harness.tailscaleCalls++;
       return input.tsExitCode ?? 0;
     },
-    exposeCloudflareOffImpl: async () => {
+    exposeCloudflareOffImpl: async (cfOpts) => {
       harness.cloudflareCalls++;
+      harness.cloudflareOpts.push(cfOpts);
       return input.cfExitCode ?? 0;
     },
   };
@@ -273,3 +277,24 @@ describe("runExposePublicOffAutoDetect — both live (non-TTY)", () => {
     expect(harness.logs).toContain("(non-TTY: tearing down both.)");
   });
 });
+
+describe("runExposePublicOffAutoDetect — supervisor threading (Phase 4 consistency)", () => {
+  test("cloudflareOffOpts.supervisor reaches the cloudflare teardown leg", async () => {
+    // cli.ts threads `cloudflareOffOpts: { supervisor: {} }` into the
+    // auto-detect off path so the Phase 4 supervisor resolution is consistent
+    // across both providers (matching the explicit `--cloudflare off` branch).
+    // Assert the supervisor block survives the spread-with-tunnelName wrapper
+    // and arrives at the leaf cloudflare-off impl.
+    const { harness, opts } = makeHarness({ cfState: cloudflaredState() });
+    const code = await runExposePublicOffAutoDetect({
+      ...opts,
+      cloudflareOffOpts: { supervisor: {} },
+    });
+    expect(code).toBe(0);
+    expect(harness.cloudflareCalls).toBe(1);
+    expect(harness.cloudflareOpts).toHaveLength(1);
+    expect(harness.cloudflareOpts[0]?.supervisor).toEqual({});
+    // The per-record wrapper still stamps the tunnelName onto the leaf opts.
+    expect(harness.cloudflareOpts[0]?.tunnelName).toBe("vault-tunnel");
+  });
+});