test(core-dsr): cover dsrRouter singleton guard proxy path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,18 +1,18 @@
 {
-  "generatedAt": "2026-05-19T20:12:30.651Z",
-  "commit": "6606b59",
+  "generatedAt": "2026-05-19T20:36:42.351Z",
+  "commit": "46e575a",
   "repo": {
-    "statements": 97.08,
-    "branches": 92.03,
-    "functions": 96.87,
-    "lines": 97.08,
+    "statements": 97.17,
+    "branches": 92.15,
+    "functions": 96.93,
+    "lines": 97.17,
     "counts": {
-      "lf": 5172,
-      "lh": 5021,
-      "brf": 1016,
-      "brh": 935,
-      "fnf": 319,
-      "fnh": 309
+      "lf": 5329,
+      "lh": 5178,
+      "brf": 1045,
+      "brh": 963,
+      "fnf": 326,
+      "fnh": 316
     }
   },
   "byPackage": {
@@ -74,16 +74,16 @@
     },
     "@repo/core-dsr": {
       "statements": 100,
-      "branches": 91.35,
-      "functions": 96.88,
+      "branches": 92.48,
+      "functions": 97.44,
       "lines": 100,
       "counts": {
-        "lf": 540,
-        "lh": 540,
-        "brf": 104,
-        "brh": 95,
-        "fnf": 32,
-        "fnh": 31
+        "lf": 697,
+        "lh": 697,
+        "brf": 133,
+        "brh": 123,
+        "fnf": 39,
+        "fnh": 38
       }
     },
     "@repo/core-shared": {

packages/core-dsr/src/__tests__/dsr.router.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi } from "vitest";
-import { createDsrRouter } from "@/dsr.router";
+import { createDsrRouter, dsrRouter } from "@/dsr.router";
 import type { DsrTrpcUser } from "@/dsr.router";
 import type { DsrBinding } from "@/di/bind-production";
 import {
@@ -207,3 +207,16 @@ describe("dsrRouter.restrict", () => {
     ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
   });
 });
+
+describe("dsrRouter singleton guard", () => {
+  it("throws when procedures are called without a real DsrBinding", async () => {
+    // The singleton uses a Proxy that throws on any binding property access.
+    // Procedures access binding lazily, so the Proxy error surfaces at call time.
+    const caller = dsrRouter.createCaller({
+      user: authenticatedUser,
+    } as Record<string, unknown>);
+    await expect(
+      caller.export({ subjectId: "alice", format: "json" }),
+    ).rejects.toThrow(/dsrRouter singleton/);
+  });
+});