graph_weaver 0.7.0 → 0.7.2

data/lib/graph_weaver/query_module.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 
+require_relative "internal"
 require_relative "internal/test_clients"
 
 module GraphWeaver
@@ -11,21 +12,21 @@ module GraphWeaver
   # Runtime for generated query modules: the client plumbing, which is the
   # one part of a generated module that carries no per-query type
   # information — every module's copy was identical. `extend
-  # GraphWeaver::QueryModule` supplies `client`/`client=`; execute and
-  # from_response stay generated, since their sigs are the query's types and
-  # those are the point.
+  # GraphWeaver::QueryModule` supplies `client`; execute and from_response
+  # stay generated, since their sigs are the query's types and those are the
+  # point.
   #
-  # Resolution order, per the docs: per call → per module (`MyQuery.client =`)
-  # → a test mode's stand-in (Internal::TestClients) → the module's baked
-  # DEFAULT_CLIENT → `GraphWeaver.client`.
+  # Resolution order, per the docs: per call → a test mode's stand-in
+  # (Internal::TestClients) → the client the module's graph names →
+  # `GraphWeaver.client`. A module has no fifth slot you can set: a parsed
+  # module runs against whatever parsed it (GraphWeaver.parse(client:)),
+  # which is a property of parsing rather than a per-module override.
   module QueryModule
     extend T::Sig
 
-    sig { params(client: T.untyped).void }
-    attr_writer :client
-
-    # the default client (a GraphWeaver::Client or any transport) for
-    # execute: per-module override, else the baked default, else the app one
+    # What this module would execute through, right now — the client a parse
+    # bound it to, else the order above. A diagnostic, and what `execute`
+    # reads when the call names none.
     sig { returns(T.untyped) }
     def client
       @client || default_client
@@ -33,6 +34,13 @@ module GraphWeaver
 
     private
 
+    # Bound by GraphWeaver.parse, which is the only caller: a parsed module
+    # generates no file, so it has no graph to read a client off. Private
+    # because a generated module's client comes from its graph — one way to
+    # say a thing.
+    sig { params(client: T.untyped).void }
+    attr_writer :client
+
     # The one call a generated `execute` makes: resolve the client, run this
     # module's own operation, hand the raw response back for from_response to
     # wrap. Here rather than emitted, so what has to BRACKET a request — the
@@ -44,12 +52,17 @@ module GraphWeaver
     # the whole of the call instead of three arguments' worth of it.
     sig { params(variables: T::Hash[String, T.untyped], client: T.untyped).returns(T.untyped) }
     def dispatch(variables, client:)
+      # A value with no JSON form is a bug in the call, not in the client that
+      # would have carried it — so it is refused here, where every mode passes,
+      # rather than in the transport, which :in_process and :fake never reach.
+      # (A transport asks the same question of a raw query string, which never
+      # comes through here.)
+      GraphWeaver::Internal::Wire.check_variables!(variables)
+
       mod = T.unsafe(self)
       # the graph codegen baked in, never one inferred from the client — a
       # wrong label on a request is worse than no label
-      graph = mod.const_defined?(:GRAPH, false) ? mod.const_get(:GRAPH) : nil
-
-      GraphWeaver::Internal::Log.with_graph(graph) do
+      GraphWeaver::Internal::Log.with_graph(graph_name) do
         client_for(client).execute(mod.const_get(:QUERY), variables:,
           operation_name: mod.const_get(:OPERATION_NAME))
       end
@@ -71,20 +84,28 @@ module GraphWeaver
         "#{self}: client must respond to #execute(query, variables:), got #{target.class}"
     end
 
-    # Codegen's `client:` constant, emitted as a DEFAULT_CLIENT lambda so the
-    # constant it names is resolved on first use rather than at load — a
-    # generated file may load before the initializer that builds the client.
+    # A module knows which graph it belongs to, and the graph knows how to
+    # reach it: the client that graph names, else the app default. Read at
+    # call time, so renaming the constant a graph names is an initializer
+    # edit rather than a regeneration of every module.
     #
-    # A test mode stands in for it: what codegen baked in is exactly what a
-    # `graphql:` tag means to replace, so a bound module is covered by the
-    # tag like every other one.
+    # A test mode stands in ahead of it: the graph's client is exactly what a
+    # `graphql:` tag means to replace, so a tagged example reaches a module
+    # whose graph names a client like every other one.
     sig { returns(T.untyped) }
     def default_client
-      mod = T.unsafe(self)
-      stand_in = GraphWeaver::Internal::TestClients.for(mod)
+      stand_in = GraphWeaver::Internal::TestClients.for(T.unsafe(self))
       return stand_in if stand_in
 
-      mod.const_defined?(:DEFAULT_CLIENT, false) ? mod.const_get(:DEFAULT_CLIENT).call : GraphWeaver.client!
+      GraphWeaver::Internal::Util.graph_named(graph_name)&.client || GraphWeaver.client!
+    end
+
+    # The graph codegen baked in, by name — nil for a module generated before
+    # graphs existed, or by a GraphWeaver.parse that named none.
+    sig { returns(T.untyped) }
+    def graph_name
+      mod = T.unsafe(self)
+      mod.const_defined?(:GRAPH, false) ? mod.const_get(:GRAPH) : nil
     end
   end
 end

data/lib/graph_weaver/retry.rb

@@ -38,7 +38,8 @@ require_relative "transport"
 #     default — pass the codes your API uses for transient failures)
 #
 # A server that answers with Retry-After sets the delay itself (clamped
-# to max_delay:); otherwise the configured backoff decides.
+# to max_delay:) — whether that answer raised or came back as a response
+# carrying GraphQL errors; otherwise the configured backoff decides.
 #
 # Exhausting the retries re-raises the last error (or returns the last
 # code-matched response).
@@ -105,10 +106,10 @@ class GraphWeaver::Retry
   def execute(query, variables: {}, operation_name: nil)
     attempts = mutation?(query) ? 1 : @retries + 1
     attempt = 0
-    failure = T.let(nil, T.nilable(Exception))
 
     loop do
       attempt += 1
+      failure = nil
       begin
         # each attempt is its own EXECUTE_EVENT; :retries says which one,
         # so "slow" and "slow after two 502s" don't read the same in an APM
@@ -116,6 +117,8 @@ class GraphWeaver::Retry
           @client.execute(query, variables:, operation_name:)
         end
         return response unless attempt < attempts && retryable_response?(response)
+
+        failure = response
       rescue *@retry_on => e
         if attempt >= attempts || !@retry_if.call(e)
           GraphWeaver::Internal::Log.log(:warn) { MUTATION_HINT } if attempts == 1 && @retries.positive?
@@ -132,7 +135,6 @@ class GraphWeaver::Retry
         "retrying #{operation_name || "query"} in #{seconds.round(2)}s (attempt #{attempt + 1} of #{attempts})"
       end
       @sleeper.call(seconds)
-      failure = nil
     end
   end
 
@@ -163,11 +165,13 @@ class GraphWeaver::Retry
   end
 
   def delay(attempt, failure)
-    # A Retry-After wins over our backoff: the server is the only party
-    # that knows when its window reopens, and it isn't guessing. Still
-    # clamped to max_delay:, so "come back in an hour" can't park a thread for
-    # an hour — and not jittered, since it's an instruction, not a guess.
-    after = failure.retry_after if failure.is_a?(GraphWeaver::ServerError)
+    # A Retry-After wins over our backoff, however the failure arrived — a
+    # raised ServerError, or the envelope a rate limit that came back with an
+    # errors body makes. The server is the only party that knows when its
+    # window reopens, and it isn't guessing. Still clamped to max_delay:, so
+    # "come back in an hour" can't park a thread for an hour — and not
+    # jittered, since it's an instruction, not a guess.
+    after = failure.retry_after if failure.respond_to?(:retry_after)
     return [after, @max_delay].min.to_f if after
 
     # floored at 0: a custom backoff: is the caller's arithmetic, and a

data/lib/graph_weaver/rspec.rb

@@ -255,13 +255,12 @@ module GraphWeaver
       def self.unserve!(stub) = WebMock::StubRegistry.instance.request_stubs.delete(stub)
 
       # Every endpoint an example's modules can post to, each with the graph
-      # whose resolvers belong behind it: the client each graph bakes into its
-      # modules, or GraphWeaver.client for a graph baking none. One graph per
-      # endpoint — an app whose graphs all bake clients needs no app default
-      # at all.
+      # whose resolvers belong behind it: the client each graph names, or
+      # GraphWeaver.client for a graph naming none. One graph per endpoint —
+      # an app whose graphs all name clients needs no app default at all.
       def self.wire_targets
         targets = GraphWeaver.graphs.filter_map do |graph|
-          client = baked_client(graph) || GraphWeaver.client
+          client = graph.client || GraphWeaver.client
           [endpoint!(client, graph), graph] if client
         end
         refuse_shared_endpoint!(targets)
@@ -283,24 +282,10 @@ module GraphWeaver
         raise GraphWeaver::Error, "#{TAG}: :wire serves one schema at each endpoint, and graphs " \
           "#{names} post to the same one (#{url}) — whichever were served there would answer the " \
           "others' queries, as fields its schema doesn't define. Give each graph a client of its " \
-          "own (client: in the graph block), or tag the example #{TAG}: :in_process or " \
+          "own (`client` in the graph block), or tag the example #{TAG}: :in_process or " \
           "#{TAG}: :router, which run above the wire."
       end
 
-      # The client a graph's generated modules call. `client:` holds a
-      # constant or its name — codegen writes it into source — so a name is
-      # resolved here the way the generated DEFAULT_CLIENT lambda resolves it.
-      def self.baked_client(graph)
-        named = graph.client
-        return named unless named.is_a?(String)
-
-        Object.const_get(named)
-      rescue NameError
-        raise GraphWeaver::Error, "#{TAG}: graph #{graph.name.inspect} bakes client: " \
-          "#{named.inspect} into its modules and nothing defines that constant, so :wire can't " \
-          "find the endpoint they post to."
-      end
-
       # The endpoint a client posts to: a transport, a Retry around one, or a
       # Client that built one. `graph` says whose client it is, when it isn't
       # the app's own.
@@ -316,12 +301,16 @@ module GraphWeaver
           "#{TAG}: :in_process or #{TAG}: :router — they run above the wire."
       end
 
-      # which client posts to nothing — the app's, or one graph's
+      # which client posts to nothing — the app's, or one graph's. A schema
+      # class in a client slot is named by ITS name: `client.class` is the
+      # word "Class", which names nothing anyone wrote.
       def self.whose_client(client, graph)
         return "GraphWeaver.client isn't set" unless client
-        return "GraphWeaver.client is #{client.class}, which posts to none" unless graph&.name
 
-        "graph #{graph.name.inspect} bakes client: #{client.class}, which posts to none"
+        named = client.is_a?(Module) ? client : client.class
+        return "GraphWeaver.client is #{named}, which posts to none" unless graph&.name
+
+        "graph #{graph.name.inspect} names client #{named}, which posts to none"
       end
 
       def self.webmock!
@@ -353,7 +342,7 @@ module GraphWeaver
         !WebMock::HttpLibAdapters::NetHttpAdapter::OriginalNetHTTP.equal?(Net::HTTP)
       end
 
-      private_class_method :wire_targets, :refuse_shared_endpoint!, :baked_client, :whose_client,
+      private_class_method :wire_targets, :refuse_shared_endpoint!, :whose_client,
         :webmock!, :webmock_enabled?, :disclose!, :served, :unnamed_schemas, :loaded_schemas
 
       # Included into every example group, so graphql_context is there

data/lib/graph_weaver/schema_loader.rb

@@ -1,6 +1,7 @@
 # typed: true
 # frozen_string_literal: true
 
+require "digest"
 require "fileutils"
 require "graphql"
 require "json"
@@ -682,7 +683,7 @@ module GraphWeaver::SchemaLoader
   #      end
   #      schema = GraphWeaver::SchemaLoader.load(json)
   def self.introspect(transport, cache: nil, ttl: nil, auth_env: nil)
-    cache = cache_path(cache)
+    cache = cache_path(cache, (transport.url if transport.respond_to?(:url)))
 
     if cache
       # reuse whatever fresh dump is present, regardless of format —
@@ -749,16 +750,20 @@ module GraphWeaver::SchemaLoader
     schema
   end
 
-  # The introspection result, asking for isOneOf and falling back without it.
+  # The introspection result, asking for the newer fields and falling back
+  # without them.
   #
   # isOneOf is the only thing that says an input object is @oneOf, and
-  # graphql-ruby leaves it out unless asked — but it is newer than plenty of
-  # servers, and one that doesn't define it REFUSES the query outright
-  # (Hasura: "field 'isOneOf' not found in type: '__Type'"). So ask, and ask
-  # the baseline query rather than give up. The second request costs one round
-  # trip on exactly the servers whose answer was going to be an error anyway.
+  # specifiedByURL the only thing that says what a scalar's format is;
+  # graphql-ruby leaves both out unless asked — but they are newer than
+  # plenty of servers, and one that doesn't define them REFUSES the query
+  # outright (Hasura: "field 'isOneOf' not found in type: '__Type'"). So ask,
+  # and ask the baseline query rather than give up. The second request costs
+  # one round trip on exactly the servers whose answer was going to be an
+  # error anyway.
   def self.ask(transport)
-    result = transport.execute(GraphQL::Introspection.query(include_is_one_of: true), variables: {}).to_h
+    query = GraphQL::Introspection.query(include_is_one_of: true, include_specified_by_url: true)
+    result = transport.execute(query, variables: {}).to_h
     return result if result["errors"].nil? && result.dig("data", "__schema")
 
     transport.execute(GraphQL::Introspection.query, variables: {}).to_h
@@ -948,23 +953,24 @@ module GraphWeaver::SchemaLoader
   private_constant :CACHE_EXTENSIONS
 
   # cache: true / :json / :graphql / :gql / a path => the file to write
-  # (nil for no caching). Symbols and true anchor at GraphWeaver.schema_path —
-  # the schema dump the generation workflow reads, so one file serves both
-  # (introspect caches it, rake generate loads it).
-  def self.cache_path(cache)
+  # (nil for no caching). A path is taken as given. Symbols and true anchor at
+  # GraphWeaver.schema_path — the schema dump the generation workflow reads,
+  # so one file serves both (introspect caches it, rake generate loads it) —
+  # unless that dump belongs to a different endpoint; see {conventional_dump}.
+  def self.cache_path(cache, url = nil)
     # Rails.root.join(...) hands you a Pathname, as schema: and query: already take
     cache = cache.to_path if cache.respond_to?(:to_path)
     path = case cache
     when nil, false
       nil
     when true
-      GraphWeaver.schema_path
+      conventional_dump(File.extname(GraphWeaver.schema_path), url)
     when Symbol
       unless CACHE_EXTENSIONS.include?(".#{cache}")
         raise ArgumentError, "cache: format must be :json, :graphql, or :gql, got #{cache.inspect}"
       end
 
-      "#{strip_extension(GraphWeaver.schema_path)}.#{cache}"
+      conventional_dump(".#{cache}", url)
     else
       unless cache.end_with?(*CACHE_EXTENSIONS)
         raise ArgumentError, "cache: must be a .json or .graphql/.gql path, got #{cache}"
@@ -976,6 +982,38 @@ module GraphWeaver::SchemaLoader
   end
   private_class_method :cache_path
 
+  # Where an unnamed `cache:` lands. One rule: **the conventional dump, unless
+  # the dump there came from a different endpoint** — then a file of this
+  # client's own, named by a digest of its url and sitting beside it. A dump
+  # records the url it was introspected from, so this is answerable; without
+  # it, two clients at two origins both saying `cache: true` read and
+  # overwrote one file, and each was silently served the other's schema.
+  #
+  # A dump that records no url is nobody's in particular — hand-written, or
+  # committed by an older version — so it stays a hit for whoever asks.
+  def self.conventional_dump(extension, url)
+    base = strip_extension(GraphWeaver.schema_path)
+    conventional = base + extension
+    url = url && GraphWeaver::Internal::Endpoint.bare(url) # what a dump records
+    return conventional if url.nil? || !someone_elses?(conventional, url)
+
+    "#{base}-#{Digest::SHA256.hexdigest(url)[0, 8]}#{extension}"
+  end
+  private_class_method :conventional_dump
+
+  # Whether a dump already at `path` (or a sibling format) says it came from
+  # somewhere other than `url`. Nothing there yet is nobody's, so a cold
+  # client still writes the conventional dump — which is what the documented
+  # bootstrap does, and what an app with one client wants.
+  def self.someone_elses?(path, url)
+    existing = cache_candidates(path).find { |candidate| File.exist?(candidate) }
+    return false unless existing
+
+    recorded = provenance(existing)&.dig("url")
+    !recorded.nil? && recorded != url
+  end
+  private_class_method :someone_elses?
+
   # the requested path first, then its siblings in the other formats
   def self.cache_candidates(path)
     path = GraphWeaver::Internal::Util.resolve(path)

data/lib/graph_weaver/tasks.rb

@@ -273,9 +273,17 @@ namespace :graph_weaver do
       puts "#{name}  #{Array(graph.queries).join(", ")} -> #{GraphWeaver::Internal::Util.relative(graph.output)}"
       puts "  namespace: #{graph.namespace}" if graph.namespace
       # which server a graph's modules call — the one thing this task couldn't
-      # say. A graph that bakes none falls back to GraphWeaver.client, which is
+      # say. A graph that names none falls back to GraphWeaver.client, which is
       # an app-wide setting and not this task's subject.
-      puts "  client: #{graph.client}" if graph.client
+      #
+      # Reported rather than raised: this is the task you run to find out why a
+      # graph is wrong, so a client whose constant is missing is the answer,
+      # not a reason to stop listing the others.
+      begin
+        puts "  client: #{graph.client_url || graph.client}" if graph.client
+      rescue GraphWeaver::Error => e
+        puts "  client: #{e.message}"
+      end
       # a registration is scoped to one graph, and nothing else says which
       GraphWeaver::Internal::Tasks.registrations(graph).each { |line| puts line }
     end

data/lib/graph_weaver/testing/cassette.rb

@@ -115,11 +115,8 @@ module GraphWeaver
 
       def initialize(path)
         @path = Testing.cassette_path(path)
-        @entries = File.exist?(@path) ? YAML.safe_load_file(@path, aliases: true) : []
+        @entries = read_entries
         @flagged = []
-        # record is read-modify-write; two threads recording through one
-        # cassette (a parallel spec run) would each save a snapshot missing
-        # the other's entry — atomic_write keeps the file whole, not complete
         @lock = Mutex.new
       end
 
@@ -147,7 +144,13 @@ module GraphWeaver
         entry["response"] = response
 
         wanted = Internal::RequestKey.for(query, variables, operation_name)
-        @lock.synchronize do
+        # Recording rewrites the whole file, and parallel_tests points several
+        # processes at one cassette — so the read-modify-write happens under a
+        # lock every recorder shares, re-reading inside it. The snapshot taken
+        # at construction is already missing whatever another process recorded
+        # since, and saving it would throw those entries away.
+        locked do
+          @entries = read_entries
           @entries.reject! { |existing| Internal::RequestKey.for_entry(existing) == wanted }
           @entries << entry
           save
@@ -198,6 +201,26 @@ module GraphWeaver
 
       private
 
+      def read_entries = File.exist?(@path) ? YAML.safe_load_file(@path, aliases: true) : []
+
+      # Serialize a read-modify-write against every other recorder, in this
+      # process and any other. The Mutex is the threads; the flock is the
+      # processes. Both, because flock is held per open file, so one process's
+      # two threads would each take their own.
+      def locked
+        @lock.synchronize do
+          FileUtils.mkdir_p(File.dirname(@path))
+          File.open(lock_path, File::RDWR | File::CREAT, 0o644) do |lock|
+            lock.flock(File::LOCK_EX)
+            yield
+          end
+        end
+      end
+
+      # A sidecar, not the cassette itself: save renames a fresh file into
+      # place, so a lock held on the replaced inode guards nothing.
+      def lock_path = "#{@path}.lock"
+
       def save
         yaml = YAML.dump(@entries)
         FileUtils.mkdir_p(File.dirname(@path))

data/lib/graph_weaver/testing/endpoint.rb

@@ -27,6 +27,12 @@ module GraphWeaver
     # one thing an in-process client can't test.
     #
     #      Router.new(supergraph:, context: ->(headers) { { current_user: User.find_by(token: headers["Authorization"]) } })
+    #
+    # Answering that proc means writing the client's context for the length
+    # of one dispatch, so the client is what resolves it: any client
+    # answering `with_request_context(headers) { }` gets the seam, which
+    # {InProcess} and {Router} take from {GraphWeaver::ContextSeam}. A client
+    # without it is served untouched, and concurrently.
     class Endpoint
       JSON_HEADERS = { "content-type" => "application/json" }.freeze
       TEXT_HEADERS = { "content-type" => "text/plain" }.freeze
@@ -67,20 +73,15 @@ module GraphWeaver
 
       private
 
-      # A `context:` proc is answered from the request in hand, so it is
-      # resolved here and put back after — one request's identity must not
-      # leak into the next. A client with no context, or a hash one, is
-      # served untouched.
-      def with_context(headers)
-        context = @client.context if @client.respond_to?(:context) && @client.respond_to?(:context=)
-        return yield unless context.respond_to?(:call)
+      # A `context:` proc is answered from the request in hand, and the
+      # client's context is what gets written to answer it — so the client
+      # does it, under its own lock. This endpoint is built per request by
+      # `graphql: :wire`; a lock held here would guard nothing the next
+      # request shares.
+      def with_context(headers, &block)
+        return yield unless @client.respond_to?(:with_request_context)
 
-        @client.context = context.call(headers)
-        begin
-          yield
-        ensure
-          @client.context = context
-        end
+        @client.with_request_context(headers, &block)
       end
 
       # Rack spells a header HTTP_X_CALLER; the proc reads "X-Caller".

data/lib/graph_weaver/testing/fake_client.rb

@@ -147,7 +147,11 @@ class GraphWeaver::Testing::FakeClient
   # `hash` or a `count`, and a Struct answers both with plausible nonsense
   # where fabricating is right.
   RUBY_OWN = [BasicObject, Kernel, Object, Comparable, Enumerable, Struct, Data].freeze
-  private_constant :OPTIONS, :WIRE, :RUBY_OWN
+
+  # The scalars the GraphQL spec serializes as JSON strings, whatever Ruby
+  # holds them.
+  STRING_SCALARS = %w[ID String].freeze
+  private_constant :OPTIONS, :WIRE, :RUBY_OWN, :STRING_SCALARS
 
   def initialize(pins = {}, **options)
     config = GraphWeaver::Testing.config
@@ -502,13 +506,31 @@ class GraphWeaver::Testing::FakeClient
     case type.kind.name
     when "NON_NULL" then wire_value(type.of_type, value, coordinate)
     when "LIST"
-      value.is_a?(Array) ? value.map { |element| wire_value(type.of_type, element, coordinate) } : value
-    when "SCALAR" then @values.wire(type.graphql_name, value, coordinate)
+      # whatever enumerates, not an Array alone: a has_many is an
+      # ActiveRecord CollectionProxy, and reading one straight onto the wire
+      # failed the cast as "the server sent a
+      # Order::ActiveRecord_Associations_CollectionProxy". A Hash is the one
+      # thing that enumerates and isn't a list.
+      return value if value.is_a?(Hash) || !value.is_a?(Enumerable)
+
+      value.map { |element| wire_value(type.of_type, element, coordinate) }
+    when "SCALAR" then scalar_wire(type.graphql_name, value, coordinate)
     when "ENUM" then value.is_a?(T::Enum) ? value.serialize : value
     else value # a composite: pinned_object reads it, one level down
     end
   end
 
+  # ID and String are JSON strings on every real wire, whatever Ruby type the
+  # object's column holds — an Integer primary key read straight through
+  # failed the cast with the advice for a server that sends ids unquoted,
+  # which is advice about a server that isn't there.
+  def scalar_wire(name, value, coordinate)
+    wired = @values.wire(name, value, coordinate)
+    return wired unless STRING_SCALARS.include?(name) && !wired.nil? && !wired.is_a?(String)
+
+    wired.to_s
+  end
+
   # The concrete type a pinned object is fabricated as. At a union or
   # interface the pin has to say: picking a member at random would fabricate
   # a shape the pinned keys don't fit, in whichever fraction of runs the
@@ -594,12 +616,20 @@ class GraphWeaver::Testing::FakeClient
     # Array.new(-1) is "negative array size" out of the fabricator's guts; a
     # cap below zero asks for nothing, which is what a page of none is
     return [capped, 0].max if capped.is_a?(Integer)
+    return 0 if errors_list?(node.name)
 
     size = list_size_for(coordinate, node.name)
     # an Integer list_size means exactly that many; a Range randomizes within it
     size.is_a?(Range) ? rng.rand(size) : size
   end
 
+  # A list field whose name ends in `errors` fabricates empty. The Relay and
+  # Shopify payload convention — `placeOrder { order userErrors }` — otherwise
+  # comes back with a fabricated order AND a fabricated failure, which is a
+  # response no server can send, so the natural happy-path assertion is flaky
+  # until it is pinned. Pin it to fabricate the failure path.
+  def errors_list?(name) = name.downcase.end_with?("errors")
+
   # How long an unbounded list is. A Hash says it per list, read most
   # specific first like a pin — which is what keeps nested lists from
   # multiplying: every list the walk reaches re-reads this, so one number

data/lib/graph_weaver/testing/router.rb

@@ -11,6 +11,7 @@ require_relative "../internal"
 require_relative "../transport"
 require_relative "../internal/planner"
 require_relative "../internal/subgraphs"
+require_relative "../context_seam"
 
 module GraphWeaver
   module Testing
@@ -203,6 +204,8 @@ module GraphWeaver
     # reset it yourself around the code path you're measuring.
     class Router
       include GraphWeaver::Parsing
+      # #context/#context= plus the lock over them — see the accessor below
+      include GraphWeaver::ContextSeam
 
       # the schema the router serves — the supergraph with its composition
       # machinery stripped, exactly what a real router exposes
@@ -232,8 +235,9 @@ module GraphWeaver
       # run as a different user without rebuilding the router. A proc is
       # answered from the request's headers, which only a wire supplies:
       # `context: ->(headers) { { current_user: User.find_by(token:
-      # headers["Authorization"]) } }` served through {Endpoint}.
-      attr_accessor :context
+      # headers["Authorization"]) } }` served through {Endpoint}. The
+      # accessors, and the lock guarding them, come from
+      # {GraphWeaver::ContextSeam}.
 
       # The planner injects key fields under this prefix, and the concrete
       # __typename under that key; reading an answer back means stripping
@@ -252,7 +256,7 @@ module GraphWeaver
         source = supergraph.to_s # a path, or the SDL itself — Pathname included
         @schema = GraphWeaver::SchemaLoader.load(source)
         @table = GraphWeaver::SchemaLoader.routing_table(source)
-        @context = context
+        init_context_seam(context)
         @trace = []
 
         Unplannable.unsupported!(@table)

data/lib/graph_weaver/testing.rb

@@ -221,9 +221,10 @@ module GraphWeaver
       # warn line as it is constructed, and a predicate that raised to say
       # "no" put a refusal that never happened in the log of every :wire
       # example. The one that graph names, else config.router[:supergraph],
-      # else the conventional dump when that's what it is. A client can't
-      # supply one — its schema is the API schema a router serves, with the
-      # @join__* routing table stripped out.
+      # else the conventional dump when that's what it is, else the dump the
+      # app's own client was built from. A client's *schema* can't supply one
+      # — it is the API schema a router serves, with the @join__* routing
+      # table stripped out — but the file behind it carries the table.
       private def supergraph_for(graph)
         # named_schema?, so a graph that declared no schema of its own falls
         # through to config.router rather than past it to the conventional dump
@@ -232,7 +233,14 @@ module GraphWeaver
         return @router[:supergraph] if @router&.key?(:supergraph)
 
         path = GraphWeaver::SchemaLoader.locate_path
-        path if path && GraphWeaver::Internal::Util.composed?(path)
+        return path if path && GraphWeaver::Internal::Util.composed?(path)
+
+        # Last, because codegen for the default graph reads the conventional
+        # dump, and the router must plan against what the modules were typed
+        # against.
+        client = GraphWeaver.client
+        source = client.schema_source if client.respond_to?(:schema_source)
+        source if source && GraphWeaver::Internal::Util.composed?(source)
       end
 
       # what to do about it, which differs by who asked: a graph in no

data/lib/graph_weaver/transport/http.rb

@@ -55,7 +55,7 @@ module GraphWeaver
           nil
         end
         unless uri && %w[http https].include?(uri.scheme)
-          raise ArgumentError, "expected an http(s) url, got #{url.inspect}"
+          raise ArgumentError, "expected an http(s) url, got #{GraphWeaver::Internal::Endpoint.safe(url).inspect}"
         end
 
         @uri = uri
@@ -69,7 +69,7 @@ module GraphWeaver
         # verify_mode: — so mTLS doesn't mean reaching for Faraday
         @ssl = { ca_file:, ca_path:, cert:, key:, verify_mode: }.compact
         if @ssl.any? && @uri.scheme != "https"
-          raise ArgumentError, "TLS options need an https url — got #{url}"
+          raise ArgumentError, "TLS options need an https url — got #{GraphWeaver::Internal::Endpoint.safe(url)}"
         end
 
         # One permit per allowed socket: holding a permit is the right to