@bajustone/fortress 1.0.0-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (465) hide show
  1. package/CHANGELOG.md +1011 -0
  2. package/LICENSE +21 -0
  3. package/README.md +760 -0
  4. package/SECURITY.md +197 -0
  5. package/bin/fortress.ts +667 -0
  6. package/dist/auth-service-BcyQ2PuZ.d.cts +307 -0
  7. package/dist/auth-service-BkzZkWfH.d.ts +307 -0
  8. package/dist/config-B2366s_G.d.ts +665 -0
  9. package/dist/config-GtlVt6ZD.d.cts +665 -0
  10. package/dist/convert-routes-BLCQT57f.d.ts +72 -0
  11. package/dist/convert-routes-BdMvP2_X.d.cts +72 -0
  12. package/dist/crypto.cjs +61 -0
  13. package/dist/crypto.d.cts +36 -0
  14. package/dist/crypto.d.ts +36 -0
  15. package/dist/crypto.js +35 -0
  16. package/dist/drift-BT1wtMDJ.d.cts +22 -0
  17. package/dist/drift-k9LiYpRP.d.ts +22 -0
  18. package/dist/drizzle/pg.cjs +481 -0
  19. package/dist/drizzle/pg.d.cts +15 -0
  20. package/dist/drizzle/pg.d.ts +15 -0
  21. package/dist/drizzle/pg.js +454 -0
  22. package/dist/drizzle.cjs +1442 -0
  23. package/dist/drizzle.d.cts +85 -0
  24. package/dist/drizzle.d.ts +85 -0
  25. package/dist/drizzle.js +1411 -0
  26. package/dist/express.cjs +1357 -0
  27. package/dist/express.d.cts +333 -0
  28. package/dist/express.d.ts +333 -0
  29. package/dist/express.js +1314 -0
  30. package/dist/fetcher.cjs +77 -0
  31. package/dist/fetcher.d.cts +7 -0
  32. package/dist/fetcher.d.ts +7 -0
  33. package/dist/fetcher.js +41 -0
  34. package/dist/fortress-BmSvFfqK.d.cts +1089 -0
  35. package/dist/fortress-uA-_cheR.d.ts +1089 -0
  36. package/dist/hono.cjs +1530 -0
  37. package/dist/hono.d.cts +514 -0
  38. package/dist/hono.d.ts +514 -0
  39. package/dist/hono.js +1483 -0
  40. package/dist/index-CxEkfCA0.d.cts +77 -0
  41. package/dist/index-CxEkfCA0.d.ts +77 -0
  42. package/dist/index-D054pcb-.d.cts +146 -0
  43. package/dist/index-jAMbbUAY.d.ts +146 -0
  44. package/dist/index.cjs +9046 -0
  45. package/dist/index.d.cts +717 -0
  46. package/dist/index.d.ts +717 -0
  47. package/dist/index.js +8935 -0
  48. package/dist/jwt.cjs +255 -0
  49. package/dist/jwt.d.cts +90 -0
  50. package/dist/jwt.d.ts +90 -0
  51. package/dist/jwt.js +227 -0
  52. package/dist/otel.cjs +108 -0
  53. package/dist/otel.d.cts +62 -0
  54. package/dist/otel.d.ts +62 -0
  55. package/dist/otel.js +73 -0
  56. package/dist/plugins/account-lockout.cjs +322 -0
  57. package/dist/plugins/account-lockout.d.cts +42 -0
  58. package/dist/plugins/account-lockout.d.ts +42 -0
  59. package/dist/plugins/account-lockout.js +295 -0
  60. package/dist/plugins/admin.cjs +2378 -0
  61. package/dist/plugins/admin.d.cts +72 -0
  62. package/dist/plugins/admin.d.ts +72 -0
  63. package/dist/plugins/admin.js +2351 -0
  64. package/dist/plugins/api-key.cjs +792 -0
  65. package/dist/plugins/api-key.d.cts +121 -0
  66. package/dist/plugins/api-key.d.ts +121 -0
  67. package/dist/plugins/api-key.js +765 -0
  68. package/dist/plugins/audit-log.cjs +493 -0
  69. package/dist/plugins/audit-log.d.cts +86 -0
  70. package/dist/plugins/audit-log.d.ts +86 -0
  71. package/dist/plugins/audit-log.js +468 -0
  72. package/dist/plugins/data-isolation.cjs +211 -0
  73. package/dist/plugins/data-isolation.d.cts +49 -0
  74. package/dist/plugins/data-isolation.d.ts +49 -0
  75. package/dist/plugins/data-isolation.js +186 -0
  76. package/dist/plugins/email-verification.cjs +273 -0
  77. package/dist/plugins/email-verification.d.cts +44 -0
  78. package/dist/plugins/email-verification.d.ts +44 -0
  79. package/dist/plugins/email-verification.js +246 -0
  80. package/dist/plugins/magic-link.cjs +231 -0
  81. package/dist/plugins/magic-link.d.cts +39 -0
  82. package/dist/plugins/magic-link.d.ts +39 -0
  83. package/dist/plugins/magic-link.js +204 -0
  84. package/dist/plugins/oauth.cjs +1696 -0
  85. package/dist/plugins/oauth.d.cts +406 -0
  86. package/dist/plugins/oauth.d.ts +406 -0
  87. package/dist/plugins/oauth.js +1669 -0
  88. package/dist/plugins/openapi.cjs +1185 -0
  89. package/dist/plugins/openapi.d.cts +6 -0
  90. package/dist/plugins/openapi.d.ts +6 -0
  91. package/dist/plugins/openapi.js +1158 -0
  92. package/dist/plugins/rate-limit/express.cjs +55 -0
  93. package/dist/plugins/rate-limit/express.d.cts +64 -0
  94. package/dist/plugins/rate-limit/express.d.ts +64 -0
  95. package/dist/plugins/rate-limit/express.js +30 -0
  96. package/dist/plugins/rate-limit/hono.cjs +51 -0
  97. package/dist/plugins/rate-limit/hono.d.cts +59 -0
  98. package/dist/plugins/rate-limit/hono.d.ts +59 -0
  99. package/dist/plugins/rate-limit/hono.js +26 -0
  100. package/dist/plugins/rate-limit/sveltekit.cjs +49 -0
  101. package/dist/plugins/rate-limit/sveltekit.d.cts +59 -0
  102. package/dist/plugins/rate-limit/sveltekit.d.ts +59 -0
  103. package/dist/plugins/rate-limit/sveltekit.js +24 -0
  104. package/dist/plugins/rate-limit.cjs +354 -0
  105. package/dist/plugins/rate-limit.d.cts +140 -0
  106. package/dist/plugins/rate-limit.d.ts +140 -0
  107. package/dist/plugins/rate-limit.js +325 -0
  108. package/dist/plugins/social-login.cjs +905 -0
  109. package/dist/plugins/social-login.d.cts +114 -0
  110. package/dist/plugins/social-login.d.ts +114 -0
  111. package/dist/plugins/social-login.js +880 -0
  112. package/dist/plugins/tenancy.cjs +780 -0
  113. package/dist/plugins/tenancy.d.cts +108 -0
  114. package/dist/plugins/tenancy.d.ts +108 -0
  115. package/dist/plugins/tenancy.js +753 -0
  116. package/dist/plugins/two-factor.cjs +555 -0
  117. package/dist/plugins/two-factor.d.cts +67 -0
  118. package/dist/plugins/two-factor.d.ts +67 -0
  119. package/dist/plugins/two-factor.js +526 -0
  120. package/dist/plugins/webauthn.cjs +786 -0
  121. package/dist/plugins/webauthn.d.cts +72 -0
  122. package/dist/plugins/webauthn.d.ts +72 -0
  123. package/dist/plugins/webauthn.js +766 -0
  124. package/dist/plugins/webhook.cjs +819 -0
  125. package/dist/plugins/webhook.d.cts +254 -0
  126. package/dist/plugins/webhook.d.ts +254 -0
  127. package/dist/plugins/webhook.js +789 -0
  128. package/dist/protect-D1v_0upK.d.cts +123 -0
  129. package/dist/protect-DsxV_-dJ.d.ts +123 -0
  130. package/dist/sveltekit.cjs +1258 -0
  131. package/dist/sveltekit.d.cts +420 -0
  132. package/dist/sveltekit.d.ts +420 -0
  133. package/dist/sveltekit.js +1207 -0
  134. package/dist/testing.cjs +4294 -0
  135. package/dist/testing.d.cts +197 -0
  136. package/dist/testing.d.ts +197 -0
  137. package/dist/testing.js +4264 -0
  138. package/dist/types-et0R8tsC.d.cts +217 -0
  139. package/dist/types-et0R8tsC.d.ts +217 -0
  140. package/docs/adapter-typed-helpers.md +192 -0
  141. package/docs/admin-recipes.md +227 -0
  142. package/docs/architecture.md +434 -0
  143. package/docs/ci/github-actions.yml +59 -0
  144. package/docs/ci.md +109 -0
  145. package/docs/compatibility.md +115 -0
  146. package/docs/deployment.md +305 -0
  147. package/docs/hardening.md +118 -0
  148. package/docs/host-owned-routes.md +154 -0
  149. package/docs/migrations/0001-schema-version.md +54 -0
  150. package/docs/migrations/0002-initial-schema.md +84 -0
  151. package/docs/migrations/upgrade-guide.md +160 -0
  152. package/docs/observability.md +394 -0
  153. package/docs/plugins/account-lockout.md +131 -0
  154. package/docs/plugins/admin.md +402 -0
  155. package/docs/plugins/api-key.md +327 -0
  156. package/docs/plugins/audit-log.md +261 -0
  157. package/docs/plugins/data-isolation.md +186 -0
  158. package/docs/plugins/email-verification.md +121 -0
  159. package/docs/plugins/magic-link.md +123 -0
  160. package/docs/plugins/oauth.md +544 -0
  161. package/docs/plugins/openapi.md +250 -0
  162. package/docs/plugins/rate-limit.md +223 -0
  163. package/docs/plugins/social-login.md +337 -0
  164. package/docs/plugins/tenancy.md +122 -0
  165. package/docs/plugins/two-factor.md +191 -0
  166. package/docs/plugins/webauthn.md +188 -0
  167. package/docs/plugins/webhook.md +242 -0
  168. package/docs/policy-as-code.md +156 -0
  169. package/docs/route-manifest.md +46 -0
  170. package/docs/security.md +261 -0
  171. package/docs/threat-model.md +161 -0
  172. package/examples/README.md +119 -0
  173. package/examples/express-app/index.ts +747 -0
  174. package/examples/hono-app/docker-compose.yml +14 -0
  175. package/examples/hono-app/index.ts +1009 -0
  176. package/examples/policy/fortress.policy.json +47 -0
  177. package/examples/sveltekit-app/README.md +125 -0
  178. package/examples/sveltekit-app/src/app.d.ts +16 -0
  179. package/examples/sveltekit-app/src/hooks.server.ts +23 -0
  180. package/examples/sveltekit-app/src/lib/server/fortress.ts +81 -0
  181. package/examples/sveltekit-app/src/routes/api/echo/[id]/+server.ts +32 -0
  182. package/examples/sveltekit-app/src/routes/api/fortress/[...path]/+server.ts +15 -0
  183. package/examples/sveltekit-app/src/routes/dashboard/+page.server.ts +20 -0
  184. package/examples/sveltekit-app/src/routes/login/+page.server.ts +48 -0
  185. package/examples/sveltekit-app/src/routes/oauth/consent/+page.server.ts +69 -0
  186. package/examples/sveltekit-app/src/routes/oauth/consent/+page.svelte +83 -0
  187. package/migrations/pg/0001_schema_version.down.sql +2 -0
  188. package/migrations/pg/0001_schema_version.sql +8 -0
  189. package/migrations/pg/0002_initial_schema.down.sql +36 -0
  190. package/migrations/pg/0002_initial_schema.sql +376 -0
  191. package/migrations/pg/0003_auth_continuation.down.sql +6 -0
  192. package/migrations/pg/0003_auth_continuation.sql +30 -0
  193. package/migrations/pg/0004_tenant_default_unique.down.sql +1 -0
  194. package/migrations/pg/0004_tenant_default_unique.sql +14 -0
  195. package/migrations/pg/0005_hot_indexes_timestamptz.down.sql +71 -0
  196. package/migrations/pg/0005_hot_indexes_timestamptz.sql +71 -0
  197. package/migrations/pg/0006_canonical_email.down.sql +3 -0
  198. package/migrations/pg/0006_canonical_email.sql +8 -0
  199. package/migrations/pg/0007_audit_chain_anchor.down.sql +1 -0
  200. package/migrations/pg/0007_audit_chain_anchor.sql +8 -0
  201. package/migrations/pg/0008_two_factor_hardening.down.sql +8 -0
  202. package/migrations/pg/0008_two_factor_hardening.sql +8 -0
  203. package/migrations/pg/0009_encrypt_totp_secrets.down.sql +2 -0
  204. package/migrations/pg/0009_encrypt_totp_secrets.sql +5 -0
  205. package/migrations/pg/0010_bigint_append_only_ids.down.sql +2 -0
  206. package/migrations/pg/0010_bigint_append_only_ids.sql +23 -0
  207. package/migrations/sqlite/0001_schema_version.down.sql +2 -0
  208. package/migrations/sqlite/0001_schema_version.sql +8 -0
  209. package/migrations/sqlite/0002_initial_schema.down.sql +36 -0
  210. package/migrations/sqlite/0002_initial_schema.sql +376 -0
  211. package/migrations/sqlite/0003_auth_continuation.down.sql +27 -0
  212. package/migrations/sqlite/0003_auth_continuation.sql +45 -0
  213. package/migrations/sqlite/0004_tenant_default_unique.down.sql +1 -0
  214. package/migrations/sqlite/0004_tenant_default_unique.sql +13 -0
  215. package/migrations/sqlite/0005_hot_indexes_timestamptz.down.sql +10 -0
  216. package/migrations/sqlite/0005_hot_indexes_timestamptz.sql +10 -0
  217. package/migrations/sqlite/0006_canonical_email.down.sql +3 -0
  218. package/migrations/sqlite/0006_canonical_email.sql +8 -0
  219. package/migrations/sqlite/0007_audit_chain_anchor.down.sql +1 -0
  220. package/migrations/sqlite/0007_audit_chain_anchor.sql +8 -0
  221. package/migrations/sqlite/0008_two_factor_hardening.down.sql +14 -0
  222. package/migrations/sqlite/0008_two_factor_hardening.sql +7 -0
  223. package/migrations/sqlite/0009_encrypt_totp_secrets.down.sql +2 -0
  224. package/migrations/sqlite/0009_encrypt_totp_secrets.sql +5 -0
  225. package/migrations/sqlite/0010_bigint_append_only_ids.down.sql +1 -0
  226. package/migrations/sqlite/0010_bigint_append_only_ids.sql +2 -0
  227. package/package.json +398 -0
  228. package/src/adapters/database/index.ts +63 -0
  229. package/src/adapters/database/types.ts +22 -0
  230. package/src/changelog-script.test.ts +21 -0
  231. package/src/cli.test.ts +79 -0
  232. package/src/core/auth/auth-admin.test.ts +247 -0
  233. package/src/core/auth/auth-endpoints.ts +558 -0
  234. package/src/core/auth/auth-observer.test.ts +191 -0
  235. package/src/core/auth/auth-service.ts +1464 -0
  236. package/src/core/auth/email.test.ts +17 -0
  237. package/src/core/auth/email.ts +11 -0
  238. package/src/core/auth/hooks.test.ts +251 -0
  239. package/src/core/auth/impersonation.test.ts +179 -0
  240. package/src/core/auth/jwt.test.ts +184 -0
  241. package/src/core/auth/jwt.ts +239 -0
  242. package/src/core/auth/login-timing.test.ts +77 -0
  243. package/src/core/auth/password-policy.test.ts +253 -0
  244. package/src/core/auth/password-policy.ts +220 -0
  245. package/src/core/auth/password.test.ts +42 -0
  246. package/src/core/auth/password.ts +62 -0
  247. package/src/core/auth/post-auth-gate.test.ts +258 -0
  248. package/src/core/auth/post-auth-gate.ts +228 -0
  249. package/src/core/auth/refresh-token.test.ts +86 -0
  250. package/src/core/auth/refresh-token.ts +105 -0
  251. package/src/core/auth/timing-safe.ts +23 -0
  252. package/src/core/config.ts +212 -0
  253. package/src/core/endpoint.ts +149 -0
  254. package/src/core/errors.ts +199 -0
  255. package/src/core/fetcher-interop.test.ts +106 -0
  256. package/src/core/fortress.test.ts +354 -0
  257. package/src/core/fortress.ts +550 -0
  258. package/src/core/http/call.test.ts +148 -0
  259. package/src/core/http/call.ts +149 -0
  260. package/src/core/http/cookie-serialize.test.ts +198 -0
  261. package/src/core/http/cookie-serialize.ts +107 -0
  262. package/src/core/http/csrf.test.ts +140 -0
  263. package/src/core/http/csrf.ts +173 -0
  264. package/src/core/http/dispatch.ts +652 -0
  265. package/src/core/http/error-response.test.ts +69 -0
  266. package/src/core/http/error-response.ts +93 -0
  267. package/src/core/http/fortress-rbac.test.ts +43 -0
  268. package/src/core/http/fortress-rbac.ts +127 -0
  269. package/src/core/http/handle-request.test.ts +441 -0
  270. package/src/core/http/handle-request.ts +354 -0
  271. package/src/core/http/match.test.ts +122 -0
  272. package/src/core/http/match.ts +126 -0
  273. package/src/core/http/outbound.test.ts +34 -0
  274. package/src/core/http/outbound.ts +105 -0
  275. package/src/core/http/plugin-middleware.ts +67 -0
  276. package/src/core/http/principal.test.ts +345 -0
  277. package/src/core/http/principal.ts +86 -0
  278. package/src/core/http/protect.test.ts +220 -0
  279. package/src/core/http/protect.ts +394 -0
  280. package/src/core/http/token-extraction.test.ts +59 -0
  281. package/src/core/http/token-extraction.ts +53 -0
  282. package/src/core/iam/explain.test.ts +177 -0
  283. package/src/core/iam/explain.ts +302 -0
  284. package/src/core/iam/iam-endpoints.ts +779 -0
  285. package/src/core/iam/iam-service.test.ts +829 -0
  286. package/src/core/iam/iam-service.ts +1137 -0
  287. package/src/core/iam/permission-cache.test.ts +115 -0
  288. package/src/core/iam/permission-cache.ts +71 -0
  289. package/src/core/iam/permission-check-observer.test.ts +90 -0
  290. package/src/core/iam/permission-evaluator.test.ts +291 -0
  291. package/src/core/iam/permission-evaluator.ts +198 -0
  292. package/src/core/iam/permission-sync.test.ts +166 -0
  293. package/src/core/iam/permission-sync.ts +192 -0
  294. package/src/core/iam/resource-sync.test.ts +70 -0
  295. package/src/core/iam/resource-sync.ts +182 -0
  296. package/src/core/iam/service-account-http.test.ts +529 -0
  297. package/src/core/iam/service-account.test.ts +282 -0
  298. package/src/core/internal-adapter.test.ts +389 -0
  299. package/src/core/internal-adapter.ts +435 -0
  300. package/src/core/json-schema.ts +50 -0
  301. package/src/core/manifest/__snapshots__/route-manifest.test.ts.snap +192 -0
  302. package/src/core/manifest/drift.ts +103 -0
  303. package/src/core/manifest/route-manifest.test.ts +142 -0
  304. package/src/core/manifest/route-manifest.ts +154 -0
  305. package/src/core/migrate.test.ts +72 -0
  306. package/src/core/migrations/engine.test.ts +308 -0
  307. package/src/core/migrations/engine.ts +548 -0
  308. package/src/core/migrations/migrations.ts +1771 -0
  309. package/src/core/migrations/pg-migration.integration-test.ts +353 -0
  310. package/src/core/migrations/upgrade-fixture.test.ts +378 -0
  311. package/src/core/observability/db-instrumentation.ts +205 -0
  312. package/src/core/observability/listener-list.test.ts +124 -0
  313. package/src/core/observability/listener-list.ts +73 -0
  314. package/src/core/observability/logger.test.ts +43 -0
  315. package/src/core/observability/logger.ts +49 -0
  316. package/src/core/observability/spans.test.ts +193 -0
  317. package/src/core/observability/types.ts +80 -0
  318. package/src/core/openapi-drift.test.ts +41 -0
  319. package/src/core/openapi.ts +47 -0
  320. package/src/core/plugin-methods-map.ts +75 -0
  321. package/src/core/plugin-runner.test.ts +233 -0
  322. package/src/core/plugin-runner.ts +276 -0
  323. package/src/core/plugin.ts +210 -0
  324. package/src/core/policy/apply.ts +272 -0
  325. package/src/core/policy/diff.ts +288 -0
  326. package/src/core/policy/loader.test.ts +63 -0
  327. package/src/core/policy/loader.ts +214 -0
  328. package/src/core/policy/policy.test.ts +232 -0
  329. package/src/core/policy/types.ts +105 -0
  330. package/src/core/schema-builder.test.ts +660 -0
  331. package/src/core/schema-builder.ts +881 -0
  332. package/src/core/standard-schema.ts +56 -0
  333. package/src/core/types.ts +258 -0
  334. package/src/core/validation.test.ts +195 -0
  335. package/src/core/validation.ts +192 -0
  336. package/src/drizzle/adapter.test.ts +425 -0
  337. package/src/drizzle/adapter.ts +474 -0
  338. package/src/drizzle/index.ts +31 -0
  339. package/src/drizzle/pg/adapter.integration-test.ts +456 -0
  340. package/src/drizzle/pg/index.ts +13 -0
  341. package/src/drizzle/pg/pg.integration-test.ts +1539 -0
  342. package/src/drizzle/pg/schema.ts +539 -0
  343. package/src/drizzle/pg-error-map.test.ts +218 -0
  344. package/src/drizzle/pg-error-map.ts +151 -0
  345. package/src/drizzle/schema.ts +544 -0
  346. package/src/drizzle/sqlite-serialization.test.ts +106 -0
  347. package/src/express/express-api-key-user-routes.test.ts +241 -0
  348. package/src/express/express.test.ts +442 -0
  349. package/src/express/handle.ts +191 -0
  350. package/src/express/index.ts +62 -0
  351. package/src/express/middleware.ts +551 -0
  352. package/src/express/protect.ts +154 -0
  353. package/src/express/validated.test.ts +86 -0
  354. package/src/express/validated.ts +99 -0
  355. package/src/fetcher/index.ts +81 -0
  356. package/src/hono/convert-routes.test.ts +220 -0
  357. package/src/hono/convert-routes.ts +196 -0
  358. package/src/hono/converters.test.ts +50 -0
  359. package/src/hono/converters.ts +43 -0
  360. package/src/hono/handle.ts +79 -0
  361. package/src/hono/helpers.ts +2 -0
  362. package/src/hono/hono-api-key-user-routes.test.ts +225 -0
  363. package/src/hono/hono-handlers.test.ts +861 -0
  364. package/src/hono/hono.test.ts +454 -0
  365. package/src/hono/index.ts +101 -0
  366. package/src/hono/middleware/auth.ts +236 -0
  367. package/src/hono/middleware/auth.types.test.ts +94 -0
  368. package/src/hono/middleware/csrf.test.ts +127 -0
  369. package/src/hono/middleware/csrf.ts +68 -0
  370. package/src/hono/middleware/error-handler.ts +12 -0
  371. package/src/hono/middleware/plugin-middleware.ts +35 -0
  372. package/src/hono/middleware/rbac.ts +131 -0
  373. package/src/hono/middleware/security-headers.test.ts +88 -0
  374. package/src/hono/middleware/security-headers.ts +68 -0
  375. package/src/hono/openapi.ts +237 -0
  376. package/src/hono/protect.ts +87 -0
  377. package/src/hono/validated.test.ts +123 -0
  378. package/src/hono/validated.ts +62 -0
  379. package/src/index.ts +309 -0
  380. package/src/integration.test.ts +718 -0
  381. package/src/internal/changelog.ts +56 -0
  382. package/src/otel/index.ts +158 -0
  383. package/src/otel/otel-types.test.ts +35 -0
  384. package/src/otel/otel.test.ts +235 -0
  385. package/src/plugins/account-lockout/account-lockout.test.ts +367 -0
  386. package/src/plugins/account-lockout/index.ts +267 -0
  387. package/src/plugins/admin/admin-api-key.test.ts +438 -0
  388. package/src/plugins/admin/index.ts +1612 -0
  389. package/src/plugins/api-key/api-key.test.ts +684 -0
  390. package/src/plugins/api-key/core.ts +336 -0
  391. package/src/plugins/api-key/index.ts +315 -0
  392. package/src/plugins/audit-log/audit-log.test.ts +749 -0
  393. package/src/plugins/audit-log/index.ts +680 -0
  394. package/src/plugins/data-isolation/data-isolation.test.ts +197 -0
  395. package/src/plugins/data-isolation/index.ts +157 -0
  396. package/src/plugins/email-verification/email-verification.test.ts +199 -0
  397. package/src/plugins/email-verification/index.ts +190 -0
  398. package/src/plugins/magic-link/index.ts +129 -0
  399. package/src/plugins/magic-link/magic-link.test.ts +156 -0
  400. package/src/plugins/oauth/id-token.ts +86 -0
  401. package/src/plugins/oauth/index.ts +2145 -0
  402. package/src/plugins/oauth/jwks.test.ts +32 -0
  403. package/src/plugins/oauth/jwks.ts +182 -0
  404. package/src/plugins/oauth/oauth.test.ts +2220 -0
  405. package/src/plugins/oauth/pkce.ts +58 -0
  406. package/src/plugins/openapi/index.ts +298 -0
  407. package/src/plugins/openapi/openapi.test.ts +425 -0
  408. package/src/plugins/openapi/spec-builder.ts +287 -0
  409. package/src/plugins/rate-limit/express.test.ts +89 -0
  410. package/src/plugins/rate-limit/express.ts +86 -0
  411. package/src/plugins/rate-limit/hono.test.ts +60 -0
  412. package/src/plugins/rate-limit/hono.ts +74 -0
  413. package/src/plugins/rate-limit/index.ts +383 -0
  414. package/src/plugins/rate-limit/memory-store.ts +61 -0
  415. package/src/plugins/rate-limit/rate-limit.test.ts +756 -0
  416. package/src/plugins/rate-limit/sveltekit.test.ts +58 -0
  417. package/src/plugins/rate-limit/sveltekit.ts +66 -0
  418. package/src/plugins/social-login/index.ts +715 -0
  419. package/src/plugins/social-login/providers/apple.ts +34 -0
  420. package/src/plugins/social-login/providers/discord.ts +26 -0
  421. package/src/plugins/social-login/providers/github.ts +54 -0
  422. package/src/plugins/social-login/providers/google.ts +23 -0
  423. package/src/plugins/social-login/providers/index.ts +22 -0
  424. package/src/plugins/social-login/providers/microsoft.ts +35 -0
  425. package/src/plugins/social-login/providers/oidc.ts +37 -0
  426. package/src/plugins/social-login/providers/providers.test.ts +211 -0
  427. package/src/plugins/social-login/social-login.test.ts +675 -0
  428. package/src/plugins/social-login/types.ts +80 -0
  429. package/src/plugins/tenancy/index.ts +544 -0
  430. package/src/plugins/tenancy/tenancy.test.ts +323 -0
  431. package/src/plugins/two-factor/index.ts +569 -0
  432. package/src/plugins/two-factor/two-factor.test.ts +235 -0
  433. package/src/plugins/webauthn/index.ts +554 -0
  434. package/src/plugins/webauthn/webauthn.test.ts +472 -0
  435. package/src/plugins/webhook/builtin-events.ts +29 -0
  436. package/src/plugins/webhook/delivery.test.ts +51 -0
  437. package/src/plugins/webhook/delivery.ts +154 -0
  438. package/src/plugins/webhook/hooks.ts +89 -0
  439. package/src/plugins/webhook/index.ts +445 -0
  440. package/src/plugins/webhook/queue/database.ts +67 -0
  441. package/src/plugins/webhook/queue/in-memory.test.ts +48 -0
  442. package/src/plugins/webhook/queue/in-memory.ts +71 -0
  443. package/src/plugins/webhook/queue/types.ts +51 -0
  444. package/src/plugins/webhook/registry.test.ts +48 -0
  445. package/src/plugins/webhook/registry.ts +64 -0
  446. package/src/plugins/webhook/signing.ts +45 -0
  447. package/src/plugins/webhook/ssrf.ts +198 -0
  448. package/src/plugins/webhook/types.ts +138 -0
  449. package/src/plugins/webhook/webhook.test.ts +324 -0
  450. package/src/sveltekit/actions.ts +233 -0
  451. package/src/sveltekit/catch-all.ts +43 -0
  452. package/src/sveltekit/cookies.ts +136 -0
  453. package/src/sveltekit/handle.ts +356 -0
  454. package/src/sveltekit/helpers.ts +69 -0
  455. package/src/sveltekit/index.ts +74 -0
  456. package/src/sveltekit/protect.ts +80 -0
  457. package/src/sveltekit/sveltekit-types.test.ts +31 -0
  458. package/src/sveltekit/sveltekit.test.ts +799 -0
  459. package/src/sveltekit/types.ts +134 -0
  460. package/src/sveltekit/validated.test.ts +117 -0
  461. package/src/sveltekit/validated.ts +78 -0
  462. package/src/testing/adapter-conformance.test.ts +408 -0
  463. package/src/testing/checks.test.ts +124 -0
  464. package/src/testing/checks.ts +304 -0
  465. package/src/testing/index.ts +107 -0
@@ -0,0 +1,660 @@
1
+ import type { FortressSchema, Infer } from './json-schema';
2
+ import type { StandardSchemaV1 } from './standard-schema';
3
+ import { describe, expect, it } from 'vitest';
4
+ import { anyOf, arr, bool, date, datetime, defineComponents, discriminatedUnion, email, endpoint, enums, ErrorEnvelope, extractJsonSchema, id, int, intersect, isFortressSchema, isStandardSchema, literal, nullable, nullType, num, obj, oneOf, record, recordOf, ref, str, strFormat, strict, time, url, uuid } from './schema-builder';
5
+
6
+ /** Assert validation fails and return issues. */
7
+ function expectIssues(result: StandardSchemaV1.Result<any>): void {
8
+ expect('issues' in result && result.issues !== undefined).toBe(true);
9
+ }
10
+
11
+ describe('schema builders', () => {
12
+ it('str() returns string schema with ~standard', () => {
13
+ const s = str();
14
+ expect(s.type).toBe('string');
15
+ expect(s['~standard'].version).toBe(1);
16
+ expect(s['~standard'].vendor).toBe('fortress');
17
+ expect(typeof s['~standard'].validate).toBe('function');
18
+
19
+ expect(str('An email').description).toBe('An email');
20
+ });
21
+
22
+ it('num() returns number schema', () => {
23
+ expect(num().type).toBe('number');
24
+ });
25
+
26
+ it('int() returns integer schema', () => {
27
+ expect(int().type).toBe('integer');
28
+ });
29
+
30
+ it('bool() returns boolean schema', () => {
31
+ expect(bool().type).toBe('boolean');
32
+ });
33
+
34
+ it('arr() returns array schema', () => {
35
+ const s = arr(str());
36
+ expect(s.type).toBe('array');
37
+ expect(s.items?.type).toBe('string');
38
+ });
39
+
40
+ it('obj() returns object schema with required', () => {
41
+ const schema = obj({ name: str(), age: int() }, 'name');
42
+ expect(schema.type).toBe('object');
43
+ expect(schema.properties?.name?.type).toBe('string');
44
+ expect(schema.properties?.age?.type).toBe('integer');
45
+ expect(schema.required).toEqual(['name']);
46
+ });
47
+
48
+ it('obj() without required fields omits required', () => {
49
+ const schema = obj({ name: str() });
50
+ expect(schema.required).toBeUndefined();
51
+ });
52
+
53
+ it('nullable() wraps schema', () => {
54
+ const s = nullable(str());
55
+ expect(s.type).toBe('string');
56
+ expect(s.nullable).toBe(true);
57
+ });
58
+
59
+ it('oneOf() composes schemas and requires exactly one runtime match', async () => {
60
+ const left = obj({ left: str() }, 'left');
61
+ const right = obj({ right: str() }, 'right');
62
+ const s = oneOf(left, right);
63
+ expect(s.oneOf).toHaveLength(2);
64
+
65
+ expect(await s['~standard'].validate({ left: 'yes' })).toEqual({ value: { left: 'yes' } });
66
+ expectIssues(await s['~standard'].validate({ neither: true }));
67
+ expectIssues(await s['~standard'].validate({ left: 'yes', right: 'yes' }));
68
+ });
69
+
70
+ it('anyOf() composes schemas and permits overlapping runtime matches', async () => {
71
+ const s = anyOf(
72
+ obj({ left: str() }, 'left'),
73
+ obj({ right: str() }, 'right'),
74
+ );
75
+ expect(s.anyOf).toHaveLength(2);
76
+ expect((await s['~standard'].validate({ left: 'yes', right: 'yes' }) as any).issues).toBeUndefined();
77
+ });
78
+
79
+ it('ref() returns $ref', () => {
80
+ expect(ref('User').$ref).toBe('#/components/schemas/User');
81
+ });
82
+
83
+ it('defineComponents refs enforce the referenced component shape', () => {
84
+ const User = strict(obj({ email: email(), age: int({ min: 18 }) }, 'email', 'age'));
85
+ const { ref: componentRef } = defineComponents({ User });
86
+ const schema = componentRef('User');
87
+
88
+ expect((schema['~standard'].validate({ email: 'user@example.com', age: 21 }) as any).issues).toBeUndefined();
89
+ expectIssues(schema['~standard'].validate({ email: 'invalid', age: 21 }) as StandardSchemaV1.Result<any>);
90
+ expectIssues(schema['~standard'].validate({ email: 'user@example.com', age: 17 }) as StandardSchemaV1.Result<any>);
91
+ expectIssues(schema['~standard'].validate({ email: 'user@example.com' }) as StandardSchemaV1.Result<any>);
92
+ expectIssues(schema['~standard'].validate({ email: 'user@example.com', age: 21, admin: true }) as StandardSchemaV1.Result<any>);
93
+ });
94
+
95
+ it('enforces bound refs nested inside an inline request schema', () => {
96
+ const User = obj({ name: str({ min: 2 }) }, 'name');
97
+ const { ref: componentRef } = defineComponents({ User });
98
+ const schema = obj({ user: componentRef('User') }, 'user');
99
+
100
+ expect((schema['~standard'].validate({ user: { name: 'Ada' } }) as any).issues).toBeUndefined();
101
+ expectIssues(schema['~standard'].validate({ user: { name: 'A' } }) as StandardSchemaV1.Result<any>);
102
+ });
103
+
104
+ it('resolves transitive and recursive component refs', () => {
105
+ const Address = obj({ city: str({ min: 2 }) }, 'city');
106
+ const User = obj({ address: ref('Address') }, 'address');
107
+ const Node = obj({ name: str(), children: arr(ref('Node')) }, 'name');
108
+ const { ref: componentRef } = defineComponents({ Address, User, Node });
109
+
110
+ const user = componentRef('User');
111
+ expect((user['~standard'].validate({ address: { city: 'Oslo' } }) as any).issues).toBeUndefined();
112
+ expectIssues(user['~standard'].validate({ address: { city: 'X' } }) as StandardSchemaV1.Result<any>);
113
+
114
+ const node = componentRef('Node');
115
+ expect((node['~standard'].validate({ name: 'root', children: [{ name: 'leaf' }] }) as any).issues).toBeUndefined();
116
+ expectIssues(node['~standard'].validate({ name: 'root', children: [{}] }) as StandardSchemaV1.Result<any>);
117
+ });
118
+
119
+ it('isolates same-named components across independent registries', () => {
120
+ const AUser = obj({ kind: literal('a') }, 'kind');
121
+ const BUser = obj({ kind: literal('b') }, 'kind');
122
+ const aRef = defineComponents({ User: AUser }).ref('User');
123
+ const bRef = defineComponents({ User: BUser }).ref('User');
124
+
125
+ // Compile lazily only after both registries exist: neither may overwrite
126
+ // the other by global component name.
127
+ expect((aRef['~standard'].validate({ kind: 'a' }) as any).issues).toBeUndefined();
128
+ expectIssues(aRef['~standard'].validate({ kind: 'b' }) as StandardSchemaV1.Result<any>);
129
+ expect((bRef['~standard'].validate({ kind: 'b' }) as any).issues).toBeUndefined();
130
+ expectIssues(bRef['~standard'].validate({ kind: 'a' }) as StandardSchemaV1.Result<any>);
131
+ });
132
+
133
+ it('typed refs enforce their supplied schema while bare refs stay permissive', () => {
134
+ const typed = ref('Token', obj({ value: str({ min: 3 }) }, 'value'));
135
+ expect((typed['~standard'].validate({ value: 'abc' }) as any).issues).toBeUndefined();
136
+ expectIssues(typed['~standard'].validate({ value: 'x' }) as StandardSchemaV1.Result<any>);
137
+
138
+ const bare = ref('Unknown');
139
+ defineComponents({ Unknown: obj({ required: str() }, 'required') });
140
+ // A later registry declaration must not retroactively bind a bare ref.
141
+ expect((bare['~standard'].validate({ arbitrary: true }) as any).issues).toBeUndefined();
142
+ });
143
+
144
+ it('resolves same-named bare and bound refs to one global component', () => {
145
+ const bare = ref('SharedUser');
146
+ const bound = defineComponents({
147
+ SharedUser: obj({ name: str({ min: 2 }) }, 'name'),
148
+ }).ref('SharedUser');
149
+ const schema = obj({ bare, bound }, 'bare', 'bound');
150
+
151
+ expect((schema['~standard'].validate({
152
+ bare: { name: 'Ada' },
153
+ bound: { name: 'Lin' },
154
+ }) as any).issues).toBeUndefined();
155
+ expectIssues(schema['~standard'].validate({
156
+ bare: { arbitrary: true },
157
+ bound: { name: 'Lin' },
158
+ }) as StandardSchemaV1.Result<any>);
159
+ });
160
+
161
+ it('nullable bound refs accept null and still enforce non-null values', () => {
162
+ const User = obj({ name: str({ min: 2 }) }, 'name');
163
+ const schema = nullable(defineComponents({ User }).ref('User'));
164
+
165
+ expect((schema['~standard'].validate(null) as any).issues).toBeUndefined();
166
+ expect((schema['~standard'].validate({ name: 'Ada' }) as any).issues).toBeUndefined();
167
+ expectIssues(schema['~standard'].validate({ name: 'A' }) as StandardSchemaV1.Result<any>);
168
+ });
169
+
170
+ it('rejects component names that cannot be represented safely in OpenAPI refs', () => {
171
+ expect(() => ref('Admin/User')).toThrow(/Invalid OpenAPI component name/);
172
+ expect(() => defineComponents({ 'Admin/User': obj({ id: str() }) })).toThrow(/Invalid OpenAPI component name/);
173
+ });
174
+
175
+ it('snapshots component bindings before lazy validation', () => {
176
+ const original = obj({ kind: literal('original') }, 'kind');
177
+ const replacement = obj({ kind: literal('replacement') }, 'kind');
178
+ const registry: Record<string, FortressSchema<any>> = { User: original };
179
+ const bound = defineComponents(registry).ref('User');
180
+ registry.User = replacement;
181
+
182
+ expect((bound['~standard'].validate({ kind: 'original' }) as any).issues).toBeUndefined();
183
+ expectIssues(bound['~standard'].validate({ kind: 'replacement' }) as StandardSchemaV1.Result<any>);
184
+ });
185
+
186
+ it('resolves mutually recursive component refs', () => {
187
+ const A = obj({ name: str(), b: ref('B') }, 'name');
188
+ const B = obj({ name: str(), a: ref('A') }, 'name');
189
+ const schema = defineComponents({ A, B }).ref('A');
190
+
191
+ expect((schema['~standard'].validate({ name: 'a', b: { name: 'b' } }) as any).issues).toBeUndefined();
192
+ expectIssues(schema['~standard'].validate({ name: 'a', b: { a: {} } }) as StandardSchemaV1.Result<any>);
193
+ });
194
+
195
+ it('fails closed when one schema mixes conflicting same-named registries', () => {
196
+ const a = defineComponents({ User: obj({ kind: literal('a') }, 'kind') }).ref('User');
197
+ const b = defineComponents({ User: obj({ kind: literal('b') }, 'kind') }).ref('User');
198
+ const mixed = obj({ a, b }, 'a', 'b');
199
+
200
+ expect(() => mixed['~standard'].validate({ a: { kind: 'a' }, b: { kind: 'b' } }))
201
+ .toThrow(/Conflicting component definitions/);
202
+ });
203
+
204
+ it('enums() returns enum schema', () => {
205
+ expect(enums('a', 'b', 'c').enum).toEqual(['a', 'b', 'c']);
206
+ });
207
+
208
+ it('strFormat() returns string with format', () => {
209
+ const s = strFormat('email');
210
+ expect(s.type).toBe('string');
211
+ expect(s.format).toBe('email');
212
+
213
+ const s2 = strFormat('date-time', 'Timestamp');
214
+ expect(s2.description).toBe('Timestamp');
215
+ });
216
+
217
+ it('nullType() returns null schema', () => {
218
+ expect(nullType().type).toBe('null');
219
+ });
220
+
221
+ it('record() returns object with additionalProperties', () => {
222
+ const s = record('Some data');
223
+ expect(s.type).toBe('object');
224
+ expect(s.additionalProperties).toBe(true);
225
+ expect(s.description).toBe('Some data');
226
+ });
227
+
228
+ it('recordOf() returns object with typed additionalProperties', () => {
229
+ const s = recordOf(str());
230
+ expect(s.type).toBe('object');
231
+ expect((s.additionalProperties as any).type).toBe('string');
232
+ });
233
+ });
234
+
235
+ describe('standard Schema validation', () => {
236
+ it('str() validates strings', () => {
237
+ const s = str();
238
+ const ok = s['~standard'].validate('hello');
239
+ expect(ok).toEqual({ value: 'hello' });
240
+
241
+ const fail = s['~standard'].validate(123);
242
+ expectIssues(fail as StandardSchemaV1.Result<any>);
243
+ });
244
+
245
+ it('int() validates integers', () => {
246
+ const s = int();
247
+ expect(s['~standard'].validate(42)).toEqual({ value: 42 });
248
+
249
+ const fail = s['~standard'].validate(3.14);
250
+ expectIssues(fail as StandardSchemaV1.Result<any>);
251
+ });
252
+
253
+ it('bool() validates booleans', () => {
254
+ const s = bool();
255
+ expect(s['~standard'].validate(true)).toEqual({ value: true });
256
+
257
+ const fail = s['~standard'].validate('true');
258
+ expectIssues(fail as StandardSchemaV1.Result<any>);
259
+ });
260
+
261
+ it('obj() validates required fields', () => {
262
+ const s = obj({ name: str(), age: int() }, 'name', 'age');
263
+
264
+ const ok = s['~standard'].validate({ name: 'Alice', age: 30 });
265
+ expect(ok).toEqual({ value: { name: 'Alice', age: 30 } });
266
+
267
+ const fail = s['~standard'].validate({ name: 'Alice' });
268
+ expectIssues(fail as StandardSchemaV1.Result<any>);
269
+ });
270
+
271
+ it('obj() validates property types', () => {
272
+ const s = obj({ name: str() }, 'name');
273
+
274
+ const fail = s['~standard'].validate({ name: 123 });
275
+ expectIssues(fail as StandardSchemaV1.Result<any>);
276
+ });
277
+
278
+ it('arr() validates array items', () => {
279
+ const s = arr(int());
280
+
281
+ const ok = s['~standard'].validate([1, 2, 3]);
282
+ expect(ok).toEqual({ value: [1, 2, 3] });
283
+
284
+ const fail = s['~standard'].validate([1, 'two', 3]);
285
+ expectIssues(fail as StandardSchemaV1.Result<any>);
286
+ });
287
+
288
+ it('enums() validates enum values', () => {
289
+ const s = enums('a', 'b');
290
+
291
+ expect(s['~standard'].validate('a')).toEqual({ value: 'a' });
292
+
293
+ const fail = s['~standard'].validate('c');
294
+ expectIssues(fail as StandardSchemaV1.Result<any>);
295
+ });
296
+
297
+ it('nullable() accepts null', () => {
298
+ const s = nullable(str());
299
+
300
+ expect(s['~standard'].validate(null)).toEqual({ value: null });
301
+ expect(s['~standard'].validate('hello')).toEqual({ value: 'hello' });
302
+ });
303
+ });
304
+
305
+ describe('type inference', () => {
306
+ it('infers primitive types', () => {
307
+ void (0 as unknown as Infer<ReturnType<typeof str>> satisfies string);
308
+ void (0 as unknown as Infer<ReturnType<typeof int>> satisfies number);
309
+ void (0 as unknown as Infer<ReturnType<typeof bool>> satisfies boolean);
310
+
311
+ expect(str().type).toBe('string');
312
+ });
313
+
314
+ it('infers object types with required/optional', () => {
315
+ const schema = obj({ name: str(), age: int() }, 'name');
316
+ type T = Infer<typeof schema>;
317
+
318
+ // Compile-time: name is required, age is optional
319
+ void (0 as unknown as T satisfies { name: string; age?: number });
320
+
321
+ expect(schema.required).toEqual(['name']);
322
+ });
323
+
324
+ it('infers array types', () => {
325
+ const schema = arr(str());
326
+ type T = Infer<typeof schema>;
327
+ void (0 as unknown as T satisfies string[]);
328
+
329
+ expect(schema.type).toBe('array');
330
+ });
331
+
332
+ it('infers enum types', () => {
333
+ const schema = enums('a', 'b', 'c');
334
+ type T = Infer<typeof schema>;
335
+ void (0 as unknown as T satisfies 'a' | 'b' | 'c');
336
+
337
+ expect(schema.enum).toEqual(['a', 'b', 'c']);
338
+ });
339
+
340
+ it('infers nullable types', () => {
341
+ const schema = nullable(str());
342
+ type T = Infer<typeof schema>;
343
+ void (0 as unknown as T satisfies string | null);
344
+
345
+ expect(schema.nullable).toBe(true);
346
+ });
347
+
348
+ it('inferOutput works with Standard Schema type', () => {
349
+ const schema = obj({ x: int() }, 'x');
350
+ type T = StandardSchemaV1.InferOutput<typeof schema>;
351
+ void (0 as unknown as T satisfies { x: number });
352
+
353
+ expect(schema.type).toBe('object');
354
+ });
355
+ });
356
+
357
+ describe('schema detection (Zod-like Standard Schema)', () => {
358
+ /** Creates a mock external Standard Schema that has a .type property (like Zod). */
359
+ function mockZodSchema(): StandardSchemaV1 & { type: string } {
360
+ const jsonSchema = { type: 'object' as const, properties: { name: { type: 'string' as const } }, required: ['name'] };
361
+ return {
362
+ 'type': 'ZodObject', // Zod objects have a .type property
363
+ '~standard': {
364
+ version: 1,
365
+ vendor: 'zod',
366
+ validate: (value: unknown) => ({ value }),
367
+ jsonSchema: {
368
+ input: () => jsonSchema,
369
+ },
370
+ },
371
+ } as any;
372
+ }
373
+
374
+ it('does not detect Zod-like schema as FortressSchema', () => {
375
+ const zod = mockZodSchema();
376
+ expect(isStandardSchema(zod)).toBe(true);
377
+ expect(isFortressSchema(zod)).toBe(false);
378
+ });
379
+
380
+ it('extractJsonSchema uses ~standard.jsonSchema for external schemas', () => {
381
+ const zod = mockZodSchema();
382
+ const result = extractJsonSchema(zod);
383
+ expect(result).toEqual({
384
+ type: 'object',
385
+ properties: { name: { type: 'string' } },
386
+ required: ['name'],
387
+ });
388
+ });
389
+
390
+ it('extractJsonSchema returns fortress schema as-is', () => {
391
+ const s = obj({ name: str() }, 'name');
392
+ const result = extractJsonSchema(s);
393
+ expect(result).toBe(s); // same reference
394
+ });
395
+
396
+ /** Mimics fetcher: JSON Schema object with ~standard bolted on, no jsonSchema.input adapter. */
397
+ function mockFetcherObject(): StandardSchemaV1 & { type: 'object'; properties: Record<string, unknown>; required: string[] } {
398
+ return {
399
+ 'type': 'object',
400
+ 'properties': { name: { type: 'string' } },
401
+ 'required': ['name'],
402
+ '~standard': {
403
+ version: 1,
404
+ vendor: 'fetcher',
405
+ validate: (value: unknown) => ({ value }),
406
+ },
407
+ } as any;
408
+ }
409
+
410
+ it('extractJsonSchema returns fetcher-shaped schema as-is (non-fortress vendor, no adapter)', () => {
411
+ const f = mockFetcherObject();
412
+ const result = extractJsonSchema(f);
413
+ expect(result).toBe(f);
414
+ expect(result).toMatchObject({
415
+ type: 'object',
416
+ properties: { name: { type: 'string' } },
417
+ required: ['name'],
418
+ });
419
+ });
420
+
421
+ it('extractJsonSchema handles $ref-shaped Standard Schema regardless of vendor', () => {
422
+ const r = {
423
+ '$ref': '#/components/schemas/User',
424
+ '~standard': { version: 1, vendor: 'fetcher', validate: (v: unknown) => ({ value: v }) },
425
+ } as any;
426
+ expect(extractJsonSchema(r)).toBe(r);
427
+ });
428
+
429
+ it('extractJsonSchema falls back to {} for wrapper-style schema whose type is not a JSON Schema type', () => {
430
+ const fakeZod = {
431
+ 'type': 'ZodObject',
432
+ '~standard': { version: 1, vendor: 'zod', validate: (v: unknown) => ({ value: v }) },
433
+ } as any;
434
+ expect(extractJsonSchema(fakeZod)).toEqual({});
435
+ });
436
+
437
+ it('endpoint builder extracts JSON Schema from external Standard Schema', () => {
438
+ const zod = mockZodSchema();
439
+ const ep = endpoint('POST', '/test')
440
+ .body(zod)
441
+ .handler('test')
442
+ .build();
443
+
444
+ expect(ep.input?.body?.type).toBe('object');
445
+ expect(ep.input?.body?.properties?.name?.type).toBe('string');
446
+ expect(ep.input?.bodySchema).toBeDefined();
447
+ });
448
+ });
449
+
450
+ describe('endpoint builder', () => {
451
+ it('builds a minimal endpoint', () => {
452
+ const ep = endpoint('GET', '/health').handler('healthCheck').build();
453
+ expect(ep).toEqual({
454
+ method: 'GET',
455
+ path: '/health',
456
+ handler: 'healthCheck',
457
+ });
458
+ });
459
+
460
+ it('builds a full endpoint with all fields', () => {
461
+ const ep = endpoint('POST', '/auth/login')
462
+ .summary('Login')
463
+ .description('Authenticate with credentials')
464
+ .tags('Auth')
465
+ .security('none')
466
+ .body(obj({ identifier: str(), password: str() }, 'identifier', 'password'))
467
+ .response(200, 'Success', ref('AuthResponse'))
468
+ .response(401, 'Invalid credentials', ref('ErrorResponse'))
469
+ .handler('login')
470
+ .build();
471
+
472
+ expect(ep.method).toBe('POST');
473
+ expect(ep.path).toBe('/auth/login');
474
+ expect(ep.handler).toBe('login');
475
+ expect(ep.meta?.summary).toBe('Login');
476
+ expect(ep.meta?.description).toBe('Authenticate with credentials');
477
+ expect(ep.meta?.tags).toEqual(['Auth']);
478
+ expect(ep.meta?.security).toEqual(['none']);
479
+ expect(ep.input?.body?.type).toBe('object');
480
+ expect(ep.input?.body?.required).toEqual(['identifier', 'password']);
481
+ expect(ep.input?.bodySchema).toBeDefined();
482
+ expect(ep.responses?.[200]?.description).toBe('Success');
483
+ expect(ep.responses?.[401]?.schema?.$ref).toBe('#/components/schemas/ErrorResponse');
484
+ });
485
+
486
+ it('stores Standard Schema ref for validation', () => {
487
+ const body = obj({ name: str() }, 'name');
488
+ const ep = endpoint('POST', '/test')
489
+ .body(body)
490
+ .handler('test')
491
+ .build();
492
+
493
+ expect(ep.input?.bodySchema).toBeDefined();
494
+ expect(typeof (ep.input?.bodySchema as any)['~standard'].validate).toBe('function');
495
+ });
496
+
497
+ it('supports deprecated endpoints', () => {
498
+ const ep = endpoint('GET', '/old').summary('Old').deprecated().handler('old').build();
499
+ expect(ep.meta?.deprecated).toBe(true);
500
+ });
501
+
502
+ it('supports query and params', () => {
503
+ const ep = endpoint('GET', '/users/:id')
504
+ .summary('Get user')
505
+ .params(obj({ id: id('User ID') }, 'id'))
506
+ .query(obj({ include: str('Relations to include') }))
507
+ .handler('getUser')
508
+ .build();
509
+
510
+ expect(ep.input?.params?.properties?.id?.type).toBe('string');
511
+ expect(ep.input?.query?.properties?.include?.type).toBe('string');
512
+ expect(ep.input?.paramsSchema).toBeDefined();
513
+ expect(ep.input?.querySchema).toBeDefined();
514
+ });
515
+
516
+ it('supports multiple tags', () => {
517
+ const ep = endpoint('GET', '/test').summary('Test').tags('Auth', 'Admin').handler('test').build();
518
+ expect(ep.meta?.tags).toEqual(['Auth', 'Admin']);
519
+ });
520
+ });
521
+
522
+ describe('errorEnvelope + .errorResponse()', () => {
523
+ it('exports ErrorEnvelope as a fortress schema matching FortressError.toJSON()', () => {
524
+ expect(isFortressSchema(ErrorEnvelope)).toBe(true);
525
+ const json = extractJsonSchema(ErrorEnvelope);
526
+ expect(json.type).toBe('object');
527
+ expect(json.required).toEqual(['code', 'message', 'statusCode']);
528
+ expect(json.properties?.code?.type).toBe('string');
529
+ expect(json.properties?.message?.type).toBe('string');
530
+ expect(json.properties?.statusCode?.type).toBe('integer');
531
+ expect(json.properties?.details).toBeDefined();
532
+ });
533
+
534
+ it('validates a canonical error body', () => {
535
+ const ok = ErrorEnvelope['~standard'].validate({
536
+ code: 'NOT_FOUND',
537
+ message: 'gone',
538
+ statusCode: 404,
539
+ });
540
+ expect('issues' in ok && ok.issues !== undefined).toBe(false);
541
+ });
542
+
543
+ it('rejects bodies missing required fields', () => {
544
+ const bad = ErrorEnvelope['~standard'].validate({ code: 'NOT_FOUND' }) as StandardSchemaV1.Result<any>;
545
+ expectIssues(bad);
546
+ });
547
+
548
+ it('.errorResponse() wires ErrorEnvelope into a response declaration', () => {
549
+ const ep = endpoint('GET', '/schools/:id')
550
+ .summary('Get school')
551
+ .errorResponse(404, 'Not found')
552
+ .errorResponse(403, 'Forbidden')
553
+ .handler('getSchool')
554
+ .build();
555
+
556
+ expect(ep.responses?.[404]?.description).toBe('Not found');
557
+ expect(ep.responses?.[404]?.schema?.required).toEqual(['code', 'message', 'statusCode']);
558
+ expect(ep.responses?.[403]?.schema?.properties?.code?.type).toBe('string');
559
+ });
560
+ });
561
+
562
+ describe('tier 1 — richer constraints (fetcher-backed, enforced)', () => {
563
+ it('str({ min, max, pattern }) emits and enforces constraints', () => {
564
+ const s = str({ min: 3, max: 5, pattern: '^[a-z]+$' });
565
+ expect(s.minLength).toBe(3);
566
+ expect(s.maxLength).toBe(5);
567
+ expect(s.pattern).toBe('^[a-z]+$');
568
+
569
+ expect(s['~standard'].validate('abc')).toEqual({ value: 'abc' });
570
+ expectIssues(s['~standard'].validate('ab') as StandardSchemaV1.Result<any>); // too short
571
+ expectIssues(s['~standard'].validate('abcdef') as StandardSchemaV1.Result<any>); // too long
572
+ expectIssues(s['~standard'].validate('AB1') as StandardSchemaV1.Result<any>); // pattern
573
+ });
574
+
575
+ it('str() still accepts a bare description string', () => {
576
+ expect(str('An email').description).toBe('An email');
577
+ });
578
+
579
+ it('int({ min, max }) enforces numeric bounds', () => {
580
+ const s = int({ min: 1, max: 10 });
581
+ expect(s.minimum).toBe(1);
582
+ expect(s.maximum).toBe(10);
583
+ expect(s['~standard'].validate(5)).toEqual({ value: 5 });
584
+ expectIssues(s['~standard'].validate(0) as StandardSchemaV1.Result<any>);
585
+ expectIssues(s['~standard'].validate(11) as StandardSchemaV1.Result<any>);
586
+ });
587
+
588
+ it('literal() narrows and enforces a constant', () => {
589
+ const s = literal('admin');
590
+ expect(s.const).toBe('admin');
591
+ void (0 as unknown as Infer<typeof s> satisfies 'admin');
592
+ expect(s['~standard'].validate('admin')).toEqual({ value: 'admin' });
593
+ expectIssues(s['~standard'].validate('user') as StandardSchemaV1.Result<any>);
594
+ });
595
+
596
+ it('intersect() requires every schema (allOf)', () => {
597
+ const s = intersect(obj({ a: str() }, 'a'), obj({ b: int() }, 'b'));
598
+ expect(s.allOf).toHaveLength(2);
599
+ expect((s['~standard'].validate({ a: 'x', b: 1 }) as any).issues).toBeUndefined();
600
+ expectIssues(s['~standard'].validate({ a: 'x' }) as StandardSchemaV1.Result<any>);
601
+ });
602
+
603
+ it('strict() closes an object against extra keys', () => {
604
+ const s = strict(obj({ a: str() }, 'a'));
605
+ expect(s.additionalProperties).toBe(false);
606
+ expect((s['~standard'].validate({ a: 'x' }) as any).issues).toBeUndefined();
607
+ expectIssues(s['~standard'].validate({ a: 'x', extra: 1 }) as StandardSchemaV1.Result<any>);
608
+ });
609
+
610
+ it('discriminatedUnion() dispatches on the tag property', () => {
611
+ const s = discriminatedUnion(
612
+ 'kind',
613
+ obj({ kind: literal('a'), x: int() }, 'kind', 'x'),
614
+ obj({ kind: literal('b'), y: str() }, 'kind', 'y'),
615
+ );
616
+ expect(s.oneOf).toHaveLength(2);
617
+ expect(s.discriminator?.propertyName).toBe('kind');
618
+ expect((s['~standard'].validate({ kind: 'a', x: 1 }) as any).issues).toBeUndefined();
619
+ expectIssues(s['~standard'].validate({ kind: 'a', x: 'no' }) as StandardSchemaV1.Result<any>);
620
+ });
621
+ });
622
+
623
+ describe('tier 2 — enforced string formats (lifted from fetcher)', () => {
624
+ it('email() carries format + pattern and enforces at runtime', () => {
625
+ const s = email();
626
+ expect(s.format).toBe('email');
627
+ expect(typeof s.pattern).toBe('string');
628
+ expect(s['~standard'].validate('user@example.com')).toEqual({ value: 'user@example.com' });
629
+ expectIssues(s['~standard'].validate('not-an-email') as StandardSchemaV1.Result<any>);
630
+ expectIssues(s['~standard'].validate('a@b@c') as StandardSchemaV1.Result<any>);
631
+ });
632
+
633
+ it('uuid() enforces the RFC 9562 grammar', () => {
634
+ const s = uuid();
635
+ expect(s.format).toBe('uuid');
636
+ expect(s['~standard'].validate('00000000-0000-0000-0000-000000000000')).toEqual({
637
+ value: '00000000-0000-0000-0000-000000000000',
638
+ });
639
+ expectIssues(s['~standard'].validate('not-a-uuid') as StandardSchemaV1.Result<any>);
640
+ });
641
+
642
+ it('url() requires an explicit scheme://authority', () => {
643
+ const s = url();
644
+ expect(s.format).toBe('uri');
645
+ expect(s['~standard'].validate('https://example.com')).toEqual({ value: 'https://example.com' });
646
+ expectIssues(s['~standard'].validate('mailto:a@b.com') as StandardSchemaV1.Result<any>);
647
+ });
648
+
649
+ it('datetime()/date()/time() enforce RFC 3339 shapes', () => {
650
+ expect(datetime().format).toBe('date-time');
651
+ expect((datetime()['~standard'].validate('2026-01-02T03:04:05Z') as any).issues).toBeUndefined();
652
+ expectIssues(datetime()['~standard'].validate('2026-01-02') as StandardSchemaV1.Result<any>);
653
+
654
+ expect(date().format).toBe('date');
655
+ expect((date()['~standard'].validate('2026-01-02') as any).issues).toBeUndefined();
656
+
657
+ expect(time().format).toBe('time');
658
+ expect((time()['~standard'].validate('03:04:05') as any).issues).toBeUndefined();
659
+ });
660
+ });