@codespar/sdk 0.10.11 → 0.12.0

package/dist/__tests__/mandate.test.js

@@ -0,0 +1,141 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, it, expect } from "vitest";
+import { agentDidFromKid, decodeMandateToken, reconstructSigningString, verifyEd25519, verifyMandateToken, } from "../mandate/index.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_PATH = join(__dirname, "fixtures/canonical.v3.fixture.json");
+const fx = JSON.parse(readFileSync(FIXTURE_PATH, "utf8"));
+/** Reproduce the enterprise `computeToken` envelope so we have a real token. */
+function makeToken(fields, envelope) {
+    return Buffer.from(JSON.stringify({ ...fields, ...envelope }), "utf8").toString("base64url");
+}
+const TOKEN = makeToken(fx.input, {
+    signature: fx.hmac_sha256_hex,
+    agent_sig: fx.agent_sig_b64url,
+    issuer_sig: fx.issuer_sig_b64url,
+    kid: fx.input.agent_kid,
+});
+describe("@codespar/sdk/mandate — decode", () => {
+    it("round-trips the V3 envelope and separates it from the signed fields", () => {
+        const res = decodeMandateToken(TOKEN);
+        expect(res.ok).toBe(true);
+        if (!res.ok)
+            return;
+        expect(res.token.signature).toBe(fx.hmac_sha256_hex);
+        expect(res.token.agent_sig).toBe(fx.agent_sig_b64url);
+        expect(res.token.issuer_sig).toBe(fx.issuer_sig_b64url);
+        expect(res.token.kid).toBe(fx.input.agent_kid);
+        const m = res.token.mandate;
+        expect(m.signature).toBeUndefined();
+        expect(m.agent_sig).toBeUndefined();
+        expect(m.issuer_sig).toBeUndefined();
+        expect(m.kid).toBeUndefined();
+    });
+    it("rejects a non-base64url / non-JSON blob", () => {
+        const res = decodeMandateToken("!!!nope!!!");
+        expect(res.ok).toBe(false);
+        if (!res.ok)
+            expect(res.error).toBe("invalid_payload");
+    });
+    it("rejects an unsupported (v1) format_version", () => {
+        const res = decodeMandateToken(makeToken({ ...fx.input, format_version: 1 }, { signature: "x" }));
+        expect(res.ok).toBe(false);
+        if (!res.ok)
+            expect(res.error).toBe("mandate_format_unsupported");
+    });
+});
+describe("@codespar/sdk/mandate — reconstructSigningString (byte-lock)", () => {
+    it("reproduces the frozen 14-field canonical string byte-for-byte", () => {
+        expect(reconstructSigningString(fx.input)).toBe(fx.canonical_string);
+    });
+    it("sorts + escapes purposes independent of input order", () => {
+        expect(reconstructSigningString({
+            ...fx.input,
+            purposes: ["utility", "refund"],
+        })).toBe(fx.canonical_string);
+    });
+});
+describe("@codespar/sdk/mandate — verifyEd25519", () => {
+    const agentPub = () => Buffer.from(fx.agent_pubkey_hex, "hex");
+    const issuerPub = () => Buffer.from(fx.issuer_pubkey_hex, "hex");
+    it("verifies agent + issuer signatures with only the DID public keys", () => {
+        expect(verifyEd25519(fx.canonical_string, fx.agent_sig_b64url, agentPub())).toBe(true);
+        expect(verifyEd25519(fx.canonical_string, fx.issuer_sig_b64url, issuerPub())).toBe(true);
+    });
+    it("fails a one-byte tamper of a signed field", () => {
+        const forged = reconstructSigningString({
+            ...fx.input,
+            amount: "9999",
+        });
+        expect(verifyEd25519(forged, fx.agent_sig_b64url, agentPub())).toBe(false);
+    });
+    it("fails against the wrong key and never throws on a malformed key", () => {
+        expect(verifyEd25519(fx.canonical_string, fx.agent_sig_b64url, issuerPub())).toBe(false);
+        expect(verifyEd25519(fx.canonical_string, fx.agent_sig_b64url, Buffer.alloc(5))).toBe(false);
+    });
+});
+describe("@codespar/sdk/mandate — verifyMandateToken (high-level)", () => {
+    it("verifies both signatures from hex keys and exposes governed fields", () => {
+        const res = verifyMandateToken(TOKEN, {
+            agentPublicKey: fx.agent_pubkey_hex,
+            issuerPublicKey: fx.issuer_pubkey_hex,
+        });
+        expect(res.verified).toBe(true);
+        expect(res.agent.status).toBe("verified");
+        expect(res.issuer.status).toBe("verified");
+        expect(res.agent.kid).toBe(fx.input.agent_kid);
+        expect(res.agentDid).toBe("did:web:id.codespar.dev:org_demo:a1");
+        expect(res.kid).toBe(fx.input.agent_kid);
+        expect(res.mandate.purposes).toContain("refund");
+        expect(res.mandate.amount).toBe("5000");
+    });
+    it("accepts raw byte keys as well as hex", () => {
+        const res = verifyMandateToken(TOKEN, {
+            agentPublicKey: Buffer.from(fx.agent_pubkey_hex, "hex"),
+            issuerPublicKey: Buffer.from(fx.issuer_pubkey_hex, "hex"),
+        });
+        expect(res.verified).toBe(true);
+    });
+    it("skips a signature when its key is not supplied (still verified overall)", () => {
+        const res = verifyMandateToken(TOKEN, { agentPublicKey: fx.agent_pubkey_hex });
+        expect(res.agent.status).toBe("verified");
+        expect(res.issuer.status).toBe("skipped");
+        expect(res.verified).toBe(true);
+    });
+    it("reports NOT verified when a supplied key fails", () => {
+        // Issuer key given for the agent slot → agent signature fails.
+        const res = verifyMandateToken(TOKEN, { agentPublicKey: fx.issuer_pubkey_hex });
+        expect(res.agent.status).toBe("failed");
+        expect(res.verified).toBe(false);
+    });
+    it("reports NOT verified for a tampered token", () => {
+        const tampered = makeToken({ ...fx.input, amount: "9999" }, {
+            signature: fx.hmac_sha256_hex,
+            agent_sig: fx.agent_sig_b64url,
+            issuer_sig: fx.issuer_sig_b64url,
+            kid: fx.input.agent_kid,
+        });
+        const res = verifyMandateToken(tampered, {
+            agentPublicKey: fx.agent_pubkey_hex,
+            issuerPublicKey: fx.issuer_pubkey_hex,
+        });
+        expect(res.verified).toBe(false);
+        expect(res.agent.status).toBe("failed");
+        expect(res.issuer.status).toBe("failed");
+    });
+    it("throws on a token that cannot be decoded", () => {
+        expect(() => verifyMandateToken("not-a-token")).toThrow(/cannot decode/);
+    });
+    it("rejects a malformed hex key by treating it as no key (skipped)", () => {
+        const res = verifyMandateToken(TOKEN, { agentPublicKey: "xyz" });
+        expect(res.agent.status).toBe("skipped");
+        expect(res.verified).toBe(false);
+    });
+});
+describe("@codespar/sdk/mandate — helpers", () => {
+    it("agentDidFromKid strips the #fragment", () => {
+        expect(agentDidFromKid("did:web:id.codespar.dev:org_demo:a1#1")).toBe("did:web:id.codespar.dev:org_demo:a1");
+    });
+});
+//# sourceMappingURL=mandate.test.js.map

package/dist/__tests__/mandate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.test.js","sourceRoot":"","sources":["../../src/__tests__/mandate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AAa3E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAc,CAAC;AAEvE,gFAAgF;AAChF,SAAS,SAAS,CAChB,MAA+B,EAC/B,QAAsF;IAEtF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,KAA2C,EAAE;IACtE,SAAS,EAAE,EAAE,CAAC,eAAe;IAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;IAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;IAChC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS;CACxB,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,OAA6C,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAA2C,CAAC,CAAC,CAAC,IAAI,CACnF,EAAE,CAAC,gBAAgB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CACJ,wBAAwB,CAAC;YACvB,GAAG,EAAE,CAAC,KAAK;YACX,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;SACM,CAAC,CACzC,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAEjE,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,CAAC,KAAK;YACX,MAAM,EAAE,MAAM;SACuB,CAAC,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE;YACpC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE;YACpC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;YACvD,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,SAAS,CACxB,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAC/B;YACE,SAAS,EAAE,EAAE,CAAC,eAAe;YAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;YAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;YAChC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS;SACxB,CACF,CAAC;QACF,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE;YACvC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,eAAe,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CACnE,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openapi-snapshot.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The generated client is only as true as the chain behind it:
+ *
+ *   served document == openapi-snapshot.json   (scripts/openapi-spec.mjs check, network)
+ *   openapi-snapshot.json == src/generated/*    (this file, hermetic)
+ *   src/generated/operations.ts == paths type   (tsc, via `satisfies`)
+ *   every row of the table is dispatchable      (api-client.test.ts)
+ *
+ * This file pins the hermetic links and proves the comparison itself can
+ * fail: a snapshot with one operation removed must be reported as drift.
+ */
+export {};
+//# sourceMappingURL=openapi-snapshot.test.d.ts.map

package/dist/__tests__/openapi-snapshot.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-snapshot.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openapi-snapshot.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/__tests__/openapi-snapshot.test.js

@@ -0,0 +1,79 @@
+/**
+ * The generated client is only as true as the chain behind it:
+ *
+ *   served document == openapi-snapshot.json   (scripts/openapi-spec.mjs check, network)
+ *   openapi-snapshot.json == src/generated/*    (this file, hermetic)
+ *   src/generated/operations.ts == paths type   (tsc, via `satisfies`)
+ *   every row of the table is dispatchable      (api-client.test.ts)
+ *
+ * This file pins the hermetic links and proves the comparison itself can
+ * fail: a snapshot with one operation removed must be reported as drift.
+ */
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import { OPERATIONS_PATH, SNAPSHOT_PATH, TYPES_PATH, diffOperations, documentSha256, listOperations, operationTable, readSnapshot, renderGenerated, } from "../../scripts/openapi-spec.mjs";
+import { API_OPERATIONS } from "../generated/operations.js";
+import { ApiClient } from "../api/client.js";
+const snapshot = readSnapshot(SNAPSHOT_PATH);
+const key = (op) => `${op.method.toUpperCase()} ${op.path}`;
+describe("openapi-snapshot.json", () => {
+    it("records the sha256 of its own document (a hand edit breaks the seal)", () => {
+        expect(documentSha256(snapshot.document)).toBe(snapshot.snapshot.sha256);
+    });
+    it("records its own operation and path counts", () => {
+        expect(listOperations(snapshot.document)).toHaveLength(snapshot.snapshot.operations);
+        expect(Object.keys(snapshot.document.paths ?? {})).toHaveLength(snapshot.snapshot.paths);
+    });
+    it("names the served URL and a fetch timestamp", () => {
+        expect(snapshot.snapshot.source).toMatch(/^https:\/\/.+\/openapi\.json$/);
+        expect(new Date(snapshot.snapshot.fetched_at).toString()).not.toBe("Invalid Date");
+    });
+});
+describe("src/generated/", () => {
+    // Regenerates 1.1 MB of types in-process: ~250 ms on a laptop, but past
+    // vitest's 5 s default on a CI runner where turbo runs every package's
+    // suite at once (it timed out there once with the code unchanged).
+    it("equals what the snapshot generates (no hand edits, no stale output)", async () => {
+        const rendered = await renderGenerated(snapshot);
+        expect(fs.readFileSync(TYPES_PATH, "utf8")).toBe(rendered.types);
+        expect(fs.readFileSync(OPERATIONS_PATH, "utf8")).toBe(rendered.operations);
+    }, 60_000);
+    it("carries every operation of the snapshot, once, in document order", () => {
+        const fromSnapshot = operationTable(snapshot.document);
+        expect(API_OPERATIONS.map(key)).toEqual(fromSnapshot.map(key));
+        expect(new Set(API_OPERATIONS.map(key)).size).toBe(API_OPERATIONS.length);
+        expect([...API_OPERATIONS]).toEqual(fromSnapshot);
+    });
+    it("is what the client enumerates as reachable", () => {
+        expect(ApiClient.operations().map(key)).toEqual(API_OPERATIONS.map(key));
+    });
+});
+describe("diffOperations (the comparison the served check relies on)", () => {
+    it("reports nothing for an identical document", () => {
+        expect(diffOperations(snapshot.document, snapshot.document)).toEqual({
+            added: [],
+            removed: [],
+            changed: [],
+            schemas: [],
+        });
+    });
+    it("goes red when one operation is removed from the snapshot (positive control)", () => {
+        const first = listOperations(snapshot.document)[0];
+        const edited = structuredClone(snapshot.document);
+        delete edited.paths[first.path][first.method];
+        const diff = diffOperations(edited, snapshot.document);
+        expect(diff.added).toEqual([key(first)]);
+        expect(diff.removed).toEqual([]);
+        expect(documentSha256(edited)).not.toBe(snapshot.snapshot.sha256);
+    });
+    it("reports an operation whose definition changed, and a schema that changed", () => {
+        const edited = structuredClone(snapshot.document);
+        const wallet = edited.paths["/v1/wallets/{id}"].get;
+        wallet.description = "edited";
+        edited.components.schemas.Wallet.description = "edited";
+        const diff = diffOperations(snapshot.document, edited);
+        expect(diff.changed).toEqual(["GET /v1/wallets/{id}"]);
+        expect(diff.schemas).toEqual(["Wallet"]);
+    });
+});
+//# sourceMappingURL=openapi-snapshot.test.js.map

package/dist/__tests__/openapi-snapshot.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-snapshot.test.js","sourceRoot":"","sources":["../../src/__tests__/openapi-snapshot.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,eAAe,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAC7C,MAAM,GAAG,GAAG,CAAC,EAAoC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAE9F,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,EAAE,CACA,qEAAqE,EACrE,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC,EACD,MAAM,CACP,CAAC;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC;QACpD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAM,CAAC,kBAAkB,CAAE,CAAC,GAA8B,CAAC;QACjF,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC7B,MAAM,CAAC,UAAW,CAAC,OAAQ,CAAC,MAAkC,CAAC,WAAW,GAAG,QAAQ,CAAC;QACvF,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/shop.test.js

@@ -63,7 +63,7 @@ async function sessionReturning(over) {
         };
     });
     globalThis.fetch = fetchMock;
-    const session = await createSession("consumer_123", { servers: ["cobasi"] }, { baseUrl: "https://api.example.com", apiKey: "csk_live_test" });
+    const session = await createSession("consumer_123", { servers: ["cobasi"] }, { baseUrl: "https://api.example.com", apiKey: "csk_live_test", timeout: 60000 });
     return { session, calls };
 }
 const originalFetch = globalThis.fetch;

package/dist/__tests__/shop.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"shop.test.js","sourceRoot":"","sources":["../../src/__tests__/shop.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAU7D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAO9C,SAAS,QAAQ,CAAC,IAAyB;IACzC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAyB;IAIvD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,IAAwB,EAAE,EAAE;QACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAGzC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;gBACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG;aACtB,CAAC;QACJ,CAAC;QACD,iBAAiB;QACjB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACjB,EAAE,EAAE,UAAU;gBACd,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,IAAI;aAChB,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,KAAK,GAAG,SAAoC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,cAAc,EACd,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,eAAe,EAAE,CAChE,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,IAAI,GAAqB;YAC7B,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE;gBACR;oBACE,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,OAAO;oBACd,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAChD;aACF;SACF,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAa;YACrB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,EAAE;SACV,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,oCAAoC;QACpC,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,MAAM,GAAqB,MAAM,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAC/C,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAuB;YAC/B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5C,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAqB;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,2BAA2B;SAC9C,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,iBAAiB;YACzB,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,8DAA8D;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAuB,MAAM,CAAC,gBAAgB,CAAC;YACxD,MAAM,KAAK,GAAuB,MAAM,CAAC,WAAW,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAqB;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,gCAAgC;SACxC,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,iBAAiB;YACzB,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,GAAG,GAAuB,MAAM,CAAC,KAAK,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,CAAC,CAAa,EAAU,EAAE;YACtC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,mBAAmB;gBACnB,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjD,2DAA2D;gBAC3D,OAAO,CAAC,CAAC,mBAAmB,CAAC;YAC/B,CAAC;YACD,mBAAmB;YACnB,OAAO,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QACnD,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"shop.test.js","sourceRoot":"","sources":["../../src/__tests__/shop.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAU7D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAO9C,SAAS,QAAQ,CAAC,IAAyB;IACzC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAyB;IAIvD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,IAAwB,EAAE,EAAE;QACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAGzC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;gBACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG;aACtB,CAAC;QACJ,CAAC;QACD,iBAAiB;QACjB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACjB,EAAE,EAAE,UAAU;gBACd,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,IAAI;aAChB,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,KAAK,GAAG,SAAoC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,cAAc,EACd,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAChF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,IAAI,GAAqB;YAC7B,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE;gBACR;oBACE,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,OAAO;oBACd,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAChD;aACF;SACF,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAa;YACrB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,EAAE;SACV,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,oCAAoC;QACpC,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,MAAM,GAAqB,MAAM,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAC/C,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAuB;YAC/B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5C,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAqB;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,2BAA2B;SAC9C,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,iBAAiB;YACzB,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,8DAA8D;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAuB,MAAM,CAAC,gBAAgB,CAAC;YACxD,MAAM,KAAK,GAAuB,MAAM,CAAC,WAAW,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAqB;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,gCAAgC;SACxC,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,iBAAiB;YACzB,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,GAAG,GAAuB,MAAM,CAAC,KAAK,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,CAAC,CAAa,EAAU,EAAE;YACtC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,mBAAmB;gBACnB,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjD,2DAA2D;gBAC3D,OAAO,CAAC,CAAC,mBAAmB,CAAC;YAC/B,CAAC;YACD,mBAAmB;YACnB,OAAO,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QACnD,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/stream-timeout.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stream-timeout.test.d.ts.map

package/dist/__tests__/stream-timeout.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-timeout.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/stream-timeout.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/stream-timeout.test.js

@@ -0,0 +1,335 @@
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { CodeSpar } from "../index.js";
+import { TimeoutError } from "../errors.js";
+const realFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = realFetch; vi.useRealTimers(); });
+function sse(chunks, gapMs) {
+    const enc = new TextEncoder();
+    let i = 0;
+    return new ReadableStream({
+        pull(ctrl) {
+            if (i >= chunks.length)
+                return new Promise(() => { }); // then idle forever
+            const c = chunks[i++];
+            return new Promise((r) => setTimeout(() => { ctrl.enqueue(enc.encode(c)); r(); }, gapMs));
+        },
+    });
+}
+function sessionCreate() {
+    return { ok: true, status: 201, text: async () => "", json: async () => ({
+            id: "ses_s", org_id: "o", user_id: "u", servers: [],
+            status: "active", created_at: new Date().toISOString(), closed_at: null,
+        }) };
+}
+function trackedSse(chunks, gapMs) {
+    const enc = new TextEncoder();
+    let i = 0;
+    const state = { cancelled: false };
+    const stream = new ReadableStream({
+        pull(ctrl) {
+            if (i >= chunks.length)
+                return new Promise(() => { });
+            const c = chunks[i++];
+            return new Promise((r) => setTimeout(() => { ctrl.enqueue(enc.encode(c)); r(); }, gapMs));
+        },
+        cancel() { state.cancelled = true; },
+    });
+    return { stream, state };
+}
+describe("stream idle timeout", () => {
+    it("delivers TimeoutError even when reader.cancel() never resolves", async () => {
+        // Pathological/degraded stream: cancel() returns a promise that
+        // never settles. Parser cleanup must not block delivery of the
+        // timeout to the caller.
+        const enc = new TextEncoder();
+        let sent = false;
+        const stream = new ReadableStream({
+            pull(ctrl) {
+                if (sent)
+                    return new Promise(() => { }); // idle forever after 1 event
+                sent = true;
+                ctrl.enqueue(enc.encode('event: assistant_text\ndata: {"content":"hi","iteration":1}\n\n'));
+            },
+            cancel() { return new Promise(() => { }); }, // never resolves
+        });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: stream });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 50 });
+        const session = await cs.create("u");
+        await expect(async () => {
+            for await (const _ of session.sendStream("hi")) { /* drain */ }
+        }).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+    it("sendStream throws TimeoutError when the stream goes idle past the window", async () => {
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: sse(['event: assistant_text\ndata: {"content":"hi","iteration":1}\n\n'], 0) });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 50 });
+        const session = await cs.create("u");
+        await expect(async () => {
+            for await (const _ of session.sendStream("hi")) { /* drain; stream idles after 1 event */ }
+        }).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+    it("sendStream times out when the initial fetch never returns headers/body", async () => {
+        // Backend accepts the connection but never sends SSE headers/body.
+        // Mirrors native fetch: hangs until the signal aborts, then rejects
+        // with the signal reason.
+        globalThis.fetch = ((url, init) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return new Promise((_res, rej) => {
+                init?.signal?.addEventListener("abort", () => rej(init.signal.reason), { once: true });
+            });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 50 });
+        const session = await cs.create("u");
+        await expect(async () => {
+            for await (const _ of session.sendStream("hi")) { /* never reached */ }
+        }).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+    it("paymentStatusStream times out when the initial fetch never returns headers/body", async () => {
+        globalThis.fetch = ((url, init) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return new Promise((_res, rej) => {
+                init?.signal?.addEventListener("abort", () => rej(init.signal.reason), { once: true });
+            });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 10_000 });
+        const session = await cs.create("u");
+        await expect(session.paymentStatusStream("tc1", { timeout: 50, onUpdate() { } })).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+    it("paymentStatusStream stays alive while only heartbeat frames arrive", async () => {
+        // Healthy long-pending flow: snapshot, then several SSE comment
+        // heartbeats spaced below the idle window across more than one
+        // window, then a terminal done. Heartbeats are complete frames —
+        // they must keep the stream alive (parity with Python httpx, whose
+        // read timeout is reset by any incoming bytes).
+        const snapshot = 'event: snapshot\ndata: {"tool_call_id":"tc1","payment_status":"pending","idempotency_key":null,"original_status":"success","hosted_url":null,"events":[]}\n\n';
+        const done = 'event: done\ndata: {}\n\n';
+        const enc = new TextEncoder();
+        let stopped = false;
+        let step = 0;
+        // timeout 80ms; heartbeat every 40ms × 5 = 200ms (> 2 windows).
+        const stream = new ReadableStream({
+            pull(ctrl) {
+                return new Promise((r) => setTimeout(() => {
+                    if (stopped)
+                        return r();
+                    if (step === 0)
+                        ctrl.enqueue(enc.encode(snapshot));
+                    else if (step <= 5)
+                        ctrl.enqueue(enc.encode(":heartbeat\n\n"));
+                    else {
+                        ctrl.enqueue(enc.encode(done));
+                        ctrl.close();
+                    }
+                    step++;
+                    r();
+                }, step === 0 ? 0 : 40));
+            },
+            cancel() { stopped = true; },
+        });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: stream });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 10_000 });
+        const session = await cs.create("u");
+        const result = await session.paymentStatusStream("tc1", { timeout: 80, onUpdate() { } });
+        expect(result.payment_status).toBe("pending");
+    }, 5000);
+    it("cancels the response body when the idle timeout fires", async () => {
+        const { stream, state } = trackedSse(['event: assistant_text\ndata: {"content":"hi","iteration":1}\n\n'], 0);
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: stream });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 50 });
+        const session = await cs.create("u");
+        await expect(async () => {
+            for await (const _ of session.sendStream("hi")) { /* drain */ }
+        }).rejects.toBeInstanceOf(TimeoutError);
+        expect(state.cancelled).toBe(true);
+    }, 5000);
+    it("propagates the caller's abort reason (not TimeoutError) and cancels the body", async () => {
+        const { stream, state } = trackedSse([], 0); // never emits
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: stream });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 10_000 });
+        const session = await cs.create("u");
+        const ac = new AbortController();
+        const reason = new DOMException("user cancelled", "AbortError");
+        const iterate = (async () => {
+            // CallOptions is part of the public Session contract — no cast needed.
+            for await (const _ of session.sendStream("hi", { signal: ac.signal })) { /* drain */ }
+        })();
+        queueMicrotask(() => ac.abort(reason));
+        await expect(iterate).rejects.toBe(reason);
+        expect(state.cancelled).toBe(true);
+    }, 5000);
+    it("paymentStatusStream: per-call timeout overrides the client default", async () => {
+        // Stream emits one snapshot frame then idles forever.
+        const snapshotFrame = 'event: snapshot\ndata: {"tool_call_id":"tc1","payment_status":"pending","idempotency_key":null,"original_status":"success","hosted_url":null,"events":[]}\n\n';
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            // Any payment-status/stream URL: emit one frame then idle forever.
+            return Promise.resolve({ ok: true, body: sse([snapshotFrame], 0) });
+        });
+        // Client default is intentionally large; per-call override is 50 ms.
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 10_000 });
+        const session = await cs.create("u");
+        await expect(session.paymentStatusStream("tc1", { timeout: 50, onUpdate() { } })).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+    it("drains a steady multi-frame stream without timing out", async () => {
+        const frames = Array.from({ length: 12 }, (_, n) => `event: assistant_text\ndata: {"content":"c${n}","iteration":${n}}\n\n`);
+        // Use a stream that closes (ctrl.close()) after all frames so the parser
+        // sees done=true rather than idling forever post-last-frame.
+        const enc = new TextEncoder();
+        let fi = 0;
+        const closingStream = new ReadableStream({
+            pull(ctrl) {
+                if (fi >= frames.length) {
+                    ctrl.close();
+                    return;
+                }
+                const c = frames[fi++];
+                return new Promise((r) => setTimeout(() => { ctrl.enqueue(enc.encode(c)); r(); }, 5));
+            },
+        });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: closingStream });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 500 });
+        const session = await cs.create("u");
+        let count = 0;
+        for await (const ev of session.sendStream("hi")) {
+            if (ev.type === "assistant_text")
+                count++;
+        }
+        expect(count).toBe(12);
+    }, 5000);
+    it("does not time out when the consumer is slow between events", async () => {
+        // Network delivers two frames promptly; the consumer spends longer
+        // than the idle window processing the first one. The idle timer is
+        // a TRANSPORT idle timeout — consumer processing time must not count
+        // against it, otherwise healthy streams with heavy per-event work
+        // false-timeout.
+        const enc = new TextEncoder();
+        const frames = [
+            'event: assistant_text\ndata: {"content":"a","iteration":0}\n\n',
+            'event: assistant_text\ndata: {"content":"b","iteration":1}\n\n',
+        ];
+        let fi = 0;
+        // highWaterMark 0 → pull only fires on an actual read(), so the
+        // post-sleep read genuinely waits on the network instead of
+        // replaying a pre-buffered frame (which would mask the bug).
+        const closing = new ReadableStream({
+            pull(ctrl) {
+                if (fi >= frames.length) {
+                    ctrl.close();
+                    return;
+                }
+                const c = frames[fi++];
+                return new Promise((r) => setTimeout(() => { ctrl.enqueue(enc.encode(c)); r(); }, 10));
+            },
+        }, { highWaterMark: 0 });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: closing });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 80 });
+        const session = await cs.create("u");
+        let count = 0;
+        for await (const ev of session.sendStream("hi")) {
+            if (ev.type === "assistant_text") {
+                count++;
+                // Heavy per-event work, longer than the 80ms idle window.
+                await new Promise((r) => setTimeout(r, 160));
+            }
+        }
+        expect(count).toBe(2);
+    }, 5000);
+    it("handles a final unterminated frame with a slow consumer without firing the idle timer", async () => {
+        // Last frame has no trailing "\n\n"; the stream then closes, so the
+        // event is emitted from the buffer.trim() branch. A slow consumer
+        // there must not trip the idle timer (no unhandled rejection / no
+        // false timeout) — the trailing yield pauses idle too.
+        const enc = new TextEncoder();
+        const chunks = [
+            'event: assistant_text\ndata: {"content":"a","iteration":0}\n\n',
+            'event: assistant_text\ndata: {"content":"b","iteration":1}', // no \n\n
+        ];
+        let ci = 0;
+        const closing = new ReadableStream({
+            pull(ctrl) {
+                if (ci >= chunks.length) {
+                    ctrl.close();
+                    return;
+                }
+                const c = chunks[ci++];
+                return new Promise((r) => setTimeout(() => { ctrl.enqueue(enc.encode(c)); r(); }, 10));
+            },
+        }, { highWaterMark: 0 });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: closing });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 60 });
+        const session = await cs.create("u");
+        let count = 0;
+        for await (const ev of session.sendStream("hi")) {
+            if (ev.type === "assistant_text") {
+                count++;
+                await new Promise((r) => setTimeout(r, 120)); // > idle window
+            }
+        }
+        expect(count).toBe(2);
+    }, 5000);
+    it("times out on a byte trickle that never completes an SSE frame", async () => {
+        // Server dribbles bytes faster than the idle window but never emits
+        // a complete "\n\n" frame. The idle timer must reset per PARSED
+        // event, not per raw read — otherwise the trickle resets it forever
+        // and the hang is never detected.
+        const enc = new TextEncoder();
+        const partial = "event: assistant_text\n"; // no blank line → no frame
+        let stopped = false;
+        const trickle = new ReadableStream({
+            pull(ctrl) {
+                return new Promise((r) => setTimeout(() => {
+                    if (stopped)
+                        return r();
+                    ctrl.enqueue(enc.encode(partial));
+                    r();
+                }, 20));
+            },
+            cancel() { stopped = true; },
+        });
+        globalThis.fetch = ((url) => {
+            if (String(url).endsWith("/v1/sessions"))
+                return Promise.resolve(sessionCreate());
+            return Promise.resolve({ ok: true, body: trickle });
+        });
+        const cs = new CodeSpar({ apiKey: "csk_live_t", baseUrl: "https://x", timeout: 120 });
+        const session = await cs.create("u");
+        await expect(async () => {
+            for await (const _ of session.sendStream("hi")) { /* never a full frame */ }
+        }).rejects.toBeInstanceOf(TimeoutError);
+    }, 5000);
+});
+//# sourceMappingURL=stream-timeout.test.js.map