@crouton-kit/crouter 0.3.40 → 0.3.42

package/dist/hearth/control-plane/__tests__/node-message.test.js

@@ -1,60 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-// Bug-regression test (CLAUDE.md "Testing policy" #2) — locks in the P5-review
-// (mr1ganv3-e3401250) CRITICAL fix: `wakeAndExecNodeMessage` invoked a
-// nonexistent `crtr node spine msg <target> --tier <tier>` command (no `node
-// spine` branch exists, and the `msg` leaf takes its target via `--to`, not
-// positionally). Every exec exited non-zero, so `deliverTrigger` recorded
-// `failed` for every cron fire and webhook — the entire SEAM-5 delivery path
-// was dead. This test fails if the argv regresses to `node spine msg` or a
-// positional target.
-test('wakeAndExecNodeMessage runs `crtr node msg --to <target> --tier <tier>` with the body on stdin', async () => {
-    const { wakeAndExecNodeMessage, nodeMessageInternals } = await import('../node-message.js');
-    const orig = { ...nodeMessageInternals };
-    const execCalls = [];
-    nodeMessageInternals.getHomeById = ((home_id) => ({
-        home_id,
-        tenant_id: 't1',
-        user_id: 'u1',
-        provider: 'blaxel',
-        provider_sandbox_id: 'sbx-1',
-        provider_volume_id: null,
-        preview_endpoint: null,
-        home_agent_target: 'home-agent-1',
-        relay_auth_ref: null,
-        status: 'running',
-        template_version: null,
-        last_ready_at: null,
-        last_wake_at: null,
-        last_suspend_at: null,
-        last_wake_latency_ms: null,
-        health_verdict: 'healthy',
-        created_at: '2026-06-30T00:00:00.000Z',
-        updated_at: '2026-06-30T00:00:00.000Z',
-    }));
-    nodeMessageInternals.ensureAwake = async () => ({ preview_endpoint: 'https://x.example', relayToken: 'tok' });
-    nodeMessageInternals.loadM0Config = (() => ({}));
-    nodeMessageInternals.getHomeBackend = (() => ({
-        wake: async () => ({ provider_sandbox_id: 'sbx-1', provider_volume_id: null, preview_endpoint: null }),
-        suspend: async () => ({ provider_sandbox_id: 'sbx-1', provider_volume_id: null, preview_endpoint: null }),
-        getMachine: async () => null,
-        exec: async (machineId, input) => {
-            execCalls.push({ machineId, argv: input.argv, stdin: input.stdin });
-            return { exitCode: 0, timedOut: false, stdout: '', stderr: '' };
-        },
-    }));
-    try {
-        await wakeAndExecNodeMessage('h1', '{"source":"cron","trigger_id":"f1"}', 'urgent');
-        assert.equal(execCalls.length, 1);
-        const call = execCalls[0];
-        assert.equal(call.machineId, 'sbx-1');
-        // The real CLI form: `crtr node msg --to <target> --tier <tier>` — never
-        // `node spine msg` and never a positional target.
-        assert.deepEqual(call.argv, ['crtr', 'node', 'msg', '--to', 'home-agent-1', '--tier', 'urgent']);
-        assert.equal(call.argv.includes('spine'), false);
-        assert.equal(call.stdin, '{"source":"cron","trigger_id":"f1"}');
-    }
-    finally {
-        Object.assign(nodeMessageInternals, orig);
-    }
-});

package/dist/hearth/control-plane/__tests__/oauth-serving-marker.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/control-plane/__tests__/oauth-serving-marker.test.js

@@ -1,44 +0,0 @@
-// Regression test for the P2 review Major fix: a stale, abandoned OAuth
-// marker must not make a later `beginOAuth` on the same home read as
-// non-serving. See serving.ts's `beginOAuth`/`oauthMarkerLive`.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mock } from 'node:test';
-import { beginOAuth, endOAuth, isHomeServing, resetServingForTests } from '../serving.js';
-const HOME = 'home-oauth-marker-test';
-const OAUTH_MARKER_TTL_MS = 5 * 60_000;
-test('a second beginOAuth refreshes a stale marker and stays live until both finishes land', () => {
-    resetServingForTests();
-    mock.timers.enable({ apis: ['Date'] });
-    try {
-        // Start A begins an OAuth window; it is immediately serving.
-        beginOAuth(HOME);
-        assert.equal(isHomeServing(HOME), true, 'start A should mark the home as serving');
-        // Start A is abandoned: advance the clock past the 5-minute TTL with no
-        // matching endOAuth. The marker goes stale, but the counter (1) is still
-        // positive because start A was never finished.
-        mock.timers.tick(OAUTH_MARKER_TTL_MS + 1_000);
-        assert.equal(isHomeServing(HOME), false, 'a stale marker with no refresh must read as not-serving');
-        // Start B is a fresh retry on the same home. Per the fix, beginOAuth
-        // refreshes oauthStartedAt on EVERY call, not only when the counter
-        // transitions from 0 — so B's own window must read as live immediately.
-        beginOAuth(HOME);
-        assert.equal(isHomeServing(HOME), true, 'a second beginOAuth must refresh the marker and read as serving');
-        // B's window survives well past when A's original (unrefreshed) TTL
-        // would have expired, proving the refresh — not the original timestamp
-        // — is what's being judged now.
-        mock.timers.tick(OAUTH_MARKER_TTL_MS - 1_000);
-        assert.equal(isHomeServing(HOME), true, 'B\'s window must still be live before its own TTL elapses');
-        // A late finish for start A arrives: counter floors from 2 -> 1. Still
-        // serving, because B's own start/finish window has not closed yet.
-        endOAuth(HOME);
-        assert.equal(isHomeServing(HOME), true, 'one matched finish (of two starts) must not end serving early');
-        // B finishes: counter 1 -> 0, marker cleared, no longer serving.
-        endOAuth(HOME);
-        assert.equal(isHomeServing(HOME), false, 'both starts matched by a finish must end serving');
-    }
-    finally {
-        mock.timers.reset();
-        resetServingForTests();
-    }
-});

package/dist/hearth/control-plane/__tests__/rate-limit-recurrence.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/control-plane/__tests__/rate-limit-recurrence.test.js

@@ -1,49 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { createRateLimiter } from '../ingress/rate-limit.js';
-import { computeNextFire } from '../scheduler/recurrence.js';
-// Category-2 (rate limiter) + category-3 (recurrence) test. The rate-limiter
-// case locks the fix for an observed bug found during P5.5 implementation: an
-// over-eager idle-prune deleted a per-key bucket right after its first draw,
-// so per-key limiting never actually bit. The recurrence case locks the custom
-// interval-parsing + timezone plumbing (my code, not cron-parser's) that cron
-// firing depends on.
-test('the per-key token bucket actually limits a burst and refills over time', () => {
-    let nowMs = 1_000_000;
-    const limiter = createRateLimiter({ capacity: 3, refillPerSec: 1, globalCapacity: 1_000, globalRefillPerSec: 1_000, now: () => nowMs });
-    // Three tokens available for one key, then it trips (the prune bug would let
-    // every request through by resetting the bucket to full each call).
-    assert.equal(limiter.checkRate('k').ok, true);
-    assert.equal(limiter.checkRate('k').ok, true);
-    assert.equal(limiter.checkRate('k').ok, true);
-    const tripped = limiter.checkRate('k');
-    assert.equal(tripped.ok, false);
-    assert.equal(typeof tripped.retryAfterMs, 'number');
-    // A different key has its own independent bucket.
-    assert.equal(limiter.checkRate('other').ok, true);
-    // After ~2s one key refills 2 tokens.
-    nowMs += 2_000;
-    assert.equal(limiter.checkRate('k').ok, true);
-    assert.equal(limiter.checkRate('k').ok, true);
-    assert.equal(limiter.checkRate('k').ok, false);
-});
-test('the global ceiling sheds a flood spread across many distinct keys', () => {
-    let nowMs = 0;
-    const limiter = createRateLimiter({ capacity: 100, refillPerSec: 100, globalCapacity: 5, globalRefillPerSec: 0.0001, now: () => nowMs });
-    let ok = 0;
-    for (let i = 0; i < 20; i++) {
-        if (limiter.checkRate(`key-${i}`).ok)
-            ok += 1;
-    }
-    assert.equal(ok, 5); // global ceiling caps total admits regardless of key spread
-});
-test('computeNextFire handles cron expressions, timezones, and @every intervals', () => {
-    assert.equal(computeNextFire('*/5 * * * *', 'UTC', '2026-06-30T12:01:00.000Z'), '2026-06-30T12:05:00.000Z');
-    // Interval form is timezone-independent, strictly after `after`.
-    assert.equal(computeNextFire('@every 30m', 'America/New_York', '2026-06-30T12:00:00.000Z'), '2026-06-30T12:30:00.000Z');
-    assert.equal(computeNextFire('@every 90s', 'UTC', '2026-06-30T12:00:00.000Z'), '2026-06-30T12:01:30.000Z');
-    // A tz-bearing daily schedule resolves to the correct UTC instant: 09:00
-    // EDT the same day is 13:00 UTC (after 08:00 EDT / 12:00 UTC).
-    assert.equal(computeNextFire('0 9 * * *', 'America/New_York', '2026-06-30T12:00:00.000Z'), '2026-06-30T13:00:00.000Z');
-    assert.throws(() => computeNextFire('not a cron', 'UTC', '2026-06-30T12:00:00.000Z'));
-});

package/dist/hearth/control-plane/__tests__/relay-security.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/control-plane/__tests__/relay-security.test.js

@@ -1,314 +0,0 @@
-import assert from 'node:assert/strict';
-import { EventEmitter } from 'node:events';
-import http from 'node:http';
-import { test } from 'node:test';
-import { WebSocket, WebSocketServer } from 'ws';
-import { buildUpstreamHttpUrl, proxyHttp, proxyUpgrade } from '../relay.js';
-// Category-3 test (CLAUDE.md "Testing policy" #3 — load-bearing Hearth/CP
-// security regression). Approved by Silas 2026-06-30 as a narrow carve-out
-// after the P4.3 relay review (mr16xp6d-2a5061f5 / mr16z2lz-3cd35b0c) found
-// these exact invariants had zero durable coverage — only a throwaway smoke
-// that was deleted after the implementation pass. The invariants below are
-// the ones part-plan T3.2's acceptance checks and design.md's R-CP-2/R-CP-3/
-// R-CP-6 non-negotiables name explicitly:
-//   - R-CP-3: the browser leg never supplies, and never sees reflected, the
-//     CP->home relay token; the home leg sees ONLY `Authorization: Bearer
-//     <relayToken>`.
-//   - criterion 4 (origin-form-only request target): scheme-relative,
-//     absolute, raw/encoded-backslash, and encoded-CRLF request targets are
-//     rejected before any upstream contact (open-proxy/SSRF prevention).
-//   - R-CP-2/R-CP-6: `home` is resolved once, server-side, from the
-//     caller's session; no client-supplied `?target=`/`/node/<id>` can move
-//     the request onto a different home's preview origin or node target.
-// A regression in any of these is silent (still typechecks, still serves
-// chat) and is exactly the kind of defect this carve-out exists for.
-const testConfig = {
-    host: '127.0.0.1',
-    port: 0,
-    publicOrigin: 'http://127.0.0.1:0',
-    cookieSecure: false,
-    wakeTimeoutMs: 2_000,
-    readyTimeoutMs: 2_000,
-};
-function makeHome(overrides = {}) {
-    const now = '2026-06-30T00:00:00.000Z';
-    return {
-        home_id: 'home-a',
-        tenant_id: 'tenant-1',
-        user_id: 'user-1',
-        provider: 'blaxel',
-        provider_sandbox_id: 'sandbox-a',
-        provider_volume_id: 'volume-a',
-        preview_endpoint: 'https://home-a.example.invalid',
-        home_agent_target: 'node-a',
-        relay_auth_ref: 'ref-a',
-        status: 'running',
-        template_version: null,
-        last_ready_at: null,
-        last_wake_at: null,
-        last_suspend_at: null,
-        last_wake_latency_ms: null,
-        health_verdict: 'healthy',
-        created_at: now,
-        updated_at: now,
-        ...overrides,
-    };
-}
-// --- Minimal req/res fakes (same shape as wake-proxy/__tests__'s FakeReq/
-// FakeRes — only the surface proxyHttp actually touches). ------------------
-class FakeReq extends EventEmitter {
-    url;
-    method;
-    headers;
-    constructor(path, headers = {}, method = 'GET') {
-        super();
-        this.url = path;
-        this.method = method;
-        this.headers = headers;
-    }
-}
-class FakeRes extends EventEmitter {
-    statusCode = 200;
-    statusMessage = '';
-    headersSent = false;
-    writableEnded = false;
-    headers = new Map();
-    chunks = [];
-    socket = { setNoDelay() { } };
-    setHeader(name, value) {
-        this.headers.set(name.toLowerCase(), value);
-    }
-    getHeader(name) {
-        return this.headers.get(name.toLowerCase());
-    }
-    hasHeader(name) {
-        return this.headers.has(name.toLowerCase());
-    }
-    writeHead(code, headers) {
-        this.statusCode = code;
-        this.headersSent = true;
-        if (headers)
-            for (const [k, v] of Object.entries(headers))
-                this.setHeader(k, v);
-    }
-    flushHeaders() {
-        this.headersSent = true;
-    }
-    write(chunk) {
-        this.headersSent = true;
-        this.chunks.push(Buffer.from(chunk));
-        return true;
-    }
-    end(chunk) {
-        this.headersSent = true;
-        if (chunk !== undefined)
-            this.chunks.push(Buffer.from(chunk));
-        this.writableEnded = true;
-        this.emit('finish');
-    }
-    destroy() {
-        this.writableEnded = true;
-    }
-    body() {
-        return Buffer.concat(this.chunks).toString('utf8');
-    }
-}
-function asReq(req) {
-    return req;
-}
-function asRes(res) {
-    return res;
-}
-async function listen(server) {
-    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-    const address = server.address();
-    if (address === null || typeof address === 'string')
-        throw new Error('expected a network address');
-    return {
-        origin: `http://127.0.0.1:${address.port}`,
-        close: () => new Promise((resolve) => server.close(() => resolve())),
-    };
-}
-// --- 1. HTTP browser->home header/token isolation -------------------------
-test('proxyHttp: browser auth/cookie/forwarding headers never reach upstream; only the relay Bearer token does; the token is never reflected to the browser', async () => {
-    let captured = null;
-    const upstream = http.createServer((req, res) => {
-        captured = req.headers;
-        // Deliberately reflect the relay token back in the response, the way a
-        // misbehaving or compromised home might — this is what makes the
-        // browser-side assertion below non-vacuous.
-        res.writeHead(200, { 'content-type': 'text/plain', authorization: 'Bearer RELAY_TOKEN_A' });
-        res.end('upstream-ok');
-    });
-    const { origin, close } = await listen(upstream);
-    try {
-        const req = new FakeReq('/views/chat', {
-            authorization: 'Bearer BROWSER_OWN_TOKEN',
-            cookie: 'session=browser-cookie',
-            forwarded: 'for=1.2.3.4;proto=https',
-            'x-forwarded-for': '1.2.3.4',
-            'x-forwarded-proto': 'https',
-            'x-forwarded-host': 'evil.example',
-            'x-real-ip': '1.2.3.4',
-            'proxy-authorization': 'Basic evil',
-            'sec-websocket-key': 'not-a-real-ws-request',
-            'x-keep-me': 'safe-custom-header',
-        });
-        const res = new FakeRes();
-        await proxyHttp(asReq(req), asRes(res), makeHome(), {
-            ensureAwake: async () => ({ preview_endpoint: origin, relayToken: 'RELAY_TOKEN_A' }),
-            resolveRunning: () => null,
-            invalidateWarmVerdict: () => undefined,
-            loadConfig: () => testConfig,
-        });
-        assert.equal(res.statusCode, 200);
-        assert.equal(res.body(), 'upstream-ok');
-        assert.ok(captured, 'upstream must have received the forwarded request');
-        const upstreamHeaders = captured;
-        assert.equal(upstreamHeaders.authorization, 'Bearer RELAY_TOKEN_A', 'upstream must see only the relay token');
-        assert.equal(upstreamHeaders.cookie, undefined, 'browser cookie must not reach upstream');
-        assert.equal(upstreamHeaders.forwarded, undefined, 'client-supplied Forwarded must not reach upstream');
-        assert.equal(upstreamHeaders['x-forwarded-for'], undefined);
-        assert.equal(upstreamHeaders['x-forwarded-proto'], undefined);
-        assert.equal(upstreamHeaders['x-forwarded-host'], undefined);
-        assert.equal(upstreamHeaders['x-real-ip'], undefined);
-        assert.equal(upstreamHeaders['proxy-authorization'], undefined);
-        assert.equal(upstreamHeaders['sec-websocket-key'], undefined);
-        assert.equal(upstreamHeaders['x-keep-me'], 'safe-custom-header', 'a safe custom header must still pass through');
-        assert.equal(res.getHeader('authorization'), undefined, 'an upstream-reflected relay token must never reach the browser response');
-    }
-    finally {
-        await close();
-    }
-});
-// --- 2. Origin-form / SSRF rejection --------------------------------------
-test('buildUpstreamHttpUrl: rejects dangerous request targets before any upstream contact', () => {
-    const previewEndpoint = 'https://home-a.example.invalid';
-    const dangerous = [
-        '//evil.example.com/path',
-        'http://evil.example.com/path',
-        '\\evil.example.com/path',
-        '%5Cevil.example.com/path',
-        '%0d%0aHost:%20evil.example.com',
-    ];
-    for (const target of dangerous) {
-        assert.throws(() => buildUpstreamHttpUrl(previewEndpoint, target), `expected rejection for: ${target}`);
-    }
-});
-test('buildUpstreamHttpUrl: accepts an ordinary origin-form target and stays on the home origin', () => {
-    const url = buildUpstreamHttpUrl('https://home-a.example.invalid', '/views/chat?x=1');
-    assert.equal(url.origin, 'https://home-a.example.invalid');
-    assert.equal(url.pathname, '/views/chat');
-});
-// --- 3. Cross-home/target isolation ---------------------------------------
-test('proxyHttp: a session-resolved home A is never widened by a client ?target= to home B', async () => {
-    let hitsA = 0;
-    let hitsB = 0;
-    const upstreamA = http.createServer((_req, res) => {
-        hitsA += 1;
-        res.writeHead(200);
-        res.end('home-a-ok');
-    });
-    const upstreamB = http.createServer((_req, res) => {
-        hitsB += 1;
-        res.writeHead(200);
-        res.end('home-b-ok');
-    });
-    const a = await listen(upstreamA);
-    const b = await listen(upstreamB);
-    try {
-        const req = new FakeReq('/views/chat?target=home-b');
-        const res = new FakeRes();
-        let ensureAwakeAskedFor = null;
-        let resolveRunningAskedFor = null;
-        await proxyHttp(asReq(req), asRes(res), makeHome({ home_id: 'home-a' }), {
-            ensureAwake: async (home_id) => {
-                ensureAwakeAskedFor = home_id;
-                // The relay's only home-selection input is the `home` row it was
-                // called with — never the request's own query string.
-                if (home_id !== 'home-a')
-                    return { preview_endpoint: b.origin, relayToken: 'RELAY_TOKEN_B' };
-                return { preview_endpoint: a.origin, relayToken: 'RELAY_TOKEN_A' };
-            },
-            resolveRunning: (home_id) => {
-                resolveRunningAskedFor = home_id;
-                return null;
-            },
-            invalidateWarmVerdict: () => undefined,
-            loadConfig: () => testConfig,
-        });
-        assert.equal(resolveRunningAskedFor, 'home-a', 'resolveRunning must be asked for the session-resolved home, never a client-supplied target');
-        assert.equal(ensureAwakeAskedFor, 'home-a', 'ensureAwake must be asked for the session-resolved home, never a client-supplied target');
-        assert.equal(res.body(), 'home-a-ok');
-        assert.equal(hitsA, 1);
-        assert.equal(hitsB, 0, 'home B must never be contacted for a home-A-resolved request');
-    }
-    finally {
-        await Promise.all([a.close(), b.close()]);
-    }
-});
-test('proxyUpgrade: WS upstream target is always home.home_agent_target, never the client-claimed /node/<id> path or ?target=', async () => {
-    let upstreamAHits = [];
-    let upstreamBHits = 0;
-    const wssA = new WebSocketServer({ port: 0 });
-    wssA.on('connection', (ws, req) => {
-        upstreamAHits.push({ url: req.url, authorization: req.headers.authorization, cookie: req.headers.cookie });
-        ws.on('message', (data) => ws.send(data));
-    });
-    const wssB = new WebSocketServer({ port: 0 });
-    wssB.on('connection', () => {
-        upstreamBHits += 1;
-    });
-    const aPort = wssA.address().port;
-    const bPort = wssB.address().port;
-    const home = makeHome({ home_id: 'home-a', home_agent_target: 'node-a' });
-    let ensureAwakeAskedFor = null;
-    const relayServer = http.createServer((_req, res) => {
-        res.writeHead(404);
-        res.end();
-    });
-    relayServer.on('upgrade', (req, socket, head) => {
-        proxyUpgrade(req, socket, head, home, {
-            ensureAwake: async (home_id) => {
-                ensureAwakeAskedFor = home_id;
-                // Same DI seam as the HTTP cross-home test: a regression that derived
-                // the wake target from the client's `?target=` would make this
-                // resolve to home B's listener, and the assertions below would catch
-                // the resulting connection landing on wssB instead of wssA.
-                if (home_id !== 'home-a')
-                    return { preview_endpoint: `http://127.0.0.1:${bPort}`, relayToken: 'RELAY_TOKEN_B' };
-                return { preview_endpoint: `http://127.0.0.1:${aPort}`, relayToken: 'RELAY_TOKEN_A' };
-            },
-            loadConfig: () => testConfig,
-        });
-    });
-    const relay = await listen(relayServer);
-    let client = null;
-    try {
-        client = new WebSocket(`${relay.origin.replace('http://', 'ws://')}/node/some-other-client-claimed-id?target=home-b`, {
-            headers: { authorization: 'Bearer BROWSER_OWN_TOKEN', cookie: 'session=browser-cookie' },
-        });
-        const echoed = await new Promise((resolve, reject) => {
-            client.once('open', () => client.send('ping'));
-            client.once('message', (data) => resolve(data.toString()));
-            client.once('error', reject);
-        });
-        assert.equal(echoed, 'ping');
-        assert.equal(ensureAwakeAskedFor, 'home-a', 'ensureAwake must be asked for the session-resolved home, never the client-claimed path/target');
-        assert.equal(upstreamAHits.length, 1);
-        assert.equal(upstreamAHits[0]?.url, '/node/node-a', 'upstream path must be the server-resolved home_agent_target, not the client path/target');
-        assert.equal(upstreamAHits[0]?.authorization, 'Bearer RELAY_TOKEN_A');
-        assert.equal(upstreamAHits[0]?.cookie, undefined, 'the browser cookie must never reach the upstream websocket');
-        assert.equal(upstreamBHits, 0, 'home B must never receive a connection for a home-A-resolved request');
-    }
-    finally {
-        if (client) {
-            if (client.readyState === WebSocket.OPEN || client.readyState === WebSocket.CONNECTING) {
-                client.terminate();
-            }
-        }
-        await new Promise((resolve) => wssA.close(() => resolve()));
-        await new Promise((resolve) => wssB.close(() => resolve()));
-        await relay.close();
-    }
-});

package/dist/hearth/control-plane/__tests__/scheduler-scan-loop.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/control-plane/__tests__/scheduler-scan-loop.test.js

@@ -1,133 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { runSchedulerScan } from '../scheduler/scan-loop.js';
-// Category-3 test (CLAUDE.md "Testing policy" #3 — load-bearing Hearth/CP
-// regression). Invariant: master plan P5.4 / part-plan T-C1 R-CRON-3 — the CP
-// cron scan is idempotent and restart-safe. A due schedule fires exactly once
-// per slot even across repeated scans, and a fire left `waking` by a crashed
-// CP is re-driven to a SINGLE delivery, never a double. A regression here is
-// silent (still typechecks) and directly re-introduces the double-fire failure
-// mode this ledger exists to prevent.
-const SCHEDULE = {
-    schedule_id: 's1',
-    tenant_id: 't1',
-    user_id: 'u1',
-    home_id: 'h1',
-    label: 'nightly',
-    recurrence: '*/5 * * * *',
-    timezone: 'UTC',
-    delivery_payload: { hello: 'world' },
-    next_fire_at: '2026-06-30T12:00:00.000Z',
-    last_fired_at: null,
-    enabled: true,
-    created_at: '2026-06-30T00:00:00.000Z',
-    updated_at: '2026-06-30T00:00:00.000Z',
-};
-function fireFor(schedule, state) {
-    return {
-        fire_id: 'f1',
-        schedule_id: schedule.schedule_id,
-        home_id: schedule.home_id,
-        tenant_id: schedule.tenant_id,
-        user_id: schedule.user_id,
-        scheduled_for: schedule.next_fire_at,
-        state,
-        attempts: 0,
-        last_error: null,
-        delivered_at: null,
-        created_at: schedule.created_at,
-        updated_at: schedule.updated_at,
-    };
-}
-function makeDeps(rec, overrides, outcome = { outcome: 'delivered' }) {
-    return {
-        selectDueSchedules: () => [],
-        getScheduleById: (id) => (id === SCHEDULE.schedule_id ? SCHEDULE : null),
-        claimFire: (input) => {
-            rec.claimCount += 1;
-            return { fire: fireFor(SCHEDULE, 'pending'), claimed: rec.claimCount === 1 };
-        },
-        setFireState: (fire_id, state) => {
-            rec.fireStates.push({ fire_id, state });
-        },
-        advanceNextFire: (schedule_id, next, last) => {
-            rec.advances.push({ schedule_id, next, last });
-        },
-        selectResumableFires: () => [],
-        computeNextFire: () => '2026-06-30T12:05:00.000Z',
-        deliverTrigger: async (input) => {
-            rec.deliveries.push({
-                home_id: input.home_id,
-                source_ref: input.source_ref,
-                trigger_id: input.envelope.trigger_id,
-                tier: input.tier,
-                source: input.envelope.source,
-                payload: input.envelope.payload,
-            });
-            return outcome;
-        },
-        now: () => '2026-06-30T12:00:01.000Z',
-        intervalMs: 15_000,
-        ...overrides,
-    };
-}
-function makeRecorder() {
-    return { deliveries: [], fireStates: [], advances: [], claimCount: 0 };
-}
-test('a due schedule fires exactly once with urgent tier and trigger_id == fire_id', async () => {
-    const rec = makeRecorder();
-    const deps = makeDeps(rec, { selectDueSchedules: () => [SCHEDULE] });
-    await runSchedulerScan(deps);
-    assert.equal(rec.deliveries.length, 1);
-    const d = rec.deliveries[0];
-    assert.equal(d.tier, 'urgent');
-    assert.equal(d.source, 'cron');
-    assert.equal(d.trigger_id, 'f1'); // R-CRON-5: envelope trigger_id is the durable fire_id
-    assert.equal(d.home_id, 'h1');
-    assert.deepEqual(d.payload, { hello: 'world' });
-    // next_fire_at advanced before delivery so the slot cannot be re-selected.
-    assert.deepEqual(rec.advances, [{ schedule_id: 's1', next: '2026-06-30T12:05:00.000Z', last: '2026-06-30T12:00:00.000Z' }]);
-    assert.deepEqual(rec.fireStates.map((s) => s.state), ['waking', 'delivered']);
-});
-test('the same due slot is claimed only once across repeated scans (no double fire)', async () => {
-    const rec = makeRecorder();
-    // Both scans see the schedule as due, but claimFire grants the slot once.
-    const deps = makeDeps(rec, { selectDueSchedules: () => [SCHEDULE] });
-    await runSchedulerScan(deps);
-    await runSchedulerScan(deps);
-    assert.equal(rec.claimCount, 2); // both passes attempted a claim
-    assert.equal(rec.deliveries.length, 1); // only the winning claim delivered
-});
-test('a fire left waking by a crashed CP is resumed to a single delivery, not doubled', async () => {
-    const rec = makeRecorder();
-    let resumables = [fireFor(SCHEDULE, 'waking')];
-    const deps = makeDeps(rec, {
-        selectResumableFires: () => {
-            const out = resumables;
-            resumables = []; // next scan finds it resolved
-            return out;
-        },
-        selectDueSchedules: () => [], // slot already advanced/claimed pre-crash
-    });
-    await runSchedulerScan(deps);
-    await runSchedulerScan(deps);
-    assert.equal(rec.claimCount, 0); // resume path never re-claims
-    assert.equal(rec.deliveries.length, 1); // exactly one delivery for the stranded fire
-    assert.equal(rec.deliveries[0].trigger_id, 'f1');
-});
-test('a failed delivery marks the fire failed with an incremented attempt, no retry storm', async () => {
-    const rec = makeRecorder();
-    const attemptFlags = [];
-    const deps = makeDeps(rec, {
-        selectDueSchedules: () => [SCHEDULE],
-        setFireState: (fire_id, state, options) => {
-            rec.fireStates.push({ fire_id, state });
-            if (options?.increment_attempts !== undefined)
-                attemptFlags.push(options.increment_attempts);
-        },
-    }, { outcome: 'failed', reason: 'boom' });
-    await runSchedulerScan(deps);
-    assert.deepEqual(rec.fireStates.map((s) => s.state), ['waking', 'failed']);
-    assert.deepEqual(attemptFlags, [true]);
-    assert.equal(rec.deliveries.length, 1); // one attempt; the natural next tick is the only re-fire
-});

package/dist/hearth/control-plane/__tests__/trigger-delivery.test.d.ts

@@ -1 +0,0 @@
-export {};