@fabrika/app 0.3.3 → 0.4.1

package/src/testing/preload.ts

@@ -0,0 +1,6 @@
+// @fabrika/app/testing/preload — what `fabrika db test-isolation` passes to `bun test --preload`: it captures Bun's
+// test functions before any application module loads.
+
+import { installTestRunner } from './runner'
+
+installTestRunner()

package/src/testing/proxy.ts

@@ -0,0 +1,87 @@
+// The proxy in front of the test kit's application: production's decision, proxy-core's verify service over the
+// endpoint table `contractProxyTable` compiles from the contract, asked the way the Cloudflare proxy Worker asks it.
+
+import { type ContractArtifact, DELEGATION_HEADER, ENDPOINT_HEADER, rawRequestTarget } from '@fabrika/auth-core'
+import {
+	APP_QUERY_PARAM,
+	createVerifyService,
+	DEFAULT_VERIFY_PATH,
+	type DelegationIssuer,
+	FORWARDED_HOST_HEADER,
+	FORWARDED_METHOD_HEADER,
+	FORWARDED_PROTO_HEADER,
+	FORWARDED_URI_HEADER,
+	type IamGateway,
+	PROXY_TOKEN_HEADER,
+	REQUEST_ID_HEADER,
+	type TokenCache,
+} from '@fabrika/proxy-core'
+import { contractProxyTable } from '@fabrika/proxy-core/manifest'
+
+/** What the proxy did with a request: answered it itself, or forwarded it with what only the proxy may set. */
+export type ProxyOutcome =
+	| {
+		readonly outcome: 'forward'
+		/** Every header only the proxy may assert, with the value the decision gave it. */
+		readonly asserted: ReadonlyMap<string, string>
+		/** Whether the request's own `Authorization` reaches the application: not on an anonymous endpoint. */
+		readonly keepsAuthorization: boolean
+	}
+	| { readonly outcome: 'answer'; readonly response: Response }
+
+/** What the proxy reads of a request; its headers have already lost every one a client may not assert. */
+export interface ProxiedRequest {
+	readonly method: string
+	readonly url: string
+	readonly headers: Headers
+}
+
+export type TestProxy = (request: ProxiedRequest) => Promise<ProxyOutcome>
+
+export interface EndpointProxyOptions {
+	readonly artifact: ContractArtifact
+	readonly appId: string
+	readonly host: string
+	readonly iam: IamGateway
+	readonly issuer: string
+	/** Issues the delegation grants of membership and scope-creating endpoints, as IAM does for the proxy. */
+	readonly delegations: DelegationIssuer | null
+	/** The proxy's token cache, as production keeps one; omitted, every request mints. */
+	readonly cache?: TokenCache
+}
+
+const ASSERTED_HEADERS = [PROXY_TOKEN_HEADER, REQUEST_ID_HEADER, ENDPOINT_HEADER, DELEGATION_HEADER]
+
+/** The production proxy: the verify service over the contract's endpoint table, asked the way an enforcement point asks it. */
+export function endpointProxy(options: EndpointProxyOptions): TestProxy {
+	const verify = createVerifyService({
+		manifest: {
+			apps: [{ id: options.appId, hosts: [options.host], upstream: 'app', scheme: 'https', ...contractProxyTable(options.artifact) }],
+		},
+		iam: options.iam,
+		issuer: options.issuer,
+		delegations: options.delegations,
+		...(options.cache === undefined ? {} : { cache: options.cache }),
+	})
+	const verifyUrl = `https://fabrika-proxy.internal${DEFAULT_VERIFY_PATH}?${APP_QUERY_PARAM}=${encodeURIComponent(options.appId)}`
+	return async (request) => {
+		const headers = new Headers(request.headers)
+		const target = rawRequestTarget(request.url)
+		headers.set(FORWARDED_METHOD_HEADER, request.method)
+		headers.set(FORWARDED_URI_HEADER, `${target.pathname}${target.search}`)
+		headers.set(FORWARDED_HOST_HEADER, new URL(request.url).host)
+		headers.set(FORWARDED_PROTO_HEADER, 'https')
+		const verification = await verify(new Request(verifyUrl, { method: 'GET', headers }))
+		if (!verification.ok) {
+			return { outcome: 'answer', response: verification }
+		}
+		const asserted = new Map<string, string>()
+		for (const header of ASSERTED_HEADERS) {
+			const value = verification.headers.get(header)
+			if (value !== null && value !== '') {
+				asserted.set(header, value)
+			}
+		}
+		return { outcome: 'forward', asserted, keepsAuthorization: asserted.has(PROXY_TOKEN_HEADER) }
+	}
+}

package/src/testing/runner.ts

@@ -0,0 +1,61 @@
+// The test functions the generated tests register through. The platform's run preloads `@fabrika/app/testing/preload`,
+// which captures Bun's own `test`, `describe`, `expect` and `afterAll` before any application module loads, so a
+// `mock.module('bun:test', …)` in application code cannot replace what the generated tests use. Each case counts
+// the `expect` calls it ran; one that ran none fails, whatever the runner reports.
+
+import * as bunTest from 'bun:test'
+
+interface TestRunner {
+	readonly test: typeof bunTest.test
+	readonly describe: typeof bunTest.describe
+	readonly expect: typeof bunTest.expect
+	readonly afterAll: typeof bunTest.afterAll
+}
+
+const RUNNER = Symbol.for('fabrika.test-runner')
+
+function isRunner(value: unknown): value is TestRunner {
+	return typeof value === 'object' && value !== null
+		&& ['test', 'describe', 'expect', 'afterAll'].every((name) => typeof Reflect.get(value, name) === 'function')
+}
+
+/** Captures Bun's test functions process-wide, once; the platform's preload calls it before the application loads. */
+export function installTestRunner(): void {
+	if (isRunner(Reflect.get(globalThis, RUNNER))) {
+		return
+	}
+	const captured: TestRunner = Object.freeze({ test: bunTest.test, describe: bunTest.describe, expect: bunTest.expect, afterAll: bunTest.afterAll })
+	Object.defineProperty(globalThis, RUNNER, { value: captured, writable: false, configurable: false, enumerable: false })
+}
+
+/** The captured functions, or, in a run without the preload, those this module imported. */
+function runner(): TestRunner {
+	const installed: unknown = Reflect.get(globalThis, RUNNER)
+	return isRunner(installed) ? installed : bunTest
+}
+
+let expectCalls = 0
+
+export function describe(name: string, body: () => void): void {
+	runner().describe(name, body)
+}
+
+/** Registers a case that fails unless its body ran at least one `expect`. */
+export function test(name: string, body: () => Promise<void>): void {
+	runner().test(name, async () => {
+		const before = expectCalls
+		await body()
+		if (expectCalls === before) {
+			throw new Error(`the generated case '${name}' ran no expect, so it proved nothing`)
+		}
+	})
+}
+
+export function expect<T>(value: T): ReturnType<typeof bunTest.expect<T>> {
+	expectCalls++
+	return runner().expect(value)
+}
+
+export function afterAll(body: () => Promise<void>): void {
+	runner().afterAll(body)
+}

package/src/testing/status.ts

@@ -0,0 +1,19 @@
+import { RpcError } from '../client/transport'
+
+/** The status the application refused a call with; a failure that is not its answer (no status) is rethrown. */
+export function refusalStatus(error: unknown): number {
+	if (error instanceof RpcError && error.httpStatus !== undefined) {
+		return error.httpStatus
+	}
+	throw error
+}
+
+/** A call's status: 200 when it resolves, the status the application refused it with otherwise. */
+export async function statusOf(call: Promise<unknown>): Promise<number> {
+	try {
+		await call
+		return 200
+	} catch (error) {
+		return refusalStatus(error)
+	}
+}

package/src/undumpable.ts

@@ -0,0 +1,42 @@
+// The launcher's own protection: a process that holds the provisioning credential marks itself non-dumpable before it
+// starts the application, so a process of the same user, the application among them, cannot read its
+// `/proc/<pid>/environ` or `/proc/<pid>/mem`. Linux only; elsewhere is a development machine.
+
+import { dlopen, FFIType } from 'bun:ffi'
+
+/** `PR_SET_DUMPABLE` from `<linux/prctl.h>`. */
+const PR_SET_DUMPABLE = 4
+
+/** The C library of a glibc system, then Alpine's musl one. */
+const libraries = (): readonly string[] => [
+	'libc.so.6',
+	`libc.musl-${process.arch === 'arm64' ? 'aarch64' : 'x86_64'}.so.1`,
+]
+
+function prctl(): (option: number, value: number) => number {
+	for (const library of libraries()) {
+		try {
+			const { symbols } = dlopen(library, {
+				prctl: { args: [FFIType.i32, FFIType.u64, FFIType.u64, FFIType.u64, FFIType.u64], returns: FFIType.i32 },
+			})
+			return (option, value) => symbols.prctl(option, value, 0, 0, 0)
+		} catch {
+			// The next candidate.
+		}
+	}
+	throw new Error('the launcher found no C library to call prctl in')
+}
+
+/**
+ * Makes this process non-dumpable. On Linux a failure throws: the launcher must not start the application readable.
+ * Elsewhere it warns once and returns, because no deployment runs there.
+ */
+export function makeProcessUndumpable(): void {
+	if (process.platform !== 'linux') {
+		console.warn(`fabrika: ${process.platform} has no prctl; the launcher stays readable by processes of the same user (development only)`)
+		return
+	}
+	if (prctl()(PR_SET_DUMPABLE, 0) !== 0) {
+		throw new Error('the launcher could not make itself non-dumpable (prctl PR_SET_DUMPABLE)')
+	}
+}

package/src/app.ts

@@ -1,76 +0,0 @@
-// ─── Application ─────────────────────────────────────────────────────
-//
-// `defineApp` owns the runtime-neutral Fetch request pipeline.
-
-import { defaultOnError, jsonResponse } from './errors.js'
-import type { Middleware } from './middleware.js'
-import { runChain } from './middleware.js'
-import { matchRoutes } from './router.js'
-import type { Route } from './router.js'
-import { dispatchRpcRequest } from './rpc/dispatcher.js'
-
-/** Runtime-neutral background-work capability available while handling a request. */
-export interface RequestExecutionContext {
-	waitUntil(promise: Promise<unknown>): void
-}
-
-/** Something that can serve static assets (e.g. a Workers Assets binding). */
-export interface AssetsLike {
-	fetch(request: Request): Promise<Response>
-}
-
-export interface AppConfig<Env, Ctx> {
-	/** Build the base per-request context. Auth is added later by middleware. */
-	context: (env: Env, request: Request, exec: RequestExecutionContext) => Ctx | Promise<Ctx>
-	/** Middleware, run in declared order around the inner dispatch. */
-	middleware?: (env: Env) => Middleware<Ctx>[]
-	/** HTTP + RPC routes. */
-	routes: Route<Ctx>[]
-	/** SPA fallback served for an unmatched GET. */
-	assets?: (env: Env) => AssetsLike
-	/** Map a thrown value to a `Response`. Defaults to `defaultOnError`. */
-	onError?: (err: unknown, request: Request, env: Env) => Response
-}
-
-export interface FabrikaApp<Env> {
-	fetch(request: Request, env: Env, exec: RequestExecutionContext): Promise<Response>
-}
-
-function createFetch<Env, Ctx>(
-	config: AppConfig<Env, Ctx>,
-): (request: Request, env: Env, exec: RequestExecutionContext) => Promise<Response> {
-	const onError = config.onError ?? defaultOnError
-
-	return async (request: Request, env: Env, exec: RequestExecutionContext): Promise<Response> => {
-		try {
-			const ctx = await config.context(env, request, exec)
-			const middleware = config.middleware ? config.middleware(env) : []
-
-			const dispatch = async (): Promise<Response> => {
-				const matched = matchRoutes(config.routes, request)
-				if (matched) {
-					const inner = (): Promise<Response> => {
-						if (matched.route.kind === 'rpc') {
-							return dispatchRpcRequest({ router: matched.route.router, ctx, request })
-						}
-						return Promise.resolve(matched.route.handler(ctx, matched.params))
-					}
-					// Route-scoped middleware run after the global chain, around the handler.
-					return runChain(request, ctx, matched.route.use, inner)
-				}
-				if (request.method === 'GET' && config.assets) {
-					return config.assets(env).fetch(request)
-				}
-				return jsonResponse({ error: { type: 'not_found', message: 'Not found' } }, 404)
-			}
-
-			return await runChain(request, ctx, middleware, dispatch)
-		} catch (err) {
-			return onError(err, request, env)
-		}
-	}
-}
-
-export function defineApp<Env, Ctx>(config: AppConfig<Env, Ctx>): FabrikaApp<Env> {
-	return { fetch: createFetch(config) }
-}

package/src/middleware.ts

@@ -1,38 +0,0 @@
-// ─── Middleware ──────────────────────────────────────────────────────
-//
-// @fabrika/auth owns the request-time contracts. The app framework consumes and
-// re-exports them instead of maintaining a structurally duplicated copy.
-
-import type { Middleware } from '@fabrika/auth'
-
-export type { Middleware } from '@fabrika/auth'
-
-/**
- * A middleware runs in declared order around the inner dispatch. It may mutate
- * `ctx` (e.g. set `ctx.auth`), short-circuit by returning a `Response` without
- * calling `next()`, or wrap `next()` (await it, then mutate the `Response`, e.g.
- * append a `Set-Cookie`).
- */
-/**
- * Fold `middleware` (in declared order) around an innermost `dispatch`. Each
- * middleware receives a `next` that advances to the following one; the last
- * `next` calls `dispatch`.
- */
-export function runChain<Ctx>(
-	request: Request,
-	ctx: Ctx,
-	middleware: ReadonlyArray<Middleware<Ctx>>,
-	dispatch: () => Promise<Response>,
-): Promise<Response> {
-	let lastIndex = -1
-	const run = (index: number): Promise<Response> => {
-		if (index <= lastIndex) {
-			return Promise.reject(new Error('next() called multiple times in a single middleware'))
-		}
-		lastIndex = index
-		const current = middleware[index]
-		if (!current) return dispatch()
-		return current(request, ctx, () => run(index + 1))
-	}
-	return run(0)
-}

package/src/router.ts

@@ -1,149 +0,0 @@
-// ─── HTTP routing ────────────────────────────────────────────────────
-//
-// A tiny method-aware path router. HTTP routes carry a `(ctx, params) => Response`
-// handler; RPC routes carry a `Router`. Params are inferred from the pattern
-// string literal: `/api/:project/envelope` → `{ project: string }`.
-
-import type { Middleware } from './middleware.js'
-import type { AnyRouter } from './rpc/types.js'
-
-export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
-
-/** Per-route options. `use` middleware run AFTER the global chain, scoped to this route only. */
-export interface RouteOptions<Ctx> {
-	readonly use?: ReadonlyArray<Middleware<Ctx>>
-}
-
-/** Extract `:param` and terminal `*rest` names from a pattern literal. */
-export type RouteParams<Pattern extends string> = Pattern extends `${infer _Head}:${infer Param}/${infer Rest}`
-	? Record<Param, string> & RouteParams<Rest>
-	: Pattern extends `${infer _Head}:${infer Param}` ? Record<Param, string>
-	: Pattern extends `${infer _Head}*${infer Rest}` ? Rest extends '' ? {} : Record<Rest, string>
-	: {}
-
-export type HttpHandler<Ctx, Pattern extends string> = (ctx: Ctx, params: RouteParams<Pattern>) => Response | Promise<Response>
-
-export interface HttpRoute<Ctx, Pattern extends string = string> {
-	readonly kind: 'http'
-	/** `null` matches every method and is intended for mounting an existing Fetch handler. */
-	readonly method: HttpMethod | null
-	readonly pattern: Pattern
-	readonly segments: ReadonlyArray<string>
-	readonly use: ReadonlyArray<Middleware<Ctx>>
-	handler(ctx: Ctx, params: RouteParams<Pattern>): Response | Promise<Response>
-}
-
-export interface RpcRoute<Ctx> {
-	readonly kind: 'rpc'
-	readonly pattern: string
-	readonly segments: ReadonlyArray<string>
-	readonly use: ReadonlyArray<Middleware<Ctx>>
-	readonly router: AnyRouter
-}
-
-export type Route<Ctx> = HttpRoute<Ctx, string> | RpcRoute<Ctx>
-
-function splitPath(path: string): string[] {
-	return path.split('/').filter((segment) => segment.length > 0)
-}
-
-function decodePathSegment(segment: string): string | null {
-	try {
-		return decodeURIComponent(segment)
-	} catch {
-		return null
-	}
-}
-
-function makeHttpRoute<Ctx, Pattern extends string>(
-	method: HttpMethod | null,
-	pattern: Pattern,
-	handler: HttpHandler<Ctx, Pattern>,
-	opts: RouteOptions<Ctx> | undefined,
-): HttpRoute<Ctx, Pattern> {
-	const segments = splitPath(pattern)
-	const wildcard = segments.findIndex((segment) => segment.startsWith('*'))
-	if (wildcard !== -1 && wildcard !== segments.length - 1) {
-		throw new Error('a wildcard route segment must be terminal')
-	}
-	return { kind: 'http', method, pattern, segments, use: opts?.use ?? [], handler }
-}
-
-/**
- * Route builders. HTTP verbs take `(pattern, handler, opts?)`; `rpc` mounts a
- * `Router` at a path. Annotate the handler's `ctx` (or place the route in a
- * `Route<Ctx>[]`) to type the context. `opts.use` adds route-scoped middleware
- * (run after the global chain) — e.g. a capability/api-key gate on one path group.
- */
-export const route = {
-	all<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute(null, pattern, handler, opts)
-	},
-	get<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute('GET', pattern, handler, opts)
-	},
-	post<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute('POST', pattern, handler, opts)
-	},
-	put<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute('PUT', pattern, handler, opts)
-	},
-	patch<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute('PATCH', pattern, handler, opts)
-	},
-	delete<Ctx, Pattern extends string>(pattern: Pattern, handler: HttpHandler<Ctx, Pattern>, opts?: RouteOptions<Ctx>): HttpRoute<Ctx, Pattern> {
-		return makeHttpRoute('DELETE', pattern, handler, opts)
-	},
-	rpc<Ctx>(path: string, router: AnyRouter, opts?: RouteOptions<Ctx>): RpcRoute<Ctx> {
-		return { kind: 'rpc', pattern: path, segments: splitPath(path), use: opts?.use ?? [], router }
-	},
-}
-
-function matchSegments(routeSegments: ReadonlyArray<string>, pathSegments: ReadonlyArray<string>): Record<string, string> | null {
-	const params: Record<string, string> = {}
-	for (let i = 0; i < routeSegments.length; i++) {
-		const routeSegment = routeSegments[i]
-		if (routeSegment === undefined) return null
-		if (routeSegment.startsWith('*')) {
-			const name = routeSegment.slice(1)
-			if (name !== '') {
-				const decoded: string[] = []
-				for (const segment of pathSegments.slice(i)) {
-					const value = decodePathSegment(segment)
-					if (value === null) return null
-					decoded.push(value)
-				}
-				params[name] = decoded.join('/')
-			}
-			return params
-		}
-		const pathSegment = pathSegments[i]
-		if (pathSegment === undefined) return null
-		if (routeSegment.startsWith(':')) {
-			const value = decodePathSegment(pathSegment)
-			if (value === null) return null
-			params[routeSegment.slice(1)] = value
-		} else if (routeSegment !== pathSegment) {
-			return null
-		}
-	}
-	return routeSegments.length === pathSegments.length ? params : null
-}
-
-/** Find the first route matching the request's method + path. RPC routes match POST. */
-export function matchRoutes<Ctx>(
-	routes: ReadonlyArray<Route<Ctx>>,
-	request: Request,
-): { route: Route<Ctx>; params: Record<string, string> } | null {
-	const pathSegments = splitPath(new URL(request.url).pathname)
-	for (const candidate of routes) {
-		if (candidate.kind === 'rpc') {
-			if (request.method !== 'POST') continue
-		} else if (candidate.method !== null && request.method !== candidate.method) {
-			continue
-		}
-		const params = matchSegments(candidate.segments, pathSegments)
-		if (params) return { route: candidate, params }
-	}
-	return null
-}

package/src/testing.ts

@@ -1,119 +0,0 @@
-import type { FabrikaApp, RequestExecutionContext } from './app.js'
-import { createBunHandler } from './bun.js'
-import { type CloudflareExecutionContext, createCloudflareWorker } from './cloudflare.js'
-
-export type AppTestRuntime = 'direct' | 'bun' | 'cloudflare'
-
-export interface NormalizedAppResponse {
-	readonly status: number
-	readonly headers: ReadonlyArray<readonly [name: string, value: string]>
-	readonly body: string
-}
-
-export interface AppRuntimeResponses {
-	readonly direct: NormalizedAppResponse
-	readonly bun: NormalizedAppResponse
-	readonly cloudflare: NormalizedAppResponse
-}
-
-export interface AppRuntimeConformanceOptions<Env> {
-	readonly app: FabrikaApp<Env>
-	/** Create isolated runtime state so one execution cannot affect the next. */
-	readonly createEnv: () => Env | Promise<Env>
-	/** Create an equivalent fresh request for each runtime. */
-	readonly createRequest: () => Request
-	/** Optional sink for rejected background work. */
-	readonly onBackgroundError?: (runtime: AppTestRuntime, error: unknown) => void
-}
-
-interface TrackedExecution {
-	readonly context: RequestExecutionContext
-	drain(): Promise<void>
-}
-
-function trackedExecution(onBackgroundError: (error: unknown) => void): TrackedExecution {
-	const pending = new Set<Promise<void>>()
-	const waitUntil = (promise: Promise<unknown>): void => {
-		const tracked = promise.then(
-			() => undefined,
-			(error) => {
-				try {
-					onBackgroundError(error)
-				} catch {
-					// Reporting failures must not prevent the conformance run from draining.
-				}
-			},
-		)
-		pending.add(tracked)
-		void tracked.then(() => pending.delete(tracked))
-	}
-	return {
-		context: { waitUntil },
-		async drain() {
-			while (pending.size > 0) {
-				await Promise.all(pending)
-			}
-		},
-	}
-}
-
-/** Convert a Fetch response into a deterministic value suitable for equality checks. */
-export async function normalizeAppResponse(response: Response): Promise<NormalizedAppResponse> {
-	const headers: Array<readonly [name: string, value: string]> = []
-	response.headers.forEach((value, name) => headers.push([name, value]))
-	headers.sort(([left], [right]) => left.localeCompare(right))
-	return {
-		status: response.status,
-		headers,
-		body: await response.text(),
-	}
-}
-
-async function runDirect<Env>(options: AppRuntimeConformanceOptions<Env>): Promise<NormalizedAppResponse> {
-	const execution = trackedExecution((error) => options.onBackgroundError?.('direct', error))
-	const env = await options.createEnv()
-	const request = options.createRequest()
-	const response = await options.app.fetch(request, env, execution.context)
-	await execution.drain()
-	return normalizeAppResponse(response)
-}
-
-async function runBun<Env>(options: AppRuntimeConformanceOptions<Env>): Promise<NormalizedAppResponse> {
-	const handler = createBunHandler(options.app, await options.createEnv(), {
-		onBackgroundError: (error) => options.onBackgroundError?.('bun', error),
-	})
-	const response = await handler.fetch(options.createRequest())
-	await handler.drain()
-	return normalizeAppResponse(response)
-}
-
-async function runCloudflare<Env>(options: AppRuntimeConformanceOptions<Env>): Promise<NormalizedAppResponse> {
-	const execution = trackedExecution((error) => options.onBackgroundError?.('cloudflare', error))
-	const context: CloudflareExecutionContext = {
-		waitUntil: execution.context.waitUntil,
-		passThroughOnException() {},
-	}
-	const env = await options.createEnv()
-	const request = options.createRequest()
-	const response = await createCloudflareWorker(options.app).fetch(request, env, context)
-	await execution.drain()
-	return normalizeAppResponse(response)
-}
-
-/** Execute one request through every supported HTTP adapter. */
-export async function runAppRuntimeConformance<Env>(options: AppRuntimeConformanceOptions<Env>): Promise<AppRuntimeResponses> {
-	const direct = await runDirect(options)
-	const bun = await runBun(options)
-	const cloudflare = await runCloudflare(options)
-	return { direct, bun, cloudflare }
-}
-
-/** Assert adapter parity without coupling application packages to a specific test runner. */
-export async function assertAppRuntimeConformance<Env>(options: AppRuntimeConformanceOptions<Env>): Promise<NormalizedAppResponse> {
-	const responses = await runAppRuntimeConformance(options)
-	const direct = JSON.stringify(responses.direct)
-	if (JSON.stringify(responses.bun) !== direct || JSON.stringify(responses.cloudflare) !== direct) {
-		throw new Error(`application runtime responses differ: ${JSON.stringify(responses)}`)
-	}
-	return responses.direct
-}