@heyramzi/utils 0.0.0-stage → 1.12.0

package/src/crypto.test.ts

@@ -0,0 +1,86 @@
+import { afterEach, beforeEach, describe, expect, it } from "vite-plus/test";
+import {
+  decryptSecret,
+  decryptSecretWithKey,
+  encryptSecret,
+  encryptSecretWithKey,
+  packSecret,
+  unpackSecret,
+} from "#src/crypto.ts";
+
+const KEY_ENV = "HEYRAMZI_UTILS_CRYPTO_KEY";
+const TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=";
+
+describe("secret crypto helpers", () => {
+  const originalKey = process.env[KEY_ENV];
+
+  beforeEach(() => {
+    process.env[KEY_ENV] = TEST_KEY;
+  });
+
+  afterEach(() => {
+    if (originalKey === undefined) {
+      delete process.env[KEY_ENV];
+      return;
+    }
+
+    process.env[KEY_ENV] = originalKey;
+  });
+
+  it("round-trips plaintext through encrypt and decrypt", () => {
+    const encrypted = encryptSecret("oauth-refresh-token");
+
+    expect(decryptSecret(encrypted.ciphertext, encrypted.iv)).toBe("oauth-refresh-token");
+  });
+
+  it("round-trips empty plaintext", () => {
+    const encrypted = encryptSecret("");
+
+    expect(decryptSecret(encrypted.ciphertext, encrypted.iv)).toBe("");
+  });
+
+  it("produces different ciphertext for the same plaintext because the IV is random", () => {
+    const first = encryptSecret("shared-secret");
+    const second = encryptSecret("shared-secret");
+
+    expect(first.iv).not.toBe(second.iv);
+    expect(first.ciphertext).not.toBe(second.ciphertext);
+  });
+
+  it("fails to decrypt a tampered ciphertext", () => {
+    const encrypted = encryptSecret("top-secret");
+    const tamperedCiphertext = `${encrypted.ciphertext.slice(0, -1)}A`;
+
+    expect(() => decryptSecret(tamperedCiphertext, encrypted.iv)).toThrow(
+      "Failed to decrypt secret",
+    );
+  });
+
+  it("preserves Unicode plaintext", () => {
+    const plaintext = "🔐 café OAuth 令牌";
+    const encrypted = encryptSecret(plaintext);
+
+    expect(decryptSecret(encrypted.ciphertext, encrypted.iv)).toBe(plaintext);
+  });
+
+  it("supports direct encryption and decryption with an explicit key", () => {
+    const encrypted = encryptSecretWithKey("api-key", TEST_KEY);
+
+    expect(decryptSecretWithKey(encrypted.ciphertext, encrypted.iv, TEST_KEY)).toBe("api-key");
+  });
+
+  it("packs and unpacks ciphertext for single-field storage", () => {
+    const encrypted = encryptSecret("legacy-token");
+    const packed = packSecret(encrypted);
+    const unpacked = unpackSecret(packed);
+
+    expect(unpacked).toEqual(encrypted);
+    expect(decryptSecret(unpacked.ciphertext, unpacked.iv)).toBe("legacy-token");
+  });
+
+  it("throws a clear error when the encryption key is missing", () => {
+    delete process.env[KEY_ENV];
+
+    expect(() => encryptSecret("missing-key")).toThrow(`Missing ${KEY_ENV}`);
+  });
+});

package/src/crypto.ts

@@ -0,0 +1,157 @@
+import { Buffer } from "node:buffer";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const AUTH_TAG_BYTES = 16;
+const IV_BYTES = 12;
+const KEY_BYTES = 32;
+const KEY_ENV = "HEYRAMZI_UTILS_CRYPTO_KEY";
+const BASE64_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
+const HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
+
+export type SecretCiphertext = {
+  ciphertext: string;
+  iv: string;
+};
+
+function ensureServerEnv(): Record<string, string | undefined> {
+  const runtimeProcess = (globalThis as { process?: { env?: Record<string, string | undefined> } })
+    .process;
+
+  if (!runtimeProcess?.env) {
+    throw new Error("[crypto] process.env is unavailable. @heyramzi/utils/crypto is server-only.");
+  }
+
+  return runtimeProcess.env;
+}
+
+function decodeBase64(value: string, label: string): Buffer {
+  const normalized = value.trim();
+
+  if (!normalized || normalized.length % 4 !== 0 || !BASE64_PATTERN.test(normalized)) {
+    throw new Error(`[crypto] ${label} must be valid base64.`);
+  }
+
+  const bytes = Buffer.from(normalized, "base64");
+
+  if (bytes.toString("base64") !== normalized) {
+    throw new Error(`[crypto] ${label} must be valid base64.`);
+  }
+
+  return bytes;
+}
+
+function decodeSecretKey(rawValue: string, label: string): Buffer {
+  if (!rawValue) {
+    throw new Error(
+      `[crypto] Missing ${label}. Set a 32-byte key encoded as base64 (recommended) or 64-character hex.`,
+    );
+  }
+
+  if (HEX_PATTERN.test(rawValue)) {
+    return Buffer.from(rawValue, "hex");
+  }
+
+  const key = decodeBase64(rawValue, label);
+
+  if (key.length !== KEY_BYTES) {
+    throw new Error(`[crypto] ${label} must decode to exactly ${KEY_BYTES} bytes for AES-256-GCM.`);
+  }
+
+  return key;
+}
+
+function getSecretKey(): Buffer {
+  const env = ensureServerEnv();
+  const rawValue = env[KEY_ENV]?.trim();
+  return decodeSecretKey(rawValue ?? "", KEY_ENV);
+}
+
+function encryptWithKey(plaintext: string, key: Buffer): SecretCiphertext {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final(),
+    cipher.getAuthTag(),
+  ]);
+
+  return {
+    ciphertext: ciphertext.toString("base64"),
+    iv: iv.toString("base64"),
+  };
+}
+
+function decryptWithKey(ciphertext: string, iv: string, key: Buffer): string {
+  const ivBytes = decodeBase64(iv, "iv");
+
+  if (ivBytes.length !== IV_BYTES) {
+    throw new Error(`[crypto] iv must decode to exactly ${IV_BYTES} bytes.`);
+  }
+
+  const payload = decodeBase64(ciphertext, "ciphertext");
+
+  if (payload.length < AUTH_TAG_BYTES) {
+    throw new Error("[crypto] ciphertext payload is invalid.");
+  }
+
+  const encrypted = payload.subarray(0, -AUTH_TAG_BYTES);
+  const authTag = payload.subarray(-AUTH_TAG_BYTES);
+
+  try {
+    const decipher = createDecipheriv(ALGORITHM, key, ivBytes);
+    decipher.setAuthTag(authTag);
+
+    return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
+  } catch (error) {
+    throw new Error(
+      "[crypto] Failed to decrypt secret. The payload may be tampered with or invalid.",
+      {
+        cause: error,
+      },
+    );
+  }
+}
+
+export function encryptSecret(plaintext: string): SecretCiphertext {
+  return encryptWithKey(plaintext, getSecretKey());
+}
+
+export function decryptSecret(ciphertext: string, iv: string): string {
+  return decryptWithKey(ciphertext, iv, getSecretKey());
+}
+
+export function encryptSecretWithKey(plaintext: string, key: string): SecretCiphertext {
+  return encryptWithKey(plaintext, decodeSecretKey(key.trim(), "key"));
+}
+
+export function decryptSecretWithKey(ciphertext: string, iv: string, key: string): string {
+  return decryptWithKey(ciphertext, iv, decodeSecretKey(key.trim(), "key"));
+}
+
+export function packSecret(secret: SecretCiphertext): string {
+  const ivBytes = decodeBase64(secret.iv, "iv");
+
+  if (ivBytes.length !== IV_BYTES) {
+    throw new Error(`[crypto] iv must decode to exactly ${IV_BYTES} bytes.`);
+  }
+
+  const ciphertextBytes = decodeBase64(secret.ciphertext, "ciphertext");
+  return Buffer.concat([ivBytes, ciphertextBytes]).toString("base64");
+}
+
+export function unpackSecret(payload: string): SecretCiphertext {
+  const packed = decodeBase64(payload, "payload");
+
+  if (packed.length < IV_BYTES + AUTH_TAG_BYTES) {
+    throw new Error("[crypto] packed payload is invalid.");
+  }
+
+  const iv = packed.subarray(0, IV_BYTES);
+  const ciphertext = packed.subarray(IV_BYTES);
+
+  return {
+    ciphertext: ciphertext.toString("base64"),
+    iv: iv.toString("base64"),
+  };
+}

package/src/error.test.ts

@@ -0,0 +1,79 @@
+import { describe, it, expect, vi } from "vite-plus/test";
+import { fetchApi } from "#src/error.ts";
+
+describe("fetchApi", () => {
+  it("returns parsed JSON on a successful response", async () => {
+    const mockData = { id: 1, name: "Test" };
+
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve(mockData),
+      }),
+    );
+
+    const result = await fetchApi<typeof mockData>("https://example.com/api");
+    expect(result).toEqual(mockData);
+  });
+
+  it("throws with the error field from the response body on failure", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 404,
+        json: () => Promise.resolve({ error: "Not found" }),
+      }),
+    );
+
+    await expect(fetchApi("https://example.com/api")).rejects.toThrow("Not found");
+  });
+
+  it("throws with a generic message when response body has no error field", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 500,
+        json: () => Promise.resolve({}),
+      }),
+    );
+
+    await expect(fetchApi("https://example.com/api")).rejects.toThrow("Request failed (500)");
+  });
+
+  it("sends Content-Type application/json header by default", async () => {
+    const mockFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({}),
+    });
+    vi.stubGlobal("fetch", mockFetch);
+
+    await fetchApi("https://example.com/api");
+
+    const [, options] = mockFetch.mock.calls[0];
+    expect(options.headers["Content-Type"]).toBe("application/json");
+  });
+
+  it("passes extra options through to fetch", async () => {
+    const mockFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({}),
+    });
+    vi.stubGlobal("fetch", mockFetch);
+
+    await fetchApi("https://example.com/api", {
+      method: "POST",
+      body: JSON.stringify({ key: "value" }),
+    });
+
+    const [url, options] = mockFetch.mock.calls[0];
+    expect(url).toBe("https://example.com/api");
+    expect(options.method).toBe("POST");
+    expect(options.body).toBe(JSON.stringify({ key: "value" }));
+  });
+});

package/src/error.ts

@@ -0,0 +1,16 @@
+/** Typed fetch wrapper with automatic JSON parsing and error handling */
+export async function fetchApi<T>(url: string, options?: RequestInit): Promise<T> {
+  const response = await fetch(url, {
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    ...options,
+  });
+
+  const data = (await response.json()) as { error?: string } | T;
+
+  if (!response.ok) {
+    const message = (data as { error?: string })?.error ?? `Request failed (${response.status})`;
+    throw new Error(message);
+  }
+
+  return data as T;
+}

package/src/errors/sentry/index.ts

@@ -0,0 +1,20 @@
+/**
+ * Error capture over `fetch` for Convex, Workers, SvelteKit and extensions.
+ * Apps Script builds with `./protocol` and sends through UrlFetchApp instead.
+ */
+
+import { buildErrorRequest, type CaptureInput } from "#src/errors/sentry/protocol.js";
+
+export { buildErrorRequest, parseDsn, parseStack } from "#src/errors/sentry/protocol.js";
+export type { CaptureInput, SentryRequest, SentryScalar } from "#src/errors/sentry/protocol.js";
+
+/** Send one error. Never throws; a missing DSN is a silent no-op. */
+export async function captureError(input: CaptureInput): Promise<void> {
+  const req = buildErrorRequest(input);
+  if (!req) return;
+  try {
+    await fetch(req.url, { method: "POST", headers: req.headers, body: req.body });
+  } catch (err) {
+    console.error("[errors] Sentry capture failed:", err);
+  }
+}

package/src/errors/sentry/protocol.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { buildErrorRequest, parseDsn, parseStack } from "#src/errors/sentry/protocol.js";
+
+const DSN = "https://abc123@o42.ingest.de.sentry.io/4507";
+
+describe("parseDsn", () => {
+  it("splits key, origin and project", () => {
+    expect(parseDsn(DSN)).toEqual({
+      publicKey: "abc123",
+      origin: "https://o42.ingest.de.sentry.io",
+      projectId: "4507",
+    });
+  });
+
+  it("rejects junk", () => {
+    expect(parseDsn("")).toBeNull();
+    expect(parseDsn("https://o42.ingest.sentry.io/4507")).toBeNull();
+  });
+});
+
+describe("parseStack", () => {
+  it("returns V8 frames oldest first", () => {
+    const stack = "Error: boom\n    at inner (app.js:10:5)\n    at app.js:20:1";
+    expect(parseStack(stack)).toEqual([
+      { filename: "app.js", lineno: 20, colno: 1 },
+      { function: "inner", filename: "app.js", lineno: 10, colno: 5 },
+    ]);
+  });
+});
+
+describe("buildErrorRequest", () => {
+  it("is null without a DSN", () => {
+    expect(buildErrorRequest({ dsn: "", error: new Error("x") })).toBeNull();
+  });
+
+  it("builds a three-line envelope with the surface tag", () => {
+    const req = buildErrorRequest({
+      dsn: DSN,
+      error: new TypeError("bad"),
+      surface: "sync",
+      tags: { plan: "pro", skip: null },
+      user: { email: "a@b.c" },
+      eventId: "f".repeat(32),
+      now: 1_700_000_000_000,
+    });
+    expect(req?.url).toBe(
+      "https://o42.ingest.de.sentry.io/api/4507/envelope/?sentry_key=abc123&sentry_version=7",
+    );
+    const [head, item, event] = (req?.body ?? "").split("\n").map((l) => JSON.parse(l));
+    expect(head.event_id).toBe("f".repeat(32));
+    expect(item).toEqual({ type: "event" });
+    expect(event.tags).toEqual({ plan: "pro", surface: "sync" });
+    expect(event.exception.values[0]).toMatchObject({ type: "TypeError", value: "bad" });
+    expect(event.user).toEqual({ email: "a@b.c" });
+    expect(event.timestamp).toBe(1_700_000_000);
+  });
+
+  it("accepts a thrown string", () => {
+    const req = buildErrorRequest({ dsn: DSN, error: "plain" });
+    const event = JSON.parse((req?.body ?? "").split("\n")[2]);
+    expect(event.exception.values[0]).toEqual({ type: "Error", value: "plain" });
+  });
+
+  // Drizzle's "Failed query" keeps D1's real message in `cause`; Sentry showed the SQL alone.
+  it("sends the cause chain, root cause first and the thrown error last", () => {
+    const d1 = new Error("D1_ERROR: no such column: x");
+    const failed = new Error("Failed query: select x from t", { cause: d1 });
+    const req = buildErrorRequest({ dsn: DSN, error: failed });
+    const event = JSON.parse((req?.body ?? "").split("\n")[2]);
+    expect(event.exception.values.map((v: { value: string }) => v.value)).toEqual([
+      "D1_ERROR: no such column: x",
+      "Failed query: select x from t",
+    ]);
+  });
+
+  it("stops on a cause loop", () => {
+    const a = new Error("a");
+    const b = new Error("b", { cause: a });
+    a.cause = b;
+    const event = JSON.parse(
+      (buildErrorRequest({ dsn: DSN, error: a })?.body ?? "").split("\n")[2],
+    );
+    expect(event.exception.values).toHaveLength(2);
+  });
+});

package/src/errors/sentry/protocol.ts

@@ -0,0 +1,144 @@
+/**
+ * Pure Sentry envelope helpers, no I/O. Any runtime (Apps Script, Convex, Workers,
+ * extensions) builds the request here and sends it with its own transport.
+ */
+
+export type SentryScalar = string | number | boolean;
+
+export type CaptureInput = {
+  dsn: string;
+  error: unknown;
+  /** Where it happened, e.g. "sidebar.sync". Becomes the `surface` tag. */
+  surface?: string;
+  release?: string;
+  environment?: string;
+  user?: { id?: string; email?: string };
+  tags?: Record<string, SentryScalar | null | undefined>;
+  extra?: Record<string, unknown>;
+  /** 32 hex chars. Generated when omitted. */
+  eventId?: string;
+  /** Epoch milliseconds. Defaults to now. */
+  now?: number;
+};
+
+export type SentryRequest = {
+  url: string;
+  headers: Record<string, string>;
+  body: string;
+};
+
+type Dsn = { publicKey: string; origin: string; projectId: string };
+
+type Frame = { function?: string; filename?: string; lineno?: number; colno?: number };
+
+/** Parse `https://<key>@<host>/<projectId>`. Returns null for anything else. */
+export function parseDsn(dsn: string): Dsn | null {
+  const m = /^(https?):\/\/([^@/]+)@([^/]+)\/(?:.*\/)?(\d+)\/?$/.exec(dsn.trim());
+  const [, scheme, publicKey, host, projectId] = m ?? [];
+  if (!scheme || !publicKey || !host || !projectId) return null;
+  return { publicKey, origin: `${scheme}://${host}`, projectId };
+}
+
+function randomHex32(): string {
+  let out = "";
+  for (let i = 0; i < 32; i++) out += Math.floor(Math.random() * 16).toString(16);
+  return out;
+}
+
+const V8_FRAME = /^\s*at (?:(.+?) \()?(.+?):(\d+):(\d+)\)?\s*$/;
+
+/** V8 stack text to Sentry frames, oldest call first as Sentry expects. */
+export function parseStack(stack: string | undefined): Frame[] {
+  if (!stack) return [];
+  const frames: Frame[] = [];
+  for (const line of stack.split("\n")) {
+    const m = V8_FRAME.exec(line);
+    if (!m) continue;
+    const frame: Frame = { filename: m[2], lineno: Number(m[3]), colno: Number(m[4]) };
+    if (m[1]) frame.function = m[1];
+    frames.push(frame);
+  }
+  return frames.reverse();
+}
+
+type Described = { type: string; value: string; stack?: string };
+
+function describe(error: unknown): Described {
+  if (error instanceof Error) {
+    return { type: error.name || "Error", value: error.message, stack: error.stack };
+  }
+  if (typeof error === "string") return { type: "Error", value: error };
+  try {
+    return { type: "Error", value: JSON.stringify(error) };
+  } catch {
+    return { type: "Error", value: String(error) };
+  }
+}
+
+/** Deepest `cause` walked. A wrapper that wraps itself in a loop stops here too. */
+const MAX_CHAIN = 5;
+
+/**
+ * The error and its `cause` chain as Sentry exceptions, root cause first. Drizzle keeps D1's
+ * real message in `cause`, so without the chain the event never says why.
+ */
+function describeChain(error: unknown): Described[] {
+  const chain = [describe(error)];
+  const seen = new Set<unknown>([error]);
+  let next = error instanceof Error ? error.cause : undefined;
+  while (next !== undefined && next !== null && !seen.has(next) && chain.length < MAX_CHAIN) {
+    seen.add(next);
+    chain.push(describe(next));
+    next = next instanceof Error ? next.cause : undefined;
+  }
+  return chain.reverse();
+}
+
+function cleanTags(input: CaptureInput): Record<string, string> {
+  const tags: Record<string, string> = {};
+  for (const [k, v] of Object.entries(input.tags ?? {})) {
+    if (v !== null && v !== undefined) tags[k] = String(v);
+  }
+  if (input.surface) tags.surface = input.surface;
+  return tags;
+}
+
+/** Build the envelope POST for one error. Null when the DSN is missing or malformed. */
+export function buildErrorRequest(input: CaptureInput): SentryRequest | null {
+  const dsn = parseDsn(input.dsn ?? "");
+  if (!dsn) return null;
+  const eventId = input.eventId ?? randomHex32();
+  const now = input.now ?? Date.now();
+  const values = describeChain(input.error).map(({ type, value, stack }) => {
+    const exception: Record<string, unknown> = { type, value };
+    const frames = parseStack(stack);
+    if (frames.length) exception.stacktrace = { frames };
+    return exception;
+  });
+
+  const event: Record<string, unknown> = {
+    event_id: eventId,
+    timestamp: now / 1000,
+    platform: "javascript",
+    level: "error",
+    tags: cleanTags(input),
+    exception: { values },
+  };
+  if (input.release) event.release = input.release;
+  if (input.environment) event.environment = input.environment;
+  if (input.user) event.user = input.user;
+  if (input.extra) event.extra = input.extra;
+
+  const sentAt = new Date(now).toISOString();
+  const body = [
+    JSON.stringify({ event_id: eventId, sent_at: sentAt, dsn: input.dsn }),
+    JSON.stringify({ type: "event" }),
+    JSON.stringify(event),
+  ].join("\n");
+
+  return {
+    url: `${dsn.origin}/api/${dsn.projectId}/envelope/?sentry_key=${dsn.publicKey}&sentry_version=7`,
+    headers: { "Content-Type": "application/x-sentry-envelope" },
+    body,
+  };
+}

package/src/errors/sentry/sveltekit.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it, vi } from "vitest";
+import { isStaleChunk, reloadForStaleChunk, shouldReport } from "#src/errors/sentry/sveltekit.js";
+
+describe("shouldReport", () => {
+  it("never reports an error() throw", () => {
+    expect(shouldReport({ kind: "app", error: { message: "Not yours" } })).toBe(false);
+  });
+
+  it("reports an unknown error", () => {
+    expect(shouldReport({ kind: "unknown", error: new Error("boom") })).toBe(true);
+  });
+
+  it("reports a framework or validation error only from 500", () => {
+    expect(shouldReport({ kind: "framework", error: { status: 404, message: "Not Found" } })).toBe(
+      false,
+    );
+    expect(shouldReport({ kind: "validation", error: { status: 400, message: "Bad" } })).toBe(
+      false,
+    );
+    expect(shouldReport({ kind: "framework", error: { status: 500, message: "Internal" } })).toBe(
+      true,
+    );
+  });
+});
+
+describe("isStaleChunk", () => {
+  it("matches the Chrome, Safari and Firefox wordings", () => {
+    expect(isStaleChunk(new Error("Failed to fetch dynamically imported module: /a.js"))).toBe(
+      true,
+    );
+    expect(isStaleChunk(new Error("Importing a module script failed."))).toBe(true);
+    expect(isStaleChunk(new Error("error loading dynamically imported module: /a.js"))).toBe(true);
+  });
+
+  it("leaves other errors alone", () => {
+    expect(isStaleChunk(new Error("Cannot read properties of undefined"))).toBe(false);
+    expect(isStaleChunk("Failed to fetch dynamically imported module")).toBe(false);
+  });
+});
+
+function fakeEnv(startAt: number) {
+  const store = new Map<string, string>();
+  let clock = startAt;
+  const reload = vi.fn();
+  return {
+    env: {
+      storage: {
+        getItem: (key: string) => store.get(key) ?? null,
+        setItem: (key: string, value: string) => void store.set(key, value),
+      },
+      now: () => clock,
+      reload,
+    },
+    reload,
+    advance: (ms: number) => (clock += ms),
+  };
+}
+
+describe("reloadForStaleChunk", () => {
+  it("reloads once, then stops so a chunk that's really gone can't loop", () => {
+    const { env, reload, advance } = fakeEnv(1_000_000);
+    expect(reloadForStaleChunk(env)).toBe(true);
+    advance(5_000);
+    expect(reloadForStaleChunk(env)).toBe(false);
+    expect(reload).toHaveBeenCalledTimes(1);
+  });
+
+  it("reloads again for a later deploy", () => {
+    const { env, reload, advance } = fakeEnv(1_000_000);
+    reloadForStaleChunk(env);
+    advance(60_000);
+    expect(reloadForStaleChunk(env)).toBe(true);
+    expect(reload).toHaveBeenCalledTimes(2);
+  });
+
+  it("doesn't reload when storage is blocked", () => {
+    const reload = vi.fn();
+    const blocked = {
+      getItem: () => {
+        throw new Error("denied");
+      },
+      setItem: () => {},
+    };
+    expect(reloadForStaleChunk({ storage: blocked, now: Date.now, reload })).toBe(false);
+    expect(reloadForStaleChunk(null)).toBe(false);
+    expect(reload).not.toHaveBeenCalled();
+  });
+});