@jasonshimmy/vite-plugin-cer-app 0.23.2 → 0.24.0

package/src/__tests__/runtime/use-runtime-config.test.ts

@@ -1,182 +0,0 @@
-import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest'
-import { useRuntimeConfig, initRuntimeConfig, resolvePrivateConfig } from '../../runtime/composables/use-runtime-config.js'
-
-beforeEach(() => {
-  // Reset global state between tests
-  delete (globalThis as Record<string, unknown>).__cerRuntimeConfig
-  // Ensure window is not set (server context for most tests)
-  delete (globalThis as Record<string, unknown>).window
-})
-
-afterEach(() => {
-  delete (globalThis as Record<string, unknown>).window
-})
-
-describe('initRuntimeConfig', () => {
-  it('stores the config on globalThis', () => {
-    initRuntimeConfig({ public: { apiBase: '/api' } })
-    expect((globalThis as Record<string, unknown>).__cerRuntimeConfig).toEqual({ public: { apiBase: '/api' } })
-  })
-
-  it('overwrites a previous config', () => {
-    initRuntimeConfig({ public: { apiBase: '/v1' } })
-    initRuntimeConfig({ public: { apiBase: '/v2' } })
-    const stored = (globalThis as Record<string, unknown>).__cerRuntimeConfig as { public: Record<string, unknown> }
-    expect(stored.public.apiBase).toBe('/v2')
-  })
-})
-
-describe('useRuntimeConfig', () => {
-  it('returns empty public config when not initialized', () => {
-    const config = useRuntimeConfig()
-    expect(config.public).toEqual({})
-  })
-
-  it('returns the config set by initRuntimeConfig', () => {
-    initRuntimeConfig({ public: { apiBase: '/api' } })
-    const config = useRuntimeConfig()
-    expect(config.public.apiBase).toBe('/api')
-  })
-
-  it('returns the full public config object', () => {
-    initRuntimeConfig({ public: { apiBase: '/api', version: '1.0', debug: false } })
-    const config = useRuntimeConfig()
-    expect(config.public).toEqual({ apiBase: '/api', version: '1.0', debug: false })
-  })
-
-  it('returns a reference to the stored config (not a copy)', () => {
-    const stored = { public: { apiBase: '/api' } }
-    initRuntimeConfig(stored)
-    const config = useRuntimeConfig()
-    expect(config).toBe(stored)
-  })
-
-  it('reflects updates when initRuntimeConfig is called again', () => {
-    initRuntimeConfig({ public: { key: 'first' } })
-    initRuntimeConfig({ public: { key: 'second' } })
-    expect(useRuntimeConfig().public.key).toBe('second')
-  })
-
-  it('handles empty public config', () => {
-    initRuntimeConfig({ public: {} })
-    const config = useRuntimeConfig()
-    expect(config.public).toEqual({})
-  })
-
-  it('returns private config when initialized with it', () => {
-    initRuntimeConfig({ public: {}, private: { dbUrl: 'postgres://localhost', secretKey: 'abc' } })
-    const config = useRuntimeConfig()
-    expect(config.private).toEqual({ dbUrl: 'postgres://localhost', secretKey: 'abc' })
-  })
-
-  it('private is undefined when not supplied', () => {
-    initRuntimeConfig({ public: { apiBase: '/api' } })
-    const config = useRuntimeConfig()
-    expect(config.private).toBeUndefined()
-  })
-
-  it('returns empty private config when initialized with empty object', () => {
-    initRuntimeConfig({ public: {}, private: {} })
-    expect(useRuntimeConfig().private).toEqual({})
-  })
-})
-
-// ─── Browser Proxy (private config enforcement) ───────────────────────────────
-
-describe('useRuntimeConfig browser Proxy', () => {
-  it('throws a clear error when .private is accessed in a browser context', () => {
-    ;(globalThis as Record<string, unknown>).window = {}
-    initRuntimeConfig({ public: { apiBase: '/api' }, private: { secret: 'shh' } })
-    const config = useRuntimeConfig()
-    expect(() => config.private).toThrow('[cer-app] runtimeConfig.private is not available in the browser')
-  })
-
-  it('allows .public access in a browser context', () => {
-    ;(globalThis as Record<string, unknown>).window = {}
-    initRuntimeConfig({ public: { apiBase: '/api' }, private: { secret: 'shh' } })
-    const config = useRuntimeConfig()
-    expect(config.public).toEqual({ apiBase: '/api' })
-  })
-
-  it('does NOT throw when .private is accessed in a server (non-browser) context', () => {
-    // window is not set — server environment
-    initRuntimeConfig({ public: {}, private: { secret: 'shh' } })
-    const config = useRuntimeConfig()
-    expect(() => config.private).not.toThrow()
-    expect(config.private).toEqual({ secret: 'shh' })
-  })
-
-  it('error message instructs moving access to a loader or middleware', () => {
-    ;(globalThis as Record<string, unknown>).window = {}
-    initRuntimeConfig({ public: {} })
-    const config = useRuntimeConfig()
-    expect(() => config.private).toThrow('loader, middleware, or API handler')
-  })
-})
-
-// ─── resolvePrivateConfig ─────────────────────────────────────────────────────
-
-describe('resolvePrivateConfig', () => {
-  it('resolves a key from the exact-case env var', () => {
-    const result = resolvePrivateConfig({ dbUrl: '' }, { dbUrl: 'postgres://localhost' })
-    expect(result.dbUrl).toBe('postgres://localhost')
-  })
-
-  it('resolves a key from the ALL_CAPS env var when exact case is absent', () => {
-    const result = resolvePrivateConfig({ dbUrl: '' }, { DB_URL: 'postgres://prod' })
-    expect(result.dbUrl).toBe('postgres://prod')
-  })
-
-  it('falls back to the declared default when neither env var is set', () => {
-    const result = resolvePrivateConfig({ dbUrl: 'default-db' }, {})
-    expect(result.dbUrl).toBe('default-db')
-  })
-
-  it('exact-case env var takes precedence over ALL_CAPS', () => {
-    const result = resolvePrivateConfig({ dbUrl: '' }, { dbUrl: 'exact', DB_URL: 'caps' })
-    expect(result.dbUrl).toBe('exact')
-  })
-
-  it('handles multiple keys independently', () => {
-    const result = resolvePrivateConfig(
-      { dbUrl: '', secretKey: '', apiToken: 'default-token' },
-      { dbUrl: 'pg://host', SECRET_KEY: 's3cr3t' },
-    )
-    expect(result.dbUrl).toBe('pg://host')
-    expect(result.secretKey).toBe('s3cr3t')
-    expect(result.apiToken).toBe('default-token')
-  })
-
-  it('returns an empty object when defaults is empty', () => {
-    expect(resolvePrivateConfig({}, { ANY: 'value' })).toEqual({})
-  })
-
-  it('preserves key names exactly as declared in output (does not rename keys)', () => {
-    const result = resolvePrivateConfig({ camelCase: 'def' }, { CAMEL_CASE: 'val' })
-    expect(Object.keys(result)).toEqual(['camelCase'])
-    expect(result.camelCase).toBe('val')
-  })
-
-  it('emits a console.warn when a key has an empty-string default and no env var is set', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    resolvePrivateConfig({ dbUrl: '' }, {})
-    expect(warn).toHaveBeenCalledOnce()
-    expect(warn.mock.calls[0][0]).toContain('dbUrl')
-    expect(warn.mock.calls[0][0]).toContain('DB_URL')
-    warn.mockRestore()
-  })
-
-  it('does NOT warn when the env var supplies a value for an empty-default key', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    resolvePrivateConfig({ dbUrl: '' }, { DB_URL: 'postgres://prod' })
-    expect(warn).not.toHaveBeenCalled()
-    warn.mockRestore()
-  })
-
-  it('does NOT warn when the declared default is non-empty and no env var is set', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    resolvePrivateConfig({ apiToken: 'fallback-token' }, {})
-    expect(warn).not.toHaveBeenCalled()
-    warn.mockRestore()
-  })
-})

package/src/__tests__/runtime/use-seo-meta.test.ts

@@ -1,109 +0,0 @@
-import { describe, it, expect, afterEach } from 'vitest'
-import { beginHeadCollection, endHeadCollection } from '../../runtime/composables/use-head.js'
-import { useSeoMeta } from '../../runtime/composables/use-seo-meta.js'
-
-// All tests run in SSR collection mode so we can inspect the output without a DOM.
-
-describe('useSeoMeta — SSR collection', () => {
-  afterEach(() => {
-    endHeadCollection()
-  })
-
-  it('sets the document title', () => {
-    beginHeadCollection()
-    useSeoMeta({ title: 'My Page' })
-    const [head] = endHeadCollection()
-    expect(head.title).toBe('My Page')
-  })
-
-  it('emits a description meta tag', () => {
-    beginHeadCollection()
-    useSeoMeta({ description: 'A great page.' })
-    const [head] = endHeadCollection()
-    expect(head.meta).toContainEqual({ name: 'description', content: 'A great page.' })
-  })
-
-  it('emits Open Graph meta tags', () => {
-    beginHeadCollection()
-    useSeoMeta({
-      ogTitle: 'OG Title',
-      ogDescription: 'OG Desc',
-      ogImage: 'https://example.com/og.png',
-      ogUrl: 'https://example.com/',
-      ogType: 'website',
-      ogSiteName: 'Example',
-    })
-    const [head] = endHeadCollection()
-    expect(head.meta).toContainEqual({ property: 'og:title', content: 'OG Title' })
-    expect(head.meta).toContainEqual({ property: 'og:description', content: 'OG Desc' })
-    expect(head.meta).toContainEqual({ property: 'og:image', content: 'https://example.com/og.png' })
-    expect(head.meta).toContainEqual({ property: 'og:url', content: 'https://example.com/' })
-    expect(head.meta).toContainEqual({ property: 'og:type', content: 'website' })
-    expect(head.meta).toContainEqual({ property: 'og:site_name', content: 'Example' })
-  })
-
-  it('emits Twitter Card meta tags', () => {
-    beginHeadCollection()
-    useSeoMeta({
-      twitterCard: 'summary_large_image',
-      twitterTitle: 'Tweet Title',
-      twitterDescription: 'Tweet Desc',
-      twitterImage: 'https://example.com/tw.png',
-      twitterSite: '@mysite',
-    })
-    const [head] = endHeadCollection()
-    expect(head.meta).toContainEqual({ name: 'twitter:card', content: 'summary_large_image' })
-    expect(head.meta).toContainEqual({ name: 'twitter:title', content: 'Tweet Title' })
-    expect(head.meta).toContainEqual({ name: 'twitter:description', content: 'Tweet Desc' })
-    expect(head.meta).toContainEqual({ name: 'twitter:image', content: 'https://example.com/tw.png' })
-    expect(head.meta).toContainEqual({ name: 'twitter:site', content: '@mysite' })
-  })
-
-  it('emits a canonical link element', () => {
-    beginHeadCollection()
-    useSeoMeta({ canonical: 'https://example.com/my-page' })
-    const [head] = endHeadCollection()
-    expect(head.link).toContainEqual({ rel: 'canonical', href: 'https://example.com/my-page' })
-  })
-
-  it('omits meta/link arrays when no tags are provided', () => {
-    beginHeadCollection()
-    useSeoMeta({ title: 'Only Title' })
-    const [head] = endHeadCollection()
-    expect(head.meta).toBeUndefined()
-    expect(head.link).toBeUndefined()
-  })
-
-  it('only emits tags for fields that are explicitly set', () => {
-    beginHeadCollection()
-    useSeoMeta({ ogTitle: 'Just OG' })
-    const [head] = endHeadCollection()
-    // description was not provided — must not appear
-    expect(head.meta?.some((m) => m.name === 'description')).toBeFalsy()
-    expect(head.meta).toContainEqual({ property: 'og:title', content: 'Just OG' })
-  })
-
-  it('allows all fields to be set together', () => {
-    beginHeadCollection()
-    useSeoMeta({
-      title: 'Full Page',
-      description: 'Full description.',
-      ogTitle: 'Full OG Title',
-      ogDescription: 'Full OG Desc',
-      ogImage: 'https://example.com/og.png',
-      ogUrl: 'https://example.com/',
-      ogType: 'article',
-      ogSiteName: 'My Site',
-      twitterCard: 'summary',
-      twitterTitle: 'Full Twitter Title',
-      twitterDescription: 'Full Twitter Desc',
-      twitterImage: 'https://example.com/tw.png',
-      twitterSite: '@site',
-      canonical: 'https://example.com/full',
-    })
-    const [head] = endHeadCollection()
-    expect(head.title).toBe('Full Page')
-    expect(head.meta).toHaveLength(12) // description + 6 OG + 5 Twitter
-    expect(head.link).toHaveLength(1)
-  })
-})

package/src/__tests__/runtime/use-session.test.ts

@@ -1,320 +0,0 @@
-/**
- * useSession() composable tests.
- *
- * Exercises HMAC-SHA-256 sign/verify round-trips, cookie storage, the clear()
- * helper, and the sessionSecret warning path. Uses happy-dom for the client
- * path (document.cookie).
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-
-// ─── Mock runtimeConfig ───────────────────────────────────────────────────────
-// useSession reads the sessionSecret from useRuntimeConfig().private.
-// We mock the composable module so tests can control the secret.
-
-let _mockSecret = 'test-secret-at-least-32-chars-long!'
-
-vi.mock('../../runtime/composables/use-runtime-config.js', () => ({
-  useRuntimeConfig: () => ({ private: { sessionSecret: _mockSecret } }),
-  initRuntimeConfig: vi.fn(),
-  resolvePrivateConfig: vi.fn((d) => d),
-}))
-
-import { useSession } from '../../runtime/composables/use-session.js'
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-/** Minimal AsyncLocalStorage-backed req/res context for SSR path testing. */
-function makeCtx(cookieHeader = '') {
-  const setCookies: string[] = []
-  const req = { headers: { cookie: cookieHeader } } as unknown as import('node:http').IncomingMessage
-  const res = {
-    setHeader(name: string, value: string | string[]) {
-      if (name.toLowerCase() === 'set-cookie') {
-        const vals = Array.isArray(value) ? value : [value]
-        setCookies.push(...vals)
-      }
-    },
-    getHeader(name: string) {
-      if (name.toLowerCase() === 'set-cookie') return setCookies
-      return undefined
-    },
-  } as unknown as import('node:http').ServerResponse
-  return { req, res, setCookies }
-}
-
-function runInStore(req: unknown, res: unknown, fn: () => Promise<void>): Promise<void> {
-  const store = (globalThis as Record<string, unknown>).__CER_REQ_STORE__ as
-    { run: (ctx: unknown, fn: () => Promise<void>) => Promise<void> } | undefined
-  if (store) return store.run({ req, res }, fn)
-  return fn()
-}
-
-// ─── SSR path ─────────────────────────────────────────────────────────────────
-
-describe('useSession() — SSR path', () => {
-  let _origStore: unknown
-
-  beforeEach(() => {
-    _origStore = (globalThis as Record<string, unknown>).__CER_REQ_STORE__
-    const { AsyncLocalStorage } = require('node:async_hooks')
-    const store = new AsyncLocalStorage()
-    ;(globalThis as Record<string, unknown>).__CER_REQ_STORE__ = store
-    _mockSecret = 'test-secret-at-least-32-chars-long!'
-  })
-
-  afterEach(() => {
-    ;(globalThis as Record<string, unknown>).__CER_REQ_STORE__ = _origStore
-  })
-
-  it('get() returns null when cookie is absent', async () => {
-    const { req, res } = makeCtx('')
-    let result: unknown
-    await runInStore(req, res, async () => {
-      result = await useSession().get()
-    })
-    expect(result).toBeNull()
-  })
-
-  it('set() then get() round-trips session data', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    let token = ''
-
-    // set
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'u1' })
-    })
-
-    // extract token from Set-Cookie header
-    const setCookie = setCookies.find((c) => c.startsWith('session='))
-    expect(setCookie).toBeTruthy()
-    token = setCookie!.split(';')[0].slice('session='.length)
-    expect(token).toContain('.') // payload.sig format
-
-    // get with the cookie present
-    const { req: req2, res: res2 } = makeCtx(`session=${token}`)
-    let data: { userId: string } | null = null
-    await runInStore(req2, res2, async () => {
-      data = await useSession<{ userId: string }>().get()
-    })
-    expect(data).toEqual({ userId: 'u1' })
-  })
-
-  it('get() returns null for a malformed token with no dot separator', async () => {
-    const { req, res } = makeCtx('session=nodotinthisvalue')
-    let data: unknown = 'not-null'
-    await runInStore(req, res, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('get() returns null for a token with valid format but invalid base64url payload', async () => {
-    // Payload is not valid base64url, signature is also garbage — should return null safely
-    const { req, res } = makeCtx('session=!!!invalid!!!.sig')
-    let data: unknown = 'not-null'
-    await runInStore(req, res, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('get() returns null for a tampered token', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'u1' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    const token = setCookie.split(';')[0].slice('session='.length)
-    const tampered = token.slice(0, -4) + 'XXXX'
-
-    const { req: req2, res: res2 } = makeCtx(`session=${tampered}`)
-    let data: unknown = 'not-null'
-    await runInStore(req2, res2, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('get() returns null when signed with a different secret', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'u1' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    const token = setCookie.split(';')[0].slice('session='.length)
-
-    _mockSecret = 'a-completely-different-secret-value!'
-    const { req: req2, res: res2 } = makeCtx(`session=${token}`)
-    let data: unknown = 'not-null'
-    await runInStore(req2, res2, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('clear() sets maxAge=0 in the Set-Cookie header', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession().clear()
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))
-    expect(setCookie).toBeTruthy()
-    expect(setCookie!.toLowerCase()).toContain('max-age=0')
-  })
-
-  it('set() writes httpOnly cookie', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ role: string }>().set({ role: 'admin' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    expect(setCookie.toLowerCase()).toContain('httponly')
-  })
-
-  it('set() respects custom name and maxAge options', async () => {
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession({ name: 'auth', maxAge: 3600 }).set({ x: 1 })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('auth='))
-    expect(setCookie).toBeTruthy()
-    expect(setCookie!.toLowerCase()).toContain('max-age=3600')
-  })
-
-  it('set() throws when sessionSecret is empty', async () => {
-    _mockSecret = ''
-    const { req, res } = makeCtx('')
-    await expect(
-      runInStore(req, res, async () => {
-        await useSession().set({ x: 1 })
-      }),
-    ).rejects.toThrow('sessionSecret')
-  })
-
-  it('get() returns null (not throws) when sessionSecret is empty', async () => {
-    _mockSecret = ''
-    const { req, res } = makeCtx('session=sometoken.sig')
-    let data: unknown = 'sentinel'
-    await runInStore(req, res, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('handles arbitrary JSON-serialisable session data', async () => {
-    const payload = { userId: 'u2', roles: ['admin', 'user'], ts: 1234567890 }
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<typeof payload>().set(payload)
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    const token = setCookie.split(';')[0].slice('session='.length)
-
-    const { req: req2, res: res2 } = makeCtx(`session=${token}`)
-    let data: typeof payload | null = null
-    await runInStore(req2, res2, async () => {
-      data = await useSession<typeof payload>().get()
-    })
-    expect(data).toEqual(payload)
-  })
-})
-
-// ─── P1-3: Session secret rotation ────────────────────────────────────────────
-
-describe('useSession() — secret rotation (P1-3)', () => {
-  let _origStore: unknown
-
-  beforeEach(() => {
-    _origStore = (globalThis as Record<string, unknown>).__CER_REQ_STORE__
-    const { AsyncLocalStorage } = require('node:async_hooks')
-    const store = new AsyncLocalStorage()
-    ;(globalThis as Record<string, unknown>).__CER_REQ_STORE__ = store
-  })
-
-  afterEach(() => {
-    ;(globalThis as Record<string, unknown>).__CER_REQ_STORE__ = _origStore
-  })
-
-  it('signs with the first secret in the array', async () => {
-    _mockSecret = ['new-secret-at-least-32-chars-long!!', 'old-secret-at-least-32-chars-long!!'] as unknown as string
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'u1' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))
-    expect(setCookie).toBeTruthy()
-    const token = setCookie!.split(';')[0].slice('session='.length)
-    expect(token).toContain('.')
-  })
-
-  it('verifies tokens signed with the second (old) secret', async () => {
-    // First, sign with the old secret alone
-    _mockSecret = 'old-secret-at-least-32-chars-long!!'
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'rotated' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    const oldToken = setCookie.split(';')[0].slice('session='.length)
-
-    // Now set secrets to [newSecret, oldSecret] — old token should still verify
-    _mockSecret = ['new-secret-at-least-32-chars-long!!', 'old-secret-at-least-32-chars-long!!'] as unknown as string
-    const { req: req2, res: res2 } = makeCtx(`session=${oldToken}`)
-    let data: { userId: string } | null = null
-    await runInStore(req2, res2, async () => {
-      data = await useSession<{ userId: string }>().get()
-    })
-    expect(data).toEqual({ userId: 'rotated' })
-  })
-
-  it('rejects a token when it matches neither secret in the array', async () => {
-    _mockSecret = 'old-secret-at-least-32-chars-long!!'
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'gone' })
-    })
-    const setCookie = setCookies.find((c) => c.startsWith('session='))!
-    const token = setCookie.split(';')[0].slice('session='.length)
-
-    // Completely different secrets — token should fail
-    _mockSecret = ['completely-different-secret-one123', 'completely-different-secret-two123'] as unknown as string
-    const { req: req2, res: res2 } = makeCtx(`session=${token}`)
-    let data: unknown = 'sentinel'
-    await runInStore(req2, res2, async () => {
-      data = await useSession().get()
-    })
-    expect(data).toBeNull()
-  })
-
-  it('treats a single string as the only secret (no rotation)', async () => {
-    _mockSecret = 'single-secret-at-least-32-chars-!!'
-    const { req, res, setCookies } = makeCtx('')
-    await runInStore(req, res, async () => {
-      await useSession<{ userId: string }>().set({ userId: 'single' })
-    })
-    const token = setCookies.find((c) => c.startsWith('session='))!.split(';')[0].slice('session='.length)
-    const { req: req2, res: res2 } = makeCtx(`session=${token}`)
-    let data: { userId: string } | null = null
-    await runInStore(req2, res2, async () => {
-      data = await useSession<{ userId: string }>().get()
-    })
-    expect(data).toEqual({ userId: 'single' })
-  })
-})
-
-// ─── Client path ──────────────────────────────────────────────────────────────
-// On the client, useSession().get() can only read an already-set cookie value.
-// Signing is skipped (no crypto key on the client); get() returns null.
-
-describe('useSession() — client path (no __CER_REQ_STORE__)', () => {
-  beforeEach(() => {
-    // Ensure no SSR store is active
-    delete (globalThis as Record<string, unknown>).__CER_REQ_STORE__
-  })
-
-  it('get() returns null when no session cookie is set', async () => {
-    const result = await useSession().get()
-    expect(result).toBeNull()
-  })
-})