@lenne.tech/nest-server 11.32.3 → 11.33.0

package/src/core/modules/hub/core-hub.module.spec.ts

@@ -1,108 +0,0 @@
-import { PATH_METADATA } from '@nestjs/common/constants';
-import { describe, expect, it } from 'vitest';
-
-import { CoreHubController } from './core-hub.controller';
-import { CoreHubModule } from './core-hub.module';
-
-const ctx = { env: 'local', version: '1.0.0' };
-
-describe('CoreHubModule.forRoot', () => {
-  it('builds a dynamic module with the hub controller', () => {
-    const mod = CoreHubModule.forRoot({ config: {}, ctx });
-    expect(mod.module).toBe(CoreHubModule);
-    expect(mod.controllers?.length).toBeGreaterThan(0);
-  });
-
-  it('becomes global and provides the email-capture binding when the mailbox is enabled', () => {
-    const mod = CoreHubModule.forRoot({ config: { mailbox: { mode: 'capture' } }, ctx });
-    expect(mod.global).toBe(true);
-  });
-
-  it('is not global when the mailbox is disabled', () => {
-    const mod = CoreHubModule.forRoot({ config: {}, ctx });
-    expect(mod.global).toBeFalsy();
-  });
-
-  it('throws when mailbox capture mode is used in production (silent mail suppression guard)', () => {
-    expect(() =>
-      CoreHubModule.forRoot({ config: { mailbox: { mode: 'capture' } }, ctx: { env: 'production', version: '1' } }),
-    ).toThrow(/capture.*not permitted/i);
-  });
-
-  it('allows mailbox copy mode in production', () => {
-    expect(() =>
-      CoreHubModule.forRoot({ config: { mailbox: { mode: 'copy' } }, ctx: { env: 'production', version: '1' } }),
-    ).not.toThrow();
-  });
-
-  describe('public-access guard (roles: false in a reachable env)', () => {
-    it('throws when roles:false in production without acknowledgment', () => {
-      expect(() =>
-        CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'production', version: '1' } }),
-      ).toThrow(/roles: false.*not permitted/i);
-    });
-
-    it('throws when roles:false in staging without acknowledgment', () => {
-      expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'staging', version: '1' } })).toThrow(
-        /not permitted/i,
-      );
-    });
-
-    it('throws for CUSTOM reachable env names too (fail-safe — not just production/staging)', () => {
-      // Regression guard for the exact-string bypass: prod / live / preprod / production-eu / staging-2
-      // must all be treated as reachable.
-      for (const env of ['prod', 'live', 'preprod', 'production-eu', 'staging-2']) {
-        expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx: { env, version: '1' } })).toThrow(
-          /not permitted/i,
-        );
-      }
-    });
-
-    it('allows roles:false in production ONLY with explicit allowPublicAccessInProduction', () => {
-      expect(() =>
-        CoreHubModule.forRoot({
-          config: { allowPublicAccessInProduction: true, roles: false },
-          ctx: { env: 'production', version: '1' },
-        }),
-      ).not.toThrow();
-    });
-
-    it('allows roles:false in non-reachable envs (local, development)', () => {
-      expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx })).not.toThrow(); // ctx = local
-      expect(() =>
-        CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'development', version: '1' } }),
-      ).not.toThrow();
-    });
-
-    it('allows the default ADMIN gate in production (no roles set)', () => {
-      expect(() => CoreHubModule.forRoot({ config: {}, ctx: { env: 'production', version: '1' } })).not.toThrow();
-    });
-  });
-
-  describe('runtime path/roles metadata (shared controller class)', () => {
-    it('writes the configured base path onto the controller class', () => {
-      CoreHubModule.forRoot({ config: { path: 'cockpit' }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('cockpit');
-    });
-
-    it('fully overwrites stale metadata on a second forRoot (no cross-instance pollution)', () => {
-      // The controller class is shared across app instances in the same process (parallel tests). A
-      // second forRoot must overwrite the first, never leak the previous path/roles.
-      CoreHubModule.forRoot({ config: { path: 'first', roles: 'admin' }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('first');
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['admin']);
-
-      CoreHubModule.forRoot({ config: { path: 'second', roles: ['ops', 'admin'] }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('second');
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['ops', 'admin']);
-    });
-
-    it('clears the roles metadata when roles: false (public opt-out)', () => {
-      CoreHubModule.forRoot({ config: { roles: 'admin' }, ctx });
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['admin']);
-
-      CoreHubModule.forRoot({ config: { roles: false }, ctx });
-      expect(Reflect.getMetadata('roles', CoreHubController)).toBeUndefined();
-    });
-  });
-});

package/src/core/modules/hub/helpers/hub-command-shape.helper.spec.ts

@@ -1,48 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { normalizeCommandShape } from './hub-command-shape.helper';
-
-describe('normalizeCommandShape', () => {
-  it('replaces scalar values with a placeholder but keeps keys', () => {
-    const out = normalizeCommandShape({ email: 'alice@example.com', age: 30, active: true });
-    expect(out).toEqual({ active: '?', age: '?', email: '?' });
-  });
-
-  it('keeps Mongo operators as keys (they are structure, not data)', () => {
-    const out = normalizeCommandShape({ age: { $gte: 18, $lt: 65 } });
-    expect(out).toEqual({ age: { $gte: '?', $lt: '?' } });
-  });
-
-  it('collapses scalar arrays ($in) to a single placeholder', () => {
-    const out = normalizeCommandShape({ id: { $in: [1, 2, 3, 4] } });
-    expect(out).toEqual({ id: { $in: ['?'] } });
-  });
-
-  it('keeps per-stage shape for pipeline-like object arrays', () => {
-    const out = normalizeCommandShape([{ $match: { x: 1 } }, { $group: { _id: '$y' } }]) as unknown[];
-    expect(out).toHaveLength(2);
-    expect(out[0]).toEqual({ $match: { x: '?' } });
-  });
-
-  it('does NOT leak the original values (privacy)', () => {
-    const secret = 'super-secret@example.com';
-    const out = normalizeCommandShape({ filter: { email: secret } });
-    expect(JSON.stringify(out)).not.toContain(secret);
-  });
-
-  it('caps recursion depth', () => {
-    let deep: any = 'leaf';
-    for (let i = 0; i < 20; i++) {
-      deep = { nested: deep };
-    }
-    const out = JSON.stringify(normalizeCommandShape(deep));
-    // Must terminate and not blow the stack; the sentinel marks the cut.
-    expect(out).toContain('…');
-  });
-
-  it('produces identical output for identical query shapes (the N+1 template key)', () => {
-    const a = normalizeCommandShape({ filter: { email: 'a@x.com' }, limit: 1 });
-    const b = normalizeCommandShape({ filter: { email: 'b@y.com' }, limit: 999 });
-    expect(JSON.stringify(a)).toBe(JSON.stringify(b));
-  });
-});

package/src/core/modules/hub/helpers/hub-mask.helper.spec.ts

@@ -1,67 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { maskConfigDeep } from './hub-mask.helper';
-
-describe('maskConfigDeep', () => {
-  it('masks values whose key matches the secret pattern', () => {
-    const out = maskConfigDeep({
-      jwt: { secret: 'SENTINEL_JWT', refresh: { secret: 'SENTINEL_REFRESH' } },
-      port: 3000,
-    });
-
-    expect(out.jwt.secret).toBe('***');
-    expect(out.jwt.refresh.secret).toBe('***');
-    expect(out.port).toBe(3000);
-  });
-
-  it('masks a broad set of secret-ish key names', () => {
-    const out = maskConfigDeep({
-      apiKey: 'AK',
-      betterAuth: { secret: 'BA' },
-      encryptionSecret: 'ENC',
-      password: 'PW',
-      privateKey: 'PK',
-      token: 'TK',
-    });
-
-    for (const value of Object.values(out)) {
-      const flat = JSON.stringify(value);
-      expect(flat).not.toMatch(/AK|BA|ENC|PW|PK|TK/);
-    }
-  });
-
-  it('deep-clones — the input object is never mutated', () => {
-    const input = { jwt: { secret: 'SENTINEL' }, nested: { arr: [{ token: 'T' }] } };
-    const out = maskConfigDeep(input);
-
-    expect(input.jwt.secret).toBe('SENTINEL');
-    expect(input.nested.arr[0].token).toBe('T');
-    expect(out.jwt.secret).toBe('***');
-    expect(out.nested.arr[0].token).toBe('***');
-  });
-
-  it('masks credentials embedded in URI-shaped values', () => {
-    const out = maskConfigDeep({ mongoose: { uri: 'mongodb://user:secretpw@host:27017/db' } });
-
-    expect(out.mongoose.uri).not.toContain('secretpw');
-    expect(out.mongoose.uri).toContain('mongodb://');
-    expect(out.mongoose.uri).toContain('host:27017');
-  });
-
-  it('honors additional explicit secret field names', () => {
-    const out = maskConfigDeep({ customField: 'HIDE_ME', other: 'keep' }, ['customField']);
-
-    expect(out.customField).toBe('***');
-    expect(out.other).toBe('keep');
-  });
-
-  it('passes through null, numbers, booleans and dates', () => {
-    const date = new Date('2026-01-01T00:00:00.000Z');
-    const out = maskConfigDeep({ a: null, b: 42, c: true, d: date });
-
-    expect(out.a).toBeNull();
-    expect(out.b).toBe(42);
-    expect(out.c).toBe(true);
-    expect(out.d).toBeInstanceOf(Date);
-  });
-});

package/src/core/modules/hub/helpers/hub-mermaid.helper.spec.ts

@@ -1,61 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-// Value and type imports are deliberately split into two statements. The lt CLI's vendor
-// conversion drops an INLINE `type` specifier from a mixed import — `{ buildErDiagram, type
-// HubModelDescriptor }` arrives in a vendored project as `{ buildErDiagram }`, and the file then
-// fails to compile with TS2304. Keeping the two forms separate survives the conversion.
-// (The CLI defect is tracked separately; this keeps src/core/ vendor-safe meanwhile.)
-import type { HubModelDescriptor } from './hub-mermaid.helper';
-
-import { buildErDiagram } from './hub-mermaid.helper';
-
-describe('buildErDiagram', () => {
-  const models: HubModelDescriptor[] = [
-    {
-      fields: [
-        { name: 'email', type: 'String' },
-        { name: 'age', type: 'Number' },
-        { name: 'company', ref: 'Company', type: 'ObjectId' },
-      ],
-      name: 'User',
-    },
-    {
-      fields: [{ name: 'name', type: 'String' }],
-      name: 'Company',
-    },
-  ];
-
-  it('opens an erDiagram block', () => {
-    const out = buildErDiagram(models);
-    expect(out.startsWith('erDiagram')).toBe(true);
-  });
-
-  it('emits one entity per model with its fields and types', () => {
-    const out = buildErDiagram(models);
-    expect(out).toContain('User {');
-    expect(out).toContain('Company {');
-    expect(out).toContain('String email');
-    expect(out).toContain('Number age');
-  });
-
-  it('renders a relationship for a ref field', () => {
-    const out = buildErDiagram(models);
-    expect(out).toMatch(/User \|\|--o\{ Company : company/);
-  });
-
-  it('ignores refs pointing at models that are not present', () => {
-    const out = buildErDiagram([{ fields: [{ name: 'ghost', ref: 'Missing', type: 'ObjectId' }], name: 'Solo' }]);
-    expect(out).toContain('Solo {');
-    expect(out).not.toContain('Missing');
-  });
-
-  it('sanitizes field/entity names so the diagram stays valid', () => {
-    const out = buildErDiagram([{ fields: [{ name: 'weird-field.name', type: 'String' }], name: 'Odd Name' }]);
-    expect(out).not.toContain('weird-field.name');
-    expect(out).not.toContain('Odd Name {');
-  });
-
-  it('handles an empty model list without throwing', () => {
-    expect(buildErDiagram([])).toBe('erDiagram');
-  });
-});

package/src/core/modules/hub/helpers/hub-shell.helper.spec.ts

@@ -1,106 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import {
-  buildHubCsp,
-  buildHubSecurityHeaders,
-  escapeHtml,
-  escapeJsString,
-  generateNonce,
-  injectNonce,
-} from './hub-shell.helper';
-
-describe('hub-shell.helper', () => {
-  describe('escapeHtml', () => {
-    it('escapes all five HTML-significant characters', () => {
-      expect(escapeHtml(`<img src="x" onerror='y'>&`)).toBe('&lt;img src=&quot;x&quot; onerror=&#39;y&#39;&gt;&amp;');
-    });
-
-    it('neutralizes a script-tag XSS payload', () => {
-      const out = escapeHtml('<script>alert(1)</script>');
-      expect(out).not.toContain('<script>');
-      expect(out).toContain('&lt;script&gt;');
-    });
-
-    it('handles empty / non-string-ish input', () => {
-      expect(escapeHtml('')).toBe('');
-    });
-  });
-
-  describe('escapeJsString', () => {
-    it('escapes characters that would break out of a JS string / script context', () => {
-      const out = escapeJsString(`a'b\\c</script>`);
-      expect(out).not.toContain('</script>');
-      expect(out).toContain("\\'");
-      expect(out).toContain('\\\\');
-      // The closing angle bracket must be escaped so `</script>` cannot terminate the tag.
-      expect(out).toContain('\\u003c');
-    });
-
-    it('escapes CR / LF into their JS escapes', () => {
-      const out = escapeJsString('line1\r\nline2');
-      expect(out).toBe('line1\\r\\nline2');
-    });
-
-    it('escapes U+2028 / U+2029, which are line terminators inside a JS string literal', () => {
-      // Built via fromCharCode so this test file stays pure ASCII (a literal separator would itself
-      // terminate the source line). A raw U+2028 in a `'...'` literal is a syntax error at runtime.
-      const lineSep = String.fromCharCode(0x2028);
-      const paraSep = String.fromCharCode(0x2029);
-      const out = escapeJsString(`before${lineSep}mid${paraSep}after`);
-      expect(out).toContain('\\u2028');
-      expect(out).toContain('\\u2029');
-      expect(out).not.toContain(lineSep);
-      expect(out).not.toContain(paraSep);
-      // The escaped result must be a valid single-line JS string literal.
-      expect(() => new Function(`return '${out}';`)()).not.toThrow();
-      expect(new Function(`return '${out}';`)()).toBe(`before${lineSep}mid${paraSep}after`);
-    });
-  });
-
-  describe('generateNonce', () => {
-    it('produces a non-empty base64 nonce that differs each call', () => {
-      const a = generateNonce();
-      const b = generateNonce();
-      expect(a.length).toBeGreaterThan(10);
-      expect(a).not.toBe(b);
-    });
-  });
-
-  describe('injectNonce', () => {
-    it('replaces every __CSP_NONCE__ placeholder', () => {
-      const html = `<style nonce="__CSP_NONCE__"></style><script nonce="__CSP_NONCE__"></script>`;
-      const out = injectNonce(html, 'abc123');
-      expect(out).not.toContain('__CSP_NONCE__');
-      expect(out).toContain('nonce="abc123"');
-      expect((out.match(/abc123/g) ?? []).length).toBe(2);
-    });
-  });
-
-  describe('buildHubCsp', () => {
-    it('is a strict, self-contained policy pinned to the nonce', () => {
-      const csp = buildHubCsp('nonce123');
-      expect(csp).toContain("default-src 'none'");
-      expect(csp).toContain("script-src 'nonce-nonce123'");
-      expect(csp).toContain("frame-ancestors 'none'");
-      expect(csp).not.toContain('unsafe-inline');
-    });
-  });
-
-  describe('buildHubSecurityHeaders', () => {
-    it('returns the strict header set with no-store for HTML by default', () => {
-      const headers = buildHubSecurityHeaders('n1');
-      expect(headers['Content-Security-Policy']).toContain('nonce-n1');
-      expect(headers['X-Frame-Options']).toBe('DENY');
-      expect(headers['X-Content-Type-Options']).toBe('nosniff');
-      expect(headers['Referrer-Policy']).toBe('no-referrer');
-      expect(headers['Cache-Control']).toContain('no-store');
-    });
-
-    it('uses a long-lived immutable cache for the cacheable script bundle', () => {
-      const headers = buildHubSecurityHeaders('n1', { cacheable: true });
-      expect(headers['Cache-Control']).toContain('max-age');
-      expect(headers['Cache-Control']).toContain('immutable');
-      expect(headers['Cache-Control']).not.toContain('no-store');
-    });
-  });
-});

package/src/core/modules/hub/hub-config.helper.spec.ts

@@ -1,108 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { isHubEnabled, isHubQueriesEnabled, normalizeHubConfig } from './hub-config.helper';
-
-describe('hub-config.helper', () => {
-  describe('isHubEnabled', () => {
-    it('is disabled by default (undefined)', () => {
-      expect(isHubEnabled(undefined)).toBe(false);
-      expect(isHubEnabled(false)).toBe(false);
-    });
-
-    it('is enabled for true / {} / a config object', () => {
-      expect(isHubEnabled(true)).toBe(true);
-      expect(isHubEnabled({})).toBe(true);
-      expect(isHubEnabled({ path: 'x' })).toBe(true);
-    });
-
-    it('respects explicit { enabled: false }', () => {
-      expect(isHubEnabled({ enabled: false, path: 'x' })).toBe(false);
-    });
-  });
-
-  describe('isHubQueriesEnabled', () => {
-    it('is off by default even when the hub is enabled', () => {
-      expect(isHubQueriesEnabled(true)).toBe(false);
-      expect(isHubQueriesEnabled({})).toBe(false);
-    });
-
-    it('is on when queries collector is explicitly enabled', () => {
-      expect(isHubQueriesEnabled({ collectors: { queries: true } })).toBe(true);
-      expect(isHubQueriesEnabled({ collectors: { queries: { warnMs: 5 } } })).toBe(true);
-      expect(isHubQueriesEnabled({ collectors: { queries: { enabled: false } } })).toBe(false);
-    });
-
-    it('is off when the hub itself is disabled', () => {
-      expect(isHubQueriesEnabled(false)).toBe(false);
-      expect(isHubQueriesEnabled({ collectors: { queries: true }, enabled: false })).toBe(false);
-    });
-  });
-
-  describe('normalizeHubConfig', () => {
-    it('applies defaults for the boolean-true form', () => {
-      const cfg = normalizeHubConfig(true, { env: 'local', version: '1.2.3' });
-
-      expect(cfg.path).toBe('hub');
-      expect(cfg.roles).toEqual(['admin']);
-      expect(cfg.actions).toBe(true);
-      expect(cfg.pollIntervalMs).toBe(5000);
-      expect(cfg.env).toBe('local');
-      expect(cfg.version).toBe('1.2.3');
-      // Default collectors: logs + traces on, queries off.
-      expect(cfg.collectors.logs).not.toBe(false);
-      expect(cfg.collectors.traces).not.toBe(false);
-      expect(cfg.collectors.queries).toBe(false);
-    });
-
-    it('clamps the poll interval to the minimum', () => {
-      const cfg = normalizeHubConfig({ pollIntervalMs: 10 }, { env: 'local', version: '1' });
-      expect(cfg.pollIntervalMs).toBe(1000);
-    });
-
-    it('normalizes a single role string to an array', () => {
-      const cfg = normalizeHubConfig({ roles: 'S_USER' }, { env: 'local', version: '1' });
-      expect(cfg.roles).toEqual(['S_USER']);
-    });
-
-    it('keeps roles: false (opt-out of auth)', () => {
-      const cfg = normalizeHubConfig({ roles: false }, { env: 'local', version: '1' });
-      expect(cfg.roles).toBe(false);
-    });
-
-    it('resolves the queries collector with thresholds when enabled', () => {
-      const cfg = normalizeHubConfig({ collectors: { queries: { warnMs: 5 } } }, { env: 'local', version: '1' });
-      expect(cfg.collectors.queries).not.toBe(false);
-      if (cfg.collectors.queries) {
-        expect(cfg.collectors.queries.warnMs).toBe(5);
-        expect(cfg.collectors.queries.criticalMs).toBe(200);
-        expect(cfg.collectors.queries.capacity).toBe(500);
-      }
-    });
-
-    it('defaults the mailbox to disabled but enables it with capture mode when present', () => {
-      expect(normalizeHubConfig({}, { env: 'local', version: '1' }).mailbox).toBe(false);
-
-      const cfg = normalizeHubConfig({ mailbox: true }, { env: 'local', version: '1' });
-      expect(cfg.mailbox).not.toBe(false);
-      if (cfg.mailbox) {
-        expect(cfg.mailbox.mode).toBe('capture');
-        expect(cfg.mailbox.capacity).toBe(100);
-      }
-    });
-
-    it('resolves default external links', () => {
-      const cfg = normalizeHubConfig(
-        {},
-        { env: 'local', graphQlEnabled: true, permissionsPath: 'permissions', version: '1' },
-      );
-      expect(cfg.links.swagger).toBe('/swagger');
-      expect(cfg.links.graphql).toBe('/graphql');
-      expect(cfg.links.permissions).toBe('/permissions');
-    });
-
-    it('omits the graphql link when GraphQL is disabled', () => {
-      const cfg = normalizeHubConfig({}, { env: 'local', graphQlEnabled: false, version: '1' });
-      expect(cfg.links.graphql).toBeUndefined();
-    });
-  });
-});

package/src/core/modules/hub/hub-ring-buffer.spec.ts

@@ -1,95 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { HubRingBuffer } from './hub-ring-buffer';
-
-interface TestEntry {
-  seq: number;
-  timestamp: number;
-  value: string;
-}
-
-describe('HubRingBuffer', () => {
-  it('assigns monotonic sequence numbers and a timestamp', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    const a = buffer.add({ value: 'a' });
-    const b = buffer.add({ value: 'b' });
-
-    expect(a.seq).toBe(0);
-    expect(b.seq).toBe(1);
-    expect(typeof a.timestamp).toBe('number');
-    expect(b.seq).toBeGreaterThan(a.seq);
-  });
-
-  it('honors an explicitly provided timestamp', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    const entry = buffer.add({ timestamp: 123456, value: 'a' });
-
-    expect(entry.timestamp).toBe(123456);
-  });
-
-  it('evicts the oldest entries once capacity is exceeded (fixed memory)', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    for (const value of ['a', 'b', 'c', 'd', 'e']) {
-      buffer.add({ value });
-    }
-
-    const items = buffer.recent();
-    expect(items.map((i) => i.value)).toEqual(['c', 'd', 'e']);
-    expect(buffer.size).toBe(3);
-  });
-
-  it('recent(limit) returns the newest N entries, oldest→newest', () => {
-    const buffer = new HubRingBuffer<TestEntry>(5);
-    for (const value of ['a', 'b', 'c', 'd']) {
-      buffer.add({ value });
-    }
-
-    expect(buffer.recent(2).map((i) => i.value)).toEqual(['c', 'd']);
-  });
-
-  it('since(seq) returns only entries newer than the cursor', () => {
-    const buffer = new HubRingBuffer<TestEntry>(10);
-    buffer.add({ value: 'a' }); // seq 0
-    const b = buffer.add({ value: 'b' }); // seq 1
-    buffer.add({ value: 'c' }); // seq 2
-
-    expect(buffer.since(b.seq).map((i) => i.value)).toEqual(['c']);
-    expect(buffer.since(-1).map((i) => i.value)).toEqual(['a', 'b', 'c']);
-    expect(buffer.since(buffer.lastSeq)).toEqual([]);
-  });
-
-  it('since(seq) clamps to what is still retained after eviction', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    for (const value of ['a', 'b', 'c', 'd', 'e']) {
-      buffer.add({ value }); // seqs 0..4, only 2,3,4 retained
-    }
-
-    // Asking since an evicted cursor (seq 0) returns only what survives, no crash, no duplicates.
-    expect(buffer.since(0).map((i) => i.value)).toEqual(['c', 'd', 'e']);
-    expect(buffer.firstRetainedSeq).toBe(2);
-  });
-
-  it('exposes lastSeq (-1 when empty) and firstRetainedSeq', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    expect(buffer.lastSeq).toBe(-1);
-    expect(buffer.firstRetainedSeq).toBe(-1);
-    expect(buffer.size).toBe(0);
-
-    buffer.add({ value: 'a' });
-    expect(buffer.lastSeq).toBe(0);
-    expect(buffer.firstRetainedSeq).toBe(0);
-  });
-
-  it('clear() empties the buffer but keeps the sequence counter monotonic', () => {
-    const buffer = new HubRingBuffer<TestEntry>(3);
-    buffer.add({ value: 'a' });
-    buffer.add({ value: 'b' });
-    buffer.clear();
-
-    expect(buffer.size).toBe(0);
-    expect(buffer.recent()).toEqual([]);
-    // A new entry after clear must not reuse an old seq (cursors stay valid across a clear).
-    const c = buffer.add({ value: 'c' });
-    expect(c.seq).toBe(2);
-  });
-});