@luckystack/server 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -5,7 +5,11 @@ All notable changes to `@luckystack/server` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.10.2] - 2026-10-09
+
+### Added
+
+- `/_test/reset` accepts `?only=<target>[,<target>]` to clear exactly those targets (the shared list in core `TEST_RESET_TARGETS`). An unknown or empty target is `400 test.invalidResetTarget` — a typo must not silently reset nothing, or everything. Without `only` the default reset is unchanged. This lets an authenticated test sweep drain limiter buckets without deleting its own session.
 
 ## [0.8.7] - 2026-08-18
 

package/CLAUDE.md

@@ -69,6 +69,7 @@ One-call server bootstrap for a LuckyStack project. Wires together a raw Node.js
 - `SERVER_IP` (env, optional, default `127.0.0.1`) — bind address fallback when `options.ip` is omitted.
 - `NODE_ENV` (env, required for security-sensitive branches) — `development` / `test` toggle devkit hot reload + REPL and gate `/_test/reset`.
 - `TEST_RESET_TOKEN` (env, required for `/_test/reset` to be reachable at all) — must match the `x-test-reset-token` request header. No fallback "no auth" mode.
+- `/_test/reset?only=<target>[,<target>]` (query) — clear only the listed targets (core `TEST_RESET_TARGETS`); unknown/empty → `400 test.invalidResetTarget`. Without `only` the default reset (rate limits + sessions + activeUsers, hooks via `?include=hooks`) is unchanged.
 - `projectConfig.http.healthEndpoint` (config) — path served by `handleHealthRoute`. Default `/_health`.
 - `projectConfig.http.liveEndpoint` (config) — path served by `handleLivezRoute`. Default `/livez`.
 - `projectConfig.http.readyEndpoint` (config) — path served by `handleReadyzRoute`. Default `/readyz`.

package/dist/index.js

@@ -391,9 +391,12 @@ import {
   clearAllRateLimits,
   getProjectConfig as getProjectConfig4,
   formatKey,
+  isTestResetTarget,
   redis as redis2,
+  TEST_RESET_ONLY_PARAM,
   tryCatch as tryCatch2
 } from "@luckystack/core";
+var splitList = (value) => (value ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var handleTestResetRoute = async ({ req, res, routePath }) => {
   if (routePath !== getProjectConfig4().http.testResetEndpoint) return false;
   const nodeEnv = process.env.NODE_ENV;
@@ -419,9 +422,33 @@ var handleTestResetRoute = async ({ req, res, routePath }) => {
     res.end(JSON.stringify({ status: "error", errorCode: "auth.forbidden" }));
     return true;
   }
+  const rawUrl = req.url ?? "/";
+  const searchParams = URL.canParse(rawUrl, "http://localhost") ? new URL(rawUrl, "http://localhost").searchParams : new URLSearchParams();
+  const onlyParam = searchParams.get(TEST_RESET_ONLY_PARAM);
+  let targets;
+  if (onlyParam === null) {
+    targets = /* @__PURE__ */ new Set(["rateLimits", "sessions", "activeUsers"]);
+    if (splitList(searchParams.get("include")).includes("hooks")) targets.add("hooks");
+  } else {
+    const requested = splitList(onlyParam);
+    const unknown = requested.filter((target) => !isTestResetTarget(target));
+    if (requested.length === 0 || unknown.length > 0) {
+      res.statusCode = 400;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify({
+        status: "error",
+        errorCode: "test.invalidResetTarget",
+        errorParams: [{ key: "target", value: unknown.join(",") || "(empty)" }]
+      }));
+      return true;
+    }
+    targets = new Set(requested.filter(isTestResetTarget));
+  }
   const cleared = [];
-  await clearAllRateLimits();
-  cleared.push("rateLimits");
+  if (targets.has("rateLimits")) {
+    await clearAllRateLimits();
+    cleared.push("rateLimits");
+  }
   const sessionPattern = `${formatKey("-session", "")}:*`;
   const activeUsersPattern = `${formatKey("-activeUsers", "")}:*`;
   const scanAndDelete = async (pattern, label) => {
@@ -442,11 +469,9 @@ var handleTestResetRoute = async ({ req, res, routePath }) => {
     if (deleted > 0) cleared.push(label);
     return deleted;
   };
-  await scanAndDelete(sessionPattern, "sessions");
-  await scanAndDelete(activeUsersPattern, "activeUsers");
-  const rawUrl = req.url ?? "/";
-  const includeFlag = URL.canParse(rawUrl, "http://localhost") ? new URL(rawUrl, "http://localhost").searchParams.get("include") ?? "" : "";
-  if (includeFlag.split(",").map((s) => s.trim()).includes("hooks")) {
+  if (targets.has("sessions")) await scanAndDelete(sessionPattern, "sessions");
+  if (targets.has("activeUsers")) await scanAndDelete(activeUsersPattern, "activeUsers");
+  if (targets.has("hooks")) {
     clearAllHooks();
     cleared.push("hooks");
   }