@luckystack/server 0.10.0 → 0.10.2

package/docs/http-routes.md

@@ -38,7 +38,7 @@ A custom-route registry sits in front of the static fallback. Both the legacy `c
 | `/livez` | GET | `handleLivezRoute` | `200 { status: 'live' }` | Always 200 when reachable |
 | `/readyz` | GET | `handleReadyzRoute` | `200 { status: 'ready', checks: {...} }` | `503 { status: 'not-ready', checks: {...} }` |
 | `/_health` | GET | `handleHealthRoute` | `200 { status: 'ok', bootUuid, envKey, synchronizedHashes }` | `503 { status: 'degraded', ... }` when boot UUID is missing |
-| `/_test/reset` | POST | `handleTestResetRoute` | `200 { status: 'success', cleared: string[] }` | `404 notFound` or `403 auth.forbidden` — see `security-defaults.md` |
+| `/_test/reset` | POST | `handleTestResetRoute` | `200 { status: 'success', cleared: string[] }` | `404 notFound`, `403 auth.forbidden`, or `400 test.invalidResetTarget` (bad `?only=`) — see `security-defaults.md` |
 | `/uploads/*` | GET | `handleUploadsRoute` | Avatar bytes via `@luckystack/core` `serveAvatar` | `404` from `serveAvatar` when missing |
 | `/auth/api/email-code/request` | POST | `handleAuthEmailCodeRoute` | `200 { status: true }` (anti-enumeration: also for unknown addresses) | `200 { status:false, reason }`, `429` per-IP |
 | `/auth/api/email-code/verify` | POST | `handleAuthEmailCodeRoute` | Login envelope + session transport, or 2FA-challenge envelope | `200 { status:false, reason }`, `429` per-IP |
@@ -54,7 +54,7 @@ A custom-route registry sits in front of the static fallback. Both the legacy `c
 
 > `GET /auth/csrf` issues the token; state-changing requests send it using `getCsrfConfig().headerName` (default `x-csrf-token`). `registerCsrfConfig(...)` also controls the login-absent cookie name/options and token length.
 >
-> `/_test/reset` clears rate limits and only the framework's default Redis session/active-user namespaces. It does not clear application database rows or invoke a custom `SessionAdapter`; custom-storage tests own that cleanup.
+> `/_test/reset` clears rate limits and only the framework's default Redis session/active-user namespaces; `?only=<target>[,<target>]` narrows it to the listed targets (so a logged-in test sweep can drain limiter buckets without deleting its own session). It does not clear application database rows or invoke a custom `SessionAdapter`; custom-storage tests own that cleanup.
 
 ## API Reference — handlers
 

package/docs/security-defaults.md

@@ -122,9 +122,11 @@ x-test-reset-token: <value of TEST_RESET_TOKEN>
 
 **What the reset clears:**
 
+Without `?only=` the default below runs. With `?only=<target>[,<target>]` exactly the listed targets run and nothing else; the valid targets are core's `TEST_RESET_TARGETS` (shared with `@luckystack/test-runner`, so the two sides cannot drift). An unknown or empty target returns `400 { status: 'error', errorCode: 'test.invalidResetTarget' }` — a typo must not silently reset nothing, or everything. The selector exists because the default also deletes the session an authenticated test sweep runs on; the runner therefore always sends `only=rateLimits`.
+
 | Step | Action |
 | --- | --- |
-| 1 | `clearAllRateLimits()` — purges in-memory + Redis rate-limit counters. Always reported in `cleared`. |
+| 1 | `clearAllRateLimits()` — purges in-memory + Redis rate-limit counters. Reported in `cleared` whenever it runs. |
 | 2 | `redis SCAN` + `DEL` keys matching `<projectName>-session:*`. Reported as `'sessions'` when at least one key is deleted. |
 | 3 | `redis SCAN` + `DEL` keys matching `<projectName>-activeUsers:*`. Reported as `'activeUsers'` when at least one key is deleted. |
 | 4 (opt-in) | When `?include=hooks` is supplied, `clearAllHooks()` empties every framework hook registration. Reported as `'hooks'`. |
@@ -137,7 +139,7 @@ x-test-reset-token: <value of TEST_RESET_TOKEN>
 
 **Errors / edge cases:**
 
-- Malformed `req.url` is detected with `URL.canParse(rawUrl, base)`. When false, `?include=hooks` is treated as absent.
+- Malformed `req.url` is detected with `URL.canParse(rawUrl, base)`. When false, the query is treated as empty: no `only`, no `?include=hooks` — the default reset runs.
 - Redis `SCAN`+`DEL` errors are swallowed per pattern — the cleared array simply omits the label.
 - The hook-clear is opt-in because clearing every hook also removes framework-internal registrations (e.g. presence's `postLogout`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luckystack/server",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "private": false,
   "publishConfig": {
     "access": "public",
@@ -57,20 +57,20 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@luckystack/api": "^0.10.0",
-    "@luckystack/core": "^0.10.0"
+    "@luckystack/api": "^0.10.2",
+    "@luckystack/core": "^0.10.2"
   },
   "peerDependencies": {
     "@prisma/client": "^6.19.0",
     "socket.io": "^4.8.0",
-    "@luckystack/cron": "^0.10.0",
-    "@luckystack/devkit": "^0.10.0",
-    "@luckystack/docs-ui": "^0.10.0",
-    "@luckystack/email": "^0.10.0",
-    "@luckystack/error-tracking": "^0.10.0",
-    "@luckystack/login": "^0.10.0",
-    "@luckystack/presence": "^0.10.0",
-    "@luckystack/sync": "^0.10.0"
+    "@luckystack/cron": "^0.10.2",
+    "@luckystack/devkit": "^0.10.2",
+    "@luckystack/docs-ui": "^0.10.2",
+    "@luckystack/email": "^0.10.2",
+    "@luckystack/error-tracking": "^0.10.2",
+    "@luckystack/login": "^0.10.2",
+    "@luckystack/presence": "^0.10.2",
+    "@luckystack/sync": "^0.10.2"
   },
   "peerDependenciesMeta": {
     "@prisma/client": {