@luckystack/test-runner 0.1.8 → 0.2.0

package/dist/index.js

@@ -1,12 +1,25 @@
 // src/walkEndpoints.ts
+var VALID_HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE"]);
+var toHttpMethod = (raw) => {
+  const upper = raw.toUpperCase();
+  for (const m of VALID_HTTP_METHODS) {
+    if (m === upper) return m;
+  }
+  return null;
+};
 var walkEndpoints = (apiMethodMap) => {
   const endpoints = [];
   for (const [page, nameMap] of Object.entries(apiMethodMap)) {
     if (!nameMap) continue;
     for (const [name, versionMap] of Object.entries(nameMap)) {
       if (!versionMap) continue;
-      for (const [version, method] of Object.entries(versionMap)) {
-        if (method === void 0) continue;
+      for (const [version, rawMethod] of Object.entries(versionMap)) {
+        if (rawMethod === void 0) continue;
+        const method = toHttpMethod(rawMethod);
+        if (!method) {
+          console.warn(`[test-runner] walkEndpoints: skipping api/${page}/${name}/${version} \u2014 unrecognised method '${rawMethod}' in apiMethodMap`);
+          continue;
+        }
         endpoints.push({
           page,
           name,
@@ -19,61 +32,94 @@ var walkEndpoints = (apiMethodMap) => {
   }
   return endpoints;
 };
+var walkSyncEndpoints = (syncMethodMap) => {
+  const endpoints = [];
+  for (const [page, nameMap] of Object.entries(syncMethodMap)) {
+    if (!nameMap) continue;
+    for (const [name, versionMap] of Object.entries(nameMap)) {
+      if (!versionMap) continue;
+      for (const [version, method] of Object.entries(versionMap)) {
+        if (method === void 0) continue;
+        endpoints.push({
+          page,
+          name,
+          version,
+          method: "POST",
+          fullPath: `sync/${page}/${name}/${version}`
+        });
+      }
+    }
+  }
+  return endpoints;
+};
 
-// src/contractCheck.ts
+// src/probeRequest.ts
 import { tryCatch } from "@luckystack/core";
-var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
-var runContractCheck = async (input) => {
-  const { endpoint, baseUrl } = input;
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
-  const body = input.inputFor ? input.inputFor(endpoint) : {};
-  const started = Date.now();
-  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+var sendProbe = async (input) => {
   const controller = new AbortController();
   const timeoutHandle = setTimeout(() => {
     controller.abort();
-  }, requestTimeoutMs);
-  const [fetchError, response] = await tryCatch(() => fetch(url, {
-    method: endpoint.method,
+  }, input.requestTimeoutMs);
+  const [fetchError, response] = await tryCatch(() => fetch(input.url, {
+    method: input.method,
     headers: {
       "Content-Type": "application/json",
       //? Browsers attach Origin on state-changing requests; the server's origin
-      //? policy fail-closes POST/PUT/DELETE without one. Send the same-origin
-      //? value so the request reaches the API pipeline (consumers can override).
-      "Origin": new URL(baseUrl).origin,
+      //? policy fail-closes POST/PUT/DELETE without one.
+      "Origin": new URL(input.baseUrl).origin,
       ...input.headers
     },
-    body: endpoint.method === "GET" ? void 0 : JSON.stringify(body),
+    body: input.method === "GET" ? void 0 : JSON.stringify(input.body),
     signal: controller.signal
   }));
   clearTimeout(timeoutHandle);
-  if (fetchError || !response) {
+  if (fetchError || !response) return null;
+  const [, parsed] = await tryCatch(
+    async () => await response.json()
+  );
+  return { httpStatus: response.status, parsed: parsed ?? null };
+};
+
+// src/contractCheck.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
+var runContractCheck = async (input) => {
+  const { endpoint, baseUrl } = input;
+  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
+  const body = input.inputFor ? input.inputFor(endpoint) : {};
+  const started = Date.now();
+  const result = await sendProbe({
+    url,
+    method: endpoint.method,
+    baseUrl,
+    body,
+    headers: input.headers,
+    requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS
+  });
+  if (!result) {
     return {
       endpoint,
       status: "fail",
-      reason: fetchError?.message ?? "fetch returned no response",
+      reason: "fetch returned no response",
       durationMs: Date.now() - started
     };
   }
-  const [parseError, parsed] = await tryCatch(
-    async () => await response.json()
-  );
+  const { httpStatus, parsed } = result;
   const durationMs = Date.now() - started;
-  if (parseError) {
+  if (!parsed) {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "unknown",
-      reason: `JSON parse failed: ${parseError.message}`,
+      reason: "JSON parse failed",
       durationMs
     };
   }
-  if (!parsed || parsed.status !== "success" && parsed.status !== "error") {
+  if (parsed.status !== "success" && parsed.status !== "error") {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "unknown",
       reason: "Response missing standard `status` envelope",
       durationMs
@@ -83,29 +129,69 @@ var runContractCheck = async (input) => {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "error",
       reason: "Error response missing `errorCode`",
       durationMs
     };
   }
+  const bodyIsNonEmpty = body !== null && typeof body === "object" && !Array.isArray(body) && Object.keys(body).length > 0;
+  if (input.inputFor && bodyIsNonEmpty && parsed.status === "error") {
+    return {
+      endpoint,
+      status: "skipped",
+      httpStatus,
+      responseStatus: "error",
+      errorCode: parsed.errorCode,
+      reason: `inputFor produced a non-empty sample but route returned error (${parsed.errorCode ?? "unknown"}); provide a valid sample via inputFor to test the happy path`,
+      durationMs
+    };
+  }
   return {
     endpoint,
     status: "pass",
-    httpStatus: response.status,
+    httpStatus,
     responseStatus: parsed.status,
     errorCode: parsed.errorCode,
     durationMs
   };
 };
 
-// src/runContractTests.ts
+// src/testLayerHelpers.ts
+var LAYER_KEYS = {
+  contract: "contract",
+  auth: "auth-enforcement",
+  rateLimit: "rate-limit",
+  csrf: "csrf-enforcement",
+  fuzz: "fuzz",
+  custom: "custom"
+};
+var STATE_CHANGING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE"]);
 var shouldSkip = (endpoint, skip) => {
   if (skip.length === 0) return false;
   const versioned = `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
   const versionless = `${endpoint.page}/${endpoint.name}`;
   return skip.includes(versioned) || skip.includes(versionless);
 };
+var requiresLogin = (apiMetaMap, endpoint) => {
+  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  return meta?.auth?.login ?? false;
+};
+var hasMetaEntry = (apiMetaMap, endpoint) => apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
+var getRateLimit = (apiMetaMap, endpoint) => {
+  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  if (!meta || meta.rateLimit === false || meta.rateLimit === void 0) return null;
+  return meta.rateLimit;
+};
+var calculateSummary = (results) => ({
+  total: results.length,
+  passed: results.filter((r) => r.status === "pass").length,
+  failed: results.filter((r) => r.status === "fail").length,
+  skipped: results.filter((r) => r.status === "skipped").length,
+  results
+});
+
+// src/runContractTests.ts
 var runContractTests = async (input) => {
   const endpoints = walkEndpoints(input.apiMethodMap);
   const skip = input.skip ?? [];
@@ -131,17 +217,10 @@ var runContractTests = async (input) => {
     results.push(result);
     input.onResult?.(result);
   }
-  return {
-    total: results.length,
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    results
-  };
+  return calculateSummary(results);
 };
 
 // src/authEnforcementCheck.ts
-import { tryCatch as tryCatch2 } from "@luckystack/core";
 var DEFAULT_REQUEST_TIMEOUT_MS2 = 5e3;
 var EXPECTED_ERROR_CODE = "auth.required";
 var runAuthEnforcementCheck = async (input) => {
@@ -149,49 +228,30 @@ var runAuthEnforcementCheck = async (input) => {
   const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
-  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2;
-  const controller = new AbortController();
-  const timeoutHandle = setTimeout(() => {
-    controller.abort();
-  }, requestTimeoutMs);
-  const [fetchError, response] = await tryCatch2(() => fetch(url, {
+  const result = await sendProbe({
+    url,
     method: endpoint.method,
-    //? No session cookie, no auth header — deliberately. Origin IS sent so the
-    //? server's origin policy doesn't 403 before the auth check can run.
-    headers: { "Content-Type": "application/json", "Origin": new URL(baseUrl).origin },
-    body: endpoint.method === "GET" ? void 0 : JSON.stringify(body),
-    signal: controller.signal
-  }));
-  clearTimeout(timeoutHandle);
-  if (fetchError || !response) {
+    baseUrl,
+    body,
+    requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2
+  });
+  if (!result) {
     return {
       endpoint,
       status: "fail",
-      reason: fetchError?.message ?? "fetch returned no response",
+      reason: "fetch returned no response",
       durationMs: Date.now() - started
     };
   }
-  const [parseError, parsed] = await tryCatch2(
-    async () => await response.json()
-  );
+  const { httpStatus, parsed } = result;
   const durationMs = Date.now() - started;
-  if (parseError) {
-    return {
-      endpoint,
-      status: "fail",
-      httpStatus: response.status,
-      responseStatus: "unknown",
-      reason: `JSON parse failed: ${parseError.message}`,
-      durationMs
-    };
-  }
   if (parsed?.status === "success") {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "success",
-      reason: `auth.login endpoint returned success without a session`,
+      reason: "auth.login endpoint returned success without a session",
       durationMs
     };
   }
@@ -199,7 +259,7 @@ var runAuthEnforcementCheck = async (input) => {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "unknown",
       reason: "Response missing standard `status` envelope",
       durationMs
@@ -209,7 +269,7 @@ var runAuthEnforcementCheck = async (input) => {
     return {
       endpoint,
       status: "fail",
-      httpStatus: response.status,
+      httpStatus,
       responseStatus: "error",
       errorCode: parsed.errorCode,
       reason: `expected errorCode '${EXPECTED_ERROR_CODE}' but got '${parsed.errorCode ?? "(missing)"}'`,
@@ -219,7 +279,7 @@ var runAuthEnforcementCheck = async (input) => {
   return {
     endpoint,
     status: "pass",
-    httpStatus: response.status,
+    httpStatus,
     responseStatus: "error",
     errorCode: parsed.errorCode,
     durationMs
@@ -227,16 +287,6 @@ var runAuthEnforcementCheck = async (input) => {
 };
 
 // src/runAuthEnforcementTests.ts
-var shouldSkip2 = (endpoint, skip) => {
-  if (skip.length === 0) return false;
-  const versioned = `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
-  const versionless = `${endpoint.page}/${endpoint.name}`;
-  return skip.includes(versioned) || skip.includes(versionless);
-};
-var requiresLogin = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return meta?.auth.login ?? false;
-};
 var runAuthEnforcementTests = async (input) => {
   const endpoints = walkEndpoints(input.apiMethodMap);
   const skip = input.skip ?? [];
@@ -245,7 +295,7 @@ var runAuthEnforcementTests = async (input) => {
     if (!requiresLogin(input.apiMetaMap, endpoint)) {
       continue;
     }
-    if (shouldSkip2(endpoint, skip)) {
+    if (shouldSkip(endpoint, skip)) {
       const skipped = {
         endpoint,
         status: "skipped",
@@ -264,46 +314,50 @@ var runAuthEnforcementTests = async (input) => {
     results.push(result);
     input.onResult?.(result);
   }
-  return {
-    total: results.length,
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    results
-  };
+  return calculateSummary(results);
 };
 
 // src/rateLimitCheck.ts
-import { tryCatch as tryCatch3 } from "@luckystack/core";
 var DEFAULT_REQUEST_TIMEOUT_MS3 = 1e4;
 var EXPECTED_ERROR_CODE2 = "api.rateLimitExceeded";
+var PRE_LIMITER_ERROR_CODES = /* @__PURE__ */ new Set([
+  "auth.required",
+  "auth.csrfTokenMissing",
+  "auth.csrfTokenInvalid",
+  "auth.unauthorized",
+  "api.csrfTokenMissing",
+  "api.csrfTokenInvalid",
+  "api.unauthorized",
+  "api.validationError"
+]);
 var runRateLimitCheck = async (input) => {
   const { endpoint, baseUrl, rateLimit } = input;
   const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
   const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS3;
-  const send = async () => {
-    const controller = new AbortController();
-    const timeoutHandle = setTimeout(() => {
-      controller.abort();
-    }, requestTimeoutMs);
-    const [error, response] = await tryCatch3(() => fetch(url, {
-      method: endpoint.method,
-      headers: {
-        "Content-Type": "application/json",
-        "Origin": new URL(baseUrl).origin,
-        ...input.headers
-      },
-      body: endpoint.method === "GET" ? void 0 : JSON.stringify(body),
-      signal: controller.signal
-    }));
-    clearTimeout(timeoutHandle);
-    if (error || !response) return null;
-    return response;
-  };
+  const send = () => sendProbe({
+    url,
+    method: endpoint.method,
+    baseUrl,
+    body,
+    headers: input.headers,
+    requestTimeoutMs
+  });
   for (let i = 0; i < rateLimit; i += 1) {
-    await send();
+    const drained = await send();
+    if (!drained) continue;
+    if (i === 0) {
+      const errorCode = drained.parsed?.errorCode;
+      if (errorCode && PRE_LIMITER_ERROR_CODES.has(errorCode)) {
+        return {
+          endpoint,
+          status: "skipped",
+          durationMs: Date.now() - started,
+          reason: `drain response rejected pre-limiter (${errorCode}); bucket was never incremented \u2014 check CSRF/auth headers`
+        };
+      }
+    }
   }
   const final = await send();
   const durationMs = Date.now() - started;
@@ -315,24 +369,23 @@ var runRateLimitCheck = async (input) => {
       durationMs
     };
   }
-  const [, parsed] = await tryCatch3(
-    async () => await final.json()
-  );
+  const { httpStatus, parsed } = final;
   if (parsed?.status === "error" && parsed.errorCode === EXPECTED_ERROR_CODE2) {
     return {
       endpoint,
       status: "pass",
-      httpStatus: final.status,
+      httpStatus,
       responseStatus: "error",
       errorCode: parsed.errorCode,
       durationMs
     };
   }
+  const responseStatus = parsed?.status === "success" || parsed?.status === "error" ? parsed.status : "unknown";
   return {
     endpoint,
     status: "fail",
-    httpStatus: final.status,
-    responseStatus: parsed?.status ?? "unknown",
+    httpStatus,
+    responseStatus,
     errorCode: parsed?.errorCode,
     reason: `expected '${EXPECTED_ERROR_CODE2}' on request ${rateLimit + 1} but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
     durationMs
@@ -340,32 +393,23 @@ var runRateLimitCheck = async (input) => {
 };
 
 // src/resetServerState.ts
-import { tryCatch as tryCatch4 } from "@luckystack/core";
-var resetServerState = async ({ baseUrl, token }) => {
+import { tryCatch as tryCatch2 } from "@luckystack/core";
+var DEFAULT_REQUEST_TIMEOUT_MS4 = 1e4;
+var resetServerState = async ({ baseUrl, token, requestTimeoutMs }) => {
   const url = `${baseUrl.replace(/\/$/, "")}/_test/reset`;
   const headers = { "Content-Type": "application/json" };
   if (token) headers["X-Test-Reset-Token"] = token;
-  const [error, response] = await tryCatch4(() => fetch(url, { method: "POST", headers }));
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => {
+    controller.abort();
+  }, requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS4);
+  const [error, response] = await tryCatch2(() => fetch(url, { method: "POST", headers, signal: controller.signal }));
+  clearTimeout(timeoutHandle);
   if (error || !response) return false;
   return response.ok;
 };
 
 // src/runRateLimitTests.ts
-var getRateLimit = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  if (!meta || meta.rateLimit === false || meta.rateLimit === void 0) return null;
-  return meta.rateLimit;
-};
-var requiresLogin2 = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return meta?.auth.login ?? false;
-};
-var shouldSkip3 = (endpoint, skip) => {
-  if (skip.length === 0) return false;
-  const versioned = `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
-  const versionless = `${endpoint.page}/${endpoint.name}`;
-  return skip.includes(versioned) || skip.includes(versionless);
-};
 var runRateLimitTests = async (input) => {
   const endpoints = walkEndpoints(input.apiMethodMap);
   const skip = input.skip ?? [];
@@ -375,7 +419,7 @@ var runRateLimitTests = async (input) => {
   for (const endpoint of endpoints) {
     const rateLimit = getRateLimit(input.apiMetaMap, endpoint);
     if (rateLimit === null) continue;
-    if (!isAuthenticatedSweep && requiresLogin2(input.apiMetaMap, endpoint)) {
+    if (!isAuthenticatedSweep && requiresLogin(input.apiMetaMap, endpoint)) {
       const skipped = {
         endpoint,
         status: "skipped",
@@ -386,6 +430,17 @@ var runRateLimitTests = async (input) => {
       input.onResult?.(skipped);
       continue;
     }
+    if (isAuthenticatedSweep && STATE_CHANGING_METHODS.has(endpoint.method)) {
+      const skipped = {
+        endpoint,
+        status: "skipped",
+        durationMs: 0,
+        reason: "state-changing route skipped in cookie-mode rate-limit sweep (mutation risk with junk bodies)"
+      };
+      results.push(skipped);
+      input.onResult?.(skipped);
+      continue;
+    }
     if (rateLimit > maxRateLimit) {
       const skipped = {
         endpoint,
@@ -397,7 +452,7 @@ var runRateLimitTests = async (input) => {
       input.onResult?.(skipped);
       continue;
     }
-    if (shouldSkip3(endpoint, skip)) {
+    if (shouldSkip(endpoint, skip)) {
       const skipped = {
         endpoint,
         status: "skipped",
@@ -421,18 +476,114 @@ var runRateLimitTests = async (input) => {
     results.push(result);
     input.onResult?.(result);
   }
-  return {
-    total: results.length,
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    results
-  };
+  return calculateSummary(results);
+};
+
+// src/csrfEnforcementCheck.ts
+var DEFAULT_REQUEST_TIMEOUT_MS5 = 5e3;
+var DEFAULT_EXPECTED_ERROR_CODE = "auth.csrfMismatch";
+var DEFAULT_EXPECTED_HTTP_STATUS = 403;
+var runCsrfEnforcementCheck = async (input) => {
+  const { endpoint, baseUrl } = input;
+  if (endpoint.method === "GET") {
+    return {
+      endpoint,
+      status: "skipped",
+      reason: `CSRF enforcement does not apply to ${endpoint.method} requests`,
+      durationMs: 0
+    };
+  }
+  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
+  const body = input.inputFor ? input.inputFor(endpoint) : {};
+  const started = Date.now();
+  const expectedErrorCode = input.expectedErrorCode ?? DEFAULT_EXPECTED_ERROR_CODE;
+  const expectedHttpStatus = input.expectedHttpStatus ?? DEFAULT_EXPECTED_HTTP_STATUS;
+  const result = await sendProbe({
+    url,
+    method: endpoint.method,
+    baseUrl,
+    body,
+    headers: { Cookie: input.authCookie },
+    requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS5
+  });
+  if (!result) {
+    return { endpoint, status: "fail", reason: "fetch returned no response", durationMs: Date.now() - started };
+  }
+  const { httpStatus, parsed } = result;
+  const durationMs = Date.now() - started;
+  if (parsed?.status === "success") {
+    return {
+      endpoint,
+      status: "fail",
+      httpStatus,
+      responseStatus: "success",
+      reason: "state-changing endpoint accepted an authenticated request with NO CSRF header \u2014 CSRF protection is not enforced",
+      durationMs
+    };
+  }
+  if (parsed?.status !== "error" || parsed.errorCode !== expectedErrorCode) {
+    const responseStatus = parsed?.status === "success" || parsed?.status === "error" ? parsed.status : "unknown";
+    return {
+      endpoint,
+      status: "fail",
+      httpStatus,
+      responseStatus,
+      errorCode: parsed?.errorCode,
+      reason: `expected CSRF rejection '${expectedErrorCode}' but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
+      durationMs
+    };
+  }
+  if (expectedHttpStatus !== false && httpStatus !== expectedHttpStatus) {
+    return {
+      endpoint,
+      status: "fail",
+      httpStatus,
+      responseStatus: "error",
+      errorCode: parsed.errorCode,
+      reason: `expected HTTP ${expectedHttpStatus} on CSRF rejection but got ${httpStatus}`,
+      durationMs
+    };
+  }
+  return { endpoint, status: "pass", httpStatus, responseStatus: "error", errorCode: parsed.errorCode, durationMs };
+};
+
+// src/runCsrfEnforcementTests.ts
+var runCsrfEnforcementTests = async (input) => {
+  const endpoints = walkEndpoints(input.apiMethodMap);
+  const skip = input.skip ?? [];
+  const results = [];
+  for (const endpoint of endpoints) {
+    if (!hasMetaEntry(input.apiMetaMap, endpoint)) continue;
+    if (!requiresLogin(input.apiMetaMap, endpoint)) continue;
+    if (!STATE_CHANGING_METHODS.has(endpoint.method)) continue;
+    if (shouldSkip(endpoint, skip)) {
+      const skipped = {
+        endpoint,
+        status: "skipped",
+        durationMs: 0,
+        reason: "Explicitly skipped"
+      };
+      results.push(skipped);
+      input.onResult?.(skipped);
+      continue;
+    }
+    const result = await runCsrfEnforcementCheck({
+      endpoint,
+      baseUrl: input.baseUrl,
+      authCookie: input.authCookie,
+      inputFor: input.inputFor,
+      requestTimeoutMs: input.requestTimeoutMs,
+      expectedErrorCode: input.expectedErrorCode,
+      expectedHttpStatus: input.expectedHttpStatus
+    });
+    results.push(result);
+    input.onResult?.(result);
+  }
+  return calculateSummary(results);
 };
 
 // src/fuzzCheck.ts
-import { tryCatch as tryCatch5 } from "@luckystack/core";
-var DEFAULT_REQUEST_TIMEOUT_MS4 = 5e3;
+var DEFAULT_REQUEST_TIMEOUT_MS6 = 5e3;
 var JUNK_PAYLOADS = [
   null,
   [],
@@ -441,33 +592,25 @@ var JUNK_PAYLOADS = [
   1234567890,
   true,
   { nested: { deeply: { nested: { value: "x".repeat(1e4) } } } },
-  { __proto__: { polluted: true } },
+  //? `{ __proto__: ... }` serializes to `{}` via JSON.stringify (prototype keys
+  //? are not own-enumerable), so it would probe nothing. Use `constructor` instead
+  //? — a named own-key that some parsers misinterpret but survives JSON round-trip.
+  { constructor: { polluted: true } },
   { key: null, other: void 0, third: Number.NaN }
 ];
-var probe = async (endpoint, baseUrl, body, headers, requestTimeoutMs) => {
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
-  const controller = new AbortController();
-  const timeoutHandle = setTimeout(() => {
-    controller.abort();
-  }, requestTimeoutMs);
-  const [fetchError, response] = await tryCatch5(() => fetch(url, {
-    method: endpoint.method,
-    headers: { "Content-Type": "application/json", "Origin": new URL(baseUrl).origin, ...headers },
-    body: endpoint.method === "GET" ? void 0 : JSON.stringify(body),
-    signal: controller.signal
-  }));
-  clearTimeout(timeoutHandle);
-  if (fetchError || !response) return null;
-  const [, parsed] = await tryCatch5(
-    async () => await response.json()
-  );
-  return { httpStatus: response.status, parsed: parsed ?? null };
-};
 var runFuzzCheck = async (input) => {
   const started = Date.now();
-  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS4;
+  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS6;
+  const url = `${input.baseUrl.replace(/\/$/, "")}/${input.endpoint.fullPath}`;
   for (const payload of JUNK_PAYLOADS) {
-    const result = await probe(input.endpoint, input.baseUrl, payload, input.headers, requestTimeoutMs);
+    const result = await sendProbe({
+      url,
+      method: input.endpoint.method,
+      baseUrl: input.baseUrl,
+      body: payload,
+      headers: input.headers,
+      requestTimeoutMs
+    });
     const durationMs = Date.now() - started;
     if (!result) {
       return {
@@ -504,18 +647,24 @@ var runFuzzCheck = async (input) => {
 };
 
 // src/runFuzzTests.ts
-var shouldSkip4 = (endpoint, skip) => {
-  if (skip.length === 0) return false;
-  const versioned = `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
-  const versionless = `${endpoint.page}/${endpoint.name}`;
-  return skip.includes(versioned) || skip.includes(versionless);
-};
 var runFuzzTests = async (input) => {
   const endpoints = walkEndpoints(input.apiMethodMap);
   const skip = input.skip ?? [];
+  const isAuthenticatedSweep = Boolean(input.headers?.Cookie);
   const results = [];
   for (const endpoint of endpoints) {
-    if (shouldSkip4(endpoint, skip)) {
+    if (isAuthenticatedSweep && STATE_CHANGING_METHODS.has(endpoint.method)) {
+      const skipped = {
+        endpoint,
+        status: "skipped",
+        durationMs: 0,
+        reason: "state-changing route skipped in cookie-mode fuzz sweep (mutation risk with junk bodies)"
+      };
+      results.push(skipped);
+      input.onResult?.(skipped);
+      continue;
+    }
+    if (shouldSkip(endpoint, skip)) {
       const skipped = {
         endpoint,
         status: "skipped",
@@ -534,16 +683,11 @@ var runFuzzTests = async (input) => {
     results.push(result);
     input.onResult?.(result);
   }
-  return {
-    total: results.length,
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    results
-  };
+  return calculateSummary(results);
 };
 
 // src/schemaSampleInput.ts
+var innerDef = (node) => node ? node.def ?? node._def : void 0;
 var sampleForDef = (def) => {
   const d = def;
   const name = d.typeName ?? d.type;
@@ -576,7 +720,7 @@ var sampleForDef = (def) => {
     }
     case "ZodLiteral":
     case "literal": {
-      return d.value ?? d.values?.[0];
+      return d.value ?? (Array.isArray(d.values) ? d.values[0] : void 0);
     }
     case "ZodOptional":
     case "optional":
@@ -584,9 +728,44 @@ var sampleForDef = (def) => {
     case "nullable": {
       return void 0;
     }
+    case "ZodEnum":
+    case "enum":
+    case "ZodNativeEnum":
+    case "nativeEnum": {
+      if (Array.isArray(d.values)) return d.values[0];
+      const entries = d.entries ?? (d.values && !Array.isArray(d.values) ? d.values : void 0);
+      if (entries) {
+        const first = Object.values(entries)[0];
+        if (first !== void 0) return first;
+      }
+      return void 0;
+    }
+    case "ZodDefault":
+    case "default":
+    case "ZodCatch":
+    case "catch": {
+      return sampleForDef(innerDef(d.innerType));
+    }
+    case "ZodEffects":
+    case "effects":
+    case "ZodPipeline":
+    case "pipe":
+    case "ZodBranded":
+    case "branded":
+    case "ZodReadonly":
+    case "readonly": {
+      return sampleForDef(innerDef(d.schema ?? d.in ?? d.innerType));
+    }
+    case "ZodTuple":
+    case "tuple": {
+      const items = d.items ?? [];
+      return items.map((item) => sampleForDef(innerDef(item)));
+    }
     case "ZodUnion":
-    case "union": {
-      return d.options && d.options.length > 0 && d.options[0] ? sampleForDef(d.options[0]._def) : null;
+    case "union":
+    case "ZodDiscriminatedUnion":
+    case "discriminatedUnion": {
+      return d.options && d.options.length > 0 && d.options[0] ? sampleForDef(innerDef(d.options[0])) : void 0;
     }
     case "ZodArray":
     case "array": {
@@ -597,7 +776,7 @@ var sampleForDef = (def) => {
       const out = {};
       const shape = typeof d.shape === "function" ? d.shape() : d.shape ?? {};
       for (const [key, valueSchema] of Object.entries(shape)) {
-        const sample = sampleForDef(valueSchema._def);
+        const sample = sampleForDef(innerDef(valueSchema));
         if (sample !== void 0) out[key] = sample;
       }
       return out;
@@ -611,12 +790,13 @@ var sampleForDef = (def) => {
       return (/* @__PURE__ */ new Date()).toISOString();
     }
     default: {
-      return null;
+      return void 0;
     }
   }
 };
 var sampleSchemaInput = (schema) => {
-  return sampleForDef(schema.def);
+  const node = schema;
+  return sampleForDef(node.def ?? node._def);
 };
 
 // src/reporter.ts
@@ -666,14 +846,14 @@ var logContractSummary = (summary) => {
 import fs from "fs";
 import path from "path";
 import { pathToFileURL } from "url";
-import { getCsrfConfig, getPrismaClient, getProjectConfig, getSrcDir, tryCatch as tryCatch7 } from "@luckystack/core";
+import { getCsrfConfig, getPrismaClient, getProjectConfig, getSrcDir, tryCatch as tryCatch4, tryCatchSync } from "@luckystack/core";
 
 // src/streamWatcher.ts
 import { io as createSocketIoClient } from "socket.io-client";
 import {
   buildJoinRoomResponseEventName,
   socketEventNames,
-  tryCatch as tryCatch6
+  tryCatch as tryCatch3
 } from "@luckystack/core";
 var DEFAULT_TIMEOUT_MS = 5e3;
 var JOIN_RESPONSE_TIMEOUT_MS = 3e3;
@@ -757,13 +937,18 @@ var openStreamWatcher = async (input) => {
     }
   };
   socket.on(socketEventNames.sync, handleChunk);
-  await waitForConnect(socket);
+  const [connectError] = await tryCatch3(() => waitForConnect(socket));
+  if (connectError) {
+    socket.off(socketEventNames.sync, handleChunk);
+    socket.disconnect();
+    throw connectError;
+  }
   const responseIndex = nextResponseIndex();
   socket.emit(socketEventNames.joinRoom, {
     group: input.roomCode,
     responseIndex
   });
-  const [joinError] = await tryCatch6(() => waitForJoinAck(socket, responseIndex));
+  const [joinError] = await tryCatch3(() => waitForJoinAck(socket, responseIndex));
   if (joinError) {
     socket.off(socketEventNames.sync, handleChunk);
     socket.disconnect();
@@ -818,16 +1003,24 @@ var openStreamWatcher = async (input) => {
 // src/customTests.ts
 var API_TEST_FILE_PATTERN = /_v(\d+)\.tests\.ts$/;
 var SYNC_SERVER_TEST_FILE_PATTERN = /_server_v(\d+)\.tests\.ts$/;
+var DEFAULT_CALL_TIMEOUT_MS = 1e4;
 var discoverCustomTestFiles = (srcDir = getSrcDir()) => {
   if (!fs.existsSync(srcDir)) return [];
   const found = [];
   const stack = [srcDir];
+  const visited = /* @__PURE__ */ new Set();
   while (stack.length > 0) {
     const current = stack.pop();
     if (current === void 0) break;
-    const entries = fs.readdirSync(current, { withFileTypes: true });
+    const [realError, realPath] = tryCatchSync(() => fs.realpathSync(current));
+    const canonical = realError || realPath === null ? current : realPath;
+    if (visited.has(canonical)) continue;
+    visited.add(canonical);
+    const [readError, entries] = tryCatchSync(() => fs.readdirSync(current, { withFileTypes: true }));
+    if (readError || entries === null) continue;
     for (const entry of entries) {
       const fullPath = path.join(current, entry.name);
+      if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(fullPath);
         continue;
@@ -869,7 +1062,7 @@ var buildExpect = () => ({
     if (!value) throw new AssertionError(message ?? `expected truthy value, got ${JSON.stringify(value)}`);
   },
   throws: async (fn, message) => {
-    const [err] = await tryCatch7(fn);
+    const [err] = await tryCatch4(fn);
     if (!err) throw new AssertionError(message ?? "expected fn to throw, but it did not");
     return err;
   },
@@ -920,18 +1113,40 @@ var buildSessionHelpers = (state) => {
     current: () => ({ token: state.token, userId: state.userId })
   };
 };
+var parseResponse = async (response, state) => {
+  const [textError, text] = await tryCatch4(() => response.text());
+  if (textError || text === null) {
+    state.lastResponse = null;
+    throw new Error(`failed to read response body (HTTP ${response.status}): ${textError?.message ?? "unknown"}`);
+  }
+  const [parseError, parsed] = tryCatchSync(() => JSON.parse(text));
+  if (parseError) {
+    const snippet = text.length > 500 ? `${text.slice(0, 500)}\u2026` : text;
+    state.lastResponse = snippet;
+    throw new Error(`response was not valid JSON (HTTP ${response.status}): ${snippet}`);
+  }
+  state.lastResponse = parsed;
+  return parsed;
+};
 var buildCallApi = (baseUrl, routePath, state, cookieName, method) => {
   return async (input) => {
     const url = `${baseUrl.replace(/\/$/, "")}/api/${routePath}`;
     const headers = { "Content-Type": "application/json", Origin: new URL(baseUrl).origin };
     if (state.token) headers.Cookie = `${cookieName}=${state.token}`;
     if (state.csrfToken) headers[getCsrfConfig().headerName] = state.csrfToken;
-    const init = { method, headers };
+    const controller = new AbortController();
+    const timeoutHandle = setTimeout(() => {
+      controller.abort();
+    }, DEFAULT_CALL_TIMEOUT_MS);
+    const init = { method, headers, signal: controller.signal };
     if (method !== "GET" && method !== "HEAD") init.body = JSON.stringify(input ?? {});
-    const response = await fetch(url, init);
-    const json = await response.json();
-    state.lastResponse = json;
-    return json;
+    const [fetchError, response] = await tryCatch4(() => fetch(url, init));
+    clearTimeout(timeoutHandle);
+    if (fetchError || !response) {
+      state.lastResponse = null;
+      throw new Error(`callApi ${method} ${routePath} failed: ${fetchError?.message ?? "no response"}`);
+    }
+    return await parseResponse(response, state);
   };
 };
 var buildCallSync = (baseUrl, routePath, state, cookieName) => {
@@ -941,14 +1156,22 @@ var buildCallSync = (baseUrl, routePath, state, cookieName) => {
     if (state.token) headers.Cookie = `${cookieName}=${state.token}`;
     if (state.csrfToken) headers[getCsrfConfig().headerName] = state.csrfToken;
     const body = { data: input ?? {}, receiver: opts?.receiver };
-    const response = await fetch(url, {
+    const controller = new AbortController();
+    const timeoutHandle = setTimeout(() => {
+      controller.abort();
+    }, DEFAULT_CALL_TIMEOUT_MS);
+    const [fetchError, response] = await tryCatch4(() => fetch(url, {
       method: "POST",
       headers,
-      body: JSON.stringify(body)
-    });
-    const json = await response.json();
-    state.lastResponse = json;
-    return json;
+      body: JSON.stringify(body),
+      signal: controller.signal
+    }));
+    clearTimeout(timeoutHandle);
+    if (fetchError || !response) {
+      state.lastResponse = null;
+      throw new Error(`callSync ${routePath} failed: ${fetchError?.message ?? "no response"}`);
+    }
+    return await parseResponse(response, state);
   };
 };
 var buildContext = (discovery, input) => {
@@ -973,7 +1196,7 @@ var buildContext = (discovery, input) => {
     while (watchers.length > 0) {
       const watcher = watchers.pop();
       if (!watcher) continue;
-      const [closeError] = await tryCatch7(() => watcher.close());
+      const [closeError] = await tryCatch4(() => watcher.close());
       if (closeError) {
       }
     }
@@ -994,7 +1217,7 @@ var runCustomTests = async (input) => {
   for (const discovery of files) {
     const routePath = `${discovery.route.page}/${discovery.route.name}/${discovery.route.version}`;
     if (input.filter && !routePath.includes(input.filter)) continue;
-    const [importError, mod] = await tryCatch7(
+    const [importError, mod] = await tryCatch4(
       () => import(pathToFileURL(discovery.filePath).href)
     );
     if (importError || !mod) {
@@ -1019,8 +1242,15 @@ var runCustomTests = async (input) => {
       const expectedToFail = typeof c.expectedToFail === "string" ? c.expectedToFail : void 0;
       const built = buildContext(discovery, input);
       const started = Date.now();
-      const [runError] = await tryCatch7(async () => c.run(built.ctx));
-      await tryCatch7(() => built.closeAllWatchers());
+      const [runError] = await tryCatch4(async () => c.run(built.ctx));
+      await tryCatch4(() => built.closeAllWatchers());
+      const residualToken = built.state.token;
+      if (residualToken) {
+        await tryCatch4(async () => {
+          const { deleteSession } = await import("@luckystack/login");
+          await deleteSession(residualToken);
+        });
+      }
       const durationMs = Date.now() - started;
       let r;
       if (runError) {
@@ -1052,7 +1282,7 @@ var runCustomTests = async (input) => {
 };
 
 // src/runAllTests.ts
-import { clearAllRateLimits, getProjectConfig as getProjectConfig2 } from "@luckystack/core";
+import { clearAllRateLimits, getCsrfConfig as getCsrfConfig2, getProjectConfig as getProjectConfig2 } from "@luckystack/core";
 var inputForEndpoint = (apiInputSchemas) => (endpoint) => {
   const schema = apiInputSchemas[endpoint.page]?.[endpoint.name]?.[endpoint.version];
   return schema ? sampleSchemaInput(schema) : {};
@@ -1064,78 +1294,137 @@ var matchesFilter = (endpoint, filter) => {
 var filterResults = (results, filter) => filter ? results.filter((r) => matchesFilter(r.endpoint, filter)) : results;
 var cloneSummary = (summary, filter) => {
   if (!filter) return summary;
-  const results = filterResults(summary.results, filter);
-  return {
-    total: results.length,
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    results
-  };
+  return calculateSummary(filterResults(summary.results, filter));
 };
-var runAllTests = async (input) => {
-  const summary = { totalPassed: 0, totalFailed: 0 };
+var buildAuthHeaders = async (input) => {
   const headers = {};
-  if (input.authToken) {
-    const cookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
-    headers.Cookie = `${cookieName}=${input.authToken}`;
+  if (!input.authToken) return headers;
+  const cookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
+  headers.Cookie = `${cookieName}=${input.authToken}`;
+  try {
+    const { getSession } = await import("@luckystack/login");
+    const session = await getSession(input.authToken);
+    if (session?.csrfToken) {
+      headers[getCsrfConfig2().headerName] = session.csrfToken;
+    }
+  } catch {
   }
-  const inputFor = inputForEndpoint(input.apiInputSchemas);
-  if (!input.noSweep) {
-    const contract = await runContractTests({
+  return headers;
+};
+var runSweepLayers = async (input, summary, headers, inputFor) => {
+  const contract = await runContractTests({
+    apiMethodMap: input.apiMethodMap,
+    baseUrl: input.baseUrl,
+    skip: input.skip,
+    headers,
+    inputFor
+  });
+  summary.contract = cloneSummary(contract, input.filter);
+  const auth = await runAuthEnforcementTests({
+    apiMethodMap: input.apiMethodMap,
+    apiMetaMap: input.apiMetaMap,
+    baseUrl: input.baseUrl,
+    skip: input.skip,
+    inputFor
+  });
+  summary.auth = cloneSummary(auth, input.filter);
+  if (!input.noRateLimit) {
+    const rateLimit = await runRateLimitTests({
       apiMethodMap: input.apiMethodMap,
+      apiMetaMap: input.apiMetaMap,
       baseUrl: input.baseUrl,
       skip: input.skip,
       headers,
-      inputFor
+      inputFor,
+      //? Reset the shared per-IP rate-limit bucket between endpoints so a
+      //? neighbour saturating the window doesn't cause false pass/fail on the
+      //? next endpoint. Requires the server to expose /_test/reset (allowed in
+      //? NODE_ENV !== production or behind TEST_RESET_TOKEN).
+      resetBetweenEndpoints: true
     });
-    summary.contract = cloneSummary(contract, input.filter);
-    const auth = await runAuthEnforcementTests({
+    summary.rateLimit = cloneSummary(rateLimit, input.filter);
+  }
+  if (!input.noCsrf && headers.Cookie) {
+    const csrf = await runCsrfEnforcementTests({
       apiMethodMap: input.apiMethodMap,
       apiMetaMap: input.apiMetaMap,
       baseUrl: input.baseUrl,
+      authCookie: headers.Cookie,
       skip: input.skip,
       inputFor
     });
-    summary.auth = cloneSummary(auth, input.filter);
-    if (!input.noRateLimit) {
-      const rateLimit = await runRateLimitTests({
-        apiMethodMap: input.apiMethodMap,
-        apiMetaMap: input.apiMetaMap,
-        baseUrl: input.baseUrl,
-        skip: input.skip,
-        headers,
-        inputFor
-      });
-      summary.rateLimit = cloneSummary(rateLimit, input.filter);
-    }
-    if (!input.noFuzz) {
-      const fuzz = await runFuzzTests({
-        apiMethodMap: input.apiMethodMap,
-        baseUrl: input.baseUrl,
-        skip: input.skip,
-        headers
-      });
-      summary.fuzz = cloneSummary(fuzz, input.filter);
-    }
+    summary.csrf = cloneSummary(csrf, input.filter);
   }
-  if (!input.noCustom) {
-    try {
-      await clearAllRateLimits();
-    } catch {
-    }
-    const custom = await runCustomTests({
+  if (!input.noFuzz) {
+    const fuzz = await runFuzzTests({
+      apiMethodMap: input.apiMethodMap,
       baseUrl: input.baseUrl,
-      sessionCookieName: input.sessionCookieName,
-      filter: input.filter,
-      //? Pass the generated method map so the harness invokes each API route
-      //? with its declared HTTP method (e.g. logout is DELETE, not POST).
-      apiMethodMap: input.apiMethodMap
+      skip: input.skip,
+      headers
     });
-    summary.custom = custom;
+    summary.fuzz = cloneSummary(fuzz, input.filter);
+  }
+};
+var runCustomLayer = async (input, summary) => {
+  try {
+    await clearAllRateLimits();
+  } catch {
+  }
+  const custom = await runCustomTests({
+    baseUrl: input.baseUrl,
+    sessionCookieName: input.sessionCookieName,
+    filter: input.filter,
+    //? Pass the generated method map so the harness invokes each API route
+    //? with its declared HTTP method (e.g. logout is DELETE, not POST).
+    apiMethodMap: input.apiMethodMap
+  });
+  summary.custom = custom;
+};
+var SWEEP_LAYER_ORDER = [
+  LAYER_KEYS.contract,
+  LAYER_KEYS.auth,
+  LAYER_KEYS.rateLimit,
+  LAYER_KEYS.csrf,
+  LAYER_KEYS.fuzz
+];
+var SWEEP_SUMMARY_PROP = {
+  [LAYER_KEYS.contract]: "contract",
+  [LAYER_KEYS.auth]: "auth",
+  [LAYER_KEYS.rateLimit]: "rateLimit",
+  [LAYER_KEYS.csrf]: "csrf",
+  [LAYER_KEYS.fuzz]: "fuzz"
+};
+var computeTotals = (summary) => {
+  let passed = 0;
+  let failed = 0;
+  for (const key of SWEEP_LAYER_ORDER) {
+    const s = summary[SWEEP_SUMMARY_PROP[key]];
+    passed += s?.passed ?? 0;
+    failed += s?.failed ?? 0;
+  }
+  summary.totalPassed = passed + (summary.custom?.passed ?? 0);
+  summary.totalFailed = failed + (summary.custom?.failed ?? 0);
+};
+var runAllTests = async (input) => {
+  const summary = { totalPassed: 0, totalFailed: 0 };
+  if (!input.noSweep) {
+    const hasRoutes = Object.keys(input.apiMethodMap).length > 0;
+    const hasMeta = Object.keys(input.apiMetaMap).length > 0;
+    if (hasRoutes && !hasMeta) {
+      console.warn(
+        "[test-runner] runAllTests: apiMetaMap is empty but apiMethodMap has routes. The auth-enforcement and rate-limit layers will skip every route. Pass the generated apiMetaMap to enable those checks."
+      );
+    }
+  }
+  const headers = await buildAuthHeaders(input);
+  const inputFor = inputForEndpoint(input.apiInputSchemas);
+  if (!input.noSweep) {
+    await runSweepLayers(input, summary, headers, inputFor);
   }
-  summary.totalPassed = (summary.contract?.passed ?? 0) + (summary.auth?.passed ?? 0) + (summary.rateLimit?.passed ?? 0) + (summary.fuzz?.passed ?? 0) + (summary.custom?.passed ?? 0);
-  summary.totalFailed = (summary.contract?.failed ?? 0) + (summary.auth?.failed ?? 0) + (summary.rateLimit?.failed ?? 0) + (summary.fuzz?.failed ?? 0) + (summary.custom?.failed ?? 0);
+  if (!input.noCustom) {
+    await runCustomLayer(input, summary);
+  }
+  computeTotals(summary);
   return summary;
 };
 var useColor = (() => {
@@ -1149,8 +1438,16 @@ var red = (t) => paint("31", t);
 var yellow = (t) => paint("33", t);
 var dim = (t) => paint("2", t);
 var bold = (t) => paint("1", t);
-var xfailOf = (s) => s && "xfailed" in s ? s.xfailed : 0;
-var skippedOf = (s) => s && "skipped" in s ? s.skipped : 0;
+var xfailOf = (s) => {
+  if (s === void 0 || !("xfailed" in s)) return 0;
+  const v = s.xfailed;
+  return typeof v === "number" ? v : 0;
+};
+var skippedOf = (s) => {
+  if (s === void 0 || !("skipped" in s)) return 0;
+  const v = s.skipped;
+  return typeof v === "number" ? v : 0;
+};
 var formatLayerLine = (label, s) => {
   if (!s) return `  ${dim("\u2013")} ${label.padEnd(18)} ${dim("(layer skipped)")}`;
   const clean = s.failed === 0;
@@ -1184,35 +1481,37 @@ var printSection = (title, heading, rows, bullet) => {
 };
 var logRunAllSummary = (summary) => {
   console.log("");
-  console.log(formatLayerLine("contract", summary.contract));
-  console.log(formatLayerLine("auth-enforcement", summary.auth));
-  console.log(formatLayerLine("rate-limit", summary.rateLimit));
-  console.log(formatLayerLine("fuzz", summary.fuzz));
-  console.log(formatLayerLine("custom", summary.custom));
+  for (const key of SWEEP_LAYER_ORDER) {
+    console.log(formatLayerLine(key, summary[SWEEP_SUMMARY_PROP[key]]));
+  }
+  console.log(formatLayerLine(LAYER_KEYS.custom, summary.custom));
   const failed = [
-    ...sweepFailRows(summary.contract),
-    ...sweepFailRows(summary.auth),
-    ...sweepFailRows(summary.rateLimit),
-    ...sweepFailRows(summary.fuzz),
+    ...SWEEP_LAYER_ORDER.flatMap((key) => sweepFailRows(summary[SWEEP_SUMMARY_PROP[key]])),
     ...customRows(summary.custom, "fail")
   ];
   printSection(red, "Failed \u2014 must be fixed (real bugs / wrong tests)", failed, "\u2717");
   printSection(yellow, "Expected failures \u2014 known issues, allowed to fail", customRows(summary.custom, "xfail"), "\u26A0");
   printSection(yellow, "Unexpectedly passed \u2014 remove the expectedToFail marker", customRows(summary.custom, "xpass"), "?");
-  const skipped = [
-    ...sweepSkipRows("contract", summary.contract),
-    ...sweepSkipRows("auth", summary.auth),
-    ...sweepSkipRows("rate-limit", summary.rateLimit),
-    ...sweepSkipRows("fuzz", summary.fuzz)
-  ];
+  const skipped = SWEEP_LAYER_ORDER.flatMap(
+    (key) => sweepSkipRows(key, summary[SWEEP_SUMMARY_PROP[key]])
+  );
   printSection(dim, "Skipped \u2014 not run (with reason)", skipped, "\u2013");
-  const totalXfail = xfailOf(summary.contract) + xfailOf(summary.auth) + xfailOf(summary.rateLimit) + xfailOf(summary.fuzz) + xfailOf(summary.custom);
-  const totalSkipped = skippedOf(summary.contract) + skippedOf(summary.auth) + skippedOf(summary.rateLimit) + skippedOf(summary.fuzz) + skippedOf(summary.custom);
+  let totalXfail = 0;
+  let totalSkipped = 0;
+  for (const key of SWEEP_LAYER_ORDER) {
+    const s = summary[SWEEP_SUMMARY_PROP[key]];
+    totalXfail += xfailOf(s);
+    totalSkipped += skippedOf(s);
+  }
+  totalXfail += xfailOf(summary.custom);
+  totalSkipped += skippedOf(summary.custom);
+  const totalXpass = summary.custom?.xpassed ?? 0;
   console.log("");
   const parts = [
     green(`${summary.totalPassed} passed`),
     summary.totalFailed > 0 ? red(`${summary.totalFailed} failed`) : dim("0 failed"),
     totalXfail > 0 ? yellow(`${totalXfail} expected-fail`) : dim("0 expected-fail"),
+    totalXpass > 0 ? yellow(`${totalXpass} unexpectedly-passed`) : dim("0 unexpectedly-passed"),
     totalSkipped > 0 ? yellow(`${totalSkipped} skipped`) : dim("0 skipped")
   ];
   console.log(`Summary: ${parts.join(dim("  \xB7  "))}`);
@@ -1241,6 +1540,7 @@ var resetTestExtensionsForTests = () => {
   reporter = null;
 };
 export {
+  LAYER_KEYS,
   discoverCustomTestFiles,
   getTestFixture,
   getTestReporter,
@@ -1259,12 +1559,15 @@ export {
   runAuthEnforcementTests,
   runContractCheck,
   runContractTests,
+  runCsrfEnforcementCheck,
+  runCsrfEnforcementTests,
   runCustomTests,
   runFuzzCheck,
   runFuzzTests,
   runRateLimitCheck,
   runRateLimitTests,
   sampleSchemaInput,
-  walkEndpoints
+  walkEndpoints,
+  walkSyncEndpoints
 };
 //# sourceMappingURL=index.js.map