@luckystack/test-runner 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -5,7 +5,33 @@ All notable changes to `@luckystack/test-runner` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.10.2] - 2026-10-09
+
+### Added
+
+- The auto-sweep layers (contract, auth, rate-limit, CSRF, fuzz) now cover sync routes when `runAllTests` receives the generated `syncMetaMap` (+ optionally `syncInputSchemas` for Zod-valid sync payloads). Sync probes travel over Socket.io — the pipeline real clients use — unless the project's `transport.invocation` is `routed-http` or `syncTransport: 'http'` is set; the CSRF layer always probes sync over HTTP, since CSRF is an HTTP-only guard. Each run uses one throwaway `lstest-room-<uuid>` room, which the sweep session joins when an `authToken` is given, so room-membership enforcement sees a member. Without `syncMetaMap`, `runAllTests` warns that sync routes are not swept.
+- New exports: `createHttpProbeTransport`, `createSocketProbeTransport`, `defaultProbeTransport`, `sendProbe` and the `ProbeTransport` family of types; `createSampleInputFor` + `InputSchemaMap`; `SyncMetaMap` / `SyncMetaEntry`; `CallSyncOptions`. `EndpointDescriptor` gains an optional `kind` (`walkSyncEndpoints` sets `'sync'`; absent means API).
+- `runAllTests` writes the full summary JSON itself: `outputFile` option, defaulting to `TEST_OUTPUT_FILE`, else `test-results.json`; `false` disables it. Entry scripts no longer need their own write.
+- `resetServerState` accepts `only?: TestResetTarget[]` to clear just those targets (`/_test/reset?only=`).
+- Registered custom layers receive `sampleInput` in `TestLayerInput` (the same Zod-valid payload the contract sweep sends), and `runRegisteredLayers` accepts `syncMetaMap`, `filter`, `apiInputSchemas`, `syncInputSchemas` and `inputFor`. `method` is `undefined` for sync endpoints.
+
+### Changed
+
+- **`ctx.callSync` follows the project's `transport.invocation`.** For a socket-mode project (the default) it now emits a real Socket.io `sync` instead of always posting to `/sync/*`, and the case's socket joins `opts.receiver` first (except `'all'`; opt out with `joinRoom: false`). Override per call with `opts.transport: 'http'`. New `opts.ignoreSelf`. A test that relied on HTTP-only behaviour in a socket-mode project must pass `transport: 'http'`.
+- **The runner's own resets no longer clear sessions.** The `runAllTests` bookends and the rate-limit layer's between-endpoint reset send `only=rateLimits`, so an authenticated sweep is no longer logged out by its own reset. A direct `resetServerState` call without `only` still clears sessions as before.
+- `filter` (`TEST_FILTER`) is passed to every layer and applied before any request. Previously every route was swept and only the report was filtered.
+
+### Fixed
+
+- GET routes receive their sample payload: probes encode it into the reserved `__luckystack_data` query key (core `buildRoutedGetUrl`) instead of dropping it, so a GET route with a required field no longer fails validation in every layer.
+- Sockets the runner opens on the caller's `authToken` session (the sync-sweep member socket and the socket probe transport) close with `intentionalDisconnect`, the signal a real client sends on a tab switch. With `@luckystack/presence` installed, a plain close made presence log that session out a few seconds after the sweep.
+- The bookend documentation no longer claims the reset drops rows the sweep created. `/_test/reset` never touched the application database; `lstest_*` rows persist.
+
+## [0.10.1] - 2026-09-03
+
+### Fixed
+
+- Layer 5: `ctx.callApi(input)` on a `GET` route silently dropped `input`, so the server always saw `data = {}` and any `GET` route with a required field rejected the call with `api.invalidInputType` before `main()` ran. `input` now travels as the `__luckystack_data` query-string value, encoded by the shared `buildRoutedGetUrl` helper from `@luckystack/core` — the same contract the real client sends and the server reads. Non-`GET` routes are unchanged (JSON body).
 
 ## [0.8.5] - 2026-08-17
 

package/CLAUDE.md

@@ -4,7 +4,7 @@
 
 ## What this package does
 
-Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit de generated `apiMethodMap` en draait vijf progressive layers: contract smoke (Zod-valid input), auth enforcement, rate-limit, crash-resistance fuzz, en per-route custom tests (`<name>_v<N>.tests.ts` naast `_api/`/`_sync/` sources). Elke layer is independent runnable; `runAllTests` orchestreert alles in volgorde en levert een geaggregeerde summary op. Reporter/fixture/layer-extension registries laten consumers eigen checks plug-in zonder de framework te forken.
+Generated-type-driven test layers voor LuckyStack APIs en sync routes. Walkt elke endpoint uit de generated `apiMethodMap` (plus elke sync route uit `syncMetaMap` wanneer die wordt meegegeven) en draait vijf progressive layers: contract smoke (Zod-valid input), auth enforcement, rate-limit, crash-resistance fuzz, en per-route custom tests (`<name>_v<N>.tests.ts` naast `_api/`/`_sync/` sources). Elke layer is independent runnable; `runAllTests` orchestreert alles in volgorde en levert een geaggregeerde summary op. Reporter/fixture/layer-extension registries laten consumers eigen checks plug-in zonder de framework te forken.
 
 ## When to USE this package
 
@@ -20,17 +20,22 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 - Voor frontend-UI tests — gebruik Playwright/`webapp-testing` skill, deze runner is server-only.
 - Wanneer er geen generated `apiMethodMap` beschikbaar is (project gebruikt geen `@luckystack/devkit`).
 - Wanneer de target server productie is — fuzz/rate-limit layers maken honderden requests en `/_test/reset` bestaat alleen bij exact `NODE_ENV=development|test` plus een verplicht `TEST_RESET_TOKEN`.
-- Voor sync-event testing via de auto-sweep — die walkt momenteel alleen API endpoints, niet de sync map (sync support voor de auto-layers staat op de roadmap maar is nog niet geleverd). Layer 5 (`runCustomTests` / `<name>_v<N>.tests.ts`) ondersteunt al wél sync routes via per-route testfiles naast `_sync/` sources.
+
+Sync routes: de auto-sweep layers dekken ze alleen wanneer `runAllTests` de generated `syncMetaMap` (+ optioneel `syncInputSchemas`) krijgt; zonder `syncMetaMap` logt `runAllTests` een waarschuwing dat sync routes niet geswept worden. Sync probes gaan over Socket.io (de pipeline van echte clients) tenzij het project `routed-http` is of `syncTransport: 'http'` gezet is; de CSRF-layer probet sync altijd over HTTP. Per run één wegwerp-room; met een `authToken` joint de sweep-sessie die room zodat room-membership-enforcement een member ziet.
 
 ## Function Index
 
 | Function / Export | 1-regel | Deep doc |
 |---|---|---|
-| `runAllTests({ apiMethodMap, apiMetaMap, apiInputSchemas, baseUrl, ... })` | Orchestrator: draait contract + auth + rate-limit + fuzz + custom (Layer 5) in volgorde, levert een `RunAllTestsSummary`. | → docs/contract-tests.md |
+| `runAllTests({ apiMethodMap, apiMetaMap, apiInputSchemas, syncMetaMap?, syncInputSchemas?, baseUrl, ... })` | Orchestrator: draait contract + auth + rate-limit + csrf + fuzz + custom (Layer 5) in volgorde, levert een `RunAllTestsSummary` en schrijft die als JSON naar `outputFile`. `filter` wordt vóór de requests toegepast. | → docs/contract-tests.md |
 | `runCustomTests(input)` | Layer 5: draait per-route tests. Direct callers moeten lazy `loadProjectConfig` meegeven; env/secrets resolven vóór test-module imports. `runAllTests` gebruikt een interne already-prepared entrypoint om pointer-reload te voorkomen. | → docs/contract-tests.md |
 | `discoverCustomTestFiles(srcDir?)` | Walker die elke `<name>_v<N>.tests.ts` onder de configured src dir yields. | → docs/contract-tests.md |
 | `logRunAllSummary(summary)` | Pretty-print één `RunAllTestsSummary`. | → docs/extension-hooks.md |
 | `walkEndpoints(apiMethodMap)` | Genereert `EndpointDescriptor[]` uit de generated map | → docs/contract-tests.md |
+| `walkSyncEndpoints(syncMap)` | Zelfde voor sync routes (`syncMetaMap` of `syncMethodMap`); descriptors krijgen `kind: 'sync'` | → docs/contract-tests.md |
+| `sendProbe(input)` / `createHttpProbeTransport(opts?)` / `defaultProbeTransport` | Eén HTTP-probe (GET-payload in de `__luckystack_data` query) / transport die API- en `/sync/*`-routes over HTTP bereikt | → docs/contract-tests.md |
+| `createSocketProbeTransport(opts)` | Transport die sync probes als Socket.io `sync` emit verstuurt | → docs/contract-tests.md |
+| `createSampleInputFor({ apiInputSchemas?, syncInputSchemas?, stringPrefix? })` | `inputFor`-factory: Zod-valid sample per API- of sync-route | → docs/contract-tests.md |
 | `runContractCheck({ endpoint, baseUrl, inputFor?, headers? })` | Single-endpoint contract smoke | → docs/contract-tests.md |
 | `runContractTests({ apiMethodMap, baseUrl, skip?, inputFor?, headers?, onResult? })` | Full sweep contract layer | → docs/contract-tests.md |
 | `runAuthEnforcementCheck({ endpoint, baseUrl, inputFor? })` | Single-endpoint auth check (verwacht 401 zonder token) | → docs/auth-tests.md |
@@ -39,7 +44,7 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 | `runRateLimitTests({ apiMethodMap, apiMetaMap, baseUrl, skip?, inputFor?, headers?, maxRateLimitToTest?, resetBetweenEndpoints?, resetToken?, onResult? })` | Sweep alle `rateLimit: N` endpoints | → docs/rate-limit-tests.md |
 | `runFuzzCheck({ endpoint, baseUrl, headers? })` | Single-endpoint crash-resistance fuzz | → docs/fuzz-tests.md |
 | `runFuzzTests({ apiMethodMap, baseUrl, skip?, headers?, onResult? })` | Sweep fuzz layer (nightly CI) | → docs/fuzz-tests.md |
-| `resetServerState({ baseUrl, token? })` | POST naar `/_test/reset` om rate limits + standaard Redis-sessienamespaces te wissen; niet app-DB/custom adapters | → docs/rate-limit-tests.md |
+| `resetServerState({ baseUrl, token?, only? })` | POST naar `/_test/reset`. Zonder `only` wist hij rate limits + standaard Redis-sessienamespaces; met `only` alleen de genoemde targets (de runner stuurt altijd `only: ['rateLimits']`). Nooit app-DB/custom adapters | → docs/rate-limit-tests.md |
 | `resolveTestBaseUrl({ cwd?, fallbackUrl? })` | Resolves `TEST_BASE_URL` → actually-bound dev port advertisement → caller fallback, so an auto-hop does not create false connection failures. | → docs/contract-tests.md |
 | `resolveTestEnvironment({ loadProjectConfig? })` | Laadt `.env`-lagen en resolveert optionele secret-manager-pointers in het testproces vóór DB/Redis-backed Layer-5 modules importeren. | → docs/contract-tests.md |
 | `sampleSchemaInput(schema, options?)` | Genereert Zod-valid sample payload uit een schema. `options.stringPrefix` tagt UNCONSTRAINED strings (finding #98) — format/checked strings blijven ongeprefixt zodat ze valid blijven. | → docs/contract-tests.md |
@@ -53,7 +58,10 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 | `registerTestReporter(reporter)` | Plug-in onResult/onSummary/webhookUrl callbacks | → docs/extension-hooks.md |
 | `getTestReporter()` | Lees actieve reporter callbacks | → docs/extension-hooks.md |
 | `resetTestExtensionsForTests()` | Clear alle registries (alleen voor interne tests) | → docs/extension-hooks.md |
-| Type: `EndpointDescriptor` | `{ page, name, version, method, fullPath }` | → docs/contract-tests.md |
+| Type: `EndpointDescriptor` | `{ page, name, version, method, fullPath, kind? }` — `kind` ontbreekt = `'api'` | → docs/contract-tests.md |
+| Type: `SyncMetaMap` / `SyncMetaEntry` | Spiegel van de generated `syncMetaMap` (auth + rateLimit per sync route) | → docs/contract-tests.md |
+| Type: `ProbeTransport` / `ProbeTransportRequest` / `ProbeRequestInput` / `ProbeResponse` / `HttpProbeTransportOptions` / `SocketProbeTransportOptions` | Probe-transport contract | → docs/contract-tests.md |
+| Type: `InputSchemaMap` / `CreateSampleInputForOptions` | Inputs voor `createSampleInputFor` | → docs/contract-tests.md |
 | Type: `HttpMethod` | `'GET' \| 'POST' \| 'PUT' \| 'DELETE'` | → docs/contract-tests.md |
 | Type: `ContractCheckResult` | Single-result shape (status, httpStatus, responseStatus, errorCode, reason, durationMs) | → docs/contract-tests.md |
 | Type: `RunContractSummary` | Aggregate shape (total, passed, failed, skipped, results[]) | → docs/contract-tests.md |
@@ -66,7 +74,8 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 | Type: `RunRateLimitTestsInput` / `RateLimitCheckInput` | Inputs voor rate-limit layer | → docs/rate-limit-tests.md |
 | Type: `RunFuzzTestsInput` / `FuzzCheckInput` | Inputs voor fuzz layer | → docs/fuzz-tests.md |
 | Type: `ResetServerStateInput` | Input voor `resetServerState` | → docs/rate-limit-tests.md |
-| Type: `TestContext` | `{ callApi, callSync, watchStream, session, prisma, expect }` — handed naar elke Layer-5 custom-tests case. | → docs/contract-tests.md |
+| Type: `TestContext` | `{ callApi, callSync, watchStream, session, prisma, expect }` — handed naar elke Layer-5 custom-tests case. `callSync` volgt `transport.invocation` van het project (`socket` → echte Socket.io emit, `routed-http` → `/sync/*`). | → docs/contract-tests.md |
+| Type: `CallSyncOptions` | `callSync` opts: `receiver`, `ignoreSelf`, `transport` (per-call override), `joinRoom` (default `true`: de case-socket joint eerst `receiver`) | → docs/contract-tests.md |
 | `ctx.watchStream(roomCode)` | Open een second-socket (socket B) joined aan `roomCode` om de chunk stream van `broadcastStream`/`streamTo`/`_client_v{N}` te observeren. Returnt `StreamWatcher<TChunk>` met `.chunks[]`, `.stopAt(predicate, timeoutMs?)`, `.waitForCount(n, timeoutMs?)`, `.close()`. Watchers worden auto-closed na elke case. | → docs/contract-tests.md |
 | `openStreamWatcher(input)` | Lower-level factory voor `watchStream` — direct bruikbaar buiten een `TestContext` (custom layers, ad-hoc harness scripts). | → docs/contract-tests.md |
 | Type: `StreamWatcher<TChunk>` | `{ readonly chunks, stopAt, waitForCount, close }` — observable chunk stream voor één route. | → docs/contract-tests.md |
@@ -84,7 +93,11 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 - `TEST_RESET_TOKEN` (env, optional, server-side) — wanneer gezet moet `resetServerState({ token })` deze meesturen als `X-Test-Reset-Token`. Verplicht voor staging/preview deploys die het endpoint over het netwerk exposen.
 - `RunRateLimitTestsInput.maxRateLimitToTest` (default `50`) — endpoints met hogere `rateLimit` worden geskipt om duizenden requests in CI te vermijden.
 - `RunRateLimitTestsInput.resetBetweenEndpoints` (default `false`) — hit `/_test/reset` voor elke endpoint zodat het shared IP-bucket schoon is.
-- `RunAllTestsInput.resetBookends` (default `true` wanneer een reset-token beschikbaar is) — POST `/_test/reset` één keer vóór en één keer ná de auto-sweep (finding #98: clean slate + cleanup zodat geen echte rows worden geëdit en geen `lstest_*` testdata achterblijft). Zonder token (`resetToken`/`TEST_RESET_TOKEN`) worden de bookends met een logregel geskipt, niet gefaald.
+- `RunAllTestsInput.resetBookends` (default `true` wanneer een reset-token beschikbaar is) — POST `/_test/reset?only=rateLimits` één keer vóór en één keer ná de auto-sweep, zodat geen limiter-bucket leeggelopen achterblijft. Wist alleen limiter-state: sessies (ook die van `authToken`) blijven staan, en de app-database wordt nooit aangeraakt — door de sweep aangemaakte `lstest_*` rows blijven dus bestaan. Zonder token (`resetToken`/`TEST_RESET_TOKEN`) worden de bookends met een logregel geskipt, niet gefaald.
+- `RunAllTestsInput.outputFile` (default `TEST_OUTPUT_FILE` env, anders `test-results.json`; `false` = uit) — `runAllTests` schrijft de volledige summary-JSON zelf; een entry-script hoeft dat niet meer te doen.
+- `RunAllTestsInput.syncMetaMap` / `syncInputSchemas` — generated door devkit; zonder `syncMetaMap` worden sync routes niet geswept.
+- `RunAllTestsInput.syncTransport` (`'socket' | 'http'`, default afgeleid van `transport.invocation`) — hoe de sweep sync routes bereikt.
+- `RunAllTestsInput.filter` (het `testAll.ts` entry-script vult hem uit `TEST_FILTER`) — substring op `<page>/<name>/<version>`; niet-matchende routes worden niet aangevraagd (niet alleen uit het rapport gefilterd).
 - `registerTestLayer({ name, run })` — custom check per endpoint (CORS, business rules, custom auth-schemes, multi-tenant isolation).
 - `registerTestFixture(typeKey, { valid, invalid })` — realistic payloads die de fuzz layer prefereert boven schema-random.
 - `registerTestReporter({ onResult?, onSummary?, webhookUrl?, webhookAuth? })` — wire per-result/per-summary callbacks of POST de summary naar een webhook.

package/README.md

@@ -18,8 +18,8 @@ import {
   resolveTestBaseUrl,
   logRunAllSummary,
 } from '@luckystack/test-runner';
-import { apiInputSchemas } from './src/_sockets/apiInputSchemas.generated';
-import { apiMetaMap, apiMethodMap } from './src/_sockets/apiTypes.generated';
+import { apiInputSchemas, syncInputSchemas } from './src/_sockets/apiInputSchemas.generated';
+import { apiMetaMap, apiMethodMap, syncMetaMap } from './src/_sockets/apiTypes.generated';
 import { ports } from './config.ports';
 
 const baseUrl = resolveTestBaseUrl({ fallbackUrl: `http://localhost:${ports.backend}` });
@@ -27,6 +27,8 @@ const summary = await runAllTests({
   apiMethodMap,
   apiMetaMap,
   apiInputSchemas,
+  syncMetaMap,      // omit and sync routes are not swept (a warning says so)
+  syncInputSchemas,
   baseUrl,
   // Loaded only after .env/.env.local. If config.secretManager.url is set,
   // pointers are resolved in THIS process before Layer-5 tests touch Prisma.
@@ -52,7 +54,7 @@ The fuzz layer is intentionally exhaustive and slow — wire it into nightly CI
 
 ## Server hooks it depends on
 
-- `/_test/reset` endpoint — served by `@luckystack/server` only when `NODE_ENV` is exactly `development` or `test`, and always gated by a non-empty `TEST_RESET_TOKEN`. `resetServerState` clears framework rate-limit state plus the default Redis session/active-user namespaces; it does not clear application database rows or custom `SessionAdapter` stores.
+- `/_test/reset` endpoint — served by `@luckystack/server` only when `NODE_ENV` is exactly `development` or `test`, and always gated by a non-empty `TEST_RESET_TOKEN`. `resetServerState` clears framework rate-limit state plus the default Redis session/active-user namespaces, or only the targets passed as `only` (the runner's own resets clear rate limits only, so an authenticated sweep keeps its session); it does not clear application database rows or custom `SessionAdapter` stores.
 - `apiMethodMap.generated.ts` — produced by `@luckystack/devkit` from your `_api/*` files. Defaults are read via `getApiMethodMapPath()` from `@luckystack/core`.
 
 ## Public API

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { z, ZodType } from 'zod';
-import { getPrismaClient } from '@luckystack/core';
+import { TestResetTarget, getPrismaClient } from '@luckystack/core';
+import { ZodType, z } from 'zod';
 
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
 type ApiMethodMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
@@ -14,13 +14,20 @@ interface ApiMetaEntry {
     rateLimit?: number | false;
 }
 type ApiMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, ApiMetaEntry>>>>>>;
+interface SyncMetaEntry {
+    auth: ApiMetaEntry['auth'];
+    rateLimit?: number | false;
+}
+type SyncMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, SyncMetaEntry>>>>>>;
 interface EndpointDescriptor {
     page: string;
     name: string;
     version: string;
     method: HttpMethod;
-    /** `api/<page>/<name>/<version>` */
+    /** `api/<page>/<name>/<version>` or `sync/<page>/<name>/<version>` */
     fullPath: string;
+    /** Route kind. Absent means `'api'` — only `walkSyncEndpoints` sets `'sync'`. */
+    kind?: 'api' | 'sync';
 }
 interface ContractCheckResult {
     endpoint: EndpointDescriptor;
@@ -41,7 +48,56 @@ interface RunContractSummary {
 
 type ApiMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
 declare const walkEndpoints: (apiMethodMap: ApiMethodMap) => EndpointDescriptor[];
-declare const walkSyncEndpoints: (syncMethodMap: SyncMethodMap) => EndpointDescriptor[];
+type SyncRouteMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, unknown>>>>>>;
+declare const walkSyncEndpoints: (syncMap: SyncMethodMap | SyncMetaMap | SyncRouteMap) => EndpointDescriptor[];
+
+interface ProbeRequestInput {
+    url: string;
+    method: HttpMethod;
+    baseUrl: string;
+    body?: unknown;
+    headers?: Record<string, string>;
+    requestTimeoutMs: number;
+}
+interface ProbeResponse {
+    /** HTTP status. Absent when the probe travelled over Socket.io. */
+    httpStatus?: number;
+    parsed: {
+        status?: string;
+        errorCode?: string;
+    } | null;
+}
+/**
+ * Send a single timed fetch probe and parse the JSON envelope. Returns
+ * `null` when the request itself fails (network error or abort).
+ */
+declare const sendProbe: (input: ProbeRequestInput) => Promise<ProbeResponse | null>;
+interface ProbeTransportRequest {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    /** The route payload — the API `data`, or the sync `data` (the transport adds the sync envelope). */
+    body: unknown;
+    /** HTTP headers (session Cookie, CSRF). A socket transport reads only the Cookie. */
+    headers?: Record<string, string>;
+    requestTimeoutMs: number;
+}
+interface ProbeTransport {
+    readonly name: 'http' | 'socket';
+    /** Resolve with the parsed reply, or `null` when no reply arrived (network error / timeout). */
+    send: (request: ProbeTransportRequest) => Promise<ProbeResponse | null>;
+    /** Release held connections. Optional — the HTTP transport holds none. */
+    close?: () => Promise<void>;
+}
+interface HttpProbeTransportOptions {
+    /**
+     * Room sent as `receiver` on sync probes. Without one the server answers
+     * `sync.missingReceiver`, which proves the envelope but not the route.
+     */
+    syncReceiver?: string;
+}
+declare const createHttpProbeTransport: (options?: HttpProbeTransportOptions) => ProbeTransport;
+/** Transport the checks use when the caller supplies none. */
+declare const defaultProbeTransport: ProbeTransport;
 
 interface ContractCheckInput {
     endpoint: EndpointDescriptor;
@@ -61,11 +117,15 @@ interface ContractCheckInput {
      * the contract check.
      */
     requestTimeoutMs?: number;
+    /** How the probe reaches the server. Defaults to HTTP. */
+    transport?: ProbeTransport;
 }
 declare const runContractCheck: (input: ContractCheckInput) => Promise<ContractCheckResult>;
 
 interface RunContractTestsInput {
     apiMethodMap: ApiMethodMap$1;
+    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
+    syncMetaMap?: SyncMetaMap;
     baseUrl: string;
     /**
      * Endpoints to skip. Matched against `<page>/<name>` (version-agnostic) and
@@ -73,8 +133,12 @@ interface RunContractTestsInput {
      * are known to need real input (e.g. a file upload).
      */
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
+    filter?: string;
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
     headers?: Record<string, string>;
+    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
+    syncTransport?: ProbeTransport;
     onResult?: (result: ContractCheckResult) => void;
 }
 declare const runContractTests: (input: RunContractTestsInput) => Promise<RunContractSummary>;
@@ -85,15 +149,23 @@ interface AuthEnforcementCheckInput {
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
     /** Per-call request timeout in ms. Defaults to 5000. */
     requestTimeoutMs?: number;
+    /** How the probe reaches the server. Defaults to HTTP. */
+    transport?: ProbeTransport;
 }
 declare const runAuthEnforcementCheck: (input: AuthEnforcementCheckInput) => Promise<ContractCheckResult>;
 
 interface RunAuthEnforcementTestsInput {
     apiMethodMap: ApiMethodMap$1;
     apiMetaMap: ApiMetaMap;
+    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
+    syncMetaMap?: SyncMetaMap;
     baseUrl: string;
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
+    filter?: string;
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
+    syncTransport?: ProbeTransport;
     onResult?: (result: ContractCheckResult) => void;
 }
 declare const runAuthEnforcementTests: (input: RunAuthEnforcementTestsInput) => Promise<RunContractSummary>;
@@ -106,27 +178,37 @@ interface RateLimitCheckInput {
     headers?: Record<string, string>;
     /** Per-call request timeout in ms. Defaults to 10000. */
     requestTimeoutMs?: number;
+    /** How the probes reach the server. Defaults to HTTP. */
+    transport?: ProbeTransport;
 }
 declare const runRateLimitCheck: (input: RateLimitCheckInput) => Promise<ContractCheckResult>;
 
 interface RunRateLimitTestsInput {
     apiMethodMap: ApiMethodMap$1;
     apiMetaMap: ApiMetaMap;
+    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
+    syncMetaMap?: SyncMetaMap;
     baseUrl: string;
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
+    filter?: string;
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
     headers?: Record<string, string>;
+    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
+    syncTransport?: ProbeTransport;
     /**
      * Max rateLimit value to test. Endpoints with a higher limit are skipped
      * to avoid firing thousands of requests in CI.
      */
     maxRateLimitToTest?: number;
     /**
-     * When true, hit `/_test/reset` before each endpoint so limiter state is
-     * clean. Requires the server to allow the endpoint: `NODE_ENV` in
-     * { 'development', 'test' } AND `TEST_RESET_TOKEN` set on the server with a
-     * matching `resetToken` here (an unset token is 403, never open). Without
-     * resetting, the shared IP bucket leaks state between endpoints.
+     * When true, hit `/_test/reset?only=rateLimits` before each endpoint so
+     * limiter state is clean. Only the limiter buckets are cleared — sessions
+     * survive, so an authenticated sweep keeps its session. Requires the server
+     * to allow the endpoint: `NODE_ENV` in { 'development', 'test' } AND
+     * `TEST_RESET_TOKEN` set on the server with a matching `resetToken` here (an
+     * unset token is 403, never open). Without resetting, the shared IP bucket
+     * leaks state between endpoints.
      */
     resetBetweenEndpoints?: boolean;
     /**
@@ -153,17 +235,33 @@ interface CsrfEnforcementCheckInput {
     expectedErrorCode?: string;
     /** HTTP status expected on CSRF rejection. Defaults to 403; pass `false` to skip. */
     expectedHttpStatus?: number | false;
+    /**
+     * HTTP transport the probe uses (e.g. one carrying the sync `receiver`).
+     * CSRF is an HTTP-only guard, so a non-HTTP transport makes the check skip.
+     * Defaults to plain HTTP.
+     */
+    transport?: ProbeTransport;
 }
 declare const runCsrfEnforcementCheck: (input: CsrfEnforcementCheckInput) => Promise<ContractCheckResult>;
 
 interface RunCsrfEnforcementTestsInput {
     apiMethodMap: ApiMethodMap$1;
     apiMetaMap: ApiMetaMap;
+    /** Generated `syncMetaMap`. When given, sync routes' `/sync/*` HTTP endpoints are probed too. */
+    syncMetaMap?: SyncMetaMap;
     baseUrl: string;
     /** Valid session Cookie header (`<name>=<token>`) the probes carry so they reach the CSRF check. */
     authCookie: string;
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
+    filter?: string;
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /**
+     * HTTP transport for sync routes (one carrying the sync `receiver`). CSRF is
+     * an HTTP-only guard, so this must be an HTTP transport even when the project
+     * syncs over Socket.io — the `/sync/*` HTTP route is reachable either way.
+     */
+    syncTransport?: ProbeTransport;
     /** Per-call request timeout in ms forwarded to each check. */
     requestTimeoutMs?: number;
     /** Error code expected on CSRF rejection. Defaults to `auth.csrfMismatch`. */
@@ -180,14 +278,22 @@ interface FuzzCheckInput {
     headers?: Record<string, string>;
     /** Per-call request timeout in ms. Defaults to 5000. */
     requestTimeoutMs?: number;
+    /** How the probes reach the server. Defaults to HTTP. */
+    transport?: ProbeTransport;
 }
 declare const runFuzzCheck: (input: FuzzCheckInput) => Promise<ContractCheckResult>;
 
 interface RunFuzzTestsInput {
     apiMethodMap: ApiMethodMap$1;
+    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
+    syncMetaMap?: SyncMetaMap;
     baseUrl: string;
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
+    filter?: string;
     headers?: Record<string, string>;
+    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
+    syncTransport?: ProbeTransport;
     onResult?: (result: ContractCheckResult) => void;
 }
 declare const runFuzzTests: (input: RunFuzzTestsInput) => Promise<RunContractSummary>;
@@ -196,8 +302,35 @@ interface ResetServerStateInput {
     baseUrl: string;
     token?: string;
     requestTimeoutMs?: number;
+    /**
+     * Clear only these targets (`?only=`). Omit for the server's default reset,
+     * which ALSO deletes every Redis session — including an authenticated sweep's
+     * own. The runner itself always passes `['rateLimits']`.
+     */
+    only?: TestResetTarget[];
+}
+declare const resetServerState: ({ baseUrl, token, requestTimeoutMs, only }: ResetServerStateInput) => Promise<boolean>;
+
+interface SocketProbeTransportOptions {
+    baseUrl: string;
+    /** Room every sync probe targets; authenticated sockets join it first. */
+    receiver: string;
+    /** Session cookie name, used to read the token out of a probe's Cookie header. */
+    sessionCookieName: string;
+}
+declare const createSocketProbeTransport: (options: SocketProbeTransportOptions) => ProbeTransport;
+
+type InputSchemaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, ZodType | undefined>>>>>>;
+interface CreateSampleInputForOptions {
+    apiInputSchemas?: InputSchemaMap;
+    syncInputSchemas?: InputSchemaMap;
+    /**
+     * Prefix for generated unconstrained strings — pass the run's
+     * `createTestDataMarker()` so rows the probes create are identifiable.
+     */
+    stringPrefix?: string;
 }
-declare const resetServerState: ({ baseUrl, token, requestTimeoutMs }: ResetServerStateInput) => Promise<boolean>;
+declare const createSampleInputFor: (options: CreateSampleInputForOptions) => (endpoint: EndpointDescriptor) => unknown;
 
 interface ResolveTestBaseUrlOptions {
     /** Project root containing node_modules/.luckystack/dev-server.json. */
@@ -343,12 +476,36 @@ interface DiscoveredTestFile {
     };
 }
 declare const discoverCustomTestFiles: (srcDir?: string) => DiscoveredTestFile[];
+interface CallSyncOptions {
+    /** Room the sync targets (the server requires one). */
+    receiver?: string;
+    /** Skip the sender's own socket in the fan-out (socket transport). */
+    ignoreSelf?: boolean;
+    /** Force a transport. Defaults to the project's `transport.invocation`. */
+    transport?: 'socket' | 'http';
+    /** Socket transport: join `receiver` before sending. Default `true`. */
+    joinRoom?: boolean;
+}
 interface TestContext {
-    /** Invoke the route under test. Page / name / version are baked in. */
+    /**
+     * Invoke the route under test. Page / name / version are baked in.
+     *
+     * `input` travels exactly like the real client sends it: as the JSON body
+     * for POST / PUT / DELETE routes, and as the `__luckystack_data` query-string
+     * value for GET routes (a GET cannot carry a body). Either way the server
+     * validates it as the route's `data`, so a GET route with required fields
+     * receives them.
+     */
     callApi: <TInput = unknown, TOutput = unknown>(input: TInput) => Promise<TOutput>;
-    callSync: <TInput = unknown, TOutput = unknown>(input: TInput, opts?: {
-        receiver?: string;
-    }) => Promise<TOutput>;
+    /**
+     * Invoke the sync route under test over the SAME transport the project's
+     * real client uses (`transport.invocation`): Socket.io for `'socket'` (the
+     * default), the `/sync/*` HTTP route for `'routed-http'`. Override per call
+     * with `opts.transport`. Over the socket, the case's session socket first
+     * joins `opts.receiver` (like a real client joins its room before syncing);
+     * pass `joinRoom: false` to test a non-member.
+     */
+    callSync: <TInput = unknown, TOutput = unknown>(input: TInput, opts?: CallSyncOptions) => Promise<TOutput>;
     /**
      * Open a second socket connection that joins `roomCode` as a pure
      * subscriber and exposes the incoming chunk stream for assertions.
@@ -385,9 +542,29 @@ interface TestExpect {
 }
 declare const runCustomTests: (input: RunCustomTestsInput) => Promise<RunCustomTestsSummary>;
 
-type ApiInputSchemas = Partial<Record<string, Partial<Record<string, Partial<Record<string, ZodType | undefined>>>>>>;
 interface RunAllTestsInput {
     apiMethodMap: ApiMethodMap$1;
+    /**
+     * Generated `syncMetaMap` (from `apiTypes.generated.ts`). When given, the
+     * sweep layers exercise every sync route too; without it sync routes are
+     * not swept (a warning says so).
+     */
+    syncMetaMap?: SyncMetaMap;
+    /** Generated `syncInputSchemas` (from `apiInputSchemas.generated.ts`) — Zod-valid sync sample payloads. */
+    syncInputSchemas?: InputSchemaMap;
+    /**
+     * How sync routes are probed. Defaults to the project's own
+     * `transport.invocation`: `'socket'` → Socket.io (the pipeline real clients
+     * hit), `'routed-http'` → the `/sync/*` HTTP route. The CSRF layer always
+     * probes over HTTP — CSRF is an HTTP-only guard.
+     */
+    syncTransport?: 'socket' | 'http';
+    /**
+     * Write the full `RunAllTestsSummary` as JSON to this path (relative to the
+     * process cwd). Defaults to `TEST_OUTPUT_FILE`, else `test-results.json`;
+     * `false` disables the file.
+     */
+    outputFile?: string | false;
     /**
      * Lazy loader for the consumer's default `config.ts` export. Required so
      * runAllTests cannot silently skip a configured secret manager; resolution
@@ -395,7 +572,7 @@ interface RunAllTestsInput {
      */
     loadProjectConfig: NonNullable<ResolveTestEnvironmentInput['loadProjectConfig']>;
     apiMetaMap: ApiMetaMap;
-    apiInputSchemas: ApiInputSchemas;
+    apiInputSchemas: InputSchemaMap;
     baseUrl: string;
     /** Cookie name for the session token. Defaults to the project's configured session cookie name (`projectConfig.http.sessionCookieName`). */
     sessionCookieName?: string;
@@ -426,12 +603,14 @@ interface RunAllTestsInput {
      */
     resetToken?: string;
     /**
-     * Contract-test mutation safety (finding #98). When a reset token is
-     * available, the sweep POSTs `/_test/reset` ONCE before the first layer
-     * (clean slate — no real row the generated payloads could clobber) and ONCE
-     * after the last (drop whatever the sweep created, so no test data persists).
+     * When a reset token is available, the sweep POSTs
+     * `/_test/reset?only=rateLimits` ONCE before the first layer (no bucket left
+     * drained by an earlier run) and ONCE after the last (the custom layer and the
+     * next run start unthrottled). Only limiter state is cleared: sessions — the
+     * `authToken` session above all — survive, so `TEST_RESET_TOKEN` can be set
+     * on an authenticated sweep. The reset never touches the app database.
      * Defaults to ON; set `false` to opt out. With no token the bookends are
-     * silently skipped with a logged note (they can't run — `/_test/reset` 403s).
+     * skipped with a logged note (they can't run — `/_test/reset` 403s).
      */
     resetBookends?: boolean;
 }
@@ -449,12 +628,19 @@ declare const runAllTests: (input: RunAllTestsInput) => Promise<RunAllTestsSumma
 declare const logRunAllSummary: (summary: RunAllTestsSummary) => void;
 
 interface TestLayerInput {
-    /** Resolved route name (`api/billing/getInvoice/v1`). */
+    /** Resolved route name (`api/billing/getInvoice/v1` or `sync/chat/send/v1`). */
     endpoint: string;
     /** Method when applicable, undefined for sync endpoints. */
     method?: string;
     /** Bearer token / session token to use for auth-aware checks. */
     authToken?: string;
+    /**
+     * A Zod-valid sample `data` payload for this route — generated from the
+     * route's input schema when `runRegisteredLayers` received the generated
+     * schemas (or an `inputFor`), `{}` otherwise. The same payload the built-in
+     * contract sweep sends, so a layer can exercise the route past validation.
+     */
+    sampleInput?: unknown;
 }
 interface TestLayerResult {
     passed: boolean;
@@ -527,6 +713,8 @@ declare const resetTestExtensionsForTests: () => void;
 
 interface RunRegisteredLayersInput {
     apiMethodMap: ApiMethodMap$1;
+    /** Generated `syncMetaMap`. When given, layers also run against every sync route. */
+    syncMetaMap?: SyncMetaMap;
     /** Session/bearer token forwarded to each layer's `run({ authToken })`. */
     authToken?: string;
     /**
@@ -534,6 +722,14 @@ interface RunRegisteredLayersInput {
      * `<page>/<name>/<version>`, same convention as the built-in sweeps.
      */
     skip?: string[];
+    /** Substring filter on `<page>/<name>/<version>`, same as the built-in sweeps. */
+    filter?: string;
+    /** Generated `apiInputSchemas` — source of each API route's `sampleInput`. */
+    apiInputSchemas?: InputSchemaMap;
+    /** Generated `syncInputSchemas` — source of each sync route's `sampleInput`. */
+    syncInputSchemas?: InputSchemaMap;
+    /** Custom sample factory; wins over the schema maps when given. */
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
 }
 declare const runRegisteredLayers: (input: RunRegisteredLayersInput) => Promise<TestSummary>;
 
@@ -546,4 +742,4 @@ declare const LAYER_KEYS: {
     readonly custom: "custom";
 };
 
-export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, LAYER_KEYS, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type ResolveTestBaseUrlOptions, type ResolveTestEnvironmentInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type RunRegisteredLayersInput, type SampleSchemaOptions, type StreamChunkFrame, type StreamWatcher, type SyncMethodMap, TEST_DATA_PREFIX, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, createTestDataMarker, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, resolveTestBaseUrl, resolveTestEnvironment, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, runRegisteredLayers, sampleSchemaInput, walkEndpoints, walkSyncEndpoints };
+export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type CallSyncOptions, type ContractCheckInput, type ContractCheckResult, type CreateSampleInputForOptions, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, type HttpProbeTransportOptions, type InputSchemaMap, LAYER_KEYS, type OpenStreamWatcherInput, type ProbeRequestInput, type ProbeResponse, type ProbeTransport, type ProbeTransportRequest, type RateLimitCheckInput, type ResetServerStateInput, type ResolveTestBaseUrlOptions, type ResolveTestEnvironmentInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type RunRegisteredLayersInput, type SampleSchemaOptions, type SocketProbeTransportOptions, type StreamChunkFrame, type StreamWatcher, type SyncMetaEntry, type SyncMetaMap, type SyncMethodMap, TEST_DATA_PREFIX, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, createHttpProbeTransport, createSampleInputFor, createSocketProbeTransport, createTestDataMarker, defaultProbeTransport, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, resolveTestBaseUrl, resolveTestEnvironment, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, runRegisteredLayers, sampleSchemaInput, sendProbe, walkEndpoints, walkSyncEndpoints };