@luckystack/test-runner 0.10.1 → 0.11.0

package/dist/index.js

@@ -32,20 +32,21 @@ var walkEndpoints = (apiMethodMap) => {
   }
   return endpoints;
 };
-var walkSyncEndpoints = (syncMethodMap) => {
+var walkSyncEndpoints = (syncMap) => {
   const endpoints = [];
-  for (const [page, nameMap] of Object.entries(syncMethodMap)) {
+  for (const [page, nameMap] of Object.entries(syncMap)) {
     if (!nameMap) continue;
     for (const [name, versionMap] of Object.entries(nameMap)) {
       if (!versionMap) continue;
-      for (const [version, method] of Object.entries(versionMap)) {
-        if (method === void 0) continue;
+      for (const [version, leaf] of Object.entries(versionMap)) {
+        if (leaf === void 0) continue;
         endpoints.push({
           page,
           name,
           version,
           method: "POST",
-          fullPath: `sync/${page}/${name}/${version}`
+          fullPath: `sync/${page}/${name}/${version}`,
+          kind: "sync"
         });
       }
     }
@@ -54,13 +55,15 @@ var walkSyncEndpoints = (syncMethodMap) => {
 };
 
 // src/probeRequest.ts
-import { tryCatch } from "@luckystack/core";
+import { buildRoutedGetUrl, tryCatch } from "@luckystack/core";
 var sendProbe = async (input) => {
   const controller = new AbortController();
   const timeoutHandle = setTimeout(() => {
     controller.abort();
   }, input.requestTimeoutMs);
-  const [fetchError, response] = await tryCatch(() => fetch(input.url, {
+  const isGet = input.method === "GET";
+  const url = isGet && input.body !== void 0 ? buildRoutedGetUrl(input.url, input.body) : input.url;
+  const [fetchError, response] = await tryCatch(() => fetch(url, {
     method: input.method,
     headers: {
       "Content-Type": "application/json",
@@ -69,7 +72,7 @@ var sendProbe = async (input) => {
       "Origin": new URL(input.baseUrl).origin,
       ...input.headers
     },
-    body: input.method === "GET" ? void 0 : JSON.stringify(input.body),
+    body: isGet ? void 0 : JSON.stringify(input.body),
     signal: controller.signal
   }));
   clearTimeout(timeoutHandle);
@@ -79,17 +82,27 @@ var sendProbe = async (input) => {
   );
   return { httpStatus: response.status, parsed: parsed ?? null };
 };
+var createHttpProbeTransport = (options = {}) => ({
+  name: "http",
+  send: (request) => sendProbe({
+    url: `${request.baseUrl.replace(/\/$/, "")}/${request.endpoint.fullPath}`,
+    method: request.endpoint.method,
+    baseUrl: request.baseUrl,
+    body: request.endpoint.kind === "sync" ? { data: request.body, receiver: options.syncReceiver } : request.body,
+    headers: request.headers,
+    requestTimeoutMs: request.requestTimeoutMs
+  })
+});
+var defaultProbeTransport = createHttpProbeTransport();
 
 // src/contractCheck.ts
 var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
 var runContractCheck = async (input) => {
   const { endpoint, baseUrl } = input;
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
-  const result = await sendProbe({
-    url,
-    method: endpoint.method,
+  const result = await (input.transport ?? defaultProbeTransport).send({
+    endpoint,
     baseUrl,
     body,
     headers: input.headers,
@@ -167,23 +180,31 @@ var LAYER_KEYS = {
   custom: "custom"
 };
 var STATE_CHANGING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE"]);
+var routeKey = (endpoint) => `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
+var matchesFilter = (endpoint, filter) => !filter || routeKey(endpoint).includes(filter);
+var selectEndpoints = (input) => [
+  ...walkEndpoints(input.apiMethodMap),
+  ...input.syncMetaMap ? walkSyncEndpoints(input.syncMetaMap) : []
+].filter((endpoint) => matchesFilter(endpoint, input.filter));
+var metaMapFor = (endpoint, apiMetaMap, syncMetaMap) => endpoint.kind === "sync" ? syncMetaMap ?? {} : apiMetaMap;
+var transportFor = (endpoint, syncTransport) => endpoint.kind === "sync" && syncTransport ? syncTransport : defaultProbeTransport;
 var shouldSkip = (endpoint, skip) => {
   if (skip.length === 0) return false;
-  const versioned = `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
+  const versioned = routeKey(endpoint);
   const versionless = `${endpoint.page}/${endpoint.name}`;
   return skip.includes(versioned) || skip.includes(versionless);
 };
-var requiresLogin = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+var requiresLogin = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
   return meta?.auth?.login ?? false;
 };
-var hasAuthRequirement = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+var hasAuthRequirement = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
   return (meta?.auth?.login ?? false) || (meta?.auth?.hasAdditional ?? false);
 };
-var hasMetaEntry = (apiMetaMap, endpoint) => apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
-var getRateLimit = (apiMetaMap, endpoint) => {
-  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+var hasMetaEntry = (metaMap, endpoint) => metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
+var getRateLimit = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
   if (!meta || meta.rateLimit === false || meta.rateLimit === void 0) return null;
   return meta.rateLimit;
 };
@@ -197,7 +218,7 @@ var calculateSummary = (results) => ({
 
 // src/runContractTests.ts
 var runContractTests = async (input) => {
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const results = [];
   for (const endpoint of endpoints) {
@@ -216,7 +237,8 @@ var runContractTests = async (input) => {
       endpoint,
       baseUrl: input.baseUrl,
       inputFor: input.inputFor,
-      headers: input.headers
+      headers: input.headers,
+      transport: transportFor(endpoint, input.syncTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -229,12 +251,10 @@ var DEFAULT_REQUEST_TIMEOUT_MS2 = 5e3;
 var EXPECTED_ERROR_CODES = /* @__PURE__ */ new Set(["auth.required", "auth.forbidden"]);
 var runAuthEnforcementCheck = async (input) => {
   const { endpoint, baseUrl } = input;
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
-  const result = await sendProbe({
-    url,
-    method: endpoint.method,
+  const result = await (input.transport ?? defaultProbeTransport).send({
+    endpoint,
     baseUrl,
     body,
     requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2
@@ -292,22 +312,23 @@ var runAuthEnforcementCheck = async (input) => {
 
 // src/runAuthEnforcementTests.ts
 var runAuthEnforcementTests = async (input) => {
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const results = [];
   for (const endpoint of endpoints) {
-    if (!hasMetaEntry(input.apiMetaMap, endpoint)) {
+    const metaMap = metaMapFor(endpoint, input.apiMetaMap, input.syncMetaMap);
+    if (!hasMetaEntry(metaMap, endpoint)) {
       const skipped = {
         endpoint,
         status: "skipped",
         durationMs: 0,
-        reason: "No apiMetaMap entry \u2014 auth requirement unverifiable"
+        reason: `No ${endpoint.kind === "sync" ? "syncMetaMap" : "apiMetaMap"} entry \u2014 auth requirement unverifiable`
       };
       results.push(skipped);
       input.onResult?.(skipped);
       continue;
     }
-    if (!hasAuthRequirement(input.apiMetaMap, endpoint)) {
+    if (!hasAuthRequirement(metaMap, endpoint)) {
       continue;
     }
     if (shouldSkip(endpoint, skip)) {
@@ -324,7 +345,8 @@ var runAuthEnforcementTests = async (input) => {
     const result = await runAuthEnforcementCheck({
       endpoint,
       baseUrl: input.baseUrl,
-      inputFor: input.inputFor
+      inputFor: input.inputFor,
+      transport: transportFor(endpoint, input.syncTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -334,21 +356,24 @@ var runAuthEnforcementTests = async (input) => {
 
 // src/rateLimitCheck.ts
 var DEFAULT_REQUEST_TIMEOUT_MS3 = 1e4;
-var EXPECTED_ERROR_CODE = "api.rateLimitExceeded";
+var expectedErrorCodeFor = (endpoint) => endpoint.kind === "sync" ? "sync.rateLimitExceeded" : "api.rateLimitExceeded";
 var PRE_LIMITER_ERROR_CODES = /* @__PURE__ */ new Set([
   "auth.required",
   "auth.forbidden",
-  "auth.csrfMismatch"
+  "auth.csrfMismatch",
+  "sync.notRoomMember",
+  "sync.receiverNotAllowed",
+  "sync.missingReceiver"
 ]);
 var runRateLimitCheck = async (input) => {
   const { endpoint, baseUrl, rateLimit } = input;
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
   const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS3;
-  const send = () => sendProbe({
-    url,
-    method: endpoint.method,
+  const expectedErrorCode = expectedErrorCodeFor(endpoint);
+  const transport = input.transport ?? defaultProbeTransport;
+  const send = () => transport.send({
+    endpoint,
     baseUrl,
     body,
     headers: input.headers,
@@ -378,7 +403,7 @@ var runRateLimitCheck = async (input) => {
     };
   }
   const { httpStatus, parsed } = final;
-  if (parsed?.status === "error" && parsed.errorCode === EXPECTED_ERROR_CODE) {
+  if (parsed?.status === "error" && parsed.errorCode === expectedErrorCode) {
     return {
       endpoint,
       status: "pass",
@@ -395,16 +420,17 @@ var runRateLimitCheck = async (input) => {
     httpStatus,
     responseStatus,
     errorCode: parsed?.errorCode,
-    reason: `expected '${EXPECTED_ERROR_CODE}' on request ${rateLimit + 1} but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
+    reason: `expected '${expectedErrorCode}' on request ${rateLimit + 1} but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
     durationMs
   };
 };
 
 // src/resetServerState.ts
-import { getProjectConfig, tryCatch as tryCatch2 } from "@luckystack/core";
+import { getProjectConfig, TEST_RESET_ONLY_PARAM, tryCatch as tryCatch2 } from "@luckystack/core";
 var DEFAULT_REQUEST_TIMEOUT_MS4 = 1e4;
-var resetServerState = async ({ baseUrl, token, requestTimeoutMs }) => {
-  const url = `${baseUrl.replace(/\/$/, "")}${getProjectConfig().http.testResetEndpoint}`;
+var resetServerState = async ({ baseUrl, token, requestTimeoutMs, only }) => {
+  const endpoint = `${baseUrl.replace(/\/$/, "")}${getProjectConfig().http.testResetEndpoint}`;
+  const url = only && only.length > 0 ? `${endpoint}?${new URLSearchParams({ [TEST_RESET_ONLY_PARAM]: only.join(",") }).toString()}` : endpoint;
   const headers = { "Content-Type": "application/json" };
   if (token) headers["X-Test-Reset-Token"] = token;
   const controller = new AbortController();
@@ -419,15 +445,16 @@ var resetServerState = async ({ baseUrl, token, requestTimeoutMs }) => {
 
 // src/runRateLimitTests.ts
 var runRateLimitTests = async (input) => {
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const maxRateLimit = input.maxRateLimitToTest ?? 50;
   const isAuthenticatedSweep = Boolean(input.headers?.Cookie);
   const results = [];
   for (const endpoint of endpoints) {
-    const rateLimit = getRateLimit(input.apiMetaMap, endpoint);
+    const metaMap = metaMapFor(endpoint, input.apiMetaMap, input.syncMetaMap);
+    const rateLimit = getRateLimit(metaMap, endpoint);
     if (rateLimit === null) continue;
-    if (!isAuthenticatedSweep && requiresLogin(input.apiMetaMap, endpoint)) {
+    if (!isAuthenticatedSweep && requiresLogin(metaMap, endpoint)) {
       const skipped = {
         endpoint,
         status: "skipped",
@@ -472,14 +499,15 @@ var runRateLimitTests = async (input) => {
       continue;
     }
     if (input.resetBetweenEndpoints) {
-      await resetServerState({ baseUrl: input.baseUrl, token: input.resetToken });
+      await resetServerState({ baseUrl: input.baseUrl, token: input.resetToken, only: ["rateLimits"] });
     }
     const result = await runRateLimitCheck({
       endpoint,
       baseUrl: input.baseUrl,
       rateLimit,
       inputFor: input.inputFor,
-      headers: input.headers
+      headers: input.headers,
+      transport: transportFor(endpoint, input.syncTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -501,14 +529,21 @@ var runCsrfEnforcementCheck = async (input) => {
       durationMs: 0
     };
   }
-  const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
+  const transport = input.transport ?? defaultProbeTransport;
+  if (transport.name !== "http") {
+    return {
+      endpoint,
+      status: "skipped",
+      reason: `CSRF enforcement only applies over HTTP (transport: ${transport.name})`,
+      durationMs: 0
+    };
+  }
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
   const expectedErrorCode = input.expectedErrorCode ?? DEFAULT_EXPECTED_ERROR_CODE;
   const expectedHttpStatus = input.expectedHttpStatus ?? DEFAULT_EXPECTED_HTTP_STATUS;
-  const result = await sendProbe({
-    url,
-    method: endpoint.method,
+  const result = await transport.send({
+    endpoint,
     baseUrl,
     body,
     headers: { Cookie: input.authCookie },
@@ -557,12 +592,13 @@ var runCsrfEnforcementCheck = async (input) => {
 
 // src/runCsrfEnforcementTests.ts
 var runCsrfEnforcementTests = async (input) => {
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const results = [];
   for (const endpoint of endpoints) {
-    if (!hasMetaEntry(input.apiMetaMap, endpoint)) continue;
-    if (!requiresLogin(input.apiMetaMap, endpoint)) continue;
+    const metaMap = metaMapFor(endpoint, input.apiMetaMap, input.syncMetaMap);
+    if (!hasMetaEntry(metaMap, endpoint)) continue;
+    if (!requiresLogin(metaMap, endpoint)) continue;
     if (!STATE_CHANGING_METHODS.has(endpoint.method)) continue;
     if (shouldSkip(endpoint, skip)) {
       const skipped = {
@@ -582,7 +618,8 @@ var runCsrfEnforcementTests = async (input) => {
       inputFor: input.inputFor,
       requestTimeoutMs: input.requestTimeoutMs,
       expectedErrorCode: input.expectedErrorCode,
-      expectedHttpStatus: input.expectedHttpStatus
+      expectedHttpStatus: input.expectedHttpStatus,
+      transport: transportFor(endpoint, input.syncTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -609,11 +646,10 @@ var JUNK_PAYLOADS = [
 var runFuzzCheck = async (input) => {
   const started = Date.now();
   const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS6;
-  const url = `${input.baseUrl.replace(/\/$/, "")}/${input.endpoint.fullPath}`;
+  const transport = input.transport ?? defaultProbeTransport;
   for (const payload of JUNK_PAYLOADS) {
-    const result = await sendProbe({
-      url,
-      method: input.endpoint.method,
+    const result = await transport.send({
+      endpoint: input.endpoint,
       baseUrl: input.baseUrl,
       body: payload,
       headers: input.headers,
@@ -656,7 +692,7 @@ var runFuzzCheck = async (input) => {
 
 // src/runFuzzTests.ts
 var runFuzzTests = async (input) => {
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const isAuthenticatedSweep = Boolean(input.headers?.Cookie);
   const results = [];
@@ -686,7 +722,8 @@ var runFuzzTests = async (input) => {
     const result = await runFuzzCheck({
       endpoint,
       baseUrl: input.baseUrl,
-      headers: input.headers
+      headers: input.headers,
+      transport: transportFor(endpoint, input.syncTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -694,81 +731,203 @@ var runFuzzTests = async (input) => {
   return calculateSummary(results);
 };
 
-// src/resolveTestBaseUrl.ts
-import fs from "fs";
-import path from "path";
-var isProcessRunning = (pid) => {
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error instanceof Error && "code" in error && error.code === "EPERM";
-  }
+// src/socketProbeTransport.ts
+import { tryCatch as tryCatch4 } from "@luckystack/core";
+
+// src/testSocket.ts
+import { io as createSocketIoClient } from "socket.io-client";
+import {
+  buildJoinRoomResponseEventName,
+  buildSyncResponseEventName,
+  getProjectConfig as getProjectConfig2,
+  socketEventNames,
+  tryCatch as tryCatch3
+} from "@luckystack/core";
+var DEFAULT_CONNECT_TIMEOUT_MS = 3e3;
+var DEFAULT_JOIN_TIMEOUT_MS = 3e3;
+var responseIndexCounter = 0;
+var nextResponseIndex = () => {
+  responseIndexCounter += 1;
+  return responseIndexCounter;
 };
-var resolveTestBaseUrl = (options = {}) => {
-  const explicit = process.env.TEST_BASE_URL;
-  if (explicit) return explicit;
-  try {
-    const raw = fs.readFileSync(
-      path.join(options.cwd ?? process.cwd(), "node_modules", ".luckystack", "dev-server.json"),
-      "utf8"
-    );
-    const info = JSON.parse(raw);
-    if (typeof info.port === "number" && Number.isInteger(info.port) && info.port > 0 && info.port <= 65535 && isProcessRunning(info.pid)) {
-      return `http://localhost:${String(info.port)}`;
+var waitForConnect = (socket, label, timeoutMs) => {
+  return new Promise((resolve, reject) => {
+    if (socket.connected) {
+      resolve();
+      return;
     }
-  } catch {
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error(`${label}: socket failed to connect within ${timeoutMs}ms`));
+    }, timeoutMs);
+    const onConnect = () => {
+      cleanup();
+      resolve();
+    };
+    const onConnectError = (err) => {
+      cleanup();
+      reject(new Error(`${label}: connect_error \u2014 ${err.message}`));
+    };
+    const cleanup = () => {
+      clearTimeout(timer);
+      socket.off("connect", onConnect);
+      socket.off("connect_error", onConnectError);
+    };
+    socket.on("connect", onConnect);
+    socket.on("connect_error", onConnectError);
+  });
+};
+var connectTestSocket = async (input) => {
+  const sessionCookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
+  const socket = createSocketIoClient(input.baseUrl, {
+    transports: ["websocket"],
+    forceNew: true,
+    reconnection: false,
+    auth: input.token ? { token: input.token } : void 0,
+    extraHeaders: input.token ? { Cookie: `${sessionCookieName}=${input.token}` } : void 0
+  });
+  const [connectError] = await tryCatch3(
+    () => waitForConnect(socket, input.label, input.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS)
+  );
+  if (connectError) {
+    socket.disconnect();
+    throw connectError;
   }
-  return options.fallbackUrl ?? "http://localhost:80";
+  return socket;
+};
+var RELEASE_TIMEOUT_MS = 1e3;
+var releaseTestSocket = async (socket) => {
+  if (!socket.connected) return;
+  await new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      socket.off("disconnect", onDisconnect);
+      resolve();
+    }, RELEASE_TIMEOUT_MS);
+    const onDisconnect = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    socket.once("disconnect", onDisconnect);
+    socket.emit(socketEventNames.intentionalDisconnect);
+  });
+  socket.disconnect();
+};
+var joinTestRoom = (socket, room, options) => {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_JOIN_TIMEOUT_MS;
+  const responseIndex = nextResponseIndex();
+  const eventName = buildJoinRoomResponseEventName(responseIndex);
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      socket.off(eventName, onAck);
+      reject(new Error(`${options.label}: joinRoom ack timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+    const onAck = (payload) => {
+      clearTimeout(timer);
+      socket.off(eventName, onAck);
+      if (typeof payload === "object" && payload !== null && payload.status === "error") {
+        const errorCode = payload.errorCode;
+        reject(new Error(`${options.label}: joinRoom rejected \u2014 ${typeof errorCode === "string" ? errorCode : "unknown"}`));
+        return;
+      }
+      resolve();
+    };
+    socket.on(eventName, onAck);
+    socket.emit(socketEventNames.joinRoom, { group: room, responseIndex });
+  });
+};
+var emitSyncOverSocket = (socket, input) => {
+  const responseIndex = nextResponseIndex();
+  const eventName = buildSyncResponseEventName(responseIndex);
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      socket.off(eventName, onResponse);
+      resolve({ kind: "timeout" });
+    }, input.timeoutMs);
+    const onResponse = (payload) => {
+      clearTimeout(timer);
+      socket.off(eventName, onResponse);
+      resolve({ kind: "response", payload });
+    };
+    socket.on(eventName, onResponse);
+    socket.emit(socketEventNames.sync, {
+      name: `sync/${input.routePath}`,
+      //? Only `undefined` defaults — a fuzz probe's `null` must reach the server as-is.
+      data: input.data === void 0 ? {} : input.data,
+      //? Same fallback cancel key the real client sends before the server's
+      //? `__cancelId` handshake arrives; the runner never cancels, so it is
+      //? only there to keep the request shape identical.
+      cb: input.routePath,
+      receiver: input.receiver,
+      responseIndex,
+      ignoreSelf: input.ignoreSelf ?? false
+    });
+  });
 };
 
-// src/resolveTestEnvironment.ts
-import { loadEnvFiles, tryCatch as tryCatch3 } from "@luckystack/core";
-var assertProjectConfigLoader = (input, caller) => {
-  if (typeof input !== "object" || input === null || !("loadProjectConfig" in input) || typeof input.loadProjectConfig !== "function") {
-    throw new TypeError(`[test-runner] ${caller} requires a lazy loadProjectConfig callback`);
+// src/socketProbeTransport.ts
+var LABEL = "sync probe";
+var tokenFromCookieHeader = (cookieHeader, cookieName) => {
+  if (!cookieHeader) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [rawName, ...rest] = part.trim().split("=");
+    if (rawName === cookieName && rest.length > 0) return rest.join("=");
   }
+  return null;
 };
-var isRecord = (value) => typeof value === "object" && value !== null;
-var isToken = (value) => typeof value === "string" || isRecord(value) && typeof value.fromFile === "string";
-var readSecretManagerConfig = (projectConfig) => {
-  if (!isRecord(projectConfig)) return null;
-  const candidate = projectConfig.secretManager;
-  if (!isRecord(candidate)) return null;
-  const url = candidate.url;
-  if (url === void 0 || url === "") return null;
-  if (typeof url !== "string") {
-    throw new TypeError("[test-runner] config.secretManager.url must be a string.");
-  }
-  if (!isToken(candidate.token)) {
-    throw new TypeError(
-      "[test-runner] config.secretManager.token must be a string or { fromFile: string }."
-    );
-  }
-  return { ...candidate, url, token: candidate.token };
+var toProbeResponse = (payload) => {
+  if (typeof payload !== "object" || payload === null) return { parsed: null };
+  const record = payload;
+  return {
+    parsed: {
+      status: typeof record.status === "string" ? record.status : void 0,
+      errorCode: typeof record.errorCode === "string" ? record.errorCode : void 0
+    }
+  };
 };
-var resolveTestEnvironment = async (input = {}) => {
-  loadEnvFiles();
-  if (!input.loadProjectConfig) return;
-  const projectConfig = await input.loadProjectConfig();
-  const secretManagerConfig = readSecretManagerConfig(projectConfig);
-  if (!secretManagerConfig) return;
-  const [importError, secretManager] = await tryCatch3(
-    () => import("@luckystack/secret-manager")
-  );
-  if (importError || !secretManager) {
-    throw new Error(
-      "[test-runner] config.secretManager.url is set, but @luckystack/secret-manager could not be loaded. Install the package or remove the secret-manager config; tests will not continue with unresolved env pointers.",
-      { cause: importError ?? void 0 }
-    );
-  }
-  await secretManager.initSecretManager({
-    ...secretManagerConfig,
-    //? Match the normal server/ORM bootstrap: configured remote resolution is
-    //? fail-fast. A raw DATABASE_URL_V<n> must never leak into Prisma.
-    source: "remote"
-  });
+var createSocketProbeTransport = (options) => {
+  const http = createHttpProbeTransport({ syncReceiver: options.receiver });
+  const sockets = /* @__PURE__ */ new Map();
+  const socketFor = (token) => {
+    const key = token ?? "";
+    const existing = sockets.get(key);
+    if (existing) return existing;
+    const opening = (async () => {
+      const [connectError, socket] = await tryCatch4(() => connectTestSocket({
+        baseUrl: options.baseUrl,
+        token,
+        label: LABEL,
+        sessionCookieName: options.sessionCookieName
+      }));
+      if (connectError || !socket) return null;
+      if (token) await tryCatch4(() => joinTestRoom(socket, options.receiver, { label: LABEL }));
+      return socket;
+    })();
+    sockets.set(key, opening);
+    return opening;
+  };
+  const send = async (request) => {
+    if (request.endpoint.kind !== "sync") return http.send(request);
+    const socket = await socketFor(tokenFromCookieHeader(request.headers?.Cookie, options.sessionCookieName));
+    if (!socket) return null;
+    const outcome = await emitSyncOverSocket(socket, {
+      routePath: `${request.endpoint.page}/${request.endpoint.name}/${request.endpoint.version}`,
+      data: request.body,
+      receiver: options.receiver,
+      timeoutMs: request.requestTimeoutMs
+    });
+    return outcome.kind === "response" ? toProbeResponse(outcome.payload) : null;
+  };
+  const close = async () => {
+    const opened = [...sockets.entries()];
+    sockets.clear();
+    for (const [key, pending] of opened) {
+      const socket = await pending;
+      if (!socket) continue;
+      if (key) await releaseTestSocket(socket);
+      else socket.disconnect();
+    }
+  };
+  return { name: "socket", send, close };
 };
 
 // src/schemaSampleInput.ts
@@ -886,6 +1045,90 @@ var sampleSchemaInput = (schema, options) => {
   return sampleForDef(node.def ?? node._def, options);
 };
 
+// src/sampleInputFor.ts
+var createSampleInputFor = (options) => (endpoint) => {
+  const schemas = endpoint.kind === "sync" ? options.syncInputSchemas : options.apiInputSchemas;
+  const schema = schemas?.[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  return schema ? sampleSchemaInput(schema, { stringPrefix: options.stringPrefix }) : {};
+};
+
+// src/resolveTestBaseUrl.ts
+import fs from "fs";
+import path from "path";
+var isProcessRunning = (pid) => {
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "EPERM";
+  }
+};
+var resolveTestBaseUrl = (options = {}) => {
+  const explicit = process.env.TEST_BASE_URL;
+  if (explicit) return explicit;
+  try {
+    const raw = fs.readFileSync(
+      path.join(options.cwd ?? process.cwd(), "node_modules", ".luckystack", "dev-server.json"),
+      "utf8"
+    );
+    const info = JSON.parse(raw);
+    if (typeof info.port === "number" && Number.isInteger(info.port) && info.port > 0 && info.port <= 65535 && isProcessRunning(info.pid)) {
+      return `http://localhost:${String(info.port)}`;
+    }
+  } catch {
+  }
+  return options.fallbackUrl ?? "http://localhost:80";
+};
+
+// src/resolveTestEnvironment.ts
+import { loadEnvFiles, tryCatch as tryCatch5 } from "@luckystack/core";
+var assertProjectConfigLoader = (input, caller) => {
+  if (typeof input !== "object" || input === null || !("loadProjectConfig" in input) || typeof input.loadProjectConfig !== "function") {
+    throw new TypeError(`[test-runner] ${caller} requires a lazy loadProjectConfig callback`);
+  }
+};
+var isRecord = (value) => typeof value === "object" && value !== null;
+var isToken = (value) => typeof value === "string" || isRecord(value) && typeof value.fromFile === "string";
+var readSecretManagerConfig = (projectConfig) => {
+  if (!isRecord(projectConfig)) return null;
+  const candidate = projectConfig.secretManager;
+  if (!isRecord(candidate)) return null;
+  const url = candidate.url;
+  if (url === void 0 || url === "") return null;
+  if (typeof url !== "string") {
+    throw new TypeError("[test-runner] config.secretManager.url must be a string.");
+  }
+  if (!isToken(candidate.token)) {
+    throw new TypeError(
+      "[test-runner] config.secretManager.token must be a string or { fromFile: string }."
+    );
+  }
+  return { ...candidate, url, token: candidate.token };
+};
+var resolveTestEnvironment = async (input = {}) => {
+  loadEnvFiles();
+  if (!input.loadProjectConfig) return;
+  const projectConfig = await input.loadProjectConfig();
+  const secretManagerConfig = readSecretManagerConfig(projectConfig);
+  if (!secretManagerConfig) return;
+  const [importError, secretManager] = await tryCatch5(
+    () => import("@luckystack/secret-manager")
+  );
+  if (importError || !secretManager) {
+    throw new Error(
+      "[test-runner] config.secretManager.url is set, but @luckystack/secret-manager could not be loaded. Install the package or remove the secret-manager config; tests will not continue with unresolved env pointers.",
+      { cause: importError ?? void 0 }
+    );
+  }
+  await secretManager.initSecretManager({
+    ...secretManagerConfig,
+    //? Match the normal server/ORM bootstrap: configured remote resolution is
+    //? fail-fast. A raw DATABASE_URL_V<n> must never leak into Prisma.
+    source: "remote"
+  });
+};
+
 // src/testDataMarker.ts
 import { randomUUID } from "crypto";
 var TEST_DATA_PREFIX = "lstest_";
@@ -940,91 +1183,25 @@ import fs2 from "fs";
 import path2 from "path";
 import { pathToFileURL } from "url";
 import {
-  buildRoutedGetUrl,
+  buildRoutedGetUrl as buildRoutedGetUrl2,
   getCsrfConfig,
   getPrismaClient,
   getProjectConfig as getProjectConfig3,
   getSrcDir,
-  tryCatch as tryCatch5,
+  tryCatch as tryCatch7,
   tryCatchSync
 } from "@luckystack/core";
 
 // src/streamWatcher.ts
-import { io as createSocketIoClient } from "socket.io-client";
-import {
-  buildJoinRoomResponseEventName,
-  socketEventNames,
-  tryCatch as tryCatch4,
-  getProjectConfig as getProjectConfig2
-} from "@luckystack/core";
+import { socketEventNames as socketEventNames2, tryCatch as tryCatch6 } from "@luckystack/core";
 var DEFAULT_TIMEOUT_MS = 5e3;
-var JOIN_RESPONSE_TIMEOUT_MS = 3e3;
-var CONNECT_TIMEOUT_MS = 3e3;
-var isJoinRoomResponse = (value) => typeof value === "object" && value !== null;
+var LABEL2 = "watchStream";
 var isStreamChunkFrame = (value) => typeof value === "object" && value !== null;
-var responseIndexCounter = 0;
-var nextResponseIndex = () => {
-  responseIndexCounter += 1;
-  return responseIndexCounter;
-};
-var waitForConnect = (socket) => {
-  return new Promise((resolve, reject) => {
-    if (socket.connected) {
-      resolve();
-      return;
-    }
-    const timer = setTimeout(() => {
-      cleanup();
-      reject(new Error(`watchStream: socket failed to connect within ${CONNECT_TIMEOUT_MS}ms`));
-    }, CONNECT_TIMEOUT_MS);
-    const onConnect = () => {
-      cleanup();
-      resolve();
-    };
-    const onConnectError = (err) => {
-      cleanup();
-      reject(new Error(`watchStream: connect_error \u2014 ${err.message}`));
-    };
-    const cleanup = () => {
-      clearTimeout(timer);
-      socket.off("connect", onConnect);
-      socket.off("connect_error", onConnectError);
-    };
-    socket.on("connect", onConnect);
-    socket.on("connect_error", onConnectError);
-  });
-};
-var waitForJoinAck = (socket, responseIndex) => {
-  const eventName = buildJoinRoomResponseEventName(responseIndex);
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      socket.off(eventName, onAck);
-      reject(new Error(`watchStream: joinRoom ack timeout after ${JOIN_RESPONSE_TIMEOUT_MS}ms`));
-    }, JOIN_RESPONSE_TIMEOUT_MS);
-    const onAck = (payload) => {
-      clearTimeout(timer);
-      socket.off(eventName, onAck);
-      if (isJoinRoomResponse(payload) && payload.status === "error") {
-        reject(new Error(`watchStream: joinRoom rejected \u2014 ${payload.errorCode ?? "unknown"}`));
-        return;
-      }
-      resolve();
-    };
-    socket.on(eventName, onAck);
-  });
-};
 var openStreamWatcher = async (input) => {
   const defaultTimeoutMs = input.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
   const chunks = [];
   const waiters = [];
-  const sessionCookieName = getProjectConfig2().http.sessionCookieName;
-  const socket = createSocketIoClient(input.baseUrl, {
-    transports: ["websocket"],
-    forceNew: true,
-    reconnection: false,
-    auth: input.token ? { token: input.token } : void 0,
-    extraHeaders: input.token ? { Cookie: `${sessionCookieName}=${input.token}` } : void 0
-  });
+  const socket = await connectTestSocket({ baseUrl: input.baseUrl, token: input.token, label: LABEL2 });
   const handleChunk = (raw) => {
     if (!isStreamChunkFrame(raw)) return;
     if (raw.status !== "stream") return;
@@ -1040,21 +1217,10 @@ var openStreamWatcher = async (input) => {
       }
     }
   };
-  socket.on(socketEventNames.sync, handleChunk);
-  const [connectError] = await tryCatch4(() => waitForConnect(socket));
-  if (connectError) {
-    socket.off(socketEventNames.sync, handleChunk);
-    socket.disconnect();
-    throw connectError;
-  }
-  const responseIndex = nextResponseIndex();
-  socket.emit(socketEventNames.joinRoom, {
-    group: input.roomCode,
-    responseIndex
-  });
-  const [joinError] = await tryCatch4(() => waitForJoinAck(socket, responseIndex));
+  socket.on(socketEventNames2.sync, handleChunk);
+  const [joinError] = await tryCatch6(() => joinTestRoom(socket, input.roomCode, { label: LABEL2 }));
   if (joinError) {
-    socket.off(socketEventNames.sync, handleChunk);
+    socket.off(socketEventNames2.sync, handleChunk);
     socket.disconnect();
     throw joinError;
   }
@@ -1062,7 +1228,7 @@ var openStreamWatcher = async (input) => {
   const close = () => {
     if (closed) return Promise.resolve();
     closed = true;
-    socket.off(socketEventNames.sync, handleChunk);
+    socket.off(socketEventNames2.sync, handleChunk);
     for (const waiter of waiters) waiter.resolve();
     waiters.length = 0;
     socket.disconnect();
@@ -1166,7 +1332,7 @@ var buildExpect = () => ({
     if (!value) throw new AssertionError(message ?? `expected truthy value, got ${JSON.stringify(value)}`);
   },
   throws: async (fn, message) => {
-    const [err] = await tryCatch5(fn);
+    const [err] = await tryCatch7(fn);
     if (!err) throw new AssertionError(message ?? "expected fn to throw, but it did not");
     return err;
   },
@@ -1218,7 +1384,7 @@ var buildSessionHelpers = (state) => {
   };
 };
 var parseResponse = async (response, state) => {
-  const [textError, text] = await tryCatch5(() => response.text());
+  const [textError, text] = await tryCatch7(() => response.text());
   if (textError || text === null) {
     state.lastResponse = null;
     throw new Error(`failed to read response body (HTTP ${response.status}): ${textError?.message ?? "unknown"}`);
@@ -1234,7 +1400,7 @@ var parseResponse = async (response, state) => {
 };
 var buildCallApi = (baseUrl, routePath, state, cookieName, method) => {
   return async (input) => {
-    const path3 = `${baseUrl.replace(/\/$/, "")}/api/${routePath}`;
+    const path4 = `${baseUrl.replace(/\/$/, "")}/api/${routePath}`;
     const headers = { "Content-Type": "application/json", Origin: new URL(baseUrl).origin };
     if (state.token) headers.Cookie = `${cookieName}=${state.token}`;
     if (state.csrfToken) headers[getCsrfConfig().headerName] = state.csrfToken;
@@ -1244,9 +1410,9 @@ var buildCallApi = (baseUrl, routePath, state, cookieName, method) => {
     }, DEFAULT_CALL_TIMEOUT_MS);
     const init = { method, headers, signal: controller.signal };
     const bodyless = method === "GET" || method === "HEAD";
-    const url = bodyless ? buildRoutedGetUrl(path3, input ?? {}) : path3;
+    const url = bodyless ? buildRoutedGetUrl2(path4, input ?? {}) : path4;
     if (!bodyless) init.body = JSON.stringify(input ?? {});
-    const [fetchError, response] = await tryCatch5(() => fetch(url, init));
+    const [fetchError, response] = await tryCatch7(() => fetch(url, init));
     clearTimeout(timeoutHandle);
     if (fetchError || !response) {
       state.lastResponse = null;
@@ -1255,18 +1421,57 @@ var buildCallApi = (baseUrl, routePath, state, cookieName, method) => {
     return await parseResponse(response, state);
   };
 };
-var buildCallSync = (baseUrl, routePath, state, cookieName) => {
+var createCaseSyncSocket = (baseUrl, cookieName) => {
+  let current = null;
+  const close = () => {
+    current?.socket.disconnect();
+    current = null;
+  };
+  return {
+    get: async (token) => {
+      if (current?.token === token && current.socket.connected) return current;
+      close();
+      const socket = await connectTestSocket({ baseUrl, token, label: "callSync", sessionCookieName: cookieName });
+      current = { socket, token, joinedRooms: /* @__PURE__ */ new Set() };
+      return current;
+    },
+    close
+  };
+};
+var resolveSyncTransport = (opts) => opts?.transport ?? (getProjectConfig3().transport.invocation === "routed-http" ? "http" : "socket");
+var buildCallSync = (baseUrl, routePath, state, cookieName, syncSocket) => {
   return async (input, opts) => {
+    if (resolveSyncTransport(opts) === "socket") {
+      const { socket, joinedRooms } = await syncSocket.get(state.token);
+      const { receiver, joinRoom = true } = opts ?? {};
+      if (receiver && receiver !== "all" && joinRoom && !joinedRooms.has(receiver)) {
+        const [joinError] = await tryCatch7(() => joinTestRoom(socket, receiver, { label: "callSync" }));
+        if (!joinError) joinedRooms.add(receiver);
+      }
+      const outcome = await emitSyncOverSocket(socket, {
+        routePath,
+        data: input,
+        receiver,
+        ignoreSelf: opts?.ignoreSelf,
+        timeoutMs: DEFAULT_CALL_TIMEOUT_MS
+      });
+      if (outcome.kind === "timeout") {
+        state.lastResponse = null;
+        throw new Error(`callSync ${routePath} failed: no socket response within ${DEFAULT_CALL_TIMEOUT_MS}ms`);
+      }
+      state.lastResponse = outcome.payload;
+      return outcome.payload;
+    }
     const url = `${baseUrl.replace(/\/$/, "")}/sync/${routePath}`;
     const headers = { "Content-Type": "application/json", Origin: new URL(baseUrl).origin };
     if (state.token) headers.Cookie = `${cookieName}=${state.token}`;
     if (state.csrfToken) headers[getCsrfConfig().headerName] = state.csrfToken;
-    const body = { data: input ?? {}, receiver: opts?.receiver };
+    const body = { data: input ?? {}, receiver: opts?.receiver, ignoreSelf: opts?.ignoreSelf };
     const controller = new AbortController();
     const timeoutHandle = setTimeout(() => {
       controller.abort();
     }, DEFAULT_CALL_TIMEOUT_MS);
-    const [fetchError, response] = await tryCatch5(() => fetch(url, {
+    const [fetchError, response] = await tryCatch7(() => fetch(url, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -1297,18 +1502,20 @@ var buildContext = (discovery, input) => {
     watchers.push(watcher);
     return watcher;
   };
+  const syncSocket = createCaseSyncSocket(input.baseUrl, cookieName);
   const closeAllWatchers = async () => {
+    syncSocket.close();
     while (watchers.length > 0) {
       const watcher = watchers.pop();
       if (!watcher) continue;
-      const [closeError] = await tryCatch5(() => watcher.close());
+      const [closeError] = await tryCatch7(() => watcher.close());
       if (closeError) {
       }
     }
   };
   const ctx = {
     callApi: buildCallApi(input.baseUrl, routePath, state, cookieName, apiMethod),
-    callSync: buildCallSync(input.baseUrl, routePath, state, cookieName),
+    callSync: buildCallSync(input.baseUrl, routePath, state, cookieName, syncSocket),
     watchStream,
     session: buildSessionHelpers(state),
     //? Lazy: only resolves when a case actually touches `ctx.prisma`, so an
@@ -1343,7 +1550,7 @@ var runCustomTestsAfterEnvironmentPrepared = async (input) => {
       input.onResult?.(r);
       continue;
     }
-    const [importError, mod] = await tryCatch5(
+    const [importError, mod] = await tryCatch7(
       () => import(pathToFileURL(resolvedPath).href)
     );
     if (importError || !mod) {
@@ -1368,11 +1575,11 @@ var runCustomTestsAfterEnvironmentPrepared = async (input) => {
       const expectedToFail = typeof c.expectedToFail === "string" ? c.expectedToFail : void 0;
       const built = buildContext(discovery, input);
       const started = Date.now();
-      const [runError] = await tryCatch5(async () => c.run(built.ctx));
-      await tryCatch5(() => built.closeAllWatchers());
+      const [runError] = await tryCatch7(async () => c.run(built.ctx));
+      await tryCatch7(() => built.closeAllWatchers());
       const residualToken = built.state.token;
       if (residualToken) {
-        await tryCatch5(async () => {
+        await tryCatch7(async () => {
           const { deleteSession } = await import("@luckystack/login");
           await deleteSession(residualToken);
         });
@@ -1413,11 +1620,10 @@ var runCustomTests = async (input) => {
 };
 
 // src/runAllTests.ts
-import { clearAllRateLimits, getCsrfConfig as getCsrfConfig2, getProjectConfig as getProjectConfig4 } from "@luckystack/core";
-var inputForEndpoint = (apiInputSchemas, stringPrefix) => (endpoint) => {
-  const schema = apiInputSchemas[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return schema ? sampleSchemaInput(schema, { stringPrefix }) : {};
-};
+import crypto2 from "crypto";
+import fs3 from "fs";
+import path3 from "path";
+import { clearAllRateLimits, getCsrfConfig as getCsrfConfig2, getProjectConfig as getProjectConfig4, tryCatch as tryCatch8, tryCatchSync as tryCatchSync2 } from "@luckystack/core";
 var resolveResetBookendToken = (input) => {
   if (input.resetBookends === false) return null;
   const token = input.resetToken ?? process.env.TEST_RESET_TOKEN;
@@ -1429,15 +1635,6 @@ var resolveResetBookendToken = (input) => {
   }
   return token;
 };
-var matchesFilter = (endpoint, filter) => {
-  if (!filter) return true;
-  return `${endpoint.page}/${endpoint.name}/${endpoint.version}`.includes(filter);
-};
-var filterResults = (results, filter) => filter ? results.filter((r) => matchesFilter(r.endpoint, filter)) : results;
-var cloneSummary = (summary, filter) => {
-  if (!filter) return summary;
-  return calculateSummary(filterResults(summary.results, filter));
-};
 var buildAuthHeaders = async (input) => {
   const headers = {};
   if (!input.authToken) return headers;
@@ -1458,70 +1655,92 @@ var buildAuthHeaders = async (input) => {
   }
   return headers;
 };
+var prepareSyncSweep = async (input) => {
+  const receiver = `lstest-room-${crypto2.randomUUID()}`;
+  const sessionCookieName = input.sessionCookieName ?? getProjectConfig4().http.sessionCookieName;
+  const mode = input.syncTransport ?? (getProjectConfig4().transport.invocation === "routed-http" ? "http" : "socket");
+  const http = createHttpProbeTransport({ syncReceiver: receiver });
+  let memberSocket = null;
+  if (input.authToken) {
+    const authToken = input.authToken;
+    const [connectError, socket] = await tryCatch8(() => connectTestSocket({
+      baseUrl: input.baseUrl,
+      token: authToken,
+      label: "sync sweep",
+      sessionCookieName
+    }));
+    if (connectError || !socket) {
+      console.warn(`[test-runner] runAllTests: could not open a socket for the sync sweep \u2014 ${connectError?.message ?? "no socket"}; sync probes will be rejected as non-members.`);
+    } else {
+      memberSocket = socket;
+      const [joinError] = await tryCatch8(() => joinTestRoom(socket, receiver, { label: "sync sweep" }));
+      if (joinError) console.warn(`[test-runner] runAllTests: ${joinError.message}; sync probes will be rejected as non-members.`);
+    }
+  }
+  const sweep = mode === "socket" ? createSocketProbeTransport({ baseUrl: input.baseUrl, receiver, sessionCookieName }) : http;
+  return {
+    sweep,
+    csrf: http,
+    close: async () => {
+      await sweep.close?.();
+      if (memberSocket) await releaseTestSocket(memberSocket);
+    }
+  };
+};
 var runSweepLayers = async (input, summary, headers, inputFor) => {
+  const resetToken = input.resetToken ?? process.env.TEST_RESET_TOKEN;
   const resetBookendToken = resolveResetBookendToken(input);
   if (resetBookendToken) {
-    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken });
+    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken, only: ["rateLimits"] });
   }
-  const contract = await runContractTests({
-    apiMethodMap: input.apiMethodMap,
-    baseUrl: input.baseUrl,
-    skip: input.skip,
-    headers,
-    inputFor
-  });
-  summary.contract = cloneSummary(contract, input.filter);
-  const auth = await runAuthEnforcementTests({
+  const hasSyncRoutes = Object.keys(input.syncMetaMap ?? {}).length > 0;
+  const sync = hasSyncRoutes ? await prepareSyncSweep(input) : null;
+  const shared = {
     apiMethodMap: input.apiMethodMap,
-    apiMetaMap: input.apiMetaMap,
+    syncMetaMap: input.syncMetaMap,
     baseUrl: input.baseUrl,
     skip: input.skip,
-    inputFor
+    filter: input.filter,
+    syncTransport: sync?.sweep
+  };
+  const [layerError] = await tryCatch8(async () => {
+    summary.contract = await runContractTests({ ...shared, headers, inputFor });
+    summary.auth = await runAuthEnforcementTests({ ...shared, apiMetaMap: input.apiMetaMap, inputFor });
+    if (!input.noRateLimit) {
+      summary.rateLimit = await runRateLimitTests({
+        ...shared,
+        apiMetaMap: input.apiMetaMap,
+        headers,
+        inputFor,
+        //? Reset the shared per-IP rate-limit bucket between endpoints so a
+        //? neighbour saturating the window doesn't cause false pass/fail on the
+        //? next endpoint. Requires the server to expose /_test/reset (NODE_ENV in
+        //? { 'development', 'test' } AND TEST_RESET_TOKEN set + matching header).
+        resetBetweenEndpoints: true,
+        //? Thread the reset token (explicit input, else the TEST_RESET_TOKEN env the
+        //? server validates against) — without it `/_test/reset` returns 403 and the
+        //? between-endpoint reset silently never happens.
+        resetToken
+      });
+    }
+    if (!input.noCsrf && headers.Cookie) {
+      summary.csrf = await runCsrfEnforcementTests({
+        ...shared,
+        apiMetaMap: input.apiMetaMap,
+        authCookie: headers.Cookie,
+        inputFor,
+        syncTransport: sync?.csrf
+      });
+    }
+    if (!input.noFuzz) {
+      summary.fuzz = await runFuzzTests({ ...shared, headers });
+    }
   });
-  summary.auth = cloneSummary(auth, input.filter);
-  if (!input.noRateLimit) {
-    const rateLimit = await runRateLimitTests({
-      apiMethodMap: input.apiMethodMap,
-      apiMetaMap: input.apiMetaMap,
-      baseUrl: input.baseUrl,
-      skip: input.skip,
-      headers,
-      inputFor,
-      //? Reset the shared per-IP rate-limit bucket between endpoints so a
-      //? neighbour saturating the window doesn't cause false pass/fail on the
-      //? next endpoint. Requires the server to expose /_test/reset (NODE_ENV in
-      //? { 'development', 'test' } AND TEST_RESET_TOKEN set + matching header).
-      resetBetweenEndpoints: true,
-      //? Thread the reset token (explicit input, else the TEST_RESET_TOKEN env the
-      //? server validates against) — without it `/_test/reset` returns 403 and the
-      //? between-endpoint reset silently never happens.
-      resetToken: input.resetToken ?? process.env.TEST_RESET_TOKEN
-    });
-    summary.rateLimit = cloneSummary(rateLimit, input.filter);
-  }
-  if (!input.noCsrf && headers.Cookie) {
-    const csrf = await runCsrfEnforcementTests({
-      apiMethodMap: input.apiMethodMap,
-      apiMetaMap: input.apiMetaMap,
-      baseUrl: input.baseUrl,
-      authCookie: headers.Cookie,
-      skip: input.skip,
-      inputFor
-    });
-    summary.csrf = cloneSummary(csrf, input.filter);
-  }
-  if (!input.noFuzz) {
-    const fuzz = await runFuzzTests({
-      apiMethodMap: input.apiMethodMap,
-      baseUrl: input.baseUrl,
-      skip: input.skip,
-      headers
-    });
-    summary.fuzz = cloneSummary(fuzz, input.filter);
-  }
+  await sync?.close();
   if (resetBookendToken) {
-    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken });
+    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken, only: ["rateLimits"] });
   }
+  if (layerError) throw layerError;
 };
 var runCustomLayer = async (input, summary) => {
   try {
@@ -1575,9 +1794,18 @@ var runAllTests = async (input) => {
         "[test-runner] runAllTests: apiMetaMap is empty but apiMethodMap has routes. The auth-enforcement and rate-limit layers will skip every route. Pass the generated apiMetaMap to enable those checks."
       );
     }
+    if (!input.syncMetaMap) {
+      console.warn(
+        "[test-runner] runAllTests: no syncMetaMap passed \u2014 sync routes are NOT swept. Pass the generated syncMetaMap (+ syncInputSchemas) to cover them."
+      );
+    }
   }
   const headers = await buildAuthHeaders(input);
-  const inputFor = inputForEndpoint(input.apiInputSchemas, createTestDataMarker());
+  const inputFor = createSampleInputFor({
+    apiInputSchemas: input.apiInputSchemas,
+    syncInputSchemas: input.syncInputSchemas,
+    stringPrefix: createTestDataMarker()
+  });
   if (!input.noSweep) {
     await runSweepLayers(input, summary, headers, inputFor);
   }
@@ -1585,8 +1813,21 @@ var runAllTests = async (input) => {
     await runCustomLayer(input, summary);
   }
   computeTotals(summary);
+  writeSummaryFile(summary, input.outputFile);
   return summary;
 };
+var writeSummaryFile = (summary, outputFile) => {
+  if (outputFile === false) return;
+  const target = path3.resolve(outputFile ?? process.env.TEST_OUTPUT_FILE ?? "test-results.json");
+  const [writeError] = tryCatchSync2(() => {
+    fs3.writeFileSync(target, JSON.stringify(summary, null, 2), "utf8");
+  });
+  if (writeError) {
+    console.warn(`[test-runner] runAllTests: could not write ${target} \u2014 ${writeError.message}`);
+    return;
+  }
+  console.log(`[test-runner] full results written to ${target}`);
+};
 var useColor = (() => {
   if (process.env.NO_COLOR) return false;
   if (process.env.FORCE_COLOR) return true;
@@ -1701,13 +1942,13 @@ var resetTestExtensionsForTests = () => {
 };
 
 // src/runRegisteredLayers.ts
-import { tryCatch as tryCatch6, tryCatchSync as tryCatchSync2 } from "@luckystack/core";
+import { tryCatch as tryCatch9, tryCatchSync as tryCatchSync3 } from "@luckystack/core";
 var isLoopbackHost = (host) => host === "localhost" || host === "::1" || host === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(host);
 var postWebhook = async (summary) => {
   const reporter2 = getTestReporter();
   const webhookUrl = reporter2?.webhookUrl;
   if (!reporter2 || !webhookUrl) return;
-  const [, parsedUrl] = tryCatchSync2(() => new URL(webhookUrl));
+  const [, parsedUrl] = tryCatchSync3(() => new URL(webhookUrl));
   if (parsedUrl?.protocol === "http:" && !isLoopbackHost(parsedUrl.hostname)) {
     console.warn(
       `[test-runner] reporter.webhookUrl is plaintext http to a non-loopback host (${parsedUrl.hostname}); the summary (endpoint paths, error codes, metadata) and any bearer token are sent unencrypted.`
@@ -1719,7 +1960,7 @@ var postWebhook = async (summary) => {
   const timeoutHandle = setTimeout(() => {
     controller.abort();
   }, 1e4);
-  await tryCatch6(() => fetch(webhookUrl, {
+  await tryCatch9(() => fetch(webhookUrl, {
     method: "POST",
     headers,
     body: JSON.stringify(summary),
@@ -1729,15 +1970,25 @@ var postWebhook = async (summary) => {
 };
 var runRegisteredLayers = async (input) => {
   const layers2 = listTestLayers();
-  const endpoints = walkEndpoints(input.apiMethodMap);
+  const endpoints = selectEndpoints(input);
   const reporter2 = getTestReporter();
   const skip = input.skip ?? [];
   const results = [];
+  const inputFor = input.inputFor ?? createSampleInputFor({
+    apiInputSchemas: input.apiInputSchemas,
+    syncInputSchemas: input.syncInputSchemas,
+    stringPrefix: createTestDataMarker()
+  });
   for (const layer of layers2) {
     for (const endpoint of endpoints) {
       if (shouldSkip(endpoint, skip)) continue;
       const started = Date.now();
-      const [runError, layerResult] = await tryCatch6(async () => layer.run({ endpoint: endpoint.fullPath, method: endpoint.method, authToken: input.authToken }));
+      const [runError, layerResult] = await tryCatch9(async () => layer.run({
+        endpoint: endpoint.fullPath,
+        method: endpoint.kind === "sync" ? void 0 : endpoint.method,
+        authToken: input.authToken,
+        sampleInput: inputFor(endpoint)
+      }));
       const durationMs = Date.now() - started;
       const result = runError || !layerResult ? {
         layer: layer.name,
@@ -1754,7 +2005,7 @@ var runRegisteredLayers = async (input) => {
         metadata: layerResult.metadata
       };
       results.push(result);
-      await tryCatch6(async () => reporter2?.onResult?.(result));
+      await tryCatch9(async () => reporter2?.onResult?.(result));
     }
   }
   const summary = {
@@ -1764,14 +2015,18 @@ var runRegisteredLayers = async (input) => {
     failed: results.filter((r) => !r.passed).length,
     results
   };
-  await tryCatch6(async () => reporter2?.onSummary?.(summary));
+  await tryCatch9(async () => reporter2?.onSummary?.(summary));
   await postWebhook(summary);
   return summary;
 };
 export {
   LAYER_KEYS,
   TEST_DATA_PREFIX,
+  createHttpProbeTransport,
+  createSampleInputFor,
+  createSocketProbeTransport,
   createTestDataMarker,
+  defaultProbeTransport,
   discoverCustomTestFiles,
   getTestFixture,
   getTestReporter,
@@ -1801,6 +2056,7 @@ export {
   runRateLimitTests,
   runRegisteredLayers,
   sampleSchemaInput,
+  sendProbe,
   walkEndpoints,
   walkSyncEndpoints
 };