@luckystack/test-runner 0.10.2 → 0.11.0

package/dist/index.d.ts

@@ -1,745 +1,49 @@
-import { TestResetTarget, getPrismaClient } from '@luckystack/core';
-import { ZodType, z } from 'zod';
-
-type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
-type ApiMethodMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-type SyncMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-interface ApiMetaEntry {
-    method: string;
-    auth: {
-        login: boolean;
-        additional?: Record<string, unknown>[];
-        hasAdditional?: boolean;
-    };
-    rateLimit?: number | false;
-}
-type ApiMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, ApiMetaEntry>>>>>>;
-interface SyncMetaEntry {
-    auth: ApiMetaEntry['auth'];
-    rateLimit?: number | false;
-}
-type SyncMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, SyncMetaEntry>>>>>>;
-interface EndpointDescriptor {
-    page: string;
-    name: string;
-    version: string;
-    method: HttpMethod;
-    /** `api/<page>/<name>/<version>` or `sync/<page>/<name>/<version>` */
-    fullPath: string;
-    /** Route kind. Absent means `'api'` — only `walkSyncEndpoints` sets `'sync'`. */
-    kind?: 'api' | 'sync';
-}
-interface ContractCheckResult {
-    endpoint: EndpointDescriptor;
-    status: 'pass' | 'fail' | 'skipped';
-    httpStatus?: number;
-    responseStatus?: 'success' | 'error' | 'unknown';
-    errorCode?: string;
-    reason?: string;
-    durationMs: number;
-}
-interface RunContractSummary {
-    total: number;
-    passed: number;
-    failed: number;
-    skipped: number;
-    results: ContractCheckResult[];
-}
-
-type ApiMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-declare const walkEndpoints: (apiMethodMap: ApiMethodMap) => EndpointDescriptor[];
-type SyncRouteMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, unknown>>>>>>;
-declare const walkSyncEndpoints: (syncMap: SyncMethodMap | SyncMetaMap | SyncRouteMap) => EndpointDescriptor[];
-
-interface ProbeRequestInput {
-    url: string;
-    method: HttpMethod;
-    baseUrl: string;
-    body?: unknown;
-    headers?: Record<string, string>;
-    requestTimeoutMs: number;
-}
-interface ProbeResponse {
-    /** HTTP status. Absent when the probe travelled over Socket.io. */
-    httpStatus?: number;
-    parsed: {
-        status?: string;
-        errorCode?: string;
-    } | null;
-}
-/**
- * Send a single timed fetch probe and parse the JSON envelope. Returns
- * `null` when the request itself fails (network error or abort).
- */
-declare const sendProbe: (input: ProbeRequestInput) => Promise<ProbeResponse | null>;
-interface ProbeTransportRequest {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    /** The route payload — the API `data`, or the sync `data` (the transport adds the sync envelope). */
-    body: unknown;
-    /** HTTP headers (session Cookie, CSRF). A socket transport reads only the Cookie. */
-    headers?: Record<string, string>;
-    requestTimeoutMs: number;
-}
-interface ProbeTransport {
-    readonly name: 'http' | 'socket';
-    /** Resolve with the parsed reply, or `null` when no reply arrived (network error / timeout). */
-    send: (request: ProbeTransportRequest) => Promise<ProbeResponse | null>;
-    /** Release held connections. Optional — the HTTP transport holds none. */
-    close?: () => Promise<void>;
-}
-interface HttpProbeTransportOptions {
-    /**
-     * Room sent as `receiver` on sync probes. Without one the server answers
-     * `sync.missingReceiver`, which proves the envelope but not the route.
-     */
-    syncReceiver?: string;
-}
-declare const createHttpProbeTransport: (options?: HttpProbeTransportOptions) => ProbeTransport;
-/** Transport the checks use when the caller supplies none. */
-declare const defaultProbeTransport: ProbeTransport;
-
-interface ContractCheckInput {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    /**
-     * Optional input factory. Defaults to `{}`. When an endpoint requires a
-     * specific shape to not crash, callers can override per-endpoint here.
-     */
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    /**
-     * Optional headers (auth tokens, cookies). Applied to every request.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Per-call request timeout in ms. Defaults to 5000. Bump for slow endpoints
-     * (AI calls, large reports) where the framework default would false-fail
-     * the contract check.
-     */
-    requestTimeoutMs?: number;
-    /** How the probe reaches the server. Defaults to HTTP. */
-    transport?: ProbeTransport;
-}
-declare const runContractCheck: (input: ContractCheckInput) => Promise<ContractCheckResult>;
-
-interface RunContractTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
-    syncMetaMap?: SyncMetaMap;
-    baseUrl: string;
-    /**
-     * Endpoints to skip. Matched against `<page>/<name>` (version-agnostic) and
-     * `<page>/<name>/<version>` (version-specific). Useful for endpoints that
-     * are known to need real input (e.g. a file upload).
-     */
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
-    filter?: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    headers?: Record<string, string>;
-    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
-    syncTransport?: ProbeTransport;
-    onResult?: (result: ContractCheckResult) => void;
-}
-declare const runContractTests: (input: RunContractTestsInput) => Promise<RunContractSummary>;
-
-interface AuthEnforcementCheckInput {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    /** Per-call request timeout in ms. Defaults to 5000. */
-    requestTimeoutMs?: number;
-    /** How the probe reaches the server. Defaults to HTTP. */
-    transport?: ProbeTransport;
-}
-declare const runAuthEnforcementCheck: (input: AuthEnforcementCheckInput) => Promise<ContractCheckResult>;
-
-interface RunAuthEnforcementTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    apiMetaMap: ApiMetaMap;
-    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
-    syncMetaMap?: SyncMetaMap;
-    baseUrl: string;
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
-    filter?: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
-    syncTransport?: ProbeTransport;
-    onResult?: (result: ContractCheckResult) => void;
-}
-declare const runAuthEnforcementTests: (input: RunAuthEnforcementTestsInput) => Promise<RunContractSummary>;
-
-interface RateLimitCheckInput {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    rateLimit: number;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    headers?: Record<string, string>;
-    /** Per-call request timeout in ms. Defaults to 10000. */
-    requestTimeoutMs?: number;
-    /** How the probes reach the server. Defaults to HTTP. */
-    transport?: ProbeTransport;
-}
-declare const runRateLimitCheck: (input: RateLimitCheckInput) => Promise<ContractCheckResult>;
-
-interface RunRateLimitTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    apiMetaMap: ApiMetaMap;
-    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
-    syncMetaMap?: SyncMetaMap;
-    baseUrl: string;
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
-    filter?: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    headers?: Record<string, string>;
-    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
-    syncTransport?: ProbeTransport;
-    /**
-     * Max rateLimit value to test. Endpoints with a higher limit are skipped
-     * to avoid firing thousands of requests in CI.
-     */
-    maxRateLimitToTest?: number;
-    /**
-     * When true, hit `/_test/reset?only=rateLimits` before each endpoint so
-     * limiter state is clean. Only the limiter buckets are cleared — sessions
-     * survive, so an authenticated sweep keeps its session. Requires the server
-     * to allow the endpoint: `NODE_ENV` in { 'development', 'test' } AND
-     * `TEST_RESET_TOKEN` set on the server with a matching `resetToken` here (an
-     * unset token is 403, never open). Without resetting, the shared IP bucket
-     * leaks state between endpoints.
-     */
-    resetBetweenEndpoints?: boolean;
-    /**
-     * Token forwarded as `X-Test-Reset-Token` when resetting. Only relevant in
-     * staging/preview deploys that enable the endpoint behind a token.
-     */
-    resetToken?: string;
-    onResult?: (result: ContractCheckResult) => void;
-}
-declare const runRateLimitTests: (input: RunRateLimitTestsInput) => Promise<RunContractSummary>;
-
-interface CsrfEnforcementCheckInput {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    /**
-     * A valid session Cookie header (`<name>=<token>`). The probe deliberately
-     * carries it so the request passes the auth guard and reaches the CSRF check.
-     */
-    authCookie: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    /** Per-call request timeout in ms. Defaults to 5000. */
-    requestTimeoutMs?: number;
-    /** Error code expected on CSRF rejection. Defaults to `auth.csrfMismatch`. */
-    expectedErrorCode?: string;
-    /** HTTP status expected on CSRF rejection. Defaults to 403; pass `false` to skip. */
-    expectedHttpStatus?: number | false;
-    /**
-     * HTTP transport the probe uses (e.g. one carrying the sync `receiver`).
-     * CSRF is an HTTP-only guard, so a non-HTTP transport makes the check skip.
-     * Defaults to plain HTTP.
-     */
-    transport?: ProbeTransport;
-}
-declare const runCsrfEnforcementCheck: (input: CsrfEnforcementCheckInput) => Promise<ContractCheckResult>;
-
-interface RunCsrfEnforcementTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    apiMetaMap: ApiMetaMap;
-    /** Generated `syncMetaMap`. When given, sync routes' `/sync/*` HTTP endpoints are probed too. */
-    syncMetaMap?: SyncMetaMap;
-    baseUrl: string;
-    /** Valid session Cookie header (`<name>=<token>`) the probes carry so they reach the CSRF check. */
-    authCookie: string;
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
-    filter?: string;
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-    /**
-     * HTTP transport for sync routes (one carrying the sync `receiver`). CSRF is
-     * an HTTP-only guard, so this must be an HTTP transport even when the project
-     * syncs over Socket.io — the `/sync/*` HTTP route is reachable either way.
-     */
-    syncTransport?: ProbeTransport;
-    /** Per-call request timeout in ms forwarded to each check. */
-    requestTimeoutMs?: number;
-    /** Error code expected on CSRF rejection. Defaults to `auth.csrfMismatch`. */
-    expectedErrorCode?: string;
-    /** HTTP status expected on CSRF rejection. Defaults to 403; pass `false` to skip. */
-    expectedHttpStatus?: number | false;
-    onResult?: (result: ContractCheckResult) => void;
-}
-declare const runCsrfEnforcementTests: (input: RunCsrfEnforcementTestsInput) => Promise<RunContractSummary>;
-
-interface FuzzCheckInput {
-    endpoint: EndpointDescriptor;
-    baseUrl: string;
-    headers?: Record<string, string>;
-    /** Per-call request timeout in ms. Defaults to 5000. */
-    requestTimeoutMs?: number;
-    /** How the probes reach the server. Defaults to HTTP. */
-    transport?: ProbeTransport;
-}
-declare const runFuzzCheck: (input: FuzzCheckInput) => Promise<ContractCheckResult>;
-
-interface RunFuzzTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    /** Generated `syncMetaMap`. When given, sync routes are swept too. */
-    syncMetaMap?: SyncMetaMap;
-    baseUrl: string;
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`; other routes are not requested at all. */
-    filter?: string;
-    headers?: Record<string, string>;
-    /** Transport for sync routes (e.g. the socket transport). API routes always use HTTP. */
-    syncTransport?: ProbeTransport;
-    onResult?: (result: ContractCheckResult) => void;
-}
-declare const runFuzzTests: (input: RunFuzzTestsInput) => Promise<RunContractSummary>;
-
-interface ResetServerStateInput {
-    baseUrl: string;
-    token?: string;
-    requestTimeoutMs?: number;
-    /**
-     * Clear only these targets (`?only=`). Omit for the server's default reset,
-     * which ALSO deletes every Redis session — including an authenticated sweep's
-     * own. The runner itself always passes `['rateLimits']`.
-     */
-    only?: TestResetTarget[];
-}
-declare const resetServerState: ({ baseUrl, token, requestTimeoutMs, only }: ResetServerStateInput) => Promise<boolean>;
-
-interface SocketProbeTransportOptions {
-    baseUrl: string;
-    /** Room every sync probe targets; authenticated sockets join it first. */
-    receiver: string;
-    /** Session cookie name, used to read the token out of a probe's Cookie header. */
-    sessionCookieName: string;
-}
-declare const createSocketProbeTransport: (options: SocketProbeTransportOptions) => ProbeTransport;
-
-type InputSchemaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, ZodType | undefined>>>>>>;
-interface CreateSampleInputForOptions {
-    apiInputSchemas?: InputSchemaMap;
-    syncInputSchemas?: InputSchemaMap;
-    /**
-     * Prefix for generated unconstrained strings — pass the run's
-     * `createTestDataMarker()` so rows the probes create are identifiable.
-     */
-    stringPrefix?: string;
-}
-declare const createSampleInputFor: (options: CreateSampleInputForOptions) => (endpoint: EndpointDescriptor) => unknown;
-
-interface ResolveTestBaseUrlOptions {
-    /** Project root containing node_modules/.luckystack/dev-server.json. */
-    cwd?: string;
-    /** Used when no explicit override or valid live advertisement exists. */
-    fallbackUrl?: string;
-}
-declare const resolveTestBaseUrl: (options?: ResolveTestBaseUrlOptions) => string;
-
-type MaybePromise<T> = T | Promise<T>;
-interface ResolveTestEnvironmentInput {
-    /**
-     * Loads the consumer's default-exported `config.ts` object after `.env` files
-     * are available. Keeping this as a callback avoids hardcoding a consumer path
-     * inside the package and keeps `@luckystack/secret-manager` optional.
-     */
-    loadProjectConfig?: () => MaybePromise<unknown>;
-}
-/**
- * Load the project's env files and resolve optional secret-manager pointers for
- * the TEST process. Call before importing integration-test modules that touch a
- * database, Redis, or another env-backed SDK.
- */
-declare const resolveTestEnvironment: (input?: ResolveTestEnvironmentInput) => Promise<void>;
-
-interface SampleSchemaOptions {
-    /**
-     * Marker prefix applied to generated UNCONSTRAINED string values so any rows
-     * a sweep creates are identifiable + collision-free (finding #98). Strings
-     * that carry a format (email/url/uuid/datetime/…) or a check (min/max/
-     * length/regex) are left as-is, since prefixing could break the route's own
-     * validation and defeat the contract layer's "valid input" guarantee.
-     */
-    stringPrefix?: string;
-}
-declare const sampleSchemaInput: (schema: z.ZodType, options?: SampleSchemaOptions) => unknown;
-
-declare const TEST_DATA_PREFIX = "lstest_";
-declare const createTestDataMarker: () => string;
-
-declare const logContractResult: (result: ContractCheckResult) => void;
-declare const logContractSummary: (summary: RunContractSummary) => void;
-
-interface StreamChunkFrame {
-    /** Per-request correlation id stamped by the server. */
-    cb?: string;
-    /** Full route name (`sync/<page>/<name>/<version>`). */
-    fullName?: string;
-    /** Always `'stream'` for chunk frames. */
-    status?: 'stream';
-    /** Payload fields spread on top of the envelope. */
-    [key: string]: unknown;
-}
-interface StreamWatcher<TChunk extends StreamChunkFrame = StreamChunkFrame> {
-    /** Chunks received so far. Array reference is stable; entries are pushed in arrival order. */
-    readonly chunks: TChunk[];
-    /** Wait until `predicate(chunks)` returns true, or until timeout (default 5000ms). */
-    stopAt(predicate: (chunks: TChunk[]) => boolean, timeoutMs?: number): Promise<void>;
-    /** Wait until N total chunks received, or until timeout. */
-    waitForCount(n: number, timeoutMs?: number): Promise<void>;
-    /** Close socket B. Tests SHOULD call this in cleanup; ctx auto-closes all watchers when the test ends. */
-    close(): Promise<void>;
-}
-interface OpenStreamWatcherInput {
-    /** Server URL (same as `ctx`'s `baseUrl`). */
-    baseUrl: string;
-    /** Room to join as a pure subscriber. */
-    roomCode: string;
-    /** Active session token (used for `joinRoom` auth). May be null for routes that don't require auth. */
-    token: string | null;
-    /**
-     * Resolved route name `sync/<page>/<name>/<version>` — chunk frames are
-     * filtered by their `fullName` property so a watcher only surfaces chunks
-     * for the route its test is bound to.
-     */
-    routeFullName: string;
-    /** Default 5000ms — overridable per `stopAt` / `waitForCount` call. */
-    defaultTimeoutMs?: number;
-}
-declare const openStreamWatcher: <TChunk extends StreamChunkFrame = StreamChunkFrame>(input: OpenStreamWatcherInput) => Promise<StreamWatcher<TChunk>>;
-
-interface CustomTestCase {
-    name: string;
-    run: (ctx: TestContext) => Promise<void>;
-    /**
-     * Mark this case as a KNOWN, accepted failure (e.g. a documented bug not
-     * yet fixed, or a scenario the current implementation cannot satisfy). The
-     * string is the reason shown in the report. A case marked `expectedToFail`
-     * that throws is reported as `xfail` — counted separately, NOT a red
-     * failure. If it unexpectedly PASSES it is reported as `xpass` so the stale
-     * marker can be removed. Leave undefined for normal cases.
-     */
-    expectedToFail?: string;
-}
-interface CustomTestResult {
-    routePath: string;
-    caseName: string;
-    status: 'pass' | 'fail' | 'xfail' | 'xpass';
-    durationMs: number;
-    reason?: string;
-    /** Documented reason when the case carried an `expectedToFail` marker. */
-    expectedToFail?: string;
-}
-interface RunCustomTestsSummary {
-    total: number;
-    passed: number;
-    failed: number;
-    /** Cases marked `expectedToFail` that failed as expected (known issues). */
-    xfailed: number;
-    /** Cases marked `expectedToFail` that unexpectedly passed (remove the marker). */
-    xpassed: number;
-    results: CustomTestResult[];
-}
-interface RunCustomTestsInput {
-    baseUrl: string;
-    /** Optional cookie name for the session token. Defaults to the project's configured cookie. */
-    sessionCookieName?: string;
-    /** Filter to a subset of routes — substring match against `<page>/<name>/<version>`. */
-    filter?: string;
-    /**
-     * Generated `apiMethodMap` so the harness sends each API route its declared
-     * HTTP method (e.g. logout is DELETE). Falls back to POST when absent.
-     */
-    apiMethodMap?: ApiMethodMap$1;
-    /**
-     * Lazy consumer config for direct Layer-5 runs. Required so the public path
-     * cannot silently skip a configured secret manager; `runAllTests` prepares
-     * the environment separately before using the internal Layer-5 entrypoint.
-     */
-    loadProjectConfig: NonNullable<ResolveTestEnvironmentInput['loadProjectConfig']>;
-    onResult?: (result: CustomTestResult) => void;
-}
-interface DiscoveredTestFile {
-    /** Absolute path to the test file. */
-    filePath: string;
-    /** `api` or `sync` — which transport this route uses. */
-    kind: 'api' | 'sync';
-    /** Route descriptor parsed from the filename + directory location. */
-    route: {
-        page: string;
-        name: string;
-        version: string;
-    };
-}
-declare const discoverCustomTestFiles: (srcDir?: string) => DiscoveredTestFile[];
-interface CallSyncOptions {
-    /** Room the sync targets (the server requires one). */
-    receiver?: string;
-    /** Skip the sender's own socket in the fan-out (socket transport). */
-    ignoreSelf?: boolean;
-    /** Force a transport. Defaults to the project's `transport.invocation`. */
-    transport?: 'socket' | 'http';
-    /** Socket transport: join `receiver` before sending. Default `true`. */
-    joinRoom?: boolean;
-}
-interface TestContext {
-    /**
-     * Invoke the route under test. Page / name / version are baked in.
-     *
-     * `input` travels exactly like the real client sends it: as the JSON body
-     * for POST / PUT / DELETE routes, and as the `__luckystack_data` query-string
-     * value for GET routes (a GET cannot carry a body). Either way the server
-     * validates it as the route's `data`, so a GET route with required fields
-     * receives them.
-     */
-    callApi: <TInput = unknown, TOutput = unknown>(input: TInput) => Promise<TOutput>;
-    /**
-     * Invoke the sync route under test over the SAME transport the project's
-     * real client uses (`transport.invocation`): Socket.io for `'socket'` (the
-     * default), the `/sync/*` HTTP route for `'routed-http'`. Override per call
-     * with `opts.transport`. Over the socket, the case's session socket first
-     * joins `opts.receiver` (like a real client joins its room before syncing);
-     * pass `joinRoom: false` to test a non-member.
-     */
-    callSync: <TInput = unknown, TOutput = unknown>(input: TInput, opts?: CallSyncOptions) => Promise<TOutput>;
-    /**
-     * Open a second socket connection that joins `roomCode` as a pure
-     * subscriber and exposes the incoming chunk stream for assertions.
-     *
-     * The route is auto-derived from the test file location, so a watcher
-     * only surfaces chunks for the route this test belongs to. Multiple
-     * watchers per test are allowed; all are auto-closed when the test
-     * case finishes (whether it passes or throws).
-     */
-    watchStream: <TChunk extends StreamChunkFrame = StreamChunkFrame>(roomCode: string) => Promise<StreamWatcher<TChunk>>;
-    session: {
-        login: (user?: {
-            email?: string;
-            id?: string;
-            name?: string;
-        }) => Promise<{
-            token: string;
-            userId: string;
-        }>;
-        logout: () => Promise<void>;
-        current: () => {
-            token: string | null;
-            userId: string | null;
-        };
-    };
-    prisma: ReturnType<typeof getPrismaClient>;
-    expect: TestExpect;
-}
-interface TestExpect {
-    eq: <T>(actual: T, expected: T, message?: string) => void;
-    ok: (value: unknown, message?: string) => void;
-    throws: (fn: () => Promise<unknown>, message?: string) => Promise<Error>;
-    matches: (value: string, pattern: RegExp, message?: string) => void;
-}
-declare const runCustomTests: (input: RunCustomTestsInput) => Promise<RunCustomTestsSummary>;
-
-interface RunAllTestsInput {
-    apiMethodMap: ApiMethodMap$1;
-    /**
-     * Generated `syncMetaMap` (from `apiTypes.generated.ts`). When given, the
-     * sweep layers exercise every sync route too; without it sync routes are
-     * not swept (a warning says so).
-     */
-    syncMetaMap?: SyncMetaMap;
-    /** Generated `syncInputSchemas` (from `apiInputSchemas.generated.ts`) — Zod-valid sync sample payloads. */
-    syncInputSchemas?: InputSchemaMap;
-    /**
-     * How sync routes are probed. Defaults to the project's own
-     * `transport.invocation`: `'socket'` → Socket.io (the pipeline real clients
-     * hit), `'routed-http'` → the `/sync/*` HTTP route. The CSRF layer always
-     * probes over HTTP — CSRF is an HTTP-only guard.
-     */
-    syncTransport?: 'socket' | 'http';
-    /**
-     * Write the full `RunAllTestsSummary` as JSON to this path (relative to the
-     * process cwd). Defaults to `TEST_OUTPUT_FILE`, else `test-results.json`;
-     * `false` disables the file.
-     */
-    outputFile?: string | false;
-    /**
-     * Lazy loader for the consumer's default `config.ts` export. Required so
-     * runAllTests cannot silently skip a configured secret manager; resolution
-     * happens in THIS process before any layer or env-backed client is touched.
-     */
-    loadProjectConfig: NonNullable<ResolveTestEnvironmentInput['loadProjectConfig']>;
-    apiMetaMap: ApiMetaMap;
-    apiInputSchemas: InputSchemaMap;
-    baseUrl: string;
-    /** Cookie name for the session token. Defaults to the project's configured session cookie name (`projectConfig.http.sessionCookieName`). */
-    sessionCookieName?: string;
-    /** Auth token applied as a `Cookie` header to sweep-layer requests that need a session. */
-    authToken?: string;
-    /** Endpoints to skip from the sweep layers, e.g. routes that need a file upload. */
-    skip?: string[];
-    /** Substring filter applied to `<page>/<name>/<version>`. */
-    filter?: string;
-    /** Disable individual layers (faster local iteration). */
-    noSweep?: boolean;
-    noFuzz?: boolean;
-    noRateLimit?: boolean;
-    /**
-     * Disable the CSRF-enforcement layer. Defaults to ON (the layer runs) — but it
-     * can only probe past the auth guard with a session, so it is a no-op unless an
-     * `authToken` is supplied.
-     */
-    noCsrf?: boolean;
-    noCustom?: boolean;
-    /**
-     * Token sent as `X-Test-Reset-Token` when the rate-limit layer resets the
-     * shared bucket between endpoints. The server's `/_test/reset` requires
-     * `TEST_RESET_TOKEN` to be set and matching — an unset/wrong token is 403, so
-     * `resetBetweenEndpoints` would silently no-op. Defaults to
-     * `process.env.TEST_RESET_TOKEN` so a CI run with the env set works with no
-     * extra wiring; pass explicitly to override.
-     */
-    resetToken?: string;
-    /**
-     * When a reset token is available, the sweep POSTs
-     * `/_test/reset?only=rateLimits` ONCE before the first layer (no bucket left
-     * drained by an earlier run) and ONCE after the last (the custom layer and the
-     * next run start unthrottled). Only limiter state is cleared: sessions — the
-     * `authToken` session above all — survive, so `TEST_RESET_TOKEN` can be set
-     * on an authenticated sweep. The reset never touches the app database.
-     * Defaults to ON; set `false` to opt out. With no token the bookends are
-     * skipped with a logged note (they can't run — `/_test/reset` 403s).
-     */
-    resetBookends?: boolean;
-}
-interface RunAllTestsSummary {
-    contract?: RunContractSummary;
-    auth?: RunContractSummary;
-    rateLimit?: RunContractSummary;
-    csrf?: RunContractSummary;
-    fuzz?: RunContractSummary;
-    custom?: RunCustomTestsSummary;
-    totalPassed: number;
-    totalFailed: number;
-}
-declare const runAllTests: (input: RunAllTestsInput) => Promise<RunAllTestsSummary>;
-declare const logRunAllSummary: (summary: RunAllTestsSummary) => void;
-
-interface TestLayerInput {
-    /** Resolved route name (`api/billing/getInvoice/v1` or `sync/chat/send/v1`). */
-    endpoint: string;
-    /** Method when applicable, undefined for sync endpoints. */
-    method?: string;
-    /** Bearer token / session token to use for auth-aware checks. */
-    authToken?: string;
-    /**
-     * A Zod-valid sample `data` payload for this route — generated from the
-     * route's input schema when `runRegisteredLayers` received the generated
-     * schemas (or an `inputFor`), `{}` otherwise. The same payload the built-in
-     * contract sweep sends, so a layer can exercise the route past validation.
-     */
-    sampleInput?: unknown;
-}
-interface TestLayerResult {
-    passed: boolean;
-    /** Short reason key — i18n-style errorCode when failed. */
-    message?: string;
-    /** Optional extras for the reporter (latency, response sample, ...). */
-    metadata?: Record<string, unknown>;
-}
-interface TestLayer {
-    name: string;
-    run: (input: TestLayerInput) => Promise<TestLayerResult> | TestLayerResult;
-}
-interface TestFixture<TPayload = unknown> {
-    valid: TPayload[];
-    invalid: TPayload[];
-}
-interface TestResult {
-    layer: string;
-    endpoint: string;
-    passed: boolean;
-    message?: string;
-    durationMs?: number;
-    metadata?: Record<string, unknown>;
-}
-interface TestSummary {
-    totalLayers: number;
-    totalEndpoints: number;
-    passed: number;
-    failed: number;
-    results: TestResult[];
-}
-interface TestReporter {
-    /** Called once per individual TestResult as the runner progresses. */
-    onResult?: (result: TestResult) => void | Promise<void>;
-    /** Called once at the end with the aggregated summary. */
-    onSummary?: (summary: TestSummary) => void | Promise<void>;
-    /** Optional webhook the runner POSTs the summary to. */
-    webhookUrl?: string;
-    webhookAuth?: {
-        type: 'bearer';
-        token: string;
-    };
-}
-/**
- * Register a custom test layer. Re-registering the same name replaces
- * the previous entry. Use for CORS enforcement, business-rule checks,
- * custom auth schemes, multi-tenant isolation, GDPR data-flow checks.
- */
-declare const registerTestLayer: (layer: TestLayer) => void;
-declare const listTestLayers: () => TestLayer[];
-/**
- * Register a realistic payload fixture for a specific type key. The fuzz
- * layer prefers these over schema-random generated inputs when a fixture
- * exists for the endpoint's input type.
- *
- * `valid` payloads are used to verify happy-path behavior; `invalid`
- * payloads probe the validator's error responses.
- */
-declare const registerTestFixture: <TPayload = unknown>(typeKey: string, fixture: TestFixture<TPayload>) => void;
-declare const getTestFixture: (typeKey: string) => TestFixture | undefined;
-/**
- * Register a test reporter. Set `null` to unregister. The runner calls
- * `onResult` per individual result as the run progresses and `onSummary`
- * once at the end. When `webhookUrl` is set, the runner additionally
- * POSTs the JSON-serialised summary to that URL.
- */
-declare const registerTestReporter: (newReporter: TestReporter | null) => void;
-declare const getTestReporter: () => TestReporter | null;
-declare const resetTestExtensionsForTests: () => void;
-
-interface RunRegisteredLayersInput {
-    apiMethodMap: ApiMethodMap$1;
-    /** Generated `syncMetaMap`. When given, layers also run against every sync route. */
-    syncMetaMap?: SyncMetaMap;
-    /** Session/bearer token forwarded to each layer's `run({ authToken })`. */
-    authToken?: string;
-    /**
-     * Endpoints to skip — matched against `<page>/<name>` (version-agnostic) and
-     * `<page>/<name>/<version>`, same convention as the built-in sweeps.
-     */
-    skip?: string[];
-    /** Substring filter on `<page>/<name>/<version>`, same as the built-in sweeps. */
-    filter?: string;
-    /** Generated `apiInputSchemas` — source of each API route's `sampleInput`. */
-    apiInputSchemas?: InputSchemaMap;
-    /** Generated `syncInputSchemas` — source of each sync route's `sampleInput`. */
-    syncInputSchemas?: InputSchemaMap;
-    /** Custom sample factory; wins over the schema maps when given. */
-    inputFor?: (endpoint: EndpointDescriptor) => unknown;
-}
-declare const runRegisteredLayers: (input: RunRegisteredLayersInput) => Promise<TestSummary>;
-
-declare const LAYER_KEYS: {
-    readonly contract: "contract";
-    readonly auth: "auth-enforcement";
-    readonly rateLimit: "rate-limit";
-    readonly csrf: "csrf-enforcement";
-    readonly fuzz: "fuzz";
-    readonly custom: "custom";
-};
-
-export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type CallSyncOptions, type ContractCheckInput, type ContractCheckResult, type CreateSampleInputForOptions, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, type HttpProbeTransportOptions, type InputSchemaMap, LAYER_KEYS, type OpenStreamWatcherInput, type ProbeRequestInput, type ProbeResponse, type ProbeTransport, type ProbeTransportRequest, type RateLimitCheckInput, type ResetServerStateInput, type ResolveTestBaseUrlOptions, type ResolveTestEnvironmentInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type RunRegisteredLayersInput, type SampleSchemaOptions, type SocketProbeTransportOptions, type StreamChunkFrame, type StreamWatcher, type SyncMetaEntry, type SyncMetaMap, type SyncMethodMap, TEST_DATA_PREFIX, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, createHttpProbeTransport, createSampleInputFor, createSocketProbeTransport, createTestDataMarker, defaultProbeTransport, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, resolveTestBaseUrl, resolveTestEnvironment, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, runRegisteredLayers, sampleSchemaInput, sendProbe, walkEndpoints, walkSyncEndpoints };
+export { walkEndpoints, walkSyncEndpoints } from './walkEndpoints.js';
+export { runContractCheck } from './contractCheck.js';
+export { runContractTests } from './runContractTests.js';
+export { runAuthEnforcementCheck } from './authEnforcementCheck.js';
+export { runAuthEnforcementTests } from './runAuthEnforcementTests.js';
+export { runRateLimitCheck } from './rateLimitCheck.js';
+export { runRateLimitTests } from './runRateLimitTests.js';
+export { runCsrfEnforcementCheck } from './csrfEnforcementCheck.js';
+export { runCsrfEnforcementTests } from './runCsrfEnforcementTests.js';
+export { runFuzzCheck } from './fuzzCheck.js';
+export { runFuzzTests } from './runFuzzTests.js';
+export { resetServerState } from './resetServerState.js';
+export { sendProbe, createHttpProbeTransport, defaultProbeTransport } from './probeRequest.js';
+export type { ProbeRequestInput, ProbeResponse, ProbeTransport, ProbeTransportRequest, HttpProbeTransportOptions, } from './probeRequest.js';
+export { createSocketProbeTransport } from './socketProbeTransport.js';
+export type { SocketProbeTransportOptions } from './socketProbeTransport.js';
+export { createSampleInputFor } from './sampleInputFor.js';
+export type { CreateSampleInputForOptions, InputSchemaMap } from './sampleInputFor.js';
+export { resolveTestBaseUrl } from './resolveTestBaseUrl.js';
+export type { ResolveTestBaseUrlOptions } from './resolveTestBaseUrl.js';
+export { resolveTestEnvironment } from './resolveTestEnvironment.js';
+export type { ResolveTestEnvironmentInput } from './resolveTestEnvironment.js';
+export { sampleSchemaInput } from './schemaSampleInput.js';
+export type { SampleSchemaOptions } from './schemaSampleInput.js';
+export { TEST_DATA_PREFIX, createTestDataMarker } from './testDataMarker.js';
+export { logContractResult, logContractSummary } from './reporter.js';
+export type { EndpointDescriptor, HttpMethod, ContractCheckResult, RunContractSummary, SyncMethodMap, SyncMetaMap, SyncMetaEntry, ApiMethodMap, ApiMetaMap, ApiMetaEntry, } from './types.js';
+export type { RunContractTestsInput } from './runContractTests.js';
+export type { ContractCheckInput } from './contractCheck.js';
+export type { AuthEnforcementCheckInput } from './authEnforcementCheck.js';
+export type { RunAuthEnforcementTestsInput } from './runAuthEnforcementTests.js';
+export type { RateLimitCheckInput } from './rateLimitCheck.js';
+export type { RunRateLimitTestsInput } from './runRateLimitTests.js';
+export type { CsrfEnforcementCheckInput } from './csrfEnforcementCheck.js';
+export type { RunCsrfEnforcementTestsInput } from './runCsrfEnforcementTests.js';
+export type { FuzzCheckInput } from './fuzzCheck.js';
+export type { RunFuzzTestsInput } from './runFuzzTests.js';
+export type { ResetServerStateInput } from './resetServerState.js';
+export { runCustomTests, discoverCustomTestFiles, } from './customTests.js';
+export type { CustomTestCase, CallSyncOptions, TestContext, TestExpect, CustomTestResult, RunCustomTestsInput, RunCustomTestsSummary, } from './customTests.js';
+export { openStreamWatcher } from './streamWatcher.js';
+export type { StreamWatcher, StreamChunkFrame, OpenStreamWatcherInput, } from './streamWatcher.js';
+export { runAllTests, logRunAllSummary } from './runAllTests.js';
+export type { RunAllTestsInput, RunAllTestsSummary } from './runAllTests.js';
+export { registerTestLayer, listTestLayers, registerTestFixture, getTestFixture, registerTestReporter, getTestReporter, resetTestExtensionsForTests, } from './extensionRegistry.js';
+export { runRegisteredLayers } from './runRegisteredLayers.js';
+export type { RunRegisteredLayersInput } from './runRegisteredLayers.js';
+export { LAYER_KEYS } from './testLayerHelpers.js';
+export type { TestLayer, TestLayerInput, TestLayerResult, TestFixture, TestResult, TestSummary, TestReporter, } from './extensionRegistry.js';