@luckystack/test-runner 0.14.0 → 0.15.0

package/dist/index.js

@@ -95,8 +95,70 @@ var createHttpProbeTransport = (options = {}) => ({
 });
 var defaultProbeTransport = createHttpProbeTransport();
 
+// src/testLayerHelpers.ts
+var LAYER_KEYS = {
+  contract: "contract",
+  auth: "auth-enforcement",
+  rateLimit: "rate-limit",
+  csrf: "csrf-enforcement",
+  fuzz: "fuzz",
+  custom: "custom"
+};
+var STATE_CHANGING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE"]);
+var routeKey = (endpoint) => `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
+var matchesFilter = (endpoint, filter) => !filter || routeKey(endpoint).includes(filter);
+var selectEndpoints = (input) => [
+  ...walkEndpoints(input.apiMethodMap),
+  ...input.syncMetaMap ? walkSyncEndpoints(input.syncMetaMap) : []
+].filter((endpoint) => matchesFilter(endpoint, input.filter));
+var metaMapFor = (endpoint, apiMetaMap, syncMetaMap) => endpoint.kind === "sync" ? syncMetaMap ?? {} : apiMetaMap;
+var transportFor = (endpoint, syncTransport, apiTransport) => (endpoint.kind === "sync" ? syncTransport : apiTransport) ?? defaultProbeTransport;
+var hasSessionHeaders = (headers) => Boolean(headers?.Cookie ?? headers?.Authorization);
+var isRateLimitedCode = (errorCode) => errorCode?.endsWith(".rateLimitExceeded") ?? false;
+var shouldSkip = (endpoint, skip) => {
+  if (skip.length === 0) return false;
+  const versioned = routeKey(endpoint);
+  const versionless = `${endpoint.page}/${endpoint.name}`;
+  return skip.includes(versioned) || skip.includes(versionless);
+};
+var requiresLogin = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  return meta?.auth?.login ?? false;
+};
+var hasAuthRequirement = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  return (meta?.auth?.login ?? false) || (meta?.auth?.hasAdditional ?? false);
+};
+var hasMetaEntry = (metaMap, endpoint) => metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
+var getRateLimit = (metaMap, endpoint) => {
+  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  if (!meta || meta.rateLimit === false || meta.rateLimit === void 0) return null;
+  return meta.rateLimit;
+};
+var calculateSummary = (results) => ({
+  total: results.length,
+  passed: results.filter((r) => r.status === "pass").length,
+  failed: results.filter((r) => r.status === "fail").length,
+  skipped: results.filter((r) => r.status === "skipped").length,
+  results
+});
+
 // src/contractCheck.ts
 var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
+var ROUTING_ERROR_CODES = /* @__PURE__ */ new Set([
+  "api.notFound",
+  "sync.notFound",
+  "api.methodNotAllowed",
+  "sync.methodNotAllowed",
+  "api.invalidName",
+  "sync.invalidName"
+]);
+var SERVER_ERROR_CODES = /* @__PURE__ */ new Set([
+  "api.serverExecutionFailed",
+  "sync.serverExecutionFailed",
+  "api.internalServerError",
+  "sync.internalServerError"
+]);
 var runContractCheck = async (input) => {
   const { endpoint, baseUrl } = input;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
@@ -148,6 +210,40 @@ var runContractCheck = async (input) => {
       durationMs
     };
   }
+  if (isRateLimitedCode(parsed.errorCode)) {
+    return {
+      endpoint,
+      status: "skipped",
+      httpStatus,
+      responseStatus: "error",
+      errorCode: parsed.errorCode,
+      reason: "rate-limited before the route ran (not exercised); pass a reset token so the sweep resets rate limits between routes",
+      durationMs
+    };
+  }
+  if (parsed.errorCode !== void 0 && ROUTING_ERROR_CODES.has(parsed.errorCode)) {
+    return {
+      endpoint,
+      status: "fail",
+      httpStatus,
+      responseStatus: "error",
+      errorCode: parsed.errorCode,
+      reason: "route not reachable as generated (routing error) \u2014 the generated route map and the live server disagree",
+      durationMs
+    };
+  }
+  const isServerError = httpStatus !== void 0 && httpStatus >= 500 || parsed.errorCode !== void 0 && SERVER_ERROR_CODES.has(parsed.errorCode);
+  if (isServerError) {
+    return {
+      endpoint,
+      status: input.allowServerError ? "pass" : "fail",
+      httpStatus,
+      responseStatus: "error",
+      errorCode: parsed.errorCode,
+      reason: input.allowServerError ? "expected server error (listed in expectServerError)" : "server error on a well-formed probe \u2014 list the route in expectServerError if it is designed to fail",
+      durationMs
+    };
+  }
   const bodyIsNonEmpty = body !== null && typeof body === "object" && !Array.isArray(body) && Object.keys(body).length > 0;
   if (input.inputFor && bodyIsNonEmpty && parsed.status === "error") {
     return {
@@ -170,51 +266,23 @@ var runContractCheck = async (input) => {
   };
 };
 
-// src/testLayerHelpers.ts
-var LAYER_KEYS = {
-  contract: "contract",
-  auth: "auth-enforcement",
-  rateLimit: "rate-limit",
-  csrf: "csrf-enforcement",
-  fuzz: "fuzz",
-  custom: "custom"
-};
-var STATE_CHANGING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE"]);
-var routeKey = (endpoint) => `${endpoint.page}/${endpoint.name}/${endpoint.version}`;
-var matchesFilter = (endpoint, filter) => !filter || routeKey(endpoint).includes(filter);
-var selectEndpoints = (input) => [
-  ...walkEndpoints(input.apiMethodMap),
-  ...input.syncMetaMap ? walkSyncEndpoints(input.syncMetaMap) : []
-].filter((endpoint) => matchesFilter(endpoint, input.filter));
-var metaMapFor = (endpoint, apiMetaMap, syncMetaMap) => endpoint.kind === "sync" ? syncMetaMap ?? {} : apiMetaMap;
-var transportFor = (endpoint, syncTransport) => endpoint.kind === "sync" && syncTransport ? syncTransport : defaultProbeTransport;
-var shouldSkip = (endpoint, skip) => {
-  if (skip.length === 0) return false;
-  const versioned = routeKey(endpoint);
-  const versionless = `${endpoint.page}/${endpoint.name}`;
-  return skip.includes(versioned) || skip.includes(versionless);
-};
-var requiresLogin = (metaMap, endpoint) => {
-  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return meta?.auth?.login ?? false;
-};
-var hasAuthRequirement = (metaMap, endpoint) => {
-  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return (meta?.auth?.login ?? false) || (meta?.auth?.hasAdditional ?? false);
-};
-var hasMetaEntry = (metaMap, endpoint) => metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
-var getRateLimit = (metaMap, endpoint) => {
-  const meta = metaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  if (!meta || meta.rateLimit === false || meta.rateLimit === void 0) return null;
-  return meta.rateLimit;
+// src/resetServerState.ts
+import { getProjectConfig, TEST_RESET_ONLY_PARAM, tryCatch as tryCatch2 } from "@luckystack/core";
+var DEFAULT_REQUEST_TIMEOUT_MS2 = 1e4;
+var resetServerState = async ({ baseUrl, token, requestTimeoutMs, only }) => {
+  const endpoint = `${baseUrl.replace(/\/$/, "")}${getProjectConfig().http.testResetEndpoint}`;
+  const url = only && only.length > 0 ? `${endpoint}?${new URLSearchParams({ [TEST_RESET_ONLY_PARAM]: only.join(",") }).toString()}` : endpoint;
+  const headers = { "Content-Type": "application/json" };
+  if (token) headers["X-Test-Reset-Token"] = token;
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => {
+    controller.abort();
+  }, requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2);
+  const [error, response] = await tryCatch2(() => fetch(url, { method: "POST", headers, signal: controller.signal }));
+  clearTimeout(timeoutHandle);
+  if (error || !response) return false;
+  return response.ok;
 };
-var calculateSummary = (results) => ({
-  total: results.length,
-  passed: results.filter((r) => r.status === "pass").length,
-  failed: results.filter((r) => r.status === "fail").length,
-  skipped: results.filter((r) => r.status === "skipped").length,
-  results
-});
 
 // src/runContractTests.ts
 var runContractTests = async (input) => {
@@ -233,12 +301,16 @@ var runContractTests = async (input) => {
       input.onResult?.(skipped);
       continue;
     }
+    if (input.resetToken) {
+      await resetServerState({ baseUrl: input.baseUrl, token: input.resetToken, only: ["rateLimits"] });
+    }
     const result = await runContractCheck({
       endpoint,
       baseUrl: input.baseUrl,
       inputFor: input.inputFor,
       headers: input.headers,
-      transport: transportFor(endpoint, input.syncTransport)
+      transport: transportFor(endpoint, input.syncTransport, input.apiTransport),
+      allowServerError: shouldSkip(endpoint, input.expectServerError ?? [])
     });
     results.push(result);
     input.onResult?.(result);
@@ -247,7 +319,7 @@ var runContractTests = async (input) => {
 };
 
 // src/authEnforcementCheck.ts
-var DEFAULT_REQUEST_TIMEOUT_MS2 = 5e3;
+var DEFAULT_REQUEST_TIMEOUT_MS3 = 5e3;
 var EXPECTED_ERROR_CODES = /* @__PURE__ */ new Set(["auth.required", "auth.forbidden"]);
 var runAuthEnforcementCheck = async (input) => {
   const { endpoint, baseUrl } = input;
@@ -257,7 +329,7 @@ var runAuthEnforcementCheck = async (input) => {
     endpoint,
     baseUrl,
     body,
-    requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2
+    requestTimeoutMs: input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS3
   });
   if (!result) {
     return {
@@ -346,7 +418,7 @@ var runAuthEnforcementTests = async (input) => {
       endpoint,
       baseUrl: input.baseUrl,
       inputFor: input.inputFor,
-      transport: transportFor(endpoint, input.syncTransport)
+      transport: transportFor(endpoint, input.syncTransport, input.apiTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -355,7 +427,7 @@ var runAuthEnforcementTests = async (input) => {
 };
 
 // src/rateLimitCheck.ts
-var DEFAULT_REQUEST_TIMEOUT_MS3 = 1e4;
+var DEFAULT_REQUEST_TIMEOUT_MS4 = 1e4;
 var expectedErrorCodeFor = (endpoint) => endpoint.kind === "sync" ? "sync.rateLimitExceeded" : "api.rateLimitExceeded";
 var PRE_LIMITER_ERROR_CODES = /* @__PURE__ */ new Set([
   "auth.required",
@@ -369,7 +441,7 @@ var runRateLimitCheck = async (input) => {
   const { endpoint, baseUrl, rateLimit } = input;
   const body = input.inputFor ? input.inputFor(endpoint) : {};
   const started = Date.now();
-  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS3;
+  const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS4;
   const expectedErrorCode = expectedErrorCodeFor(endpoint);
   const transport = input.transport ?? defaultProbeTransport;
   const send = () => transport.send({
@@ -425,30 +497,12 @@ var runRateLimitCheck = async (input) => {
   };
 };
 
-// src/resetServerState.ts
-import { getProjectConfig, TEST_RESET_ONLY_PARAM, tryCatch as tryCatch2 } from "@luckystack/core";
-var DEFAULT_REQUEST_TIMEOUT_MS4 = 1e4;
-var resetServerState = async ({ baseUrl, token, requestTimeoutMs, only }) => {
-  const endpoint = `${baseUrl.replace(/\/$/, "")}${getProjectConfig().http.testResetEndpoint}`;
-  const url = only && only.length > 0 ? `${endpoint}?${new URLSearchParams({ [TEST_RESET_ONLY_PARAM]: only.join(",") }).toString()}` : endpoint;
-  const headers = { "Content-Type": "application/json" };
-  if (token) headers["X-Test-Reset-Token"] = token;
-  const controller = new AbortController();
-  const timeoutHandle = setTimeout(() => {
-    controller.abort();
-  }, requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS4);
-  const [error, response] = await tryCatch2(() => fetch(url, { method: "POST", headers, signal: controller.signal }));
-  clearTimeout(timeoutHandle);
-  if (error || !response) return false;
-  return response.ok;
-};
-
 // src/runRateLimitTests.ts
 var runRateLimitTests = async (input) => {
   const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
   const maxRateLimit = input.maxRateLimitToTest ?? 50;
-  const isAuthenticatedSweep = Boolean(input.headers?.Cookie);
+  const isAuthenticatedSweep = hasSessionHeaders(input.headers);
   const results = [];
   for (const endpoint of endpoints) {
     const metaMap = metaMapFor(endpoint, input.apiMetaMap, input.syncMetaMap);
@@ -470,7 +524,7 @@ var runRateLimitTests = async (input) => {
         endpoint,
         status: "skipped",
         durationMs: 0,
-        reason: "state-changing route skipped in cookie-mode rate-limit sweep (mutation risk with junk bodies)"
+        reason: "state-changing route skipped in authenticated rate-limit sweep (mutation risk with junk bodies)"
       };
       results.push(skipped);
       input.onResult?.(skipped);
@@ -507,7 +561,7 @@ var runRateLimitTests = async (input) => {
       rateLimit,
       inputFor: input.inputFor,
       headers: input.headers,
-      transport: transportFor(endpoint, input.syncTransport)
+      transport: transportFor(endpoint, input.syncTransport, input.apiTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -647,7 +701,7 @@ var runFuzzCheck = async (input) => {
   const started = Date.now();
   const requestTimeoutMs = input.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS6;
   const transport = input.transport ?? defaultProbeTransport;
-  for (const payload of JUNK_PAYLOADS) {
+  for (const [index, payload] of JUNK_PAYLOADS.entries()) {
     const result = await transport.send({
       endpoint: input.endpoint,
       baseUrl: input.baseUrl,
@@ -673,6 +727,16 @@ var runFuzzCheck = async (input) => {
         durationMs
       };
     }
+    if (isRateLimitedCode(result.parsed.errorCode)) {
+      return {
+        endpoint: input.endpoint,
+        status: "skipped",
+        httpStatus: result.httpStatus,
+        errorCode: result.parsed.errorCode,
+        reason: `rate-limited after ${String(index)} of ${String(JUNK_PAYLOADS.length)} fuzz payloads (not exercised); pass a reset token so the sweep resets rate limits between routes`,
+        durationMs
+      };
+    }
     if (result.parsed.status === "error" && typeof result.parsed.errorCode !== "string") {
       return {
         endpoint: input.endpoint,
@@ -694,7 +758,7 @@ var runFuzzCheck = async (input) => {
 var runFuzzTests = async (input) => {
   const endpoints = selectEndpoints(input);
   const skip = input.skip ?? [];
-  const isAuthenticatedSweep = Boolean(input.headers?.Cookie);
+  const isAuthenticatedSweep = hasSessionHeaders(input.headers);
   const results = [];
   for (const endpoint of endpoints) {
     if (isAuthenticatedSweep && STATE_CHANGING_METHODS.has(endpoint.method)) {
@@ -702,7 +766,7 @@ var runFuzzTests = async (input) => {
         endpoint,
         status: "skipped",
         durationMs: 0,
-        reason: "state-changing route skipped in cookie-mode fuzz sweep (mutation risk with junk bodies)"
+        reason: "state-changing route skipped in authenticated fuzz sweep (mutation risk with junk bodies)"
       };
       results.push(skipped);
       input.onResult?.(skipped);
@@ -719,11 +783,14 @@ var runFuzzTests = async (input) => {
       input.onResult?.(skipped);
       continue;
     }
+    if (input.resetToken) {
+      await resetServerState({ baseUrl: input.baseUrl, token: input.resetToken, only: ["rateLimits"] });
+    }
     const result = await runFuzzCheck({
       endpoint,
       baseUrl: input.baseUrl,
       headers: input.headers,
-      transport: transportFor(endpoint, input.syncTransport)
+      transport: transportFor(endpoint, input.syncTransport, input.apiTransport)
     });
     results.push(result);
     input.onResult?.(result);
@@ -737,6 +804,8 @@ import { tryCatch as tryCatch4 } from "@luckystack/core";
 // src/testSocket.ts
 import { io as createSocketIoClient } from "socket.io-client";
 import {
+  applyCookiePrefixConstraints,
+  buildApiResponseEventName,
   buildJoinRoomResponseEventName,
   buildSyncResponseEventName,
   getProjectConfig as getProjectConfig2,
@@ -745,6 +814,10 @@ import {
 } from "@luckystack/core";
 var DEFAULT_CONNECT_TIMEOUT_MS = 3e3;
 var DEFAULT_JOIN_TIMEOUT_MS = 3e3;
+var projectSessionCookieName = () => {
+  const { http } = getProjectConfig2();
+  return applyCookiePrefixConstraints(http.sessionCookieName, http.sessionCookiePrefix).name;
+};
 var responseIndexCounter = 0;
 var nextResponseIndex = () => {
   responseIndexCounter += 1;
@@ -778,7 +851,7 @@ var waitForConnect = (socket, label, timeoutMs) => {
   });
 };
 var connectTestSocket = async (input) => {
-  const sessionCookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
+  const sessionCookieName = input.sessionCookieName ?? projectSessionCookieName();
   const socket = createSocketIoClient(input.baseUrl, {
     transports: ["websocket"],
     forceNew: true,
@@ -835,20 +908,22 @@ var joinTestRoom = (socket, room, options) => {
     socket.emit(socketEventNames.joinRoom, { group: room, responseIndex });
   });
 };
+var emitAndAwaitReply = (socket, replyEvent, emit, timeoutMs) => new Promise((resolve) => {
+  const timer = setTimeout(() => {
+    socket.off(replyEvent, onResponse);
+    resolve({ kind: "timeout" });
+  }, timeoutMs);
+  const onResponse = (payload) => {
+    clearTimeout(timer);
+    socket.off(replyEvent, onResponse);
+    resolve({ kind: "response", payload });
+  };
+  socket.on(replyEvent, onResponse);
+  emit();
+});
 var emitSyncOverSocket = (socket, input) => {
   const responseIndex = nextResponseIndex();
-  const eventName = buildSyncResponseEventName(responseIndex);
-  return new Promise((resolve) => {
-    const timer = setTimeout(() => {
-      socket.off(eventName, onResponse);
-      resolve({ kind: "timeout" });
-    }, input.timeoutMs);
-    const onResponse = (payload) => {
-      clearTimeout(timer);
-      socket.off(eventName, onResponse);
-      resolve({ kind: "response", payload });
-    };
-    socket.on(eventName, onResponse);
+  return emitAndAwaitReply(socket, buildSyncResponseEventName(responseIndex), () => {
     socket.emit(socketEventNames.sync, {
       name: `sync/${input.routePath}`,
       //? Only `undefined` defaults — a fuzz probe's `null` must reach the server as-is.
@@ -861,11 +936,22 @@ var emitSyncOverSocket = (socket, input) => {
       responseIndex,
       ignoreSelf: input.ignoreSelf ?? false
     });
-  });
+  }, input.timeoutMs);
+};
+var emitApiOverSocket = (socket, input) => {
+  const responseIndex = nextResponseIndex();
+  return emitAndAwaitReply(socket, buildApiResponseEventName(responseIndex), () => {
+    socket.emit(socketEventNames.apiRequest, {
+      name: `api/${input.routePath}`,
+      //? Only `undefined` defaults — a fuzz probe's `null` must reach the server as-is.
+      data: input.data === void 0 ? {} : input.data,
+      responseIndex
+    });
+  }, input.timeoutMs);
 };
 
 // src/socketProbeTransport.ts
-var LABEL = "sync probe";
+var LABEL = "socket probe";
 var tokenFromCookieHeader = (cookieHeader, cookieName) => {
   if (!cookieHeader) return null;
   for (const part of cookieHeader.split(";")) {
@@ -874,10 +960,17 @@ var tokenFromCookieHeader = (cookieHeader, cookieName) => {
   }
   return null;
 };
+var tokenFromHeaders = (headers, cookieName) => {
+  const cookieToken = tokenFromCookieHeader(headers?.Cookie, cookieName);
+  if (cookieToken) return cookieToken;
+  const authorization = headers?.Authorization;
+  return authorization?.startsWith("Bearer ") ? authorization.slice("Bearer ".length) : null;
+};
 var toProbeResponse = (payload) => {
   if (typeof payload !== "object" || payload === null) return { parsed: null };
   const record = payload;
   return {
+    ...typeof record.httpStatus === "number" ? { httpStatus: record.httpStatus } : {},
     parsed: {
       status: typeof record.status === "string" ? record.status : void 0,
       errorCode: typeof record.errorCode === "string" ? record.errorCode : void 0
@@ -885,7 +978,6 @@ var toProbeResponse = (payload) => {
   };
 };
 var createSocketProbeTransport = (options) => {
-  const http = createHttpProbeTransport({ syncReceiver: options.receiver });
   const sockets = /* @__PURE__ */ new Map();
   const socketFor = (token) => {
     const key = token ?? "";
@@ -906,15 +998,15 @@ var createSocketProbeTransport = (options) => {
     return opening;
   };
   const send = async (request) => {
-    if (request.endpoint.kind !== "sync") return http.send(request);
-    const socket = await socketFor(tokenFromCookieHeader(request.headers?.Cookie, options.sessionCookieName));
+    const socket = await socketFor(tokenFromHeaders(request.headers, options.sessionCookieName));
     if (!socket) return null;
-    const outcome = await emitSyncOverSocket(socket, {
-      routePath: `${request.endpoint.page}/${request.endpoint.name}/${request.endpoint.version}`,
+    const routePath = `${request.endpoint.page}/${request.endpoint.name}/${request.endpoint.version}`;
+    const outcome = request.endpoint.kind === "sync" ? await emitSyncOverSocket(socket, {
+      routePath,
       data: request.body,
       receiver: options.receiver,
       timeoutMs: request.requestTimeoutMs
-    });
+    }) : await emitApiOverSocket(socket, { routePath, data: request.body, timeoutMs: request.requestTimeoutMs });
     return outcome.kind === "response" ? toProbeResponse(outcome.payload) : null;
   };
   const close = async () => {
@@ -1398,8 +1490,19 @@ var parseResponse = async (response, state) => {
   state.lastResponse = parsed;
   return parsed;
 };
-var buildCallApi = (baseUrl, routePath, state, cookieName, method) => {
-  return async (input) => {
+var resolveCallTransport = (opts) => opts?.transport ?? (getProjectConfig3().transport.invocation === "routed-http" ? "http" : "socket");
+var buildCallApi = (baseUrl, routePath, state, cookieName, method, caseSocket) => {
+  return async (input, opts) => {
+    if (resolveCallTransport(opts) === "socket") {
+      const { socket } = await caseSocket.get(state.token);
+      const outcome = await emitApiOverSocket(socket, { routePath, data: input, timeoutMs: DEFAULT_CALL_TIMEOUT_MS });
+      if (outcome.kind === "timeout") {
+        state.lastResponse = null;
+        throw new Error(`callApi ${routePath} failed: no socket response within ${DEFAULT_CALL_TIMEOUT_MS}ms`);
+      }
+      state.lastResponse = outcome.payload;
+      return outcome.payload;
+    }
     const path4 = `${baseUrl.replace(/\/$/, "")}/api/${routePath}`;
     const headers = { "Content-Type": "application/json", Origin: new URL(baseUrl).origin };
     if (state.token) headers.Cookie = `${cookieName}=${state.token}`;
@@ -1431,17 +1534,16 @@ var createCaseSyncSocket = (baseUrl, cookieName) => {
     get: async (token) => {
       if (current?.token === token && current.socket.connected) return current;
       close();
-      const socket = await connectTestSocket({ baseUrl, token, label: "callSync", sessionCookieName: cookieName });
+      const socket = await connectTestSocket({ baseUrl, token, label: "case socket", sessionCookieName: cookieName });
       current = { socket, token, joinedRooms: /* @__PURE__ */ new Set() };
       return current;
     },
     close
   };
 };
-var resolveSyncTransport = (opts) => opts?.transport ?? (getProjectConfig3().transport.invocation === "routed-http" ? "http" : "socket");
 var buildCallSync = (baseUrl, routePath, state, cookieName, syncSocket) => {
   return async (input, opts) => {
-    if (resolveSyncTransport(opts) === "socket") {
+    if (resolveCallTransport(opts) === "socket") {
       const { socket, joinedRooms } = await syncSocket.get(state.token);
       const { receiver, joinRoom = true } = opts ?? {};
       if (receiver && receiver !== "all" && joinRoom && !joinedRooms.has(receiver)) {
@@ -1486,7 +1588,7 @@ var buildCallSync = (baseUrl, routePath, state, cookieName, syncSocket) => {
   };
 };
 var buildContext = (discovery, input) => {
-  const cookieName = input.sessionCookieName ?? getProjectConfig3().http.sessionCookieName;
+  const cookieName = input.sessionCookieName ?? projectSessionCookieName();
   const routePath = `${discovery.route.page}/${discovery.route.name}/${discovery.route.version}`;
   const routeFullName = `sync/${routePath}`;
   const apiMethod = input.apiMethodMap?.[discovery.route.page]?.[discovery.route.name]?.[discovery.route.version] ?? "POST";
@@ -1514,7 +1616,7 @@ var buildContext = (discovery, input) => {
     }
   };
   const ctx = {
-    callApi: buildCallApi(input.baseUrl, routePath, state, cookieName, apiMethod),
+    callApi: buildCallApi(input.baseUrl, routePath, state, cookieName, apiMethod, syncSocket),
     callSync: buildCallSync(input.baseUrl, routePath, state, cookieName, syncSocket),
     watchStream,
     session: buildSessionHelpers(state),
@@ -1638,7 +1740,11 @@ var resolveResetBookendToken = (input) => {
 var buildAuthHeaders = async (input) => {
   const headers = {};
   if (!input.authToken) return headers;
-  const cookieName = input.sessionCookieName ?? getProjectConfig4().http.sessionCookieName;
+  if (getProjectConfig4().session.basedToken) {
+    headers.Authorization = `Bearer ${input.authToken}`;
+    return headers;
+  }
+  const cookieName = input.sessionCookieName ?? projectSessionCookieName();
   headers.Cookie = `${cookieName}=${input.authToken}`;
   try {
     const { getSession } = await import("@luckystack/login");
@@ -1655,34 +1761,37 @@ var buildAuthHeaders = async (input) => {
   }
   return headers;
 };
-var prepareSyncSweep = async (input) => {
+var resolveProbeMode = (override) => override ?? (getProjectConfig4().transport.invocation === "routed-http" ? "http" : "socket");
+var prepareSweepTransports = async (input, hasSyncRoutes) => {
   const receiver = `lstest-room-${crypto2.randomUUID()}`;
-  const sessionCookieName = input.sessionCookieName ?? getProjectConfig4().http.sessionCookieName;
-  const mode = input.syncTransport ?? (getProjectConfig4().transport.invocation === "routed-http" ? "http" : "socket");
+  const sessionCookieName = input.sessionCookieName ?? projectSessionCookieName();
+  const syncMode = resolveProbeMode(input.syncTransport);
+  const apiMode = resolveProbeMode(input.apiTransport);
   const http = createHttpProbeTransport({ syncReceiver: receiver });
+  const socket = apiMode === "socket" || hasSyncRoutes && syncMode === "socket" ? createSocketProbeTransport({ baseUrl: input.baseUrl, receiver, sessionCookieName }) : null;
   let memberSocket = null;
-  if (input.authToken) {
+  if (hasSyncRoutes && input.authToken) {
     const authToken = input.authToken;
-    const [connectError, socket] = await tryCatch8(() => connectTestSocket({
+    const [connectError, socket2] = await tryCatch8(() => connectTestSocket({
       baseUrl: input.baseUrl,
       token: authToken,
       label: "sync sweep",
       sessionCookieName
     }));
-    if (connectError || !socket) {
+    if (connectError || !socket2) {
       console.warn(`[test-runner] runAllTests: could not open a socket for the sync sweep \u2014 ${connectError?.message ?? "no socket"}; sync probes will be rejected as non-members.`);
     } else {
-      memberSocket = socket;
-      const [joinError] = await tryCatch8(() => joinTestRoom(socket, receiver, { label: "sync sweep" }));
+      memberSocket = socket2;
+      const [joinError] = await tryCatch8(() => joinTestRoom(socket2, receiver, { label: "sync sweep" }));
       if (joinError) console.warn(`[test-runner] runAllTests: ${joinError.message}; sync probes will be rejected as non-members.`);
     }
   }
-  const sweep = mode === "socket" ? createSocketProbeTransport({ baseUrl: input.baseUrl, receiver, sessionCookieName }) : http;
   return {
-    sweep,
-    csrf: http,
+    sync: hasSyncRoutes ? syncMode === "socket" && socket ? socket : http : void 0,
+    csrfSync: hasSyncRoutes ? http : void 0,
+    api: apiMode === "socket" && socket ? socket : void 0,
     close: async () => {
-      await sweep.close?.();
+      await socket?.close?.();
       if (memberSocket) await releaseTestSocket(memberSocket);
     }
   };
@@ -1694,17 +1803,26 @@ var runSweepLayers = async (input, summary, headers, inputFor) => {
     await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken, only: ["rateLimits"] });
   }
   const hasSyncRoutes = Object.keys(input.syncMetaMap ?? {}).length > 0;
-  const sync = hasSyncRoutes ? await prepareSyncSweep(input) : null;
-  const shared = {
+  const transports = await prepareSweepTransports(input, hasSyncRoutes);
+  const routing = {
     apiMethodMap: input.apiMethodMap,
     syncMetaMap: input.syncMetaMap,
     baseUrl: input.baseUrl,
     skip: input.skip,
-    filter: input.filter,
-    syncTransport: sync?.sweep
+    filter: input.filter
   };
+  const shared = { ...routing, syncTransport: transports.sync, apiTransport: transports.api };
   const [layerError] = await tryCatch8(async () => {
-    summary.contract = await runContractTests({ ...shared, headers, inputFor });
+    summary.contract = await runContractTests({
+      ...shared,
+      headers,
+      inputFor,
+      expectServerError: input.expectServerError,
+      //? Reset limiter buckets between routes when a token is available: the
+      //? global per-IP bucket is checked before validation, so once it fills,
+      //? every later probe would be a limiter rejection, not a route test.
+      resetToken
+    });
     summary.auth = await runAuthEnforcementTests({ ...shared, apiMetaMap: input.apiMetaMap, inputFor });
     if (!input.noRateLimit) {
       summary.rateLimit = await runRateLimitTests({
@@ -1723,20 +1841,23 @@ var runSweepLayers = async (input, summary, headers, inputFor) => {
         resetToken
       });
     }
-    if (!input.noCsrf && headers.Cookie) {
+    if (!input.noCsrf && headers.Authorization) {
+      console.log("[test-runner] runAllTests: CSRF layer skipped \u2014 token-mode sessions (session.basedToken) are not subject to CSRF enforcement.");
+    } else if (!input.noCsrf && headers.Cookie) {
       summary.csrf = await runCsrfEnforcementTests({
-        ...shared,
+        ...routing,
         apiMetaMap: input.apiMetaMap,
         authCookie: headers.Cookie,
         inputFor,
-        syncTransport: sync?.csrf
+        //? CSRF is an HTTP-only guard: both route kinds probe over HTTP.
+        syncTransport: transports.csrfSync
       });
     }
     if (!input.noFuzz) {
-      summary.fuzz = await runFuzzTests({ ...shared, headers });
+      summary.fuzz = await runFuzzTests({ ...shared, headers, resetToken });
     }
   });
-  await sync?.close();
+  await transports.close();
   if (resetBookendToken) {
     await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken, only: ["rateLimits"] });
   }