@luckystack/test-runner 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to `@luckystack/test-runner` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.0] - 2026-10-19
+
+### Added
+
+- `runAllTests({ apiTransport, expectServerError })`, `runContractTests({ apiTransport, expectServerError, resetToken })`, `runFuzzTests({ apiTransport, resetToken })`, `apiTransport` on the auth and rate-limit layer inputs, `ctx.callApi(input, { transport })` and the `CallApiOptions` type.
+
+### Changed
+
+- **Breaking:** in socket-mode projects (the default `transport.invocation: 'socket'`) the contract, auth, rate-limit and fuzz layers and `ctx.callApi` test API routes over Socket.io, the path real clients use, instead of `/api/*` (ADR 0084). `createSocketProbeTransport` sends API routes over the socket too; the CSRF layer still probes over HTTP. Upgrade: expect results to change where the two pipelines differ; pass `apiTransport: 'http'` to `runAllTests`, or `{ transport: 'http' }` to `ctx.callApi`, to keep the old path.
+- **Breaking:** the contract layer fails on routing errors (`notFound`, `methodNotAllowed`, `invalidName`) and on server errors (HTTP 5xx, `serverExecutionFailed`, `internalServerError`) instead of passing any well-formed error. Upgrade: list routes that throw on purpose in the new `expectServerError` option of `runAllTests` / `runContractTests`.
+
+### Fixed
+
+- **Token-mode projects:** `runAllTests({ authToken })` sends the session as `Authorization: Bearer` instead of a Cookie and skips the CSRF layer with a note. Before, the CSRF layer failed every state-changing route by mistake and ran real mutations on the sweep's session.
+- **Contract and fuzz probes that hit the rate limiter are reported as skipped instead of passed.** With a reset token (`resetToken` / `TEST_RESET_TOKEN`) both layers reset rate limits before each route.
+- **The session `Cookie:` header uses the effective cookie name** when `http.sessionCookiePrefix` is set (`__Host-…` / `__Secure-…`), in the sweep, the test sockets and `ctx` calls. Before, the runner sent the unprefixed name, which the server no longer reads.
+
 ## [0.12.0] - 2026-10-15
 
 ### Changed

package/dist/contractCheck.d.ts

@@ -20,5 +20,11 @@ export interface ContractCheckInput {
     requestTimeoutMs?: number;
     /** How the probe reaches the server. Defaults to HTTP. */
     transport?: ProbeTransport;
+    /**
+     * The route is designed to fail on the server (e.g. a playground route that
+     * throws on purpose): a shaped 5xx / execution-failed reply then passes.
+     * Routing errors (unknown route, wrong method) still fail.
+     */
+    allowServerError?: boolean;
 }
 export declare const runContractCheck: (input: ContractCheckInput) => Promise<ContractCheckResult>;

package/dist/customTests.d.ts

@@ -1,5 +1,6 @@
 import { getPrismaClient } from '@luckystack/core';
 import { type ResolveTestEnvironmentInput } from './resolveTestEnvironment.js';
+import type { Socket } from 'socket.io-client';
 import { type StreamChunkFrame, type StreamWatcher } from './streamWatcher.js';
 import type { ApiMethodMap } from './types.js';
 export interface CustomTestCase {
@@ -77,17 +78,23 @@ export interface CallSyncOptions {
     /** Socket transport: join `receiver` before sending. Default `true`. */
     joinRoom?: boolean;
 }
+export interface CallApiOptions {
+    /** Force a transport. Defaults to the project's `transport.invocation`. */
+    transport?: 'socket' | 'http';
+}
 export interface TestContext {
     /**
      * Invoke the route under test. Page / name / version are baked in.
      *
-     * `input` travels exactly like the real client sends it: as the JSON body
-     * for POST / PUT / DELETE routes, and as the `__luckystack_data` query-string
-     * value for GET routes (a GET cannot carry a body). Either way the server
-     * validates it as the route's `data`, so a GET route with required fields
-     * receives them.
+     * The call takes the SAME transport the project's real client uses
+     * (`transport.invocation`): Socket.io (`apiRequest`) for `'socket'` (the
+     * default), the `/api/*` HTTP route for `'routed-http'`. Override per call
+     * with `opts.transport`. Over HTTP, `input` travels exactly like the real
+     * client sends it: as the JSON body for POST / PUT / DELETE routes, and as the
+     * `__luckystack_data` query-string value for GET routes (a GET cannot carry a
+     * body). Either way the server validates it as the route's `data`.
      */
-    callApi: <TInput = unknown, TOutput = unknown>(input: TInput) => Promise<TOutput>;
+    callApi: <TInput = unknown, TOutput = unknown>(input: TInput, opts?: CallApiOptions) => Promise<TOutput>;
     /**
      * Invoke the sync route under test over the SAME transport the project's
      * real client uses (`transport.invocation`): Socket.io for `'socket'` (the
@@ -138,7 +145,15 @@ interface TestSessionState {
     lastResponse: unknown;
 }
 /** @internal Exported for the unit test only; consumers use `TestContext.callApi`. */
-export declare const buildCallApi: (baseUrl: string, routePath: string, state: TestSessionState, cookieName: string, method: string) => TestContext['callApi'];
+export declare const buildCallApi: (baseUrl: string, routePath: string, state: TestSessionState, cookieName: string, method: string, caseSocket: CaseSyncSocket) => TestContext['callApi'];
+/** @internal Exported for the unit test only. */
+export interface CaseSyncSocket {
+    get: (token: string | null) => Promise<{
+        socket: Socket;
+        joinedRooms: Set<string>;
+    }>;
+    close: () => void;
+}
 /** @internal Environment is already prepared by `runAllTests`. */
 export declare const runCustomTestsAfterEnvironmentPrepared: (input: PreparedRunCustomTestsInput) => Promise<RunCustomTestsSummary>;
 export declare const runCustomTests: (input: RunCustomTestsInput) => Promise<RunCustomTestsSummary>;

package/dist/index.d.ts

@@ -37,7 +37,7 @@ export type { FuzzCheckInput } from './fuzzCheck.js';
 export type { RunFuzzTestsInput } from './runFuzzTests.js';
 export type { ResetServerStateInput } from './resetServerState.js';
 export { runCustomTests, discoverCustomTestFiles, } from './customTests.js';
-export type { CustomTestCase, CallSyncOptions, TestContext, TestExpect, CustomTestResult, RunCustomTestsInput, RunCustomTestsSummary, } from './customTests.js';
+export type { CustomTestCase, CallApiOptions, CallSyncOptions, TestContext, TestExpect, CustomTestResult, RunCustomTestsInput, RunCustomTestsSummary, } from './customTests.js';
 export { openStreamWatcher } from './streamWatcher.js';
 export type { StreamWatcher, StreamChunkFrame, OpenStreamWatcherInput, } from './streamWatcher.js';
 export { runAllTests, logRunAllSummary } from './runAllTests.js';