@luckystack/test-runner 0.2.7 → 0.3.0

package/CLAUDE.md

@@ -40,7 +40,8 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 | `runFuzzCheck({ endpoint, baseUrl, headers? })` | Single-endpoint crash-resistance fuzz | → docs/fuzz-tests.md |
 | `runFuzzTests({ apiMethodMap, baseUrl, skip?, headers?, onResult? })` | Sweep fuzz layer (nightly CI) | → docs/fuzz-tests.md |
 | `resetServerState({ baseUrl, token? })` | POST naar `/_test/reset` om DB+Redis schoon te maken | → docs/rate-limit-tests.md |
-| `sampleSchemaInput(schema)` | Genereert Zod-valid sample payload uit een schema | → docs/contract-tests.md |
+| `sampleSchemaInput(schema, options?)` | Genereert Zod-valid sample payload uit een schema. `options.stringPrefix` tagt UNCONSTRAINED strings (finding #98) — format/checked strings blijven ongeprefixt zodat ze valid blijven. | → docs/contract-tests.md |
+| `createTestDataMarker()` / `TEST_DATA_PREFIX` | Run-unique `lstest_<uuid>_` marker (+ vaste `lstest_` prefix-constant) waarmee `runAllTests` gegenereerde test-strings identificeerbaar maakt. | → docs/contract-tests.md |
 | `logContractResult(result)` | Pretty-print één `ContractCheckResult` | → docs/extension-hooks.md |
 | `logContractSummary(summary)` | Pretty-print aggregate `RunContractSummary` | → docs/extension-hooks.md |
 | `registerTestLayer(layer)` | Plug-in custom test-layer (CORS, business rules, multi-tenant) | → docs/extension-hooks.md |
@@ -79,13 +80,14 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 - `TEST_RESET_TOKEN` (env, optional, server-side) — wanneer gezet moet `resetServerState({ token })` deze meesturen als `X-Test-Reset-Token`. Verplicht voor staging/preview deploys die het endpoint over het netwerk exposen.
 - `RunRateLimitTestsInput.maxRateLimitToTest` (default `50`) — endpoints met hogere `rateLimit` worden geskipt om duizenden requests in CI te vermijden.
 - `RunRateLimitTestsInput.resetBetweenEndpoints` (default `false`) — hit `/_test/reset` voor elke endpoint zodat het shared IP-bucket schoon is.
+- `RunAllTestsInput.resetBookends` (default `true` wanneer een reset-token beschikbaar is) — POST `/_test/reset` één keer vóór en één keer ná de auto-sweep (finding #98: clean slate + cleanup zodat geen echte rows worden geëdit en geen `lstest_*` testdata achterblijft). Zonder token (`resetToken`/`TEST_RESET_TOKEN`) worden de bookends met een logregel geskipt, niet gefaald.
 - `registerTestLayer({ name, run })` — custom check per endpoint (CORS, business rules, custom auth-schemes, multi-tenant isolation).
 - `registerTestFixture(typeKey, { valid, invalid })` — realistic payloads die de fuzz layer prefereert boven schema-random.
 - `registerTestReporter({ onResult?, onSummary?, webhookUrl?, webhookAuth? })` — wire per-result/per-summary callbacks of POST de summary naar een webhook.
 
 ## Peer dependencies
 
-- **Required**: `zod@^4.0.0` (peer), `socket.io-client@^4.8.0` (peer — `streamWatcher.ts` opent een tweede socket voor `ctx.watchStream`), `@luckystack/core@^0.1.0` (dependency — leest `getApiMethodMapPath()` voor de default map-locatie).
+- **Required**: `zod@^4.0.0` (peer), `socket.io-client@^4.8.0` (peer — `streamWatcher.ts` opent een tweede socket voor `ctx.watchStream`), `@luckystack/core@^0.1.0` (dependency — levert de helpers die de runner consumeert: `tryCatch`/`tryCatchSync`, `getProjectConfig`/`getCsrfConfig`, `getSrcDir` (default src-dir voor custom-test discovery in `customTests.ts`), `getPrismaClient` (Layer-5 `ctx.prisma`) en `clearAllRateLimits`. De `apiMethodMap` zelf wordt door de consumer als argument doorgegeven, niet uit een pad gelezen).
 - **Required server-side**: `@luckystack/server` met `/_test/reset` endpoint gemount (default ingebouwd, gated op `NODE_ENV !== 'production'`).
 - **Required generated artefact**: `apiMethodMap.generated.ts` (en `apiMetaMap.generated.ts` voor de auth/rate-limit layers), geproduceerd door `@luckystack/devkit`.
 - **Optional**: geen — fixtures, reporters en custom layers zijn pure-JS opt-in.

package/dist/index.d.ts

@@ -9,6 +9,7 @@ interface ApiMetaEntry {
     auth: {
         login: boolean;
         additional?: Record<string, unknown>[];
+        hasAdditional?: boolean;
     };
     rateLimit?: number | false;
 }
@@ -122,9 +123,10 @@ interface RunRateLimitTestsInput {
     maxRateLimitToTest?: number;
     /**
      * When true, hit `/_test/reset` before each endpoint so limiter state is
-     * clean. Requires the server to allow the endpoint (NODE_ENV !== production
-     * or `TEST_RESET_TOKEN` configured). Without resetting, the shared IP bucket
-     * leaks state between endpoints.
+     * clean. Requires the server to allow the endpoint: `NODE_ENV` in
+     * { 'development', 'test' } AND `TEST_RESET_TOKEN` set on the server with a
+     * matching `resetToken` here (an unset token is 403, never open). Without
+     * resetting, the shared IP bucket leaks state between endpoints.
      */
     resetBetweenEndpoints?: boolean;
     /**
@@ -197,7 +199,20 @@ interface ResetServerStateInput {
 }
 declare const resetServerState: ({ baseUrl, token, requestTimeoutMs }: ResetServerStateInput) => Promise<boolean>;
 
-declare const sampleSchemaInput: (schema: z.ZodType) => unknown;
+interface SampleSchemaOptions {
+    /**
+     * Marker prefix applied to generated UNCONSTRAINED string values so any rows
+     * a sweep creates are identifiable + collision-free (finding #98). Strings
+     * that carry a format (email/url/uuid/datetime/…) or a check (min/max/
+     * length/regex) are left as-is, since prefixing could break the route's own
+     * validation and defeat the contract layer's "valid input" guarantee.
+     */
+    stringPrefix?: string;
+}
+declare const sampleSchemaInput: (schema: z.ZodType, options?: SampleSchemaOptions) => unknown;
+
+declare const TEST_DATA_PREFIX = "lstest_";
+declare const createTestDataMarker: () => string;
 
 declare const logContractResult: (result: ContractCheckResult) => void;
 declare const logContractSummary: (summary: RunContractSummary) => void;
@@ -346,7 +361,7 @@ interface RunAllTestsInput {
     apiMetaMap: ApiMetaMap;
     apiInputSchemas: ApiInputSchemas;
     baseUrl: string;
-    /** Cookie name for the session token. Defaults to `luckystack_token`. */
+    /** Cookie name for the session token. Defaults to the project's configured session cookie name (`projectConfig.http.sessionCookieName`). */
     sessionCookieName?: string;
     /** Auth token applied as a `Cookie` header to sweep-layer requests that need a session. */
     authToken?: string;
@@ -365,6 +380,24 @@ interface RunAllTestsInput {
      */
     noCsrf?: boolean;
     noCustom?: boolean;
+    /**
+     * Token sent as `X-Test-Reset-Token` when the rate-limit layer resets the
+     * shared bucket between endpoints. The server's `/_test/reset` requires
+     * `TEST_RESET_TOKEN` to be set and matching — an unset/wrong token is 403, so
+     * `resetBetweenEndpoints` would silently no-op. Defaults to
+     * `process.env.TEST_RESET_TOKEN` so a CI run with the env set works with no
+     * extra wiring; pass explicitly to override.
+     */
+    resetToken?: string;
+    /**
+     * Contract-test mutation safety (finding #98). When a reset token is
+     * available, the sweep POSTs `/_test/reset` ONCE before the first layer
+     * (clean slate — no real row the generated payloads could clobber) and ONCE
+     * after the last (drop whatever the sweep created, so no test data persists).
+     * Defaults to ON; set `false` to opt out. With no token the bookends are
+     * silently skipped with a logged note (they can't run — `/_test/reset` 403s).
+     */
+    resetBookends?: boolean;
 }
 interface RunAllTestsSummary {
     contract?: RunContractSummary;
@@ -456,6 +489,18 @@ declare const registerTestReporter: (newReporter: TestReporter | null) => void;
 declare const getTestReporter: () => TestReporter | null;
 declare const resetTestExtensionsForTests: () => void;
 
+interface RunRegisteredLayersInput {
+    apiMethodMap: ApiMethodMap$1;
+    /** Session/bearer token forwarded to each layer's `run({ authToken })`. */
+    authToken?: string;
+    /**
+     * Endpoints to skip — matched against `<page>/<name>` (version-agnostic) and
+     * `<page>/<name>/<version>`, same convention as the built-in sweeps.
+     */
+    skip?: string[];
+}
+declare const runRegisteredLayers: (input: RunRegisteredLayersInput) => Promise<TestSummary>;
+
 declare const LAYER_KEYS: {
     readonly contract: "contract";
     readonly auth: "auth-enforcement";
@@ -465,4 +510,4 @@ declare const LAYER_KEYS: {
     readonly custom: "custom";
 };
 
-export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, LAYER_KEYS, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type StreamChunkFrame, type StreamWatcher, type SyncMethodMap, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, sampleSchemaInput, walkEndpoints, walkSyncEndpoints };
+export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, LAYER_KEYS, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type RunRegisteredLayersInput, type SampleSchemaOptions, type StreamChunkFrame, type StreamWatcher, type SyncMethodMap, TEST_DATA_PREFIX, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, createTestDataMarker, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, runRegisteredLayers, sampleSchemaInput, walkEndpoints, walkSyncEndpoints };

package/dist/index.js

@@ -177,6 +177,10 @@ var requiresLogin = (apiMetaMap, endpoint) => {
   const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
   return meta?.auth?.login ?? false;
 };
+var hasAuthRequirement = (apiMetaMap, endpoint) => {
+  const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
+  return (meta?.auth?.login ?? false) || (meta?.auth?.hasAdditional ?? false);
+};
 var hasMetaEntry = (apiMetaMap, endpoint) => apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version] !== void 0;
 var getRateLimit = (apiMetaMap, endpoint) => {
   const meta = apiMetaMap[endpoint.page]?.[endpoint.name]?.[endpoint.version];
@@ -222,7 +226,7 @@ var runContractTests = async (input) => {
 
 // src/authEnforcementCheck.ts
 var DEFAULT_REQUEST_TIMEOUT_MS2 = 5e3;
-var EXPECTED_ERROR_CODE = "auth.required";
+var EXPECTED_ERROR_CODES = /* @__PURE__ */ new Set(["auth.required", "auth.forbidden"]);
 var runAuthEnforcementCheck = async (input) => {
   const { endpoint, baseUrl } = input;
   const url = `${baseUrl.replace(/\/$/, "")}/${endpoint.fullPath}`;
@@ -265,14 +269,14 @@ var runAuthEnforcementCheck = async (input) => {
       durationMs
     };
   }
-  if (parsed.errorCode !== EXPECTED_ERROR_CODE) {
+  if (parsed.errorCode === void 0 || !EXPECTED_ERROR_CODES.has(parsed.errorCode)) {
     return {
       endpoint,
       status: "fail",
       httpStatus,
       responseStatus: "error",
       errorCode: parsed.errorCode,
-      reason: `expected errorCode '${EXPECTED_ERROR_CODE}' but got '${parsed.errorCode ?? "(missing)"}'`,
+      reason: `expected an auth-rejection errorCode (${[...EXPECTED_ERROR_CODES].join(" | ")}) but got '${parsed.errorCode ?? "(missing)"}'`,
       durationMs
     };
   }
@@ -292,7 +296,7 @@ var runAuthEnforcementTests = async (input) => {
   const skip = input.skip ?? [];
   const results = [];
   for (const endpoint of endpoints) {
-    if (!requiresLogin(input.apiMetaMap, endpoint)) {
+    if (!hasAuthRequirement(input.apiMetaMap, endpoint)) {
       continue;
     }
     if (shouldSkip(endpoint, skip)) {
@@ -319,16 +323,11 @@ var runAuthEnforcementTests = async (input) => {
 
 // src/rateLimitCheck.ts
 var DEFAULT_REQUEST_TIMEOUT_MS3 = 1e4;
-var EXPECTED_ERROR_CODE2 = "api.rateLimitExceeded";
+var EXPECTED_ERROR_CODE = "api.rateLimitExceeded";
 var PRE_LIMITER_ERROR_CODES = /* @__PURE__ */ new Set([
   "auth.required",
-  "auth.csrfTokenMissing",
-  "auth.csrfTokenInvalid",
-  "auth.unauthorized",
-  "api.csrfTokenMissing",
-  "api.csrfTokenInvalid",
-  "api.unauthorized",
-  "api.validationError"
+  "auth.forbidden",
+  "auth.csrfMismatch"
 ]);
 var runRateLimitCheck = async (input) => {
   const { endpoint, baseUrl, rateLimit } = input;
@@ -368,7 +367,7 @@ var runRateLimitCheck = async (input) => {
     };
   }
   const { httpStatus, parsed } = final;
-  if (parsed?.status === "error" && parsed.errorCode === EXPECTED_ERROR_CODE2) {
+  if (parsed?.status === "error" && parsed.errorCode === EXPECTED_ERROR_CODE) {
     return {
       endpoint,
       status: "pass",
@@ -385,16 +384,16 @@ var runRateLimitCheck = async (input) => {
     httpStatus,
     responseStatus,
     errorCode: parsed?.errorCode,
-    reason: `expected '${EXPECTED_ERROR_CODE2}' on request ${rateLimit + 1} but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
+    reason: `expected '${EXPECTED_ERROR_CODE}' on request ${rateLimit + 1} but got ${parsed?.status ?? "none"}/${parsed?.errorCode ?? "(none)"}`,
     durationMs
   };
 };
 
 // src/resetServerState.ts
-import { tryCatch as tryCatch2 } from "@luckystack/core";
+import { getProjectConfig, tryCatch as tryCatch2 } from "@luckystack/core";
 var DEFAULT_REQUEST_TIMEOUT_MS4 = 1e4;
 var resetServerState = async ({ baseUrl, token, requestTimeoutMs }) => {
-  const url = `${baseUrl.replace(/\/$/, "")}/_test/reset`;
+  const url = `${baseUrl.replace(/\/$/, "")}${getProjectConfig().http.testResetEndpoint}`;
   const headers = { "Content-Type": "application/json" };
   if (token) headers["X-Test-Reset-Token"] = token;
   const controller = new AbortController();
@@ -686,12 +685,14 @@ var runFuzzTests = async (input) => {
 
 // src/schemaSampleInput.ts
 var innerDef = (node) => node ? node.def ?? node._def : void 0;
-var sampleForDef = (def) => {
+var sampleForDef = (def, options) => {
   const d = def;
   const name = d.typeName ?? d.type;
   switch (name) {
     case "ZodString":
     case "string": {
+      const isConstrained = Boolean(d.format) || d.check === "string_format" || Array.isArray(d.checks) && d.checks.length > 0;
+      if (options?.stringPrefix && !isConstrained) return `${options.stringPrefix}test`;
       return "test";
     }
     case "ZodNumber":
@@ -742,7 +743,7 @@ var sampleForDef = (def) => {
     case "default":
     case "ZodCatch":
     case "catch": {
-      return sampleForDef(innerDef(d.innerType));
+      return sampleForDef(innerDef(d.innerType), options);
     }
     case "ZodEffects":
     case "effects":
@@ -752,18 +753,18 @@ var sampleForDef = (def) => {
     case "branded":
     case "ZodReadonly":
     case "readonly": {
-      return sampleForDef(innerDef(d.schema ?? d.in ?? d.innerType));
+      return sampleForDef(innerDef(d.schema ?? d.in ?? d.innerType), options);
     }
     case "ZodTuple":
     case "tuple": {
       const items = d.items ?? [];
-      return items.map((item) => sampleForDef(innerDef(item)));
+      return items.map((item) => sampleForDef(innerDef(item), options));
     }
     case "ZodUnion":
     case "union":
     case "ZodDiscriminatedUnion":
     case "discriminatedUnion": {
-      return d.options && d.options.length > 0 && d.options[0] ? sampleForDef(innerDef(d.options[0])) : void 0;
+      return d.options && d.options.length > 0 && d.options[0] ? sampleForDef(innerDef(d.options[0]), options) : void 0;
     }
     case "ZodArray":
     case "array": {
@@ -774,7 +775,7 @@ var sampleForDef = (def) => {
       const out = {};
       const shape = typeof d.shape === "function" ? d.shape() : d.shape ?? {};
       for (const [key, valueSchema] of Object.entries(shape)) {
-        const sample = sampleForDef(innerDef(valueSchema));
+        const sample = sampleForDef(innerDef(valueSchema), options);
         if (sample !== void 0) out[key] = sample;
       }
       return out;
@@ -792,11 +793,16 @@ var sampleForDef = (def) => {
     }
   }
 };
-var sampleSchemaInput = (schema) => {
+var sampleSchemaInput = (schema, options) => {
   const node = schema;
-  return sampleForDef(node.def ?? node._def);
+  return sampleForDef(node.def ?? node._def, options);
 };
 
+// src/testDataMarker.ts
+import { randomUUID } from "crypto";
+var TEST_DATA_PREFIX = "lstest_";
+var createTestDataMarker = () => `${TEST_DATA_PREFIX}${randomUUID().slice(0, 8)}_`;
+
 // src/reporter.ts
 var statusIcon = (status) => {
   switch (status) {
@@ -845,7 +851,7 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import { pathToFileURL } from "url";
-import { getCsrfConfig, getPrismaClient, getProjectConfig, getSrcDir, tryCatch as tryCatch4, tryCatchSync } from "@luckystack/core";
+import { getCsrfConfig, getPrismaClient, getProjectConfig as getProjectConfig2, getSrcDir, tryCatch as tryCatch4, tryCatchSync } from "@luckystack/core";
 
 // src/streamWatcher.ts
 import { io as createSocketIoClient } from "socket.io-client";
@@ -1174,7 +1180,7 @@ var buildCallSync = (baseUrl, routePath, state, cookieName) => {
   };
 };
 var buildContext = (discovery, input) => {
-  const cookieName = input.sessionCookieName ?? getProjectConfig().http.sessionCookieName;
+  const cookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
   const routePath = `${discovery.route.page}/${discovery.route.name}/${discovery.route.version}`;
   const routeFullName = `sync/${routePath}`;
   const apiMethod = input.apiMethodMap?.[discovery.route.page]?.[discovery.route.name]?.[discovery.route.version] ?? "POST";
@@ -1297,10 +1303,21 @@ var runCustomTests = async (input) => {
 };
 
 // src/runAllTests.ts
-import { clearAllRateLimits, getCsrfConfig as getCsrfConfig2, getProjectConfig as getProjectConfig2 } from "@luckystack/core";
-var inputForEndpoint = (apiInputSchemas) => (endpoint) => {
+import { clearAllRateLimits, getCsrfConfig as getCsrfConfig2, getProjectConfig as getProjectConfig3 } from "@luckystack/core";
+var inputForEndpoint = (apiInputSchemas, stringPrefix) => (endpoint) => {
   const schema = apiInputSchemas[endpoint.page]?.[endpoint.name]?.[endpoint.version];
-  return schema ? sampleSchemaInput(schema) : {};
+  return schema ? sampleSchemaInput(schema, { stringPrefix }) : {};
+};
+var resolveResetBookendToken = (input) => {
+  if (input.resetBookends === false) return null;
+  const token = input.resetToken ?? process.env.TEST_RESET_TOKEN;
+  if (!token) {
+    console.warn(
+      "[test-runner] runAllTests: reset bookends skipped \u2014 no reset token (set TEST_RESET_TOKEN or pass resetToken/resetBookends). /_test/reset requires it, so the clean-slate + cleanup resets around the sweep are skipped."
+    );
+    return null;
+  }
+  return token;
 };
 var matchesFilter = (endpoint, filter) => {
   if (!filter) return true;
@@ -1314,7 +1331,7 @@ var cloneSummary = (summary, filter) => {
 var buildAuthHeaders = async (input) => {
   const headers = {};
   if (!input.authToken) return headers;
-  const cookieName = input.sessionCookieName ?? getProjectConfig2().http.sessionCookieName;
+  const cookieName = input.sessionCookieName ?? getProjectConfig3().http.sessionCookieName;
   headers.Cookie = `${cookieName}=${input.authToken}`;
   try {
     const { getSession } = await import("@luckystack/login");
@@ -1332,6 +1349,10 @@ var buildAuthHeaders = async (input) => {
   return headers;
 };
 var runSweepLayers = async (input, summary, headers, inputFor) => {
+  const resetBookendToken = resolveResetBookendToken(input);
+  if (resetBookendToken) {
+    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken });
+  }
   const contract = await runContractTests({
     apiMethodMap: input.apiMethodMap,
     baseUrl: input.baseUrl,
@@ -1358,9 +1379,13 @@ var runSweepLayers = async (input, summary, headers, inputFor) => {
       inputFor,
       //? Reset the shared per-IP rate-limit bucket between endpoints so a
       //? neighbour saturating the window doesn't cause false pass/fail on the
-      //? next endpoint. Requires the server to expose /_test/reset (allowed in
-      //? NODE_ENV !== production or behind TEST_RESET_TOKEN).
-      resetBetweenEndpoints: true
+      //? next endpoint. Requires the server to expose /_test/reset (NODE_ENV in
+      //? { 'development', 'test' } AND TEST_RESET_TOKEN set + matching header).
+      resetBetweenEndpoints: true,
+      //? Thread the reset token (explicit input, else the TEST_RESET_TOKEN env the
+      //? server validates against) — without it `/_test/reset` returns 403 and the
+      //? between-endpoint reset silently never happens.
+      resetToken: input.resetToken ?? process.env.TEST_RESET_TOKEN
     });
     summary.rateLimit = cloneSummary(rateLimit, input.filter);
   }
@@ -1384,6 +1409,9 @@ var runSweepLayers = async (input, summary, headers, inputFor) => {
     });
     summary.fuzz = cloneSummary(fuzz, input.filter);
   }
+  if (resetBookendToken) {
+    await resetServerState({ baseUrl: input.baseUrl, token: resetBookendToken });
+  }
 };
 var runCustomLayer = async (input, summary) => {
   try {
@@ -1437,7 +1465,7 @@ var runAllTests = async (input) => {
     }
   }
   const headers = await buildAuthHeaders(input);
-  const inputFor = inputForEndpoint(input.apiInputSchemas);
+  const inputFor = inputForEndpoint(input.apiInputSchemas, createTestDataMarker());
   if (!input.noSweep) {
     await runSweepLayers(input, summary, headers, inputFor);
   }
@@ -1559,8 +1587,79 @@ var resetTestExtensionsForTests = () => {
   fixtures.clear();
   reporter = null;
 };
+
+// src/runRegisteredLayers.ts
+import { tryCatch as tryCatch5, tryCatchSync as tryCatchSync2 } from "@luckystack/core";
+var isLoopbackHost = (host) => host === "localhost" || host === "::1" || host === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(host);
+var postWebhook = async (summary) => {
+  const reporter2 = getTestReporter();
+  const webhookUrl = reporter2?.webhookUrl;
+  if (!reporter2 || !webhookUrl) return;
+  const [, parsedUrl] = tryCatchSync2(() => new URL(webhookUrl));
+  if (parsedUrl?.protocol === "http:" && !isLoopbackHost(parsedUrl.hostname)) {
+    console.warn(
+      `[test-runner] reporter.webhookUrl is plaintext http to a non-loopback host (${parsedUrl.hostname}); the summary (endpoint paths, error codes, metadata) and any bearer token are sent unencrypted.`
+    );
+  }
+  const headers = { "Content-Type": "application/json" };
+  if (reporter2.webhookAuth?.type === "bearer") headers.Authorization = `Bearer ${reporter2.webhookAuth.token}`;
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => {
+    controller.abort();
+  }, 1e4);
+  await tryCatch5(() => fetch(webhookUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(summary),
+    signal: controller.signal
+  }));
+  clearTimeout(timeoutHandle);
+};
+var runRegisteredLayers = async (input) => {
+  const layers2 = listTestLayers();
+  const endpoints = walkEndpoints(input.apiMethodMap);
+  const reporter2 = getTestReporter();
+  const skip = input.skip ?? [];
+  const results = [];
+  for (const layer of layers2) {
+    for (const endpoint of endpoints) {
+      if (shouldSkip(endpoint, skip)) continue;
+      const started = Date.now();
+      const [runError, layerResult] = await tryCatch5(async () => layer.run({ endpoint: endpoint.fullPath, method: endpoint.method, authToken: input.authToken }));
+      const durationMs = Date.now() - started;
+      const result = runError || !layerResult ? {
+        layer: layer.name,
+        endpoint: endpoint.fullPath,
+        passed: false,
+        message: runError?.message ?? "layer returned no result",
+        durationMs
+      } : {
+        layer: layer.name,
+        endpoint: endpoint.fullPath,
+        passed: layerResult.passed,
+        message: layerResult.message,
+        durationMs,
+        metadata: layerResult.metadata
+      };
+      results.push(result);
+      await tryCatch5(async () => reporter2?.onResult?.(result));
+    }
+  }
+  const summary = {
+    totalLayers: layers2.length,
+    totalEndpoints: endpoints.length,
+    passed: results.filter((r) => r.passed).length,
+    failed: results.filter((r) => !r.passed).length,
+    results
+  };
+  await tryCatch5(async () => reporter2?.onSummary?.(summary));
+  await postWebhook(summary);
+  return summary;
+};
 export {
   LAYER_KEYS,
+  TEST_DATA_PREFIX,
+  createTestDataMarker,
   discoverCustomTestFiles,
   getTestFixture,
   getTestReporter,
@@ -1586,6 +1685,7 @@ export {
   runFuzzTests,
   runRateLimitCheck,
   runRateLimitTests,
+  runRegisteredLayers,
   sampleSchemaInput,
   walkEndpoints,
   walkSyncEndpoints