@nano133/nanoterra 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.10.1 (2026-11-01)
+
+- **The admin conformance suite's heavy checks are one case for each route.** "Other spellings of EVERY admin path" and "a request from another
+  page" were each one case over every route, every visitor and every method: hundreds of requests, which timed out at the starter's 30 s under load
+  and even alone on a game with more routes (the prompt pack's Echo Island runs). They are now "other spellings of GET /api/admin/summary ..." and
+  "a request from another page to GET /api/admin/summary ...", one for each route; the checks are the same. `ConformanceCase` has an optional
+  `timeoutMs`, and the heavy cases (these two and "OPTIONS and HEAD") set it to the new `HEAVY_CASE_MS` (120 s): pass it to the runner,
+  `it(c.name, c.run, c.timeoutMs)`.
+- README: a test of the shop's sheet clicks a slot's tab (`.n133s-tab`) before it looks for that slot's looks, or calls `buy(lookId)`.
+
 ## 0.10.0 (2026-11-01)
 
 - **No minimum price: a fraction of a cent works.** A look's `priceUsd` may have up to 4 decimals (`0.005` is half a cent, `0.0001` the smallest price

package/README.md

@@ -544,9 +544,13 @@ and your defaults when the store fails.
 import { adminConformance } from "@nano133/nanoterra/admin/conformance";
 
 const host = { routes: admin.routes, basePath: admin.basePath, origin: "https://game.example", request: (who, req) => sendAs(who, req) };
-for (const c of adminConformance(host)) it(c.name, c.run);   // vitest, node:test or any runner
+for (const c of adminConformance(host)) it(c.name, c.run, c.timeoutMs);   // vitest; node:test: test(c.name, { timeout: c.timeoutMs }, c.run)
 ```
 
+Pass `c.timeoutMs`: the heavy cases (other spellings of a path, a request from another page, OPTIONS and HEAD) each send every visitor with every
+method, a few hundred requests, and say they may need `HEAVY_CASE_MS` (120 s) on a slow machine. They are one case for each route (since 0.10.1),
+so a game with many routes has many short cases, not one long one.
+
 `sendAs(who, req)` makes a request as one of eleven visitors from YOUR sessions: `signed_out`; `game_login` (a login made for your players, which must NOT open the admin);
 `game_token_as_admin` (the token of that player login put in the ADMIN cookie: your store must keep the two scopes apart, not only the cookie names); `nanoterra_login`;
 `unknown_via_login` (an admin login whose `via` is a word you do not know, like `"ticket"`: it must fail closed); `other_wallet`; `no_address`;
@@ -1318,7 +1322,9 @@ const shop = mountShop(document.getElementById("shop")!, {
 ```
 
 - The looks sheet: a tab for each wear slot (the outfits first) when the game sells items, each look with its price before any step; Wear,
-  Wearing, or Buy. `picture(look)` gives the game's own picture instead of the swatch.
+  Wearing, or Buy. `picture(look)` gives the game's own picture instead of the swatch. **For a test:** the sheet opens on the first tab (the
+  outfits), so the looks of another slot ("Shirts", "Hats") are not in the page until the test clicks their tab (`.n133s-tab`); or the test
+  calls `buy(lookId)`, which needs no tab.
 - Buy: the game's sign-in (`signIn`) when nobody is signed in, then the person check, then the pay sheet: the amount, the QR code of the exact
   `nano:` link (drawn by the package as SVG: no QR library, no outside service), "Open wallet", the address and the amount by hand, the time
   left (live only), and a check every 5 seconds for 2 minutes ("Check again" after). Paid: "Paid. Thank you!" and `onOwned`. Paid late: no look,

package/dist/admin/conformance.d.ts

@@ -51,10 +51,17 @@ export type ConformanceHost = {
     /** Optional but recommended. Ends the login of the last request of this kind with the game's OWN sign-out (the real route): the suite then uses the same login again and requires a refusal. */
     endLogin?(who: Who): Promise<void>;
 };
+/**
+ * One test case. `timeoutMs`, when set, is the time the case may need on a slow machine (each heavy case sends a few hundred requests to the game):
+ * pass it to the runner, `it(c.name, c.run, c.timeoutMs)` (vitest) or `test(c.name, { timeout: c.timeoutMs }, c.run)` (node:test).
+ */
 export type ConformanceCase = {
     name: string;
     run: () => Promise<void>;
+    timeoutMs?: number;
 };
+/** The time a heavy case may take (every visitor, every method, many spellings or origins of one route). */
+export declare const HEAVY_CASE_MS = 120000;
 export declare function adminConformance(host: ConformanceHost): ConformanceCase[];
 /** What a test gives to run the store contract: the store, and a way to put rows in the game's database the way the game's own code does (the store has no write for them). */
 export type StoreHarness = {

package/dist/admin/conformance.js

@@ -8,6 +8,8 @@
 // `host.request(who, ...)` sends the request as that kind of visitor. The game makes each kind from its own sessions (see `Who`). The suite asks
 // only for statuses and for the words "reason" and "error"; it never reads a cookie.
 import { ORDERS_SHOWN } from "./summary.js";
+/** The time a heavy case may take (every visitor, every method, many spellings or origins of one route). */
+export const HEAVY_CASE_MS = 120_000;
 const REFUSALS = [
     { who: "signed_out", status: 401, words: "a visitor who is signed out" },
     { who: "game_login", status: 401, words: "a login that was made for the game's players" },
@@ -43,7 +45,7 @@ const REFUSAL_KEYS = new Set(["error", "reason", "signedInAs"]);
 const DATA_WORDS = /"orders"|"players"|"totals"|"counts"|"character"|"signin"|"friends"|"emotes"|"warnings"/;
 export function adminConformance(host) {
     const cases = [];
-    const add = (name, run) => cases.push({ name, run });
+    const add = (name, run, timeoutMs) => cases.push(timeoutMs ? { name, run, timeoutMs } : { name, run });
     const good = (extra = {}) => ({ Origin: host.origin, "Content-Type": "application/json", ...extra });
     const body = (r) => (r.method === "POST" ? "{}" : undefined);
     const NOT_OWNER = REFUSALS.map((r) => r.who);
@@ -86,7 +88,7 @@ export function adminConformance(host) {
                 }
             }
         }
-    });
+    }, HEAVY_CASE_MS);
     add("an unknown path under the base is refused like any admin path (so the routes are not leaked): the same refusal for a visitor, 404 for the owner", async () => {
         const path = `${host.basePath}/no-such-page`;
         for (const r of REFUSALS) {
@@ -124,13 +126,10 @@ export function adminConformance(host) {
             `${base.replace(/^\/(\w)/, (_, c) => `/%${c.charCodeAt(0).toString(16)}`)}/${last}`,
         ];
     };
-    add("other spellings of EVERY admin path never open anything for a visitor, with any method", async () => {
-        const seen = new Set();
-        for (const route of host.routes) {
-            for (const path of spellings(route.path)) {
-                if (seen.has(path))
-                    continue;
-                seen.add(path);
+    // One case for each route (not one for all of them): each sends every visitor with every method, so a game with many routes stays inside a runner's time.
+    for (const route of host.routes) {
+        add(`other spellings of ${route.method} ${route.path} never open anything for a visitor, with any method`, async () => {
+            for (const path of new Set(spellings(route.path))) {
                 for (const who of NOT_OWNER) {
                     for (const method of new Set([route.method, "GET", "POST", "OPTIONS", "HEAD"])) {
                         const got = await read(await send(who, { method, path, headers: good(), body: body({ method }) }, false));
@@ -139,13 +138,13 @@ export function adminConformance(host) {
                     }
                 }
             }
-        }
-    });
-    add("a request from another page never gets a CORS header, and never the data: a foreign Origin (another site, 'null', a sibling subdomain) on every route, with every method, for the owner and for every visitor", async () => {
-        const own = new URL(host.origin);
-        const origins = ["https://evil.example", "null", `${own.protocol}//evil.${own.host}`, `${own.protocol}//${own.host.replace(/^[^.]+\./, "sibling.")}`, `${own.protocol}//${own.host}.evil.example`];
-        const WHO = ["owner", ...NOT_OWNER];
-        for (const route of host.routes) {
+        }, HEAVY_CASE_MS);
+    }
+    const own = new URL(host.origin);
+    const origins = ["https://evil.example", "null", `${own.protocol}//evil.${own.host}`, `${own.protocol}//${own.host.replace(/^[^.]+\./, "sibling.")}`, `${own.protocol}//${own.host}.evil.example`];
+    const WHO = ["owner", ...NOT_OWNER];
+    for (const route of host.routes) {
+        add(`a request from another page to ${route.method} ${route.path} never gets a CORS header, and never the data: a foreign Origin (another site, 'null', a sibling subdomain), with every method, for the owner and for every visitor`, async () => {
             for (const origin of origins) {
                 for (const who of WHO) {
                     for (const method of new Set([route.method, "GET", "OPTIONS", "HEAD"])) {
@@ -161,8 +160,8 @@ export function adminConformance(host) {
                 const got = await read(await send("owner", { method: route.method, path: route.path, headers: { "Sec-Fetch-Site": site, "Content-Type": "application/json" }, body: body(route) }));
                 check(got.status === 403, `${route.method} ${route.path} as owner with Sec-Fetch-Site ${site}: expected 403, got ${got.status}`);
             }
-        }
-    });
+        }, HEAVY_CASE_MS);
+    }
     add("an old login that is still valid in the store is refused EVERY time it is used, not only the first: a game must not renew a login on each read", async () => {
         for (const route of host.routes) {
             for (const again of [false, true, true]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano133/nanoterra",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Nanoterra for a creator's game, in one package: the player's sign-in ticket, the player's character (a toon body on the island's skeleton), the looks ladder, the admin, the friends list, an options menu, emotes, the player's sign-in (a passkey or a wallet app) and a shop that sells looks for Nano with no key on the server.",
   "type": "module",
   "main": "dist/index.js",

package/src/admin/conformance.ts

@@ -62,7 +62,14 @@ export type ConformanceHost = {
   endLogin?(who: Who): Promise<void>;
 };
 
-export type ConformanceCase = { name: string; run: () => Promise<void> };
+/**
+ * One test case. `timeoutMs`, when set, is the time the case may need on a slow machine (each heavy case sends a few hundred requests to the game):
+ * pass it to the runner, `it(c.name, c.run, c.timeoutMs)` (vitest) or `test(c.name, { timeout: c.timeoutMs }, c.run)` (node:test).
+ */
+export type ConformanceCase = { name: string; run: () => Promise<void>; timeoutMs?: number };
+
+/** The time a heavy case may take (every visitor, every method, many spellings or origins of one route). */
+export const HEAVY_CASE_MS = 120_000;
 
 const REFUSALS: { who: Who; status: number; reason?: string; words: string }[] = [
   { who: "signed_out", status: 401, words: "a visitor who is signed out" },
@@ -101,7 +108,7 @@ const DATA_WORDS = /"orders"|"players"|"totals"|"counts"|"character"|"signin"|"f
 
 export function adminConformance(host: ConformanceHost): ConformanceCase[] {
   const cases: ConformanceCase[] = [];
-  const add = (name: string, run: () => Promise<void>) => cases.push({ name, run });
+  const add = (name: string, run: () => Promise<void>, timeoutMs?: number) => cases.push(timeoutMs ? { name, run, timeoutMs } : { name, run });
   const good = (extra: Record<string, string> = {}) => ({ Origin: host.origin, "Content-Type": "application/json", ...extra });
   const body = (r: { method: string }) => (r.method === "POST" ? "{}" : undefined);
   const NOT_OWNER = REFUSALS.map((r) => r.who);
@@ -145,7 +152,7 @@ export function adminConformance(host: ConformanceHost): ConformanceCase[] {
         }
       }
     }
-  });
+  }, HEAVY_CASE_MS);
 
   add("an unknown path under the base is refused like any admin path (so the routes are not leaked): the same refusal for a visitor, 404 for the owner", async () => {
     const path = `${host.basePath}/no-such-page`;
@@ -187,12 +194,10 @@ export function adminConformance(host: ConformanceHost): ConformanceCase[] {
     ];
   };
 
-  add("other spellings of EVERY admin path never open anything for a visitor, with any method", async () => {
-    const seen = new Set<string>();
-    for (const route of host.routes) {
-      for (const path of spellings(route.path)) {
-        if (seen.has(path)) continue;
-        seen.add(path);
+  // One case for each route (not one for all of them): each sends every visitor with every method, so a game with many routes stays inside a runner's time.
+  for (const route of host.routes) {
+    add(`other spellings of ${route.method} ${route.path} never open anything for a visitor, with any method`, async () => {
+      for (const path of new Set(spellings(route.path))) {
         for (const who of NOT_OWNER) {
           for (const method of new Set([route.method, "GET", "POST", "OPTIONS", "HEAD"])) {
             const got = await read(await send(who, { method, path, headers: good(), body: body({ method }) }, false));
@@ -201,14 +206,14 @@ export function adminConformance(host: ConformanceHost): ConformanceCase[] {
           }
         }
       }
-    }
-  });
+    }, HEAVY_CASE_MS);
+  }
 
-  add("a request from another page never gets a CORS header, and never the data: a foreign Origin (another site, 'null', a sibling subdomain) on every route, with every method, for the owner and for every visitor", async () => {
-    const own = new URL(host.origin);
-    const origins = ["https://evil.example", "null", `${own.protocol}//evil.${own.host}`, `${own.protocol}//${own.host.replace(/^[^.]+\./, "sibling.")}`, `${own.protocol}//${own.host}.evil.example`];
-    const WHO: Who[] = ["owner", ...NOT_OWNER];
-    for (const route of host.routes) {
+  const own = new URL(host.origin);
+  const origins = ["https://evil.example", "null", `${own.protocol}//evil.${own.host}`, `${own.protocol}//${own.host.replace(/^[^.]+\./, "sibling.")}`, `${own.protocol}//${own.host}.evil.example`];
+  const WHO: Who[] = ["owner", ...NOT_OWNER];
+  for (const route of host.routes) {
+    add(`a request from another page to ${route.method} ${route.path} never gets a CORS header, and never the data: a foreign Origin (another site, 'null', a sibling subdomain), with every method, for the owner and for every visitor`, async () => {
       for (const origin of origins) {
         for (const who of WHO) {
           for (const method of new Set([route.method, "GET", "OPTIONS", "HEAD"])) {
@@ -224,8 +229,8 @@ export function adminConformance(host: ConformanceHost): ConformanceCase[] {
         const got = await read(await send("owner", { method: route.method, path: route.path, headers: { "Sec-Fetch-Site": site, "Content-Type": "application/json" }, body: body(route) }));
         check(got.status === 403, `${route.method} ${route.path} as owner with Sec-Fetch-Site ${site}: expected 403, got ${got.status}`);
       }
-    }
-  });
+    }, HEAVY_CASE_MS);
+  }
 
   add("an old login that is still valid in the store is refused EVERY time it is used, not only the first: a game must not renew a login on each read", async () => {
     for (const route of host.routes) {