@oxy.so/core 1.18.0 → 3.0.0

package/src/__tests__/fixEsmImports.test.ts

@@ -1,132 +0,0 @@
-/**
- * `scripts/fix-esm-imports.mjs` must rewrite DYNAMIC relative imports too.
- *
- * ## The failure this exists for, which happened
- *
- * This package writes relative specifiers without an extension — legal under
- * `moduleResolution: bundler`, illegal in Node's ESM resolver — and the
- * post-build script adds the extension back. For its first life the script's
- * pattern was `(?:from|import)\s+['"]`, which cannot match `import('./x')`:
- * the keyword is followed by a parenthesis, not whitespace. Every dynamic
- * import therefore shipped extensionless in `dist/esm`.
- *
- * `OxyServices.getServiceToken()` loads `../server/workloadIdentity` that way
- * to decide whether this process can attest its workload identity (ADR 0026),
- * and it does so inside a `try/catch` that reads any failure as "cannot attest
- * here". So in every ESM consumer of the BUILT package the ADR 0026 fallback
- * was dead, and a service whose task role attests perfectly well was told
- * `Service credentials not provided` — which is what a deployment sees the
- * moment its key pair is removed, and the reason `mention-mcp` and `alia` could
- * not complete the migration while `mention`, `allo` and `alia-integrations`
- * (all CommonJS, where `require()` supplies the extension) already had.
- *
- * ## Why this spawns the real script
- *
- * The defect is in the build OUTPUT, and core's CI job runs jest without
- * building the package, so a test that reads `dist/esm` would pass by finding
- * nothing. `serviceTokenWorkloadFallback.test.ts` cannot catch it either: jest
- * resolves extensionless specifiers, and it mocks that module by name. The one
- * thing that measures the real behaviour without a build is to run the script
- * over a fixture and read what it wrote.
- */
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-
-const script = path.resolve(__dirname, '../../scripts/fix-esm-imports.mjs');
-
-function runOnFixture(files: Record<string, string>): Record<string, string> {
-  const root = mkdtempSync(path.join(tmpdir(), 'oxy-core-esm-fix-'));
-  try {
-    for (const [name, source] of Object.entries(files)) {
-      const full = path.join(root, name);
-      mkdirSync(path.dirname(full), { recursive: true });
-      writeFileSync(full, source);
-    }
-    const result = spawnSync(process.execPath, [script, root], { encoding: 'utf8' });
-    expect(result.status).toBe(0);
-    const out: Record<string, string> = {};
-    for (const name of Object.keys(files)) {
-      out[name] = readFileSync(path.join(root, name), 'utf8');
-    }
-    return out;
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-}
-
-describe('fix-esm-imports', () => {
-  it('adds .js to a dynamic relative import', () => {
-    const out = runOnFixture({
-      'server/workloadIdentity.js': 'export const canAttestWorkloadIdentity = () => true;\n',
-      'mixins/auth.js': [
-        'export async function canUse() {',
-        "  const { canAttestWorkloadIdentity } = await import('../server/workloadIdentity');",
-        '  return canAttestWorkloadIdentity();',
-        '}',
-        '',
-      ].join('\n'),
-    });
-
-    expect(out['mixins/auth.js']).toContain("await import('../server/workloadIdentity.js')");
-  });
-
-  it('rewrites every dynamic import in a file, not only the first', () => {
-    const out = runOnFixture({
-      'server/workloadIdentity.js': 'export const a = 1;\nexport const b = 2;\n',
-      'mixins/auth.js': [
-        "const first = await import('../server/workloadIdentity');",
-        "const second = await import('../server/workloadIdentity');",
-        '',
-      ].join('\n'),
-    });
-
-    const matches = out['mixins/auth.js'].match(/workloadIdentity\.js/g) ?? [];
-    expect(matches).toHaveLength(2);
-    // And nothing was left extensionless.
-    expect(out['mixins/auth.js']).not.toMatch(/workloadIdentity'/);
-  });
-
-  it('tolerates whitespace between the keyword and the parenthesis', () => {
-    const out = runOnFixture({
-      'server/workloadIdentity.js': 'export const a = 1;\n',
-      'mixins/auth.js': "const m = await import(\n  '../server/workloadIdentity'\n);\n",
-    });
-
-    expect(out['mixins/auth.js']).toContain("'../server/workloadIdentity.js'");
-  });
-
-  it('resolves a dynamic directory import to its index', () => {
-    const out = runOnFixture({
-      'server/index.js': 'export const a = 1;\n',
-      'mixins/auth.js': "const m = await import('../server');\n",
-    });
-
-    expect(out['mixins/auth.js']).toContain("'../server/index.js'");
-  });
-
-  it('still rewrites the static forms, and leaves bare and already-suffixed specifiers alone', () => {
-    const out = runOnFixture({
-      'server/workloadIdentity.js': 'export const a = 1;\n',
-      'mixins/auth.js': [
-        "import { a } from '../server/workloadIdentity';",
-        "import '../server/workloadIdentity';",
-        "export { a as b } from '../server/workloadIdentity';",
-        "import { createHash } from 'node:crypto';",
-        "import { z } from 'zod';",
-        "const late = await import('./sibling.js');",
-        '',
-      ].join('\n'),
-      'mixins/sibling.js': 'export const s = 1;\n',
-    });
-
-    const source = out['mixins/auth.js'];
-    expect(source.match(/workloadIdentity\.js/g) ?? []).toHaveLength(3);
-    expect(source).toContain("import { createHash } from 'node:crypto';");
-    expect(source).toContain("import { z } from 'zod';");
-    expect(source).toContain("await import('./sibling.js')");
-    expect(source).not.toContain('sibling.js.js');
-  });
-});

package/src/__tests__/httpServiceAbort.test.ts

@@ -1,308 +0,0 @@
-/**
- * Cancellation and timeout regressions.
- *
- * `HttpService` used to build its `AbortController` INSIDE the function
- * `retryAsync` re-invokes, and link the caller's signal to each new controller
- * with a bare `addEventListener`. Since `abort` is a once-only event, a signal
- * that had already fired could not abort the controller built for attempt 2 —
- * so a request the caller had CANCELLED was re-issued for real. A caller abort
- * also reached the retry predicate as an `AbortError` carrying `status: 0`,
- * which is not 4xx, so the predicate read it as a transient failure worth
- * another try. With the 5s default timeout and 3 retries that is ~28s of work
- * after the caller stopped waiting, inside a request queue ten slots deep.
- *
- * Every test here pins one half of "a cancellation is an instruction, not a
- * failure": nothing retries it, nothing queues it, and nothing leaks after it.
- */
-import { HttpService } from '../HttpService';
-import { ErrorCodes } from '../utils/errorUtils';
-
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify({ data }), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-/**
- * A fetch that never responds, but DOES honour its abort signal — rejecting
- * with an `AbortError` exactly as the real one does.
- *
- * Honouring the signal is not harness politeness, it is the whole point: the
- * behaviour under test is what happens after an abort, so a fake that ignores
- * the signal would hang instead of exercising it.
- */
-function hangingFetch(): { fetch: typeof globalThis.fetch; calls: () => number } {
-  let calls = 0;
-  return {
-    fetch: ((_input: RequestInfo | URL, init?: RequestInit) => {
-      calls++;
-      return new Promise<Response>((_resolve, reject) => {
-        const signal = init?.signal;
-        const fail = (): void => reject(new DOMException('The operation was aborted.', 'AbortError'));
-        if (!signal) return;
-        if (signal.aborted) { fail(); return; }
-        signal.addEventListener('abort', fail, { once: true });
-      });
-    }) as typeof globalThis.fetch,
-    calls: () => calls,
-  };
-}
-
-/**
- * Pin the retry backoff's jitter to zero.
- *
- * `retryAsync`'s delay is `baseDelay * 2**attempt + Math.random() * 1000`, so
- * with real timers a retry can land up to a second later. A test that waits a
- * fixed 80ms to prove "no retry happened" would then pass whether the bug was
- * present or not — it would just be measuring the jitter. Pinning it makes the
- * retry window exactly `baseDelay * (1 + 2 + 4)`, which a short wait covers
- * decisively.
- */
-function pinJitter(): void {
-  jest.spyOn(Math, 'random').mockReturnValue(0);
-}
-
-describe('HttpService cancellation', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-    jest.useRealTimers();
-  });
-
-  it('never calls fetch for a signal that was already aborted', async () => {
-    let calls = 0;
-    globalThis.fetch = (async () => { calls++; return jsonResponse({}); }) as typeof globalThis.fetch;
-
-    const http = new HttpService({ baseURL: 'https://api.test' });
-    const controller = new AbortController();
-    controller.abort();
-
-    await expect(http.get('/thing', { signal: controller.signal })).rejects.toMatchObject({
-      code: ErrorCodes.CANCELLED,
-    });
-    expect(calls).toBe(0);
-  });
-
-  it('issues exactly one fetch when a request is cancelled mid-flight, with retry on', async () => {
-    pinJitter();
-    const { fetch, calls } = hangingFetch();
-    globalThis.fetch = fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 3,
-      retryDelay: 1,
-    });
-
-    const controller = new AbortController();
-    const pending = http.get('/thing', { signal: controller.signal });
-    const assertion = expect(pending).rejects.toMatchObject({ code: ErrorCodes.CANCELLED });
-
-    // Let the request reach fetch, then cancel it.
-    await new Promise((resolve) => setTimeout(resolve, 10));
-    expect(calls()).toBe(1);
-    controller.abort();
-    await assertion;
-
-    // The retry budget was 3 more attempts, whose backoff with jitter pinned is
-    // 1+2+4ms. Waiting well past that window is what proves none of them ran,
-    // and it is the crux of the defect: the re-issued request went out AFTER
-    // the rejection the caller saw, so a test that stopped at the rejection
-    // would have passed with the bug fully present.
-    await new Promise((resolve) => setTimeout(resolve, 80));
-    expect(calls()).toBe(1);
-  });
-
-  it('leaves no abort listener on a caller signal that outlives the request', async () => {
-    globalThis.fetch = (async () => jsonResponse({ ok: true })) as typeof globalThis.fetch;
-
-    const controller = new AbortController();
-    const added: unknown[] = [];
-    const removed: unknown[] = [];
-    const realAdd = controller.signal.addEventListener.bind(controller.signal);
-    const realRemove = controller.signal.removeEventListener.bind(controller.signal);
-    jest.spyOn(controller.signal, 'addEventListener').mockImplementation(((type: string, fn: never, opts: never) => {
-      if (type === 'abort') added.push(fn);
-      return realAdd(type as 'abort', fn, opts);
-    }) as never);
-    jest.spyOn(controller.signal, 'removeEventListener').mockImplementation(((type: string, fn: never, opts: never) => {
-      if (type === 'abort') removed.push(fn);
-      return realRemove(type as 'abort', fn, opts);
-    }) as never);
-
-    const http = new HttpService({ baseURL: 'https://api.test' });
-    // A React Query query signal is reused across the query's whole lifetime,
-    // so a listener left behind per request is an unbounded leak, not a nit.
-    for (let i = 0; i < 5; i++) {
-      await http.get(`/thing-${i}`, { signal: controller.signal, cache: false, deduplicate: false });
-    }
-
-    expect(added.length).toBeGreaterThan(0);
-    expect(removed.length).toBe(added.length);
-  });
-
-  it('does not consume a queue slot for a cancelled request, so a live one still runs', async () => {
-    const live: string[] = [];
-    globalThis.fetch = (async (input: RequestInfo | URL) => {
-      const url = String(input);
-      if (url.includes('/live')) {
-        live.push(url);
-        return jsonResponse({ ok: true });
-      }
-      // Cancelled requests never get here; if one does, it would hold a slot.
-      return new Promise<Response>(() => { /* never settles */ });
-    }) as typeof globalThis.fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      maxConcurrentRequests: 2,
-      enableRetry: false,
-    });
-
-    // Fill more than the pool with requests whose callers have already gone.
-    const dead = Array.from({ length: 6 }, (_, i) => {
-      const controller = new AbortController();
-      controller.abort();
-      return http.get(`/dead-${i}`, { signal: controller.signal }).catch(() => 'cancelled');
-    });
-    await Promise.all(dead);
-
-    // With only two slots, this is the assertion that matters: the live request
-    // is not queued behind six abandoned ones.
-    await expect(http.get('/live', { cache: false })).resolves.toBeDefined();
-    expect(live).toHaveLength(1);
-  });
-});
-
-describe('HttpService timeout', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-    jest.useRealTimers();
-  });
-
-  it('does not retry a timeout by default, and reports it as a timeout not a cancellation', async () => {
-    pinJitter();
-    const { fetch, calls } = hangingFetch();
-    globalThis.fetch = fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 3,
-      retryDelay: 1,
-      requestTimeout: 20,
-    });
-
-    await expect(http.get('/slow', { cache: false })).rejects.toMatchObject({
-      code: ErrorCodes.TIMEOUT,
-      timeout: true,
-    });
-
-    await new Promise((resolve) => setTimeout(resolve, 80));
-    // One attempt, not four. Four behind a short timeout is how a single slow
-    // endpoint used to cost tens of seconds of wall clock.
-    expect(calls()).toBe(1);
-  });
-
-  it('retries a timeout when the caller opts in', async () => {
-    const { fetch, calls } = hangingFetch();
-    globalThis.fetch = fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 2,
-      retryDelay: 1,
-      requestTimeout: 20,
-    });
-
-    await expect(
-      http.get('/slow', { cache: false, retryOnTimeout: true }),
-    ).rejects.toMatchObject({ code: ErrorCodes.TIMEOUT });
-
-    expect(calls()).toBe(3);
-  });
-
-  it('bounds total wall clock with a deadline, even with retries on', async () => {
-    pinJitter();
-    const { fetch } = hangingFetch();
-    globalThis.fetch = fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 5,
-      retryDelay: 100,
-      requestTimeout: 20,
-    });
-
-    const started = Date.now();
-    await expect(
-      http.get('/slow', { cache: false, retryOnTimeout: true, deadline: 150 }),
-    ).rejects.toBeDefined();
-
-    // `timeout` bounds an attempt; `deadline` bounds the call. Without it the
-    // total is attempts x timeout + backoff, which no call site computes.
-    expect(Date.now() - started).toBeLessThan(400);
-  });
-
-  it('still retries a 5xx — the fix must not disable retry wholesale', async () => {
-    let calls = 0;
-    globalThis.fetch = (async () => {
-      calls++;
-      return jsonResponse({ error: 'boom' }, 503);
-    }) as typeof globalThis.fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 2,
-      retryDelay: 1,
-    });
-
-    await expect(http.get('/flaky', { cache: false })).rejects.toBeDefined();
-    expect(calls).toBe(3);
-  });
-
-  it('still refuses to retry a 4xx', async () => {
-    let calls = 0;
-    globalThis.fetch = (async () => {
-      calls++;
-      return jsonResponse({ error: 'nope' }, 404);
-    }) as typeof globalThis.fetch;
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: true,
-      maxRetries: 3,
-      retryDelay: 1,
-    });
-
-    await expect(http.get('/missing', { cache: false })).rejects.toBeDefined();
-    expect(calls).toBe(1);
-  });
-
-  it('arms no timer past a request that threw before returning', async () => {
-    globalThis.fetch = (async () => jsonResponse({ error: 'nope' }, 404)) as typeof globalThis.fetch;
-    jest.useFakeTimers({ doNotFake: ['nextTick'] });
-
-    const http = new HttpService({
-      baseURL: 'https://api.test',
-      enableRetry: false,
-      requestTimeout: 30_000,
-    });
-
-    await expect(http.get('/missing', { cache: false })).rejects.toBeDefined();
-    // `clearTimeout` used to sit on the success path only, so any throw between
-    // the fetch and the return left a 30s timer armed.
-    expect(jest.getTimerCount()).toBe(0);
-    jest.useRealTimers();
-  });
-});

package/src/__tests__/httpServiceActivityId.test.ts

@@ -1,49 +0,0 @@
-import { HttpService } from '../HttpService';
-
-describe('HttpService browser activity identifier', () => {
-  const originalFetch = globalThis.fetch;
-  const originalWindowDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'window');
-  const originalDocumentDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'document');
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    if (originalWindowDescriptor) {
-      Object.defineProperty(globalThis, 'window', originalWindowDescriptor);
-    } else {
-      Reflect.deleteProperty(globalThis, 'window');
-    }
-    if (originalDocumentDescriptor) {
-      Object.defineProperty(globalThis, 'document', originalDocumentDescriptor);
-    } else {
-      Reflect.deleteProperty(globalThis, 'document');
-    }
-    jest.restoreAllMocks();
-  });
-
-  it('adds the runtime identifier after caller headers', async () => {
-    Object.defineProperty(globalThis, 'window', {
-      configurable: true,
-      value: {},
-    });
-    Object.defineProperty(globalThis, 'document', {
-      configurable: true,
-      value: {},
-    });
-    const fetchMock = jest.fn(async () => new Response(JSON.stringify({ data: { ok: true } }), {
-      status: 200,
-      headers: { 'content-type': 'application/json' },
-    }));
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-
-    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
-    await http.get('/session/status', {
-      headers: { 'X-Oxy-Activity-Id': 'caller-controlled' },
-    });
-
-    const requestHeaders = fetchMock.mock.calls[0]?.[1]?.headers as Record<string, string>;
-    expect(requestHeaders['X-Oxy-Activity-Id']).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
-    );
-    expect(requestHeaders['X-Oxy-Activity-Id']).not.toBe('caller-controlled');
-  });
-});

package/src/__tests__/httpServiceAuthSelfAwait.test.ts

@@ -1,108 +0,0 @@
-/**
- * Auth self-await regression.
- *
- * The refresh handler (arm 2 shared-key sign-in) calls PRE-SESSION public
- * endpoints (`/auth/challenge`, `/auth/verify`, the commons-signin surface, …)
- * from INSIDE the single-flight `tokenRefreshPromise`. If any of those carried
- * an auth preflight (no `skipAuth`), its `getAuthHeader` would call
- * `refreshAccessToken`, find the handler's own promise already in flight, and
- * await it — the handler awaiting itself → permanent hang (no deadline on the
- * auto-connect lane makes it visible). `skipAuth` on every pre-session public
- * endpoint is what prevents this; these tests lock the invariant.
- */
-import { HttpService } from '../HttpService';
-
-function createJwt(payload: Record<string, unknown>): string {
-  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
-  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
-}
-
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-const nowSec = (): number => Math.floor(Date.now() / 1000);
-
-/** Resolve to `true` if `promise` settles within `ms`, else `false`. Always
- *  clears its timer so no pending timeout leaks into jest's teardown. */
-async function settlesWithin(promise: Promise<unknown>, ms: number): Promise<boolean> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const timeout = new Promise<false>((resolve) => {
-    timer = setTimeout(() => resolve(false), ms);
-  });
-  try {
-    return await Promise.race([promise.then(() => true), timeout]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-describe('HttpService auth self-await', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-  });
-
-  it('a skipAuth request issued from INSIDE the refresh handler resolves (no self-await)', async () => {
-    globalThis.fetch = (async (input: RequestInfo | URL) => {
-      const url = String(input);
-      if (url.includes('/auth/challenge')) return jsonResponse({ challenge: 'c' });
-      return jsonResponse({ ok: true });
-    }) as typeof fetch;
-
-    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
-    // Near-expiry → the data request's preflight starts the refresh.
-    http.setTokens(createJwt({ userId: 'u', exp: nowSec() + 30 }));
-
-    http.setAuthRefreshHandler(async () => {
-      // Mirror arm 2: from inside the handler, hit a pre-session public endpoint.
-      // With skipAuth it does NOT re-enter refreshAccessToken; without it, its
-      // preflight would await THIS handler's own pending promise → self-await.
-      await http.post('/auth/challenge', { publicKey: 'p' }, { skipAuth: true, retry: false });
-      const fresh = createJwt({ userId: 'u', exp: nowSec() + 3600, jti: 'fresh' });
-      http.setTokens(fresh);
-      return fresh;
-    });
-
-    expect(await settlesWithin(http.get('/data'), 500)).toBe(true);
-  });
-
-  it('a skipAuth public request does NOT await a pending refresh', async () => {
-    let releaseRefresh: (() => void) | undefined;
-    const refreshGate = new Promise<void>((resolve) => {
-      releaseRefresh = resolve;
-    });
-
-    globalThis.fetch = (async (input: RequestInfo | URL) => {
-      const url = String(input);
-      if (url.includes('/auth/challenge')) return jsonResponse({ challenge: 'c' });
-      return jsonResponse({ ok: true });
-    }) as typeof fetch;
-
-    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
-    http.setTokens(createJwt({ userId: 'u', exp: nowSec() + 30 }));
-
-    http.setAuthRefreshHandler(async () => {
-      await refreshGate; // hold the refresh open
-      const fresh = createJwt({ userId: 'u', exp: nowSec() + 3600, jti: 'fresh' });
-      http.setTokens(fresh);
-      return fresh;
-    });
-
-    // A data request whose preflight starts (and blocks on) the held refresh.
-    const data = http.get('/data');
-    await new Promise((resolve) => setTimeout(resolve, 0));
-
-    // A skipAuth public request must settle WITHOUT waiting for the held refresh.
-    const pub = http.post('/auth/challenge', { publicKey: 'p' }, { skipAuth: true, retry: false });
-    expect(await settlesWithin(pub, 300)).toBe(true);
-
-    releaseRefresh?.();
-    await data;
-  });
-});