@oxy.so/core 1.18.0 → 3.0.0

package/src/mixins/__tests__/authRefusalObservability.test.ts

@@ -1,396 +0,0 @@
-/**
- * A refused credential is observable to the HOST — and to nobody else.
- *
- * The incident these lock in: Oxy served `{"keys":[]}` from
- * `/.well-known/jwks.json` with no Ed25519 signing key bound. Every service
- * token failed verification, the optional mount swallowed the failure into
- * `next()`, the host answered its own generic 401, and the one fact that named
- * the fault — an empty key set — was written down nowhere. These tests assert
- * that each refusal class now lands on `req.oxyAuthRefusal`, reaches
- * `onRefusal`, and emits exactly one `warn` carrying a stable code, while the
- * bodies the client sees stay byte-identical and optional auth still refuses to
- * 401 on its own.
- */
-
-import { generateKeyPairSync, sign as signBytes, type KeyObject } from 'node:crypto';
-import { OxyServices } from '../../OxyServices';
-import type { OxyAuthRefusal } from '../OxyServices.utility';
-import { createOptionalOxyAuth, createOxyAuthMiddleware, getOxyAuthRefusal } from '../../server/auth';
-import { configureLogger, resetLoggerConfig, type LogEntry } from '../../logger';
-
-const b64url = (value: string | Uint8Array): string => Buffer.from(value).toString('base64url');
-
-const primary = generateKeyPairSync('ed25519');
-const impostor = generateKeyPairSync('ed25519');
-const primaryJwk = {
-  ...primary.publicKey.export({ format: 'jwk' }),
-  use: 'sig',
-  alg: 'EdDSA',
-  kid: 'service-2026-09-a',
-};
-
-function serviceToken(
-  privateKey: KeyObject,
-  keyId: string,
-  claims: Record<string, unknown> = {},
-): string {
-  const now = Math.floor(Date.now() / 1_000);
-  const header = { alg: 'EdDSA', typ: 'JWT', kid: keyId };
-  const payload = {
-    type: 'service',
-    appId: 'app-exact',
-    appName: 'Homiio',
-    credentialId: 'credential-exact',
-    ownerAccountId: 'account-exact',
-    environment: 'production',
-    scopes: ['inference:invoke'],
-    iss: 'oxy-auth',
-    aud: 'oxy-api',
-    iat: now,
-    exp: now + 3_600,
-    ...claims,
-  };
-  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
-  return `${signingInput}.${b64url(signBytes(null, Buffer.from(signingInput), privateKey))}`;
-}
-
-/** An unsigned user token — the middleware decodes these, it never verifies them. */
-function userToken(claims: Record<string, unknown>): string {
-  const now = Math.floor(Date.now() / 1_000);
-  const header = { alg: 'none', typ: 'JWT' };
-  const payload = { userId: 'user-1', exp: now + 3_600, ...claims };
-  return `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}.`;
-}
-
-function responseHarness() {
-  return {
-    statusCode: 0,
-    body: undefined as unknown,
-    status(code: number) {
-      this.statusCode = code;
-      return this;
-    },
-    json(body: unknown) {
-      this.body = body;
-      return this;
-    },
-  };
-}
-
-function requestHarness(headers: Record<string, string>) {
-  return { method: 'POST', path: '/v1/chat/completions', query: {}, headers };
-}
-
-function jwksResponse(body: unknown) {
-  return new Response(JSON.stringify(body), { status: 200 });
-}
-
-/** Drive a composed (optional-inside) middleware to completion. */
-async function runMiddleware(
-  middleware: (req: unknown, res: unknown, next: unknown) => unknown,
-  headers: Record<string, string>,
-) {
-  const request = requestHarness(headers);
-  const response = responseHarness();
-  let settle!: () => void;
-  const settled = new Promise<void>((resolve) => { settle = resolve; });
-  const originalJson = response.json.bind(response);
-  response.json = (body: unknown) => {
-    const result = originalJson(body);
-    settle();
-    return result;
-  };
-  const next = jest.fn(() => settle());
-  await middleware(request as never, response as never, next as never);
-  await settled;
-  return { request, response, next };
-}
-
-let warnings: LogEntry[];
-
-beforeEach(() => {
-  warnings = [];
-  configureLogger({
-    level: 'warn',
-    sink: (entry) => {
-      if (entry.level === 'warn') warnings.push(entry);
-    },
-  });
-});
-
-afterEach(() => {
-  resetLoggerConfig();
-  jest.restoreAllMocks();
-});
-
-function refusalWarnings(): LogEntry[] {
-  return warnings.filter((entry) => entry.message.startsWith('[oxy.auth] refused '));
-}
-
-describe('optional auth records why a presented credential was refused', () => {
-  /**
-   * Each case is a distinct production outage that answers the client the same
-   * way. `reason` is what tells them apart, so each case asserts on it.
-   */
-  const cases: Array<{
-    name: string;
-    jwks: unknown | 'unreachable';
-    token: string;
-    expected: { code: string; stage: OxyAuthRefusal['stage']; reason: RegExp; status: number };
-  }> = [
-    {
-      name: 'a signature that does not verify',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(impostor.privateKey, primaryJwk.kid),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN',
-        stage: 'service-token',
-        reason: /signature is invalid/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'a kid the key set does not carry',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(impostor.privateKey, 'rotated-away'),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN',
-        stage: 'service-token',
-        reason: /signing key is unknown/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'the empty key set Oxy actually served',
-      jwks: { keys: [] },
-      token: serviceToken(primary.privateKey, primaryJwk.kid),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN',
-        stage: 'service-token',
-        reason: /key set is unavailable/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'a JWKS endpoint that cannot be reached',
-      jwks: 'unreachable',
-      token: serviceToken(primary.privateKey, primaryJwk.kid),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN',
-        stage: 'service-token',
-        reason: /key set is unavailable/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'an expired service token',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(primary.privateKey, primaryJwk.kid, { exp: 1 }),
-      expected: {
-        code: 'TOKEN_EXPIRED',
-        stage: 'service-token',
-        reason: /expired/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'an audience this verifier does not answer for',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(primary.privateKey, primaryJwk.kid, { aud: 'someone-else' }),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN_CLAIMS',
-        stage: 'service-token',
-        reason: /audience/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'an issuer this verifier does not trust',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(primary.privateKey, primaryJwk.kid, { iss: 'attacker' }),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN_CLAIMS',
-        stage: 'service-token',
-        reason: /issuer/i,
-        status: 401,
-      },
-    },
-    {
-      name: 'a service token missing a required claim',
-      jwks: { keys: [primaryJwk] },
-      token: serviceToken(primary.privateKey, primaryJwk.kid, { appName: undefined }),
-      expected: {
-        code: 'INVALID_SERVICE_TOKEN',
-        stage: 'service-token',
-        reason: /appName/,
-        status: 401,
-      },
-    },
-  ];
-
-  it.each(cases)('$name', async ({ jwks, token, expected }) => {
-    if (jwks === 'unreachable') {
-      jest.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('connect ECONNREFUSED'));
-    } else {
-      jest.spyOn(globalThis, 'fetch').mockResolvedValue(jwksResponse(jwks));
-    }
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const refused: OxyAuthRefusal[] = [];
-
-    const { request, response, next } = await runMiddleware(
-      createOptionalOxyAuth(oxy, { auth: { onRefusal: (refusal) => refused.push(refusal) } }),
-      { authorization: `Bearer ${token}` },
-    );
-
-    // Optional auth still does not answer for itself.
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(response.statusCode).toBe(0);
-    expect(response.body).toBeUndefined();
-
-    const recorded = getOxyAuthRefusal(request as never);
-    expect(recorded).toMatchObject({
-      code: expected.code,
-      stage: expected.stage,
-      status: expected.status,
-      optional: true,
-    });
-    expect(recorded?.reason).toMatch(expected.reason);
-    expect(refused).toEqual([recorded]);
-
-    const warned = refusalWarnings();
-    expect(warned).toHaveLength(1);
-    expect(warned[0]?.context).toMatchObject({ code: expected.code, optional: true });
-    // The credential itself never reaches a log line.
-    expect(JSON.stringify(warned[0])).not.toContain(token);
-  });
-
-  it('records a user token that carries no session', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const { request, next } = await runMiddleware(
-      createOptionalOxyAuth(oxy),
-      { authorization: `Bearer ${userToken({})}` },
-    );
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({
-      code: 'SESSION_REQUIRED',
-      stage: 'token',
-      optional: true,
-    });
-  });
-
-  it('records a session the API refuses to validate, without logging the session id', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    jest.spyOn(oxy, 'validateSession').mockResolvedValue({ valid: false });
-    const { request } = await runMiddleware(
-      createOptionalOxyAuth(oxy),
-      { authorization: `Bearer ${userToken({ sessionId: 'session-secret-value' })}` },
-    );
-
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({
-      code: 'INVALID_SESSION',
-      stage: 'session',
-    });
-    expect(JSON.stringify(warnings)).not.toContain('session-secret-value');
-  });
-
-  it('keeps a validation transport failure diagnostic but id-free', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const transport = Object.assign(new Error('connect ECONNREFUSED https://api.oxy.test/session/validate/session-secret-value'), {
-      code: 'ECONNREFUSED',
-    });
-    jest.spyOn(oxy, 'validateSession').mockRejectedValue(transport);
-
-    const { request } = await runMiddleware(
-      createOptionalOxyAuth(oxy),
-      { authorization: `Bearer ${userToken({ sessionId: 'session-secret-value' })}` },
-    );
-
-    const recorded = getOxyAuthRefusal(request as never);
-    expect(recorded).toMatchObject({ code: 'SESSION_VALIDATION_ERROR', stage: 'session' });
-    expect(recorded?.reason).toContain('ECONNREFUSED');
-    expect(recorded?.reason).not.toContain('session-secret-value');
-  });
-
-  it('records a bearer that is not a JWT at all', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const { request } = await runMiddleware(createOptionalOxyAuth(oxy), {
-      authorization: 'Bearer not-a-jwt',
-    });
-
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({
-      code: 'INVALID_TOKEN_FORMAT',
-      stage: 'token',
-    });
-  });
-
-  it('treats an absent credential as absence, not refusal', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const refused: OxyAuthRefusal[] = [];
-    const { request, response, next } = await runMiddleware(
-      createOptionalOxyAuth(oxy, { auth: { onRefusal: (refusal) => refused.push(refusal) } }),
-      {},
-    );
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(response.statusCode).toBe(0);
-    expect(getOxyAuthRefusal(request as never)).toBeNull();
-    expect(refused).toEqual([]);
-    expect(refusalWarnings()).toEqual([]);
-  });
-
-  it('survives an onRefusal observer that throws', async () => {
-    jest.spyOn(globalThis, 'fetch').mockResolvedValue(jwksResponse({ keys: [] }));
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const { request, response, next } = await runMiddleware(
-      createOptionalOxyAuth(oxy, {
-        auth: { onRefusal: () => { throw new Error('observer blew up'); } },
-      }),
-      { authorization: `Bearer ${serviceToken(primary.privateKey, primaryJwk.kid)}` },
-    );
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(response.statusCode).toBe(0);
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({ code: 'INVALID_SERVICE_TOKEN' });
-  });
-});
-
-describe('a blocking mount answers exactly what it always answered', () => {
-  it('keeps the generic 401 body while naming the refusal in the log', async () => {
-    jest.spyOn(globalThis, 'fetch').mockResolvedValue(jwksResponse({ keys: [] }));
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const { request, response, next } = await runMiddleware(
-      createOxyAuthMiddleware(oxy),
-      { authorization: `Bearer ${serviceToken(primary.privateKey, primaryJwk.kid)}` },
-    );
-
-    expect(next).not.toHaveBeenCalled();
-    expect(response.statusCode).toBe(401);
-    // Unchanged, and deliberately uninformative.
-    expect(response.body).toEqual({ error: 'Unauthorized', message: 'Authentication required' });
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({ code: 'INVALID_SERVICE_TOKEN' });
-    expect(
-      warnings.some((entry) => entry.message.includes('401 after refusal INVALID_SERVICE_TOKEN')),
-    ).toBe(true);
-  });
-
-  it('reports a non-optional refusal as non-optional', async () => {
-    jest.spyOn(globalThis, 'fetch').mockResolvedValue(jwksResponse({ keys: [] }));
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    const request = requestHarness({
-      authorization: `Bearer ${serviceToken(primary.privateKey, primaryJwk.kid)}`,
-    });
-    const response = responseHarness();
-
-    await oxy.auth()(request as never, response as never, jest.fn() as never);
-
-    expect(response.statusCode).toBe(401);
-    expect(getOxyAuthRefusal(request as never)).toMatchObject({
-      code: 'INVALID_SERVICE_TOKEN',
-      optional: false,
-    });
-    // The client is told the code on a blocking mount — that has always been
-    // true and is not what this change touches.
-    expect(response.body).toMatchObject({ code: 'INVALID_SERVICE_TOKEN', status: 401 });
-  });
-});

package/src/mixins/__tests__/backgroundCredential.httpIntegration.test.ts

@@ -1,130 +0,0 @@
-import type { DeviceBackgroundCredentialResponse } from '@oxy.so/contracts';
-import { OxyServices } from '../../OxyServices';
-
-/**
- * Real-stack integration test for `provisionBackgroundCredential`: a genuine
- * `HttpService` (via `OxyServices`) with `global.fetch` stubbed to return the
- * EXACT wire bodies oxy-api sends, rather than a `makeRequest` spy.
- *
- * The unit suite (`OxyServices.deviceBoot.test.ts`) stubs `makeRequest`, so by
- * construction it cannot see either of the two things this file pins:
- *
- *  1. **The `{ data }` envelope.** The route answers
- *     `{ data: { deviceId, secret, accountId, expiresAt } }`, and
- *     `HttpService.unwrapResponse` strips that outer envelope — so the mixin
- *     must validate the FLAT credential and must not read `.data` a second
- *     time. A spy returning the flat shape asserts that assumption instead of
- *     testing it; the same blind spot produced a P0 in `SessionClient` (see
- *     `SessionClient.httpIntegration.test.ts`).
- *  2. **The 404 degrade against the REAL error object.** The `404 → null` path
- *     is what keeps a client on a newer SDK than the server from breaking, and
- *     it keys on the status surviving whatever `HttpService` throws. A
- *     hand-built `Object.assign(new Error(), { status: 404 })` proves only that
- *     the branch reads the shape the test itself invented.
- *
- * Assertions select calls by URL rather than position, so a preflight added
- * to the real stack later cannot make a call-count assertion measure it
- * instead of the route.
- */
-const ROUTE = '/session/device/background-credential';
-
-const CREDENTIAL: DeviceBackgroundCredentialResponse = {
-  deviceId: 'device-real',
-  secret: 'bg-secret-from-the-wire',
-  accountId: 'acct-1',
-  expiresAt: '2030-01-01T00:00:00.000Z',
-};
-
-/** The route's success body: the credential under this API's `data` envelope. */
-const ROUTE_BODY = { data: CREDENTIAL };
-
-/** oxy-api's 404 body for an unmatched path (server.ts's terminal handler). */
-const NOT_FOUND_BODY = { error: 'NOT_FOUND', message: 'Resource not found' };
-
-const jsonResponse = (body: unknown, status: number) =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  });
-
-/**
- * A syntactically real, far-future access token. It must be a decodable JWT:
- * `HttpService.getAuthHeader` runs `jwtDecode` and sends NO bearer at all when
- * that throws, so an opaque placeholder would silently turn this into an
- * anonymous request and make the bearer assertion below untestable.
- */
-const ACCESS_TOKEN = (() => {
-  const segment = (payload: object) => Buffer.from(JSON.stringify(payload)).toString('base64url');
-  return [
-    segment({ alg: 'none', typ: 'JWT' }),
-    segment({ sub: 'acct-1', exp: 4_102_444_800 }), // 2100-01-01
-    'signature-not-verified-client-side',
-  ].join('.');
-})();
-
-describe('provisionBackgroundCredential over a real HttpService', () => {
-  const originalFetch = global.fetch;
-
-  /** Answers every call with `body`/`status`. */
-  const stubFetch = (body: unknown, status: number) => {
-    const fetchMock = jest.fn(async (input: unknown) => {
-      return jsonResponse(body, status);
-    });
-    global.fetch = fetchMock as unknown as typeof fetch;
-    return fetchMock;
-  };
-
-  /** Every stubbed call whose URL is the route under test. */
-  const routeCalls = (fetchMock: jest.Mock) =>
-    fetchMock.mock.calls.filter(([input]) => String(input).includes(ROUTE));
-
-  const client = () => {
-    const oxy = new OxyServices({ baseURL: 'http://api.test.invalid' });
-    // Bearer required: the server derives both the deviceId and the account
-    // from it, and this call (unlike the device-secret mint) does not skipAuth.
-    oxy.setTokens(ACCESS_TOKEN);
-    return oxy;
-  };
-
-  afterEach(() => {
-    global.fetch = originalFetch;
-  });
-
-  it('unwraps the { data } envelope and returns the flat credential', async () => {
-    stubFetch(ROUTE_BODY, 200);
-
-    const result = await client().provisionBackgroundCredential();
-
-    // Would be `{ data: {...} }` if the envelope were not unwrapped, and would
-    // throw (contract validation failure) if `.data` were read twice.
-    expect(result).toEqual(CREDENTIAL);
-    expect(result?.secret).toBe('bg-secret-from-the-wire');
-  });
-
-  it('sends a POST to the route with NO body and a bearer', async () => {
-    const fetchMock = stubFetch(ROUTE_BODY, 200);
-
-    await client().provisionBackgroundCredential();
-
-    const calls = routeCalls(fetchMock);
-    expect(calls).toHaveLength(1);
-    const [, init] = calls[0] as unknown as [string, RequestInit];
-    expect(init.method).toBe('POST');
-    // No body at all — not `'undefined'`, not `'{}'`. The server derives the
-    // deviceId and the account from the bearer; anything sent here would be
-    // ignored at best and mass-assignment surface at worst.
-    expect(init.body ?? null).toBeNull();
-    expect(new Headers(init.headers).get('authorization')).toBe(`Bearer ${ACCESS_TOKEN}`);
-  });
-
-  it('returns null on the real 404 response, without retrying the route', async () => {
-    const fetchMock = stubFetch(NOT_FOUND_BODY, 404);
-
-    await expect(client().provisionBackgroundCredential()).resolves.toBeNull();
-
-    // 4xx is not retried (`retryAsync`'s default shouldRetry), so an absent
-    // endpoint costs exactly one request to the route — the degrade must not
-    // burn a backoff loop on every provision attempt.
-    expect(routeCalls(fetchMock)).toHaveLength(1);
-  });
-});

package/src/mixins/__tests__/chains.test.ts

@@ -1,113 +0,0 @@
-/**
- * The chains client — what it puts on the wire.
- *
- * There is exactly one piece of real logic here and it is the read's query
- * string: joining two lists, and including `since`/`limit` only when the caller
- * gave them. Everything else is a pass-through, so these cases pin the part that
- * can actually be wrong rather than restating the method bodies.
- *
- * `makeServiceRequest` is stubbed because it belongs to the auth mixin and has
- * its own suites; what matters here is the method, path and payload it is handed.
- */
-
-import { OxyServicesChainsMixin } from '../OxyServices.chains';
-
-type Call = { method: string; url: string; data?: unknown };
-
-/** A minimal host carrying the mixin, with the service transport recorded. */
-function client(): { calls: Call[]; api: any } {
-  const calls: Call[] = [];
-  class Base {
-    makeServiceRequest(method: string, url: string, data?: unknown) {
-      calls.push({ method, url, data });
-      return Promise.resolve({ records: [], nextCursor: null });
-    }
-  }
-  const Mixed = OxyServicesChainsMixin(Base as any);
-  return { calls, api: new (Mixed as any)() };
-}
-
-describe('appendChainRecord', () => {
-  it('POSTs the record to /chains/records untouched', async () => {
-    const { calls, api } = client();
-
-    await api.appendChainRecord({
-      oxyUserId: 'u1',
-      collection: 'app.mention.feed.post',
-      rkey: 'p1',
-      record: { text: 'hi' },
-    });
-
-    expect(calls).toEqual([
-      {
-        method: 'POST',
-        url: '/chains/records',
-        data: {
-          oxyUserId: 'u1',
-          collection: 'app.mention.feed.post',
-          rkey: 'p1',
-          record: { text: 'hi' },
-        },
-      },
-    ]);
-  });
-});
-
-describe('readChainRecords', () => {
-  it('joins authors and collections into one comma-separated query each', async () => {
-    const { calls, api } = client();
-
-    await api.readChainRecords({
-      oxyUserIds: ['u1', 'u2'],
-      collections: ['app.mention.feed.post', 'app.mention.feed.like'],
-    });
-
-    const url = new URL(`http://x${calls[0].url}`);
-    expect(calls[0].method).toBe('GET');
-    expect(url.pathname).toBe('/chains/records');
-    expect(url.searchParams.get('authors')).toBe('u1,u2');
-    expect(url.searchParams.get('collections')).toBe('app.mention.feed.post,app.mention.feed.like');
-  });
-
-  it('omits since and limit when the caller gave neither', async () => {
-    // A `since=` or `limit=` sent as an empty string is not the same request —
-    // the server validates both, so an always-present key would 400 a first page.
-    const { calls, api } = client();
-
-    await api.readChainRecords({ oxyUserIds: ['u1'], collections: ['app.mention.feed.post'] });
-
-    const url = new URL(`http://x${calls[0].url}`);
-    expect(url.searchParams.has('since')).toBe(false);
-    expect(url.searchParams.has('limit')).toBe(false);
-  });
-
-  it('sends since and limit when it did', async () => {
-    const { calls, api } = client();
-
-    await api.readChainRecords({
-      oxyUserIds: ['u1'],
-      collections: ['app.mention.feed.post'],
-      since: 'Y3Vyc29y',
-      limit: 25,
-    });
-
-    const url = new URL(`http://x${calls[0].url}`);
-    expect(url.searchParams.get('since')).toBe('Y3Vyc29y');
-    expect(url.searchParams.get('limit')).toBe('25');
-  });
-
-  it('escapes a cursor that is not URL-safe', async () => {
-    // Cursors are opaque to the caller, so this client must not assume the
-    // encoding the server happens to use today.
-    const { calls, api } = client();
-
-    await api.readChainRecords({
-      oxyUserIds: ['u1'],
-      collections: ['app.mention.feed.post'],
-      since: 'a+b/c=',
-    });
-
-    const url = new URL(`http://x${calls[0].url}`);
-    expect(url.searchParams.get('since')).toBe('a+b/c=');
-  });
-});