@oxy.so/core 1.18.0 → 3.0.0

package/src/server/__tests__/userInvalidation.test.ts

@@ -1,203 +0,0 @@
-import { OXY_USER_INVALIDATION_CHANNEL } from '@oxy.so/contracts';
-
-import {
-  createOxyUserInvalidationHandler,
-  publishOxyUserInvalidation,
-} from '../userInvalidation';
-// The key enumeration this subscriber sweeps is platform-neutral and shared
-// with the client mixins — see `utils/identityCacheSweep` and its own suite.
-import type { OxyIdentityCacheEvictor } from '../../utils/identityCacheSweep';
-
-function makePublisher() {
-  const calls: Array<{ channel: string; message: string }> = [];
-  return {
-    calls,
-    publish(channel: string, message: string) {
-      calls.push({ channel, message });
-      return Promise.resolve(1);
-    },
-  };
-}
-
-function makeEvictor() {
-  const entries: string[] = [];
-  const prefixes: string[] = [];
-  const evictor: OxyIdentityCacheEvictor = {
-    clearCacheEntry: (key) => {
-      entries.push(key);
-    },
-    clearCacheByPrefix: (prefix) => {
-      prefixes.push(prefix);
-      return 0;
-    },
-  };
-  return { evictor, entries, prefixes };
-}
-
-describe('@oxy.so/core/server publishOxyUserInvalidation', () => {
-  it('publishes a profile change on the contract channel', () => {
-    const publisher = makePublisher();
-    const published = publishOxyUserInvalidation(publisher, 'user-1', 'profile');
-
-    expect(published).toBe(true);
-    expect(publisher.calls).toHaveLength(1);
-    expect(publisher.calls[0].channel).toBe(OXY_USER_INVALIDATION_CHANNEL);
-
-    const payload = JSON.parse(publisher.calls[0].message);
-    expect(payload.userId).toBe('user-1');
-    expect(payload.reason).toBe('profile');
-    expect(typeof payload.at).toBe('number');
-  });
-
-  it('puts NOTHING on the wire for graph churn', () => {
-    // The whole point of the suppression: not a message subscribers discard,
-    // but no message at all. Bulk follow moves up to 200 edges per call.
-    const publisher = makePublisher();
-    const published = publishOxyUserInvalidation(publisher, 'user-1', 'graph');
-
-    expect(published).toBe(false);
-    expect(publisher.calls).toHaveLength(0);
-  });
-
-  it('publishes nothing for an empty user id', () => {
-    const publisher = makePublisher();
-    expect(publishOxyUserInvalidation(publisher, '', 'profile')).toBe(false);
-    expect(publisher.calls).toHaveLength(0);
-  });
-
-  it('never throws when the client throws synchronously', () => {
-    const boom = new Error('redis down');
-    const publisher = {
-      publish() {
-        throw boom;
-      },
-    };
-    const onError = jest.fn();
-
-    expect(() => publishOxyUserInvalidation(publisher, 'user-1', 'profile', onError)).not.toThrow();
-    expect(publishOxyUserInvalidation(publisher, 'user-1', 'profile', onError)).toBe(false);
-    expect(onError).toHaveBeenCalledWith(boom);
-  });
-
-  it('never surfaces a rejected publish as an unhandled rejection', async () => {
-    const boom = new Error('publish rejected');
-    const publisher = {
-      publish: () => Promise.reject(boom),
-    };
-    const onError = jest.fn();
-
-    // Returns true — the message was handed to the client; the failure is async.
-    expect(publishOxyUserInvalidation(publisher, 'user-1', 'profile', onError)).toBe(true);
-    await Promise.resolve();
-    expect(onError).toHaveBeenCalledWith(boom);
-  });
-
-  it('tolerates a client whose publish returns a non-promise', () => {
-    const calls: string[] = [];
-    const publisher = {
-      publish: (_channel: string, message: string) => {
-        calls.push(message);
-        return 1;
-      },
-    };
-    expect(publishOxyUserInvalidation(publisher, 'user-1', 'profile')).toBe(true);
-    expect(calls).toHaveLength(1);
-  });
-});
-
-describe('@oxy.so/core/server createOxyUserInvalidationHandler', () => {
-  const validMessage = JSON.stringify({ userId: 'user-1', reason: 'profile', at: 1 });
-
-  it('sweeps the SDK identity cache for the invalidated user', () => {
-    const { evictor, entries, prefixes } = makeEvictor();
-    createOxyUserInvalidationHandler({ oxy: evictor })(validMessage);
-
-    expect(entries).toEqual(['GET:/users/user-1']);
-    expect(prefixes).toEqual([
-      'GET:/session/user/',
-      'GET:/users/me',
-      'GET:/auth/lookup/',
-      'GET:/profiles/username/',
-      'GET:/profiles/resolve',
-    ]);
-  });
-
-  it('hands the parsed event to app-specific eviction', () => {
-    const onInvalidate = jest.fn();
-    createOxyUserInvalidationHandler({ onInvalidate })(validMessage);
-
-    expect(onInvalidate).toHaveBeenCalledWith({ userId: 'user-1', reason: 'profile', at: 1 });
-  });
-
-  it('drops an unparseable message without throwing', () => {
-    const onInvalidate = jest.fn();
-    const onError = jest.fn();
-    const handle = createOxyUserInvalidationHandler({ onInvalidate, onError });
-
-    expect(() => handle('not json at all')).not.toThrow();
-    expect(onInvalidate).not.toHaveBeenCalled();
-    expect(onError).toHaveBeenCalled();
-  });
-
-  it('drops a message that fails the contract schema', () => {
-    const onInvalidate = jest.fn();
-    const onError = jest.fn();
-    const handle = createOxyUserInvalidationHandler({ onInvalidate, onError });
-
-    handle(JSON.stringify({ userId: 'user-1', reason: 'graph', at: 1 }));
-    handle(JSON.stringify({ reason: 'profile', at: 1 }));
-
-    expect(onInvalidate).not.toHaveBeenCalled();
-    expect(onError).toHaveBeenCalledTimes(2);
-  });
-
-  it('never throws when app eviction throws', () => {
-    // The handler runs inside the Redis client's message dispatch. An escape
-    // there kills the subscription — silently and permanently — which is far
-    // worse than losing the one message that caused it.
-    const boom = new Error('app eviction failed');
-    const onError = jest.fn();
-    const handle = createOxyUserInvalidationHandler({
-      onInvalidate: () => {
-        throw boom;
-      },
-      onError,
-    });
-
-    expect(() => handle(validMessage)).not.toThrow();
-    expect(onError).toHaveBeenCalledWith(boom, validMessage);
-  });
-
-  it('never throws when app eviction rejects', async () => {
-    const boom = new Error('async eviction failed');
-    const onError = jest.fn();
-    const handle = createOxyUserInvalidationHandler({
-      onInvalidate: () => Promise.reject(boom),
-      onError,
-    });
-
-    expect(() => handle(validMessage)).not.toThrow();
-    await Promise.resolve();
-    expect(onError).toHaveBeenCalledWith(boom, validMessage);
-  });
-
-  it('still runs app eviction when the SDK sweep throws', () => {
-    const onInvalidate = jest.fn();
-    const onError = jest.fn();
-    const evictor: OxyIdentityCacheEvictor = {
-      clearCacheEntry: () => {
-        throw new Error('sweep failed');
-      },
-      clearCacheByPrefix: () => 0,
-    };
-
-    createOxyUserInvalidationHandler({ oxy: evictor, onInvalidate, onError })(validMessage);
-
-    expect(onInvalidate).toHaveBeenCalled();
-    expect(onError).toHaveBeenCalled();
-  });
-
-  it('is a no-op with no options configured', () => {
-    expect(() => createOxyUserInvalidationHandler()(validMessage)).not.toThrow();
-  });
-});

package/src/server/__tests__/verifySecret.test.ts

@@ -1,40 +0,0 @@
-import { verifySecret } from '../verifySecret';
-
-describe('@oxy.so/core/server verifySecret', () => {
-  it('returns true for equal secrets', () => {
-    expect(verifySecret('s3cr3t-token', 's3cr3t-token')).toBe(true);
-    expect(verifySecret('a', 'a')).toBe(true);
-    const long = 'x'.repeat(256);
-    expect(verifySecret(long, long)).toBe(true);
-  });
-
-  it('returns false for unequal same-length secrets', () => {
-    expect(verifySecret('s3cr3t-token', 's3cr3t-tokeN')).toBe(false);
-    expect(verifySecret('abcd', 'abce')).toBe(false);
-  });
-
-  it('returns false on length mismatch without throwing', () => {
-    expect(() => verifySecret('short', 'a-much-longer-secret')).not.toThrow();
-    expect(verifySecret('short', 'a-much-longer-secret')).toBe(false);
-    expect(verifySecret('a-much-longer-secret', 'short')).toBe(false);
-    expect(verifySecret('abc', 'abcd')).toBe(false);
-  });
-
-  it('returns false for empty inputs', () => {
-    expect(verifySecret('', '')).toBe(false);
-    expect(verifySecret('', 'x')).toBe(false);
-    expect(verifySecret('x', '')).toBe(false);
-  });
-
-  it('returns false for non-string inputs without throwing', () => {
-    expect(() => verifySecret(undefined as unknown as string, 'x')).not.toThrow();
-    expect(verifySecret(undefined as unknown as string, 'x')).toBe(false);
-    expect(verifySecret('x', null as unknown as string)).toBe(false);
-    expect(verifySecret(123 as unknown as string, 123 as unknown as string)).toBe(false);
-  });
-
-  it('handles multi-byte UTF-8 content correctly', () => {
-    expect(verifySecret('clé-secrète-🔐', 'clé-secrète-🔐')).toBe(true);
-    expect(verifySecret('clé-secrète-🔐', 'cle-secrete-🔐')).toBe(false);
-  });
-});

package/src/server/__tests__/workloadIdentity.client.test.ts

@@ -1,16 +0,0 @@
-import { canAttestWorkloadIdentity, requestWorkloadServiceToken } from '../workloadIdentity.client';
-
-describe('client workload identity boundary', () => {
-  it('cannot attest even when Node process globals are present', () => {
-    expect(process.versions.node).toBeTruthy();
-    expect(canAttestWorkloadIdentity()).toBe(false);
-  });
-
-  it('rejects before contacting a server when explicitly requested', async () => {
-    const fetchSpy = jest.spyOn(globalThis, 'fetch');
-    await expect(requestWorkloadServiceToken({ baseUrl: 'https://example.test' }))
-      .rejects.toThrow('only available on a Node host');
-    expect(fetchSpy).not.toHaveBeenCalled();
-    fetchSpy.mockRestore();
-  });
-});

package/src/server/__tests__/workloadIdentity.test.ts

@@ -1,128 +0,0 @@
-import { describe, expect, it, jest } from '@jest/globals';
-
-import { canAttestWorkloadIdentity, requestWorkloadServiceToken } from '../workloadIdentity';
-
-/**
- * The client half of ADR 0026, and the two properties that decide whether it
- * works at all against the verifier in `packages/api`:
- *
- *  1. **The nonce is inside the signature.** The verifier refuses an attestation
- *     whose `SignedHeaders` omits the nonce header, so a signer that merely sets
- *     the header produces attestations that are always rejected — a failure that
- *     would only show up in production, against the real verifier.
- *  2. **The signed request is never sent to AWS.** Only Oxy replays it. A client
- *     that called STS itself would work in a test and leak an identity call per
- *     token in production.
- *
- * The signature's cryptographic correctness is AWS's to judge; what is asserted
- * here is its SHAPE, which is what the two halves have to agree on.
- */
-
-const CREDENTIALS = {
-  AccessKeyId: 'ASIAEXAMPLE',
-  SecretAccessKey: 'secret-example',
-  Token: 'session-token-example',
-};
-
-function harness(overrides: { tokenStatus?: number } = {}) {
-  const calls: { url: string; init?: RequestInit }[] = [];
-  const fetchImpl = (async (input: string | URL | Request, init?: RequestInit) => {
-    const url = String(input);
-    calls.push({ url, init });
-    if (url.endsWith('/auth/service-token/workload/challenge')) {
-      return new Response(JSON.stringify({ data: { nonce: 'nonce-from-oxy', expiresIn: 60 } }), { status: 200 });
-    }
-    if (url.includes('169.254.170.2')) {
-      return new Response(JSON.stringify(CREDENTIALS), { status: 200 });
-    }
-    if (url.endsWith('/auth/service-token/workload')) {
-      const status = overrides.tokenStatus ?? 200;
-      if (status !== 200) return new Response('{}', { status });
-      return new Response(
-        JSON.stringify({ data: { token: 'service-token', expiresIn: 3600, appName: 'Mention' } }),
-        { status: 200 },
-      );
-    }
-    throw new Error(`unexpected request to ${url}`);
-  }) as unknown as typeof fetch;
-  return { calls, fetchImpl };
-}
-
-describe('workload identity client', () => {
-  const previous = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
-
-  beforeEach(() => {
-    process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = '/v2/credentials/abc';
-  });
-
-  afterAll(() => {
-    // Cleared by assignment rather than `delete`: Biome refuses `delete` on a
-    // property access, and an empty value reads as "cannot attest" everywhere
-    // that matters here.
-    process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = previous ?? '';
-  });
-
-  it('knows whether this process can attest at all', () => {
-    expect(canAttestWorkloadIdentity({ AWS_CONTAINER_CREDENTIALS_RELATIVE_URI: '/v2/x' } as NodeJS.ProcessEnv)).toBe(true);
-    expect(canAttestWorkloadIdentity({} as NodeJS.ProcessEnv)).toBe(false);
-  });
-
-  it('answers the challenge with a signature that covers the nonce', async () => {
-    const { calls, fetchImpl } = harness();
-
-    const granted = await requestWorkloadServiceToken({ baseUrl: 'https://api.oxy.so/', fetch: fetchImpl });
-
-    expect(granted).toEqual({ token: 'service-token', expiresIn: 3600, appName: 'Mention' });
-
-    const exchange = calls.find((call) => call.url.endsWith('/auth/service-token/workload'));
-    const body = JSON.parse(String(exchange?.init?.body)) as {
-      provider: string;
-      nonce: string;
-      attestation: { headers: Record<string, string> };
-    };
-
-    expect(body.provider).toBe('aws-iam');
-    expect(body.nonce).toBe('nonce-from-oxy');
-    expect(body.attestation.headers['x-oxy-attestation-nonce']).toBe('nonce-from-oxy');
-    expect(body.attestation.headers.host).toBe('sts.amazonaws.com');
-    expect(body.attestation.headers['x-amz-security-token']).toBe(CREDENTIALS.Token);
-    // The property the verifier actually checks.
-    expect(body.attestation.headers.authorization).toMatch(
-      /^AWS4-HMAC-SHA256 Credential=ASIAEXAMPLE\/\d{8}\/us-east-1\/sts\/aws4_request, SignedHeaders=[^,]*x-oxy-attestation-nonce[^,]*, Signature=[0-9a-f]{64}$/,
-    );
-  });
-
-  it('never sends the signed request to AWS itself', async () => {
-    const { calls, fetchImpl } = harness();
-
-    await requestWorkloadServiceToken({ baseUrl: 'https://api.oxy.so', fetch: fetchImpl });
-
-    expect(calls.some((call) => call.url.includes('sts.amazonaws.com'))).toBe(false);
-  });
-
-  it('carries no credential material into the request body', async () => {
-    const { calls, fetchImpl } = harness();
-
-    await requestWorkloadServiceToken({ baseUrl: 'https://api.oxy.so', fetch: fetchImpl });
-
-    const exchange = calls.find((call) => call.url.endsWith('/auth/service-token/workload'));
-    expect(String(exchange?.init?.body)).not.toContain(CREDENTIALS.SecretAccessKey);
-  });
-
-  it('throws rather than returning an empty token when Oxy refuses', async () => {
-    const { fetchImpl } = harness({ tokenStatus: 403 });
-
-    await expect(
-      requestWorkloadServiceToken({ baseUrl: 'https://api.oxy.so', fetch: fetchImpl }),
-    ).rejects.toThrow(/refused the workload attestation \(403\)/);
-  });
-
-  it('throws when the process has no identity to prove', async () => {
-    process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = '';
-    const { fetchImpl } = harness();
-
-    await expect(
-      requestWorkloadServiceToken({ baseUrl: 'https://api.oxy.so', fetch: fetchImpl }),
-    ).rejects.toThrow(/cannot attest its identity/);
-  });
-});

package/src/session/__tests__/SessionClient.additive.test.ts

@@ -1,153 +0,0 @@
-import type { DeviceSessionState } from '@oxy.so/contracts';
-import { SessionClient, type SessionClientHost, type SessionStateOrigin } from '../SessionClient';
-import { createMemoryAuthStateStore } from '../authStateStore';
-
-const stateWith = (rev: number, active: string | null, accountIds: string[]): DeviceSessionState => ({
-  deviceId: 'd1',
-  accounts: accountIds.map((id, i) => ({ accountId: id, sessionId: `s-${id}`, authuser: i })),
-  activeAccountId: active,
-  revision: rev,
-  updatedAt: 1720000000000,
-});
-
-const sync = (state: DeviceSessionState) => ({ state, activeToken: { accessToken: `jwt-${state.revision}`, expiresAt: 'x' } });
-
-function makeHost(makeRequest: jest.Mock, currentAccountId: string | null = null): SessionClientHost {
-  return {
-    makeRequest,
-    getBaseURL: () => 'http://test.invalid',
-    getAccessToken: () => 't',
-    getDeviceCredential: () => null,
-    onTokensChanged: () => () => undefined,
-    setTokens: jest.fn(),
-    getCurrentAccountId: () => currentAccountId,
-  };
-}
-
-class TestClient extends SessionClient {
-  public apply(raw: unknown): boolean {
-    return this.applyState(raw);
-  }
-
-  public applyWith(raw: unknown, origin: SessionStateOrigin): boolean {
-    return this.applyState(raw, origin);
-  }
-}
-
-describe('SessionClient.registerAndActivate', () => {
-  it('adds then switches to the explicit target when it is not already active', async () => {
-    const makeRequest = jest
-      .fn()
-      // add → device set has a1 active, a2 present but not active
-      .mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1', 'a2'])))
-      // switch → a2 becomes active
-      .mockResolvedValueOnce(sync(stateWith(2, 'a2', ['a1', 'a2'])));
-    const c = new SessionClient(makeHost(makeRequest));
-
-    await c.registerAndActivate('a2');
-
-    expect(makeRequest).toHaveBeenNthCalledWith(1, 'POST', '/session/device/add', undefined, { cache: false });
-    expect(makeRequest).toHaveBeenNthCalledWith(2, 'POST', '/session/device/switch', { accountId: 'a2' }, { cache: false });
-    expect(c.getState()?.activeAccountId).toBe('a2');
-    c.stop();
-  });
-
-  it('falls back to the host current-account ref when no target is passed', async () => {
-    const makeRequest = jest
-      .fn()
-      .mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1', 'a2'])))
-      .mockResolvedValueOnce(sync(stateWith(2, 'a2', ['a1', 'a2'])));
-    const c = new SessionClient(makeHost(makeRequest, 'a2'));
-
-    await c.registerAndActivate();
-
-    expect(makeRequest).toHaveBeenNthCalledWith(2, 'POST', '/session/device/switch', { accountId: 'a2' }, { cache: false });
-    c.stop();
-  });
-
-  it('does NOT switch when the added account is already active', async () => {
-    const makeRequest = jest.fn().mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1'])));
-    const c = new SessionClient(makeHost(makeRequest));
-
-    await c.registerAndActivate('a1');
-
-    expect(makeRequest).toHaveBeenCalledTimes(1);
-    expect(makeRequest).toHaveBeenCalledWith('POST', '/session/device/add', undefined, { cache: false });
-    c.stop();
-  });
-});
-
-describe('SessionClient onUnauthenticated', () => {
-  it('fires when an applied state has zero accounts (device signout-all)', () => {
-    const onUnauthenticated = jest.fn();
-    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
-
-    c.apply(stateWith(1, 'a1', ['a1']));
-    expect(onUnauthenticated).not.toHaveBeenCalled();
-
-    c.apply(stateWith(2, null, []));
-    expect(onUnauthenticated).toHaveBeenCalledTimes(1);
-  });
-
-  it('does not fire for a stale (non-applied) empty state', () => {
-    const onUnauthenticated = jest.fn();
-    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
-
-    c.apply(stateWith(5, 'a1', ['a1']));
-    // revision 4 <= 5 → rejected, so onUnauthenticated must NOT fire.
-    c.apply(stateWith(4, null, []));
-    expect(onUnauthenticated).not.toHaveBeenCalled();
-  });
-
-  it('passes the applied-state ORIGIN through to onUnauthenticated', () => {
-    const onUnauthenticated = jest.fn();
-    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
-
-    // A socket-pushed empty state → `push` origin.
-    c.applyWith(stateWith(1, null, []), 'push');
-    expect(onUnauthenticated).toHaveBeenLastCalledWith('push');
-
-    // A direct REST response empty state → `request` origin.
-    c.applyWith(stateWith(2, null, []), 'request');
-    expect(onUnauthenticated).toHaveBeenLastCalledWith('request');
-  });
-});
-
-describe('SessionClient onUnauthenticated — durable credential guard (bug #4)', () => {
-  const CRED = { sessionId: 's1', userId: 'a1', deviceId: 'dev-1', deviceSecret: 'ds-1' };
-
-  // Mirror the provider's origin-gated wipe: erase the durable credential ONLY on
-  // a `request`-origin verdict, never on a (possibly transient) `push`.
-  function wireGuardedStore() {
-    const store = createMemoryAuthStateStore();
-    const onUnauthenticated = (origin: SessionStateOrigin) => {
-      if (origin === 'request') void store.clear();
-    };
-    return { store, onUnauthenticated };
-  }
-
-  it('a transient socket-pushed accounts===0 does NOT wipe the durable credential', async () => {
-    const { store, onUnauthenticated } = wireGuardedStore();
-    await store.save(CRED);
-    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
-
-    // A `push`-origin empty state (e.g. a reconnect race on another device).
-    c.applyWith(stateWith(2, null, []), 'push');
-    await Promise.resolve();
-
-    // The device credential survives — a reload can still restore the session.
-    expect(await store.load()).toEqual(CRED);
-  });
-
-  it('a real (request-origin) sign-out DOES wipe the durable credential', async () => {
-    const { store, onUnauthenticated } = wireGuardedStore();
-    await store.save(CRED);
-    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
-
-    // A `request`-origin empty state = the REST sign-out response.
-    c.applyWith(stateWith(2, null, []), 'request');
-    await Promise.resolve();
-
-    expect(await store.load()).toBeNull();
-  });
-});

package/src/session/__tests__/SessionClient.broadcastChannel.test.ts

@@ -1,114 +0,0 @@
-/**
- * SessionClient same-origin `BroadcastChannel` cross-tab state propagation.
- *
- * This is the AUTHENTICATED-only survivor of the zero-cookie cutover: when one
- * authenticated tab commits an account switch / sign-out, same-origin siblings
- * re-sync their device state instantly without waiting on the socket. The
- * signed-out "self-acquire on sibling sign-in" wake is gone (sockets are now
- * bearer-only), so every case here runs with a bearer present.
- */
-import type { DeviceSessionState } from '@oxy.so/contracts';
-
-type Handler = (...args: unknown[]) => void;
-class FakeSocket {
-  connected = false;
-  handlers = new Map<string, Handler[]>();
-  on(event: string, cb: Handler) { const l = this.handlers.get(event) ?? []; l.push(cb); this.handlers.set(event, l); }
-  off(event: string, cb?: Handler) { if (!cb) { this.handlers.delete(event); return; } this.handlers.set(event, (this.handlers.get(event) ?? []).filter((h) => h !== cb)); }
-  connect() { this.connected = true; this.trigger('connect'); }
-  disconnect() { this.connected = false; }
-  trigger(event: string, ...args: unknown[]) { for (const h of this.handlers.get(event) ?? []) h(...args); }
-}
-let fakeSocket: FakeSocket;
-const ioMock = jest.fn((_uri: string, opts?: Record<string, unknown>) => {
-  if (!opts || opts.autoConnect !== false) fakeSocket.connected = true;
-  return fakeSocket;
-});
-jest.mock('socket.io-client', () => ({ __esModule: true, io: (...args: unknown[]) => ioMock(...(args as [string, Record<string, unknown>?])) }));
-
-// A same-name in-process BroadcastChannel bus: postMessage delivers to every
-// OTHER open channel of the same name (never the sender) — matching the spec.
-type BusEntry = { name: string; onmessage: ((event: { data: unknown }) => void) | null };
-const bus = new Set<BusEntry>();
-class FakeBroadcastChannel {
-  private entry: BusEntry;
-  constructor(public name: string) { this.entry = { name, onmessage: null }; bus.add(this.entry); }
-  get onmessage(): ((event: { data: unknown }) => void) | null { return this.entry.onmessage; }
-  set onmessage(cb: ((event: { data: unknown }) => void) | null) { this.entry.onmessage = cb; }
-  postMessage(data: unknown) {
-    for (const e of bus) {
-      if (e === this.entry || e.name !== this.name) continue;
-      e.onmessage?.({ data });
-    }
-  }
-  close() { bus.delete(this.entry); }
-}
-
-import { SessionClient, type SessionClientHost } from '../SessionClient';
-
-const STATE = (rev: number, accounts = [{ accountId: 'a1', sessionId: 's1', authuser: 0 }]): DeviceSessionState =>
-  ({ deviceId: 'd1', accounts, activeAccountId: accounts[0]?.accountId ?? null, revision: rev, updatedAt: 1720000000000 });
-const SYNC = (rev: number) => ({ state: STATE(rev), activeToken: { accessToken: `jwt-${rev}`, expiresAt: 'x' } });
-
-function makeHost(over: Partial<SessionClientHost> = {}): SessionClientHost {
-  return {
-    makeRequest: jest.fn().mockResolvedValue(SYNC(1)),
-    getBaseURL: () => 'http://test.invalid',
-    getAccessToken: () => 'tok',
-    getDeviceCredential: () => null,
-    onTokensChanged: () => () => undefined,
-    setTokens: jest.fn(),
-    getCurrentAccountId: () => 'a1',
-    ...over,
-  };
-}
-
-const flush = async () => { await Promise.resolve(); await Promise.resolve(); };
-
-beforeEach(() => {
-  fakeSocket = new FakeSocket();
-  ioMock.mockClear();
-  bus.clear();
-  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = FakeBroadcastChannel as unknown;
-});
-afterEach(() => {
-  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
-});
-
-describe('SessionClient BroadcastChannel cross-tab re-sync (authenticated)', () => {
-  it('a local mutation wakes an authenticated same-origin sibling to re-sync (bootstrap)', async () => {
-    const bMakeRequest = jest.fn().mockResolvedValue(SYNC(1));
-    const b = new SessionClient(makeHost({ makeRequest: bMakeRequest, getAccessToken: () => 'tok-b' }), {});
-    await b.start();
-    bMakeRequest.mockClear();
-    const a = new SessionClient(makeHost({ getAccessToken: () => 'tok-a' }), {});
-    await a.start();
-    await a.addCurrentAccount();
-    await flush();
-    expect(bMakeRequest).toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
-    a.stop();
-    b.stop();
-  });
-
-  it('does not re-sync the posting tab from its own commit ping (no self-loop)', async () => {
-    const makeRequest = jest.fn().mockResolvedValue(SYNC(1));
-    const a = new SessionClient(makeHost({ makeRequest, getAccessToken: () => 'tok-a' }), {});
-    await a.start();
-    makeRequest.mockClear();
-    // `addCurrentAccount` POSTs then posts a commit ping; the ping never echoes
-    // to the sender, so this tab must NOT re-fetch its own device state.
-    await a.addCurrentAccount();
-    await flush();
-    expect(makeRequest).not.toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
-    a.stop();
-  });
-
-  it('is a no-op on platforms without BroadcastChannel (native)', async () => {
-    (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
-    const c = new SessionClient(makeHost({ getAccessToken: () => 'tok' }), {});
-    await c.start();
-    // Mutations must not throw when BroadcastChannel is absent.
-    await expect(c.switchAccount('a1')).resolves.toBeUndefined();
-    c.stop();
-  });
-});