@rangojs/router 0.0.0-experimental.124 → 0.0.0-experimental.126

package/src/testing/dispatch.ts

@@ -37,6 +37,10 @@
  *   (?_rsc_partial / ?_rsc_action): converted to a 204 + X-RSC-Redirect via the
  *   real interceptRedirectForPartial, so fetch() does not auto-follow the 3xx —
  *   identical to production's no-location-state path.
+ * - The open-redirect guard (rsc/redirect-guard.ts) on full (browser-followed)
+ *   redirects: a cross-origin Location is rewritten to the basename root unless
+ *   redirect(url, { external: true }) opted out, mirroring production's single
+ *   handler chokepoint. Soft partial/action redirects are 204 and pass through.
  *
  * What dispatch DOES NOT support (and why):
  * - RSC component routes — rendering requires the Flight serializer + React
@@ -91,6 +95,13 @@ import {
   interceptRedirectForPartial,
   mergeStubHeadersAndFinalize,
 } from "../rsc/helpers.js";
+import { guardOutgoingRedirect } from "../rsc/redirect-guard.js";
+import { stringifyJsonRouteResult } from "../rsc/json-route-result.js";
+import {
+  EXTERNAL_REDIRECT_MARKER,
+  isExternalRedirect,
+  markExternalRedirect,
+} from "../redirect-origin.js";
 import { isWebSocketUpgradeResponse } from "../response-utils.js";
 import type { Rango } from "../router/router-interfaces.js";
 
@@ -154,7 +165,8 @@ function toRequest(request: Request | string): Request {
 /**
  * Serialize a NON-Response response-route handler result, mirroring the
  * router's handleResponseRoute() contract:
- * - "json" serializes the value verbatim (bare) with application/json,
+ * - "json" serializes the value (bare) with application/json, rejecting a nested
+ *   unresolved Promise via the shared stringifyJsonRouteResult guard,
  * - text/html/xml/md stringify with the mapped MIME type.
  *
  * A handler-returned Response is NOT routed here — callHandler re-wraps it via
@@ -167,7 +179,12 @@ function serializeResponseRouteResult(
   responseType: string,
 ): Response {
   if (responseType === "json") {
-    return new Response(JSON.stringify(result), {
+    // Serialize through the SAME guard production uses: a nested unresolved
+    // Promise (forgotten await) throws RESPONSE_NOT_SERIALIZABLE here, caught by
+    // callHandler's catch and mapped to the identical typed 500 production
+    // returns -- so a dispatch json test fails exactly where production would,
+    // instead of silently emitting {} and passing.
+    return new Response(stringifyJsonRouteResult(result), {
       status: 200,
       headers: { "content-type": "application/json;charset=utf-8" },
     });
@@ -252,16 +269,27 @@ function rewrapHandlerResponse(result: Response): Response {
   }
   const headers = new Headers();
   result.headers.forEach((value, key) => {
+    // Mirror production: never copy the reserved external-redirect marker off a
+    // handler result (it is not a trust signal; the opt-in is the out-of-band
+    // brand transferred below).
+    if (key.toLowerCase() === EXTERNAL_REDIRECT_MARKER) return;
     if (key.toLowerCase() === "set-cookie") {
       headers.append(key, value);
     } else {
       headers.set(key, value);
     }
   });
-  return createResponseWithMergedHeaders(result.body, {
+  const rewrapped = createResponseWithMergedHeaders(result.body, {
     status: result.status,
     headers,
   });
+  // Mirror production's rewrapResponse: transfer the out-of-band external brand
+  // only from a genuinely branded result (a real redirect(url, { external:
+  // true })), never from a proxied upstream's forged header.
+  if (isExternalRedirect(result)) {
+    markExternalRedirect(rewrapped);
+  }
+  return rewrapped;
 }
 
 /**
@@ -506,7 +534,6 @@ export async function dispatch<TEnv = any>(
             regex: null,
             paramNames: [],
             handler: mw.handler,
-            mountPrefix: null,
           } as MiddlewareEntry<TEnv>,
           params: mw.params,
         }),
@@ -569,13 +596,23 @@ export async function dispatch<TEnv = any>(
     // callbacks via finalizeResponse. dispatch is RSC-free, so the
     // createRedirectFlightResponse stand-in falls back to the no-state
     // 204 + X-RSC-Redirect (see the location-state divergence in the header).
+    let finalResponse: Response;
     if (isPartial || isAction) {
       const intercepted = interceptRedirectForPartial(
         mwResponse,
         (redirectUrl) => createSimpleRedirectResponse(redirectUrl),
       );
-      return finalizeResponse(intercepted ?? mwResponse);
+      finalResponse = finalizeResponse(intercepted ?? mwResponse);
+    } else {
+      finalResponse = finalizeResponse(mwResponse);
     }
-    return finalizeResponse(mwResponse);
+
+    // Mirror production's single open-redirect chokepoint (handler.ts): every
+    // browser-followed (3xx + Location) redirect is same-origin guarded before
+    // it leaves -- a cross-origin Location is rewritten to the basename root
+    // unless redirect(url, { external: true }) opted out. Soft partial/action
+    // redirects are 204 + X-RSC-Redirect and pass through untouched (the client
+    // validates them), so this is a no-op for them.
+    return guardOutgoingRedirect(finalResponse, url.origin, router.basename);
   });
 }

package/src/testing/e2e/index.ts

@@ -1,8 +1,3 @@
-// Public entry for the consumer e2e harness. `createRangoE2E({ test, expect })`
-// wires the server fixture, page helpers, parity helpers, and matchers around
-// the consumer's Playwright `test`/`expect` objects so this module never
-// imports `@playwright/test` at runtime (type-only imports are erased).
-
 import type { Expect, TestType } from "@playwright/test";
 import {
   createUseFixture,
@@ -35,14 +30,9 @@ import {
 } from "./parity.js";
 import { createRangoMatchers, type RangoMatchers } from "./matchers.js";
 
-// Cache-status helpers are pure (cache-status.ts imports only TYPES), so they
-// are safe to surface from this Playwright-runnable entry. Importing them from
-// the `@rangojs/router/testing` barrel does NOT work in a plain Playwright
-// runner — the barrel transitively pulls the build-only `@rangojs/router:version`
-// virtual via the route-manifest path. Asserting cache status on a real
-// response is an e2e activity, so this is their Playwright-safe home.
 export {
   assertCacheStatus,
+  assertCacheDecision,
   parseCacheHeader,
   createCacheSink,
   filterCacheDecisions,
@@ -50,9 +40,6 @@ export {
   type ExpectedCacheStatus,
   type CacheStatusTarget,
 } from "../cache-status.js";
-
-// Re-export standalone helpers and all public types so the barrel can re-export
-// them from a single module.
 export {
   testId,
   waitForHydration,
@@ -87,7 +74,6 @@ export interface RangoE2E extends PageHelpers, Parity {
   useFixture: (options: FixtureOptions) => Fixture;
   testNoJs: TestType<any, any>;
   rangoMatchers: RangoMatchers;
-  // Standalone helpers, re-surfaced for convenience.
   testId: typeof testId;
   waitForHydration: typeof waitForHydration;
   waitForNavigation: typeof waitForNavigation;
@@ -102,12 +88,6 @@ export interface RangoE2E extends PageHelpers, Parity {
   measureTime: typeof measureTime;
 }
 
-/**
- * Wire the full e2e harness around a consumer's Playwright `test`/`expect`.
- *
- * @param defaultRoot - fallback app root for `parityDescribe` when a call omits
- *   `options.root`.
- */
 export function createRangoE2E({
   test,
   expect,
@@ -132,7 +112,6 @@ export function createRangoE2E({
     rangoMatchers,
     ...parity,
     ...pageHelpers,
-    // Standalone helpers.
     testId,
     waitForHydration,
     waitForNavigation,

package/src/testing/e2e/matchers.ts

@@ -1,6 +1,3 @@
-// Custom Playwright matchers for Rango assertions. Returned as an object
-// suitable for `expect.extend(...)`. v1 ships only `toHaveRangoPathname`.
-
 import type { Expect, Page } from "@playwright/test";
 
 interface MatcherResult {
@@ -12,17 +9,6 @@ export interface RangoMatchers {
   toHaveRangoPathname: (page: Page, expected: string) => MatcherResult;
 }
 
-/**
- * Build the matcher object for `expect.extend(createRangoMatchers(expect))`.
- *
- * `toHaveRangoPathname(page, expected)` asserts that the pathname of the page's
- * current URL equals `expected`.
- *
- * TODO: `toHaveSegments` / `toHaveParams` are intentionally not implemented.
- * They require a client-emitted signal (the active segment chain / resolved
- * params exposed on the page) that does not exist yet; implementing them by
- * scraping the DOM would be a guess. Add them once the router emits that signal.
- */
 export function createRangoMatchers(_expect: Expect): RangoMatchers {
   return {
     toHaveRangoPathname(page: Page, expected: string): MatcherResult {
@@ -39,8 +25,6 @@ export function createRangoMatchers(_expect: Expect): RangoMatchers {
   };
 }
 
-// Type augmentation so consumers can call `await expect(page).toHaveRangoPathname("/x")`
-// after `expect.extend(rangoMatchers)`, without re-declaring the matcher.
 declare global {
   // eslint-disable-next-line @typescript-eslint/no-namespace
   namespace PlaywrightTest {

package/src/testing/flight-matchers.ts

@@ -42,14 +42,6 @@ interface MatcherResult {
   message: () => string;
 }
 
-/**
- * Matcher object for `expect.extend(flightMatchers)`.
- *
- * - `toMatchFlight(received, expected)` — `received` is a rendered Flight
- *   string; passes if its normalized form contains `expected`.
- * - `toMatchFlightSnapshot(received)` — delegates to vitest's snapshot on the
- *   normalized Flight string.
- */
 export const flightMatchers: {
   toMatchFlight(received: string, expected: string): MatcherResult;
   toMatchFlightSnapshot(received: string): MatcherResult;
@@ -78,12 +70,7 @@ export const flightMatchers: {
   },
 
   toMatchFlightSnapshot(received: string): MatcherResult {
-    // Delegate to vitest's snapshot engine on the normalized string. The
-    // snapshot is keyed by the current test file/title (vitest tracks this via
-    // the active test context), not by this call site, so delegating through a
-    // freshly imported `expect` is reliable.
     expect(normalizeFlight(received)).toMatchSnapshot();
-    // toMatchSnapshot throws on mismatch; reaching here means it passed.
     return {
       pass: true,
       message: () => "Flight snapshot matched.",

package/src/testing/flight-normalize.ts

@@ -1,36 +1,9 @@
-/**
- * normalizeFlight — scrub volatile bits from a Flight wire string so snapshots
- * are stable across runs/machines.
- *
- * This is two regex replacements and NOTHING else. It is split out of flight.ts
- * on purpose: flight.ts top-level imports the vendored react-server-dom
- * serializer, which throws when imported outside the `react-server` export
- * condition. The flight-matchers module (and a consumer's shared `setupFiles`
- * that does `expect.extend(flightMatchers)`) must be importable under the PLAIN
- * node condition, so the normalizer it needs cannot live next to that import.
- * flight.ts re-exports normalizeFlight from here, so the public surface of the
- * `@rangojs/router/testing/flight` entry is unchanged.
- */
-
-// Volatile leading reference row: `:N<timestamp>` (dev debug-info anchor).
+// Volatile leading reference row: `:N<timestamp>` (dev only).
 const REFERENCE_ROW_RE = /^:N[\d.]+\n/;
-// Absolute file:// paths embedded in dev STACK rows. The serializer emits stack
-// frames as `["Component","file:///abs/path.tsx",<line>,<col>,...]`, so the
-// path is a quoted JSON string immediately followed by `",<line>,<col>`. The
-// lookahead scopes the scrub to exactly that frame shape, leaving a legitimate
-// `file://` href in RENDERED content (e.g. `{"href":"file:///x"}`) untouched.
+// Absolute file:// paths in dev stack rows. Pattern matches frames
+// `["Component","file:///path",<line>,<col>...]` and scrubs the path only.
 const FILE_URL_RE = /file:\/\/[^"\\]+(?=",\d+,\d+)/g;
 
-/**
- * Scrub volatile bits from a Flight string so snapshots are stable across runs
- * and machines:
- * - the leading `:N<timestamp>` reference row (dev only),
- * - absolute `file://...` paths inside dev stack rows.
- *
- * Under NODE_ENV=production these rows are already absent; normalize is a
- * no-op safety net there. In dev mode it removes the machine/clock-specific
- * noise while leaving the rendered tree intact.
- */
 export function normalizeFlight(flight: string): string {
   return flight
     .replace(REFERENCE_ROW_RE, "")

package/src/testing/flight.ts

@@ -70,6 +70,14 @@ export interface RenderToFlightStringOptions {
   params?: Record<string, string>;
   /** Matched route name (drives `ctx.routeName` and scoped reverse). */
   routeName?: string;
+  /**
+   * Route name -> pattern map enabling a SCOPED `ctx.reverse()` (like
+   * `renderHandler`). Without it, a server component that reverses resolves
+   * against the GLOBAL route map and is order-dependent on whatever router
+   * registered last. Pass the router-under-test's map to make reversing
+   * deterministic.
+   */
+  routeMap?: Record<string, string>;
   /**
    * Context variables visible to the rendered tree via `ctx.get(...)` — as a
    * prior middleware would have set them. Seeds the SAME way the handler-test
@@ -83,12 +91,43 @@ export interface RenderToFlightStringOptions {
 const DEFAULT_URL = "http://localhost/";
 
 /**
- * Guard the pre-rename `{ url }` option (renamed to `{ request }`). A plain-JS
- * consumer, or one whose object spread defeats the compile-time type error,
- * would otherwise have `{ url }` SILENTLY ignored and render against
- * http://localhost/. Throw a clear migration error instead. Cheap: a single
- * `in` check on the already-built options object.
+ * True when `error` is the out-of-react-server stub thrown by index.ts's
+ * server-only exports (getRequestContext/cookies/headers/...) — i.e. the bare
+ * `@rangojs/router` specifier resolved to index.ts, not index.rsc.ts, because
+ * the rsc Vitest project is missing the `rangoTestAliases` alias. Matches both
+ * substrings of `serverOnlyStubError` (index.ts) so a normal app error cannot
+ * over-match. Shared with render-handler.ts so the two Flight primitives report
+ * the same misconfiguration identically.
+ */
+export function isServerOnlyStubError(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    error.message.includes("is only available from") &&
+    error.message.includes("react-server")
+  );
+}
+
+/**
+ * Rethrow a server tree render error. When it is the missing-rsc-alias stub
+ * (above), rethrow an actionable message naming `rangoTestAliases` instead of
+ * the opaque stub text; otherwise rethrow the original unchanged. Classify the
+ * ORIGINAL error before constructing the wrapper so the wrapper's `Original: ...`
+ * echo (which re-embeds the matched substrings) never re-triggers the predicate.
  */
+function rethrowFlightRenderError(error: unknown): never {
+  if (isServerOnlyStubError(error)) {
+    throw new Error(
+      `The server component called a server-only API ` +
+        `(getRequestContext/cookies/headers/...) but "@rangojs/router" resolved to ` +
+        `the out-of-react-server stub. Add rangoTestAliases({ preset }) to your ` +
+        `vitest.rsc.config.ts \`resolve.alias\` so the bare specifier maps to ` +
+        `index.rsc.ts (the real react-server implementations). ` +
+        `Original: ${(error as Error).message}`,
+    );
+  }
+  throw error;
+}
+
 export function assertNoLegacyUrlOption(opts: object, fnName: string): void {
   if ("url" in opts) {
     throw new Error(
@@ -100,11 +139,6 @@ export function assertNoLegacyUrlOption(opts: object, fnName: string): void {
   }
 }
 
-/**
- * Wrap a single element in the minimal ResolvedSegment + RscPayload shape that
- * mirrors Rango's wire format, so the serialized output matches what a real
- * route segment would emit.
- */
 function wrapAsPayload(element: ReactNode, pathname: string): RscPayload {
   const segment: ResolvedSegment = {
     id: "test",
@@ -137,20 +171,9 @@ export async function renderToFlightString(
   opts: RenderToFlightStringOptions = {},
 ): Promise<string> {
   assertNoLegacyUrlOption(opts, "renderToFlightString");
-  // Server-only trees: empty client manifest. A client reference would emit an
-  // unresolvable `I` row here; use renderServerTree (flight-tree.ts) when the
-  // tree has client boundaries you want to inspect.
   return serializeToFlightString(element, opts, {});
 }
 
-/**
- * Shared serialize core: set up a request context, wrap the element as a Rango
- * payload, and serialize it with the given client-reference manifest. Used by
- * {@link renderToFlightString} (empty manifest) and renderServerTree (a manifest
- * that resolves every registered client reference).
- *
- * Must run under the `react-server` export condition (see module header).
- */
 export async function serializeToFlightString(
   element: ReactNode,
   opts: RenderToFlightStringOptions,
@@ -167,39 +190,21 @@ export async function serializeToFlightString(
     env: opts.env ?? {},
     request,
     url,
-    // Seed vars so a server component reading ctx.get(MyVar) during render sees
-    // them — same seeding the handler-test primitives use.
     variables: seedVariables({}, opts.vars),
   });
 
   return runWithRequestContext(ctx, () => {
-    setRequestContextParams(opts.params ?? {}, opts.routeName);
+    setRequestContextParams(opts.params ?? {}, opts.routeName, opts.routeMap);
     return serializeNodeToFlight(element, clientManifest, url.pathname);
   });
 }
 
-/**
- * Serialize a node to a Flight string, ASSUMING a request context is already
- * active (i.e. called inside `runWithRequestContext`). This is the core
- * `renderHandler` reuses: it enters its own context, builds a HandlerContext,
- * invokes the handler, then serializes the returned RSC in that SAME context (so
- * cookies/headers/vars/handles the handler set are all on one context).
- *
- * Must run under the `react-server` export condition (see module header).
- */
 export async function serializeNodeToFlight(
   node: ReactNode,
   clientManifest: unknown,
   pathname: string,
 ): Promise<string> {
   const payload = wrapAsPayload(node, pathname);
-  // Capture (do NOT rethrow) the first render error. The serializer calls
-  // onError from its own scheduled work; throwing there escapes as an unhandled
-  // rejection AND leaves the stream un-closed, so the drain below would hang
-  // until the test times out. Production's onError returns void (rsc-rendering.ts)
-  // so the stream completes with an error row. We mirror that — let the stream
-  // finish — then surface the error as a clean rejection after draining, so
-  // `await expect(...).rejects.toThrow()` works.
   let renderError: unknown;
   let didError = false;
   const stream = RSDServer.renderToReadableStream(payload, clientManifest, {
@@ -210,18 +215,11 @@ export async function serializeNodeToFlight(
       }
     },
   });
-  // Drain inside the context so async components see ctx during streaming.
   const text = await new Response(stream).text();
-  if (didError) throw renderError;
+  if (didError) rethrowFlightRenderError(renderError);
   return text;
 }
 
-/**
- * Smoke check that the vendored serializer subpath still resolves and exposes
- * `renderToReadableStream`. The vendored path is private to plugin-rsc; a minor
- * bump could relocate it. Call this in a test to fail loudly with a clear
- * message instead of an opaque import error.
- */
 export function assertFlightRuntimeAvailable(): void {
   if (typeof RSDServer.renderToReadableStream !== "function") {
     throw new Error(

package/src/testing/generated-routes.ts

@@ -32,14 +32,6 @@ interface RouterWithRouteMap {
   findMatch?: (pathname: string) => unknown;
 }
 
-/**
- * Derive a best-effort concrete path from a route pattern so `findMatch` can be
- * invoked to expand a lazy include. `:param`, `:param(constraint)`, optional
- * `:param?`, and `*` are all replaced with a literal segment. A constrained
- * param may not match its constraint (so that one route's match fails), but
- * since matching ANY route in an include expands ALL of the include's routes,
- * a sibling route in the same include will still trigger expansion.
- */
 function concretePath(pattern: string): string {
   return (
     pattern
@@ -50,17 +42,6 @@ function concretePath(pattern: string): string {
   );
 }
 
-/**
- * Force-expand the router's lazy `include()`d routes into `router.routeMap`.
- *
- * All Rango includes are lazy — their child routes only populate `routeMap` when
- * the router first matches a path inside them (in production the build-time
- * manifest virtual carries the full map; in a bare test that virtual is absent).
- * To make the whole-app drift check work in a unit test, we trigger expansion by
- * calling `findMatch` on a concrete path derived from each known pattern. This is
- * idempotent and side-effect-free beyond populating the route map. Routers that
- * don't expose `findMatch` (e.g. a plain `{ routeMap }` object) are left as-is.
- */
 function expandLazyIncludes(
   router: RouterWithRouteMap,
   patterns: Iterable<string>,
@@ -70,10 +51,7 @@ function expandLazyIncludes(
   for (const pattern of patterns) {
     try {
       findMatch.call(router, concretePath(pattern));
-    } catch {
-      // A pattern that fails to match (constrained param, etc.) is fine — a
-      // sibling route in the same include still triggers expansion.
-    }
+    } catch {}
   }
 }
 
@@ -100,11 +78,6 @@ export interface GeneratedRoutesDiff {
   ok: boolean;
 }
 
-/**
- * Normalize a route map value to its pattern string. Route maps may carry
- * either a bare pattern string or a `{ path, ... }` object (for response/search
- * routes); compare on the `path`.
- */
 function patternOf(value: unknown): string {
   if (typeof value === "string") return value;
   if (
@@ -118,19 +91,12 @@ function patternOf(value: unknown): string {
   return String(value);
 }
 
-/**
- * Compute the diff between a router's runtime route map and a generated map.
- */
 export function diffGeneratedRoutes(
   router: RouterWithRouteMap,
   generatedMap?: Record<string, unknown>,
 ): GeneratedRoutesDiff {
   const generated = generatedMap ?? getGlobalRouteMap();
 
-  // Lazy `include()`d routes are absent from `routeMap` until first matched, so
-  // expand them first (using the generated patterns to drive the matches) —
-  // otherwise every included route is a false `missing`. No-op for plain
-  // `{ routeMap }` objects that don't expose `findMatch`.
   expandLazyIncludes(
     router,
     Object.values(generated).map((v) => patternOf(v)),
@@ -155,12 +121,6 @@ export function diffGeneratedRoutes(
   }
 
   for (const name of Object.keys(runtime)) {
-    // Auto-generated internal names ($path_*/$prefix_*) live in the runtime
-    // mergedRouteMap but are deliberately excluded from the generated
-    // *.named-routes.gen.ts file (route-types-writer / runtime-discovery skip
-    // them). Reporting them as `extra` would throw on a perfectly in-sync app
-    // that simply uses an unnamed path()/include() route, so skip them here to
-    // match exactly the surface the generator emits.
     if (isAutoGeneratedRouteName(name)) continue;
     if (!(name in generated)) {
       extra.push(name);

package/src/testing/index.ts

@@ -34,7 +34,6 @@
  * - RSC:         see @rangojs/router/testing/flight
  */
 
-// Unit
 export { runMiddleware } from "./run-middleware.js";
 export type {
   RunMiddlewareOptions,
@@ -48,17 +47,12 @@ export type {
   TestLoaderContext,
 } from "./run-loader.js";
 
-// Integration
 export { dispatch } from "./dispatch.js";
 export type { DispatchOptions } from "./dispatch.js";
 
-// renderRoute lives at `@rangojs/router/testing/dom` — it pulls React, the
-// browser runtime, and @testing-library/react types, which this barrel keeps
-// out so node-only unit suites depend on none of them.
-
-// Cross-cutting: cache/prerender status
 export {
   assertCacheStatus,
+  assertCacheDecision,
   parseCacheHeader,
   createCacheSink,
   filterCacheDecisions,
@@ -68,9 +62,6 @@ export type {
   CacheStatusTarget,
   CacheSink,
 } from "./cache-status.js";
-// The telemetry event types a cache-status assertion inspects (createCacheSink
-// records CacheDecisionEvents; filterCacheDecisions narrows them). Re-exported
-// here so a test can annotate the events without reaching past `@rangojs/router/testing`.
 export type {
   TelemetryEvent,
   TelemetrySink,
@@ -79,10 +70,8 @@ export type {
   CacheSegmentStatus,
 } from "../router/telemetry.js";
 
-// Cross-cutting: handle collect/accumulator
 export { collectHandle } from "./collect-handle.js";
 
-// Cross-cutting: generated-route drift
 export {
   diffGeneratedRoutes,
   assertGeneratedRoutesMatch,
@@ -92,7 +81,6 @@ export type {
   GeneratedRouteMismatch,
 } from "./generated-routes.js";
 
-// Advanced: build a real RequestContext for bespoke loader/middleware setups
 export {
   createTestRequestContext,
   runInRequestContext,
@@ -108,12 +96,4 @@ export type {
   StateCookieSeed,
 } from "./internal/context.js";
 
-// The low-level context runner that enters a RequestContext (the same one the
-// RSC handler uses for server actions). Re-exported so a ctx built with
-// createTestRequestContext can be entered directly; runInRequestContext is the
-// one-call convenience over createTestRequestContext + runWithRequestContext.
 export { runWithRequestContext } from "../server/request-context.js";
-
-// The E2E harness is NOT re-exported here: it must be imported from
-// `@rangojs/router/testing/e2e` so it stays loadable in a plain Playwright
-// runner (this barrel pulls in router-manifest code that needs Vite virtuals).