@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/test/driver-registry.test.ts

@@ -14,7 +14,9 @@ function createMockDataDriverDelegate(key: string): DataDriver {
         initialised: true,
         fetchCollection: jest.fn().mockResolvedValue([]),
         fetchEntity: jest.fn().mockResolvedValue(undefined),
-        saveEntity: jest.fn().mockResolvedValue({ id: "test-id", path: "test", values: {} }),
+        saveEntity: jest.fn().mockResolvedValue({ id: "test-id",
+path: "test",
+values: {} }),
         deleteEntity: jest.fn().mockResolvedValue(undefined),
         checkUniqueField: jest.fn().mockResolvedValue(true)
     };
@@ -86,7 +88,7 @@ describe("DriverRegistry", () => {
                 const registry = new DefaultDriverRegistry();
 
                 expect(() => registry.getDefault()).toThrow(
-                    `[DriverRegistry] No default driver registered.`
+                    "[DriverRegistry] No default driver registered."
                 );
             });
         });

package/test/error-propagation.test.ts

@@ -0,0 +1,226 @@
+import { Hono } from "hono";
+import { ApiError, errorHandler } from "../src/api/errors";
+import { HonoEnv } from "../src/api/types";
+
+/**
+ * End-to-end tests that verify ApiError thrown inside Hono sub-routers
+ * produces the correct HTTP status code and JSON body WHEN the sub-router
+ * is mounted on a parent app — exactly simulating the init.ts mounting
+ * pattern.
+ *
+ * This is critical because Hono's `onError` does NOT propagate from parent
+ * to child routers. Each sub-router must have its own `router.onError(errorHandler)`.
+ */
+describe("Error Propagation through Sub-Routers", () => {
+
+    // ── Without onError on sub-router (broken behavior) ─────────────
+
+    describe("Sub-router WITHOUT onError (demonstrates the bug)", () => {
+        function createBrokenApp() {
+            // This simulates the REAL production scenario: the consumer's Hono app
+            // (e.g. SustenTalent's index.ts) does NOT set onError on the parent app.
+            // Without onError on the sub-router either, Hono's DEFAULT error handler
+            // catches ApiErrors and returns a generic 500 with a plain text body.
+            const parentApp = new Hono<HonoEnv>();
+            // NOTE: no parentApp.onError(errorHandler) — this is the real scenario
+
+            const subRouter = new Hono<HonoEnv>();
+            // NOTE: no subRouter.onError(errorHandler) — this is the bug
+            subRouter.get("/login", () => {
+                throw ApiError.unauthorized("Invalid credentials", "INVALID_CREDENTIALS");
+            });
+
+            parentApp.route("/api/auth", subRouter);
+            return parentApp;
+        }
+
+        it("ApiError.unauthorized returns 500 plain text without ANY onError handler", async () => {
+            const app = createBrokenApp();
+            const res = await app.request("/api/auth/login");
+            // Without any onError handler, Hono's default handler returns 500
+            expect(res.status).toBe(500);
+            // And the body is NOT our structured JSON — it's plain text
+            const text = await res.text();
+            expect(text).toBe("Internal Server Error");
+        });
+    });
+
+    // ── With onError on sub-router (fixed behavior) ─────────────────
+
+    describe("Sub-router WITH onError (correct behavior)", () => {
+        function createFixedApp() {
+            const parentApp = new Hono<HonoEnv>();
+            parentApp.onError(errorHandler);
+
+            const subRouter = new Hono<HonoEnv>();
+            subRouter.onError(errorHandler); // ← THE FIX
+
+            subRouter.get("/login", () => {
+                throw ApiError.unauthorized("Invalid credentials", "INVALID_CREDENTIALS");
+            });
+            subRouter.get("/register", () => {
+                throw ApiError.conflict("Email already exists", "EMAIL_EXISTS");
+            });
+            subRouter.get("/refresh", () => {
+                throw ApiError.unauthorized("Refresh token expired", "TOKEN_EXPIRED");
+            });
+            subRouter.get("/forbidden", () => {
+                throw ApiError.forbidden("Admin only");
+            });
+            subRouter.get("/not-found", () => {
+                throw ApiError.notFound("User not found");
+            });
+            subRouter.get("/bad-request", () => {
+                throw ApiError.badRequest("Missing email", "INVALID_INPUT", { field: "email" });
+            });
+            subRouter.get("/service-unavailable", () => {
+                throw ApiError.serviceUnavailable("Google login not configured", "NOT_CONFIGURED");
+            });
+            subRouter.get("/generic-error", () => {
+                throw new Error("Unexpected failure");
+            });
+
+            parentApp.route("/api/auth", subRouter);
+            return parentApp;
+        }
+
+        it("returns 401 for unauthorized errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/login");
+            expect(res.status).toBe(401);
+            const body = await res.json() as { error: { message: string; code: string } };
+            expect(body.error.message).toBe("Invalid credentials");
+            expect(body.error.code).toBe("INVALID_CREDENTIALS");
+        });
+
+        it("returns 409 for conflict errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/register");
+            expect(res.status).toBe(409);
+            const body = await res.json() as { error: { message: string; code: string } };
+            expect(body.error.message).toBe("Email already exists");
+            expect(body.error.code).toBe("EMAIL_EXISTS");
+        });
+
+        it("returns 401 for expired refresh token", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/refresh");
+            expect(res.status).toBe(401);
+            const body = await res.json() as { error: { message: string; code: string } };
+            expect(body.error.code).toBe("TOKEN_EXPIRED");
+        });
+
+        it("returns 403 for forbidden errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/forbidden");
+            expect(res.status).toBe(403);
+        });
+
+        it("returns 404 for not found errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/not-found");
+            expect(res.status).toBe(404);
+        });
+
+        it("returns 400 with details for bad request errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/bad-request");
+            expect(res.status).toBe(400);
+            const body = await res.json() as { error: { message: string; code: string; details: unknown } };
+            expect(body.error.code).toBe("INVALID_INPUT");
+            expect(body.error.details).toEqual({ field: "email" });
+        });
+
+        it("returns 503 for service unavailable errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/service-unavailable");
+            expect(res.status).toBe(503);
+            const body = await res.json() as { error: { message: string; code: string } };
+            expect(body.error.code).toBe("NOT_CONFIGURED");
+        });
+
+        it("returns 500 with sanitized message for generic errors", async () => {
+            const app = createFixedApp();
+            const res = await app.request("/api/auth/generic-error");
+            expect(res.status).toBe(500);
+            const body = await res.json() as { error: { message: string; code: string } };
+            expect(body.error.code).toBe("INTERNAL_ERROR");
+            // Should NOT leak the raw error message
+            expect(body.error.message).toBe("Internal Server Error");
+        });
+
+        it("returns consistent { error: { message, code } } shape for all error types", async () => {
+            const app = createFixedApp();
+            const paths = ["/api/auth/login", "/api/auth/register", "/api/auth/forbidden", "/api/auth/not-found", "/api/auth/bad-request"];
+
+            for (const path of paths) {
+                const res = await app.request(path);
+                const body = await res.json() as Record<string, unknown>;
+                expect(body).toHaveProperty("error");
+                expect(body.error).toHaveProperty("message");
+                expect(body.error).toHaveProperty("code");
+            }
+        });
+    });
+
+    // ── Multi-level nesting ─────────────────────────────────────────
+
+    describe("Deeply nested sub-routers", () => {
+        it("error handler works through two levels of nesting", async () => {
+            const root = new Hono<HonoEnv>();
+            root.onError(errorHandler);
+
+            const level1 = new Hono<HonoEnv>();
+            level1.onError(errorHandler);
+
+            const level2 = new Hono<HonoEnv>();
+            level2.onError(errorHandler);
+
+            level2.get("/deep", () => {
+                throw ApiError.unauthorized("Deep error");
+            });
+
+            level1.route("/nested", level2);
+            root.route("/api", level1);
+
+            const res = await root.request("/api/nested/deep");
+            expect(res.status).toBe(401);
+            const body = await res.json() as { error: { message: string } };
+            expect(body.error.message).toBe("Deep error");
+        });
+    });
+
+    // ── Data router simulation ──────────────────────────────────────
+
+    describe("Data router error propagation (simulates init.ts pattern)", () => {
+        function createDataApp() {
+            const app = new Hono<HonoEnv>();
+            app.onError(errorHandler);
+
+            const dataRouter = new Hono<HonoEnv>();
+            dataRouter.onError(errorHandler);
+
+            dataRouter.get("/posts/:id", () => {
+                throw ApiError.notFound("Entity not found");
+            });
+            dataRouter.post("/posts", () => {
+                throw ApiError.badRequest("Validation failed", "INVALID_INPUT");
+            });
+
+            app.route("/api/data", dataRouter);
+            return app;
+        }
+
+        it("returns 404 for entity not found", async () => {
+            const app = createDataApp();
+            const res = await app.request("/api/data/posts/999");
+            expect(res.status).toBe(404);
+        });
+
+        it("returns 400 for validation errors", async () => {
+            const app = createDataApp();
+            const res = await app.request("/api/data/posts", { method: "POST" });
+            expect(res.status).toBe(400);
+        });
+    });
+});

package/test/errors.test.ts

@@ -6,18 +6,19 @@ function createMockContext(method = "GET", path = "/test") {
     let capturedBody: any;
 
     const c = {
-        req: { method, path },
+        req: { method,
+path },
         json: (body: any, status?: number) => {
             capturedBody = body;
             capturedStatus = status ?? 200;
             return new Response(JSON.stringify(body), { status: capturedStatus });
-        },
+        }
     } as any;
 
     return {
         c,
         getStatus: () => capturedStatus,
-        getBody: () => capturedBody,
+        getBody: () => capturedBody
     };
 }
 
@@ -100,7 +101,8 @@ describe("errorHandler", () => {
 
         expect(getStatus()).toBe(404);
         expect(getBody()).toEqual({
-            error: { message: "User not found", code: "NOT_FOUND" }
+            error: { message: "User not found",
+code: "NOT_FOUND" }
         });
     });
 
@@ -125,7 +127,8 @@ describe("errorHandler", () => {
 
         expect(getStatus()).toBe(404);
         expect(getBody()).toEqual({
-            error: { message: "Not found", code: "NOT_FOUND" }
+            error: { message: "Not found",
+code: "NOT_FOUND" }
         });
     });
 
@@ -136,13 +139,15 @@ describe("errorHandler", () => {
 
         expect(getStatus()).toBe(500);
         expect(getBody()).toEqual({
-            error: { message: "Internal Server Error", code: "INTERNAL_ERROR" }
+            error: { message: "Internal Server Error",
+code: "INTERNAL_ERROR" }
         });
     });
 
     it("should use statusCode from error if present", () => {
         const { c, getStatus } = createMockContext();
-        const err = Object.assign(new Error("Rate limited"), { statusCode: 429, code: "RATE_LIMITED" });
+        const err = Object.assign(new Error("Rate limited"), { statusCode: 429,
+code: "RATE_LIMITED" });
         errorHandler(err, c);
 
         expect(getStatus()).toBe(429);

package/test/jwt-security.test.ts

@@ -5,7 +5,7 @@ import {
     generateRefreshToken,
     hashRefreshToken,
     getAccessTokenExpiryMs,
-    getRefreshTokenExpiry,
+    getRefreshTokenExpiry
 } from "../src/auth/jwt";
 
 const STRONG_SECRET = "this-is-a-strong-secret-for-jwt-testing-at-least-32-chars-long";
@@ -13,7 +13,9 @@ const STRONG_SECRET = "this-is-a-strong-secret-for-jwt-testing-at-least-32-chars
 describe("JWT Security Hardening", () => {
 
     beforeEach(() => {
-        configureJwt({ secret: STRONG_SECRET, accessExpiresIn: "1h", refreshExpiresIn: "30d" });
+        configureJwt({ secret: STRONG_SECRET,
+accessExpiresIn: "1h",
+refreshExpiresIn: "30d" });
     });
 
     // ── Secret validation ───────────────────────────────────
@@ -37,7 +39,7 @@ describe("JWT Security Hardening", () => {
 
         it("accepts strong, random secrets", () => {
             expect(() => configureJwt({
-                secret: "aG7x!kL2$mP9#qR5+tU8*wZ0^bD3&fH6",
+                secret: "aG7x!kL2$mP9#qR5+tU8*wZ0^bD3&fH6"
             })).not.toThrow();
         });
     });
@@ -64,7 +66,9 @@ describe("JWT Security Hardening", () => {
 
         it("throws when secret is not configured", () => {
             // Force empty secret
-            Object.defineProperty(require("../src/auth/jwt"), "jwtConfig", { value: { secret: "" }, writable: true });
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            Object.defineProperty(require("../src/auth/jwt"), "jwtConfig", { value: { secret: "" },
+writable: true });
             // This won't work since jwtConfig is module-scoped, but generateAccessToken has its own check
             // We'll test via configureJwt + clearing
         });
@@ -142,27 +146,32 @@ describe("JWT Security Hardening", () => {
     // ── Expiry calculations ─────────────────────────────────
     describe("expiry calculations", () => {
         it("calculates 1h as 3600000ms", () => {
-            configureJwt({ secret: STRONG_SECRET, accessExpiresIn: "1h" });
+            configureJwt({ secret: STRONG_SECRET,
+accessExpiresIn: "1h" });
             expect(getAccessTokenExpiryMs()).toBe(3600000);
         });
 
         it("calculates 30m as 1800000ms", () => {
-            configureJwt({ secret: STRONG_SECRET, accessExpiresIn: "30m" });
+            configureJwt({ secret: STRONG_SECRET,
+accessExpiresIn: "30m" });
             expect(getAccessTokenExpiryMs()).toBe(1800000);
         });
 
         it("calculates 7d correctly", () => {
-            configureJwt({ secret: STRONG_SECRET, accessExpiresIn: "7d" });
+            configureJwt({ secret: STRONG_SECRET,
+accessExpiresIn: "7d" });
             expect(getAccessTokenExpiryMs()).toBe(7 * 24 * 60 * 60 * 1000);
         });
 
         it("defaults to 1h for unparseable duration", () => {
-            configureJwt({ secret: STRONG_SECRET, accessExpiresIn: "invalid" });
+            configureJwt({ secret: STRONG_SECRET,
+accessExpiresIn: "invalid" });
             expect(getAccessTokenExpiryMs()).toBe(3600000);
         });
 
         it("refresh expiry is in the future", () => {
-            configureJwt({ secret: STRONG_SECRET, refreshExpiresIn: "30d" });
+            configureJwt({ secret: STRONG_SECRET,
+refreshExpiresIn: "30d" });
             const expiry = getRefreshTokenExpiry();
             expect(expiry.getTime()).toBeGreaterThan(Date.now());
             // Should be approximately 30 days in the future

package/test/jwt.test.ts

@@ -29,7 +29,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should allow partial configuration updates", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "2h" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "2h" });
             // Token generation should still work
             const token = generateAccessToken("user-1", ["admin"]);
             expect(token).toBeTruthy();
@@ -138,27 +139,32 @@ describe("JWT Utilities", () => {
 
     describe("getAccessTokenExpiryMs", () => {
         it("should return correct milliseconds for hours", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "2h" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "2h" });
             expect(getAccessTokenExpiryMs()).toBe(2 * 60 * 60 * 1000);
         });
 
         it("should return correct milliseconds for days", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "7d" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "7d" });
             expect(getAccessTokenExpiryMs()).toBe(7 * 24 * 60 * 60 * 1000);
         });
 
         it("should return correct milliseconds for minutes", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "30m" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "30m" });
             expect(getAccessTokenExpiryMs()).toBe(30 * 60 * 1000);
         });
 
         it("should return correct milliseconds for seconds", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "300s" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "300s" });
             expect(getAccessTokenExpiryMs()).toBe(300 * 1000);
         });
 
         it("should default to 1 hour for invalid format", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "invalid" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "invalid" });
             expect(getAccessTokenExpiryMs()).toBe(60 * 60 * 1000);
         });
     });
@@ -171,7 +177,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should match the configured expiry duration", () => {
-            configureJwt({ secret: testSecret, accessExpiresIn: "1h" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "1h" });
             const now = Date.now();
             const expiry = getAccessTokenExpiry();
             // Should be approximately 1 hour from now (with small tolerance)
@@ -197,7 +204,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should respect custom refresh expiry configuration", () => {
-            configureJwt({ secret: testSecret, refreshExpiresIn: "7d" });
+            configureJwt({ secret: testSecret,
+refreshExpiresIn: "7d" });
             const expiry = getRefreshTokenExpiry();
             const expected = Date.now() + (7 * 24 * 60 * 60 * 1000);
             expect(expiry.getTime()).toBeGreaterThanOrEqual(expected - 1000);
@@ -205,7 +213,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should handle hour-based refresh expiry", () => {
-            configureJwt({ secret: testSecret, refreshExpiresIn: "24h" });
+            configureJwt({ secret: testSecret,
+refreshExpiresIn: "24h" });
             const expiry = getRefreshTokenExpiry();
             const expected = Date.now() + (24 * 60 * 60 * 1000);
             expect(expiry.getTime()).toBeGreaterThanOrEqual(expected - 1000);
@@ -213,7 +222,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should handle minute-based refresh expiry", () => {
-            configureJwt({ secret: testSecret, refreshExpiresIn: "90m" });
+            configureJwt({ secret: testSecret,
+refreshExpiresIn: "90m" });
             const expiry = getRefreshTokenExpiry();
             const expected = Date.now() + (90 * 60 * 1000);
             expect(expiry.getTime()).toBeGreaterThanOrEqual(expected - 1000);
@@ -221,7 +231,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should handle second-based refresh expiry", () => {
-            configureJwt({ secret: testSecret, refreshExpiresIn: "3600s" });
+            configureJwt({ secret: testSecret,
+refreshExpiresIn: "3600s" });
             const expiry = getRefreshTokenExpiry();
             const expected = Date.now() + (3600 * 1000);
             expect(expiry.getTime()).toBeGreaterThanOrEqual(expected - 1000);
@@ -229,7 +240,8 @@ describe("JWT Utilities", () => {
         });
 
         it("should default to 30 days for invalid refresh format", () => {
-            configureJwt({ secret: testSecret, refreshExpiresIn: "invalid" });
+            configureJwt({ secret: testSecret,
+refreshExpiresIn: "invalid" });
             const expiry = getRefreshTokenExpiry();
             const expected = Date.now() + (30 * 24 * 60 * 60 * 1000);
             expect(expiry.getTime()).toBeGreaterThanOrEqual(expected - 1000);
@@ -270,7 +282,8 @@ describe("JWT Utilities", () => {
     describe("expired token handling", () => {
         it("should return null for an expired token", () => {
             // Configure with 1 second expiry
-            configureJwt({ secret: testSecret, accessExpiresIn: "1s" });
+            configureJwt({ secret: testSecret,
+accessExpiresIn: "1s" });
             const token = generateAccessToken("user-1", ["admin"]);
 
             // Immediately verify should work

package/test/middleware.test.ts

@@ -22,7 +22,7 @@ function createMockContext(opts: {
             query: (name: string) => {
                 if (name === "token") return opts.queryToken;
                 return undefined;
-            },
+            }
         },
         json: (body: any, status?: number) => {
             capturedBody = body;
@@ -30,14 +30,14 @@ function createMockContext(opts: {
             return new Response(JSON.stringify(body), { status: capturedStatus });
         },
         set: (key: string, value: any) => variables.set(key, value),
-        get: (key: string) => variables.get(key),
+        get: (key: string) => variables.get(key)
     } as any;
 
     return {
         c,
         getStatus: () => capturedStatus,
         getBody: () => capturedBody,
-        getUser: () => variables.get("user"),
+        getUser: () => variables.get("user")
     };
 }
 
@@ -217,7 +217,8 @@ describe("Auth Middleware", () => {
         });
 
         it("should return 403 if user has empty roles array", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: [] } });
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
+roles: [] } });
 
             await requireAdmin(c, nextFn);
 
@@ -226,7 +227,8 @@ describe("Auth Middleware", () => {
         });
 
         it("should return 403 if user has standard roles (forbidden)", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["editor", "viewer"] } });
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
+roles: ["editor", "viewer"] } });
 
             await requireAdmin(c, nextFn);
 
@@ -235,7 +237,8 @@ describe("Auth Middleware", () => {
         });
 
         it("should allow access if user has 'admin' role", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["editor", "admin"] } });
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
+roles: ["editor", "admin"] } });
 
             await requireAdmin(c, nextFn);
 
@@ -244,7 +247,8 @@ describe("Auth Middleware", () => {
         });
 
         it("should allow access if user has 'schema-admin' role", async () => {
-            const { c } = createMockContext({ user: { userId: "user-123", roles: ["schema-admin"] } });
+            const { c } = createMockContext({ user: { userId: "user-123",
+roles: ["schema-admin"] } });
 
             await requireAdmin(c, nextFn);
 
@@ -252,7 +256,8 @@ describe("Auth Middleware", () => {
         });
 
         it("should block access for malformed spoofed string roles", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["schema-adminstration", "admins", "admin "] } });
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
+roles: ["schema-adminstration", "admins", "admin "] } });
 
             await requireAdmin(c, nextFn);
 

package/test/query-parser.test.ts

@@ -39,7 +39,8 @@ describe("parseQueryOptions — pagination", () => {
     });
 
     it("calculates offset from page number", () => {
-        const result = parseQueryOptions({ page: "3", limit: "10" });
+        const result = parseQueryOptions({ page: "3",
+limit: "10" });
         expect(result.offset).toBe(20); // (3-1) * 10
     });
 
@@ -134,7 +135,7 @@ describe("parseQueryOptions — PostgREST filters", () => {
             limit: "10",
             offset: "0",
             orderBy: "name:asc",
-            status: "eq.active",
+            status: "eq.active"
         });
         // Only status should be in where
         expect(result.where?.status).toEqual(["==", "active"]);
@@ -161,14 +162,14 @@ describe("parseQueryOptions — PostgREST filters", () => {
 describe("parseQueryOptions — legacy JSON where", () => {
     it("parses JSON where string", () => {
         const result = parseQueryOptions({
-            where: JSON.stringify({ status: ["==", "published"] }),
+            where: JSON.stringify({ status: ["==", "published"] })
         });
         expect(result.where?.status).toEqual(["==", "published"]);
     });
 
     it("accepts object where directly", () => {
         const result = parseQueryOptions({
-            where: { status: ["==", "draft"] },
+            where: { status: ["==", "draft"] }
         });
         expect(result.where?.status).toEqual(["==", "draft"]);
     });
@@ -191,19 +192,23 @@ describe("parseQueryOptions — legacy JSON where", () => {
 // ─────────────────────────────────────────────────────────────
 describe("parseQueryOptions — sorting", () => {
     it("parses JSON orderBy", () => {
-        const orderBy = JSON.stringify([{ field: "name", direction: "asc" }]);
+        const orderBy = JSON.stringify([{ field: "name",
+direction: "asc" }]);
         const result = parseQueryOptions({ orderBy });
-        expect(result.orderBy).toEqual([{ field: "name", direction: "asc" }]);
+        expect(result.orderBy).toEqual([{ field: "name",
+direction: "asc" }]);
     });
 
     it("parses simple field:direction format", () => {
         const result = parseQueryOptions({ orderBy: "created_at:desc" });
-        expect(result.orderBy).toEqual([{ field: "created_at", direction: "desc" }]);
+        expect(result.orderBy).toEqual([{ field: "created_at",
+direction: "desc" }]);
     });
 
     it("defaults direction to asc", () => {
         const result = parseQueryOptions({ orderBy: "name" });
-        expect(result.orderBy).toEqual([{ field: "name", direction: "asc" }]);
+        expect(result.orderBy).toEqual([{ field: "name",
+direction: "asc" }]);
     });
 
     it("handles no orderBy", () => {