@selvajs/server 0.2.0-beta.2 → 0.2.0-beta.4

package/src/definitions/index.ts

@@ -1,22 +0,0 @@
-// Definitions server slice — the write orchestration (DefinitionService), the
-// compute-schema extraction/validation gate, and the render loader. All
-// composition-root wiring (stores, warm-client cache, server resolution) is
-// injected; access gating stays with the calling app.
-
-export { DefinitionService, type CreateDefinitionRecord } from './definition-service.js';
-
-export {
-	fetchSchemaFromCompute,
-	assertSupportedSchemaVersion,
-	SchemaExtractionError
-} from './schema-extraction.js';
-
-export {
-	createDefinitionLoader,
-	DefinitionLoadError,
-	type DefinitionChannel,
-	type DefinitionLoader,
-	type DefinitionLoaderDeps,
-	type DefinitionLoadErrorKind,
-	type LoadedDefinition
-} from './load-for-render.js';

package/src/definitions/load-for-render.ts

@@ -1,272 +0,0 @@
-// Loader for "given a definition record, produce everything the client needs to
-// render its form and solve it": version resolution, blob fetch, compute-server
-// resolution, schema fetch (with the ADR 0005 staleness check), default merging.
-//
-// Access gating is intentionally NOT done here — the calling route decides
-// whether `ctx` is allowed to load this definition, since gates differ across
-// routes (project membership, segment ownership, share-token, admin override).
-//
-// Everything stateful is injected (`DefinitionLoaderDeps`): stores, server
-// resolution, the warm-client cache, and the schema fetcher — so any app built
-// on the engine can wire its own composition root.
-
-import type { GrasshopperClient } from '@selvajs/compute/grasshopper';
-import { UI_SCHEMA_VERSION, type UISchema } from '@selvajs/schemas';
-import type {
-	ComputeServerConfig,
-	DefinitionRecord,
-	DefinitionVersion,
-	IDefinitionStore,
-	IProjectStore,
-	IStorageProvider,
-	RequestContext
-} from '@selvajs/platform';
-import { fetchSchemaFromCompute } from './schema-extraction.js';
-
-export type DefinitionChannel = 'live' | 'draft';
-
-export interface LoadedDefinition {
-	version: DefinitionVersion;
-	definitionSource: Uint8Array;
-	computeServer: ComputeServerConfig;
-	schema: UISchema;
-}
-
-/**
- * Classified failure modes so callers can map to appropriate HTTP status:
- *   - 'data':           record references a version/blob that isn't there. (400)
- *   - 'missing-config': no compute server resolvable for this org/definition. (503)
- *   - 'connect':        compute server is configured but unreachable. (503)
- *   - 'schema':         compute responded but IO/schema phase failed. (500)
- */
-export type DefinitionLoadErrorKind = 'data' | 'missing-config' | 'connect' | 'schema';
-
-export class DefinitionLoadError extends Error {
-	constructor(
-		public readonly kind: DefinitionLoadErrorKind,
-		message: string,
-		public readonly cause?: unknown
-	) {
-		super(message);
-		this.name = 'DefinitionLoadError';
-	}
-}
-
-export interface DefinitionLoaderDeps {
-	storage: Pick<IStorageProvider, 'get'>;
-	definitions: Pick<IDefinitionStore, 'getVersion' | 'setVersionSchema'>;
-	projects: Pick<IProjectStore, 'getProject'>;
-	/** §3 resolution order: definition pin → org default override → global default. */
-	resolveServer: (
-		ctx: RequestContext,
-		orgId: string | null,
-		opts: { definitionPin: string | null }
-	) => Promise<ComputeServerConfig>;
-	/** Shared warm-client cache (ADR 0004: keyed by server id, definition-guid affinity header). */
-	getClient: (
-		server: ComputeServerConfig,
-		opts: { definitionGuid: string }
-	) => Promise<{ client: GrasshopperClient }>;
-	/** Schema extraction; defaults to `fetchSchemaFromCompute`. Injectable for tests. */
-	fetchSchema?: (bytes: Uint8Array, server: ComputeServerConfig) => Promise<UISchema>;
-	/**
-	 * Verbose IO diagnostics — when set, an unhealthy IO result (empty inputs /
-	 * parse / load errors) also dumps the raw /io wire shape so
-	 * casing/serialization mismatches are visible.
-	 */
-	computeDebug?: boolean;
-	/** Diagnostic sink; defaults to `console.warn`. */
-	onWarn?: (message: string, detail?: string) => void;
-}
-
-export type DefinitionLoader = (
-	ctx: RequestContext,
-	record: DefinitionRecord,
-	channel: DefinitionChannel,
-	explicitVersionId?: string | null
-) => Promise<LoadedDefinition>;
-
-/**
- * Build a definition loader over the injected stores/compute wiring.
- *
- * The returned function loads a definition's version blob + schema (with
- * merged compute defaults). By default it resolves the `channel` pointer
- * (live/draft); pass `explicitVersionId` to render an arbitrary historical
- * version instead — the caller must gate that behind edit permission
- * (editor-only, like the draft channel). Throws `DefinitionLoadError` for
- * classified failures so the caller can translate to HTTP status codes.
- */
-export function createDefinitionLoader(deps: DefinitionLoaderDeps): DefinitionLoader {
-	const {
-		storage,
-		definitions,
-		projects,
-		resolveServer,
-		getClient,
-		fetchSchema = fetchSchemaFromCompute,
-		computeDebug = false,
-		onWarn = (message, detail) => (detail ? console.warn(message, detail) : console.warn(message))
-	} = deps;
-
-	return async function loadDefinitionForRender(ctx, record, channel, explicitVersionId) {
-		const versionId =
-			explicitVersionId ?? (channel === 'draft' ? record.draftVersionId : record.liveVersionId);
-		if (!versionId)
-			throw new DefinitionLoadError(
-				'data',
-				`Definition '${record.guid}' has no ${channel} version`
-			);
-
-		const version = await definitions.getVersion(ctx, versionId);
-		if (!version) throw new DefinitionLoadError('data', `version missing for '${record.guid}'`);
-		// An explicitly requested version must belong to this definition.
-		if (version.definitionId !== record.guid)
-			throw new DefinitionLoadError('data', `version does not belong to '${record.guid}'`);
-
-		const definitionSource = await storage.get(version.fileKey);
-		if (!definitionSource)
-			throw new DefinitionLoadError(
-				'data',
-				`Definition file for '${record.guid}' not found on disk`
-			);
-
-		const project = await projects.getProject(ctx, record.projectId);
-		let computeServer: ComputeServerConfig;
-		try {
-			computeServer = await resolveServer(ctx, project?.orgId ?? null, {
-				definitionPin: record.computeServerId ?? null
-			});
-		} catch (err) {
-			throw new DefinitionLoadError(
-				'missing-config',
-				'No compute server configured for this definition',
-				err
-			);
-		}
-
-		// Only the client is used here (getIO); the entry's solve scheduler rides
-		// along unused.
-		let client: GrasshopperClient;
-		try {
-			client = (await getClient(computeServer, { definitionGuid: record.guid })).client;
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			throw new DefinitionLoadError(
-				'connect',
-				`Failed to connect to Rhino Compute server: ${message}`,
-				err
-			);
-		}
-
-		try {
-			// Prefer the schema cached on the version row (extracted + validated at
-			// upload) — but ONLY when its format version matches the app's. The
-			// stored schema is a disposable cache (ADR 0005): on a version mismatch
-			// (or a pre-caching row with no schema at all) re-extract from compute,
-			// whose C# SchemaMigrator emits the current format — the web side never
-			// migrates schemas itself. `getIO` is always needed to merge compute
-			// default values into the schema, cached or not.
-			const cachedSchema = version.schema as UISchema | undefined;
-			const freshCache =
-				cachedSchema && cachedSchema.schemaVersion === UI_SCHEMA_VERSION ? cachedSchema : null;
-			const [definition, fetchedSchema] = await Promise.all([
-				client.getIO(definitionSource),
-				freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)
-			]);
-
-			// Persist the refreshed schema back onto the version row (best-effort —
-			// a viewer context may lack write access; the next editor render or the
-			// solve-time backfill will land it). Only when the re-extracted schema
-			// is at the app's current version: persisting an older format (compute
-			// plugin behind the app) would just go stale again next render.
-			if (!freshCache && fetchedSchema.schemaVersion === UI_SCHEMA_VERSION) {
-				definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {
-					onWarn(
-						`[loadForRender] schema cache refresh failed for version ${version.id}: ` +
-							`${err instanceof Error ? err.message : String(err)}`
-					);
-				});
-			}
-
-			if (!definition) {
-				throw new Error(`Failed to get definition IO — server returned undefined`);
-			}
-
-			// Surface IO health when something looks off: zero inputs, or the compute
-			// layer reported parse/load problems (e.g. an empty ValueList because its
-			// backing GH component didn't resolve → "Missing Definition Objects", or a
-			// PascalCase /io response the parser silently dropped to []). On a problem
-			// we also fetch the raw IO so the un-parsed wire shape is in the logs.
-			// Always-on warn (cheap, only fires on the unhappy path); the verbose raw
-			// dump is gated on `computeDebug`.
-			const ioParseErrors = (definition as { parseErrors?: unknown[] }).parseErrors ?? [];
-			const ioLoadErrors = (definition as { loadErrors?: unknown[] }).loadErrors ?? [];
-			const ioLooksBroken =
-				definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0;
-			if (ioLooksBroken) {
-				onWarn(
-					`[loadForRender] IO health for '${record.guid}':`,
-					JSON.stringify({
-						inputCount: definition.inputs.length,
-						outputCount: definition.outputs?.length,
-						parseErrors: ioParseErrors,
-						loadErrors: ioLoadErrors,
-						loadWarnings: (definition as { loadWarnings?: unknown }).loadWarnings
-					})
-				);
-				if (computeDebug) {
-					const rawIO = await client
-						.getRawIO(definitionSource)
-						.catch((e) => ({ error: String(e) }));
-					onWarn('[loadForRender] raw /io:', JSON.stringify(rawIO).slice(0, 3000));
-				}
-			}
-
-			return {
-				version,
-				definitionSource,
-				computeServer,
-				schema: mergeComputeDefaults(fetchedSchema, definition.inputs)
-			};
-		} catch (err) {
-			if (err instanceof DefinitionLoadError) throw err;
-			const message = err instanceof Error ? err.message : String(err);
-			throw new DefinitionLoadError('schema', message, err);
-		}
-	};
-}
-
-// Merge default values from Compute definition into schema inputs.
-// Colors come back as "r,g,b" or "a,r,g,b" strings — convert to hex so the
-// color picker can consume them directly.
-function mergeComputeDefaults(
-	schema: UISchema,
-	computeInputs: Array<{ id?: string; paramType?: string; default?: unknown }>
-): UISchema {
-	const byParamId = new Map(computeInputs.map((input) => [input.id, input]));
-
-	return {
-		...schema,
-		inputs: schema.inputs.map((schemaInput) => {
-			const computeInput = byParamId.get(schemaInput.id);
-
-			if (computeInput?.paramType === 'Color' && computeInput.default !== undefined) {
-				const toHex = (value: number) => value.toString(16).padStart(2, '0');
-				const parts = String(computeInput.default)
-					.split(',')
-					.map((s) => parseInt(s.trim(), 10));
-
-				if (parts.length === 3) {
-					computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;
-				} else if (parts.length === 4) {
-					computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;
-				}
-			}
-
-			if (computeInput && computeInput.default !== undefined) {
-				return { ...schemaInput, default: computeInput.default };
-			}
-			return schemaInput;
-		})
-	};
-}

package/src/definitions/schema-extraction.ts

@@ -1,117 +0,0 @@
-// Shared compute-schema extraction. One implementation used by:
-//   - upload routes (validate-and-cache gate — no upload without a valid schema)
-//   - the render path (falls back to live extraction for un-cached or stale
-//     versions; see load-for-render.ts and ADR 0005)
-//   - the temporary solve-time backfill bridge (see the app's specs/SchemaCaching.md)
-//
-// Extraction IS validation: a `.gh` with no valid "Schema" output, or an
-// unreachable compute server, throws here and the caller rejects the upload.
-
-import { camelcaseKeys } from '@selvajs/compute/core';
-import { UI_SCHEMA_VERSION, type UISchema } from '@selvajs/schemas';
-import type { ComputeServerConfig } from '@selvajs/platform';
-
-/** Thrown when compute is reachable but the definition yields no usable schema. */
-export class SchemaExtractionError extends Error {
-	constructor(
-		public readonly kind: 'unreachable' | 'invalid' | 'unsupported',
-		message: string
-	) {
-		super(message);
-		this.name = 'SchemaExtractionError';
-	}
-}
-
-function parseSemver(version: string): [number, number, number] | null {
-	const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-	return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
-}
-
-/**
- * Plugin↔app compat gate: reject a schema emitted by a NEWER plugin than this
- * app was built against — its shape may contain constructs the renderer does
- * not know. Older (or missing) versions pass: the compute-side C# migrator
- * always emits its own current version, and an older shape only lacks
- * optional additions.
- */
-export function assertSupportedSchemaVersion(schema: UISchema): void {
-	const version = schema.schemaVersion;
-	if (!version) return; // pre-2.12.0 plugin — older than the app, fine
-	const extracted = parseSemver(version);
-	const supported = parseSemver(UI_SCHEMA_VERSION);
-	if (!extracted || !supported) return;
-	const newer =
-		extracted[0] > supported[0] ||
-		(extracted[0] === supported[0] &&
-			(extracted[1] > supported[1] ||
-				(extracted[1] === supported[1] && extracted[2] > supported[2])));
-	if (newer) {
-		throw new SchemaExtractionError(
-			'unsupported',
-			`This definition was authored with a newer Selva plugin (schema format ${version}); ` +
-				`this server supports schema format ≤ ${UI_SCHEMA_VERSION}. Update the server, or ` +
-				`re-save the definition with a matching plugin version.`
-		);
-	}
-}
-
-/**
- * Fetch the UI schema from Rhino Compute's `/grasshopper/schema` endpoint (no
- * solve required). Throws `SchemaExtractionError` so callers can map to the
- * right HTTP status (503 unreachable / 422 invalid or unsupported).
- */
-export async function fetchSchemaFromCompute(
-	definitionBytes: Uint8Array,
-	server: ComputeServerConfig
-): Promise<UISchema> {
-	const schemaUrl = new URL('/grasshopper/schema', server.serverUrl).toString();
-
-	const formData = new FormData();
-	const blob = new Blob([new Uint8Array(definitionBytes)], { type: 'application/octet-stream' });
-	formData.append('file', blob, 'definition.gh');
-
-	const headers: Record<string, string> = {};
-	if (server.apiKey) {
-		headers['RhinoComputeKey'] = server.apiKey;
-	}
-
-	let response: Response;
-	try {
-		response = await fetch(schemaUrl, { method: 'POST', headers, body: formData });
-	} catch (err) {
-		throw new SchemaExtractionError(
-			'unreachable',
-			`Compute server is unreachable: ${err instanceof Error ? err.message : String(err)}`
-		);
-	}
-
-	if (!response.ok) {
-		throw new SchemaExtractionError(
-			'unreachable',
-			`Schema endpoint returned ${response.status}: ${response.statusText}`
-		);
-	}
-
-	// Compute returns [{ FileName, Schemas }] with PascalCase wrapper keys only.
-	// The schema contents are already camelCase from our C# serializer, so we only
-	// need a shallow camelcase per wrapper to normalize FileName→fileName,
-	// Schemas→schemas (shallow camelcaseKeys is a no-op on arrays, so each
-	// element is normalized individually). deep:true would mangle user-defined
-	// option names (e.g. "Display3d" → "display3d").
-	const raw = await response.json();
-	const results = (Array.isArray(raw) ? raw : [raw]).map((r) => camelcaseKeys(r)) as {
-		schemas: UISchema[];
-	}[];
-	const schemas = results.flatMap((r) => r.schemas ?? []);
-
-	if (schemas.length === 0) {
-		throw new SchemaExtractionError(
-			'invalid',
-			'No schemas found in definition.\n\n' +
-				'In Grasshopper, verify a Context Bake component with the output name "Schema" is present and wired to the solver.'
-		);
-	}
-
-	assertSupportedSchemaVersion(schemas[0]);
-	return schemas[0];
-}

package/src/errors/SentryErrorReporter.ts

@@ -1,88 +0,0 @@
-import type { ErrorContext, IErrorReporter } from '@selvajs/platform';
-
-/**
- * `IErrorReporter` backed by Sentry (`@sentry/node`). Constructed only when
- * the consuming app has a DSN configured. Deployments that don't configure a
- * DSN never load `@sentry/node`, so it stays an OPTIONAL peer dependency: the
- * base install ships without it and the no-op path needs no package at all.
- *
- * `@sentry/node` is imported dynamically and its surface is narrowed to the
- * two calls we use — a hard static import would make the package mandatory.
- */
-interface SentryLike {
-	init(options: {
-		dsn: string;
-		environment?: string;
-		release?: string;
-		tracesSampleRate: number;
-	}): void;
-	captureException(
-		error: unknown,
-		context?: {
-			tags?: Record<string, string>;
-			user?: { id?: string };
-			extra?: Record<string, unknown>;
-		}
-	): void;
-}
-
-export class SentryErrorReporter implements IErrorReporter {
-	private constructor(private readonly sentry: SentryLike) {}
-
-	/**
-	 * Initialize Sentry and return a reporter, or `null` if `@sentry/node` is
-	 * not installed (optional dependency absent). Never throws — a broken
-	 * error-tracker must not take down boot.
-	 */
-	static async create(opts: {
-		dsn: string;
-		environment?: string;
-		release?: string;
-	}): Promise<SentryErrorReporter | null> {
-		try {
-			// Dynamic so the package stays optional. `@vite-ignore` keeps the
-			// bundler from trying to resolve it at build time when it's absent.
-			// `@ts-ignore` (not `@ts-expect-error`) because whether the module
-			// resolves at type-check time depends on the environment — it's a real
-			// dep in some installs, absent in others — so we can't assert the error
-			// is always present. The `as unknown as` cast narrows whatever loads to
-			// the two calls we use.
-			// eslint-disable-next-line @typescript-eslint/ban-ts-comment
-			// @ts-ignore -- optional dependency, may be absent at type-check time
-			const sentry = (await import(/* @vite-ignore */ '@sentry/node')) as unknown as SentryLike;
-			sentry.init({
-				dsn: opts.dsn,
-				environment: opts.environment,
-				release: opts.release,
-				// Error tracking only — no performance tracing by default. Flip
-				// this up later if you want transactions/spans.
-				tracesSampleRate: 0
-			});
-			return new SentryErrorReporter(sentry);
-		} catch (err) {
-			console.error(
-				'[ErrorReporter] A Sentry DSN is set but @sentry/node could not be loaded. ' +
-					'Install it (`pnpm add @sentry/node`) or unset the DSN. Falling back to no-op.',
-				err
-			);
-			return null;
-		}
-	}
-
-	capture(error: unknown, context?: ErrorContext): void {
-		try {
-			const tags: Record<string, string> = { ...context?.tags };
-			if (context?.method) tags.method = context.method;
-			if (context?.route) tags.route = context.route;
-			if (context?.orgId) tags.orgId = context.orgId;
-			this.sentry.captureException(error, {
-				tags,
-				user: context?.userId ? { id: context.userId } : undefined
-			});
-		} catch (err) {
-			// Reporting is best-effort and sits on the error path — a second
-			// failure here would mask the first. Swallow after logging.
-			console.error('[ErrorReporter] Failed to capture error:', err);
-		}
-	}
-}

package/src/errors/index.ts

@@ -1,3 +0,0 @@
-// Error reporting — Sentry-backed IErrorReporter (optional @sentry/node peer).
-
-export { SentryErrorReporter } from './SentryErrorReporter.js';

package/src/http/__tests__/body-size.test.ts

@@ -1,27 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { declaredBodySizeExceeds } from '../body-size.js';
-
-function headersWith(contentLength?: string): Headers {
-	const h = new Headers();
-	if (contentLength !== undefined) h.set('content-length', contentLength);
-	return h;
-}
-
-describe('declaredBodySizeExceeds', () => {
-	it('flags a declared size over the limit', () => {
-		expect(declaredBodySizeExceeds(headersWith('1001'), 1000)).toBe(true);
-	});
-
-	it('passes a declared size at or under the limit', () => {
-		expect(declaredBodySizeExceeds(headersWith('1000'), 1000)).toBe(false);
-		expect(declaredBodySizeExceeds(headersWith('0'), 1000)).toBe(false);
-	});
-
-	it('passes when Content-Length is absent (chunked transfer — global limit is the backstop)', () => {
-		expect(declaredBodySizeExceeds(headersWith(), 1000)).toBe(false);
-	});
-
-	it('passes a non-numeric Content-Length rather than throwing', () => {
-		expect(declaredBodySizeExceeds(headersWith('not-a-number'), 1000)).toBe(false);
-	});
-});

package/src/http/__tests__/route-classifier.test.ts

@@ -1,60 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createRouteClassifier } from '../route-classifier.js';
-
-// Generic values — the consuming app's actual route policy is pinned by its
-// own test suite; these cover the classifier mechanics.
-const classifier = createRouteClassifier({
-	publicPages: ['/', '/login'],
-	publicPrefixes: ['/auth/', '/logout'],
-	publicApis: ['/api/health'],
-	selfGatingPrefix: '/api/files/',
-	staticPrefixes: ['/_app/', '/favicon/'],
-	staticPaths: ['/favicon.svg', '/robots.txt']
-});
-
-describe('createRouteClassifier', () => {
-	it('classifies exact pages, API allowlist, prefixes, and self-gating as public', () => {
-		for (const path of [
-			'/',
-			'/login',
-			'/api/health',
-			'/auth/oauth/callback',
-			'/logout',
-			'/api/files/orgs/abc/logo.webp'
-		]) {
-			expect(classifier.isPublicRoute(path)).toBe(true);
-		}
-	});
-
-	it('denies by default — unknown routes are gated', () => {
-		for (const path of ['/library', '/api/projects', '/billing', '/whatever']) {
-			expect(classifier.isPublicRoute(path)).toBe(false);
-		}
-	});
-
-	it('exact-match pages do not admit siblings via prefix', () => {
-		expect(classifier.isPublicRoute('/login-other')).toBe(false);
-		expect(classifier.isPublicRoute('/api/healthz')).toBe(false);
-	});
-
-	it('self-gating prefix is not a loose match', () => {
-		expect(classifier.isSelfGatingApiRoute('/api/files/x')).toBe(true);
-		expect(classifier.isSelfGatingApiRoute('/api/filesX/y')).toBe(false);
-		expect(classifier.isSelfGatingApiRoute('/api/projects')).toBe(false);
-	});
-
-	it('recognizes static assets by prefix and exact path', () => {
-		expect(classifier.isStaticAsset('/_app/immutable/x.js')).toBe(true);
-		expect(classifier.isStaticAsset('/favicon/16.png')).toBe(true);
-		expect(classifier.isStaticAsset('/robots.txt')).toBe(true);
-		expect(classifier.isStaticAsset('/favicon-other.png')).toBe(false);
-		expect(classifier.isStaticAsset('/login')).toBe(false);
-	});
-
-	it('every allowlist is optional — an empty config gates everything', () => {
-		const closed = createRouteClassifier({});
-		expect(closed.isPublicRoute('/')).toBe(false);
-		expect(closed.isStaticAsset('/robots.txt')).toBe(false);
-		expect(closed.isSelfGatingApiRoute('/api/files/x')).toBe(false);
-	});
-});

package/src/http/__tests__/safe-redirect.test.ts

@@ -1,47 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { safeRedirectTarget } from '../redirect.js';
-
-/**
- * `safeRedirectTarget` is the post-login redirect validator. The point of
- * the function is to reject *exactly* the values that would otherwise
- * smuggle an external host into a `redirect(303, …)` call:
- * protocol-relative URLs (`//evil.com`) and back-slash variants some
- * browsers normalize as a path separator. Each row below is one such case.
- */
-describe('safeRedirectTarget', () => {
-	it.each([
-		['/foo', '/foo'],
-		['/foo/bar', '/foo/bar'],
-		['/foo?x=1', '/foo?x=1'],
-		['/foo#frag', '/foo#frag'],
-		['/a', '/a'] // shortest valid path: `/` + non-`/` char
-	])('accepts same-origin path %j → %j', (input, expected) => {
-		expect(safeRedirectTarget(input, '/fallback')).toBe(expected);
-	});
-
-	it.each([
-		['//evil.com', 'protocol-relative URL'],
-		['//evil.com/path', 'protocol-relative URL with path'],
-		['/\\evil.com', 'back-slash bypass'],
-		['https://evil.com', 'absolute URL'],
-		['http://evil.com', 'absolute URL'],
-		['javascript:alert(1)', 'javascript: scheme'],
-		['', 'empty string'],
-		['/', 'lone slash (length<2)'],
-		['evil.com', 'no leading slash'],
-		['./relative', 'relative path']
-	])('rejects %j (%s)', (input) => {
-		expect(safeRedirectTarget(input, '/fallback')).toBe('/fallback');
-	});
-
-	it.each([null, undefined])('rejects %j', (input) => {
-		expect(safeRedirectTarget(input, '/fallback')).toBe('/fallback');
-	});
-
-	it('passes through arbitrary non-string types as fallback', () => {
-		// safeRedirectTarget's signature is `string | null | undefined`, but
-		// some call sites get `unknown` from FormData — make sure we don't
-		// throw on a stray non-string.
-		expect(safeRedirectTarget(42 as unknown as string, '/fallback')).toBe('/fallback');
-	});
-});

package/src/http/__tests__/security-headers.test.ts

@@ -1,29 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { applySecurityHeaders } from '../security-headers.js';
-
-describe('applySecurityHeaders', () => {
-	it('sets the baseline hardening headers and returns the same response', () => {
-		const response = new Response('ok');
-		const out = applySecurityHeaders(response, { hsts: false });
-		expect(out).toBe(response);
-		expect(out.headers.get('X-Content-Type-Options')).toBe('nosniff');
-		expect(out.headers.get('Referrer-Policy')).toBe('strict-origin-when-cross-origin');
-		expect(out.headers.get('Permissions-Policy')).toContain('camera=()');
-	});
-
-	it('sets HSTS only when asked (production)', () => {
-		const dev = applySecurityHeaders(new Response('ok'), { hsts: false });
-		expect(dev.headers.get('Strict-Transport-Security')).toBeNull();
-
-		const prod = applySecurityHeaders(new Response('ok'), { hsts: true });
-		expect(prod.headers.get('Strict-Transport-Security')).toBe(
-			'max-age=31536000; includeSubDomains'
-		);
-	});
-
-	it('never sets CSP or frame headers (iframe embedding is a product requirement)', () => {
-		const out = applySecurityHeaders(new Response('ok'), { hsts: true });
-		expect(out.headers.get('Content-Security-Policy')).toBeNull();
-		expect(out.headers.get('X-Frame-Options')).toBeNull();
-	});
-});