@sirrlock/mcp 0.1.0 → 1.0.2

package/dist/index.test.js

@@ -0,0 +1,619 @@
+"use strict";
+/**
+ * Unit tests for MCP tool handlers.
+ *
+ * Uses a mock HTTP server so tests run without a real sirrd instance.
+ * Assertions cover: HTTP method, path, request body, response formatting,
+ * 404 handling (returns text, not error), non-2xx handling (returns Error:).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const http_1 = require("http");
+const child_process_1 = require("child_process");
+const readline_1 = require("readline");
+class MockServer {
+    constructor(port) {
+        this.responseQueue = [];
+        this.lastRequest = null;
+        this.port = port;
+        this.url = `http://127.0.0.1:${port}`;
+        this.server = (0, http_1.createServer)(async (req, res) => {
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const raw = Buffer.concat(chunks).toString();
+            let body = null;
+            try {
+                body = JSON.parse(raw);
+            }
+            catch {
+                body = raw || null;
+            }
+            this.lastRequest = { method: req.method, path: req.url, body };
+            const next = this.responseQueue.shift() ?? { status: 200, body: {} };
+            const ct = next.contentType ?? "application/json";
+            res.writeHead(next.status, { "Content-Type": ct });
+            res.end(ct === "application/json" ? JSON.stringify(next.body) : String(next.body));
+        });
+    }
+    start() {
+        return new Promise((resolve) => this.server.listen(this.port, "127.0.0.1", resolve));
+    }
+    stop() {
+        return new Promise((resolve, reject) => this.server.close((err) => (err ? reject(err) : resolve())));
+    }
+    /** Enqueue a JSON response to be served for the next request. */
+    next(status, body) {
+        this.responseQueue.push({ status, body });
+        return this;
+    }
+    /** Enqueue a plain-text response (simulates rate-limiter / proxy errors). */
+    nextText(status, text) {
+        this.responseQueue.push({ status, body: text, contentType: "text/plain" });
+        return this;
+    }
+    clearQueue() {
+        this.responseQueue = [];
+    }
+}
+class McpClient {
+    constructor(proc) {
+        this.proc = proc;
+        this.pending = new Map();
+        this.nextId = 1;
+        this.rl = (0, readline_1.createInterface)({ input: proc.stdout });
+        this.rl.on("line", (line) => {
+            if (!line.trim())
+                return;
+            const msg = JSON.parse(line);
+            if (msg.id != null) {
+                const resolve = this.pending.get(msg.id);
+                if (resolve) {
+                    this.pending.delete(msg.id);
+                    resolve(msg);
+                }
+            }
+        });
+    }
+    close() { this.rl.close(); this.proc.kill(); }
+    rpc(method, params) {
+        const id = this.nextId++;
+        return new Promise((resolve) => {
+            this.pending.set(id, resolve);
+            this.proc.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+        });
+    }
+    async initialize() {
+        await this.rpc("initialize", {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: "unit-test", version: "1" },
+        });
+    }
+    async call(tool, args = {}) {
+        const resp = await this.rpc("tools/call", { name: tool, arguments: args });
+        if (resp.error)
+            throw new Error(`MCP error: ${resp.error.message}`);
+        return resp.result?.content?.[0]?.text ?? "";
+    }
+}
+// ── Fixtures ──────────────────────────────────────────────────────────────────
+const MOCK_PORT = 19082;
+const TOKEN = "unit-test-token";
+const MCP_BIN = `${__dirname}/../dist/index.js`;
+let mock;
+let client;
+let mcpProc;
+(0, globals_1.beforeAll)(async () => {
+    mock = new MockServer(MOCK_PORT);
+    await mock.start();
+    mcpProc = (0, child_process_1.spawn)("node", [MCP_BIN], {
+        env: { ...process.env, SIRR_SERVER: mock.url, SIRRLOCK_URL: mock.url, SIRR_TOKEN: TOKEN },
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    mcpProc.stderr.on("data", (d) => {
+        const msg = d.toString();
+        if (!msg.includes("[sirr-mcp] Warning"))
+            process.stderr.write(msg);
+    });
+    client = new McpClient(mcpProc);
+    await client.initialize();
+}, 15000);
+(0, globals_1.afterAll)(async () => {
+    client?.close();
+    await mock?.stop();
+});
+(0, globals_1.afterEach)(() => {
+    mock.clearQueue();
+});
+// ── check_secret ─────────────────────────────────────────────────────────────
+(0, globals_1.describe)("check_secret", () => {
+    (0, globals_1.it)("HEAD /secrets/{key} — active secret returns metadata without consuming a read", async () => {
+        const future = Math.floor(Date.now() / 1000) + 3600;
+        mock.next(200, {});
+        // Mock server doesn't send response headers naturally, but we test the path/method
+        const text = await client.call("check_secret", { key: "MY_KEY" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("HEAD");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets/MY_KEY");
+        // 200 with no X-Sirr-Status header defaults to "active"
+        (0, globals_1.expect)(text).toContain("active");
+    });
+    (0, globals_1.it)("404 → not found message", async () => {
+        mock.next(404, {});
+        const text = await client.call("check_secret", { key: "GONE" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+    (0, globals_1.it)("410 → sealed message", async () => {
+        mock.next(410, {});
+        const text = await client.call("check_secret", { key: "SEALED" });
+        (0, globals_1.expect)(text).toContain("sealed");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── get_secret ────────────────────────────────────────────────────────────────
+(0, globals_1.describe)("get_secret", () => {
+    (0, globals_1.it)("GET /secrets/{id} (public dead drop) and returns value", async () => {
+        mock.next(200, { id: "abc123", value: "supersecret" });
+        const text = await client.call("get_secret", { id: "abc123" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets/abc123");
+        (0, globals_1.expect)(text).toBe("supersecret");
+    });
+    (0, globals_1.it)("GET /orgs/{org}/secrets/{key} (org-scoped) and returns value", async () => {
+        mock.next(200, { id: "hex64id", value: "orgsecret" });
+        const text = await client.call("get_secret", { key: "MY_KEY", org: "my-org" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/my-org/secrets/MY_KEY");
+        (0, globals_1.expect)(text).toBe("orgsecret");
+    });
+    (0, globals_1.it)("error if neither id nor key provided", async () => {
+        const text = await client.call("get_secret", {});
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("id");
+    });
+    (0, globals_1.it)("error if key provided without org (and no SIRR_ORG env)", async () => {
+        const text = await client.call("get_secret", { key: "MY_KEY" });
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("org");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error (public id)", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("get_secret", { id: "MISSING" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+    (0, globals_1.it)("410 → not-found message (burned public secret)", async () => {
+        mock.next(410, { error: "gone" });
+        const text = await client.call("get_secret", { id: "BURNED" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+    (0, globals_1.it)("403 → Error: in output (public id)", async () => {
+        mock.next(403, { error: "forbidden" });
+        const text = await client.call("get_secret", { id: "DENIED" });
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("403");
+    });
+});
+// ── push_secret ───────────────────────────────────────────────────────────────
+(0, globals_1.describe)("push_secret", () => {
+    (0, globals_1.it)("POST /secrets with value only (no key)", async () => {
+        mock.next(201, { id: "deadbeef01020304" });
+        const text = await client.call("push_secret", { value: "bar" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets");
+        (0, globals_1.expect)((mock.lastRequest?.body)["key"]).toBeUndefined();
+        (0, globals_1.expect)((mock.lastRequest?.body)["value"]).toBe("bar");
+        (0, globals_1.expect)(text).toContain("deadbeef01020304");
+    });
+    (0, globals_1.it)("returns URL in output", async () => {
+        mock.next(201, { id: "abc123" });
+        const text = await client.call("push_secret", { value: "v" });
+        (0, globals_1.expect)(text).toContain("/s/abc123");
+    });
+    (0, globals_1.it)("reports TTL in output when ttl_seconds provided", async () => {
+        mock.next(201, { id: "ttlid" });
+        const text = await client.call("push_secret", { value: "v", ttl_seconds: 3600 });
+        (0, globals_1.expect)(text).toContain("1h");
+    });
+    (0, globals_1.it)("reports burn limit in output when max_reads provided", async () => {
+        mock.next(201, { id: "burnid" });
+        const text = await client.call("push_secret", { value: "v", max_reads: 1 });
+        (0, globals_1.expect)(text).toContain("1 read(s)");
+    });
+    (0, globals_1.it)("does not send null for omitted optional fields", async () => {
+        mock.next(201, { id: "bareid" });
+        await client.call("push_secret", { value: "v" });
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["ttl_seconds"]).toBeUndefined();
+        (0, globals_1.expect)(body["max_reads"]).toBeUndefined();
+        (0, globals_1.expect)(body["key"]).toBeUndefined();
+    });
+});
+// ── set_secret ────────────────────────────────────────────────────────────────
+(0, globals_1.describe)("set_secret", () => {
+    (0, globals_1.it)("POST /orgs/{org}/secrets with key and value", async () => {
+        mock.next(201, { key: "FOO", id: "hexid001" });
+        const text = await client.call("set_secret", { org: "my-org", key: "FOO", value: "bar" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/my-org/secrets");
+        (0, globals_1.expect)((mock.lastRequest?.body)["key"]).toBe("FOO");
+        (0, globals_1.expect)((mock.lastRequest?.body)["value"]).toBe("bar");
+        (0, globals_1.expect)(text).toContain("FOO");
+        (0, globals_1.expect)(text).toContain("hexid001");
+    });
+    (0, globals_1.it)("409 → conflict message with isError", async () => {
+        mock.next(409, { error: "conflict" });
+        const text = await client.call("set_secret", { org: "my-org", key: "FOO", value: "bar" });
+        (0, globals_1.expect)(text).toContain("Conflict");
+        (0, globals_1.expect)(text).toContain("FOO");
+        (0, globals_1.expect)(text).toContain("patch_secret");
+    });
+    (0, globals_1.it)("401 → Error: in output", async () => {
+        mock.next(401, { error: "unauthorized" });
+        const text = await client.call("set_secret", { org: "my-org", key: "FOO", value: "bar" });
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("401");
+    });
+});
+// ── patch_secret ──────────────────────────────────────────────────────────────
+(0, globals_1.describe)("patch_secret", () => {
+    (0, globals_1.it)("PATCH /secrets/{key} with body", async () => {
+        mock.next(200, { key: "FOO", read_count: 0, max_reads: 5, expires_at: null });
+        await client.call("patch_secret", { key: "FOO", max_reads: 5 });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("PATCH");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets/FOO");
+        (0, globals_1.expect)((mock.lastRequest?.body)["max_reads"]).toBe(5);
+    });
+    (0, globals_1.it)("only sends provided fields", async () => {
+        mock.next(200, { key: "FOO", read_count: 0, max_reads: null, expires_at: null });
+        await client.call("patch_secret", { key: "FOO", ttl_seconds: 7200 });
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["ttl_seconds"]).toBe(7200);
+        (0, globals_1.expect)(body["max_reads"]).toBeUndefined();
+        (0, globals_1.expect)(body["value"]).toBeUndefined();
+    });
+    (0, globals_1.it)("formats response with expiry and max_reads", async () => {
+        const future = Math.floor(Date.now() / 1000) + 7200;
+        mock.next(200, { key: "FOO", read_count: 1, max_reads: 5, expires_at: future });
+        const text = await client.call("patch_secret", { key: "FOO" });
+        (0, globals_1.expect)(text).toContain("FOO");
+        (0, globals_1.expect)(text).toContain("2h");
+        (0, globals_1.expect)(text).toContain("Max reads: 5 (1 used)");
+    });
+});
+// ── list_secrets ──────────────────────────────────────────────────────────────
+(0, globals_1.describe)("list_secrets", () => {
+    (0, globals_1.it)("GET /secrets and formats list", async () => {
+        mock.next(200, {
+            secrets: [
+                { key: "KEY_A", read_count: 2, max_reads: null, expires_at: null },
+                { key: "KEY_B", read_count: 0, max_reads: 1, expires_at: null },
+            ],
+        });
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets");
+        (0, globals_1.expect)(text).toContain("KEY_A");
+        (0, globals_1.expect)(text).toContain("KEY_B");
+        (0, globals_1.expect)(text).toContain("0/1 reads");
+    });
+    (0, globals_1.it)("empty vault → 'No active secrets'", async () => {
+        mock.next(200, { secrets: [] });
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(text).toBe("No active secrets.");
+    });
+});
+// ── delete_secret ─────────────────────────────────────────────────────────────
+(0, globals_1.describe)("delete_secret", () => {
+    (0, globals_1.it)("DELETE /secrets/{key}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("delete_secret", { key: "TO_DEL" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/secrets/TO_DEL");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("delete_secret", { key: "MISSING" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── prune_secrets ─────────────────────────────────────────────────────────────
+(0, globals_1.describe)("prune_secrets", () => {
+    (0, globals_1.it)("POST /prune and reports count", async () => {
+        mock.next(200, { pruned: 3 });
+        const text = await client.call("prune_secrets");
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/prune");
+        (0, globals_1.expect)(text).toContain("3");
+    });
+});
+// ── sirr_audit ────────────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_audit", () => {
+    (0, globals_1.it)("GET /audit with query params", async () => {
+        mock.next(200, { events: [
+                { id: 1, timestamp: 1000, action: "secret.read", key: "K", source_ip: "1.2.3.4", success: true },
+            ] });
+        const text = await client.call("sirr_audit", { since: 500, action: "secret.read", limit: 10 });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("/audit");
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("since=500");
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("action=secret.read");
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("limit=10");
+        (0, globals_1.expect)(text).toContain("secret.read");
+    });
+    (0, globals_1.it)("passes until param in query string", async () => {
+        mock.next(200, { events: [] });
+        await client.call("sirr_audit", { since: 100, until: 200 });
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("since=100");
+        (0, globals_1.expect)(mock.lastRequest?.path).toContain("until=200");
+    });
+    (0, globals_1.it)("empty events → 'No audit events found'", async () => {
+        mock.next(200, { events: [] });
+        const text = await client.call("sirr_audit");
+        (0, globals_1.expect)(text).toBe("No audit events found.");
+    });
+});
+// ── sirr_webhook_create / list / delete ───────────────────────────────────────
+(0, globals_1.describe)("sirr_webhook_create", () => {
+    (0, globals_1.it)("POST /webhooks with url and events", async () => {
+        mock.next(201, { id: "wh_1", secret: "whsec_abc" });
+        const text = await client.call("sirr_webhook_create", { url: "https://example.com/hook", events: ["secret.created"] });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/webhooks");
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["url"]).toBe("https://example.com/hook");
+        (0, globals_1.expect)(body["events"]).toEqual(["secret.created"]);
+        (0, globals_1.expect)(text).toContain("wh_1");
+        (0, globals_1.expect)(text).toContain("whsec_abc");
+    });
+});
+(0, globals_1.describe)("sirr_webhook_list", () => {
+    (0, globals_1.it)("GET /webhooks and formats list", async () => {
+        mock.next(200, { webhooks: [{ id: "wh_1", url: "https://example.com", events: ["*"], created_at: 0 }] });
+        const text = await client.call("sirr_webhook_list");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/webhooks");
+        (0, globals_1.expect)(text).toContain("wh_1");
+    });
+    (0, globals_1.it)("empty → 'No webhooks registered'", async () => {
+        mock.next(200, { webhooks: [] });
+        (0, globals_1.expect)(await client.call("sirr_webhook_list")).toBe("No webhooks registered.");
+    });
+});
+(0, globals_1.describe)("sirr_webhook_delete", () => {
+    (0, globals_1.it)("DELETE /webhooks/{id}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("sirr_webhook_delete", { id: "wh_1" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/webhooks/wh_1");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("sirr_webhook_delete", { id: "wh_missing" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── sirr_key_list ─────────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_key_list", () => {
+    (0, globals_1.it)("GET /me and extracts keys array", async () => {
+        const future = Math.floor(Date.now() / 1000) + 86400;
+        mock.next(200, {
+            id: "p1", name: "alice", role: "admin", org_id: "org1", metadata: {}, created_at: 0,
+            keys: [{ id: "key_1", name: "my-key", valid_after: 0, valid_before: future, created_at: 0 }],
+        });
+        const text = await client.call("sirr_key_list");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/me");
+        (0, globals_1.expect)(text).toContain("key_1");
+        (0, globals_1.expect)(text).toContain("my-key");
+    });
+    (0, globals_1.it)("empty keys → 'No API keys'", async () => {
+        mock.next(200, { id: "p1", name: "alice", role: "admin", org_id: "org1", metadata: {}, created_at: 0, keys: [] });
+        (0, globals_1.expect)(await client.call("sirr_key_list")).toBe("No API keys.");
+    });
+});
+// ── sirr_me ───────────────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_me", () => {
+    (0, globals_1.it)("GET /me and returns JSON", async () => {
+        mock.next(200, { id: "p1", name: "alice", role: "admin", org_id: "org1" });
+        const text = await client.call("sirr_me");
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/me");
+        (0, globals_1.expect)(text).toContain("alice");
+    });
+});
+// ── sirr_update_me ────────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_update_me", () => {
+    (0, globals_1.it)("PATCH /me with metadata body", async () => {
+        mock.next(200, { id: "p1", name: "alice", role: "admin", org_id: "org1", metadata: { env: "prod" } });
+        await client.call("sirr_update_me", { metadata: { env: "prod" } });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("PATCH");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/me");
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["metadata"]).toEqual({ env: "prod" });
+        (0, globals_1.expect)(body["name"]).toBeUndefined();
+        (0, globals_1.expect)(body["email"]).toBeUndefined();
+    });
+});
+// ── sirr_create_key ───────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_create_key", () => {
+    (0, globals_1.it)("POST /me/keys with name and optional validity", async () => {
+        const future = Math.floor(Date.now() / 1000) + 3600;
+        mock.next(201, { id: "key_2", name: "ci-key", key: "sk_live_abc123", valid_after: 0, valid_before: future });
+        const text = await client.call("sirr_create_key", { name: "ci-key", valid_for_seconds: 3600 });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/me/keys");
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["name"]).toBe("ci-key");
+        (0, globals_1.expect)(body["valid_for_seconds"]).toBe(3600);
+        (0, globals_1.expect)(body["permissions"]).toBeUndefined();
+        (0, globals_1.expect)(body["prefix"]).toBeUndefined();
+        (0, globals_1.expect)(text).toContain("sk_live_abc123");
+        (0, globals_1.expect)(text).toContain("ci-key");
+    });
+});
+// ── sirr_delete_key ───────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_delete_key", () => {
+    (0, globals_1.it)("DELETE /me/keys/{keyId}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("sirr_delete_key", { keyId: "key_2" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/me/keys/key_2");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("sirr_delete_key", { keyId: "gone" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── org management ────────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_org_create", () => {
+    (0, globals_1.it)("POST /orgs with name", async () => {
+        mock.next(201, { id: "org_1", name: "acme" });
+        const text = await client.call("sirr_org_create", { name: "acme" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs");
+        (0, globals_1.expect)((mock.lastRequest?.body)["name"]).toBe("acme");
+        (0, globals_1.expect)(text).toContain("org_1");
+        (0, globals_1.expect)(text).toContain("acme");
+    });
+});
+(0, globals_1.describe)("sirr_org_list", () => {
+    (0, globals_1.it)("GET /orgs and formats list", async () => {
+        mock.next(200, { orgs: [{ id: "org_1", name: "acme", metadata: {}, created_at: 0 }] });
+        const text = await client.call("sirr_org_list");
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("GET");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs");
+        (0, globals_1.expect)(text).toContain("org_1");
+    });
+    (0, globals_1.it)("empty → 'No organizations'", async () => {
+        mock.next(200, { orgs: [] });
+        (0, globals_1.expect)(await client.call("sirr_org_list")).toBe("No organizations.");
+    });
+});
+(0, globals_1.describe)("sirr_org_delete", () => {
+    (0, globals_1.it)("DELETE /orgs/{org_id}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("sirr_org_delete", { org_id: "org_1" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("sirr_org_delete", { org_id: "missing" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── principal management ──────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_principal_create", () => {
+    (0, globals_1.it)("POST /orgs/{org_id}/principals with name and role", async () => {
+        mock.next(201, { id: "p_1", name: "bob", role: "reader", org_id: "org_1" });
+        const text = await client.call("sirr_principal_create", { org_id: "org_1", name: "bob", role: "reader" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/principals");
+        const body = mock.lastRequest?.body;
+        (0, globals_1.expect)(body["name"]).toBe("bob");
+        (0, globals_1.expect)(body["role"]).toBe("reader");
+        (0, globals_1.expect)(text).toContain("p_1");
+    });
+});
+(0, globals_1.describe)("sirr_principal_list", () => {
+    (0, globals_1.it)("GET /orgs/{org_id}/principals", async () => {
+        mock.next(200, { principals: [{ id: "p_1", name: "bob", role: "reader", org_id: "org_1", created_at: 0 }] });
+        const text = await client.call("sirr_principal_list", { org_id: "org_1" });
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/principals");
+        (0, globals_1.expect)(text).toContain("bob");
+        (0, globals_1.expect)(text).toContain("reader");
+    });
+});
+(0, globals_1.describe)("sirr_principal_delete", () => {
+    (0, globals_1.it)("DELETE /orgs/{org_id}/principals/{principal_id}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("sirr_principal_delete", { org_id: "org_1", principal_id: "p_1" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/principals/p_1");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("sirr_principal_delete", { org_id: "org_1", principal_id: "gone" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── role management ───────────────────────────────────────────────────────────
+(0, globals_1.describe)("sirr_role_create", () => {
+    (0, globals_1.it)("POST /orgs/{org_id}/roles with name and permissions", async () => {
+        mock.next(201, { name: "reader", permissions: "RL", org_id: "org_1" });
+        const text = await client.call("sirr_role_create", { org_id: "org_1", name: "reader", permissions: "RL" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/roles");
+        (0, globals_1.expect)((mock.lastRequest?.body)["permissions"]).toBe("RL");
+        (0, globals_1.expect)(text).toContain("reader");
+        (0, globals_1.expect)(text).toContain("RL");
+    });
+});
+(0, globals_1.describe)("sirr_role_list", () => {
+    (0, globals_1.it)("GET /orgs/{org_id}/roles", async () => {
+        mock.next(200, { roles: [
+                { name: "admin", permissions: "CRPDLMA", built_in: true, created_at: 0 },
+                { name: "reader", permissions: "RL", built_in: false, created_at: 0 },
+            ] });
+        const text = await client.call("sirr_role_list", { org_id: "org_1" });
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/roles");
+        (0, globals_1.expect)(text).toContain("admin");
+        (0, globals_1.expect)(text).toContain("(built-in)");
+        (0, globals_1.expect)(text).toContain("reader");
+    });
+});
+(0, globals_1.describe)("sirr_role_delete", () => {
+    (0, globals_1.it)("DELETE /orgs/{org_id}/roles/{role_name}", async () => {
+        mock.next(200, { deleted: true });
+        await client.call("sirr_role_delete", { org_id: "org_1", role_name: "reader" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("DELETE");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/orgs/org_1/roles/reader");
+    });
+    (0, globals_1.it)("404 → not-found message, not an error", async () => {
+        mock.next(404, { error: "not found" });
+        const text = await client.call("sirr_role_delete", { org_id: "org_1", role_name: "gone" });
+        (0, globals_1.expect)(text).toContain("not found");
+        (0, globals_1.expect)(text).not.toContain("Error:");
+    });
+});
+// ── share_secret ──────────────────────────────────────────────────────────────
+(0, globals_1.describe)("share_secret", () => {
+    (0, globals_1.it)("returns a sirrlock share URL on success", async () => {
+        mock.next(200, { key: "a3f9c2d1e4b5" });
+        const text = await client.call("share_secret", { value: "hunter2" });
+        (0, globals_1.expect)(mock.lastRequest?.method).toBe("POST");
+        (0, globals_1.expect)(mock.lastRequest?.path).toBe("/api/public/secret");
+        (0, globals_1.expect)((mock.lastRequest?.body)["value"]).toBe("hunter2");
+        (0, globals_1.expect)(text).toContain("/s/a3f9c2d1e4b5");
+        (0, globals_1.expect)(text).toContain("burns after one read");
+    });
+    (0, globals_1.it)("returns an error when the upstream call fails", async () => {
+        mock.next(503, { error: "unavailable" });
+        const text = await client.call("share_secret", { value: "hunter2" });
+        (0, globals_1.expect)(text).toContain("Error:");
+    });
+});
+// ── error handling ────────────────────────────────────────────────────────────
+(0, globals_1.describe)("error handling", () => {
+    (0, globals_1.it)("non-JSON error body → Error: with text content", async () => {
+        mock.nextText(429, "Too Many Requests");
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("429");
+    });
+    (0, globals_1.it)("non-2xx JSON error → Error: with status and message", async () => {
+        mock.next(401, { error: "invalid token" });
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(text).toContain("Error:");
+        (0, globals_1.expect)(text).toContain("401");
+        (0, globals_1.expect)(text).toContain("invalid token");
+    });
+});
+//# sourceMappingURL=index.test.js.map