@specific.dev/spectest 0.97.0 → 0.99.0

package/src/harness/http-proxy.test.ts

@@ -176,11 +176,12 @@ describe("preflight response", () => {
   });
 
   /** Without Vary, a cache can serve one origin's preflight to another. */
-  test("varies on origin and requested headers", () => {
+  test("varies on origin, requested method and headers", () => {
     const res = preflight({ origin: "http://a.test", "access-control-request-method": "GET" });
     const vary = res.headers.get("vary") ?? "";
     expect(vary.toLowerCase()).toContain("origin");
     expect(vary.toLowerCase()).toContain("access-control-request-headers");
+    expect(vary.toLowerCase()).toContain("access-control-request-method");
   });
 });
 

package/src/harness/http-proxy.ts

@@ -1,3 +1,5 @@
+import type { CorsMode } from "../ingress.js";
+
 /**
  * HTTP semantics the ingress proxy has to get right: which headers must
  * not be forwarded, and how CORS is answered.
@@ -75,9 +77,8 @@ export function isCorsPreflight(req: {
 }
 
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -104,16 +105,14 @@ export function corsPreflightResponse(req: {
   // one origin's preflight to another.
   headers.append("vary", "Origin");
   headers.append("vary", "Access-Control-Request-Headers");
+  headers.append("vary", "Access-Control-Request-Method");
   return new Response(null, { status: 204, headers });
 }
 
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export function augmentCorsResponse(
   req: { headers: { get(n: string): string | null } },
@@ -133,3 +132,15 @@ export function augmentCorsResponse(
   }
   return res;
 }
+
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export async function withIngressCors(
+  req: Request,
+  cors: CorsMode | undefined,
+  handle: (req: Request) => Response | Promise<Response>,
+): Promise<Response> {
+  if (cors === "permissive" && isCorsPreflight(req)) return corsPreflightResponse(req);
+  const res = await handle(req);
+  return cors === "permissive" ? augmentCorsResponse(req, res) : res;
+}

package/src/harness/ingress-cors.test.ts

@@ -0,0 +1,184 @@
+import { describe, expect, test } from "bun:test";
+import { defineEnvironment, defineFake, lowerIngress, provides, proxy, type CorsMode } from "../index.js";
+import { supabase } from "../components/supabase.js";
+import { withIngressCors, upstreamRequestHeaders } from "./http-proxy.js";
+import { InterceptRegistry, runChain } from "./intercept.js";
+
+const allowed = "https://app.tangent.test";
+const denied = "https://untrusted.test";
+const preflight = (origin: string, method = "PUT"): RequestInit => ({
+  method: "OPTIONS",
+  headers: { origin, "access-control-request-method": method, "access-control-request-headers": "authorization" },
+});
+
+for (const kind of ["fake", "service"] as const) {
+  for (const cors of [undefined, "passthrough"] as const) {
+    describe(`${kind} ingress, cors=${cors ?? "default"}`, () => {
+      test("preserves application CORS, rejections, range reads, OPTIONS and interceptor responses", async () => {
+        const seen: string[] = [];
+        const handler = async (req: Request): Promise<Response> => {
+          const path = new URL(req.url).pathname;
+          seen.push(`${req.method} ${path}`);
+          if (path === "/no-policy") return new Response("private", { headers: { vary: "Accept-Encoding" } });
+          if (req.method === "OPTIONS" && !req.headers.has("access-control-request-method")) {
+            return new Response("options", { status: 200, headers: { allow: "GET, PUT" } });
+          }
+          if (req.headers.get("origin") !== allowed) return new Response("origin denied", { status: 403 });
+          if (req.method === "OPTIONS" && req.headers.get("access-control-request-method") !== "PUT") {
+            return new Response("method denied", { status: 405, headers: { allow: "PUT" } });
+          }
+          const headers = {
+            "access-control-allow-origin": allowed,
+            "access-control-allow-credentials": "true",
+            "access-control-allow-methods": "PUT",
+            "access-control-allow-headers": "authorization",
+            "access-control-expose-headers": "Content-Range",
+            vary: "Origin, Accept-Encoding",
+          };
+          if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
+          if (req.headers.get("range")) return new Response("par", {
+            status: 206, headers: { ...headers, "content-range": "bytes 0-2/7" },
+          });
+          return new Response(req.headers.get("cookie"), { headers });
+        };
+        const upstream = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: handler });
+        const interceptors = new InterceptRegistry();
+        const pass = interceptors.register("bucket.test", undefined, (_req, next) => next());
+        const blocked = interceptors.register("bucket.test", "/intercepted", () =>
+          new Response("intercepted", { status: 418, headers: { vary: "Accept" } }));
+        const fake = defineFake({ name: "bucket", hostnames: ["bucket.test"], cors, handler });
+        const serviceRoute = lowerIngress(defineEnvironment({ name: "cors", services: {
+          web: { image: "nginx", tls: [{ hostname: "bucket.test", port: upstream.port!, cors }] },
+        } }).project([])).proxies[0];
+        const mode = kind === "fake" ? fake.cors : serviceRoute.cors;
+        const forward = kind === "fake" ? handler : async (req: Request) => fetch(
+          new URL(new URL(req.url).pathname, upstream.url), {
+            method: req.method, headers: upstreamRequestHeaders(req.headers, { proto: "https" }),
+            body: req.body, redirect: "manual",
+          });
+        const ingress = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: req =>
+          withIngressCors(req, mode, current => runChain(
+            interceptors.chainFor("bucket.test", new URL(current.url).pathname), current, forward)),
+        });
+        try {
+          const send = (path: string, init: RequestInit) => fetch(new URL(path, ingress.url), init);
+          const ok = await send("/probe", preflight(allowed));
+          expect(ok.status).toBe(204);
+          expect(ok.headers.get("access-control-allow-origin")).toBe(allowed);
+          expect(ok.headers.get("access-control-allow-credentials")).toBe("true");
+          expect(ok.headers.get("access-control-allow-methods")).toBe("PUT");
+          expect(ok.headers.get("access-control-allow-headers")).toBe("authorization");
+          expect(ok.headers.get("vary")).toBe("Origin, Accept-Encoding");
+          for (const [init, status, body] of [
+            [preflight(denied), 403, "origin denied"],
+            [preflight(allowed, "DELETE"), 405, "method denied"],
+            [{ headers: { origin: denied } }, 403, "origin denied"],
+          ] as const) {
+            const res = await send("/probe", init);
+            expect(res.status).toBe(status);
+            expect(await res.text()).toBe(body);
+            expect(res.headers.get("access-control-allow-origin")).toBeNull();
+            expect(res.headers.get("access-control-allow-credentials")).toBeNull();
+          }
+          const credentialed = await send("/probe", { method: "PUT", headers: { origin: allowed, cookie: "session=test" } });
+          expect(await credentialed.text()).toBe("session=test");
+          expect(credentialed.headers.get("access-control-allow-origin")).toBe(allowed);
+          expect(credentialed.headers.get("access-control-allow-credentials")).toBe("true");
+          const range = await send("/probe", { headers: { origin: allowed, range: "bytes=0-2" } });
+          expect(range.status).toBe(206);
+          expect(range.headers.get("content-range")).toBe("bytes 0-2/7");
+          expect(range.headers.get("access-control-expose-headers")).toBe("Content-Range");
+          expect(await range.text()).toBe("par");
+          const noPolicy = await send("/no-policy", { headers: { origin: allowed } });
+          expect(await noPolicy.text()).toBe("private");
+          expect(noPolicy.headers.get("access-control-allow-origin")).toBeNull();
+          expect(noPolicy.headers.get("access-control-allow-credentials")).toBeNull();
+          expect(noPolicy.headers.get("vary")).toBe("Accept-Encoding");
+          const options = await send("/probe", { method: "OPTIONS", headers: { origin: allowed } });
+          expect(options.status).toBe(200);
+          expect(options.headers.get("allow")).toBe("GET, PUT");
+          expect(options.headers.get("access-control-allow-origin")).toBeNull();
+          expect(await options.text()).toBe("options");
+          for (const init of [preflight(denied), { headers: { origin: denied } }]) {
+            const res = await send("/intercepted", init);
+            expect(res.status).toBe(418);
+            expect(await res.text()).toBe("intercepted");
+            expect(res.headers.get("access-control-allow-origin")).toBeNull();
+            expect(res.headers.get("vary")).toBe("Accept");
+          }
+          expect(pass.requests).toHaveLength(10);
+          expect(blocked.requests.map(r => r.method)).toEqual(["OPTIONS", "GET"]);
+          expect(seen.filter(s => s === "OPTIONS /probe")).toHaveLength(4);
+          expect(seen.some(s => s.endsWith("/intercepted"))).toBe(false);
+        } finally {
+          ingress.stop(true);
+          upstream.stop(true);
+        }
+      });
+    });
+  }
+}
+
+test("passthrough preserves the exact response, including interceptor CORS and repeated cookies", async () => {
+  const res = new Response("error", { status: 500, headers: {
+    "access-control-allow-origin": allowed, "access-control-allow-credentials": "false", vary: "Accept",
+  } });
+  res.headers.append("set-cookie", "a=1");
+  res.headers.append("set-cookie", "b=2");
+  const headers = [...res.headers];
+  expect(await withIngressCors(new Request("http://bucket.test", preflight(denied)), undefined, () => res)).toBe(res);
+  expect([...res.headers]).toEqual(headers);
+});
+
+test("permissive is opt-in for preflight interception and response augmentation", async () => {
+  let calls = 0;
+  const handle = () => { calls++; return new Response("denied", { status: 403 }); };
+  const pre = await withIngressCors(new Request("http://bucket.test", preflight(denied)), "permissive", handle);
+  expect(pre.status).toBe(204);
+  expect(pre.headers.get("access-control-allow-origin")).toBe(denied);
+  expect(pre.headers.get("access-control-allow-credentials")).toBe("true");
+  expect(calls).toBe(0);
+  const ordinary = await withIngressCors(new Request("http://bucket.test", { method: "OPTIONS" }), "permissive", handle);
+  expect(ordinary.status).toBe(403);
+  expect(calls).toBe(1);
+  const res = await withIngressCors(new Request("http://bucket.test", { headers: { origin: denied } }), "permissive", handle);
+  expect(res.status).toBe(403);
+  expect(res.headers.get("access-control-allow-origin")).toBe(denied);
+  expect(res.headers.get("access-control-allow-credentials")).toBe("true");
+  expect(calls).toBe(2);
+});
+
+test.each(["passthrough", "permissive"] as CorsMode[])("public config retains %s for fakes, TLS and component proxies", cors => {
+  const fake = defineFake({ name: "fake", hostnames: ["fake.test"], cors, handler: () => new Response() });
+  const env = defineEnvironment({ name: "cors", fakes: { fake }, services: {
+    web: provides({ image: "nginx", tls: [{ hostname: "web.test", port: 81, cors }] }, [
+      proxy("*.proxy.test", { service: "web", port: 81, cors }),
+    ]),
+  } });
+  const project = env.project([]);
+  expect(project.fakes?.fake.cors).toBe(cors);
+  expect(lowerIngress(project).proxies.map(p => p.cors)).toEqual([cors, cors]);
+});
+
+test("invalid CORS modes fail at configuration time", () => {
+  const cors = "typo" as CorsMode;
+  expect(() => defineFake({ name: "fake", hostnames: ["fake.test"], cors, handler: () => new Response() })).toThrow("cors must be");
+  expect(() => proxy("proxy.test", { service: "web", port: 81, cors })).toThrow("cors must be");
+  expect(() => defineEnvironment({ name: "cors", services: {
+    web: { image: "nginx", tls: [{ hostname: "web.test", port: 81, cors }] },
+  } })).toThrow("cors must be");
+});
+
+for (const cors of [undefined, "passthrough", "permissive"] as const) {
+  test(`Supabase gateway carries ${cors ?? "default"} CORS through group expansion`, () => {
+    const sb = supabase({ hostname: "supabase.test", cors });
+    const project = defineEnvironment({ name: "cors", services: { supabase: sb.group } }).project([]);
+    const gateway = lowerIngress(project).proxies.find(p => p.hostname === "supabase.test");
+    expect(gateway).toBeDefined();
+    expect(gateway?.cors).toBe(cors);
+  });
+}
+
+test("Supabase rejects an invalid CORS mode", () => {
+  expect(() => supabase({ hostname: "supabase.test", cors: "typo" as CorsMode })).toThrow("cors must be");
+});

package/src/harness/ingress-table.ts

@@ -42,6 +42,7 @@
  * yet.
  */
 
+import type { CorsMode } from "../ingress.js";
 import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
 
 /**
@@ -53,7 +54,7 @@ import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
  */
 export type Route<F = unknown> =
   | { kind: "fake"; fake: F }
-  | { kind: "proxy"; service: string; port: number; http2?: boolean };
+  | { kind: "proxy"; service: string; port: number; http2?: boolean; cors?: CorsMode };
 
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {

package/src/index.ts

@@ -190,6 +190,7 @@ export {
   SELF_SERVICE_TOKEN,
 } from "./ingress.js";
 export type {
+  CorsMode,
   CertificateDecl,
   DnsDecl,
   ProxyDecl,
@@ -197,7 +198,7 @@ export type {
   DnsTarget,
   LoweredIngress,
 } from "./ingress.js";
-import type { DnsTarget } from "./ingress.js";
+import { validateCorsMode, type CorsMode, type DnsTarget } from "./ingress.js";
 import type {
   InterceptHandler,
   InterceptNext,
@@ -1164,6 +1165,9 @@ export interface ServiceTls {
   /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
    * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
   http2?: boolean;
+  /** Preserve upstream CORS policy by default. "permissive" opts HTTP/1
+   * ingress into answering preflights and adding credentialed CORS headers. */
+  cors?: CorsMode;
 }
 
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
@@ -1665,6 +1669,7 @@ function validateEnvironmentConfig<S extends ServicesMap>(
         );
       }
       if (entry.http2 !== undefined && typeof entry.http2 !== "boolean") throw new Error(`service "${name}" tls http2 must be a boolean`);
+      validateCorsMode(entry.cors);
       const h = entry.hostname.toLowerCase();
       if (!HOSTNAME_RE.test(hostPatternBody(h))) {
         throw new Error(
@@ -2144,6 +2149,9 @@ export interface FakeDefinition<
   hostnames: readonly string[];
   /** TCP port the fake listens on. Default `80`. */
   port?: number;
+  /** Preserve handler/interceptor CORS policy by default. "permissive"
+   * answers preflights and adds credentialed CORS headers at ingress. */
+  cors?: CorsMode;
   /**
    * Build the fake's initial state. Called once when the project loads.
    * The returned value lives in daemon memory for the rest of the
@@ -2227,6 +2235,7 @@ export function defineFake<
       );
     }
   }
+  validateCorsMode(opts.cors);
   if (typeof opts.handler !== "function") {
     throw new Error(`defineFake(${opts.name}): \`handler\` is required`);
   }

package/src/ingress.ts

@@ -25,6 +25,17 @@ import type { FakeDefinition, Project, ServiceConfig } from "./index.js";
  *  live IP on spectest-net (a plain peer alias, no daemon hop). */
 export type DnsTarget = { ingress: true } | { service: string };
 
+/** Passthrough preserves application CORS policy (the default). Permissive
+ * answers preflights and adds credentialed CORS headers at HTTP/1 ingress. */
+export type CorsMode = "passthrough" | "permissive";
+
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export function validateCorsMode(cors: unknown): void {
+  if (cors !== undefined && cors !== "passthrough" && cors !== "permissive") {
+    throw new Error('cors must be "passthrough" or "permissive"');
+  }
+}
+
 export interface CertificateDecl {
   kind: "certificate";
   /** Hostnames the leaf cert's SANs cover. One cert is minted per decl. */
@@ -40,7 +51,7 @@ export interface DnsDecl {
 export interface ProxyDecl {
   kind: "proxy";
   hostname: string;
-  upstream: { service: string; port: number; http2?: boolean };
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode };
 }
 
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -137,7 +148,7 @@ export function dnsName(hostname: string, target: DnsTarget): DnsDecl {
  */
 export function proxy(
   hostname: string,
-  upstream: { service: string; port: number; http2?: boolean },
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode },
 ): ProxyDecl {
   assertNameOrWildcard(hostname, "proxy()");
   if (!upstream || typeof upstream.service !== "string" || typeof upstream.port !== "number") {
@@ -146,6 +157,7 @@ export function proxy(
     );
   }
   if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean") throw new Error("proxy(): http2 must be a boolean");
+  validateCorsMode(upstream.cors);
   return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 
@@ -198,7 +210,7 @@ export interface LoweredIngress {
   /** One leaf cert per group; SANs = the group's hostnames. */
   certificates: { hostnames: string[] }[];
   /** Reverse-proxy routes: hostname → upstream service:port. */
-  proxies: { hostname: string; service: string; port: number; http2?: boolean }[];
+  proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[];
   /** Hostnames that resolve to the daemon ingress gateway (DNS registry
    *  + `--add-host` on every container). Covers fakes, TLS proxies, and
    *  any `dnsName(h, { ingress: true })`. */
@@ -227,7 +239,7 @@ function resolveSelf(service: string, selfKey: string): string {
  */
 export function lowerIngress(project: Project): LoweredIngress {
   const certificates: { hostnames: string[] }[] = [];
-  const proxies: { hostname: string; service: string; port: number; http2?: boolean }[] = [];
+  const proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[] = [];
   const ingressSet = new Set<string>();
   const aliasesByService: Record<string, string[]> = {};
   const wildcards: { pattern: string; target: DnsTarget }[] = [];
@@ -242,7 +254,7 @@ export function lowerIngress(project: Project): LoweredIngress {
         break;
       case "proxy": {
         const service = resolveSelf(decl.upstream.service, selfKey);
-        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
+        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}), ...(decl.upstream.cors ? { cors: decl.upstream.cors } : {}) });
         // A proxied hostname must route to the daemon. A wildcard one can
         // only be answered by the resolver (there is no `--add-host` for a
         // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -279,7 +291,7 @@ export function lowerIngress(project: Project): LoweredIngress {
     // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
     for (const entry of (svc as ServiceConfig).tls ?? []) {
       applyDecl(certificate([entry.hostname]), name);
-      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
+      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}), ...(entry.cors ? { cors: entry.cors } : {}) }), name);
     }
     // `hostnames: [h]` → plain peer alias (no daemon hop).
     for (const h of (svc as ServiceConfig).hostnames ?? []) {

package/dist/components/gcp.d.ts

@@ -1,2 +0,0 @@
-/** Google Cloud components for local Spectest environments. */
-export { pubsub, pubsubClient, type PubSubOptions, type PubSubOidcToken, type PubSubPushConfig, type PubSubDeadLetterPolicy, type PubSubRetryPolicy, type PubSubClient, type PubSubHelpers, type PubSubSubscriptionOptions, type PubSubMessage, type PubSubReceivedMessage, } from "./pubsub.js";

package/dist/components/gcp.js

@@ -1,2 +0,0 @@
-/** Google Cloud components for local Spectest environments. */
-export { pubsub, pubsubClient, } from "./pubsub.js";

package/dist/components/pubsub-push.py

@@ -1,83 +0,0 @@
-"""Authenticated push adapter; the emulator still owns scheduling and retries.
-
-Runs only on loopback in the emulator container. Tokens come from the local
-Google IAM fake, so recipients verify them with the same Google JWKS as usual.
-Never follows redirects or acknowledges a failed token request/delivery.
-"""
-import base64
-import json
-import os
-import ssl
-import sys
-import urllib.error
-import urllib.parse
-import urllib.request
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-
-
-class NoRedirect(urllib.request.HTTPRedirectHandler):
-    def redirect_request(self, req, fp, code, msg, headers, newurl):
-        return None
-
-
-def opener():
-    context = ssl.create_default_context(cafile=os.environ.get("SSL_CERT_FILE"))
-    return urllib.request.build_opener(NoRedirect(), urllib.request.HTTPSHandler(context=context))
-
-
-class Handler(BaseHTTPRequestHandler):
-    def do_POST(self):
-        phase = "configuration"
-        try:
-            if not self.path.startswith('/push/'):
-                self.send_error(404)
-                return
-            encoded = self.path[len('/push/'):]
-            config = json.loads(base64.urlsafe_b64decode(encoded + '=' * (-len(encoded) % 4)))
-            endpoint = config['endpoint']
-            if urllib.parse.urlsplit(endpoint).scheme not in ('http', 'https'):
-                raise ValueError('Invalid push endpoint')
-            size = int(self.headers.get('Content-Length', '0'))
-            if not 0 <= size <= 16 * 1024 * 1024:
-                self.send_error(413)
-                return
-            body = self.rfile.read(size)
-            account = urllib.parse.quote(config['serviceAccountEmail'], safe='')
-            token_url = 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/' + account + ':generateIdToken'
-            token_body = json.dumps({'audience': config.get('audience') or endpoint, 'includeEmail': True}).encode()
-            http = opener()
-            phase = "token issuance"
-            with http.open(urllib.request.Request(token_url, data=token_body, headers={'Content-Type': 'application/json'}), timeout=10) as response:
-                token = json.load(response)['token']
-            if not isinstance(token, str) or not token or '\r' in token or '\n' in token:
-                raise ValueError('Invalid ID token from Google IAM fake')
-            request = urllib.request.Request(endpoint, data=body, headers={
-                'Content-Type': self.headers.get('Content-Type', 'application/json'),
-                'Authorization': 'Bearer ' + token,
-            })
-            phase = "delivery"
-            with http.open(request, timeout=30) as response:
-                status = response.status
-            self.send_response(status)
-            self.end_headers()
-        except urllib.error.HTTPError as error:
-            # An unsuccessful token request or destination response must retry.
-            print(f"pubsub push {phase} returned HTTP {error.code}", flush=True)
-            self.send_response(error.code if error.code >= 300 else 502)
-            self.end_headers()
-            error.close()
-        except Exception as error:
-            # Do not log tokens, request bodies, or the encoded config URL.
-            print('pubsub push adapter failed: ' + type(error).__name__, flush=True)
-            self.send_response(502)
-            self.end_headers()
-
-    def log_message(self, format, *args):
-        pass
-
-
-if __name__ == '__main__':
-    server = ThreadingHTTPServer(('127.0.0.1', int(sys.argv[1])), Handler)
-    server.daemon_threads = True
-    print('pubsub authenticated push adapter ready', flush=True)
-    server.serve_forever()

package/dist/components/pubsub.d.ts

@@ -1,100 +0,0 @@
-import type { ServiceSetupContext, ServicesMap } from "../index.js";
-export interface PubSubOidcToken {
-    serviceAccountEmail: string;
-    /** Defaults to the original push endpoint URL. */
-    audience?: string;
-}
-export interface PubSubPushConfig {
-    pushEndpoint: string;
-    oidcToken?: PubSubOidcToken;
-    attributes?: Record<string, string>;
-}
-export interface PubSubDeadLetterPolicy {
-    /** Fully qualified projects/{project}/topics/{topic} name. Create this topic separately. */
-    deadLetterTopic: string;
-    maxDeliveryAttempts?: number;
-}
-export interface PubSubRetryPolicy {
-    /** Google duration strings, for example "1s" and "60s". */
-    minimumBackoff?: string;
-    maximumBackoff?: string;
-}
-export interface PubSubSubscriptionOptions {
-    /** Topic ID in this component's project. */
-    topic: string;
-    ackDeadlineSeconds?: number;
-    /** Shorthand for pushConfig.pushEndpoint. HTTP and HTTPS are supported. */
-    pushEndpoint?: string;
-    pushConfig?: PubSubPushConfig;
-    deadLetterPolicy?: PubSubDeadLetterPolicy;
-    retryPolicy?: PubSubRetryPolicy;
-}
-export interface PubSubOptions {
-    /** Local project ID; no Google Cloud account is needed. Default "spectest". */
-    projectId?: string;
-    /** Official Cloud CLI image with the Pub/Sub emulator installed. */
-    image?: string;
-    /** Emulator HTTP and gRPC port. Default 8085. */
-    port?: number;
-    /** TLS on pubsub.googleapis.com by default. Set false for direct emulator
-     * access, or choose a different hostname for a second isolated instance. */
-    tls?: false | {
-        hostname: string;
-    };
-    topics?: string[];
-    /** Subscription ID → options. Referenced topics are created automatically. */
-    subscriptions?: Record<string, PubSubSubscriptionOptions>;
-    /** Runs after the declared topics and subscriptions have been created. */
-    setup?: (ctx: ServiceSetupContext<PubSubHelpers>) => void | Promise<void>;
-}
-export interface PubSubMessage {
-    /** Base64 encoded data, as returned by the Pub/Sub REST API. */
-    data?: string;
-    attributes?: Record<string, string>;
-    messageId: string;
-    publishTime: string;
-    orderingKey?: string;
-}
-export interface PubSubReceivedMessage {
-    ackId: string;
-    message: PubSubMessage;
-    deliveryAttempt?: number;
-}
-/** Stateless emulator REST client. No credentials or gRPC channel to preserve across forks.
- * Resource arguments are short IDs in projectId; publish accepts UTF-8 text or bytes.
- */
-export declare function pubsubClient(endpoint: string, projectId?: string, fetcher?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>): {
-    projectId: string;
-    endpoint: string;
-    topicName: (id: string) => string;
-    subscriptionName: (id: string) => string;
-    createTopic(id: string): Promise<{
-        name: string;
-    }>;
-    createSubscription(id: string, options: PubSubSubscriptionOptions): Promise<{
-        name: string;
-        topic: string;
-        ackDeadlineSeconds: number;
-    }>;
-    publish(topic: string, data: string | Uint8Array, attributes?: Record<string, string>): Promise<string>;
-    /** A pull leases messages; call acknowledge() to remove them. Empty is valid.
-     * Uses the emulator's immediate pull mode for bounded test polling.
-     */
-    pull(subscription: string, options?: {
-        maxMessages?: number;
-        timeoutMs?: number;
-    }): Promise<PubSubReceivedMessage[]>;
-    acknowledge(subscription: string, ackIds: string[]): Promise<void>;
-};
-export type PubSubClient = ReturnType<typeof pubsubClient>;
-export interface PubSubHelpers extends PubSubClient {
-    /** Direct plaintext address for clients explicitly using emulator mode. */
-    emulatorHost: string;
-}
-/** Google Cloud's real local Pub/Sub emulator, ready for Google client libraries.
- * Mount directly in services: { pubsub: pubsub({ topics: ["orders"] }) }.
- * Applications use their default pubsub.googleapis.com:443 endpoint with
- * verified TLS and local test credentials. No emulator endpoint override.
- * State survives VM snapshots/forks, but not an emulator process restart.
- */
-export declare function pubsub(opts?: PubSubOptions): import("../index.js").ServiceGroup<ServicesMap, PubSubHelpers, "emulator">;