@synap-core/sdk 1.1.0 → 1.3.0

package/dist/testing.cjs

@@ -0,0 +1,671 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/testing/index.ts
+var testing_exports = {};
+__export(testing_exports, {
+  MOCK_AUTH_ISSUER: () => MOCK_AUTH_ISSUER,
+  MOCK_FAILURE_TOKENS: () => MOCK_FAILURE_TOKENS,
+  MOCK_FORM: () => MOCK_FORM,
+  MOCK_GRANT: () => MOCK_GRANT,
+  MOCK_POD_URL: () => MOCK_POD_URL,
+  MOCK_RETRY_AFTER_SEC: () => MOCK_RETRY_AFTER_SEC,
+  MOCK_SHARE: () => MOCK_SHARE,
+  MOCK_SITE: () => MOCK_SITE,
+  MOCK_TOKENS: () => MOCK_TOKENS,
+  MOCK_USER: () => MOCK_USER,
+  createMockAuthServer: () => createMockAuthServer,
+  createMockPod: () => createMockPod
+});
+module.exports = __toCommonJS(testing_exports);
+
+// src/testing/fixtures.ts
+var MOCK_FORM = {
+  title: "Get in touch",
+  fields: [
+    { key: "name", label: "Name", type: "text", required: true, constraints: { maxLength: 120 } },
+    { key: "email", label: "Email", type: "email", required: true },
+    {
+      key: "topic",
+      label: "Topic",
+      type: "enum",
+      constraints: { enum: ["Sales", "Support", "Partnership"] }
+    },
+    { key: "message", label: "Message", type: "richtext", help: "A few lines is plenty." }
+  ],
+  successMessage: "Thanks \u2014 we received your message.",
+  honeypotField: "hp",
+  ticket: "mock-ticket",
+  minSubmitMs: 0,
+  captcha: { required: false }
+};
+var MOCK_SHARE = {
+  resourceType: "entity",
+  title: "Launch notes",
+  properties: { status: "open", owner: "Ada", featured: true },
+  body: {
+    format: "markdown",
+    content: [
+      "# Launch notes",
+      "",
+      "This page is a **published snapshot** from a Synap pod.",
+      "",
+      "- Read the [Synap docs](https://synap.live)",
+      "- Links other than http, https and mailto render as plain text: [bad](javascript:alert(1))",
+      "",
+      "<script>raw HTML is shown as text, never run</script>"
+    ].join("\n")
+  },
+  publishedOn: "2026-09-27"
+};
+function publicId(prefix, n) {
+  return `p_${prefix}${String(n).padStart(16 - prefix.length, "0")}`;
+}
+function slugify(s) {
+  return s.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 96);
+}
+var PAPER_TITLES = [
+  "Sparse graphs at scale",
+  "Learning to rank, revisited",
+  "A note on causal tracing",
+  "Small models, long contexts",
+  "Evaluating retrieval honestly",
+  "Robust tokenisation",
+  "Graphs that forget",
+  "Calibration under shift",
+  "Latent space cartography",
+  "Proofs as programs, again",
+  "Cheap uncertainty",
+  "R\xE9sum\xE9 of a decade"
+];
+var VENUES = ["NeurIPS", "ICML", "ACL", "ICLR"];
+var PAPERS = PAPER_TITLES.map((title, i) => ({
+  collection: "paper",
+  publicId: publicId("paper", i + 1),
+  slug: slugify(title),
+  title,
+  properties: {
+    year: 2026 - i % 5,
+    venue: VENUES[i % VENUES.length],
+    open: i % 3 !== 0
+  },
+  publishedOn: `2026-09-${String(28 - i).padStart(2, "0")}`,
+  body: i % 4 === 3 ? null : { format: "markdown", content: `# ${title}
+
+Abstract of **${title}**.` }
+}));
+var PEOPLE = ["Ada Lovelace", "Alan Turing", "Grace Hopper"].map((name, i) => ({
+  collection: "person",
+  publicId: publicId("person", i + 1),
+  slug: null,
+  title: name,
+  properties: { name, role: i === 0 ? "Lead" : "Researcher" },
+  publishedOn: "2026-09-01",
+  body: null
+}));
+var MOCK_SITE = {
+  title: "Demo lab",
+  description: "What the lab publishes",
+  publishedOn: "2026-09-01",
+  collections: {
+    paper: { sort: ["-year"], pageSize: 5, addressing: "slug", records: PAPERS },
+    person: { sort: ["name"], pageSize: 20, addressing: "publicId", records: PEOPLE },
+    event: { sort: [], pageSize: 10, addressing: "slug", records: [] }
+  }
+};
+
+// src/connect/encoding.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function utf8(text) {
+  return encoder.encode(text);
+}
+function base64url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBytes(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function randomToken() {
+  return base64url(randomBytes(32));
+}
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", utf8(verifier));
+  return base64url(new Uint8Array(digest));
+}
+
+// src/testing/auth-server.ts
+var MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
+var MOCK_GRANT = [
+  { permission: "entity.post.read", workspaceId: "ws_mock_studio", workspaceName: "Studio" },
+  { permission: "entity.post.create", workspaceId: "ws_mock_studio", workspaceName: "Studio" }
+];
+var MOCK_USER = { id: "user_mock_ada", name: "Ada Lovelace" };
+function json(status, body, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+  });
+}
+function oauthError(error, description, status = 400) {
+  return json(status, { error, error_description: description });
+}
+function createMockAuthServer(options = {}) {
+  const issuer = options.issuer ?? MOCK_AUTH_ISSUER;
+  const now = options.now ?? Date.now;
+  const refresh = options.refresh ?? true;
+  const accessTtl = options.accessTtlSec ?? 3600;
+  const refreshIdle = options.refreshIdleSec ?? 30 * 24 * 3600;
+  const grant = options.grant ?? MOCK_GRANT;
+  const user = options.user ?? MOCK_USER;
+  const codes = /* @__PURE__ */ new Map();
+  const access = /* @__PURE__ */ new Map();
+  const refreshTokens = /* @__PURE__ */ new Map();
+  const requests = [];
+  const writes = [];
+  let proposalSeq = 0;
+  const metadata = () => {
+    const base = {
+      issuer,
+      authorization_endpoint: `${issuer}/authorize`,
+      token_endpoint: `${issuer}/token`,
+      registration_endpoint: `${issuer}/register`,
+      revocation_endpoint: `${issuer}/revoke`,
+      revocation_endpoint_auth_methods_supported: ["none"],
+      response_types_supported: ["code"],
+      grant_types_supported: refresh ? ["authorization_code", "refresh_token"] : ["authorization_code"],
+      code_challenge_methods_supported: ["S256"],
+      token_endpoint_auth_methods_supported: ["none"],
+      authorization_response_iss_parameter_supported: true,
+      client_id_metadata_document_supported: true
+    };
+    for (const [k, v] of Object.entries(options.metadata ?? {})) {
+      if (v === void 0) delete base[k];
+      else base[k] = v;
+    }
+    return base;
+  };
+  let loseNextRace = false;
+  let reuses = 0;
+  const revokeFamily = (family) => {
+    for (const r of refreshTokens.values()) if (r.family === family) r.revoked = true;
+    for (const a of access.values()) if (a.family === family) a.revoked = true;
+  };
+  const tokenBody = (scope, clientId, family) => {
+    const accessToken = `synap_hub_mock_${randomToken()}`;
+    access.set(accessToken, { expiresAt: now() + accessTtl * 1e3, revoked: false, family: refresh ? family : null });
+    const body = {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: accessTtl,
+      scope: scope.join(" "),
+      synap_grant: grant.filter((g) => scope.includes(g.permission)),
+      synap_user: user
+    };
+    if (refresh) {
+      const refreshToken = randomToken();
+      refreshTokens.set(refreshToken, { clientId, family, idleUntil: now() + refreshIdle * 1e3, used: false, revoked: false, scope });
+      body.refresh_token = refreshToken;
+      if (options.advertiseRefreshExpiry) body.refresh_token_expires_in = refreshIdle;
+    }
+    return body;
+  };
+  async function token(form) {
+    if (form.grant_type === "authorization_code") {
+      const row = form.code ? codes.get(form.code) : void 0;
+      if (form.code) codes.delete(form.code);
+      if (!row) return oauthError("invalid_grant", "Invalid, expired, or already-redeemed authorization code");
+      if (row.clientId !== form.client_id) return oauthError("invalid_grant", "client_id does not match the code");
+      if (row.redirectUri !== form.redirect_uri) return oauthError("invalid_grant", "redirect_uri mismatch");
+      if (!form.code_verifier || await pkceChallenge(form.code_verifier) !== row.challenge) {
+        return oauthError("invalid_grant", "PKCE verification failed");
+      }
+      if (form.resource !== void 0 && row.resource && form.resource !== row.resource) {
+        return oauthError("invalid_target", "resource does not match the authorization request");
+      }
+      for (const r of refreshTokens.values()) if (r.clientId === row.clientId) revokeFamily(r.family);
+      return json(200, tokenBody(row.scope, row.clientId, randomToken()));
+    }
+    if (form.grant_type === "refresh_token") {
+      if (!refresh) return oauthError("unsupported_grant_type", 'Only grant_type "authorization_code" is supported');
+      if (!form.refresh_token || !form.client_id) return oauthError("invalid_request", "refresh_token and client_id are required");
+      const row = refreshTokens.get(form.refresh_token);
+      if (!row || row.clientId !== form.client_id || row.revoked) {
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.used) {
+        reuses++;
+        revokeFamily(row.family);
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.idleUntil <= now()) return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      if (loseNextRace) {
+        loseNextRace = false;
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      row.used = true;
+      return json(200, tokenBody(row.scope, row.clientId, row.family));
+    }
+    return oauthError("unsupported_grant_type", "Unsupported grant_type");
+  }
+  function hub(method, path, headers, body) {
+    const failure2 = options.failures?.[path];
+    if (failure2 === "unreachable") return "reject";
+    const bearer = /^Bearer (.+)$/.exec(headers.authorization ?? "")?.[1];
+    const row = bearer ? access.get(bearer) : void 0;
+    if (!row || row.revoked || row.expiresAt <= now()) return json(401, { error: "Unauthorized" });
+    switch (failure2) {
+      case "rate_limited":
+        return json(429, { error: "Too many requests" }, { "Retry-After": "30" });
+      case "forbidden":
+        return json(403, { error: "Forbidden" });
+      case "door_unsupported":
+        return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+      case "server":
+        return json(500, { error: "Internal error" });
+      case "unavailable":
+        return json(503, { error: "Unavailable" });
+    }
+    if (path.startsWith("/knowledge/") || path === "/entities/retrieve" || path === "/memory/search") {
+      return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+    }
+    if (method === "GET" && path === "/users/me") return json(200, user);
+    if (method === "GET" && path === "/entities") return json(200, { entities: [], total: 0 });
+    if (method !== "GET") {
+      writes.push({ method, path, body });
+      if ((options.writeMode ?? "proposed") === "proposed") {
+        const proposalId = `prop_mock_${++proposalSeq}`;
+        return json(200, {
+          status: "proposed",
+          message: "Sent for review",
+          proposalId,
+          reviewUrl: `${issuer}/open/${proposalId}`
+        });
+      }
+      return json(200, { status: "created", id: `ent_mock_${writes.length}` });
+    }
+    return json(404, { error: "Not found" });
+  }
+  const mockFetch = async (input, init) => {
+    const request = typeof input === "object" && "method" in input ? input : null;
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+    const headers = {};
+    new Headers(init?.headers ?? request?.headers).forEach((value, name) => {
+      headers[name.toLowerCase()] = value;
+    });
+    const rawBody = typeof init?.body === "string" ? init.body : request ? await request.clone().text() : "";
+    const isForm = (headers["content-type"] ?? "").includes("application/x-www-form-urlencoded");
+    const form = isForm ? Object.fromEntries(new URLSearchParams(rawBody)) : null;
+    requests.push({ method, url: url.href, headers, form });
+    if (url.origin !== new URL(issuer).origin) throw new TypeError(`Failed to fetch: ${url.origin} is not the mock pod`);
+    const path = url.pathname;
+    if (method === "GET" && path === "/.well-known/oauth-authorization-server") return json(200, metadata());
+    if (method === "POST" && path === "/token") return token(form ?? {});
+    if (method === "POST" && path === "/revoke") {
+      const t = form?.token ?? "";
+      const r = refreshTokens.get(t);
+      if (r && form?.client_id && form.client_id !== r.clientId) {
+        return oauthError("unauthorized_client", "The token was not issued to this client");
+      }
+      if (r) revokeFamily(r.family);
+      const a = access.get(t);
+      if (a) a.revoked = true;
+      return new Response(null, { status: 200 });
+    }
+    const hubPath = /^\/api\/hub(\/.*)$/.exec(path)?.[1];
+    if (hubPath) {
+      let body = void 0;
+      try {
+        body = rawBody ? JSON.parse(rawBody) : void 0;
+      } catch {
+        body = rawBody;
+      }
+      const res = hub(method, hubPath, headers, body);
+      if (res === "reject") throw new TypeError("Failed to fetch: mock pod unreachable");
+      return res;
+    }
+    return json(404, { error: "Not found" });
+  };
+  return {
+    issuer,
+    fetch: mockFetch,
+    requests,
+    writes,
+    authorize(authorizeUrl, decision = {}) {
+      const url = new URL(authorizeUrl);
+      if (`${url.origin}${url.pathname}` !== `${issuer}/authorize`) throw new Error(`Not this pod's /authorize: ${authorizeUrl}`);
+      const q = url.searchParams;
+      const redirectUri = q.get("redirect_uri");
+      const clientId = q.get("client_id");
+      if (!clientId || !redirectUri) throw new Error("Authorization request rejected: client_id and redirect_uri are required");
+      const answer = new URL(redirectUri);
+      const state = decision.state ?? q.get("state");
+      const finish = (fields) => {
+        for (const [k, v] of Object.entries(fields)) answer.searchParams.set(k, v);
+        if (state !== null) answer.searchParams.set("state", state);
+        const iss = decision.iss === void 0 ? issuer : decision.iss;
+        if (iss !== null) answer.searchParams.set("iss", iss);
+        return answer.href;
+      };
+      if (q.get("response_type") !== "code") return finish({ error: "unsupported_response_type" });
+      if (q.get("code_challenge_method") !== "S256" || !q.get("code_challenge")) {
+        return finish({ error: "invalid_request", error_description: "PKCE S256 is required" });
+      }
+      const resource = q.get("resource");
+      if (resource !== null && resource !== `${issuer}/api/hub` && resource !== `${issuer}/mcp`) {
+        return finish({ error: "invalid_target" });
+      }
+      const scope = (q.get("scope") ?? "").split(/\s+/).filter(Boolean);
+      if (scope.length === 0) return finish({ error: "invalid_scope" });
+      if (decision.deny) return finish({ error: "access_denied" });
+      const code = randomToken();
+      codes.set(code, { clientId, redirectUri, challenge: q.get("code_challenge"), resource, scope });
+      return finish({ code });
+    },
+    consumeRefreshToken(t) {
+      const row = refreshTokens.get(t);
+      if (row) row.used = true;
+    },
+    loseNextRefreshRace() {
+      loseNextRace = true;
+    },
+    get reuses() {
+      return reuses;
+    },
+    revokeAll() {
+      for (const row of access.values()) row.revoked = true;
+      for (const row of refreshTokens.values()) row.revoked = true;
+    },
+    liveRefreshTokens() {
+      return [...refreshTokens].filter(([, r]) => !r.used && !r.revoked).map(([t]) => t);
+    },
+    reset() {
+      requests.length = 0;
+      writes.length = 0;
+    }
+  };
+}
+
+// src/testing/index.ts
+var MOCK_POD_URL = "https://mock.synap.invalid";
+var MOCK_TOKENS = { form: "demo-form", share: "demo", site: "demo-site" };
+var MOCK_RETRY_AFTER_SEC = 30;
+var MOCK_FAILURE_TOKENS = {
+  /** 429 with no `Retry-After` (what the pod's public doors send today). */
+  rateLimited: "mock-rate-limited",
+  /** 429 with `Retry-After: 30`. */
+  rateLimitedRetryAfter: "mock-rate-limited-retry-after",
+  /** 403 `public_doors_disabled`: the owner switched public pages off. */
+  doorsDisabled: "mock-doors-disabled",
+  /** 500. */
+  serverError: "mock-server-error",
+  /** 503 (a read: `pod_unreachable` / `server`; a submit: `unavailable`). */
+  unavailable: "mock-unavailable",
+  /** No answer: the fetch rejects (`network` / `pod_unreachable`). */
+  unreachable: "mock-unreachable"
+};
+var NOT_FOUND = { error: "Not found" };
+var DOORS_DISABLED = {
+  error: "The owner has not turned on public pages and forms for this workspace.",
+  code: "public_doors_disabled"
+};
+var SAFELISTED = /* @__PURE__ */ new Set(["accept", "accept-language", "content-language", "content-type"]);
+var PREFLIGHT_ALLOWED = /* @__PURE__ */ new Set(["content-type"]);
+var PUBLIC_ID_RE = /^p_[A-Za-z0-9]{16}$/;
+var SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var SLUG_MAX_LENGTH = 96;
+var DIGITS = /^\d{1,9}$/;
+var SORT_TERM = /^(-?)([A-Za-z][A-Za-z0-9_]{0,63})$/;
+var MAX_OFFSET = 1e4;
+var MAX_LIMIT = 100;
+var MAX_SORT_KEYS = 3;
+var PUBLISHED_AT = "publishedAt";
+function json2(status, body, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-cache", ...headers }
+  });
+}
+function weakEtag(value) {
+  let h = 2166136261;
+  for (const ch of JSON.stringify(value)) {
+    h ^= ch.charCodeAt(0);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return `W/"${h.toString(16).padStart(8, "0")}"`;
+}
+function etagMatches(header, etag) {
+  if (!header) return false;
+  if (header.trim() === "*") return true;
+  const strip = (t) => t.trim().replace(/^W\//, "");
+  return header.split(",").some((t) => strip(t) === strip(etag));
+}
+function failure(token) {
+  switch (token) {
+    case MOCK_FAILURE_TOKENS.rateLimited:
+      return json2(429, { error: "Too many requests", retryAfter: "5 minutes" });
+    case MOCK_FAILURE_TOKENS.rateLimitedRetryAfter:
+      return json2(429, { error: "Too many requests" }, { "Retry-After": String(MOCK_RETRY_AFTER_SEC) });
+    case MOCK_FAILURE_TOKENS.doorsDisabled:
+      return json2(403, DOORS_DISABLED);
+    case MOCK_FAILURE_TOKENS.serverError:
+      return json2(500, { error: "Internal error" });
+    case MOCK_FAILURE_TOKENS.unavailable:
+      return json2(503, { received: false });
+    case MOCK_FAILURE_TOKENS.unreachable:
+      return "reject";
+    default:
+      return null;
+  }
+}
+function summary(record) {
+  const { body: _body, ...rest } = record;
+  return rest;
+}
+function manifest(site) {
+  return {
+    ...site.title !== void 0 ? { title: site.title } : {},
+    ...site.description !== void 0 ? { description: site.description } : {},
+    publishedOn: site.publishedOn,
+    collections: Object.keys(site.collections).sort().map((key) => {
+      const c = site.collections[key];
+      return { key, count: c.records.length, sort: [...c.sort], pageSize: c.pageSize, addressing: c.addressing };
+    })
+  };
+}
+function parseQuery(params, c) {
+  for (const name of params.keys()) {
+    if (name === "embed") return "embed is not available";
+    if (name === "ref" || name.startsWith("ref[")) return "ref filter is not available";
+  }
+  const one = (name) => {
+    const all = params.getAll(name);
+    return all.length === 0 ? void 0 : all.length === 1 ? all[0] : null;
+  };
+  const rawOffset = one("offset");
+  if (rawOffset === null || rawOffset !== void 0 && !DIGITS.test(rawOffset)) return "invalid offset";
+  const offset = rawOffset === void 0 ? 0 : Number(rawOffset);
+  if (offset > MAX_OFFSET) return "offset too large";
+  const rawLimit = one("limit");
+  if (rawLimit === null || rawLimit !== void 0 && !DIGITS.test(rawLimit)) return "invalid limit";
+  const limit = Math.min(MAX_LIMIT, Math.max(1, rawLimit === void 0 ? c.pageSize : Number(rawLimit)));
+  const rawSort = one("sort");
+  if (rawSort === null) return "invalid sort";
+  const terms = rawSort !== void 0 ? rawSort.split(",") : c.sort.length > 0 ? [...c.sort] : [`-${PUBLISHED_AT}`];
+  if (terms.length > MAX_SORT_KEYS) return "invalid sort";
+  const allowed = /* @__PURE__ */ new Set([PUBLISHED_AT, ...c.sort.map((s) => s.replace(/^-/, ""))]);
+  const sort = [];
+  for (const term of terms) {
+    const m = SORT_TERM.exec(term);
+    if (!m || !allowed.has(m[2]) || sort.some((s) => s.key === m[2])) return "invalid sort";
+    sort.push({ key: m[2], desc: m[1] === "-" });
+  }
+  return { offset, limit, sort };
+}
+function compareRecords(sort) {
+  const rank = (v) => typeof v === "string" ? 0 : typeof v === "number" ? 1 : 2;
+  const valueOf = (r, key) => key === PUBLISHED_AT ? r.publishedOn : r.properties[key];
+  return (a, b) => {
+    for (const { key, desc } of sort) {
+      const va = valueOf(a, key);
+      const vb = valueOf(b, key);
+      if (va === void 0 || vb === void 0) {
+        if (va !== vb) return va === void 0 ? 1 : -1;
+        continue;
+      }
+      let d = rank(va) - rank(vb);
+      if (d === 0) d = va < vb ? -1 : va > vb ? 1 : 0;
+      if (d !== 0) return desc ? -d : d;
+    }
+    if (a.publishedOn !== b.publishedOn) return a.publishedOn < b.publishedOn ? 1 : -1;
+    return a.publicId < b.publicId ? -1 : a.publicId > b.publicId ? 1 : 0;
+  };
+}
+function cached(view, ifNoneMatch) {
+  const etag = weakEtag(view);
+  if (etagMatches(ifNoneMatch, etag)) {
+    return new Response(null, { status: 304, headers: { ETag: etag, "Cache-Control": "no-cache" } });
+  }
+  return json2(200, view, { ETag: etag });
+}
+function siteDoor(site, rest, params, ifNoneMatch) {
+  if (rest.length === 0) return cached(manifest(site), ifNoneMatch);
+  if (rest[0] !== "collections" || rest.length > 3 || !Object.hasOwn(site.collections, rest[1])) {
+    return json2(404, NOT_FOUND);
+  }
+  const c = site.collections[rest[1]];
+  if (rest.length === 2) {
+    const q = parseQuery(params, c);
+    if (typeof q === "string") return json2(400, { error: q });
+    const sorted = [...c.records].sort(compareRecords(q.sort));
+    const page = {
+      items: sorted.slice(q.offset, q.offset + q.limit).map(summary),
+      total: sorted.length,
+      offset: q.offset,
+      limit: q.limit
+    };
+    return cached(page, ifNoneMatch);
+  }
+  const address = rest[2];
+  const byPublicId = PUBLIC_ID_RE.test(address);
+  if (!byPublicId && !(address.length <= SLUG_MAX_LENGTH && SLUG_RE.test(address))) return json2(404, NOT_FOUND);
+  const record = c.records.find((r) => byPublicId ? r.publicId === address : r.slug === address);
+  if (!record) return json2(404, NOT_FOUND);
+  if (params.has("embed")) return json2(400, { error: "embed is not available" });
+  return cached(record, ifNoneMatch);
+}
+function invalidKeys(form, body) {
+  const fields = body?.fields;
+  if (typeof fields !== "object" || fields === null) return [];
+  const answers = fields;
+  return form.fields.filter((f) => {
+    const v = answers[f.key];
+    if (v === void 0 || v === "" || v === null) return f.required === true;
+    if (f.type === "boolean") return typeof v !== "boolean" || f.required === true && v !== true;
+    const allowed = f.constraints?.enum;
+    return allowed !== void 0 && !allowed.includes(String(v));
+  }).map((f) => f.key);
+}
+function createMockPod(options = {}) {
+  const forms = options.forms ?? { [MOCK_TOKENS.form]: MOCK_FORM };
+  const shares = options.shares ?? { [MOCK_TOKENS.share]: MOCK_SHARE };
+  const sites = options.sites ?? { [MOCK_TOKENS.site]: MOCK_SITE };
+  const requests = [];
+  const submissions = [];
+  const mockFetch = async (input, init) => {
+    const request = typeof input === "object" && "method" in input ? input : null;
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+    const headers = {};
+    new Headers(init?.headers ?? request?.headers).forEach((value, name) => {
+      headers[name.toLowerCase()] = value;
+    });
+    const credentials = init?.credentials ?? request?.credentials;
+    requests.push({ method, url: url.href, headers, credentials });
+    if (credentials === "include") throw new TypeError("Failed to fetch: credentialed request to a public door");
+    if (options.browser) {
+      const preflighted = Object.keys(headers).filter((h) => !SAFELISTED.has(h) && !PREFLIGHT_ALLOWED.has(h));
+      if (preflighted.length > 0) throw new TypeError(`Failed to fetch: preflight refuses ${preflighted.join(", ")}`);
+    }
+    const m = url.pathname.match(/^\/api\/hub\/public\/(forms|shares|sites)\/(.+)$/);
+    if (!m) return json2(404, NOT_FOUND);
+    let segments;
+    try {
+      segments = m[2].split("/").map(decodeURIComponent);
+    } catch {
+      return json2(404, NOT_FOUND);
+    }
+    const [token, ...rest] = segments;
+    const failed = failure(token);
+    if (failed === "reject") throw new TypeError("Failed to fetch: mock pod unreachable");
+    if (failed) return failed;
+    const door = m[1];
+    if (door === "forms" && method === "POST" && rest.length === 0) {
+      let body = null;
+      try {
+        body = JSON.parse(typeof init?.body === "string" ? init.body : "null");
+      } catch {
+        body = null;
+      }
+      const form = Object.hasOwn(forms, token) ? forms[token] : void 0;
+      const invalid = form ? invalidKeys(form, body) : [];
+      const status = invalid.length > 0 ? 422 : 202;
+      submissions.push({ token, body, status });
+      return status === 422 ? json2(422, { received: false, invalid }) : json2(202, { received: true });
+    }
+    if (method !== "GET") return json2(404, NOT_FOUND);
+    if (door === "forms" && rest.length === 0 && Object.hasOwn(forms, token)) return json2(200, forms[token]);
+    if (door === "shares" && rest.length === 0 && Object.hasOwn(shares, token)) return json2(200, shares[token]);
+    if (door === "sites" && Object.hasOwn(sites, token)) {
+      return siteDoor(sites[token], rest, url.searchParams, headers["if-none-match"] ?? null);
+    }
+    return json2(404, NOT_FOUND);
+  };
+  return {
+    podUrl: MOCK_POD_URL,
+    fetch: mockFetch,
+    requests,
+    submissions,
+    reset() {
+      requests.length = 0;
+      submissions.length = 0;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MOCK_AUTH_ISSUER,
+  MOCK_FAILURE_TOKENS,
+  MOCK_FORM,
+  MOCK_GRANT,
+  MOCK_POD_URL,
+  MOCK_RETRY_AFTER_SEC,
+  MOCK_SHARE,
+  MOCK_SITE,
+  MOCK_TOKENS,
+  MOCK_USER,
+  createMockAuthServer,
+  createMockPod
+});
+//# sourceMappingURL=testing.cjs.map