@synap-core/sdk 1.2.0 → 1.3.0

package/dist/testing.d.cts

@@ -1,4 +1,5 @@
-import { P as PublicForm, g as PublicShare, e as PublicRecord } from './client-C5sF20f1.cjs';
+import { P as PublicForm, a as PublicShare, b as PublicRecord } from './client-CVUT1Mcf.cjs';
+import { P as PodGrant, a as PodUser } from './types-DpqPNaaa.cjs';
 
 /**
  * Demo data for the mock pod. Shapes are the `@synap-core/sdk/public` wire
@@ -28,6 +29,73 @@ interface MockSite {
  */
 declare const MOCK_SITE: MockSite;
 
+/** A placeholder pod origin; never contacted. */
+declare const MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
+declare const MOCK_GRANT: PodGrant[];
+declare const MOCK_USER: PodUser;
+type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported" | "unreachable" | "server" | "unavailable";
+interface MockAuthServerOptions {
+    issuer?: string;
+    /** Issue rotating refresh tokens (PB3). Default true; false = a pod before PB3. */
+    refresh?: boolean;
+    /** Default 3600 (the pod's 1 h). */
+    accessTtlSec?: number;
+    /** Default 30 days. */
+    refreshIdleSec?: number;
+    /** Send `refresh_token_expires_in` with each refresh token. Default false (the pod does not say). */
+    advertiseRefreshExpiry?: boolean;
+    grant?: PodGrant[];
+    user?: PodUser;
+    /** Override or remove (undefined) metadata fields: a pod too old, a lying issuer. */
+    metadata?: Record<string, unknown>;
+    /** Hub writes: "proposed" (ask-first, the default for an app) or "applied". */
+    writeMode?: "proposed" | "applied";
+    /** Hub paths (after /api/hub) that answer one failure. */
+    failures?: Record<string, MockHubFailure>;
+    now?: () => number;
+}
+interface MockAuthRequest {
+    method: string;
+    url: string;
+    /** Lower-cased header names. */
+    headers: Record<string, string>;
+    /** The form body of a /token or /revoke call. */
+    form: Record<string, string> | null;
+}
+interface AuthorizeDecision {
+    /** The person said no. */
+    deny?: boolean;
+    /** Override `iss` on the answer (null = omit it): a mix-up attack. */
+    iss?: string | null;
+    /** Override `state` on the answer: a forged answer. */
+    state?: string;
+}
+interface MockAuthServer {
+    issuer: string;
+    fetch: typeof fetch;
+    requests: MockAuthRequest[];
+    /** Hub writes seen, in order. */
+    writes: Array<{
+        method: string;
+        path: string;
+        body: unknown;
+    }>;
+    /** Stand-in for the consent screen: validates the request like /authorize, returns where the pod redirects. */
+    authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
+    /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
+    consumeRefreshToken(token: string): void;
+    /** The next refresh redeem loses a concurrent race: invalid_grant, nothing revoked. */
+    loseNextRefreshRace(): void;
+    /** Refresh-token redeems that were reuses (each revoked a family). */
+    reuses: number;
+    /** The person revoked the app: every token stops working. */
+    revokeAll(): void;
+    /** Live (unrevoked) refresh tokens. */
+    liveRefreshTokens(): string[];
+    reset(): void;
+}
+declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuthServer;
+
 /**
  * @synap-core/sdk/testing — a mock pod: a fake `fetch` that answers the pod's
  * public doors (forms, shares, sites) from fixtures, with no network. Inject
@@ -45,6 +113,9 @@ declare const MOCK_SITE: MockSite;
  *   tokens MOCK_TOKENS.form / .share / .site   the demo form, share and site
  *   tokens MOCK_FAILURE_TOKENS.*                one failure on every door
  *   anything else                               the uniform 404
+ *
+ * Pod-app sign-in (`@synap-core/sdk/connect`): `createMockAuthServer()`, see
+ * ./auth-server.ts.
  */
 
 /** A placeholder origin; never contacted. */
@@ -107,4 +178,4 @@ interface MockPod {
 }
 declare function createMockPod(options?: MockPodOptions): MockPod;
 
-export { MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, type MockCollection, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockPod };
+export { type AuthorizeDecision, MOCK_AUTH_ISSUER, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockPod };

package/dist/testing.d.ts

@@ -1,4 +1,5 @@
-import { P as PublicForm, g as PublicShare, e as PublicRecord } from './client-C5sF20f1.js';
+import { P as PublicForm, a as PublicShare, b as PublicRecord } from './client-CVUT1Mcf.js';
+import { P as PodGrant, a as PodUser } from './types-DpqPNaaa.js';
 
 /**
  * Demo data for the mock pod. Shapes are the `@synap-core/sdk/public` wire
@@ -28,6 +29,73 @@ interface MockSite {
  */
 declare const MOCK_SITE: MockSite;
 
+/** A placeholder pod origin; never contacted. */
+declare const MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
+declare const MOCK_GRANT: PodGrant[];
+declare const MOCK_USER: PodUser;
+type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported" | "unreachable" | "server" | "unavailable";
+interface MockAuthServerOptions {
+    issuer?: string;
+    /** Issue rotating refresh tokens (PB3). Default true; false = a pod before PB3. */
+    refresh?: boolean;
+    /** Default 3600 (the pod's 1 h). */
+    accessTtlSec?: number;
+    /** Default 30 days. */
+    refreshIdleSec?: number;
+    /** Send `refresh_token_expires_in` with each refresh token. Default false (the pod does not say). */
+    advertiseRefreshExpiry?: boolean;
+    grant?: PodGrant[];
+    user?: PodUser;
+    /** Override or remove (undefined) metadata fields: a pod too old, a lying issuer. */
+    metadata?: Record<string, unknown>;
+    /** Hub writes: "proposed" (ask-first, the default for an app) or "applied". */
+    writeMode?: "proposed" | "applied";
+    /** Hub paths (after /api/hub) that answer one failure. */
+    failures?: Record<string, MockHubFailure>;
+    now?: () => number;
+}
+interface MockAuthRequest {
+    method: string;
+    url: string;
+    /** Lower-cased header names. */
+    headers: Record<string, string>;
+    /** The form body of a /token or /revoke call. */
+    form: Record<string, string> | null;
+}
+interface AuthorizeDecision {
+    /** The person said no. */
+    deny?: boolean;
+    /** Override `iss` on the answer (null = omit it): a mix-up attack. */
+    iss?: string | null;
+    /** Override `state` on the answer: a forged answer. */
+    state?: string;
+}
+interface MockAuthServer {
+    issuer: string;
+    fetch: typeof fetch;
+    requests: MockAuthRequest[];
+    /** Hub writes seen, in order. */
+    writes: Array<{
+        method: string;
+        path: string;
+        body: unknown;
+    }>;
+    /** Stand-in for the consent screen: validates the request like /authorize, returns where the pod redirects. */
+    authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
+    /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
+    consumeRefreshToken(token: string): void;
+    /** The next refresh redeem loses a concurrent race: invalid_grant, nothing revoked. */
+    loseNextRefreshRace(): void;
+    /** Refresh-token redeems that were reuses (each revoked a family). */
+    reuses: number;
+    /** The person revoked the app: every token stops working. */
+    revokeAll(): void;
+    /** Live (unrevoked) refresh tokens. */
+    liveRefreshTokens(): string[];
+    reset(): void;
+}
+declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuthServer;
+
 /**
  * @synap-core/sdk/testing — a mock pod: a fake `fetch` that answers the pod's
  * public doors (forms, shares, sites) from fixtures, with no network. Inject
@@ -45,6 +113,9 @@ declare const MOCK_SITE: MockSite;
  *   tokens MOCK_TOKENS.form / .share / .site   the demo form, share and site
  *   tokens MOCK_FAILURE_TOKENS.*                one failure on every door
  *   anything else                               the uniform 404
+ *
+ * Pod-app sign-in (`@synap-core/sdk/connect`): `createMockAuthServer()`, see
+ * ./auth-server.ts.
  */
 
 /** A placeholder origin; never contacted. */
@@ -107,4 +178,4 @@ interface MockPod {
 }
 declare function createMockPod(options?: MockPodOptions): MockPod;
 
-export { MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, type MockCollection, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockPod };
+export { type AuthorizeDecision, MOCK_AUTH_ISSUER, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockPod };

package/dist/testing.js

@@ -1,3 +1,8 @@
+import {
+  pkceChallenge,
+  randomToken
+} from "./chunk-J7XHAAFJ.js";
+
 // src/testing/fixtures.ts
 var MOCK_FORM = {
   title: "Get in touch",
@@ -93,6 +98,259 @@ var MOCK_SITE = {
   }
 };
 
+// src/testing/auth-server.ts
+var MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
+var MOCK_GRANT = [
+  { permission: "entity.post.read", workspaceId: "ws_mock_studio", workspaceName: "Studio" },
+  { permission: "entity.post.create", workspaceId: "ws_mock_studio", workspaceName: "Studio" }
+];
+var MOCK_USER = { id: "user_mock_ada", name: "Ada Lovelace" };
+function json(status, body, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+  });
+}
+function oauthError(error, description, status = 400) {
+  return json(status, { error, error_description: description });
+}
+function createMockAuthServer(options = {}) {
+  const issuer = options.issuer ?? MOCK_AUTH_ISSUER;
+  const now = options.now ?? Date.now;
+  const refresh = options.refresh ?? true;
+  const accessTtl = options.accessTtlSec ?? 3600;
+  const refreshIdle = options.refreshIdleSec ?? 30 * 24 * 3600;
+  const grant = options.grant ?? MOCK_GRANT;
+  const user = options.user ?? MOCK_USER;
+  const codes = /* @__PURE__ */ new Map();
+  const access = /* @__PURE__ */ new Map();
+  const refreshTokens = /* @__PURE__ */ new Map();
+  const requests = [];
+  const writes = [];
+  let proposalSeq = 0;
+  const metadata = () => {
+    const base = {
+      issuer,
+      authorization_endpoint: `${issuer}/authorize`,
+      token_endpoint: `${issuer}/token`,
+      registration_endpoint: `${issuer}/register`,
+      revocation_endpoint: `${issuer}/revoke`,
+      revocation_endpoint_auth_methods_supported: ["none"],
+      response_types_supported: ["code"],
+      grant_types_supported: refresh ? ["authorization_code", "refresh_token"] : ["authorization_code"],
+      code_challenge_methods_supported: ["S256"],
+      token_endpoint_auth_methods_supported: ["none"],
+      authorization_response_iss_parameter_supported: true,
+      client_id_metadata_document_supported: true
+    };
+    for (const [k, v] of Object.entries(options.metadata ?? {})) {
+      if (v === void 0) delete base[k];
+      else base[k] = v;
+    }
+    return base;
+  };
+  let loseNextRace = false;
+  let reuses = 0;
+  const revokeFamily = (family) => {
+    for (const r of refreshTokens.values()) if (r.family === family) r.revoked = true;
+    for (const a of access.values()) if (a.family === family) a.revoked = true;
+  };
+  const tokenBody = (scope, clientId, family) => {
+    const accessToken = `synap_hub_mock_${randomToken()}`;
+    access.set(accessToken, { expiresAt: now() + accessTtl * 1e3, revoked: false, family: refresh ? family : null });
+    const body = {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: accessTtl,
+      scope: scope.join(" "),
+      synap_grant: grant.filter((g) => scope.includes(g.permission)),
+      synap_user: user
+    };
+    if (refresh) {
+      const refreshToken = randomToken();
+      refreshTokens.set(refreshToken, { clientId, family, idleUntil: now() + refreshIdle * 1e3, used: false, revoked: false, scope });
+      body.refresh_token = refreshToken;
+      if (options.advertiseRefreshExpiry) body.refresh_token_expires_in = refreshIdle;
+    }
+    return body;
+  };
+  async function token(form) {
+    if (form.grant_type === "authorization_code") {
+      const row = form.code ? codes.get(form.code) : void 0;
+      if (form.code) codes.delete(form.code);
+      if (!row) return oauthError("invalid_grant", "Invalid, expired, or already-redeemed authorization code");
+      if (row.clientId !== form.client_id) return oauthError("invalid_grant", "client_id does not match the code");
+      if (row.redirectUri !== form.redirect_uri) return oauthError("invalid_grant", "redirect_uri mismatch");
+      if (!form.code_verifier || await pkceChallenge(form.code_verifier) !== row.challenge) {
+        return oauthError("invalid_grant", "PKCE verification failed");
+      }
+      if (form.resource !== void 0 && row.resource && form.resource !== row.resource) {
+        return oauthError("invalid_target", "resource does not match the authorization request");
+      }
+      for (const r of refreshTokens.values()) if (r.clientId === row.clientId) revokeFamily(r.family);
+      return json(200, tokenBody(row.scope, row.clientId, randomToken()));
+    }
+    if (form.grant_type === "refresh_token") {
+      if (!refresh) return oauthError("unsupported_grant_type", 'Only grant_type "authorization_code" is supported');
+      if (!form.refresh_token || !form.client_id) return oauthError("invalid_request", "refresh_token and client_id are required");
+      const row = refreshTokens.get(form.refresh_token);
+      if (!row || row.clientId !== form.client_id || row.revoked) {
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.used) {
+        reuses++;
+        revokeFamily(row.family);
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.idleUntil <= now()) return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      if (loseNextRace) {
+        loseNextRace = false;
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      row.used = true;
+      return json(200, tokenBody(row.scope, row.clientId, row.family));
+    }
+    return oauthError("unsupported_grant_type", "Unsupported grant_type");
+  }
+  function hub(method, path, headers, body) {
+    const failure2 = options.failures?.[path];
+    if (failure2 === "unreachable") return "reject";
+    const bearer = /^Bearer (.+)$/.exec(headers.authorization ?? "")?.[1];
+    const row = bearer ? access.get(bearer) : void 0;
+    if (!row || row.revoked || row.expiresAt <= now()) return json(401, { error: "Unauthorized" });
+    switch (failure2) {
+      case "rate_limited":
+        return json(429, { error: "Too many requests" }, { "Retry-After": "30" });
+      case "forbidden":
+        return json(403, { error: "Forbidden" });
+      case "door_unsupported":
+        return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+      case "server":
+        return json(500, { error: "Internal error" });
+      case "unavailable":
+        return json(503, { error: "Unavailable" });
+    }
+    if (path.startsWith("/knowledge/") || path === "/entities/retrieve" || path === "/memory/search") {
+      return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+    }
+    if (method === "GET" && path === "/users/me") return json(200, user);
+    if (method === "GET" && path === "/entities") return json(200, { entities: [], total: 0 });
+    if (method !== "GET") {
+      writes.push({ method, path, body });
+      if ((options.writeMode ?? "proposed") === "proposed") {
+        const proposalId = `prop_mock_${++proposalSeq}`;
+        return json(200, {
+          status: "proposed",
+          message: "Sent for review",
+          proposalId,
+          reviewUrl: `${issuer}/open/${proposalId}`
+        });
+      }
+      return json(200, { status: "created", id: `ent_mock_${writes.length}` });
+    }
+    return json(404, { error: "Not found" });
+  }
+  const mockFetch = async (input, init) => {
+    const request = typeof input === "object" && "method" in input ? input : null;
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+    const headers = {};
+    new Headers(init?.headers ?? request?.headers).forEach((value, name) => {
+      headers[name.toLowerCase()] = value;
+    });
+    const rawBody = typeof init?.body === "string" ? init.body : request ? await request.clone().text() : "";
+    const isForm = (headers["content-type"] ?? "").includes("application/x-www-form-urlencoded");
+    const form = isForm ? Object.fromEntries(new URLSearchParams(rawBody)) : null;
+    requests.push({ method, url: url.href, headers, form });
+    if (url.origin !== new URL(issuer).origin) throw new TypeError(`Failed to fetch: ${url.origin} is not the mock pod`);
+    const path = url.pathname;
+    if (method === "GET" && path === "/.well-known/oauth-authorization-server") return json(200, metadata());
+    if (method === "POST" && path === "/token") return token(form ?? {});
+    if (method === "POST" && path === "/revoke") {
+      const t = form?.token ?? "";
+      const r = refreshTokens.get(t);
+      if (r && form?.client_id && form.client_id !== r.clientId) {
+        return oauthError("unauthorized_client", "The token was not issued to this client");
+      }
+      if (r) revokeFamily(r.family);
+      const a = access.get(t);
+      if (a) a.revoked = true;
+      return new Response(null, { status: 200 });
+    }
+    const hubPath = /^\/api\/hub(\/.*)$/.exec(path)?.[1];
+    if (hubPath) {
+      let body = void 0;
+      try {
+        body = rawBody ? JSON.parse(rawBody) : void 0;
+      } catch {
+        body = rawBody;
+      }
+      const res = hub(method, hubPath, headers, body);
+      if (res === "reject") throw new TypeError("Failed to fetch: mock pod unreachable");
+      return res;
+    }
+    return json(404, { error: "Not found" });
+  };
+  return {
+    issuer,
+    fetch: mockFetch,
+    requests,
+    writes,
+    authorize(authorizeUrl, decision = {}) {
+      const url = new URL(authorizeUrl);
+      if (`${url.origin}${url.pathname}` !== `${issuer}/authorize`) throw new Error(`Not this pod's /authorize: ${authorizeUrl}`);
+      const q = url.searchParams;
+      const redirectUri = q.get("redirect_uri");
+      const clientId = q.get("client_id");
+      if (!clientId || !redirectUri) throw new Error("Authorization request rejected: client_id and redirect_uri are required");
+      const answer = new URL(redirectUri);
+      const state = decision.state ?? q.get("state");
+      const finish = (fields) => {
+        for (const [k, v] of Object.entries(fields)) answer.searchParams.set(k, v);
+        if (state !== null) answer.searchParams.set("state", state);
+        const iss = decision.iss === void 0 ? issuer : decision.iss;
+        if (iss !== null) answer.searchParams.set("iss", iss);
+        return answer.href;
+      };
+      if (q.get("response_type") !== "code") return finish({ error: "unsupported_response_type" });
+      if (q.get("code_challenge_method") !== "S256" || !q.get("code_challenge")) {
+        return finish({ error: "invalid_request", error_description: "PKCE S256 is required" });
+      }
+      const resource = q.get("resource");
+      if (resource !== null && resource !== `${issuer}/api/hub` && resource !== `${issuer}/mcp`) {
+        return finish({ error: "invalid_target" });
+      }
+      const scope = (q.get("scope") ?? "").split(/\s+/).filter(Boolean);
+      if (scope.length === 0) return finish({ error: "invalid_scope" });
+      if (decision.deny) return finish({ error: "access_denied" });
+      const code = randomToken();
+      codes.set(code, { clientId, redirectUri, challenge: q.get("code_challenge"), resource, scope });
+      return finish({ code });
+    },
+    consumeRefreshToken(t) {
+      const row = refreshTokens.get(t);
+      if (row) row.used = true;
+    },
+    loseNextRefreshRace() {
+      loseNextRace = true;
+    },
+    get reuses() {
+      return reuses;
+    },
+    revokeAll() {
+      for (const row of access.values()) row.revoked = true;
+      for (const row of refreshTokens.values()) row.revoked = true;
+    },
+    liveRefreshTokens() {
+      return [...refreshTokens].filter(([, r]) => !r.used && !r.revoked).map(([t]) => t);
+    },
+    reset() {
+      requests.length = 0;
+      writes.length = 0;
+    }
+  };
+}
+
 // src/testing/index.ts
 var MOCK_POD_URL = "https://mock.synap.invalid";
 var MOCK_TOKENS = { form: "demo-form", share: "demo", site: "demo-site" };
@@ -127,7 +385,7 @@ var MAX_OFFSET = 1e4;
 var MAX_LIMIT = 100;
 var MAX_SORT_KEYS = 3;
 var PUBLISHED_AT = "publishedAt";
-function json(status, body, headers = {}) {
+function json2(status, body, headers = {}) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json", "Cache-Control": "no-cache", ...headers }
@@ -150,15 +408,15 @@ function etagMatches(header, etag) {
 function failure(token) {
   switch (token) {
     case MOCK_FAILURE_TOKENS.rateLimited:
-      return json(429, { error: "Too many requests", retryAfter: "5 minutes" });
+      return json2(429, { error: "Too many requests", retryAfter: "5 minutes" });
     case MOCK_FAILURE_TOKENS.rateLimitedRetryAfter:
-      return json(429, { error: "Too many requests" }, { "Retry-After": String(MOCK_RETRY_AFTER_SEC) });
+      return json2(429, { error: "Too many requests" }, { "Retry-After": String(MOCK_RETRY_AFTER_SEC) });
     case MOCK_FAILURE_TOKENS.doorsDisabled:
-      return json(403, DOORS_DISABLED);
+      return json2(403, DOORS_DISABLED);
     case MOCK_FAILURE_TOKENS.serverError:
-      return json(500, { error: "Internal error" });
+      return json2(500, { error: "Internal error" });
     case MOCK_FAILURE_TOKENS.unavailable:
-      return json(503, { received: false });
+      return json2(503, { received: false });
     case MOCK_FAILURE_TOKENS.unreachable:
       return "reject";
     default:
@@ -233,17 +491,17 @@ function cached(view, ifNoneMatch) {
   if (etagMatches(ifNoneMatch, etag)) {
     return new Response(null, { status: 304, headers: { ETag: etag, "Cache-Control": "no-cache" } });
   }
-  return json(200, view, { ETag: etag });
+  return json2(200, view, { ETag: etag });
 }
 function siteDoor(site, rest, params, ifNoneMatch) {
   if (rest.length === 0) return cached(manifest(site), ifNoneMatch);
   if (rest[0] !== "collections" || rest.length > 3 || !Object.hasOwn(site.collections, rest[1])) {
-    return json(404, NOT_FOUND);
+    return json2(404, NOT_FOUND);
   }
   const c = site.collections[rest[1]];
   if (rest.length === 2) {
     const q = parseQuery(params, c);
-    if (typeof q === "string") return json(400, { error: q });
+    if (typeof q === "string") return json2(400, { error: q });
     const sorted = [...c.records].sort(compareRecords(q.sort));
     const page = {
       items: sorted.slice(q.offset, q.offset + q.limit).map(summary),
@@ -255,10 +513,10 @@ function siteDoor(site, rest, params, ifNoneMatch) {
   }
   const address = rest[2];
   const byPublicId = PUBLIC_ID_RE.test(address);
-  if (!byPublicId && !(address.length <= SLUG_MAX_LENGTH && SLUG_RE.test(address))) return json(404, NOT_FOUND);
+  if (!byPublicId && !(address.length <= SLUG_MAX_LENGTH && SLUG_RE.test(address))) return json2(404, NOT_FOUND);
   const record = c.records.find((r) => byPublicId ? r.publicId === address : r.slug === address);
-  if (!record) return json(404, NOT_FOUND);
-  if (params.has("embed")) return json(400, { error: "embed is not available" });
+  if (!record) return json2(404, NOT_FOUND);
+  if (params.has("embed")) return json2(400, { error: "embed is not available" });
   return cached(record, ifNoneMatch);
 }
 function invalidKeys(form, body) {
@@ -295,12 +553,12 @@ function createMockPod(options = {}) {
       if (preflighted.length > 0) throw new TypeError(`Failed to fetch: preflight refuses ${preflighted.join(", ")}`);
     }
     const m = url.pathname.match(/^\/api\/hub\/public\/(forms|shares|sites)\/(.+)$/);
-    if (!m) return json(404, NOT_FOUND);
+    if (!m) return json2(404, NOT_FOUND);
     let segments;
     try {
       segments = m[2].split("/").map(decodeURIComponent);
     } catch {
-      return json(404, NOT_FOUND);
+      return json2(404, NOT_FOUND);
     }
     const [token, ...rest] = segments;
     const failed = failure(token);
@@ -318,15 +576,15 @@ function createMockPod(options = {}) {
       const invalid = form ? invalidKeys(form, body) : [];
       const status = invalid.length > 0 ? 422 : 202;
       submissions.push({ token, body, status });
-      return status === 422 ? json(422, { received: false, invalid }) : json(202, { received: true });
+      return status === 422 ? json2(422, { received: false, invalid }) : json2(202, { received: true });
     }
-    if (method !== "GET") return json(404, NOT_FOUND);
-    if (door === "forms" && rest.length === 0 && Object.hasOwn(forms, token)) return json(200, forms[token]);
-    if (door === "shares" && rest.length === 0 && Object.hasOwn(shares, token)) return json(200, shares[token]);
+    if (method !== "GET") return json2(404, NOT_FOUND);
+    if (door === "forms" && rest.length === 0 && Object.hasOwn(forms, token)) return json2(200, forms[token]);
+    if (door === "shares" && rest.length === 0 && Object.hasOwn(shares, token)) return json2(200, shares[token]);
     if (door === "sites" && Object.hasOwn(sites, token)) {
       return siteDoor(sites[token], rest, url.searchParams, headers["if-none-match"] ?? null);
     }
-    return json(404, NOT_FOUND);
+    return json2(404, NOT_FOUND);
   };
   return {
     podUrl: MOCK_POD_URL,
@@ -340,13 +598,17 @@ function createMockPod(options = {}) {
   };
 }
 export {
+  MOCK_AUTH_ISSUER,
   MOCK_FAILURE_TOKENS,
   MOCK_FORM,
+  MOCK_GRANT,
   MOCK_POD_URL,
   MOCK_RETRY_AFTER_SEC,
   MOCK_SHARE,
   MOCK_SITE,
   MOCK_TOKENS,
+  MOCK_USER,
+  createMockAuthServer,
   createMockPod
 };
 //# sourceMappingURL=testing.js.map