@synap-core/sdk 1.2.0 → 1.4.0

package/dist/testing.cjs

@@ -20,13 +20,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/testing/index.ts
 var testing_exports = {};
 __export(testing_exports, {
+  MOCK_APP: () => MOCK_APP,
+  MOCK_APP_AGENT_ID: () => MOCK_APP_AGENT_ID,
+  MOCK_AUTH_ISSUER: () => MOCK_AUTH_ISSUER,
+  MOCK_CLOUD_URL: () => MOCK_CLOUD_URL,
   MOCK_FAILURE_TOKENS: () => MOCK_FAILURE_TOKENS,
   MOCK_FORM: () => MOCK_FORM,
+  MOCK_GRANT: () => MOCK_GRANT,
   MOCK_POD_URL: () => MOCK_POD_URL,
   MOCK_RETRY_AFTER_SEC: () => MOCK_RETRY_AFTER_SEC,
   MOCK_SHARE: () => MOCK_SHARE,
   MOCK_SITE: () => MOCK_SITE,
   MOCK_TOKENS: () => MOCK_TOKENS,
+  MOCK_USER: () => MOCK_USER,
+  createMockAuthServer: () => createMockAuthServer,
+  createMockCloud: () => createMockCloud,
   createMockPod: () => createMockPod
 });
 module.exports = __toCommonJS(testing_exports);
@@ -126,6 +134,402 @@ var MOCK_SITE = {
   }
 };
 
+// src/connect/encoding.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function utf8(text) {
+  return encoder.encode(text);
+}
+function base64url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBytes(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function randomToken() {
+  return base64url(randomBytes(32));
+}
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", utf8(verifier));
+  return base64url(new Uint8Array(digest));
+}
+
+// src/testing/auth-server.ts
+var MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
+var MOCK_GRANT = [
+  { permission: "entity.post.read", workspaceId: "ws_mock_studio", workspaceName: "Studio" },
+  { permission: "entity.post.create", workspaceId: "ws_mock_studio", workspaceName: "Studio" }
+];
+var MOCK_USER = { id: "user_mock_ada", name: "Ada Lovelace" };
+var MOCK_APP = { id: "app_mock_studio", manageUrl: "https://pod-admin.mock-synap.test/apps/app_mock_studio" };
+var MOCK_APP_AGENT_ID = "agent_mock_app";
+function json(status, body, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+  });
+}
+function oauthError(error, description, status = 400) {
+  return json(status, { error, error_description: description });
+}
+function createMockAuthServer(options = {}) {
+  const issuer = options.issuer ?? MOCK_AUTH_ISSUER;
+  const now = options.now ?? Date.now;
+  const refresh = options.refresh ?? true;
+  const accessTtl = options.accessTtlSec ?? 3600;
+  const refreshIdle = options.refreshIdleSec ?? 30 * 24 * 3600;
+  const grant = options.grant ?? MOCK_GRANT;
+  const user = options.user ?? MOCK_USER;
+  const codes = /* @__PURE__ */ new Map();
+  const access = /* @__PURE__ */ new Map();
+  const refreshTokens = /* @__PURE__ */ new Map();
+  const requests = [];
+  const writes = [];
+  const proposals = [];
+  const entities = [...options.entities ?? []];
+  const graceMs = (options.refreshGraceSec ?? 30) * 1e3;
+  const app = options.app === void 0 ? MOCK_APP : options.app;
+  let proposalSeq = 0;
+  let graceAnswers = 0;
+  const metadata = () => {
+    const base = {
+      issuer,
+      authorization_endpoint: `${issuer}/authorize`,
+      token_endpoint: `${issuer}/token`,
+      registration_endpoint: `${issuer}/register`,
+      revocation_endpoint: `${issuer}/revoke`,
+      revocation_endpoint_auth_methods_supported: ["none"],
+      response_types_supported: ["code"],
+      grant_types_supported: refresh ? ["authorization_code", "refresh_token"] : ["authorization_code"],
+      code_challenge_methods_supported: ["S256"],
+      token_endpoint_auth_methods_supported: ["none"],
+      authorization_response_iss_parameter_supported: true,
+      client_id_metadata_document_supported: true
+    };
+    for (const [k, v] of Object.entries(options.metadata ?? {})) {
+      if (v === void 0) delete base[k];
+      else base[k] = v;
+    }
+    return base;
+  };
+  let loseNextRace = false;
+  let reuses = 0;
+  const revokeFamily = (family) => {
+    for (const r of refreshTokens.values()) if (r.family === family) r.revoked = true;
+    for (const a of access.values()) if (a.family === family) a.revoked = true;
+  };
+  const tokenBody = (scope, clientId, family, pair) => {
+    const accessToken = pair?.accessToken ?? `synap_hub_mock_${randomToken()}`;
+    if (!pair) access.set(accessToken, { expiresAt: now() + accessTtl * 1e3, revoked: false, family: refresh ? family : null, scope });
+    const row = access.get(accessToken);
+    const body = {
+      access_token: accessToken,
+      token_type: "Bearer",
+      // As the pod: what the key has left, never an assumed hour.
+      expires_in: Math.max(0, Math.floor((row.expiresAt - now()) / 1e3)),
+      scope: scope.join(" "),
+      synap_grant: grant.filter((g) => scope.includes(g.permission)),
+      synap_user: user,
+      ...app ? { synap_app: app } : {}
+    };
+    if (pair) {
+      body.refresh_token = pair.refreshToken;
+      if (options.advertiseRefreshExpiry) body.refresh_token_expires_in = Math.floor((refreshTokens.get(pair.refreshToken).idleUntil - now()) / 1e3);
+    } else if (refresh) {
+      const refreshToken = randomToken();
+      refreshTokens.set(refreshToken, { clientId, family, idleUntil: now() + refreshIdle * 1e3, used: false, revoked: false, scope });
+      body.refresh_token = refreshToken;
+      if (options.advertiseRefreshExpiry) body.refresh_token_expires_in = refreshIdle;
+    }
+    return body;
+  };
+  async function token(form) {
+    if (form.grant_type === "authorization_code") {
+      const row = form.code ? codes.get(form.code) : void 0;
+      if (form.code) codes.delete(form.code);
+      if (!row) return oauthError("invalid_grant", "Invalid, expired, or already-redeemed authorization code");
+      if (row.clientId !== form.client_id) return oauthError("invalid_grant", "client_id does not match the code");
+      if (row.redirectUri !== form.redirect_uri) return oauthError("invalid_grant", "redirect_uri mismatch");
+      if (!form.code_verifier || await pkceChallenge(form.code_verifier) !== row.challenge) {
+        return oauthError("invalid_grant", "PKCE verification failed");
+      }
+      if (form.resource !== void 0 && row.resource && form.resource !== row.resource) {
+        return oauthError("invalid_target", "resource does not match the authorization request");
+      }
+      for (const r of refreshTokens.values()) if (r.clientId === row.clientId) revokeFamily(r.family);
+      return json(200, tokenBody(row.scope, row.clientId, randomToken()));
+    }
+    if (form.grant_type === "refresh_token") {
+      if (!refresh) return oauthError("unsupported_grant_type", 'Only grant_type "authorization_code" is supported');
+      if (!form.refresh_token || !form.client_id) return oauthError("invalid_request", "refresh_token and client_id are required");
+      const row = refreshTokens.get(form.refresh_token);
+      if (!row || row.clientId !== form.client_id || row.revoked) {
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.used) {
+        const successor = row.successor ? refreshTokens.get(row.successor) : void 0;
+        const key = row.pairAccess ? access.get(row.pairAccess) : void 0;
+        const inGrace = graceMs > 0 && row.usedAt !== void 0 && now() - row.usedAt < graceMs;
+        if (inGrace && successor && !successor.used && !successor.revoked && key && !key.revoked && key.expiresAt > now()) {
+          graceAnswers++;
+          return json(200, tokenBody(row.scope, row.clientId, row.family, { accessToken: row.pairAccess, refreshToken: row.successor }));
+        }
+        reuses++;
+        revokeFamily(row.family);
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      if (row.idleUntil <= now()) return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      if (loseNextRace) {
+        loseNextRace = false;
+        return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+      }
+      row.used = true;
+      row.usedAt = now();
+      for (const a of access.values()) if (a.family === row.family) a.revoked = true;
+      const body = tokenBody(row.scope, row.clientId, row.family);
+      row.successor = body.refresh_token;
+      row.pairAccess = body.access_token;
+      return json(200, body);
+    }
+    return oauthError("unsupported_grant_type", "Unsupported grant_type");
+  }
+  function hub(method, path, query, headers, body) {
+    const failure2 = options.failures?.[path];
+    if (failure2 === "unreachable") return "reject";
+    const bearer = /^Bearer (.+)$/.exec(headers.authorization ?? "")?.[1];
+    const row = bearer ? access.get(bearer) : void 0;
+    if (!row || row.revoked || row.expiresAt <= now()) return json(401, { error: "Unauthorized" });
+    switch (failure2) {
+      case "rate_limited":
+        return json(429, { error: "Too many requests" }, { "Retry-After": "30" });
+      case "forbidden":
+        return json(403, { error: "Forbidden" });
+      case "door_unsupported":
+        return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+      case "server":
+        return json(500, { error: "Internal error" });
+      case "unavailable":
+        return json(503, { error: "Unavailable" });
+    }
+    if (path.startsWith("/knowledge/") || path === "/entities/retrieve" || path === "/memory/search") {
+      return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+    }
+    if (method === "GET" && path === "/users/me") return json(200, user);
+    if (method === "GET" && path === "/entities") {
+      const ws = query.get("workspaceId");
+      const kind = query.get("profileSlug");
+      const offset = Number(query.get("offset") ?? 0) || 0;
+      const limit = Number(query.get("limit") ?? 50) || 50;
+      const rows = entities.filter((e) => (!ws || e.workspaceId === ws) && (!kind || e.profileSlug === kind));
+      return json(200, rows.slice(offset, offset + limit));
+    }
+    if (method === "GET" && path === "/proposals") {
+      const readable = new Set(grant.filter((g) => g.permission === "proposal.read" && row.scope.includes(g.permission)).map((g) => g.workspaceId));
+      const status = query.get("status") ?? "pending";
+      const ws = query.get("workspaceId");
+      const limit = Math.min(Math.max(Number(query.get("limit") ?? 50) || 50, 1), 200);
+      const offset = Number(query.get("offset") ?? 0) || 0;
+      const rows = proposals.filter((p) => p.workspaceId !== null && readable.has(p.workspaceId)).filter((p) => (status === "all" || p.status === status) && (!ws || p.workspaceId === ws)).reverse();
+      const page = rows.slice(offset, offset + limit);
+      return json(200, { proposals: page, limit, offset, total: rows.length, hasMore: offset + page.length < rows.length });
+    }
+    if (method !== "GET") {
+      writes.push({ method, path, body });
+      const fields = body && typeof body === "object" ? body : {};
+      const workspaceId = typeof fields.workspaceId === "string" ? fields.workspaceId : null;
+      if ((options.writeMode ?? "proposed") === "proposed") {
+        const proposalId = `prop_mock_${++proposalSeq}`;
+        proposals.push({
+          id: proposalId,
+          proposalType: method === "POST" ? "create" : method === "DELETE" ? "delete" : "update",
+          targetType: path.split("/")[1]?.replace(/s$/, "") ?? "entity",
+          targetId: null,
+          status: "pending",
+          workspaceId,
+          createdAt: new Date(now()).toISOString(),
+          correlationId: null,
+          sessionId: null,
+          agentUserId: MOCK_APP_AGENT_ID,
+          ...typeof fields.title === "string" ? { summary: `Create "${fields.title}"` } : {}
+        });
+        return json(200, {
+          status: "proposed",
+          message: "Sent for review",
+          proposalId,
+          reviewUrl: `${issuer}/open/${proposalId}`
+        });
+      }
+      const id = `ent_mock_${writes.length}`;
+      if (method === "POST" && path === "/entities") entities.push({ id, ...fields });
+      return json(200, { status: "created", id });
+    }
+    return json(404, { error: "Not found" });
+  }
+  const mockFetch = async (input, init) => {
+    const request = typeof input === "object" && "method" in input ? input : null;
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+    const headers = {};
+    new Headers(init?.headers ?? request?.headers).forEach((value, name) => {
+      headers[name.toLowerCase()] = value;
+    });
+    const rawBody = typeof init?.body === "string" ? init.body : request ? await request.clone().text() : "";
+    const isForm = (headers["content-type"] ?? "").includes("application/x-www-form-urlencoded");
+    const form = isForm ? Object.fromEntries(new URLSearchParams(rawBody)) : null;
+    requests.push({ method, url: url.href, headers, form });
+    if (url.origin !== new URL(issuer).origin) throw new TypeError(`Failed to fetch: ${url.origin} is not the mock pod`);
+    const path = url.pathname;
+    if (method === "GET" && path === "/.well-known/oauth-authorization-server") return json(200, metadata());
+    if (method === "POST" && path === "/token") return token(form ?? {});
+    if (method === "POST" && path === "/revoke") {
+      const t = form?.token ?? "";
+      const r = refreshTokens.get(t);
+      if (r && form?.client_id && form.client_id !== r.clientId) {
+        return oauthError("unauthorized_client", "The token was not issued to this client");
+      }
+      if (r) revokeFamily(r.family);
+      const a = access.get(t);
+      if (a) a.revoked = true;
+      return new Response(null, { status: 200 });
+    }
+    const hubPath = /^\/api\/hub(\/.*)$/.exec(path)?.[1];
+    if (hubPath) {
+      let body = void 0;
+      try {
+        body = rawBody ? JSON.parse(rawBody) : void 0;
+      } catch {
+        body = rawBody;
+      }
+      const res = hub(method, hubPath, url.searchParams, headers, body);
+      if (res === "reject") throw new TypeError("Failed to fetch: mock pod unreachable");
+      return res;
+    }
+    return json(404, { error: "Not found" });
+  };
+  return {
+    issuer,
+    fetch: mockFetch,
+    requests,
+    writes,
+    proposals,
+    settleProposal(id, status) {
+      const p = proposals.find((x) => x.id === id);
+      if (p) p.status = status;
+    },
+    async redeemElsewhere(t) {
+      const row = refreshTokens.get(t);
+      const res = await token({ grant_type: "refresh_token", refresh_token: t, client_id: row?.clientId ?? "" });
+      if (res.status !== 200) throw new Error(`redeemElsewhere: the pod answered ${res.status}`);
+      return await res.json();
+    },
+    get graceAnswers() {
+      return graceAnswers;
+    },
+    authorize(authorizeUrl, decision = {}) {
+      const url = new URL(authorizeUrl);
+      if (`${url.origin}${url.pathname}` !== `${issuer}/authorize`) throw new Error(`Not this pod's /authorize: ${authorizeUrl}`);
+      const q = url.searchParams;
+      const redirectUri = q.get("redirect_uri");
+      const clientId = q.get("client_id");
+      if (!clientId || !redirectUri) throw new Error("Authorization request rejected: client_id and redirect_uri are required");
+      const answer = new URL(redirectUri);
+      const state = decision.state ?? q.get("state");
+      const finish = (fields) => {
+        for (const [k, v] of Object.entries(fields)) answer.searchParams.set(k, v);
+        if (state !== null) answer.searchParams.set("state", state);
+        const iss = decision.iss === void 0 ? issuer : decision.iss;
+        if (iss !== null) answer.searchParams.set("iss", iss);
+        return answer.href;
+      };
+      if (q.get("response_type") !== "code") return finish({ error: "unsupported_response_type" });
+      if (q.get("code_challenge_method") !== "S256" || !q.get("code_challenge")) {
+        return finish({ error: "invalid_request", error_description: "PKCE S256 is required" });
+      }
+      const resource = q.get("resource");
+      if (resource !== null && resource !== `${issuer}/api/hub` && resource !== `${issuer}/mcp`) {
+        return finish({ error: "invalid_target" });
+      }
+      const scope = (q.get("scope") ?? "").split(/\s+/).filter(Boolean);
+      if (scope.length === 0) return finish({ error: "invalid_scope" });
+      if (decision.deny) return finish({ error: "access_denied" });
+      const code = randomToken();
+      codes.set(code, { clientId, redirectUri, challenge: q.get("code_challenge"), resource, scope });
+      return finish({ code });
+    },
+    consumeRefreshToken(t) {
+      const row = refreshTokens.get(t);
+      if (row) row.used = true;
+    },
+    loseNextRefreshRace() {
+      loseNextRace = true;
+    },
+    get reuses() {
+      return reuses;
+    },
+    revokeAll() {
+      for (const row of access.values()) row.revoked = true;
+      for (const row of refreshTokens.values()) row.revoked = true;
+    },
+    liveRefreshTokens() {
+      return [...refreshTokens].filter(([, r]) => !r.used && !r.revoked).map(([t]) => t);
+    },
+    reset() {
+      requests.length = 0;
+      writes.length = 0;
+    }
+  };
+}
+
+// src/testing/cloud.ts
+var MOCK_CLOUD_URL = "https://cp.mock-synap.test";
+var STATE_RE = /^[A-Za-z0-9._~-]{16,256}$/;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function createMockCloud(options = {}) {
+  const base = (options.url ?? MOCK_CLOUD_URL).replace(/\/+$/, "");
+  const requests = [];
+  return {
+    url: base,
+    requests,
+    choose(location, { pod, metadata }) {
+      const back = check(location, metadata);
+      back.searchParams.set("iss", pod);
+      back.searchParams.set("state", new URL(location).searchParams.get("state"));
+      return back.href;
+    },
+    cancel(location, { metadata }) {
+      const back = check(location, metadata);
+      back.searchParams.set("state", new URL(location).searchParams.get("state"));
+      back.searchParams.set("error", "access_denied");
+      return back.href;
+    }
+  };
+  function check(location, metadata) {
+    requests.push(location);
+    const url = new URL(location);
+    if (`${url.origin}${url.pathname}` !== `${base}/connect/pod`) throw new Error(`Not this CP's /connect/pod: ${location}`);
+    const clientId = url.searchParams.get("client_id");
+    const state = url.searchParams.get("state");
+    if (!clientId || !cimdUrlAccepted(clientId)) throw new Error("Chooser refused: client_id must be an https CIMD URL");
+    if (!state || !STATE_RE.test(state)) throw new Error("Chooser refused: state is missing or malformed");
+    if (clientId !== metadata.client_id) throw new Error("Chooser refused: the client metadata is not this client_id's");
+    return new URL(metadata.initiate_login_uri);
+  }
+  function cimdUrlAccepted(clientId) {
+    let url;
+    try {
+      url = new URL(clientId);
+    } catch {
+      return false;
+    }
+    if (url.protocol === "https:") return true;
+    return url.protocol === "http:" && options.allowInsecureLoopback === true && LOOPBACK_HOSTS.has(url.hostname);
+  }
+}
+
 // src/testing/index.ts
 var MOCK_POD_URL = "https://mock.synap.invalid";
 var MOCK_TOKENS = { form: "demo-form", share: "demo", site: "demo-site" };
@@ -160,7 +564,7 @@ var MAX_OFFSET = 1e4;
 var MAX_LIMIT = 100;
 var MAX_SORT_KEYS = 3;
 var PUBLISHED_AT = "publishedAt";
-function json(status, body, headers = {}) {
+function json2(status, body, headers = {}) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json", "Cache-Control": "no-cache", ...headers }
@@ -183,15 +587,15 @@ function etagMatches(header, etag) {
 function failure(token) {
   switch (token) {
     case MOCK_FAILURE_TOKENS.rateLimited:
-      return json(429, { error: "Too many requests", retryAfter: "5 minutes" });
+      return json2(429, { error: "Too many requests", retryAfter: "5 minutes" });
     case MOCK_FAILURE_TOKENS.rateLimitedRetryAfter:
-      return json(429, { error: "Too many requests" }, { "Retry-After": String(MOCK_RETRY_AFTER_SEC) });
+      return json2(429, { error: "Too many requests" }, { "Retry-After": String(MOCK_RETRY_AFTER_SEC) });
     case MOCK_FAILURE_TOKENS.doorsDisabled:
-      return json(403, DOORS_DISABLED);
+      return json2(403, DOORS_DISABLED);
     case MOCK_FAILURE_TOKENS.serverError:
-      return json(500, { error: "Internal error" });
+      return json2(500, { error: "Internal error" });
     case MOCK_FAILURE_TOKENS.unavailable:
-      return json(503, { received: false });
+      return json2(503, { received: false });
     case MOCK_FAILURE_TOKENS.unreachable:
       return "reject";
     default:
@@ -266,17 +670,17 @@ function cached(view, ifNoneMatch) {
   if (etagMatches(ifNoneMatch, etag)) {
     return new Response(null, { status: 304, headers: { ETag: etag, "Cache-Control": "no-cache" } });
   }
-  return json(200, view, { ETag: etag });
+  return json2(200, view, { ETag: etag });
 }
 function siteDoor(site, rest, params, ifNoneMatch) {
   if (rest.length === 0) return cached(manifest(site), ifNoneMatch);
   if (rest[0] !== "collections" || rest.length > 3 || !Object.hasOwn(site.collections, rest[1])) {
-    return json(404, NOT_FOUND);
+    return json2(404, NOT_FOUND);
   }
   const c = site.collections[rest[1]];
   if (rest.length === 2) {
     const q = parseQuery(params, c);
-    if (typeof q === "string") return json(400, { error: q });
+    if (typeof q === "string") return json2(400, { error: q });
     const sorted = [...c.records].sort(compareRecords(q.sort));
     const page = {
       items: sorted.slice(q.offset, q.offset + q.limit).map(summary),
@@ -288,10 +692,10 @@ function siteDoor(site, rest, params, ifNoneMatch) {
   }
   const address = rest[2];
   const byPublicId = PUBLIC_ID_RE.test(address);
-  if (!byPublicId && !(address.length <= SLUG_MAX_LENGTH && SLUG_RE.test(address))) return json(404, NOT_FOUND);
+  if (!byPublicId && !(address.length <= SLUG_MAX_LENGTH && SLUG_RE.test(address))) return json2(404, NOT_FOUND);
   const record = c.records.find((r) => byPublicId ? r.publicId === address : r.slug === address);
-  if (!record) return json(404, NOT_FOUND);
-  if (params.has("embed")) return json(400, { error: "embed is not available" });
+  if (!record) return json2(404, NOT_FOUND);
+  if (params.has("embed")) return json2(400, { error: "embed is not available" });
   return cached(record, ifNoneMatch);
 }
 function invalidKeys(form, body) {
@@ -328,12 +732,12 @@ function createMockPod(options = {}) {
       if (preflighted.length > 0) throw new TypeError(`Failed to fetch: preflight refuses ${preflighted.join(", ")}`);
     }
     const m = url.pathname.match(/^\/api\/hub\/public\/(forms|shares|sites)\/(.+)$/);
-    if (!m) return json(404, NOT_FOUND);
+    if (!m) return json2(404, NOT_FOUND);
     let segments;
     try {
       segments = m[2].split("/").map(decodeURIComponent);
     } catch {
-      return json(404, NOT_FOUND);
+      return json2(404, NOT_FOUND);
     }
     const [token, ...rest] = segments;
     const failed = failure(token);
@@ -351,15 +755,15 @@ function createMockPod(options = {}) {
       const invalid = form ? invalidKeys(form, body) : [];
       const status = invalid.length > 0 ? 422 : 202;
       submissions.push({ token, body, status });
-      return status === 422 ? json(422, { received: false, invalid }) : json(202, { received: true });
+      return status === 422 ? json2(422, { received: false, invalid }) : json2(202, { received: true });
     }
-    if (method !== "GET") return json(404, NOT_FOUND);
-    if (door === "forms" && rest.length === 0 && Object.hasOwn(forms, token)) return json(200, forms[token]);
-    if (door === "shares" && rest.length === 0 && Object.hasOwn(shares, token)) return json(200, shares[token]);
+    if (method !== "GET") return json2(404, NOT_FOUND);
+    if (door === "forms" && rest.length === 0 && Object.hasOwn(forms, token)) return json2(200, forms[token]);
+    if (door === "shares" && rest.length === 0 && Object.hasOwn(shares, token)) return json2(200, shares[token]);
     if (door === "sites" && Object.hasOwn(sites, token)) {
       return siteDoor(sites[token], rest, url.searchParams, headers["if-none-match"] ?? null);
     }
-    return json(404, NOT_FOUND);
+    return json2(404, NOT_FOUND);
   };
   return {
     podUrl: MOCK_POD_URL,
@@ -374,13 +778,21 @@ function createMockPod(options = {}) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  MOCK_APP,
+  MOCK_APP_AGENT_ID,
+  MOCK_AUTH_ISSUER,
+  MOCK_CLOUD_URL,
   MOCK_FAILURE_TOKENS,
   MOCK_FORM,
+  MOCK_GRANT,
   MOCK_POD_URL,
   MOCK_RETRY_AFTER_SEC,
   MOCK_SHARE,
   MOCK_SITE,
   MOCK_TOKENS,
+  MOCK_USER,
+  createMockAuthServer,
+  createMockCloud,
   createMockPod
 });
 //# sourceMappingURL=testing.cjs.map