@tinytars/frame 0.1.25 → 0.1.27

package/account-methods.svelte.ts

@@ -21,6 +21,20 @@ export interface AccountInfo {
   emailConfirmed: boolean;
 }
 
+const defaultApi = {
+  getMyAccount,
+  listMethods,
+  updateProfile,
+  addPasswordMethod,
+  addPasskeyMethod,
+  addGoogleMethod,
+  removeMethod,
+  // Wrapped, because a bare `fetch` invoked as `api.fetch` throws "Illegal invocation" in browsers.
+  fetch: (input: RequestInfo | URL, init?: RequestInit) => fetch(input, init),
+};
+
+export type AccountMethodsApi = typeof defaultApi;
+
 export interface AccountMethodsDeps {
   /**
    * The in-memory account private key — `session.ownerKey ?? session.providerKey`, read fresh because
@@ -33,6 +47,8 @@ export interface AccountMethodsDeps {
   applyUnitSystem: (u: "metric" | "imperial") => void;
   /** Vault principals + access events. App's, because App owns the recovery controller they feed. */
   loadOwnerBlocks: () => Promise<void>;
+  /** The server calls, overridable so a test can pass fakes. Defaults to `@tinytars/vault`. */
+  api?: Partial<AccountMethodsApi>;
 }
 
 export interface AccountMethods {
@@ -86,6 +102,7 @@ export interface AccountMethods {
 }
 
 export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
+  const api = { ...defaultApi, ...deps.api };
   let open = $state(false);
   let busy = $state(false);
   let error = $state<string | null>(null);
@@ -113,7 +130,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
   }
 
   async function refresh(): Promise<void> {
-    const [account, list] = await Promise.all([getMyAccount(), listMethods()]);
+    const [account, list] = await Promise.all([api.getMyAccount(), api.listMethods()]);
     info = { email: account.email, displayName: account.displayName, emailConfirmed: account.emailConfirmed };
     methods = list;
     deps.applyUnitSystem(account.unitSystem ?? "imperial");
@@ -202,7 +219,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
       open = true;
       error = null;
       try {
-        const [account, list] = await Promise.all([getMyAccount(), listMethods()]);
+        const [account, list] = await Promise.all([api.getMyAccount(), api.listMethods()]);
         info = { email: account.email, displayName: account.displayName, emailConfirmed: account.emailConfirmed };
         methods = list;
         editEmail = account.email ?? "";
@@ -225,7 +242,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
     // worth a red line across a panel the person opened to do something else.
     async resendVerification() {
       try {
-        await fetch("/api/account/email/send-verification", { method: "POST" });
+        await api.fetch("/api/account/email/send-verification", { method: "POST" });
         emailVerifyNote = "sent";
       } catch {
         /* best-effort */
@@ -234,7 +251,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
 
     async saveProfile() {
       error = null;
-      await mutate(() => updateProfile({ email: editEmail.trim() || undefined, displayName: editDisplayName.trim() || undefined }));
+      await mutate(() => api.updateProfile({ email: editEmail.trim() || undefined, displayName: editDisplayName.trim() || undefined }));
     },
 
     async addPassword() {
@@ -244,7 +261,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
       if (!pk) return;
       const password = newPassword;
       await mutate(async () => {
-        await addPasswordMethod(pk, password);
+        await api.addPasswordMethod(pk, password);
         // Cleared inside the try: a rejected password (too short, step-up refused) must stay in the
         // field, or the retry is a re-entry of something the person already typed once.
         newPassword = "";
@@ -255,7 +272,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
       error = null;
       const pk = ensureExtractableKey();
       if (!pk) return;
-      await mutate(() => addPasskeyMethod(pk));
+      await mutate(() => api.addPasskeyMethod(pk));
     },
 
     async remove(method: RemovableMethod) {
@@ -265,7 +282,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
         error = blocked;
         return;
       }
-      await mutate(() => removeMethod(method));
+      await mutate(() => api.removeMethod(method));
     },
 
     // OAuth runs in a POPUP so this SPA (and the in-memory key the server needs to wrap)
@@ -294,7 +311,7 @@ export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
                 : "Google sign-in failed.";
           return;
         }
-        await mutate(() => addGoogleMethod(pk));
+        await mutate(() => api.addGoogleMethod(pk));
       };
       window.addEventListener("message", onMessage);
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinytars/frame",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Domain-neutral Svelte app-shell: session/auth controllers, account chrome, and menu/card/modal primitives built on @tinytars/vault.",
   "license": "MIT",
   "type": "module",
@@ -23,6 +23,7 @@
   },
   "files": [
     "*.ts",
+    "!*.test.ts",
     "*.svelte",
     "*.css"
   ],
@@ -74,7 +75,8 @@
     "./VisibilitySettings.svelte": "./VisibilitySettings.svelte"
   },
   "scripts": {
-    "typecheck": "svelte-check --tsconfig ./tsconfig.json --threshold error"
+    "typecheck": "svelte-check --tsconfig ./tsconfig.json --threshold error",
+    "test": "vitest run"
   },
   "dependencies": {
     "@tinytars/vault": "^0.1.18",

package/roster-session.svelte.ts

@@ -36,6 +36,20 @@ export interface EnteredAccount {
   rotationPending?: boolean;
 }
 
+const defaultApi = {
+  getAccountKey,
+  putAccountKey,
+  clearAccountKey,
+  resumeSession,
+  bootstrapGoogleSession,
+  getMyAccount,
+  revokeProvider,
+  // Wrapped, because a bare `fetch` invoked as `api.fetch` throws "Illegal invocation" in browsers.
+  fetch: (input: RequestInfo | URL, init?: RequestInit) => fetch(input, init),
+};
+
+export type RosterSessionApi = typeof defaultApi;
+
 export interface RosterSessionDeps {
   session: VaultSession;
   reportError: (message: string | null) => void;
@@ -54,6 +68,8 @@ export interface RosterSessionDeps {
   closeVault: () => void;
   /** The roster-removal confirmation. Injected so the dialog stays the host's. */
   confirmRemoval: (label: string) => boolean;
+  /** The server and key-store calls, overridable so a test can pass fakes. Defaults to `@tinytars/vault`. */
+  api?: Partial<RosterSessionApi>;
 }
 
 export interface RosterSession {
@@ -90,13 +106,14 @@ export interface RosterSession {
 }
 
 export function createRosterSession(deps: RosterSessionDeps): RosterSession {
+  const api = { ...defaultApi, ...deps.api };
   let isProvider = $state(false);
   let patients = $state<RosterPatient[]>([]);
   let enteredPatient = $state<{ email: string | null; displayName: string } | null>(null);
   let resuming = $state(false);
 
   async function loadPatients(): Promise<void> {
-    const res = await fetch("/api/providers/patients", { cache: "no-store" });
+    const res = await api.fetch("/api/providers/patients", { cache: "no-store" });
     // A failed fetch leaves the previous roster standing rather than blanking it. A provider whose
     // network blipped keeps the list they were working from; an empty roster would read as "you have
     // no patients", which is a different and wrong statement.
@@ -114,7 +131,7 @@ export function createRosterSession(deps: RosterSessionDeps): RosterSession {
     }
     deps.session.setProviderKey(r.privateKey);
     isProvider = true;
-    const acct = await getMyAccount();
+    const acct = await api.getMyAccount();
     if (acct.providerKind === "support") await deps.beginSupportSession();
     else {
       await loadPatients();
@@ -131,15 +148,15 @@ export function createRosterSession(deps: RosterSessionDeps): RosterSession {
   async function resumeFromStoredKey(): Promise<boolean> {
     let storedKey: CryptoKey | null = null;
     try {
-      storedKey = await getAccountKey();
+      storedKey = await api.getAccountKey();
     } catch {
       return false;
     }
     if (!storedKey) return false;
-    const r = await resumeSession();
+    const r = await api.resumeSession();
     if (!r) {
       try {
-        await clearAccountKey();
+        await api.clearAccountKey();
       } catch {
         /* best-effort */
       }
@@ -155,7 +172,7 @@ export function createRosterSession(deps: RosterSessionDeps): RosterSession {
   /** Google: no client-held key (server custody). A non-Google session 401s and stays locked. */
   async function resumeGoogle(): Promise<boolean> {
     try {
-      await enterAccount(await bootstrapGoogleSession());
+      await enterAccount(await api.bootstrapGoogleSession());
       return true;
     } catch {
       return false;
@@ -197,7 +214,7 @@ export function createRosterSession(deps: RosterSessionDeps): RosterSession {
 
     async persistSessionKey(privateKey: CryptoKey) {
       try {
-        await putAccountKey(privateKey);
+        await api.putAccountKey(privateKey);
         // Only once the key is genuinely stored. Setting the marker first would promise a resume that
         // private browsing cannot deliver, and the next load would probe, fail, and clear it anyway.
         localStorage.setItem(RESUME_MARKER, "key");
@@ -212,7 +229,7 @@ export function createRosterSession(deps: RosterSessionDeps): RosterSession {
       if (!deps.confirmRemoval(p.displayName)) return;
       deps.reportError(null);
       try {
-        await revokeProvider(p.linkId);
+        await api.revokeProvider(p.linkId);
         await loadPatients();
       } catch (e) {
         deps.reportError((e as Error).message);

package/vault-principals.svelte.ts

@@ -16,6 +16,20 @@ import { listMyProviders, lookupProvider, grantProvider, revokeProvider, type Pr
 import { approveSupport, approveSupportAsProvider } from "@tinytars/vault/auth-support";
 import { getVaultPrincipals, stageVaultRotation, rotateVault } from "@tinytars/vault/auth-recovery";
 
+const defaultApi = {
+  listMyProviders,
+  lookupProvider,
+  grantProvider,
+  revokeProvider,
+  approveSupport,
+  approveSupportAsProvider,
+  getVaultPrincipals,
+  stageVaultRotation,
+  rotateVault,
+};
+
+export type VaultPrincipalsApi = typeof defaultApi;
+
 export interface VaultPrincipalsDeps<V> {
   /** The decrypted record, read fresh — never captured. Still App's, along with the sink below. */
   getVault: () => V | null;
@@ -29,6 +43,8 @@ export interface VaultPrincipalsDeps<V> {
    * the Access modal is not mounted. Behaviour preserved from the extraction, not a new idea.
    */
   reportError: (message: string | null) => void;
+  /** The server calls, overridable so a test can pass fakes. Defaults to `@tinytars/vault`. */
+  api?: Partial<VaultPrincipalsApi>;
 }
 
 export interface VaultPrincipals {
@@ -67,6 +83,7 @@ export interface VaultPrincipals {
 }
 
 export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPrincipals {
+  const api = { ...defaultApi, ...deps.api };
   let open = $state(false);
   let providers = $state<ProviderLinkView[]>([]);
   let newProviderEmail = $state("");
@@ -84,7 +101,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
     report(null);
     try {
       await body();
-      providers = await listMyProviders();
+      providers = await api.listMyProviders();
     } catch (e) {
       report((e as Error).message);
     } finally {
@@ -98,7 +115,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
     const vault = deps.getVault();
     const { session } = deps;
     if (!vault || !session.dek || !session.r2Id) return;
-    const principals = await getVaultPrincipals();
+    const principals = await api.getVaultPrincipals();
     const newDek = await generateDEK();
     // The blob goes to a NEW object, reserved here, and the envelope commit below doubles as the
     // pointer swap. This used to re-encrypt in place and commit the matching envelopes four round
@@ -106,7 +123,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
     // mid-revoke — left every principal holding an envelope for a key the ciphertext no longer used.
     // An interruption before the commit now leaves the old blob and the old envelopes still agreeing,
     // and the abandoned object is ciphertext under a key nobody kept.
-    const newVaultId = await stageVaultRotation(principals.vaultId);
+    const newVaultId = await api.stageVaultRotation(principals.vaultId);
     await deps.saveVault(vault, newVaultId, newDek);
     const targets = [
       { accountId: principals.selfAccountId, publicKeyJwk: principals.selfPublicKeyJwk },
@@ -120,7 +137,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
         return { principalAccountId: t.accountId, wrappedDEK: bytesToB64(e.wrappedDEK), ephemeralPublicKeyJwk: e.ephemeralPublicKeyJwk };
       }),
     );
-    await rotateVault({ vaultId: principals.vaultId, newVaultId, envelopes });
+    await api.rotateVault({ vaultId: principals.vaultId, newVaultId, envelopes });
     session.open(newVaultId, newDek);
   }
 
@@ -163,7 +180,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
       open = true;
       error = null;
       try {
-        providers = await listMyProviders();
+        providers = await api.listMyProviders();
       } catch (e) {
         error = (e as Error).message;
       }
@@ -175,7 +192,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
 
     async refreshQuietly() {
       try {
-        providers = await listMyProviders();
+        providers = await api.listMyProviders();
       } catch {
         /* non-fatal; the section just stays empty */
       }
@@ -188,16 +205,16 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
       busy = true;
       error = null;
       try {
-        const provider = await lookupProvider(emailInput);
+        const provider = await api.lookupProvider(emailInput);
         // Not an exception, and deliberately not a reload either: a typo is an ordinary outcome, and
         // re-listing for it would be a round trip that changes nothing.
         if (!provider) {
           error = "No provider found with that email.";
           return;
         }
-        await grantProvider(dek, provider);
+        await api.grantProvider(dek, provider);
         newProviderEmail = "";
-        providers = await listMyProviders();
+        providers = await api.listMyProviders();
       } catch (e) {
         error = (e as Error).message;
       } finally {
@@ -207,7 +224,7 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
 
     async revoke(p: ProviderLinkView) {
       await run(async () => {
-        await revokeProvider(p.linkId);
+        await api.revokeProvider(p.linkId);
         // True forward-secret revocation for SUPPORT: re-key the vault so a support agent
         // who cached the DEK can no longer decrypt it. Clinician revoke stays delete-only. Denying a
         // pending (never-active) support request needs no rotation — support never held the DEK.
@@ -219,18 +236,18 @@ export function createVaultPrincipals<V>(deps: VaultPrincipalsDeps<V>): VaultPri
       if (!deps.session.dek || !p.publicKeyJwk) return;
       const dek = deps.session.dek;
       const jwk = p.publicKeyJwk;
-      await run(() => approveSupport(p.linkId, dek, jwk, ttlHours).then(() => undefined), toPanel);
+      await run(() => api.approveSupport(p.linkId, dek, jwk, ttlHours).then(() => undefined), toPanel);
     },
 
     async approveAsProvider(p: ProviderLinkView) {
-      await run(() => approveSupportAsProvider(p.linkId, ttlHours).then(() => undefined), deps.reportError);
+      await run(() => api.approveSupportAsProvider(p.linkId, ttlHours).then(() => undefined), deps.reportError);
     },
 
     async revokeAsProvider(p: ProviderLinkView) {
       // No vault rotation, unlike the patient-side revoke: a provider owns nothing encrypted, and
       // support only ever held per-patient DEKs via separate patient grants, which are the patients'
       // to rotate.
-      await run(() => revokeProvider(p.linkId).then(() => undefined), deps.reportError);
+      await run(() => api.revokeProvider(p.linkId).then(() => undefined), deps.reportError);
     },
 
     rotateVaultKey,

package/filter.test.ts

@@ -1,42 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { filterTokens, matchesTokens, onlyIndexed } from "./filter";
-
-describe("filterTokens", () => {
-  it("lowercases, splits on whitespace, drops empties", () => {
-    expect(filterTokens("Rosuvastatin 10mg")).toEqual(["rosuvastatin", "10mg"]);
-    expect(filterTokens("  Vitamin   D  ")).toEqual(["vitamin", "d"]);
-    expect(filterTokens("")).toEqual([]);
-    expect(filterTokens("   ")).toEqual([]);
-  });
-});
-
-describe("matchesTokens", () => {
-  it("empty query matches everything", () => {
-    expect(matchesTokens("anything", [])).toBe(true);
-    expect(matchesTokens("", [])).toBe(true);
-  });
-
-  it("is case-insensitive substring match", () => {
-    expect(matchesTokens("Rosuvastatin drug", filterTokens("ROSU"))).toBe(true);
-    expect(matchesTokens("Rosuvastatin drug", filterTokens("statin"))).toBe(true);
-  });
-
-  it("requires every token to match (AND)", () => {
-    expect(matchesTokens("Rosuvastatin 10mg drug", filterTokens("rosuvastatin drug"))).toBe(true);
-    expect(matchesTokens("Rosuvastatin 10mg drug", filterTokens("rosuvastatin supplement"))).toBe(false);
-  });
-});
-
-describe("onlyIndexed", () => {
-  it("passes through untouched when only is undefined", () => {
-    expect(onlyIndexed(["a", "b", "c"], undefined)).toEqual(["a", "b", "c"]);
-  });
-
-  it("reduces to just the one index", () => {
-    expect(onlyIndexed(["a", "b", "c"], 1)).toEqual(["b"]);
-  });
-
-  it("returns empty for an out-of-range index", () => {
-    expect(onlyIndexed(["a", "b", "c"], 5)).toEqual([]);
-  });
-});

package/time-ago.test.ts

@@ -1,32 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { timeAgo } from "./time-ago";
-
-describe("timeAgo", () => {
-  const NOW = new Date("2026-07-05T12:00:00Z").getTime();
-  const ago = (ms: number) => new Date(NOW - ms).toISOString();
-  const s = 1000, m = 60 * s, h = 60 * m, d = 24 * h;
-
-  it("collapses the last few seconds to 'just now'", () => {
-    expect(timeAgo(ago(5 * s), NOW)).toBe("just now");
-    expect(timeAgo(ago(44 * s), NOW)).toBe("just now");
-  });
-
-  it("reports minutes, hours, and days with correct pluralization", () => {
-    expect(timeAgo(ago(1 * m), NOW)).toBe("1 minute ago");
-    expect(timeAgo(ago(5 * m), NOW)).toBe("5 minutes ago");
-    expect(timeAgo(ago(1 * h), NOW)).toBe("1 hour ago");
-    expect(timeAgo(ago(3 * h), NOW)).toBe("3 hours ago");
-    expect(timeAgo(ago(1 * d), NOW)).toBe("1 day ago");
-    expect(timeAgo(ago(2 * d), NOW)).toBe("2 days ago");
-  });
-
-  it("rolls up to months and years for older timestamps", () => {
-    expect(timeAgo(ago(45 * d), NOW)).toBe("2 months ago");
-    expect(timeAgo(ago(400 * d), NOW)).toBe("1 year ago");
-  });
-
-  it("degrades a future or malformed timestamp instead of throwing", () => {
-    expect(timeAgo(ago(-1 * h), NOW)).toBe("just now"); // clock skew → future
-    expect(timeAgo("not-a-date", NOW)).toBe("unknown");
-  });
-});