acrylblends 0.2.0 → 0.3.0

package/plugins/acryl-router/tests/conformance.ts

@@ -0,0 +1,170 @@
+/**
+ * The framework-neutral conformance suite for a `router` (spec 046, milestone M0). A candidate is one factory returning
+ * five operations; the same checks run against every implementation, so choosing between the rewrite, H3 or
+ * a Rou3-based core is a matter of one adapter function and a test run.
+ */
+
+import { describe, expect, it } from 'vitest'
+import type { Handler, Middleware, RouteMethod } from '../src/types.ts'
+
+export interface Candidate {
+  route(method: RouteMethod, path: string, handler: Handler): () => void
+  use(path: string, middleware: Middleware): () => void
+  fetch(request: Request): Promise<Response>
+  /** Routes plus middleware currently registered. */
+  size(): number
+}
+
+const req = (path: string, method = 'GET'): Request => new Request(`http://acryl.test${path}`, { method })
+const body = async (response: Response): Promise<string> => response.text()
+const echo = (label: string): Handler => c => c.text(`${label}:${JSON.stringify(c.params)}`)
+
+export function conformance(label: string, make: () => Promise<Candidate> | Candidate): void {
+  describe(`router conformance: ${label}`, () => {
+    it('matches exact, parameter and wildcard routes and decodes parameters', async () => {
+      const r = await make()
+      r.route('GET', '/', echo('root'))
+      r.route('GET', '/market', echo('market'))
+      r.route('GET', '/market/:id', echo('item'))
+      r.route('GET', '/files/*', echo('files'))
+      expect(await body(await r.fetch(req('/')))).toBe('root:{}')
+      expect(await body(await r.fetch(req('/market')))).toBe('market:{}')
+      expect(await body(await r.fetch(req('/market/a%20b')))).toBe('item:{"id":"a b"}')
+      expect(await body(await r.fetch(req('/files/a/b/c')))).toBe('files:{"*":"a/b/c"}')
+      expect((await r.fetch(req('/market/a/b'))).status).toBe(404)
+    })
+
+    it('prefers static over parameter over wildcard, whatever the registration order', async () => {
+      const r = await make()
+      r.route('GET', '/x/*', echo('wild'))
+      r.route('GET', '/x/:id', echo('param'))
+      r.route('GET', '/x/fixed', echo('static'))
+      expect(await body(await r.fetch(req('/x/fixed')))).toBe('static:{}')
+      expect(await body(await r.fetch(req('/x/other')))).toBe('param:{"id":"other"}')
+      expect(await body(await r.fetch(req('/x/other/deep')))).toBe('wild:{"*":"other/deep"}')
+    })
+
+    it('answers 404 for unknown paths and 405 with Allow for a known path with another method', async () => {
+      const r = await make()
+      r.route('GET', '/a', echo('a'))
+      r.route('POST', '/a', echo('a-post'))
+      expect((await r.fetch(req('/nope'))).status).toBe(404)
+      const refused = await r.fetch(req('/a', 'DELETE'))
+      expect(refused.status).toBe(405)
+      expect(refused.headers.get('allow')).toBe('GET, HEAD, POST')
+    })
+
+    it('answers HEAD from the GET route with the same status and headers and no body, unless a HEAD route exists', async () => {
+      const r = await make()
+      r.route('GET', '/h', c => c.json({ big: 'body' }, 202))
+      const head = await r.fetch(req('/h', 'HEAD'))
+      expect(head.status).toBe(202)
+      expect(head.headers.get('content-type')).toContain('application/json')
+      expect(await body(head)).toBe('')
+      r.route('HEAD', '/h', c => c.text('', 204))
+      expect((await r.fetch(req('/h', 'HEAD'))).status).toBe(204)
+    })
+
+    it('lets a specific method beat the any-method route, and the any-method route catch the rest', async () => {
+      const r = await make()
+      r.route('*', '/m', echo('any'))
+      r.route('GET', '/m', echo('get'))
+      expect(await body(await r.fetch(req('/m')))).toBe('get:{}')
+      expect(await body(await r.fetch(req('/m', 'PUT')))).toBe('any:{}')
+    })
+
+    it('throws on a duplicate route, including one that differs only in parameter name', async () => {
+      const r = await make()
+      r.route('GET', '/dup/:id', echo('one'))
+      expect(() => r.route('GET', '/dup/:name', echo('two'))).toThrow(/duplicate/i)
+      expect(() => r.route('POST', '/dup/:name', echo('post'))).not.toThrow()
+    })
+
+    it('rejects malformed paths', async () => {
+      const r = await make()
+      expect(() => r.route('GET', 'no-slash', echo('x'))).toThrow()
+      expect(() => r.route('GET', '/a/*/b', echo('x'))).toThrow()
+      expect(() => r.route('GET', '/a/:/b', echo('x'))).toThrow()
+      expect(() => r.route('GET', '/a/:id/:id', echo('x'))).toThrow()
+    })
+
+    it('runs middleware in registration order around the handler and lets one short-circuit', async () => {
+      const r = await make()
+      const seen: string[] = []
+      r.use('/api', async (c, next) => { seen.push('a-in'); c.set('who', 'alice'); const res = await next(); seen.push('a-out'); return res })
+      r.use('/api', async (_c, next) => { seen.push('b-in'); const res = await next(); seen.push('b-out'); return res })
+      r.use('/api/private', (c) => c.text('denied', 401))
+      r.route('GET', '/api/ok', c => c.text(`hello ${c.get<string>('who') ?? '?'}`))
+      r.route('GET', '/api/private/x', c => c.text('secret'))
+      r.route('GET', '/open', c => c.text('open'))
+
+      expect(await body(await r.fetch(req('/api/ok')))).toBe('hello alice')
+      expect(seen).toEqual(['a-in', 'b-in', 'b-out', 'a-out'])
+      seen.length = 0
+      const denied = await r.fetch(req('/api/private/x'))
+      expect(denied.status).toBe(401)
+      // The /api middleware still ran before the /api/private one refused; /open is outside every middleware path.
+      expect(seen).toEqual(['a-in', 'b-in', 'b-out', 'a-out'])
+      seen.length = 0
+      expect(await body(await r.fetch(req('/open')))).toBe('open')
+      expect(seen).toEqual([])
+    })
+
+    it('turns a throwing handler into a 500 and a double next() into a 500', async () => {
+      const r = await make()
+      r.route('GET', '/boom', () => { throw new Error('boom') })
+      r.use('/twice', async (_c, next) => { await next(); return next() })
+      r.route('GET', '/twice', echo('t'))
+      expect((await r.fetch(req('/boom'))).status).toBe(500)
+      expect((await r.fetch(req('/twice'))).status).toBe(500)
+    })
+
+    it('removes a route when its remover runs, is idempotent, and leaves other routes alone', async () => {
+      const r = await make()
+      const removeA = r.route('GET', '/a', echo('a'))
+      r.route('GET', '/b', echo('b'))
+      expect((await r.fetch(req('/a'))).status).toBe(200)
+      removeA()
+      removeA()
+      expect((await r.fetch(req('/a'))).status).toBe(404)
+      expect((await r.fetch(req('/b'))).status).toBe(200)
+      r.route('GET', '/a', echo('a2'))
+      expect(await body(await r.fetch(req('/a')))).toBe('a2:{}')
+    })
+
+    it('removes middleware with its remover', async () => {
+      const r = await make()
+      r.route('GET', '/p', echo('p'))
+      const remove = r.use('/', (c) => c.text('blocked', 403))
+      expect((await r.fetch(req('/p'))).status).toBe(403)
+      remove()
+      expect((await r.fetch(req('/p'))).status).toBe(200)
+    })
+
+    it('returns to its baseline size after fifty register and remove cycles', async () => {
+      const r = await make()
+      r.route('GET', '/stay', echo('stay'))
+      const baseline = r.size()
+      for (let i = 0; i < 50; i += 1) {
+        const a = r.route('GET', `/cycle/${String(i)}`, echo('c'))
+        const b = r.use(`/cycle/${String(i)}`, async (_c, next) => next())
+        expect(r.size()).toBe(baseline + 2)
+        a()
+        b()
+      }
+      expect(r.size()).toBe(baseline)
+    })
+
+    it('gives the same response through fetch as a handler builds, including headers and status', async () => {
+      const r = await make()
+      r.route('POST', '/echo/:name', async c => {
+        const text = await c.req.text()
+        return c.json({ name: c.params['name'], text, query: c.url.searchParams.get('q') }, 201)
+      })
+      const response = await r.fetch(new Request('http://acryl.test/echo/zed?q=1', { method: 'POST', body: 'hi' }))
+      expect(response.status).toBe(201)
+      expect(response.headers.get('content-type')).toContain('application/json')
+      expect(await response.json()).toEqual({ name: 'zed', text: 'hi', query: '1' })
+    })
+  })
+}

package/plugins/acryl-router/tests/helpers.spec.ts

@@ -0,0 +1,172 @@
+/** The route helpers (spec 046): bounded body reading, server-sent events, and validation. */
+
+import { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { afterEach, describe, expect, it } from 'vitest'
+import { apply, name, type Router } from '../src/index.ts'
+import { readBytes, readJson, readText, streamSSE, valid, validate } from '../src/helpers/index.ts'
+import { bodyLimit } from '../src/middleware/index.ts'
+
+const contexts: Context[] = []
+const settle = (ms = 0): Promise<void> => new Promise(resolve => setTimeout(resolve, ms))
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+async function mount(): Promise<{ ctx: Context, router: Router }> {
+  const ctx = new Context()
+  contexts.push(ctx)
+  ctx.plugin({ name, apply })
+  await settle()
+  return { ctx, router: ctx.router }
+}
+
+describe('readJson / readText / readBytes', () => {
+  it('reads a JSON body, and an empty body as no bytes', async () => {
+    const { router } = await mount()
+    router.post('/j', async c => c.json({ got: await readJson(c) }))
+    router.post('/t', async c => c.text(String((await readBytes(c)).byteLength)))
+    expect(await (await router.request('/j', { method: 'POST', body: '{"a":1}' })).json()).toEqual({ got: { a: 1 } })
+    expect(await (await router.request('/t', { method: 'POST' })).text()).toBe('0')
+  })
+
+  it('answers 400 for bad JSON and 413 over the limit, counting the bytes it reads', async () => {
+    const { router } = await mount()
+    router.post('/j', async c => c.json(await readJson(c, { maxBytes: 16 })))
+    expect((await router.request('/j', { method: 'POST', body: '{nope' })).status).toBe(400)
+    const big = await router.request('/j', { method: 'POST', body: JSON.stringify({ pad: 'x'.repeat(100) }) })
+    expect(big.status).toBe(413)
+  })
+
+  it('stops a chunked body that has no declared length at the limit', async () => {
+    const { router } = await mount()
+    router.post('/t', async c => c.text(await readText(c, { maxBytes: 8 })))
+    const stream = new ReadableStream<Uint8Array>({ start(controller) { controller.enqueue(new TextEncoder().encode('0123456789')); controller.close() } })
+    const response = await router.request(new Request('http://localhost/t', { method: 'POST', body: stream, duplex: 'half' } as RequestInit))
+    expect(response.status).toBe(413)
+  })
+
+  it('uses the limit the bodyLimit middleware set', async () => {
+    const { router } = await mount()
+    router.use(bodyLimit({ maxBytes: 4 }))
+    router.post('/t', async c => c.text(await readText(c)))
+    const stream = new ReadableStream<Uint8Array>({ start(controller) { controller.enqueue(new TextEncoder().encode('abcdefgh')); controller.close() } })
+    expect((await router.request(new Request('http://localhost/t', { method: 'POST', body: stream, duplex: 'half' } as RequestInit))).status).toBe(413)
+  })
+})
+
+describe('streamSSE', () => {
+  async function read(response: Response, count: number): Promise<string[]> {
+    const reader = response.body!.getReader()
+    const decoder = new TextDecoder()
+    let buffer = ''
+    const out: string[] = []
+    while (out.length < count) {
+      const { done, value } = await reader.read()
+      if (done) break
+      buffer += decoder.decode(value, { stream: true })
+      for (let at = buffer.indexOf('\n\n'); at !== -1; at = buffer.indexOf('\n\n')) { out.push(buffer.slice(0, at)); buffer = buffer.slice(at + 2) }
+    }
+    reader.releaseLock()
+    return out
+  }
+
+  it('sends events with ids, names, JSON and multi-line text, and a comment', async () => {
+    const { router } = await mount()
+    router.get('/s', c => streamSSE(c, stream => {
+      stream.send({ n: 1 }, { event: 'tick', id: '7' })
+      stream.send('line one\nline two')
+      stream.comment('keep-alive')
+    }))
+    const events = await read(await router.request('/s'), 3)
+    expect(events).toEqual(['id: 7\nevent: tick\ndata: {"n":1}', 'data: line one\ndata: line two', ': keep-alive'])
+  })
+
+  it('runs its cleanup once when the client aborts, and ends the stream', async () => {
+    const { router } = await mount()
+    let cleaned = 0
+    router.get('/s', c => streamSSE(c, () => () => { cleaned += 1 }))
+    const controller = new AbortController()
+    const response = await router.request('/s', { signal: controller.signal })
+    const reader = response.body!.getReader()
+    controller.abort()
+    await expect(reader.read()).resolves.toMatchObject({ done: true })
+    await settle(5)
+    expect(cleaned).toBe(1)
+  })
+
+  it('lets the server close the stream, and runs the cleanup once even if cancelled afterwards', async () => {
+    const { router } = await mount()
+    let cleaned = 0
+    router.get('/s', c => streamSSE(c, stream => { stream.send('only'); stream.close(); return () => { cleaned += 1 } }))
+    const response = await router.request('/s')
+    const reader = response.body!.getReader()
+    expect((await reader.read()).done).toBe(false)
+    await expect(reader.read()).resolves.toMatchObject({ done: true })
+    await reader.cancel()
+    expect(cleaned).toBe(1)
+  })
+
+  it('is ended and awaited when its plugin unloads the router', async () => {
+    const { ctx, router } = await mount()
+    let cleaned = 0
+    router.get('/s', c => streamSSE(c, () => () => { cleaned += 1 }))
+    const response = await router.request('/s')
+    const reader = response.body!.getReader()
+    const ended = reader.read()
+    await ctx.fiber.dispose()
+    contexts.length = 0
+    await expect(ended).resolves.toMatchObject({ done: true })
+    expect(cleaned).toBe(1)
+  })
+})
+
+describe('validate', () => {
+  const Body = z.object({ name: z.string().required(), age: z.number().default(0) })
+
+  it('hands the handler the parsed value, with defaults applied', async () => {
+    const { router } = await mount()
+    router.post('/u', validate('json', Body), c => c.json(valid<{ name: string, age: number }>(c, 'json')))
+    const response = await router.request('/u', { method: 'POST', body: '{"name":"ada"}' })
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ name: 'ada', age: 0 })
+  })
+
+  it('answers 400 with the issues for an invalid body, query or parameter', async () => {
+    const { router } = await mount()
+    router.post('/u', validate('json', Body), c => c.text('ok'))
+    router.get('/q', validate('query', z.object({ page: z.string().required() })), c => c.text('ok'))
+    router.get('/p/:id', validate('param', z.object({ id: z.string().pattern(/^\d+$/u).required() })), c => c.text('ok'))
+    const bad = await router.request('/u', { method: 'POST', body: '{}' })
+    expect(bad.status).toBe(400)
+    expect(((await bad.json()) as { error: string }).error).toBe('invalid json')
+    expect((await router.request('/q')).status).toBe(400)
+    expect((await router.request('/q?page=2')).status).toBe(200)
+    expect((await router.request('/p/abc')).status).toBe(400)
+    expect((await router.request('/p/42')).status).toBe(200)
+  })
+
+  it('tells the author when valid() is used without validate()', async () => {
+    const { router } = await mount()
+    router.get('/x', c => c.text(String(valid(c, 'json'))))
+    expect((await router.request('/x')).status).toBe(500)
+  })
+})
+
+describe('streamSSE keepalive and validate on bad JSON', () => {
+  it('sends a comment line on an idle stream and stops when it ends', async () => {
+    const { router } = await mount()
+    router.get('/s', c => streamSSE(c, () => undefined, { keepAliveMs: 10 }))
+    const response = await router.request('/s')
+    const reader = response.body!.getReader()
+    const chunk = new TextDecoder().decode((await reader.read()).value)
+    expect(chunk).toBe(': keepalive\n\n')
+    await reader.cancel()
+  })
+
+  it('answers 400, not 500, when the body is not JSON', async () => {
+    const { router } = await mount()
+    router.post('/v', validate('json', z.object({ a: z.number() }) as never), c => c.json(valid(c, 'json')))
+    expect((await router.request('/v', { method: 'POST', body: '{nope' })).status).toBe(400)
+  })
+})

package/plugins/acryl-router/tests/live-install.spec.ts

@@ -0,0 +1,64 @@
+/**
+ * Mounting a plugin after startup from inside a Service method (what an Extensions service does). Inside a service method `this.ctx` is Cordis's
+ * "shadow" context, which resolves services as the SERVICE'S OWN fiber; a child plugin mounted with it inherits that shadow, so its `ctx.router`
+ * is looked up in the installer's fiber (which never injected it) and throws "cannot get property router without inject", even though the child's
+ * own `fiber.inject` and `ctx.get('router')` are fine. The context captured in the constructor is not shadowed and mounts a plugin that behaves
+ * exactly like one mounted at startup.
+ */
+import { Context, Service } from '@deepseek-ai/cordis'
+import { afterEach, describe, expect, it } from 'vitest'
+import { apply, name } from '../src/index.ts'
+
+const contexts: Context[] = []
+const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+class Installer extends Service {
+  private readonly owner: Context
+  constructor(ctx: Context) {
+    super(ctx, 'installer')
+    this.owner = ctx
+  }
+
+  /** Right: mount from the context captured in the constructor. */
+  async install(module: object): Promise<void> {
+    await this.owner.plugin(module as { apply(ctx: Context): void })
+  }
+
+  /** Wrong: `this.ctx` inside a method is the shadow context. */
+  async installFromShadow(module: object): Promise<void> {
+    await this.ctx.plugin(module as { apply(ctx: Context): void })
+  }
+}
+
+async function system(): Promise<Context & { installer: Installer }> {
+  const root = new Context()
+  contexts.push(root)
+  root.plugin({ name, apply })
+  root.plugin({ name: 'installer', apply: (ctx: Context) => { new Installer(ctx) } })
+  await settle()
+  return root as Context & { installer: Installer }
+}
+
+const extension = (): object => ({
+  name: 'live-ext',
+  inject: ['router'],
+  apply(ctx: Context): void {
+    ctx.router.get('/live', c => c.json({ ok: true }))
+  },
+})
+
+describe('live install from a service method', () => {
+  it('works from the constructor context: the plugin reads ctx.router like one mounted at startup', async () => {
+    const root = await system()
+    await root.installer.install(extension())
+    expect(await (await root.router.request('/live')).json()).toEqual({ ok: true })
+  })
+
+  it('fails from this.ctx, which is Cordis behavior the framework docs warn about', async () => {
+    const root = await system()
+    await expect(root.installer.installFromShadow(extension())).rejects.toThrow(/cannot get property "router" without inject/u)
+  })
+})

package/plugins/acryl-router/tests/loader.spec.ts

@@ -0,0 +1,71 @@
+/**
+ * The router mounted the way production mounts every plugin: a real `@deepseek-ai/cordis-plugin-loader` Loader row
+ * pointing at the built `lib/index.js`. Covers what a hand-built `ctx.plugin` cannot: the row id equals the package
+ * name, the `cordis.patch.yml` insert is loadable, and disabling and enabling the row ten times leaves nothing behind.
+ * @throws if the package has not been built: run `pnpm run build` first.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Context, type FiberState } from '@deepseek-ai/cordis'
+import { Loader } from '@deepseek-ai/cordis-plugin-loader'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const ACTIVE = 2 as FiberState.ACTIVE
+const DISPOSED = 4 as FiberState.DISPOSED
+const BUILT_ENTRY = new URL('../lib/index.js', import.meta.url).href
+
+const roots: string[] = []
+const contexts: Context[] = []
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
+})
+
+async function mount(): Promise<{ ctx: Context, entryId: string }> {
+  const root = mkdtempSync(join(tmpdir(), 'acryl-router-loader-'))
+  roots.push(root)
+  writeFileSync(join(root, 'row.mjs'), `export * from ${JSON.stringify(BUILT_ENTRY)}\n`)
+  const ctx = new Context()
+  contexts.push(ctx)
+  await ctx.plugin(Loader, { baseUrl: `file://${root}/` })
+  const entryId = await ctx.loader.create({ name: './row.mjs' })
+  await ctx.loader.await()
+  return { ctx, entryId }
+}
+
+function entryOf(ctx: Context, entryId: string) {
+  const found = [...ctx.loader.entries()].find(candidate => candidate.id === entryId)
+  if (found === undefined) throw new Error('entry not found')
+  return found
+}
+
+describe('acryl-router through a real Loader', () => {
+  it('activates from the built entry and serves a request in process', async () => {
+    const { ctx, entryId } = await mount()
+    expect(entryOf(ctx, entryId).fiber?.state).toBe(ACTIVE)
+    ctx.router.get('/ping', c => c.json({ ok: true }))
+    const response = await ctx.router.fetch(new Request('http://acryl.test/ping'))
+    expect(await response.json()).toEqual({ ok: true })
+  })
+
+  it('answers 503 and drops its routes when the row is disabled, and serves again when re-enabled, ten times', async () => {
+    const { ctx, entryId } = await mount()
+    const first = ctx.router
+    for (let i = 0; i < 10; i += 1) {
+      await entryOf(ctx, entryId).update({ disabled: true })
+      await ctx.loader.await()
+      const fiber = entryOf(ctx, entryId).fiber
+      expect(fiber === undefined || fiber.state === DISPOSED).toBe(true)
+      await entryOf(ctx, entryId).update({ disabled: false })
+      await ctx.loader.await()
+      expect(entryOf(ctx, entryId).fiber?.state).toBe(ACTIVE)
+    }
+    expect(ctx.router).not.toBe(first)
+    expect(ctx.router.size).toBe(0)
+    expect((await first.fetch(new Request('http://acryl.test/x'))).status).toBe(503)
+    ctx.router.get('/again', c => c.text('ok'))
+    expect(await (await ctx.router.fetch(new Request('http://acryl.test/again'))).text()).toBe('ok')
+  })
+})

package/plugins/acryl-router/tests/middleware.spec.ts

@@ -0,0 +1,183 @@
+/** The built-in middleware (spec 046), each through the real Cordis service and `router.request`. */
+
+import { Context } from '@deepseek-ai/cordis'
+import { afterEach, describe, expect, it } from 'vitest'
+import { apply, name, type Router } from '../src/index.ts'
+import { bodyLimit, cors, logger, loopbackOnly, requestId, secureHeaders } from '../src/middleware/index.ts'
+
+const contexts: Context[] = []
+const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+async function mount(): Promise<Router> {
+  const ctx = new Context()
+  contexts.push(ctx)
+  ctx.plugin({ name, apply })
+  await settle()
+  return ctx.router
+}
+
+describe('secureHeaders', () => {
+  it('adds the hardening headers without overriding what the handler set, and lets a default be removed', async () => {
+    const router = await mount()
+    router.use(secureHeaders({ headers: { 'x-frame-options': '' } }))
+    router.get('/a', c => c.text('a'))
+    router.get('/b', () => new Response('b', { headers: { 'referrer-policy': 'origin' } }))
+    const a = await router.request('/a')
+    expect(a.headers.get('x-content-type-options')).toBe('nosniff')
+    expect(a.headers.get('x-frame-options')).toBeNull()
+    expect((await router.request('/b')).headers.get('referrer-policy')).toBe('origin')
+  })
+
+  it('also works on an immutable response', async () => {
+    const router = await mount()
+    router.use(secureHeaders())
+    router.get('/go', () => Response.redirect('http://example.test/x', 302))
+    const response = await router.request('/go')
+    expect(response.status).toBe(302)
+    expect(response.headers.get('x-content-type-options')).toBe('nosniff')
+  })
+})
+
+describe('requestId', () => {
+  it('keeps a well-formed incoming id, replaces a bad one, and exposes it to handlers', async () => {
+    const router = await mount()
+    router.use(requestId({ generate: () => 'generated-1' }))
+    router.get('/id', c => c.text(c.get<string>('requestId') ?? ''))
+    const kept = await router.request('/id', { headers: { 'x-request-id': 'abc-123' } })
+    expect(await kept.text()).toBe('abc-123')
+    expect(kept.headers.get('x-request-id')).toBe('abc-123')
+    const replaced = await router.request('/id', { headers: { 'x-request-id': 'bad id with spaces' } })
+    expect(await replaced.text()).toBe('generated-1')
+    expect((await router.request('/id')).headers.get('x-request-id')).toBe('generated-1')
+  })
+})
+
+describe('logger', () => {
+  it('writes an in line and an out line with status and time to the sink, and reports a throw', async () => {
+    const router = await mount()
+    const lines: string[] = []
+    router.use(logger(line => lines.push(line)))
+    router.get('/ok', c => c.text('ok'))
+    router.get('/boom', () => { throw new Error('boom') })
+    await router.request('/ok')
+    await router.request('/boom')
+    expect(lines[0]).toBe('<-- GET /ok')
+    expect(lines[1]).toMatch(/^--> GET \/ok 200 \d+ms$/)
+    expect(lines[2]).toBe('<-- GET /boom')
+    expect(lines[3]).toMatch(/^--> GET \/boom threw boom \d+ms$/)
+  })
+})
+
+describe('bodyLimit', () => {
+  it('refuses a declared length over the limit and lets a smaller one through', async () => {
+    const router = await mount()
+    router.use(bodyLimit({ maxBytes: 10 }))
+    router.post('/in', async c => c.text(await c.req.text()))
+    const big = await router.request('/in', { method: 'POST', body: 'x'.repeat(50), headers: { 'content-length': '50' } })
+    expect(big.status).toBe(413)
+    expect(await big.json()).toEqual({ error: 'payload too large', maxBytes: 10 })
+    expect(await (await router.request('/in', { method: 'POST', body: 'small', headers: { 'content-length': '5' } })).text()).toBe('small')
+  })
+
+  it('uses a custom error response', async () => {
+    const router = await mount()
+    router.use(bodyLimit({ maxBytes: 1, onError: c => c.text('too big', 400) }))
+    router.post('/in', c => c.text('ok'))
+    const response = await router.request('/in', { method: 'POST', body: 'xx', headers: { 'content-length': '2' } })
+    expect(response.status).toBe(400)
+    expect(await response.text()).toBe('too big')
+  })
+})
+
+describe('cors', () => {
+  it('answers a preflight itself and adds the headers to normal responses', async () => {
+    const router = await mount()
+    router.use(cors({ origin: ['https://app.example'], allowMethods: ['GET', 'POST'], maxAge: 600, credentials: true }))
+    router.get('/x', c => c.text('x'))
+    const preflight = await router.request('/x', { method: 'OPTIONS', headers: { origin: 'https://app.example', 'access-control-request-method': 'POST', 'access-control-request-headers': 'x-a, x-b' } })
+    expect(preflight.status).toBe(204)
+    expect(preflight.headers.get('access-control-allow-origin')).toBe('https://app.example')
+    expect(preflight.headers.get('access-control-allow-methods')).toBe('GET,POST')
+    expect(preflight.headers.get('access-control-allow-headers')).toBe('x-a,x-b')
+    expect(preflight.headers.get('access-control-max-age')).toBe('600')
+    expect(preflight.headers.get('access-control-allow-credentials')).toBe('true')
+    const normal = await router.request('/x', { headers: { origin: 'https://app.example' } })
+    expect(normal.headers.get('access-control-allow-origin')).toBe('https://app.example')
+    expect(normal.headers.get('vary')).toContain('Origin')
+  })
+
+  it('does not allow an origin outside the list', async () => {
+    const router = await mount()
+    router.use(cors({ origin: 'https://app.example' }))
+    router.get('/x', c => c.text('x'))
+    const response = await router.request('/x', { headers: { origin: 'https://evil.example' } })
+    expect(response.headers.get('access-control-allow-origin')).toBeNull()
+  })
+})
+
+describe('loopbackOnly', () => {
+  const peer = { remoteAddress: '127.0.0.1', localPort: 3105 }
+  const headers = (extra: Record<string, string> = {}): Record<string, string> => ({ host: '127.0.0.1:3105', ...extra })
+
+  it('lets a loopback peer on the real port through and refuses everything else with a 403', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.get('/x', c => c.text('x'))
+    expect((await router.request('/x', { headers: headers() }, peer)).status).toBe(200)
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ host: 'evil.example:3105' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ 'sec-fetch-site': 'cross-site' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers() })).status).toBe(403)
+  })
+
+  it('accepts an IPv4-mapped loopback address and ::1', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.get('/x', c => c.text('x'))
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::ffff:127.0.0.1', localPort: 3105 })).status).toBe(200)
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
+  })
+
+  it('refuses a change from a foreign or null Origin, and accepts this app\'s own', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://evil.example' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'null' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://127.0.0.1:3105' }) }, peer)).status).toBe(200)
+  })
+
+  it('accepts a change with no Origin (curl) only when the Host is a loopback address with this port', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'localhost:3105' }) }, peer)).status).toBe(200)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '[::1]:3105' }) }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
+    // DNS rebinding: the page's own domain arrives as the Host, so a foreign Host is refused with or without an Origin.
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'rebind.example:3105' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
+  })
+
+  it('refuses an in-process call by default and lets it through when told the caller is the host', async () => {
+    const router = await mount()
+    router.get('/guarded', loopbackOnly(), c => c.text('x'))
+    router.get('/host', loopbackOnly({ inProcess: 'allow' }), c => c.text('x'))
+    expect((await router.request('/guarded')).status).toBe(403)
+    expect((await router.request('/host')).status).toBe(200)
+    // A request with any connection facts is checked in full, even when inProcess is allowed.
+    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
+    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '127.0.0.1' })).status).toBe(403)
+  })
+
+  it('can check only the peer when mutations are none', async () => {
+    const router = await mount()
+    router.use(loopbackOnly({ mutations: 'none' }))
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
+  })
+})