akanjs 2.2.4-rc.5 → 2.2.4

package/build.ts

@@ -0,0 +1,318 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { $ } from "bun";
+import ts from "typescript";
+
+const PACKAGE_DIR = import.meta.dir;
+const WORKSPACE_ROOT = process.env.WORKSPACE_ROOT ?? process.cwd();
+const OUT_DIR = process.env.DIST_DIR ?? `${WORKSPACE_ROOT}/dist/pkgs/akanjs`;
+const TYPES_OUT_DIR = `${OUT_DIR}/types`;
+const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+const TEST_FILE_PATTERNS = [
+  "**/*.test.ts",
+  "**/*.test.tsx",
+  "**/*.test.js",
+  "**/*.test.jsx",
+  "**/*.spec.ts",
+  "**/*.spec.tsx",
+  "**/*.spec.js",
+  "**/*.spec.jsx",
+];
+
+const removeTestFiles = async () => {
+  for (const pattern of TEST_FILE_PATTERNS) {
+    const glob = new Bun.Glob(pattern);
+    for await (const file of glob.scan({ cwd: OUT_DIR, onlyFiles: true })) {
+      await rm(`${OUT_DIR}/${file}`, { force: true });
+    }
+  }
+};
+const COMMENT_FILE_PATTERNS = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"];
+const testFilePattern = /\.(?:test|spec)\.[cm]?[tj]sx?$/;
+
+const isJSDocComment = (comment: string) => comment.startsWith("/**") && !comment.startsWith("/***/");
+
+const stripStandaloneNonJsdocComments = (source: string) => {
+  const lines = source.split(/(\r?\n)/);
+  let result = "";
+  let inBlockComment = false;
+
+  for (let idx = 0; idx < lines.length; idx += 2) {
+    const line = lines[idx] ?? "";
+    const newline = lines[idx + 1] ?? "";
+    const trimmed = line.trimStart();
+
+    if (inBlockComment) {
+      if (trimmed.includes("*/")) inBlockComment = false;
+      continue;
+    }
+
+    if (trimmed.startsWith("//")) {
+      continue;
+    }
+
+    if (trimmed.startsWith("/*") && !trimmed.startsWith("/**")) {
+      if (!trimmed.includes("*/")) inBlockComment = true;
+      continue;
+    }
+
+    result += line + newline;
+  }
+
+  return result;
+};
+
+const collapseExcessBlankLines = (source: string) => source.replace(/(?:[ \t]*\r?\n){3,}/g, "\n\n");
+
+const stripNonJsdocCommentsFromSource = (source: string) => {
+  const sourceFile = ts.createSourceFile("strip-comments.ts", source, ts.ScriptTarget.Latest, true);
+  const removals = new Map<number, number>();
+  const addRanges = (ranges: ts.CommentRange[] | undefined) => {
+    for (const range of ranges ?? []) {
+      const comment = source.slice(range.pos, range.end);
+      if (!isJSDocComment(comment)) removals.set(range.pos, range.end);
+    }
+  };
+
+  const visit = (node: ts.Node) => {
+    addRanges(ts.getLeadingCommentRanges(source, node.pos));
+    addRanges(ts.getTrailingCommentRanges(source, node.end));
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sourceFile);
+
+  const sortedRemovals = [...removals.entries()].sort(([left], [right]) => left - right);
+  if (sortedRemovals.length === 0) return collapseExcessBlankLines(stripStandaloneNonJsdocComments(source));
+
+  let result = "";
+  let cursor = 0;
+  for (const [start, end] of sortedRemovals) {
+    result += source.slice(cursor, start);
+    cursor = end;
+  }
+  result += source.slice(cursor);
+
+  return collapseExcessBlankLines(stripStandaloneNonJsdocComments(result));
+};
+
+const stripNonJsdocComments = async (targetDir: string) => {
+  for (const pattern of COMMENT_FILE_PATTERNS) {
+    const glob = new Bun.Glob(pattern);
+    for await (const file of glob.scan({ cwd: targetDir, onlyFiles: true })) {
+      const filePath = `${targetDir}/${file}`;
+      const source = await readFile(filePath, "utf-8");
+      const stripped = stripNonJsdocCommentsFromSource(source);
+      if (stripped !== source) await writeFile(filePath, stripped);
+    }
+  }
+};
+
+const stripDeclarationAssetImports = async (targetDir: string) => {
+  const glob = new Bun.Glob("**/*.d.ts");
+  for await (const file of glob.scan({ cwd: targetDir, onlyFiles: true })) {
+    const filePath = `${targetDir}/${file}`;
+    const source = await readFile(filePath, "utf-8");
+    const stripped = source.replace(/^import\s+["'][^"']+\.(?:css|scss|sass)["'];\r?\n/gm, "");
+    if (stripped !== source) await writeFile(filePath, stripped);
+  }
+};
+
+const resolveDeclarationSpecifier = async (fromFilePath: string, specifier: string) => {
+  if (!specifier.startsWith("./") && !specifier.startsWith("../")) return specifier;
+  if (path.extname(specifier)) return specifier;
+
+  const basePath = path.resolve(path.dirname(fromFilePath), specifier);
+  if (await Bun.file(`${basePath}.d.ts`).exists()) return `${specifier}.d.ts`;
+  if (await Bun.file(path.join(basePath, "index.d.ts")).exists()) return `${specifier}/index.d.ts`;
+  return specifier;
+};
+
+const rewriteDeclarationRelativeSpecifiers = async (targetDir: string) => {
+  const glob = new Bun.Glob("**/*.d.ts");
+  const specifierPattern = /(from\s+|import\()(["'])(\.{1,2}\/[^"']+?)\2/g;
+  for await (const file of glob.scan({ cwd: targetDir, onlyFiles: true })) {
+    const filePath = `${targetDir}/${file}`;
+    const source = await readFile(filePath, "utf-8");
+    let rewritten = "";
+    let cursor = 0;
+
+    for (const match of source.matchAll(specifierPattern)) {
+      const index = match.index ?? 0;
+      const [fullMatch, prefix, quote, specifier] = match;
+      rewritten += source.slice(cursor, index);
+      rewritten += `${prefix}${quote}${await resolveDeclarationSpecifier(filePath, specifier)}${quote}`;
+      cursor = index + fullMatch.length;
+    }
+
+    rewritten += source.slice(cursor);
+    if (rewritten !== source) await writeFile(filePath, rewritten);
+  }
+};
+
+const isSourceFile = (filePath: string) => SOURCE_EXTENSIONS.some((ext) => filePath.endsWith(ext));
+
+const isEmittableSourceFile = (filePath: string) => {
+  const relativePath = path.relative(PACKAGE_DIR, filePath);
+  if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) return false;
+  if (relativePath === "build.ts") return false;
+  if (relativePath.startsWith(`build${path.sep}`)) return false;
+  return isSourceFile(filePath) && !testFilePattern.test(filePath);
+};
+
+const formatDiagnosticMessages = (diagnostics: ts.Diagnostic[]) =>
+  ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+    getCanonicalFileName: (fileName) => fileName,
+    getCurrentDirectory: () => WORKSPACE_ROOT,
+    getNewLine: () => ts.sys.newLine,
+  });
+
+const collectSourceFiles = async () => {
+  const files: string[] = [];
+  const glob = new Bun.Glob("**/*.{ts,tsx,js,jsx}");
+  for await (const file of glob.scan({ cwd: PACKAGE_DIR, onlyFiles: true })) {
+    const filePath = path.join(PACKAGE_DIR, file);
+    if (isEmittableSourceFile(filePath)) files.push(filePath);
+  }
+  return files;
+};
+
+const emitDeclarations = async () => {
+  const configPath = path.join(PACKAGE_DIR, "tsconfig.json");
+  const configFile = ts.readConfigFile(configPath, ts.sys.readFile);
+  if (configFile.error) throw new Error(formatDiagnosticMessages([configFile.error]));
+
+  const parsedConfig = ts.parseJsonConfigFileContent(
+    configFile.config,
+    ts.sys,
+    PACKAGE_DIR,
+    {
+      declaration: true,
+      declarationMap: false,
+      emitDeclarationOnly: true,
+      noEmit: false,
+      noEmitOnError: false,
+      outDir: TYPES_OUT_DIR,
+      rootDir: PACKAGE_DIR,
+      sourceMap: false,
+      tsBuildInfoFile: path.join(TYPES_OUT_DIR, "tsconfig.tsbuildinfo"),
+    },
+    configPath,
+  );
+  if (parsedConfig.errors.length > 0) throw new Error(formatDiagnosticMessages(parsedConfig.errors));
+
+  const fileNames = await collectSourceFiles();
+  const program = ts.createProgram({ rootNames: fileNames, options: parsedConfig.options });
+  const emitResult = program.emit();
+  const diagnostics = ts.getPreEmitDiagnostics(program).concat(emitResult.diagnostics);
+  const errors = diagnostics.filter((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error);
+  if (errors.length > 0 && process.env.AKAN_BUILD_DECLARATION_DIAGNOSTICS === "1") {
+    console.warn(formatDiagnosticMessages(errors));
+  }
+};
+
+const copyExistingDeclarationFiles = async () => {
+  const glob = new Bun.Glob("**/*.d.ts");
+  for await (const file of glob.scan({ cwd: PACKAGE_DIR, onlyFiles: true })) {
+    const sourcePath = path.join(PACKAGE_DIR, file);
+    const targetPath = path.join(TYPES_OUT_DIR, file);
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    await writeFile(targetPath, await readFile(sourcePath, "utf-8"));
+  }
+};
+
+const writeDirectoryDeclarationFacades = async (targetDir: string) => {
+  const glob = new Bun.Glob("**/index.d.ts");
+  for await (const file of glob.scan({ cwd: targetDir, onlyFiles: true })) {
+    const dirname = path.dirname(file);
+    if (dirname === ".") continue;
+
+    const facadePath = path.join(targetDir, `${dirname}.d.ts`);
+    const target = `./${path.basename(dirname)}/index`;
+    await writeFile(facadePath, `export * from ${JSON.stringify(target)};\n`);
+  }
+};
+
+const toDeclarationPath = (target: string) => {
+  const toTypesPath = (declarationPath: string) => `./types/${declarationPath.replace(/^\.\//, "")}`;
+  for (const extension of [".tsx", ".ts", ".jsx", ".js"]) {
+    if (target.endsWith(extension)) return toTypesPath(`${target.slice(0, -extension.length)}.d.ts`);
+  }
+  if (target.endsWith("/*")) return toTypesPath(`${target}.d.ts`);
+  return target;
+};
+
+const toTypesExport = (target: string) => ({
+  types: toDeclarationPath(target),
+  import: target,
+  default: target,
+});
+
+const addExtensionWildcardTypes = (exportsMap: Record<string, unknown>, key: string, target: string) => {
+  if (!key.endsWith("/*") || !target.endsWith("/*")) return;
+  const keyPrefix = key.slice(0, -1);
+  const targetPrefix = target.slice(0, -1);
+  exportsMap[`${keyPrefix}*.ts`] = toTypesExport(`${targetPrefix}*.ts`);
+  exportsMap[`${keyPrefix}*.tsx`] = toTypesExport(`${targetPrefix}*.tsx`);
+};
+
+const rewriteExportsTypes = (packageJson: { exports?: Record<string, unknown> }) => {
+  const exportsMap = packageJson.exports;
+  if (!exportsMap) return;
+  const rewrittenExports: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(exportsMap)) {
+    if (typeof value === "string") {
+      if (isSourceFile(value) || value.endsWith("/*")) {
+        rewrittenExports[key] = toTypesExport(value);
+        addExtensionWildcardTypes(rewrittenExports, key, value);
+      } else {
+        rewrittenExports[key] = value;
+      }
+      continue;
+    }
+
+    if (value && typeof value === "object" && "types" in value) {
+      const exportValue = value as Record<string, unknown>;
+      rewrittenExports[key] = {
+        types: typeof exportValue.types === "string" ? toDeclarationPath(exportValue.types) : exportValue.types,
+        ...Object.fromEntries(Object.entries(exportValue).filter(([condition]) => condition !== "types")),
+      };
+      continue;
+    }
+
+    rewrittenExports[key] = value;
+  }
+
+  packageJson.exports = rewrittenExports;
+};
+
+const build = async () => {
+  try {
+    await $`rm -rf ${OUT_DIR}`;
+    await $`mkdir -p ${OUT_DIR}`;
+    await $`cp -R ${PACKAGE_DIR}/. ${OUT_DIR}`;
+    await $`rm -rf ${OUT_DIR}/build.ts`;
+    await rm(`${OUT_DIR}/build`, { recursive: true, force: true });
+    await rm(`${OUT_DIR}/tsconfig.json`, { force: true });
+    await removeTestFiles();
+
+    await emitDeclarations();
+    await copyExistingDeclarationFiles();
+    await writeDirectoryDeclarationFacades(TYPES_OUT_DIR);
+    await stripDeclarationAssetImports(TYPES_OUT_DIR);
+    await rewriteDeclarationRelativeSpecifiers(TYPES_OUT_DIR);
+    await stripNonJsdocComments(OUT_DIR);
+
+    const packageJson = await Bun.file(`${OUT_DIR}/package.json`).json();
+    packageJson.main = "./index.ts";
+    delete packageJson.bin;
+    rewriteExportsTypes(packageJson);
+    await Bun.write(`${OUT_DIR}/package.json`, `${JSON.stringify(packageJson, null, 2)}\n`);
+  } catch (error) {
+    console.error(error);
+    process.exit(1);
+  }
+};
+
+void build();

package/capacitor.base.config.test.ts

@@ -0,0 +1,83 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { AppScanResult } from "akanjs";
+import { withBase } from "./capacitor.base.config";
+
+const originalEnv = { ...process.env };
+const originalCwd = process.cwd();
+const tempRoots: string[] = [];
+
+const makeTempRoot = async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "akan-capacitor-"));
+  tempRoots.push(root);
+  return root;
+};
+
+const writeAppConfig = async (root: string, appName: string) => {
+  await mkdir(path.join(root, "apps", appName), { recursive: true });
+  await writeFile(path.join(root, "apps", appName, "akan.config.ts"), "export default {};\n");
+};
+
+const appInfo = (name: string): AppScanResult =>
+  ({
+    name,
+    type: "app",
+    repoName: "repo",
+    serveDomain: "example.com",
+    files: {},
+    libDeps: [],
+    pkgDeps: [],
+    dependencies: [],
+    devDependencies: [],
+    routes: [],
+    akanConfig: {
+      mobile: {
+        targets: {
+          app: {
+            name: "app",
+            appId: "com.example.app",
+            appName: "Example",
+          },
+        },
+      },
+    },
+  }) as AppScanResult;
+
+afterEach(async () => {
+  process.chdir(originalCwd);
+  process.env = { ...originalEnv };
+  await Promise.all(tempRoots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+});
+
+describe("withBase", () => {
+  test("uses sorted app order for local CSR fallback port", async () => {
+    const root = await makeTempRoot();
+    await writeAppConfig(root, "minimal");
+    await writeAppConfig(root, "akan");
+    process.chdir(root);
+    delete process.env.AKAN_PUBLIC_CLIENT_PORT;
+    delete process.env.PORT;
+
+    const config = withBase(undefined, appInfo("minimal"));
+
+    expect(config.server).toMatchObject({
+      url: expect.stringContaining(":8283/"),
+    });
+  });
+
+  test("prefers explicit local CSR port env", async () => {
+    const root = await makeTempRoot();
+    await writeAppConfig(root, "minimal");
+    await writeAppConfig(root, "akan");
+    process.chdir(root);
+    process.env.AKAN_PUBLIC_CLIENT_PORT = "9300";
+
+    const config = withBase(undefined, appInfo("minimal"));
+
+    expect(config.server).toMatchObject({
+      url: expect.stringContaining(":9300/"),
+    });
+  });
+});

package/capacitor.base.config.ts

@@ -14,7 +14,7 @@ const getLocalIP = () => {
       if (alias.family === "IPv4" && !alias.internal) return alias.address;
     }
   }
-  return "127.0.0.1"; 
+  return "127.0.0.1"; // fallback to localhost if no suitable IP found
 };
 
 const normalizeBasePath = (basePath: string | undefined) => basePath?.replace(/^\/+|\/+$/g, "");

package/client/capacitor.ts

@@ -148,7 +148,7 @@ type CapacitorImportCache = Partial<{
 type CapacitorPluginRegistry = Record<string, unknown>;
 
 declare global {
-  
+  // eslint-disable-next-line no-var
   var __AKAN_CAPACITOR_IMPORTS__: CapacitorImportCache | undefined;
 }
 

package/client/client.auth-storage.test.ts

@@ -0,0 +1,210 @@
+import { afterEach, beforeAll, describe, expect, mock, test } from "bun:test";
+
+type Side = "server" | "client";
+type RenderMode = "ssr" | "csr";
+
+const envState = {
+  side: "client" as Side,
+  renderMode: "ssr" as RenderMode,
+  appName: "test-app",
+  environment: "debug",
+};
+const preferenceStore = new Map<string, string>();
+const localStore = new Map<string, string>();
+const cookieStore: Record<string, string> = {};
+const fetchJwtCalls: Array<string | null> = [];
+const requestState = {
+  request: undefined as Request | undefined,
+};
+
+const makeJwt = (payload: Record<string, unknown>) => {
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `header.${encoded}.signature`;
+};
+
+beforeAll(() => {
+  mock.module("akanjs/base", () => ({
+    getEnv: () => ({
+      side: envState.side,
+      renderMode: envState.renderMode,
+      appName: envState.appName,
+      environment: envState.environment,
+    }),
+  }));
+  mock.module("akanjs/common", () => ({
+    Logger: { log: () => undefined, verbose: () => undefined, error: () => undefined },
+    decodeJwtPayload: (jwt: string) => JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")),
+    parseAkanI18nEnv: () => ({ locales: ["en", "ko"], defaultLocale: "en" }),
+    parseBasePaths: (value?: string) => (value ? value.split(",").filter(Boolean) : []),
+    getBasePathFromPathname: () => null,
+    pathGet: (path: string, obj: Record<string, unknown>, separator = ".", fallback?: unknown) =>
+      path.split(separator).reduce<unknown>((acc, key) => {
+        if (!acc || typeof acc !== "object") return fallback;
+        return (acc as Record<string, unknown>)[key] ?? fallback;
+      }, obj),
+  }));
+  mock.module("akanjs/fetch", () => ({
+    defaultAccount: { appName: envState.appName, environment: envState.environment },
+    requestStorage: {
+      getStore: () => requestState.request,
+    },
+  }));
+  mock.module("./useClient", () => ({
+    msg: {
+      loading: () => undefined,
+      success: () => undefined,
+      error: () => undefined,
+    },
+    fetch: {
+      setJwt: (jwt: string | null) => fetchJwtCalls.push(jwt),
+    },
+  }));
+});
+
+const installCapacitorBridge = () => {
+  Object.defineProperty(globalThis, "Capacitor", {
+    value: {
+      Plugins: {
+        Preferences: {
+          get: async ({ key }: { key: string }) => ({ value: preferenceStore.get(key) ?? null }),
+          set: async ({ key, value }: { key: string; value: string }) => {
+            preferenceStore.set(key, value);
+          },
+          remove: async ({ key }: { key: string }) => {
+            preferenceStore.delete(key);
+          },
+        },
+        CapacitorCookies: {
+          setCookie: async ({ key, value }: { key: string; value: string }) => {
+            cookieStore[key] = value;
+          },
+        },
+      },
+    },
+    configurable: true,
+  });
+};
+
+const installBrowserGlobals = (cookie = "") => {
+  Object.defineProperty(globalThis, "localStorage", {
+    value: {
+      getItem: (key: string) => localStore.get(key) ?? null,
+      setItem: (key: string, value: string) => localStore.set(key, value),
+      removeItem: (key: string) => localStore.delete(key),
+    },
+    configurable: true,
+  });
+  Object.defineProperty(globalThis, "document", {
+    value: {
+      cookie,
+    },
+    configurable: true,
+  });
+};
+
+afterEach(() => {
+  envState.side = "client";
+  envState.renderMode = "ssr";
+  envState.appName = "test-app";
+  envState.environment = "debug";
+  preferenceStore.clear();
+  localStore.clear();
+  Object.keys(cookieStore).forEach((key) => {
+    delete cookieStore[key];
+  });
+  fetchJwtCalls.length = 0;
+  requestState.request = undefined;
+  globalThis.__AKAN_CAPACITOR_IMPORTS__ = undefined;
+  Object.defineProperty(globalThis, "localStorage", { value: undefined, configurable: true });
+  Object.defineProperty(globalThis, "document", { value: undefined, configurable: true });
+  Object.defineProperty(globalThis, "Capacitor", { value: undefined, configurable: true });
+});
+
+describe("storage", () => {
+  test("server mode is a no-op", async () => {
+    envState.side = "server";
+    const { storage } = await import("./storage");
+
+    expect(await storage.getItem("jwt")).toBeUndefined();
+    expect(await storage.setItem("jwt", "token")).toBeUndefined();
+    expect(await storage.removeItem("jwt")).toBeUndefined();
+  });
+
+  test("client ssr mode uses localStorage", async () => {
+    envState.side = "client";
+    envState.renderMode = "ssr";
+    installBrowserGlobals();
+    const { storage } = await import("./storage");
+
+    await storage.setItem("jwt", "token-1");
+    expect(await storage.getItem("jwt")).toBe("token-1");
+    await storage.removeItem("jwt");
+    expect(await storage.getItem("jwt")).toBeNull();
+  });
+
+  test("client csr mode uses Capacitor Preferences", async () => {
+    envState.side = "client";
+    envState.renderMode = "csr";
+    installCapacitorBridge();
+    const { storage } = await import("./storage");
+
+    await storage.setItem("jwt", "token-2");
+    expect(await storage.getItem("jwt")).toBe("token-2");
+    await storage.removeItem("jwt");
+    expect(await storage.getItem("jwt")).toBeNull();
+  });
+});
+
+describe("cookies, headers, and auth", () => {
+  test("server cookies and headers read request storage", async () => {
+    envState.side = "server";
+    requestState.request = new Request("https://example.test", {
+      headers: {
+        cookie: 'jwt=abc; prefs=j:"dark"',
+        "x-locale": "ko",
+      },
+    });
+    const { cookies, getCookie, getHeader, headers, removeCookie } = await import("./cookie");
+
+    expect(cookies().get("jwt")).toEqual({ name: "jwt", value: "abc" });
+    expect(cookies().get("prefs")).toEqual({ name: "prefs", value: "dark" });
+    expect(getCookie("jwt")).toBe("abc");
+    expect(headers().get("x-locale")).toBe("ko");
+    expect(getHeader("x-locale")).toBe("ko");
+    expect(removeCookie("jwt")).toBe(true);
+  });
+
+  test("client cookies and account helpers use document/js-cookie and auth side effects", async () => {
+    envState.side = "client";
+    envState.renderMode = "ssr";
+    const jwt = makeJwt({ appName: "test-app", environment: "debug", userId: "u1" });
+    installBrowserGlobals(`jwt=${jwt}; theme=dark`);
+    const { cookies, getAccount, getCookie, initAuth, resetAuth, setAuth } = await import("./cookie");
+
+    expect(cookies()).toBeInstanceOf(Map);
+    expect(getCookie("jwt")).toBe(jwt);
+    expect(getAccount<{ userId?: string }>().userId).toBe("u1");
+    setAuth({ jwt: "new-token" });
+    expect(fetchJwtCalls.at(-1)).toBe("new-token");
+    expect(localStore.get("jwt")).toBe("new-token");
+
+    initAuth({ jwt: "init-token" });
+    expect(fetchJwtCalls.at(-1)).toBe("init-token");
+
+    resetAuth();
+    expect(fetchJwtCalls.at(-1)).toBeNull();
+    expect(localStore.has("jwt")).toBe(false);
+  });
+
+  test("getAccount rejects mismatched app or environment jwt", async () => {
+    envState.side = "client";
+    installBrowserGlobals();
+    const { getAccount } = await import("./cookie");
+
+    Object.defineProperty(globalThis, "document", {
+      value: { cookie: `jwt=${makeJwt({ appName: "other", environment: "debug" })}` },
+      configurable: true,
+    });
+    expect(getAccount<Record<string, unknown>>()).toEqual({ appName: "test-app", environment: "debug" });
+  });
+});