proteum 2.5.25 → 2.7.0

package/server/services/router/http/securityHeaders.ts

@@ -0,0 +1,343 @@
+/*----------------------------------
+- DEPENDANCES
+----------------------------------*/
+
+// Npm
+import type express from 'express';
+import onHeaders from 'on-headers';
+
+/*----------------------------------
+- TYPES
+----------------------------------*/
+
+/** A Content-Security-Policy written by its real directive names, e.g. `{ 'frame-ancestors': ["'self'"] }`. */
+export type TCspDirectives = Readonly<Record<string, readonly string[]>>;
+
+export type TCspReportOnly = {
+    /** A complete policy, sent as `Content-Security-Policy-Report-Only` on the answers that carry the app policy. */
+    policy: TCspDirectives;
+    /** Appended to the report-only policy as `report-uri`. */
+    reportUri?: string;
+};
+
+/** The four historical lists. Proteum adds `'unsafe-inline' 'self' 'unsafe-eval'` to the scripts. */
+export type TCspLegacyConfig = {
+    default?: readonly string[];
+    styles?: readonly string[];
+    images?: readonly string[];
+    scripts: readonly string[];
+    /** More enforced directives by their real names, appended after the four lists. */
+    directives?: TCspDirectives;
+    policy?: undefined;
+    reportOnly?: TCspReportOnly;
+};
+
+/** A complete enforced policy written in full by the app: Proteum adds nothing to it. */
+export type TCspPolicyConfig = {
+    policy: TCspDirectives;
+    default?: undefined;
+    styles?: undefined;
+    images?: undefined;
+    scripts?: undefined;
+    directives?: undefined;
+    reportOnly?: TCspReportOnly;
+};
+
+export type TCspConfig = TCspLegacyConfig | TCspPolicyConfig;
+
+export type TContentSecurityPolicyHeaders = {
+    /** The enforced `Content-Security-Policy` value: router answers outside `/api`, HTML under `/api`. */
+    policy: string;
+    /** The `Content-Security-Policy-Report-Only` value, on the answers that carry the app policy, when configured. */
+    reportOnly?: string;
+};
+
+type TDirectiveEntries = Array<[string, string[]]>;
+
+/*----------------------------------
+- CONSTANTS
+----------------------------------*/
+
+export const contentSecurityPolicyHeader = 'Content-Security-Policy';
+export const contentSecurityPolicyReportOnlyHeader = 'Content-Security-Policy-Report-Only';
+
+/** Directives the four legacy lists own, whether or not the list is filled. */
+const legacyDirectiveNames = new Set(['default-src', 'script-src', 'style-src', 'img-src']);
+const legacyListNames = ['default', 'styles', 'images', 'scripts'] as const;
+const cspKeys = new Set<string>([...legacyListNames, 'directives', 'policy', 'reportOnly']);
+const reportOnlyKeys = new Set(['policy', 'reportUri']);
+
+/** The CSP 3 directives a browser understands: any other name is a typo the browser would ignore. */
+const knownDirectiveNames = new Set([
+    'base-uri',
+    'block-all-mixed-content',
+    'child-src',
+    'connect-src',
+    'default-src',
+    'fenced-frame-src',
+    'font-src',
+    'form-action',
+    'frame-ancestors',
+    'frame-src',
+    'img-src',
+    'manifest-src',
+    'media-src',
+    'object-src',
+    'report-to',
+    'report-uri',
+    'require-trusted-types-for',
+    'sandbox',
+    'script-src',
+    'script-src-attr',
+    'script-src-elem',
+    'style-src',
+    'style-src-attr',
+    'style-src-elem',
+    'trusted-types',
+    'upgrade-insecure-requests',
+    'webrtc',
+    'worker-src',
+]);
+/** Directives that take no value at all. */
+const valuelessDirectiveNames = new Set(['upgrade-insecure-requests', 'block-all-mixed-content']);
+/** Directives whose value list may be empty. */
+const optionalValueDirectiveNames = new Set(['sandbox', 'trusted-types']);
+/** Directives whose values are tokens or addresses, not sources. */
+const nonSourceDirectiveNames = new Set(['sandbox', 'report-uri', 'report-to']);
+/** Keywords that only mean something inside single quotes: bare, they name a host. */
+const quotedKeywords = new Set([
+    'self',
+    'none',
+    'unsafe-inline',
+    'unsafe-eval',
+    'unsafe-hashes',
+    'strict-dynamic',
+    'report-sample',
+    'wasm-unsafe-eval',
+]);
+/** Printable ASCII with no whitespace, `;` or `,`: anything else breaks the header or the directive list. */
+const headerTokenPattern = /^[\x21-\x2b\x2d-\x3a\x3c-\x7e]+$/;
+/** HTML documents: under `/api`, the only answers that get the app policy. */
+const documentContentTypePattern = /^\s*(?:text\/html|application\/xhtml\+xml)\s*(?:;|$)/i;
+
+/*----------------------------------
+- BUILD (boot time)
+----------------------------------*/
+
+const fail = (message: string): never => {
+    throw new Error(`[http.csp] ${message}`);
+};
+
+// @boundary The csp config may be written in plain JavaScript (or spread from shared objects), so every
+// reader below takes its input as untyped and checks each field before use.
+type TConfigInput = unknown;
+
+const isPlainRecord = (value: TConfigInput): value is Record<string, TConfigInput> =>
+    typeof value === 'object' && value !== null && !Array.isArray(value);
+
+const readToken = (label: string, token: TConfigInput): string => {
+    if (typeof token !== 'string' || !headerTokenPattern.test(token))
+        return fail(`${label} must be a non-empty source in printable ASCII with no whitespace, ";" or "," (got ${JSON.stringify(token)}).`);
+    return token;
+};
+
+/**
+ * A legacy list entry keeps its 2.6 meaning: helmet joined the entries with spaces, so an entry holding
+ * several space-separated sources is kept as written (each source checked) and writes the same bytes.
+ */
+const readLegacyList = (label: string, value: TConfigInput): string[] => {
+    if (value === undefined) return [];
+    if (!Array.isArray(value)) return fail(`${label} must be an array of sources.`);
+
+    return value.map((entry, index) => {
+        if (typeof entry !== 'string') return fail(`${label}[${index}] must be a string.`);
+
+        const sources = entry.split(' ').filter((source) => source !== '');
+        if (sources.length === 0)
+            return fail(`${label}[${index}] is empty: an empty entry would send an empty source list, which blocks everything.`);
+        for (const source of sources) readToken(`${label}[${index}]`, source);
+
+        return entry;
+    });
+};
+
+const readSource = (label: string, directiveName: string, source: TConfigInput): string => {
+    const token = readToken(label, source);
+    if (nonSourceDirectiveNames.has(directiveName)) return token;
+
+    if (quotedKeywords.has(token.toLowerCase()))
+        return fail(`${label} is the bare word ${JSON.stringify(token)}, which names a host: write "'${token}'" with its single quotes.`);
+    const startsQuoted = token.startsWith("'");
+    const endsQuoted = token.endsWith("'");
+    if ((startsQuoted || endsQuoted) && !(startsQuoted && endsQuoted && token.length > 2 && !token.slice(1, -1).includes("'")))
+        return fail(`${label} has unbalanced single quotes: ${JSON.stringify(token)}.`);
+
+    return token;
+};
+
+/** Validates a directive record and returns it as ordered `[name, sources]` entries. */
+const readDirectives = (label: string, value: TConfigInput): TDirectiveEntries => {
+    if (!isPlainRecord(value)) return fail(`${label} must be an object of directive name to sources.`);
+
+    return Object.entries(value).map(([name, sources]) => {
+        if (!knownDirectiveNames.has(name))
+            return fail(`${label} has an unknown directive name ${JSON.stringify(name)}: use a real CSP directive name, lowercase, e.g. "frame-ancestors".`);
+        if (!Array.isArray(sources)) return fail(`${label}['${name}'] must be an array of sources.`);
+
+        const values = sources.map((source, index) => readSource(`${label}['${name}'][${index}]`, name, source));
+        if (valuelessDirectiveNames.has(name) && values.length > 0)
+            return fail(`${label}['${name}'] takes no value: write an empty array.`);
+        if (values.length === 0 && !valuelessDirectiveNames.has(name) && !optionalValueDirectiveNames.has(name))
+            return fail(`${label}['${name}'] is empty: a directive needs at least one source.`);
+
+        return [name, values];
+    });
+};
+
+/** A misspelt key (`reportonly`, `directive`) would otherwise boot and send nothing. */
+const assertKnownKeys = (label: string, value: Record<string, TConfigInput>, known: ReadonlySet<string>) => {
+    const unknownKeys = Object.keys(value).filter((key) => !known.has(key));
+    if (unknownKeys.length > 0)
+        fail(`${label} has unknown keys ${unknownKeys.map((key) => JSON.stringify(key)).join(', ')}: expected ${[...known].join(', ')}.`);
+};
+
+/** Serializes directives in helmet 4.6's exact format, so legacy headers stay byte for byte. */
+const serializeDirectives = (directives: TDirectiveEntries) =>
+    directives.map(([name, values]) => (values.length === 0 ? name : `${name} ${values.join(' ')}`)).join(';');
+
+const buildLegacyDirectives = (config: Record<string, TConfigInput>): TDirectiveEntries => {
+    if (config.scripts === undefined) fail('csp.scripts is required with the list form (an empty array is fine), or write the whole policy in csp.policy.');
+    const defaults = readLegacyList('csp.default', config.default);
+    const scripts = readLegacyList('csp.scripts', config.scripts);
+    const styles = readLegacyList('csp.styles', config.styles);
+    const images = readLegacyList('csp.images', config.images);
+
+    const directives: TDirectiveEntries = [];
+    if (defaults.length > 0) directives.push(['default-src', defaults]);
+    directives.push(['script-src', ["'unsafe-inline'", "'self'", "'unsafe-eval'", ...scripts]]);
+    if (styles.length > 0) directives.push(['style-src', styles]);
+    if (images.length > 0) directives.push(['img-src', images]);
+
+    if (config.directives !== undefined) {
+        const extra = readDirectives('csp.directives', config.directives);
+        for (const [name] of extra) {
+            if (legacyDirectiveNames.has(name))
+                fail(`csp.directives names ${JSON.stringify(name)}, which the legacy lists own: use default, scripts, styles or images, or write the whole policy in csp.policy.`);
+        }
+        directives.push(...extra);
+    }
+
+    return directives;
+};
+
+const buildReportOnlyDirectives = (value: TConfigInput): TDirectiveEntries => {
+    if (!isPlainRecord(value)) return fail('csp.reportOnly must be an object with a policy.');
+    assertKnownKeys('csp.reportOnly', value, reportOnlyKeys);
+
+    const directives = readDirectives('csp.reportOnly.policy', value.policy);
+    if (directives.length === 0) fail('csp.reportOnly.policy has no directive.');
+
+    if (value.reportUri !== undefined) {
+        const reportUri = readToken('csp.reportOnly.reportUri', value.reportUri);
+        if (directives.some(([name]) => name === 'report-uri'))
+            fail('csp.reportOnly sets report-uri twice: keep reportUri or the policy entry, not both.');
+        directives.push(['report-uri', [reportUri]]);
+    }
+
+    return directives;
+};
+
+/**
+ * Builds the policy header values once, at boot.
+ * Throws on any malformed config, so a broken header can never reach production.
+ */
+export const buildContentSecurityPolicyHeaders = (cspConfig: TCspConfig): TContentSecurityPolicyHeaders => {
+    const config: TConfigInput = cspConfig;
+    if (!isPlainRecord(config)) return fail('csp must be an object.');
+    assertKnownKeys('csp', config, cspKeys);
+
+    let directives: TDirectiveEntries;
+    if (config.policy !== undefined) {
+        const legacyFields = [...legacyListNames, 'directives'].filter((name) => config[name] !== undefined);
+        if (legacyFields.length > 0)
+            fail(`csp.policy replaces the whole policy, so ${legacyFields.join(', ')} must be absent.`);
+
+        directives = readDirectives('csp.policy', config.policy);
+        if (directives.length === 0) fail('csp.policy has no directive.');
+    } else {
+        directives = buildLegacyDirectives(config);
+    }
+
+    const headers: TContentSecurityPolicyHeaders = { policy: serializeDirectives(directives) };
+    if (config.reportOnly !== undefined) headers.reportOnly = serializeDirectives(buildReportOnlyDirectives(config.reportOnly));
+
+    return headers;
+};
+
+/*----------------------------------
+- WRITE (request time)
+----------------------------------*/
+
+const readContentType = (res: express.Response) => {
+    const value = res.getHeader('Content-Type');
+    if (Array.isArray(value)) return value[0];
+    return typeof value === 'string' ? value : undefined;
+};
+
+/** Adds the report-only policy when the headers are written, if the answer still carries the app policy. */
+const writeReportOnlyWithAppPolicy = (res: express.Response, headers: TContentSecurityPolicyHeaders) => {
+    if (headers.reportOnly === undefined) return;
+    if (res.getHeader(contentSecurityPolicyHeader) !== headers.policy) return;
+    if (res.hasHeader(contentSecurityPolicyReportOnlyHeader)) return;
+
+    res.setHeader(contentSecurityPolicyReportOnlyHeader, headers.reportOnly);
+};
+
+/**
+ * Outside `/api`: every router answer gets the app policy, whatever its type, as in 2.6
+ * (a worker takes its policy from its own script's answer, so a route-served worker must keep it).
+ * Set at the start of the request, so a route that writes its own policy replaces it.
+ */
+export const createAppContentSecurityPolicy =
+    (headers: TContentSecurityPolicyHeaders): express.RequestHandler =>
+    (_req, res, next) => {
+        res.setHeader(contentSecurityPolicyHeader, headers.policy);
+        if (headers.reportOnly !== undefined)
+            onHeaders(res, function writeReportOnly(this: express.Response) {
+                writeReportOnlyWithAppPolicy(this, headers);
+            });
+
+        next();
+    };
+
+/**
+ * Under `/api`: decides the policy when the headers are about to be written, by the final status and Content-Type.
+ * Mount it after helmet: the value helmet wrote at the start of the request is the baseline.
+ * - a route wrote or removed its own policy: everything is left as it is;
+ * - a 304: no policy at all, so the browser keeps the one its stored copy came with;
+ * - an HTML document: the app policy, plus the report-only policy when configured;
+ * - anything else: helmet's value stays.
+ */
+export const createApiContentSecurityPolicyWriter =
+    (headers: TContentSecurityPolicyHeaders): express.RequestHandler =>
+    (_req, res, next) => {
+        const baseline = res.getHeader(contentSecurityPolicyHeader);
+
+        onHeaders(res, function writeContentSecurityPolicy(this: express.Response) {
+            if (this.getHeader(contentSecurityPolicyHeader) !== baseline) return;
+
+            // A 304 refreshes the stored copy's headers: helmet's default there would replace the page's policy.
+            if (this.statusCode === 304) {
+                this.removeHeader(contentSecurityPolicyHeader);
+                return;
+            }
+
+            const contentType = readContentType(this);
+            if (contentType === undefined || !documentContentTypePattern.test(contentType)) return;
+
+            this.setHeader(contentSecurityPolicyHeader, headers.policy);
+            writeReportOnlyWithAppPolicy(this, headers);
+        });
+
+        next();
+    };

package/server/services/router/response/page/index.tsx

@@ -9,7 +9,7 @@ import renderToString from 'preact-render-to-string';
 // Core
 import { type TServerRouter, TRouterContext } from '@server/services/router';
 import type { Layout, TRoute, TErrorRoute, TClientOrServerContext } from '@common/router';
-import PageResponse, { TFrontRenderer, TPageRenderContext } from '@common/router/response/page';
+import PageResponse, { TPageRenderContext, TPageRenderer } from '@common/router/response/page';
 import { getClientBuildManifest } from './clientManifest';
 import { buildMetaTags } from './metas';
 import { buildDefaultJsonLd } from './jsonld';
@@ -41,7 +41,7 @@ export default class ServerPage<TRouter extends TServerRouter = TServerRouter> e
 
     public constructor(
         public route: TRoute | TErrorRoute,
-        public renderer: TFrontRenderer,
+        public renderer: TPageRenderer,
         context: TRouterContext<TRouter>,
         public layout?: Layout,
     ) {

package/tests/app-shaped-typecheck.test.cjs

@@ -0,0 +1,74 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const ts = require('typescript');
+
+const coreRoot = path.join(__dirname, '..');
+
+/** The `declare module '<name>'` names of a declaration file. */
+const declaredModules = (filepath) =>
+    [...fs.readFileSync(filepath, 'utf8').matchAll(/^declare module '([^']+)'/gm)].map((match) => match[1]);
+
+// Apps include `types/global` only (see the scaffold's server tsconfig), while Proteum's own tsc also reads
+// `types/vendors.d.ts`: a vendor declared in the root file alone typechecks here and fails in every app.
+test('every vendor module declared for Proteum is declared for apps too', () => {
+    const root = declaredModules(path.join(coreRoot, 'types/vendors.d.ts'));
+    const global = new Set(declaredModules(path.join(coreRoot, 'types/global/vendors.d.ts')));
+
+    assert.deepEqual(
+        root.filter((name) => !global.has(name)),
+        [],
+        'add these blocks to types/global/vendors.d.ts',
+    );
+});
+
+test('an app-shaped program reaching the HTTP server finds a declaration for every untyped vendor', () => {
+    const appRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'proteum-app-typecheck-'));
+    try {
+        fs.mkdirSync(path.join(appRoot, 'node_modules'));
+        fs.mkdirSync(path.join(appRoot, 'server'));
+        fs.symlinkSync(coreRoot, path.join(appRoot, 'node_modules', 'proteum'), 'dir');
+        fs.writeFileSync(
+            path.join(appRoot, 'server', 'probe.ts'),
+            "import HttpServer from '@server/services/router/http';\nexport type Probe = typeof HttpServer;\n",
+        );
+
+        // The shape of an app's server tsconfig: Proteum's base config, `types/global` only, noImplicitAny.
+        const proteum = './node_modules/proteum';
+        const config = ts.parseJsonConfigFileContent(
+            {
+                extends: `${proteum}/tsconfig.common.json`,
+                compilerOptions: {
+                    noEmit: true,
+                    rootDir: '.',
+                    baseUrl: '.',
+                    noImplicitAny: true,
+                    paths: {
+                        '@client/*': [`${proteum}/client/*`],
+                        '@common/*': [`${proteum}/common/*`],
+                        '@server/*': [`${proteum}/server/*`],
+                        react: [`${proteum}/node_modules/preact/compat`],
+                        'react-dom': [`${proteum}/node_modules/preact/compat`],
+                        'react/jsx-runtime': [`${proteum}/node_modules/preact/jsx-runtime`],
+                    },
+                },
+                include: ['./server/probe.ts', `${proteum}/types/global`],
+            },
+            ts.sys,
+            appRoot,
+        );
+        const program = ts.createProgram(config.fileNames, config.options);
+
+        // TS7016 is the B1 failure: a vendor with no types and no declaration. The harness has no generated
+        // `.proteum` files and no app code, so the other diagnostics are not this test's subject.
+        const missingDeclarations = ts
+            .getPreEmitDiagnostics(program)
+            .filter((diagnostic) => diagnostic.code === 7016)
+            .map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n').split('.')[0]);
+
+        assert.deepEqual(missingDeclarations, []);
+    } finally {
+        fs.rmSync(appRoot, { recursive: true, force: true });
+    }
+});

package/tests/client-api-fetch-sync.test.cjs

@@ -0,0 +1,180 @@
+const assert = require('node:assert/strict');
+const path = require('node:path');
+
+const coreRoot = path.join(__dirname, '..');
+require('module-alias').addAliases({
+    '@client': path.join(coreRoot, 'client'),
+    '@common': path.join(coreRoot, 'common'),
+    '@server': path.join(coreRoot, 'server'),
+});
+process.env.TS_NODE_PROJECT = path.join(coreRoot, 'cli', 'tsconfig.json');
+process.env.TS_NODE_TRANSPILE_ONLY = '1';
+require('ts-node/register/transpile-only');
+
+const previousDev = global.__DEV__;
+const previousFetch = global.fetch;
+global.__DEV__ = false;
+
+const ApiClient = require('../client/services/router/request/api.ts').default;
+
+/*----------------------------------
+- HARNESS
+----------------------------------*/
+
+const createClient = (respond) => {
+    const calls = [];
+    const handledErrors = [];
+    const app = { handleError: (error) => handledErrors.push(error) };
+    const request = { router: { url: (requestPath) => requestPath } };
+
+    global.fetch = async (url, config) => {
+        calls.push({ url, method: config.method, body: config.body ? JSON.parse(config.body) : undefined });
+        const { status = 200, body } = respond(url, config);
+        return { ok: status < 400, status, json: async () => body, headers: new Headers() };
+    };
+
+    return { api: new ApiClient(app, request), calls, handledErrors };
+};
+
+const quietly = async (run) => {
+    const originalLog = console.log;
+    const originalWarn = console.warn;
+    console.log = () => {};
+    console.warn = () => {};
+    try {
+        return await run();
+    } finally {
+        console.log = originalLog;
+        console.warn = originalWarn;
+    }
+};
+
+/*----------------------------------
+- TESTS
+----------------------------------*/
+
+test('fetchSync sends api fetchers in one batch, awaits other promises locally and keeps plain values', async () => {
+    const { api, calls } = createClient(() => ({ body: { rows: [1, 2], stats: { total: 2 } } }));
+
+    const data = await quietly(() =>
+        api.fetchSync(
+            {
+                rows: api.post('/api/Rows/list', { page: 1 }),
+                stats: api.post('/api/Rows/stats'),
+                local: Promise.resolve({ ok: true }),
+                thenable: { then: (resolve) => resolve(5) },
+                initialFilters: { q: 'word' },
+                dateKey: '2026-10-04',
+                skipped: undefined,
+                cached: api.post('/api/Rows/cached'),
+            },
+            { cached: 'kept' },
+        ),
+    );
+
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].url, '/api');
+    assert.equal(calls[0].method, 'POST');
+    assert.deepEqual(Object.keys(calls[0].body.fetchers), ['rows', 'stats']);
+    assert.deepEqual(calls[0].body.fetchers.rows, { method: 'POST', path: '/api/Rows/list', data: { page: 1 } });
+
+    assert.deepEqual(data, {
+        cached: 'kept',
+        rows: [1, 2],
+        stats: { total: 2 },
+        // Not an /api call: resolved here instead of serializing to {}
+        local: { ok: true },
+        thenable: 5,
+        initialFilters: { q: 'word' },
+        dateKey: '2026-10-04',
+    });
+    assert.deepEqual(Object.keys(data), ['cached', 'rows', 'stats', 'local', 'thenable', 'initialFilters', 'dateKey']);
+});
+
+test('fetchSync makes no request when no entry needs the server', async () => {
+    const { api, calls } = createClient(() => ({ body: {} }));
+
+    const data = await api.fetchSync({ deepLink: { tab: 'sales' }, today: Promise.resolve('2026-10-04') }, {});
+
+    assert.equal(calls.length, 0);
+    assert.deepEqual(data, { deepLink: { tab: 'sales' }, today: '2026-10-04' });
+});
+
+test('a failed batch goes through the app error handler and rejects', async () => {
+    const { api, handledErrors } = createClient(() => ({ status: 500, body: { code: 500, message: 'Boom' } }));
+
+    await quietly(() =>
+        assert.rejects(() => api.fetchSync({ rows: api.post('/api/Rows/list') }, {}), (error) => error.message === 'Boom'),
+    );
+    assert.equal(handledErrors.length, 1);
+});
+
+test('a rejected local promise goes through the app error handler and rejects', async () => {
+    const { api, calls, handledErrors } = createClient(() => ({ body: {} }));
+
+    await assert.rejects(() => api.fetchSync({ local: Promise.reject(new Error('local failure')) }, {}), /local failure/);
+    assert.equal(calls.length, 0);
+    assert.equal(handledErrors.length, 1);
+    assert.equal(handledErrors[0].message, 'local failure');
+});
+
+test('locally resolved values go through JSON, like SSR data and /api responses', async () => {
+    const { api } = createClient(() => ({ body: {} }));
+    const filters = { q: 'word', page: undefined };
+    const day = new Date('2026-10-04T00:00:00.000Z');
+
+    const data = await api.fetchSync(
+        {
+            filters,
+            day,
+            money: { toJSON: () => '12.50' },
+            seen: new Set(['a']),
+            resolved: Promise.resolve({ at: day, missing: undefined }),
+            nothing: Promise.resolve(undefined),
+        },
+        {},
+    );
+
+    assert.deepEqual(data, {
+        filters: { q: 'word' },
+        day: '2026-10-04T00:00:00.000Z',
+        money: '12.50',
+        seen: {},
+        resolved: { at: '2026-10-04T00:00:00.000Z' },
+    });
+    // The page gets its own copy: the provider's object is not shared
+    assert.notEqual(data.filters, filters);
+});
+
+test('api.reload re-runs the data step through navigation on a deferred page', () => {
+    const { api } = createClient(() => ({ body: {} }));
+    let retries = 0;
+    let fetches = 0;
+    const page = {
+        fetchers: { rows: {}, stats: {} },
+        data: { rows: [1], stats: { total: 1 } },
+        context: { request: { data: { page: '1' } } },
+        isDeferred: () => true,
+        navigationRetry: () => retries++,
+        fetchData: () => {
+            fetches++;
+            return Promise.resolve({});
+        },
+    };
+    api.router = { context: { page } };
+
+    api.reload('rows', { page: '2' });
+
+    assert.equal(retries, 1);
+    assert.equal(fetches, 0);
+    // The retry fetches what reload removed, with the new params
+    assert.deepEqual(page.data, { stats: { total: 1 } });
+    assert.deepEqual(page.context.request.data, { page: '2' });
+});
+
+afterAll(() => {
+    if (previousDev === undefined) delete global.__DEV__;
+    else global.__DEV__ = previousDev;
+    if (previousFetch === undefined) delete global.fetch;
+    else global.fetch = previousFetch;
+});