sqlite-hub 0.17.2 → 1.1.0

package/tests/api-token-auth.test.js

@@ -0,0 +1,236 @@
+const assert = require("node:assert/strict");
+const express = require("express");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+const { createExternalApiRouter } = require("../server/routes/externalApi");
+const { ApiTokenService } = require("../server/services/apiTokenService");
+const { AppStateStore } = require("../server/services/storage/appStateStore");
+const { ReadOnlyError } = require("../server/utils/errors");
+const { errorMiddleware } = require("../server/utils/errors");
+
+function createConnection(id, label, databasePath) {
+  return {
+    id,
+    label,
+    path: databasePath,
+    lastOpenedAt: new Date().toISOString(),
+    lastModifiedAt: new Date().toISOString(),
+    sizeBytes: 0,
+    readOnly: false,
+    logoPath: null,
+  };
+}
+
+async function startApi(t) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-api-token-"));
+  const store = new AppStateStore(path.join(directory, "state.db"));
+  const databaseA = createConnection("db-a", "Database A", path.join(directory, "a.db"));
+  const databaseB = createConnection("db-b", "Database B", path.join(directory, "b.db"));
+
+  store.upsertRecentConnection(databaseA);
+  store.upsertRecentConnection(databaseB, { makeActive: false });
+
+  const tokenService = new ApiTokenService({ appStateStore: store });
+  const serviceCalls = [];
+  const databaseService = {
+    listTables(databaseId) {
+      serviceCalls.push(databaseId);
+      return [{ name: "companies" }];
+    },
+    executeRawQuery(databaseId, sql, options = {}) {
+      serviceCalls.push(`${databaseId}:query:${sql}:${options.storeName ?? ""}`);
+      if (sql === "READONLY") {
+        throw new ReadOnlyError("Cannot execute raw SQL against a read-only database.");
+      }
+      return {
+        result: {
+          sql,
+          statementCount: 1,
+          statements: [],
+          rows: [],
+          columns: [],
+          affectedRowCount: 0,
+          resultKind: "unknown",
+          timingMs: 2,
+          historyId: 42,
+          storedQuery: options.storeName
+            ? {
+                id: 42,
+                title: options.storeName,
+                isSaved: true,
+              }
+            : null,
+        },
+      };
+    },
+  };
+  const app = express();
+
+  app.use(express.json());
+  app.use(
+    "/api/v1",
+    createExternalApiRouter({
+      databaseService,
+      tokenService,
+      appInfoService: async ({ port, url }) => ({
+        packageName: "sqlite-hub",
+        appVersion: "1.0.1",
+        sqliteVersion: "3.50.0",
+        port,
+        url,
+        versionCheck: {
+          packageName: "sqlite-hub",
+          currentVersion: "1.0.1",
+          latestVersion: "1.0.1",
+          updateAvailable: false,
+          checkedAt: "2026-06-20T10:00:00.000Z",
+          source: "npm",
+          releaseUrl: "https://www.npmjs.com/package/sqlite-hub/v/1.0.1",
+          status: "current",
+        },
+      }),
+    })
+  );
+  app.use(errorMiddleware);
+
+  const server = await new Promise((resolve) => {
+    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
+  });
+
+  t.after(async () => {
+    await new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+    store.db.close();
+    fs.rmSync(directory, { recursive: true, force: true });
+  });
+
+  return {
+    baseUrl: `http://127.0.0.1:${server.address().port}/api/v1`,
+    databaseA,
+    databaseB,
+    serviceCalls,
+    store,
+    tokenService,
+  };
+}
+
+test("tokens are hashed, deletable, and isolated per database", async (t) => {
+  const fixture = await startApi(t);
+  const created = fixture.tokenService.createToken(fixture.databaseA.id, "Automation");
+
+  assert.match(created.token, /^shub_[A-Za-z0-9_-]+$/);
+  assert.equal(fixture.tokenService.listTokens(fixture.databaseA.id)[0].token, undefined);
+
+  const stored = fixture.store.db
+    .prepare("SELECT token_hash, token_prefix FROM api_tokens WHERE id = ?")
+    .get(created.id);
+
+  assert.notEqual(stored.token_hash, created.token);
+  assert.equal(stored.token_prefix, created.tokenPrefix);
+  assert.equal(fixture.tokenService.authenticate(fixture.databaseA.id, created.token).id, created.id);
+  assert.throws(
+    () => fixture.tokenService.authenticate(fixture.databaseB.id, created.token),
+    /invalid for this database/
+  );
+
+  const validResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`,
+    { headers: { Authorization: `Bearer ${created.token}` } }
+  );
+  const validPayload = await validResponse.json();
+
+  assert.equal(validResponse.status, 200);
+  assert.deepEqual(validPayload.data.items, [{ name: "companies" }]);
+  assert.deepEqual(fixture.serviceCalls, [fixture.databaseA.id]);
+
+  const invalidResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`,
+    { headers: { Authorization: "Bearer invalid" } }
+  );
+  assert.equal(invalidResponse.status, 401);
+
+  const missingResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`
+  );
+  assert.equal(missingResponse.status, 401);
+
+  const wrongDatabaseResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseB.id}/tables`,
+    { headers: { Authorization: `Bearer ${created.token}` } }
+  );
+  assert.equal(wrongDatabaseResponse.status, 401);
+  assert.deepEqual(fixture.serviceCalls, [fixture.databaseA.id]);
+
+  fixture.tokenService.deleteToken(fixture.databaseA.id, created.id);
+  assert.equal(fixture.tokenService.listTokens(fixture.databaseA.id).length, 0);
+  assert.throws(
+    () => fixture.tokenService.authenticate(fixture.databaseA.id, created.token),
+    /invalid for this database/
+  );
+});
+
+test("public API info returns app and version status without a token", async (t) => {
+  const fixture = await startApi(t);
+  const response = await fetch(`${fixture.baseUrl}/info`);
+  const payload = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(payload.data.packageName, "sqlite-hub");
+  assert.equal(payload.data.appVersion, "1.0.1");
+  assert.equal(payload.data.sqliteVersion, "3.50.0");
+  assert.equal(payload.data.versionCheck.status, "current");
+  assert.equal(payload.data.versionCheck.updateAvailable, false);
+  assert.match(payload.data.url, /^http:\/\/127\.0\.0\.1:\d+$/);
+});
+
+test("query API executes raw SQL with a database token", async (t) => {
+  const fixture = await startApi(t);
+  const created = fixture.tokenService.createToken(fixture.databaseA.id, "Automation");
+  const response = await fetch(`${fixture.baseUrl}/query`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${created.token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      databaseId: fixture.databaseA.id,
+      sql: "SELECT 1",
+      store: "Stored API Query",
+    }),
+  });
+  const payload = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(payload.data.sql, "SELECT 1");
+  assert.equal(payload.data.historyId, 42);
+  assert.equal(payload.data.storedQuery.title, "Stored API Query");
+  assert.equal(payload.metadata.stored, true);
+  assert.equal(payload.metadata.databaseId, fixture.databaseA.id);
+  assert.deepEqual(fixture.serviceCalls, [
+    `${fixture.databaseA.id}:query:SELECT 1:Stored API Query`,
+  ]);
+});
+
+test("query API rejects read-only raw SQL execution", async (t) => {
+  const fixture = await startApi(t);
+  const created = fixture.tokenService.createToken(fixture.databaseA.id, "Automation");
+  const response = await fetch(`${fixture.baseUrl}/query`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${created.token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      databaseId: fixture.databaseA.id,
+      sql: "READONLY",
+    }),
+  });
+  const payload = await response.json();
+
+  assert.equal(response.status, 403);
+  assert.equal(payload.error.code, "SQLITE_READONLY");
+});

package/tests/cli-args.test.js

@@ -31,6 +31,11 @@ test("parses database info commands with the new schema", () => {
   assert.equal(parseCliArguments(["--database:db", "--lastopened"]).lastOpenedInfo, true);
 });
 
+test("parses app info command and keeps config as a legacy alias", () => {
+  assert.equal(parseCliArguments(["--info"]).info, true);
+  assert.equal(parseCliArguments(["--config"]).info, true);
+});
+
 test("keeps old sqleditor aliases working", () => {
   const listOptions = parseCliArguments(["--database:Unit-00", "--sqleditor"]);
   const executeOptions = parseCliArguments(["--database:Unit-00", "--sqleditor:Saved Query"]);
@@ -50,8 +55,13 @@ test("keeps old database detail aliases working", () => {
   assert.equal(tableOptions.tables, true);
 });
 
-test("parses query display and export commands", () => {
-  const showOptions = parseCliArguments(["--database:db", "--query:Stock Winners"]);
+test("parses raw query, store name, saved query display, and export commands", () => {
+  const rawOptions = parseCliArguments([
+    "--database:db",
+    "--query:SELECT 1",
+    "--store:Stored Select",
+  ]);
+  const showOptions = parseCliArguments(["--database:db", "--saved-query:Stock Winners"]);
   const notesOptions = parseCliArguments(["--database:db", "--notes:Stock Winners"]);
   const exportOptions = parseCliArguments([
     "--database:db",
@@ -59,6 +69,8 @@ test("parses query display and export commands", () => {
     "--format:md",
   ]);
 
+  assert.equal(rawOptions.rawQuery, "SELECT 1");
+  assert.equal(rawOptions.storeName, "Stored Select");
   assert.equal(showOptions.showQuery, "Stock Winners");
   assert.equal(notesOptions.showNotes, "Stock Winners");
   assert.equal(exportOptions.exportTarget, "Stock Winners");
@@ -96,5 +108,6 @@ test("parses document commands", () => {
 test("validates export formats", () => {
   assert.equal(normalizeExportFormat("csv"), "csv");
   assert.equal(normalizeExportFormat("TSV"), "tsv");
-  assert.throws(() => normalizeExportFormat("json"), /Unsupported export format/);
+  assert.equal(normalizeExportFormat("json"), "json");
+  assert.throws(() => normalizeExportFormat("xlsx"), /Unsupported export format/);
 });

package/tests/cli-service-delegation.test.js

@@ -0,0 +1,43 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const { main } = require("../bin/sqlite-hub");
+
+test("CLI delegates database operations to the shared command service", async () => {
+  const calls = [];
+  const connection = {
+    id: "db-one",
+    label: "Database One",
+  };
+  const databaseService = {
+    getDatabase(reference) {
+      calls.push(["getDatabase", reference]);
+      return connection;
+    },
+    listDatabases() {
+      calls.push(["listDatabases"]);
+      return [connection];
+    },
+    listTables(reference) {
+      calls.push(["listTables", reference]);
+      return [{ name: "companies" }];
+    },
+  };
+  const output = [];
+  const originalLog = console.log;
+
+  console.log = (...values) => output.push(values.join(" "));
+
+  try {
+    await main(["--database:Database One", "--tables"], { databaseService });
+  } finally {
+    console.log = originalLog;
+  }
+
+  assert.deepEqual(calls, [
+    ["listDatabases"],
+    ["getDatabase", "Database One"],
+    ["listTables", "db-one"],
+  ]);
+  assert.match(output.join("\n"), /companies/);
+});

package/tests/connections-file-dialog-route.test.js

@@ -15,6 +15,7 @@ test("connections route returns the path selected by the native dialog", async (
       backupService: {},
       nativeFileDialogService: {
         chooseCreateDatabasePath: async () => "/tmp/new-database.sqlite",
+        chooseOpenDatabasePath: async () => "/tmp/existing-database.db",
       },
     })
   );
@@ -44,3 +45,45 @@ test("connections route returns the path selected by the native dialog", async (
     });
   }
 });
+
+test("connections route returns the existing database selected by the native dialog", async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(
+    "/api/connections",
+    createConnectionsRouter({
+      connectionManager: {},
+      importService: {},
+      backupService: {},
+      nativeFileDialogService: {
+        chooseCreateDatabasePath: async () => null,
+        chooseOpenDatabasePath: async () => "/tmp/existing-database.db",
+      },
+    })
+  );
+  app.use(errorMiddleware);
+
+  const server = await new Promise((resolve) => {
+    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
+  });
+
+  try {
+    const address = server.address();
+    const response = await fetch(
+      `http://127.0.0.1:${address.port}/api/connections/choose-open-path`,
+      { method: "POST" }
+    );
+    const payload = await response.json();
+
+    assert.equal(response.status, 200);
+    assert.equal(payload.success, true);
+    assert.deepEqual(payload.data, {
+      cancelled: false,
+      path: "/tmp/existing-database.db",
+    });
+  } finally {
+    await new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+  }
+});

package/tests/copy-column-modal.test.js

@@ -95,3 +95,37 @@ test("create database modal offers a native path picker and manual fallback", as
   assert.match(html, /name="path"/);
   assert.match(html, /enter an absolute path manually/);
 });
+
+test("open database modal offers a native file picker and manual fallback", async () => {
+  const { renderOpenConnectionForm } = await loadModalModule();
+  const html = renderOpenConnectionForm({
+    kind: "open-connection",
+    error: null,
+    submitting: false,
+  });
+
+  assert.match(html, /data-action="choose-open-database-path"/);
+  assert.match(html, /data-open-database-path/);
+  assert.match(html, /name="path"/);
+  assert.match(html, /enter an absolute path manually/);
+});
+
+test("API token deletion uses the shared confirmation modal", async () => {
+  const { renderDeleteApiTokenForm } = await loadModalModule();
+  const html = renderDeleteApiTokenForm({
+    kind: "delete-api-token",
+    tokenId: "token-one",
+    tokenName: "Automation",
+    tokenPrefix: "shub_example",
+    databaseLabel: "Database One",
+    error: null,
+    submitting: false,
+  });
+
+  assert.match(html, /Delete API token/);
+  assert.match(html, /Automation/);
+  assert.match(html, /Database One/);
+  assert.match(html, /shub_example\.\.\./);
+  assert.match(html, /data-form="delete-api-token-confirm"/);
+  assert.match(html, /Delete Token/);
+});

package/tests/database-command-service.test.js

@@ -0,0 +1,139 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const Database = require("better-sqlite3");
+
+const { DatabaseCommandService } = require("../server/services/databaseCommandService");
+const { AppStateStore } = require("../server/services/storage/appStateStore");
+
+function createFixture(t, options = {}) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-command-service-"));
+  const databasePath = path.join(directory, "sample.db");
+  const targetDb = new Database(databasePath);
+
+  targetDb.exec(`
+    CREATE TABLE companies (id INTEGER PRIMARY KEY, name TEXT NOT NULL);
+    INSERT INTO companies (name) VALUES ('Acme'), ('Globex');
+  `);
+  targetDb.close();
+
+  const store = new AppStateStore(path.join(directory, "state.db"));
+  const connection = {
+    id: "db-sample",
+    label: "Sample",
+    path: databasePath,
+    lastOpenedAt: new Date().toISOString(),
+    lastModifiedAt: new Date().toISOString(),
+    sizeBytes: fs.statSync(databasePath).size,
+    readOnly: Boolean(options.readOnly),
+    logoPath: null,
+  };
+
+  store.upsertRecentConnection(connection);
+  store.db
+    .prepare(
+      `
+        INSERT INTO query_history (
+          database_key,
+          normalized_sql,
+          raw_sql,
+          title,
+          notes,
+          query_type,
+          tables_detected,
+          is_saved,
+          first_executed_at,
+          last_used_at
+        )
+        VALUES (?, ?, ?, ?, ?, 'select', '["companies"]', 1, ?, ?)
+      `
+    )
+    .run(
+      connection.id,
+      "select id, name from companies order by id",
+      "SELECT id, name FROM companies ORDER BY id",
+      "Company List",
+      "Used by CLI and API",
+      new Date().toISOString(),
+      new Date().toISOString()
+    );
+  store.createDatabaseDocument(connection.id, {
+    filename: "Readme.md",
+    content: "# Sample\n",
+  });
+
+  t.after(() => {
+    store.db.close();
+    fs.rmSync(directory, { recursive: true, force: true });
+  });
+
+  return {
+    connection,
+    service: new DatabaseCommandService({ appStateStore: store }),
+    store,
+  };
+}
+
+test("database command service provides shared CLI and API operations", (t) => {
+  const { connection, service } = createFixture(t);
+
+  assert.equal(service.getDatabase("sample").id, connection.id);
+  assert.deepEqual(service.listTables(connection.id), [{ name: "companies" }]);
+  assert.equal(service.getTable(connection.id, "companies").rowCount, 2);
+
+  const row = service.getTableRow(connection.id, "companies", "1");
+  assert.deepEqual(row.data, { id: 1, name: "Acme" });
+  assert.equal(row.identity.kind, "primaryKey");
+
+  const queries = service.listSavedQueries(connection.id);
+  assert.equal(queries.total, 1);
+  assert.equal(service.getSavedQuery(connection.id, "Company List").notes, "Used by CLI and API");
+
+  const execution = service.executeSavedQuery(connection.id, "Company List");
+  assert.equal(execution.result.statements[0].rowCount, 2);
+
+  const exported = service.exportSavedQuery(connection.id, "Company List", "csv");
+  assert.equal(exported.result.rowCount, 2);
+  assert.match(exported.result.content, /Acme/);
+
+  assert.equal(service.listDocuments(connection.id).length, 1);
+  assert.equal(service.getDocument(connection.id, "Readme").content, "# Sample\n");
+});
+
+test("raw query execution writes SQL Editor query history", (t) => {
+  const { connection, service, store } = createFixture(t);
+  const beforeCount = Number(
+    store.db.prepare("SELECT COUNT(*) AS count FROM query_history").get().count
+  );
+  const { result, storedQuery } = service.executeRawQuery(
+    connection.id,
+    "INSERT INTO companies (name) VALUES ('Initech')",
+    { storeName: "Add Initech" }
+  );
+  const afterCount = Number(
+    store.db.prepare("SELECT COUNT(*) AS count FROM query_history").get().count
+  );
+  const historyRow = store.db
+    .prepare("SELECT raw_sql, query_type, title, is_saved FROM query_history WHERE id = ?")
+    .get(result.historyId);
+
+  assert.equal(result.affectedRowCount, 1);
+  assert.equal(afterCount, beforeCount + 1);
+  assert.equal(historyRow.raw_sql, "INSERT INTO companies (name) VALUES ('Initech')");
+  assert.equal(historyRow.query_type, "insert");
+  assert.equal(historyRow.title, "Add Initech");
+  assert.equal(historyRow.is_saved, 1);
+  assert.equal(storedQuery.title, "Add Initech");
+  assert.equal(storedQuery.isSaved, true);
+});
+
+test("raw query execution is blocked for read-only connections", (t) => {
+  const { connection, service } = createFixture(t, { readOnly: true });
+
+  assert.throws(
+    () => service.executeRawQuery(connection.id, "SELECT 1"),
+    /read-only database/
+  );
+});

package/tests/export-blob.test.js

@@ -1,10 +1,29 @@
 const Database = require("better-sqlite3");
 const assert = require("node:assert/strict");
+const parquet = require("parquetjs-lite");
 const test = require("node:test");
 const { ExportService } = require("../server/services/sqlite/exportService");
 const { SqlExecutor } = require("../server/services/sqlite/sqlExecutor");
 
-test("query and table exports include complete BLOB data", () => {
+async function readParquetRows(buffer) {
+  const reader = await parquet.ParquetReader.openBuffer(buffer);
+  const cursor = reader.getCursor();
+  const rows = [];
+
+  try {
+    let row;
+
+    while ((row = await cursor.next())) {
+      rows.push(row);
+    }
+  } finally {
+    await reader.close();
+  }
+
+  return rows;
+}
+
+test("query and table exports include complete BLOB data", async () => {
   const db = new Database(":memory:");
   const blob = Buffer.from(Array.from({ length: 100 }, (_, index) => index));
 
@@ -33,13 +52,47 @@ test("query and table exports include complete BLOB data", () => {
       "SELECT payload FROM files ORDER BY id",
       { format: "csv" }
     );
+    const queryJsonExport = exportService.exportQuery(
+      "SELECT payload FROM files ORDER BY id",
+      { format: "json" }
+    );
     const tableExport = exportService.exportTable("files", { format: "tsv" });
+    const jsonExport = exportService.exportTable("files", { format: "json" });
+    const queryParquetExport = await exportService.exportQueryDownload(
+      "SELECT id, payload FROM files ORDER BY id",
+      { format: "parquet" }
+    );
+    const tableParquetExport = await exportService.exportTableDownload("files", { format: "parquet" });
 
     for (const content of [queryExport.content, tableExport.content]) {
       assert.equal(content.includes(expectedBase64), true);
       assert.match(content, /""encoding"":""base64""/);
       assert.doesNotMatch(content, /base64Preview|hexPreview/);
     }
+
+    assert.equal(jsonExport.mimeType, "application/json; charset=utf-8");
+    assert.equal(jsonExport.filename, "files.json");
+
+    const [queryJsonRow] = JSON.parse(queryJsonExport.content);
+    const [jsonRow] = JSON.parse(jsonExport.content);
+    assert.equal(queryJsonExport.mimeType, "application/json; charset=utf-8");
+    assert.equal(queryJsonRow.payload.encoding, "base64");
+    assert.equal(queryJsonRow.payload.data, expectedBase64);
+    assert.equal(jsonRow.payload.encoding, "base64");
+    assert.equal(jsonRow.payload.data, expectedBase64);
+    assert.equal(jsonRow.payload.sizeBytes, blob.length);
+    assert.equal(jsonExport.content.includes("base64Preview"), false);
+    assert.equal(jsonExport.content.includes("hexPreview"), false);
+
+    assert.equal(queryParquetExport.mimeType, "application/vnd.apache.parquet");
+    assert.equal(queryParquetExport.filename.endsWith(".parquet"), true);
+    assert.equal(Buffer.isBuffer(queryParquetExport.content), true);
+    assert.equal(tableParquetExport.filename, "files.parquet");
+
+    const [queryParquetRow] = await readParquetRows(queryParquetExport.content);
+    const [tableParquetRow] = await readParquetRows(tableParquetExport.content);
+    assert.equal(queryParquetRow.payload.equals(blob), true);
+    assert.equal(tableParquetRow.payload.equals(blob), true);
   } finally {
     db.close();
   }

package/tests/export-filenames.test.js

@@ -24,6 +24,8 @@ test("text export filenames use the selected format extension", async () => {
 
   assert.equal(buildTextExportFilename("query-results.csv", { format: "tsv" }), "query-results.tsv");
   assert.equal(buildTextExportFilename("white_house_live_streams", { format: "md" }), "white_house_live_streams.md");
+  assert.equal(buildTextExportFilename("companies.tsv", { format: "json" }), "companies.json");
+  assert.equal(buildTextExportFilename("companies.json", { format: "parquet" }), "companies.parquet");
 });
 
 test("text export filenames sanitize unsafe names and fallback when empty", async () => {
@@ -31,4 +33,6 @@ test("text export filenames sanitize unsafe names and fallback when empty", asyn
 
   assert.equal(buildTextExportFilename("", { format: "csv", fallback: "table" }), "table.csv");
   assert.equal(buildTextExportFilename("../bad:name?.csv", { format: "csv", fallback: "table" }), "bad name.csv");
+  assert.equal(buildTextExportFilename("bad:name?.json", { format: "json", fallback: "table" }), "bad name.json");
+  assert.equal(buildTextExportFilename("bad:name?.parquet", { format: "parquet", fallback: "table" }), "bad name.parquet");
 });

package/tests/form-controls.test.js

@@ -0,0 +1,34 @@
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const test = require('node:test');
+
+let formControlsModulePromise = null;
+
+function loadFormControlsModule() {
+    if (!formControlsModulePromise) {
+        formControlsModulePromise = import(
+            pathToFileURL(path.resolve(__dirname, '../frontend/js/components/formControls.js')).href
+        );
+    }
+
+    return formControlsModulePromise;
+}
+
+test('standard text input uses the shared application styling', async () => {
+    const { renderTextInput } = await loadFormControlsModule();
+    const markup = renderTextInput({
+        className: 'flex-1',
+        dataAttributes: { tokenName: true },
+        maxlength: 80,
+        placeholder: 'Token name',
+    });
+
+    assert.match(markup, /control-input/);
+    assert.match(markup, /border-outline-variant\/20/);
+    assert.match(markup, /bg-surface-container-lowest/);
+    assert.match(markup, /placeholder:text-on-surface-variant\/35/);
+    assert.match(markup, /focus:border-primary-container/);
+    assert.match(markup, /data-token-name/);
+    assert.match(markup, /maxlength="80"/);
+});